diff --git a/.agents/skills/pr/SKILL.md b/.agents/skills/pr/SKILL.md
index 6a72949c96..f2a9ec8dad 100644
--- a/.agents/skills/pr/SKILL.md
+++ b/.agents/skills/pr/SKILL.md
@@ -210,7 +210,7 @@ the diff first — `git diff --name-only main...HEAD` answers most of these.
 **Flip without asking** when it is self-contained: a single-file fix, test-only, docs-only, one
 call site, no new public surface.
 
-Unattended (webmux oneshot) there is nobody to ask, so the judgement holds and the action
+Unattended (a one-shot run) there is nobody to ask, so the judgement holds and the action
 degrades: flip the self-contained ones, and leave the rest at a clean draft with a line in the PR
 description saying why — `left in draft: adds a migration, wants a human look before ready`.
 Don't flip a wide-blast-radius change just because the round came back clean, and don't ask a
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 80970d1e76..0d174a548f 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,4 +1,13 @@
-# Basic set up for three package managers
+# Weekly, grouped version updates for every shipped manifest, plus one grouped
+# security-update PR per manifest. Security-update PRs have no open-PR limit, so
+# without an `applies-to: security-updates` group each alert would get its own PR.
+# Bun has no security updates: /cli alerts are fixed through its version group.
+#
+# Deliberately NOT covered here:
+#   - /rust-client: Cargo.toml is generated and gitignored
+#   - /backend/parsers/windmill-parser-wasm: excluded from the workspace, needs nightly cargo
+#   - /benchmarks/pulumi: one-off load-test infrastructure, not shipped
+#   - /integration_tests: CI-only
 
 version: 2
 updates:
@@ -13,12 +22,32 @@ updates:
     directory: "/frontend"
     schedule:
       interval: "weekly"
+    groups:
+      # minor + patch bumps in one PR; majors in their own PR so they can be
+      # reviewed separately without blocking the routine bumps
+      frontend-deps:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
+      frontend-majors:
+        patterns: ["*"]
+        update-types: ["major"]
+      frontend-security:
+        applies-to: security-updates
+        patterns: ["*"]
 
   # Maintain dependencies for cargo
   - package-ecosystem: "cargo"
     directory: "/backend"
     schedule:
       interval: "weekly"
+    groups:
+      # majors stay as individual PRs: they usually need code changes
+      cargo-deps:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
+      cargo-security:
+        applies-to: security-updates
+        patterns: ["*"]
 
   # Maintain dependencies for Docker
   - package-ecosystem: "docker"
@@ -31,3 +60,52 @@ updates:
     directory: "/python-client/wmill"
     schedule:
       interval: "weekly"
+    groups:
+      python-client-security:
+        applies-to: security-updates
+        patterns: ["*"]
+
+  # Maintain dependencies for the CLI (bun.lock)
+  - package-ecosystem: "bun"
+    directory: "/cli"
+    schedule:
+      interval: "weekly"
+    groups:
+      cli-deps:
+        patterns: ["*"]
+
+  # Maintain dependencies for the YAML validator
+  - package-ecosystem: "npm"
+    directory: "/windmill-yaml-validator"
+    schedule:
+      interval: "weekly"
+    groups:
+      yaml-validator-deps:
+        patterns: ["*"]
+      yaml-validator-security:
+        applies-to: security-updates
+        patterns: ["*"]
+
+  # Maintain dependencies for the TypeScript client (devDependencies only)
+  - package-ecosystem: "npm"
+    directory: "/typescript-client"
+    schedule:
+      interval: "weekly"
+    groups:
+      typescript-client-deps:
+        patterns: ["*"]
+      typescript-client-security:
+        applies-to: security-updates
+        patterns: ["*"]
+
+  # Maintain dependencies for multiplayer
+  - package-ecosystem: "npm"
+    directory: "/multiplayer"
+    schedule:
+      interval: "weekly"
+    groups:
+      multiplayer-deps:
+        patterns: ["*"]
+      multiplayer-security:
+        applies-to: security-updates
+        patterns: ["*"]
diff --git a/.github/workflows/ai-agent-tests.yml b/.github/workflows/ai-agent-tests.yml
index cd07602109..8a3e9e6dbc 100644
--- a/.github/workflows/ai-agent-tests.yml
+++ b/.github/workflows/ai-agent-tests.yml
@@ -63,11 +63,11 @@ jobs:
         with:
           bun-version: 1.4.0
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: "20"
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
diff --git a/.github/workflows/ai-evals-test.yml b/.github/workflows/ai-evals-test.yml
index 87eefab0f3..573bc77df9 100644
--- a/.github/workflows/ai-evals-test.yml
+++ b/.github/workflows/ai-evals-test.yml
@@ -77,7 +77,7 @@ jobs:
         with:
           bun-version: 1.4.0
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           # Node 24 ships npm 11, which frontend/package-lock.json is authored
           # with; npm 10 rejects it ("Missing: picomatch@4.0.5 from lock file").
diff --git a/.github/workflows/backend-test-windows.yml b/.github/workflows/backend-test-windows.yml
index f9153c0ce0..54a62ec495 100644
--- a/.github/workflows/backend-test-windows.yml
+++ b/.github/workflows/backend-test-windows.yml
@@ -67,7 +67,7 @@ jobs:
           # tests what production runs, instead of floating on the latest v2.x.
           deno-version: 2.2.1
 
-      - uses: actions/setup-go@v2
+      - uses: actions/setup-go@v7
         with:
           go-version: 1.21.5
 
@@ -75,11 +75,11 @@ jobs:
         with:
           bun-version: 1.4.0
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: "20"
 
-      - uses: astral-sh/setup-uv@v6.2.1
+      - uses: astral-sh/setup-uv@v7
         with:
           version: "0.11.24"
 
diff --git a/.github/workflows/backend-test.yml b/.github/workflows/backend-test.yml
index 9f65c2ae47..466259f6f8 100644
--- a/.github/workflows/backend-test.yml
+++ b/.github/workflows/backend-test.yml
@@ -53,16 +53,16 @@ jobs:
           # Pin to the Deno version shipped in the runtime image (Dockerfile) so CI
           # tests what production runs, instead of floating on the latest v2.x.
           deno-version: 2.2.1
-      - uses: actions/setup-go@v2
+      - uses: actions/setup-go@v7
         with:
           go-version: 1.21.5
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: 1.4.0
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: "24"
-      - uses: astral-sh/setup-uv@v6.2.1
+      - uses: astral-sh/setup-uv@v7
         with:
           version: "0.11.24"
       - uses: shivammathur/setup-php@v2
@@ -295,4 +295,4 @@ jobs:
           # never reaches it. Pin the target dir (matching the cache step above) so
           # its own tests run off this compile rather than a second bundled build.
           (cd windmill-duckdb-ffi-internal && export CARGO_TARGET_DIR="$PWD/target" && ./build_dev.sh && cargo test --release -p windmill_duckdb_ffi_internal)
-          DENO_PATH=$(which deno) BUN_PATH=$(which bun) NODE_BIN_PATH=$(which node) GO_PATH=$(which go) UV_PATH=$(which uv) PHP_PATH=$(which php) COMPOSER_PATH=$(which composer) RUBY_PATH=$(which ruby) RUBY_BUNDLE_PATH=$(which bundle) RUBY_GEM_PATH=$(which gem) POWERSHELL_PATH=$(which pwsh) DOTNET_PATH=$(which dotnet) cargo test --features enterprise,deno_core,duckdb,license,python,rust,scoped_cache,parquet,private,private_registry_test,csharp,php,ruby,mysql,quickjs,mcp,run_inline --all -- --nocapture --test-threads=10
+          DENO_PATH=$(which deno) BUN_PATH=$(which bun) NODE_BIN_PATH=$(which node) GO_PATH=$(which go) UV_PATH=$(which uv) PHP_PATH=$(which php) COMPOSER_PATH=$(which composer) RUBY_PATH=$(which ruby) RUBY_BUNDLE_PATH=$(which bundle) RUBY_GEM_PATH=$(which gem) POWERSHELL_PATH=$(which pwsh) DOTNET_PATH=$(which dotnet) cargo test --features enterprise,deno_core,duckdb,license,python,rust,scoped_cache,parquet,private,private_registry_test,csharp,php,ruby,mysql,quickjs,mcp,run_inline,smtp --all -- --nocapture --test-threads=10
diff --git a/.github/workflows/check-docs-links.yml b/.github/workflows/check-docs-links.yml
index ec17c06771..e32e976f0c 100644
--- a/.github/workflows/check-docs-links.yml
+++ b/.github/workflows/check-docs-links.yml
@@ -16,7 +16,7 @@ jobs:
           sparse-checkout: |
             frontend/src
             .github/scripts
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: "22.x"
       - name: Verify docs links are not 404
diff --git a/.github/workflows/check-system-prompts.yml b/.github/workflows/check-system-prompts.yml
index 3e684c82f9..370a177716 100644
--- a/.github/workflows/check-system-prompts.yml
+++ b/.github/workflows/check-system-prompts.yml
@@ -28,7 +28,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/cli-tests.yml b/.github/workflows/cli-tests.yml
index e26231eda4..19afa777ae 100644
--- a/.github/workflows/cli-tests.yml
+++ b/.github/workflows/cli-tests.yml
@@ -43,7 +43,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "20"
 
@@ -89,7 +89,7 @@ jobs:
           cache-workspaces: backend
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "20"
 
@@ -143,7 +143,7 @@ jobs:
           cache-workspaces: backend
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "20"
 
diff --git a/.github/workflows/codex-pr-review.yml b/.github/workflows/codex-pr-review.yml
index 7a3882df7c..55036776c6 100644
--- a/.github/workflows/codex-pr-review.yml
+++ b/.github/workflows/codex-pr-review.yml
@@ -40,11 +40,14 @@ jobs:
     # an author_association gate: the pull_request webhook payload reports private org
     # members as CONTRIBUTOR/NONE (only public members show as MEMBER), which silently
     # skips auto-review for every private member.
+    # Dependabot-triggered runs get a separate secret scope, so this job has no API
+    # key and cannot review. workflow_call stays open for an explicit request.
     if: |
       github.event_name == 'workflow_call' ||
       (
         github.event.pull_request.draft == false &&
-        github.event.pull_request.head.repo.fork == false
+        github.event.pull_request.head.repo.fork == false &&
+        github.event.pull_request.user.login != 'dependabot[bot]'
       )
     permissions:
       contents: read
@@ -213,7 +216,7 @@ jobs:
 
       - name: Set up Node.js
         if: steps.codex_config.outputs.enabled == 'true' && steps.pr.outputs.skip != 'true'
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: 22
 
diff --git a/.github/workflows/discord-notification.yml b/.github/workflows/discord-notification.yml
index d731faafd9..c83cbc90d3 100644
--- a/.github/workflows/discord-notification.yml
+++ b/.github/workflows/discord-notification.yml
@@ -13,7 +13,8 @@ on:
 
 jobs:
   notify_discord_when_pr_opened:
-    if: (github.event.pull_request.draft == false) && (github.event.action == 'opened' || github.event.action == 'ready_for_review')
+    # No thread is opened for Dependabot PRs, so nothing downstream may assume one.
+    if: (github.event.pull_request.draft == false) && (github.event.action == 'opened' || github.event.action == 'ready_for_review') && (github.event.pull_request.user.login != 'dependabot[bot]')
     uses: ./.github/workflows/shareable-discord-notification.yml
     with:
       PR_TITLE: ${{ github.event.pull_request.title }}
@@ -28,7 +29,8 @@ jobs:
       DISCORD_BOT_TOKEN: ${{ secrets.DISCORD_AI_BOT_TOKEN }}
 
   merge_success_emoji:
-    if: github.event.action == 'closed'
+    # Must match open_thread's exclusion: this reacts to a thread that was never created.
+    if: github.event.action == 'closed' && github.event.pull_request.user.login != 'dependabot[bot]'
     uses: ./.github/workflows/shareable-discord-notification.yml
     with:
       PR_STATUS: "merged"
diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
index a8b20623bc..c94521d332 100644
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -40,6 +40,11 @@ jobs:
     runs-on: ubicloud
     if: (github.event_name != 'workflow_dispatch') || (github.event.inputs &&
       !github.event.inputs.ee)
+    # Jobs that build from, extract or retag this image must reference it by
+    # this digest: concurrent main-branch runs push :dev too, so a tag run
+    # reading :dev can ship a main build under the release version.
+    outputs:
+      digest: ${{ steps.docker_build.outputs.digest }}
     steps:
       - uses: actions/checkout@v4
         with:
@@ -112,6 +117,8 @@ jobs:
   build_ee:
     runs-on: ubicloud
     if: (github.event_name != 'workflow_dispatch') || github.event.inputs.ee
+    outputs:
+      digest: ${{ steps.docker_build.outputs.digest }}
     steps:
       - uses: actions/checkout@v4
         with:
@@ -192,31 +199,31 @@ jobs:
       - uses: actions/checkout@v4
       - run: |
           # pulling docker image with desired arch so that actions-docker-extract doesn't do it
-          docker pull --platform "linux/$ARCH" ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEV_SHA }}
-          docker pull --platform "linux/$ARCH" ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:${{ env.DEV_SHA }}
+          docker pull --platform "linux/$ARCH" ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ needs.build.outputs.digest }}
+          docker pull --platform "linux/$ARCH" ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee@${{ needs.build_ee.outputs.digest }}
 
       - run: |
           # Checks the image is in docker prior to running actions-docker-extract. It fails if not
           # Also useful to visually check that the arch is the right opencontainers
-          docker image inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEV_SHA }}
-          docker image inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:${{ env.DEV_SHA }}
+          docker image inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ needs.build.outputs.digest }}
+          docker image inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee@${{ needs.build_ee.outputs.digest }}
 
       - uses: shrink/actions-docker-extract@v3
         id: extract
         with:
-          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEV_SHA }}
+          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ needs.build.outputs.digest }}
           path: "/usr/src/app/windmill"
 
       - uses: shrink/actions-docker-extract@v3
         id: extract-duckdb-ffi-internal
         with:
-          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEV_SHA }}
+          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ needs.build.outputs.digest }}
           path: "/usr/src/app/libwindmill_duckdb_ffi_internal.so"
 
       - uses: shrink/actions-docker-extract@v3
         id: extract-ee
         with:
-          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:${{ env.DEV_SHA }}
+          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee@${{ needs.build_ee.outputs.digest }}
           path: "/usr/src/app/windmill"
 
       - name: Rename binary with corresponding architecture
@@ -373,8 +380,8 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Tag main and latest
         run: |
-          docker buildx imagetools create ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEV_SHA }} --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-          docker buildx imagetools create ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEV_SHA }} --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:main
+          docker buildx imagetools create ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ needs.build.outputs.digest }} --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+          docker buildx imagetools create ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ needs.build.outputs.digest }} --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:main
 
       - uses: sigstore/cosign-installer@v4.1.2
         if: startsWith(github.ref, 'refs/tags/v')
@@ -409,8 +416,8 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Tag main and latest for ee
         run: |
-          docker buildx imagetools create ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:${{ env.DEV_SHA }} --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:latest
-          docker buildx imagetools create ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:${{ env.DEV_SHA }} --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:main
+          docker buildx imagetools create ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee@${{ needs.build_ee.outputs.digest }} --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:latest
+          docker buildx imagetools create ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee@${{ needs.build_ee.outputs.digest }} --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:main
 
       - uses: sigstore/cosign-installer@v4.1.2
         if: startsWith(github.ref, 'refs/tags/v')
@@ -447,12 +454,18 @@ jobs:
           dockerhub-user: windmilllabs
           dockerhub-password: ${{ secrets.DOCKER_PAT }}
 
+      # Filed under main, not under the release tag this job runs on. The scanned image is
+      # `-ee:main` and the Security tab only reads the default branch, so tag-only uploads
+      # left main's last Docker Scout result at 2025-01-29: the tool showed as failing and
+      # its alerts could never close. `sha` is the release commit, which is on main.
       - name: Upload SARIF result
         id: upload-sarif
         if: ${{ github.event_name != 'pull_request_target' }}
-        uses: github/codeql-action/upload-sarif@v2
+        uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: sarif.output.json
+          ref: refs/heads/main
+          sha: ${{ github.sha }}
 
   # docker_scout_ee:
   #   runs-on: ubicloud
@@ -549,6 +562,8 @@ jobs:
           push: true
           sbom: ${{ startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push' }}
           file: "./docker/DockerfileCuda"
+          build-args: |
+            BASE_IMAGE=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee@${{ needs.build_ee.outputs.digest }}
           tags: |
             ${{ steps.meta-ee-public.outputs.tags }}
           labels: |
@@ -602,6 +617,8 @@ jobs:
           push: true
           sbom: ${{ startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push' }}
           file: "./docker/DockerfileSlim"
+          build-args: |
+            BASE_IMAGE=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ needs.build.outputs.digest }}
           tags: |
             ${{ steps.meta-ee-public.outputs.tags }}
           labels: |
@@ -656,6 +673,8 @@ jobs:
           push: true
           sbom: ${{ startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push' }}
           file: "./docker/DockerfileSlimEe"
+          build-args: |
+            BASE_IMAGE=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee@${{ needs.build_ee.outputs.digest }}
           tags: |
             ${{ steps.meta-ee-public.outputs.tags }}
           labels: |
@@ -709,6 +728,8 @@ jobs:
           push: true
           sbom: ${{ startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push' }}
           file: "./docker/DockerfileFull"
+          build-args: |
+            BASE_IMAGE=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ needs.build.outputs.digest }}
           tags: |
             ${{ steps.meta-public.outputs.tags }}
           labels: |
@@ -761,6 +782,8 @@ jobs:
           push: true
           sbom: ${{ startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push' }}
           file: "./docker/DockerfileFullEe"
+          build-args: |
+            BASE_IMAGE=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee@${{ needs.build_ee.outputs.digest }}
           tags: |
             ${{ steps.meta-ee-public.outputs.tags }}
           labels: |
diff --git a/.github/workflows/frontend-check.yml b/.github/workflows/frontend-check.yml
index 178ed53dc5..6347614e16 100644
--- a/.github/workflows/frontend-check.yml
+++ b/.github/workflows/frontend-check.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubicloud-standard-8
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: 24
           cache: "npm"
diff --git a/.github/workflows/git-sync-test.yml b/.github/workflows/git-sync-test.yml
index bd15ec8876..b19f899a20 100644
--- a/.github/workflows/git-sync-test.yml
+++ b/.github/workflows/git-sync-test.yml
@@ -141,7 +141,7 @@ jobs:
         with:
           deno-version: v2.x
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: "20"
 
diff --git a/.github/workflows/go_on_release.yml b/.github/workflows/go_on_release.yml
index 78ce12c6c3..6e53db09e7 100644
--- a/.github/workflows/go_on_release.yml
+++ b/.github/workflows/go_on_release.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubicloud-standard-8
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-go@v4
+      - uses: actions/setup-go@v7
       - name: install_jq
         run: |
           sudo apt-get update
diff --git a/.github/workflows/npm_on_release.yml b/.github/workflows/npm_on_release.yml
index 7d30265c74..631ab53153 100644
--- a/.github/workflows/npm_on_release.yml
+++ b/.github/workflows/npm_on_release.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubicloud-standard-8
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v7
         with:
           node-version: "20.x"
           registry-url: "https://registry.npmjs.org"
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubicloud-standard-8
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v7
         with:
           node-version: "20.x"
           registry-url: "https://registry.npmjs.org"
@@ -32,7 +32,7 @@ jobs:
     runs-on: ubicloud-standard-8
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v7
         with:
           node-version: "20.x"
           registry-url: "https://registry.npmjs.org"
diff --git a/.github/workflows/pi-pr-review.yml b/.github/workflows/pi-pr-review.yml
index 9b536b6ed5..a18dc28ff2 100644
--- a/.github/workflows/pi-pr-review.yml
+++ b/.github/workflows/pi-pr-review.yml
@@ -38,11 +38,14 @@ jobs:
     # an author_association gate: the pull_request webhook payload reports private org
     # members as CONTRIBUTOR/NONE (only public members show as MEMBER), which silently
     # skips auto-review for every private member.
+    # Dependabot-triggered runs get a separate secret scope, so this job has no API
+    # key and cannot review. workflow_call stays open for an explicit request.
     if: |
       github.event_name == 'workflow_call' ||
       (
         github.event.pull_request.draft == false &&
-        github.event.pull_request.head.repo.fork == false
+        github.event.pull_request.head.repo.fork == false &&
+        github.event.pull_request.user.login != 'dependabot[bot]'
       )
     permissions:
       contents: read
@@ -206,7 +209,7 @@ jobs:
 
       - name: Set up Node.js
         if: steps.pi_config.outputs.enabled == 'true' && steps.pr.outputs.skip != 'true'
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: 22
 
diff --git a/.github/workflows/pr-ready-review.yml b/.github/workflows/pr-ready-review.yml
index 4bfb5b4147..5e5c6a8c61 100644
--- a/.github/workflows/pr-ready-review.yml
+++ b/.github/workflows/pr-ready-review.yml
@@ -37,11 +37,14 @@ jobs:
     # an author_association gate: the pull_request webhook payload reports private org
     # members as CONTRIBUTOR/NONE (only public members show as MEMBER), which silently
     # skips auto-review for every private member.
+    # Dependabot-triggered runs get a separate secret scope, so this job has no API
+    # key and cannot review. workflow_call stays open for an explicit request.
     if: |
       github.event_name == 'workflow_call' ||
       (
         (github.event.pull_request.draft == false || github.event.pull_request.ready_for_review == true) &&
-        github.event.pull_request.head.repo.fork == false
+        github.event.pull_request.head.repo.fork == false &&
+        github.event.pull_request.user.login != 'dependabot[bot]'
       )
     permissions:
       contents: read
diff --git a/.github/workflows/publish-cli-docs.yml b/.github/workflows/publish-cli-docs.yml
index 9e76117eb5..d6a2bdb332 100644
--- a/.github/workflows/publish-cli-docs.yml
+++ b/.github/workflows/publish-cli-docs.yml
@@ -38,7 +38,7 @@ jobs:
           ssh-key: ${{ secrets.CLI_DOCS_DEPLOY_KEY }}
           fetch-depth: 0
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/sdk-tests.yml b/.github/workflows/sdk-tests.yml
index 6f7d79c6af..260fbb3a02 100644
--- a/.github/workflows/sdk-tests.yml
+++ b/.github/workflows/sdk-tests.yml
@@ -43,7 +43,7 @@ jobs:
         with:
           bun-version: latest
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: "20.x"
 
@@ -58,7 +58,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
 
       # The interpreter is named explicitly: on a clean checkout uv picks the
       # runner's system python and stops with "not compatible with the locked
diff --git a/.github/workflows/validate-openapi.yml b/.github/workflows/validate-openapi.yml
index 5bc59ebc4c..846621b503 100644
--- a/.github/workflows/validate-openapi.yml
+++ b/.github/workflows/validate-openapi.yml
@@ -15,7 +15,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '20'
 
diff --git a/.github/workflows/yaml-validator-tests.yml b/.github/workflows/yaml-validator-tests.yml
index 04d31451d4..c5524312cb 100644
--- a/.github/workflows/yaml-validator-tests.yml
+++ b/.github/workflows/yaml-validator-tests.yml
@@ -24,7 +24,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: "20"
 
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 103817a597..6dc5574962 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "1.814.0"
+  ".": "1.817.0"
 }
diff --git a/AGENTS.md b/AGENTS.md
index a315f1a67c..77b38c3267 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -55,12 +55,23 @@ Open-source platform for internal tools, workflows, API integrations, background
 > defaults in this section apply only to a plain single checkout. **Discover the real
 > values before running anything** — see "Per-worktree ports and database" below.
 
-**Check whether they are already running before starting anything.** In a webmux worktree
-(`$WEBMUX_WORKTREE_PATH` is set) the backend and frontend are already up in sibling tmux panes —
-use those, don't spawn your own. `tmux list-panes -t "$(tmux display-message -p -t "$TMUX_PANE"
-'#{window_id}')" -F '#{pane_index} #{pane_current_command}'` shows what is running; read its log
-with `tmux capture-pane`, and see `backend/AGENTS.md` to restart it with different cargo features.
-A second server started in your own shell fights the first one for the port. The commands below
+**Check whether they are already running before starting anything.** In a managed worktree the
+backend and frontend are already up in sibling panes — use those, don't spawn your own. A second
+server started in your own shell fights the first one for the port.
+
+**herdr** is the worktree manager; `$HERDR_ENV=1` marks one of its panes. `herdr pane list
+--workspace "$HERDR_WORKSPACE_ID"` lists this worktree's panes — match on `cwd`, since the servers
+run from `backend/` and `frontend/` — and `herdr pane read <pane_id> --source recent-unwrapped
+--lines 50` reads one's log; `herdr --skill` prints the full reference for
+inspecting and driving panes and agents. The plugins that provision these worktrees live in the
+private `windmill-labs/windmill-herdr` — clone it and run `./setup.sh` to install them and the
+keybindings they need.
+
+A worktree from the older **webmux** setup sets `$WEBMUX_WORKTREE_PATH` instead and is driven
+through tmux: `tmux list-panes -t "$(tmux display-message -p -t "$TMUX_PANE" '#{window_id}')" -F
+'#{pane_index} #{pane_current_command}'` for what is running, `tmux capture-pane` for a pane's log.
+
+See `backend/AGENTS.md` to restart the backend with different cargo features. The commands below
 are for a plain checkout with nothing running.
 
 - **Backend**: `cargo run` from `backend/` (API at http://localhost:8000)
@@ -72,10 +83,16 @@ are for a plain checkout with nothing running.
 
 ### Per-worktree ports and database
 
-In a webmux worktree the authoritative values live in
-`$(git rev-parse --git-dir)/webmux/runtime.env` — `BACKEND_PORT`, `FRONTEND_PORT`,
-`DATABASE_URL`, `CARGO_FEATURES`, `WM_DB_NAME`. Every pane sources it at startup. Read that
-first: it is not a `.env*` file, so the repo's secret-file read rules don't stand in the way.
+**`.env.local` in the worktree root holds the real values** — `BACKEND_PORT`, `FRONTEND_PORT`,
+`REMOTE`, `DATABASE_URL`, `CARGO_FEATURES`, `WM_DB_NAME`. Every manager writes those fields, so it
+is correct whichever one you are in. Read it with `cat .env.local` from a shell: the file-read
+tool denies every `.env.*` path, and `DATABASE_URL` is written with an `export` prefix that a
+`^DATABASE_URL=` grep misses.
+
+herdr keeps nothing besides that file; its hooks write it and read it back. A webmux worktree
+additionally has `$(git rev-parse --git-dir)/webmux/runtime.env`, which every pane sources at
+startup and which carries the extras `.env.local` lacks: `WEBMUX_*`, `WM_CLONE_DB`,
+`USE_RUST_PLUGIN`.
 
 In a plain checkout, fall back to `.env` / `.env.local` (repo root) and `backend/.env`.
 
@@ -84,19 +101,25 @@ hook. It is not a copy of the main dev instance: you get the `admins` workspace,
 `admin@windmill.dev` superadmin, the license key copied from the base database, and whatever the
 migrations seed — and none of your own workspaces, scripts, flows or apps. Create whatever a test
 needs. Cloning the base `windmill` database instead is
-opt-in per project via `WM_CLONE_DB` in `.webmux.yaml`; read the note there before turning it on.
+opt-in via `WM_CLONE_DB` (the `windmill.worktree` plugin's `config.env` under herdr, or
+`.webmux.yaml` under webmux); read the note in `.webmux.yaml` before turning it on.
 
 The database is named after the **worktree directory, not the branch** (`scripts/worktree-common.sh`):
 `windmill_` + the directory basename with `-` → `_`, which Postgres then truncates at 63
-characters. Branch `hugo/win-2340-ai-agent-evals-standalone-agent-runs-and-eval-datasets` sits in
-a worktree directory named `win-2340-…`, so its database is
-`windmill_win_2340_ai_agent_evals_standalone_agent_runs_and_eval` — no `hugo_`, and the tail
-chopped. Take `WM_DB_NAME` from `runtime.env` instead of reconstructing the name. Read those, or
-discover from what is already running:
+characters. herdr creates the directory under `~/.herdr/worktrees/<repo>/` from the branch name
+with each `/` turned into `-`, so branch
+`hugo/win-2544-add-options-field-to-the-postgresql-resource-type` gets the database
+`windmill_hugo_win_2544_add_options_field_to_the_postgresql_reso` — the whole branch name, cut
+mid-word at the limit. The two drift apart as soon as the branch is renamed, and webmux named its
+directories after the ticket alone, so reconstructing the name from the branch you are on is
+wrong in both. Take `WM_DB_NAME` from `.env.local` instead. Read that, or discover from what is
+already running:
 
 ```bash
+# match on the worktree directory, truncated the way Postgres truncates it (63 - len('windmill_')):
 psql postgres://postgres:changeme@localhost:5432/postgres -tAc \
-  "select datname from pg_database where datname like 'windmill%'" | grep "$(git branch --show-current | tr - _)"
+  "select datname from pg_database where datname like 'windmill%'" \
+  | grep -F "$(basename "$(git rev-parse --show-toplevel)" | tr '/-' '_' | cut -c1-54)"
 # the port the frontend actually proxies to (REMOTE of this worktree's vite):
 for p in $(pgrep -f vite); do case "$(readlink /proc/$p/cwd)" in *"$(basename "$(git rev-parse --show-toplevel)")"*)
   tr '\0' '\n' < /proc/$p/environ | grep -E '^REMOTE=|^PORT=';; esac; done
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9a5ee31990..595426d619 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,93 @@
 # Changelog
 
+## [1.817.0](https://github.com/windmill-labs/windmill/compare/v1.816.0...v1.817.0) (2026-09-22)
+
+
+### Features
+
+* add workspace mentions to AI composer ([#11264](https://github.com/windmill-labs/windmill/issues/11264)) ([e7ba595](https://github.com/windmill-labs/windmill/commit/e7ba5954b69514d72c140f9b1e697fb2236df23e))
+* allow workspace-scoped dynamic custom tags ([#11283](https://github.com/windmill-labs/windmill/issues/11283)) ([efa7a0a](https://github.com/windmill-labs/windmill/commit/efa7a0a70af43f8827542059dd450326a9b88d62))
+* check dynamic worker tags on the tag they resolve to ([#11271](https://github.com/windmill-labs/windmill/issues/11271)) ([69fafb9](https://github.com/windmill-labs/windmill/commit/69fafb9262f90184e6c2dc9a84f1c3feeb9d9638))
+* deploy from the UI to a workspace on another instance ([#11245](https://github.com/windmill-labs/windmill/issues/11245)) ([4d12ea4](https://github.com/windmill-labs/windmill/commit/4d12ea461454f89367bd91daa7e8c39a89035507))
+
+
+### Bug Fixes
+
+* add missing credential fields to settings redaction lists ([#11272](https://github.com/windmill-labs/windmill/issues/11272)) ([2a40f25](https://github.com/windmill-labs/windmill/commit/2a40f25bda81d41b9f578338c85656744f59ebfc))
+* apply SSRF validation to workspace webhook URLs ([#11285](https://github.com/windmill-labs/windmill/issues/11285)) ([586699c](https://github.com/windmill-labs/windmill/commit/586699c4938b5203920a43e69a706310078b93f5))
+* apply token path scopes to the native trigger list ([#11281](https://github.com/windmill-labs/windmill/issues/11281)) ([faf7b22](https://github.com/windmill-labs/windmill/commit/faf7b22be0827738c90c1f3ed6cd3e214d6c63d3))
+* check workflow-as-code task tags against CUSTOM_TAGS ([#11273](https://github.com/windmill-labs/windmill/issues/11273)) ([2699d50](https://github.com/windmill-labs/windmill/commit/2699d5065ea3dfe985636733fb6022ca23187291))
+* clear the impersonation token from session storage on logout ([#11274](https://github.com/windmill-labs/windmill/issues/11274)) ([9936673](https://github.com/windmill-labs/windmill/commit/9936673ee62fb6dd929a654a6138aeca687c0fb7))
+* enforce token path scopes on GET /raw_apps/list ([#11284](https://github.com/windmill-labs/windmill/issues/11284)) ([9ad2c91](https://github.com/windmill-labs/windmill/commit/9ad2c91ddb661ab60ada9ec4039ef8d025602969))
+* keep a cancel that lands after a worker last read its queue row ([#11246](https://github.com/windmill-labs/windmill/issues/11246)) ([02006f3](https://github.com/windmill-labs/windmill/commit/02006f364a4217e967435d9e71d8617c03b65413))
+* size the AI chat output budget by model, not provider ([#11286](https://github.com/windmill-labs/windmill/issues/11286)) ([7d0f2ce](https://github.com/windmill-labs/windmill/commit/7d0f2ce3bf920a68f1ea22d59481d239947f1b51))
+* stop cutting DeepSeek chat turns off mid-thought ([#11282](https://github.com/windmill-labs/windmill/issues/11282)) ([5821700](https://github.com/windmill-labs/windmill/commit/58217006ece56bbaf0447af67cac487e72b928c7))
+* stop the raw app editor stealing focus in ai sessions ([#11287](https://github.com/windmill-labs/windmill/issues/11287)) ([7322143](https://github.com/windmill-labs/windmill/commit/732214361f36eb07d65854118bd053c96ce681fb))
+
+## [1.816.0](https://github.com/windmill-labs/windmill/compare/v1.815.0...v1.816.0) (2026-09-21)
+
+
+### Features
+
+* add an ACL editor for data table roles ([#11063](https://github.com/windmill-labs/windmill/issues/11063)) ([9994e03](https://github.com/windmill-labs/windmill/commit/9994e03bc75404503001a5db37e175b66e7371f2))
+* add per-model context window override in workspace AI settings ([#11232](https://github.com/windmill-labs/windmill/issues/11232)) ([c637b06](https://github.com/windmill-labs/windmill/commit/c637b06a548a5725aceb7504bcb62383d35614ac))
+* **ai-chat:** disclose an app's exposure on deploy, refuse drag-and-drop apps ([#11137](https://github.com/windmill-labs/windmill/issues/11137)) ([85b36a2](https://github.com/windmill-labs/windmill/commit/85b36a2de5f3fa08750b6d2ab8203f4b745cfdd2))
+* data table roles in the DB manager and raw apps ([#11139](https://github.com/windmill-labs/windmill/issues/11139)) ([e1e3692](https://github.com/windmill-labs/windmill/commit/e1e3692fbc82d50c021ef8bf8ca7019d760705f0))
+* drafts follow their item through a move; behind means base ≠ head ([#10577](https://github.com/windmill-labs/windmill/issues/10577)) ([f00b2fc](https://github.com/windmill-labs/windmill/commit/f00b2fcb1e65cb8f8e95d55f7cc58b816ac7d89d))
+* edit variables, resources and triggers in their own session tab ([#11206](https://github.com/windmill-labs/windmill/issues/11206)) ([6186a06](https://github.com/windmill-labs/windmill/commit/6186a0645d3f3e92e06b666a6b5774b8af2b488f))
+* let every EE instance set the announcement banner ([#11238](https://github.com/windmill-labs/windmill/issues/11238)) ([87761d1](https://github.com/windmill-labs/windmill/commit/87761d179799026ebaf9ed91bf589852b5453ee3))
+* snap-collapse the sidebar by dragging it to the left edge ([#11225](https://github.com/windmill-labs/windmill/issues/11225)) ([56a6ad3](https://github.com/windmill-labs/windmill/commit/56a6ad322e8354695a0a96eef9e83ffa135b3ad4))
+
+
+### Bug Fixes
+
+* bump git sync hub scripts to cli 1.815.1 ([#11239](https://github.com/windmill-labs/windmill/issues/11239)) ([9e0e835](https://github.com/windmill-labs/windmill/commit/9e0e835c6876305d3a44902fb1432fd9c2348a7c))
+* check custom_instance_user can connect during instance database setup ([#11244](https://github.com/windmill-labs/windmill/issues/11244)) ([1b0f119](https://github.com/windmill-labs/windmill/commit/1b0f119c7b8ac2aacf2e2b4428c57f661df87ae5))
+* **cli:** read wmill.yaml from the branch a git-sync deploy writes to ([#11236](https://github.com/windmill-labs/windmill/issues/11236)) ([974b026](https://github.com/windmill-labs/windmill/commit/974b0265f85f9cfac65bbd2f6ebbcb0e966e3301))
+* guard data table migration routes against operators and unauthorized authors ([#11243](https://github.com/windmill-labs/windmill/issues/11243)) ([b742544](https://github.com/windmill-labs/windmill/commit/b7425443e1e08be029fc676047f727f84b646323))
+* tell the user when a draft conflict has stopped their edits saving ([#11241](https://github.com/windmill-labs/windmill/issues/11241)) ([d8ebbc0](https://github.com/windmill-labs/windmill/commit/d8ebbc06f5c56dad2570115700d640105d856c57))
+
+
+### Performance Improvements
+
+* index audit logs by workspace and operation ([#11235](https://github.com/windmill-labs/windmill/issues/11235)) ([3b8c326](https://github.com/windmill-labs/windmill/commit/3b8c3264ecb33884420b1bdac9cae9c841e721a0))
+* keep the sessions page fast with many ai sessions ([#11224](https://github.com/windmill-labs/windmill/issues/11224)) ([4cbc944](https://github.com/windmill-labs/windmill/commit/4cbc944c0bcb938300c964437d745d15a3ea608f))
+* retire the legacy pre-partitioning audit table ([#11240](https://github.com/windmill-labs/windmill/issues/11240)) ([9f2685d](https://github.com/windmill-labs/windmill/commit/9f2685d788e624c9ed9db5cbaee456ea21af2b29))
+
+## [1.815.0](https://github.com/windmill-labs/windmill/compare/v1.814.0...v1.815.0) (2026-09-18)
+
+
+### Features
+
+* add a workspace toggle that adds its admins and developers to new forks ([#11215](https://github.com/windmill-labs/windmill/issues/11215)) ([9d335de](https://github.com/windmill-labs/windmill/commit/9d335de87a4dbaa51038d55afe8d980761dcdfaf))
+* add an instance setting to refuse a token in MCP URLs ([#11162](https://github.com/windmill-labs/windmill/issues/11162)) ([37e493a](https://github.com/windmill-labs/windmill/commit/37e493ae66ed5c000ecac492d60fc0fdf4bda71f))
+* **ai-chat:** render get_run through the run tools' card ([#11204](https://github.com/windmill-labs/windmill/issues/11204)) ([6f9c4dc](https://github.com/windmill-labs/windmill/commit/6f9c4dc29455d13b0e64af05c2d6aa8bd5ff4fd6))
+* **ai-chat:** tell the chat which kind of app it is looking at ([#11208](https://github.com/windmill-labs/windmill/issues/11208)) ([c8c06d8](https://github.com/windmill-labs/windmill/commit/c8c06d8f79774abf109192e71a8b6fc37c7937ba))
+* attach files to a flow chat message ([#11185](https://github.com/windmill-labs/windmill/issues/11185)) ([c4c9677](https://github.com/windmill-labs/windmill/commit/c4c9677982b75c63d98ebf85b1904e0c341ba957))
+* **auth:** 2 h login links and a click-to-sign-in page for emailed ones ([#11203](https://github.com/windmill-labs/windmill/issues/11203)) ([5639187](https://github.com/windmill-labs/windmill/commit/5639187fec6d517a72e82df49d63d7438301127c))
+* cap user token expiration with an instance setting ([#11159](https://github.com/windmill-labs/windmill/issues/11159)) ([9320312](https://github.com/windmill-labs/windmill/commit/9320312eac56f944c4d31504601293ab4e816ccc))
+* flow chat job-backed detail, smooth streaming and answer chrome ([#11186](https://github.com/windmill-labs/windmill/issues/11186)) ([e2a91ca](https://github.com/windmill-labs/windmill/commit/e2a91ca2b141a0bee64ddfafe3cbf3ff86b6fb35))
+* put a data table's connection under Postgres roles ([#11020](https://github.com/windmill-labs/windmill/issues/11020)) ([0e807fb](https://github.com/windmill-labs/windmill/commit/0e807fb1dd80d7536ec144cd49445abc7961e504))
+* render an AI agent result as its answer, not as raw JSON ([#11051](https://github.com/windmill-labs/windmill/issues/11051)) ([a089928](https://github.com/windmill-labs/windmill/commit/a08992834d45d0211336f4fc32c3421646ca47c5))
+* support $flow_expr[...] dynamic tags on flow steps ([#11170](https://github.com/windmill-labs/windmill/issues/11170)) ([48f0025](https://github.com/windmill-labs/windmill/commit/48f00259c5e7361d3553dbcb809461e1cde96f8f))
+
+
+### Bug Fixes
+
+* **frontend:** inline only the package version, not the whole package.json ([#11191](https://github.com/windmill-labs/windmill/issues/11191)) ([813e486](https://github.com/windmill-labs/windmill/commit/813e486e166ac6215364817a7732b66f8dc1d463))
+* keep instance groups when editing auto-invite ([#11217](https://github.com/windmill-labs/windmill/issues/11217)) ([df61dea](https://github.com/windmill-labs/windmill/commit/df61dea5fa8b18d1e0044dc0db6702b053d5119f))
+* key the large root font size on screen width, not window width ([#11216](https://github.com/windmill-labs/windmill/issues/11216)) ([3b4e13d](https://github.com/windmill-labs/windmill/commit/3b4e13d1c564c6195e30b55b0671f7533e3ce408))
+* re-encrypt git sync secrets on workspace key rotation ([#11218](https://github.com/windmill-labs/windmill/issues/11218)) ([f0d66a4](https://github.com/windmill-labs/windmill/commit/f0d66a42eba27502767423af0c08b2ca1f16e8df))
+* re-point cloned fork identities that name nobody in the fork ([#11161](https://github.com/windmill-labs/windmill/issues/11161)) ([9690c44](https://github.com/windmill-labs/windmill/commit/9690c4462cf264a5577b87d07d465b5442b4e09d))
+* register the job token with the sensitive log masking system ([#10943](https://github.com/windmill-labs/windmill/issues/10943)) ([53afecd](https://github.com/windmill-labs/windmill/commit/53afecd4588247bc1812d3e68a30db1f3c3b2724))
+* show the New menu's description panel only on hover ([#11199](https://github.com/windmill-labs/windmill/issues/11199)) ([ecd0a6c](https://github.com/windmill-labs/windmill/commit/ecd0a6c77bc3a057b8072dbb0aca731e8bd3d882))
+* stop picker listing a draft twice when drafts share a friendly path ([#11214](https://github.com/windmill-labs/windmill/issues/11214)) ([72507d5](https://github.com/windmill-labs/windmill/commit/72507d52a021de8101794ee8f4a3392be1ba20c7))
+
+
+### Performance Improvements
+
+* count completed jobs on the v2_job_completed index with a timeout ([#11211](https://github.com/windmill-labs/windmill/issues/11211)) ([d1a2536](https://github.com/windmill-labs/windmill/commit/d1a25360b070994a31fb033707dbfde1fb553939))
+
 ## [1.814.0](https://github.com/windmill-labs/windmill/compare/v1.813.0...v1.814.0) (2026-09-17)
 
 
diff --git a/ai_evals/adapters/frontend/core/shared/baseEvalRunner.ts b/ai_evals/adapters/frontend/core/shared/baseEvalRunner.ts
index 2e29b9064d..3d0c6d6734 100644
--- a/ai_evals/adapters/frontend/core/shared/baseEvalRunner.ts
+++ b/ai_evals/adapters/frontend/core/shared/baseEvalRunner.ts
@@ -98,9 +98,11 @@ export async function runEval<THelpers, TOutput>(
   // Wrap tools to intercept fn calls for tracking.
   // Cast to ProductionTool since the eval Tool has a narrower toolCallbacks type
   // but the actual callbacks passed at runtime will satisfy both interfaces.
+  // `fn` forwards `this`: the chat loop calls it on a per-iteration copy carrying the def the
+  // model was sent, and a tool reading `this.def` must see that one, as it does in production.
   const wrappedTools = tools.map((tool) => ({
     ...tool,
-    fn: async (p: any) => {
+    fn: async function (this: unknown, p: any) {
       toolCallsCount++;
       toolsCalled.push(tool.def.function.name);
       let argumentsText = "";
@@ -120,7 +122,7 @@ export async function runEval<THelpers, TOutput>(
         toolName: tool.def.function.name,
         argumentsText,
       });
-      return tool.fn(p);
+      return tool.fn.call(this, p);
     },
   }));
 
diff --git a/ai_evals/adapters/frontend/mockBackend.ts b/ai_evals/adapters/frontend/mockBackend.ts
index d27bb4d69a..90df0cf870 100644
--- a/ai_evals/adapters/frontend/mockBackend.ts
+++ b/ai_evals/adapters/frontend/mockBackend.ts
@@ -14,7 +14,6 @@ import type {
 	DataMetric,
 	DataTableTables,
 	DataTableTableSchema,
-	EndpointTool,
 	GetDraftForUserResponse,
 	GetOwnDraftResponse,
 	ListDraftsResponse,
@@ -49,12 +48,16 @@ export interface BenchmarkWorkspaceFlow {
 export interface BenchmarkWorkspaceApp {
 	path: string
 	summary: string
+	/** Defaults to true. Set false for a drag-and-drop app, which the chat can list
+	 * and read but has no tool to edit — its value is a grid, not files. */
+	rawApp?: boolean
 	value: {
-		files: Record<string, string>
-		runnables: Record<string, unknown>
+		files?: Record<string, string>
+		runnables?: Record<string, unknown>
 		data?: unknown
 		policy?: unknown
 		custom_path?: unknown
+		[key: string]: unknown
 	}
 }
 
@@ -994,7 +997,7 @@ function buildBenchmarkListableApp(app: BenchmarkWorkspaceApp): ListableApp {
 		extra_perms: {},
 		edited_at: BENCHMARK_TIMESTAMP,
 		execution_mode: 'viewer',
-		raw_app: true
+		raw_app: app.rawApp ?? true
 	}
 }
 
@@ -1012,123 +1015,10 @@ function buildBenchmarkApp(app: BenchmarkWorkspaceApp): AppWithLastVersion {
 		execution_mode: 'viewer',
 		extra_perms: {},
 		custom_path: app.value.custom_path as string | undefined,
-		raw_app: true
+		raw_app: app.rawApp ?? true
 	}
 }
 
-// ============= API endpoint catalog (McpService.listMcpTools + raw fetch) =============
-// The global chat's API catalog tools list endpoints via McpService and execute
-// them with a plain relative fetch('/api/...'), which has no meaning in the
-// vitest environment. A representative slice of the real catalog is served here,
-// and `handleBenchmarkApiFetch` answers the executed calls.
-
-const BENCHMARK_MCP_TOOLS: EndpointTool[] = [
-	{
-		name: 'listWorkers',
-		description: 'List workers',
-		instructions: 'List all workers with their last ping and job counts.',
-		path: '/workers/list',
-		method: 'GET',
-		query_params_schema: {
-			type: 'object',
-			properties: { page: { type: 'integer' }, per_page: { type: 'integer' } }
-		}
-	},
-	{
-		name: 'listQueue',
-		description: 'List queued jobs',
-		instructions: '',
-		path: '/w/{workspace}/jobs/queue/list',
-		method: 'GET',
-		path_params_schema: {
-			type: 'object',
-			properties: { workspace: { type: 'string' } },
-			required: ['workspace']
-		}
-	},
-	{
-		name: 'getJob',
-		description: 'get job',
-		instructions: '',
-		path: '/w/{workspace}/jobs_u/get/{id}',
-		method: 'GET',
-		path_params_schema: {
-			type: 'object',
-			properties: { workspace: { type: 'string' }, id: { type: 'string', format: 'uuid' } },
-			required: ['workspace', 'id']
-		},
-		query_params_schema: {
-			type: 'object',
-			properties: {
-				no_logs: { type: 'boolean' },
-				no_code: { type: 'boolean' },
-				approval_token: { type: 'string' }
-			},
-			required: []
-		}
-	},
-	{
-		name: 'runScriptByPath',
-		description: 'Run the deployed version of a script by path',
-		instructions: '',
-		path: '/w/{workspace}/jobs/run/p/{path}',
-		method: 'POST',
-		path_params_schema: {
-			type: 'object',
-			properties: { workspace: { type: 'string' }, path: { type: 'string' } },
-			required: ['workspace', 'path']
-		},
-		body_schema: { type: 'object', properties: {} }
-	},
-	{
-		name: 'runFlowByPath',
-		description: 'Run the deployed version of a flow by path',
-		instructions: '',
-		path: '/w/{workspace}/jobs/run/f/{path}',
-		method: 'POST',
-		path_params_schema: {
-			type: 'object',
-			properties: { workspace: { type: 'string' }, path: { type: 'string' } },
-			required: ['workspace', 'path']
-		},
-		body_schema: { type: 'object', properties: {} }
-	},
-	// Draft-covered endpoints, present so steering cases exercise the guard the
-	// way production does (hidden from search, refused at call time).
-	{
-		name: 'getScriptByPath',
-		description: 'Get a script by path',
-		instructions: '',
-		path: '/w/{workspace}/scripts/get/p/{path}',
-		method: 'GET'
-	},
-	{
-		name: 'createFlow',
-		description: 'Create a flow',
-		instructions: '',
-		path: '/w/{workspace}/flows/create',
-		method: 'POST'
-	},
-	{
-		name: 'deleteSchedule',
-		description: 'Delete a schedule',
-		instructions: '',
-		path: '/w/{workspace}/schedules/delete/{path}',
-		method: 'DELETE'
-	},
-	{
-		name: 'getVariable',
-		description: 'Get a variable',
-		instructions: '',
-		path: '/w/{workspace}/variables/get/{path}',
-		method: 'GET'
-	}
-]
-
-export function listBenchmarkMcpTools(): EndpointTool[] {
-	return BENCHMARK_MCP_TOOLS
-}
-
 /** A stand-in Windmill hub. `search_hub_scripts` and a `hub/` read go out over
  * relative `/api/...` fetches, which have no origin here, so without these the
  * hub tools throw and no case can exercise hub reuse. Serving fixtures rather
@@ -1288,26 +1178,6 @@ const BENCHMARK_WORKERS = [
 	}
 ]
 
-const BENCHMARK_JOB_GET_PATH = /^\/api\/w\/([^/]+)\/jobs_u\/get\/([^/]+)$/
-const BENCHMARK_RUN_BY_PATH = /^\/api\/w\/([^/]+)\/jobs\/run\/(p|f)\/([^/]+)$/
-
-/** `executeEndpoint` sends a JSON string; anything else means no args were supplied. */
-function parseBenchmarkRequestBody(
-	body: BodyInit | null | undefined
-): Record<string, unknown> | undefined {
-	if (typeof body !== 'string') {
-		return undefined
-	}
-	try {
-		const parsed = JSON.parse(body)
-		return typeof parsed === 'object' && parsed !== null
-			? (parsed as Record<string, unknown>)
-			: undefined
-	} catch {
-		return undefined
-	}
-}
-
 /** True when `handleBenchmarkApiFetch` has an answer for this `/api/...` url.
  * Any other relative fetch must keep its normal (non-benchmark) behavior —
  * intercepting it with a synthetic 404 sends the model into retry loops. */
@@ -1319,17 +1189,13 @@ export function hasBenchmarkApiHandler(url: string): boolean {
 	const path = url.split('?')[0]
 	return (
 		path === '/api/workers/list' ||
-		BENCHMARK_JOB_GET_PATH.test(path) ||
-		BENCHMARK_RUN_BY_PATH.test(path) ||
-		/^\/api\/w\/[^/]+\/jobs\/queue\/list$/.test(path) ||
 		path === '/api/embeddings/query_hub_scripts' ||
 		path.startsWith('/api/scripts/hub/get_full/') ||
 		BENCHMARK_AI_MODELS_PATH.test(path)
 	)
 }
 
-/** Answer a relative `/api/...` fetch — from the API catalog executor, or from the
- * chat's hub tools. */
+/** Answer the relative `/api/...` fetches no mocked service covers. */
 export function handleBenchmarkApiFetch(url: string, init?: RequestInit): Response {
 	const path = url.split('?')[0]
 	if (path === '/api/workers/list') {
@@ -1346,39 +1212,6 @@ export function handleBenchmarkApiFetch(url: string, init?: RequestInit): Respon
 			?.aiProviders?.find((entry) => entry.path === resourcePath)
 		return Response.json({ data: (seed?.models ?? []).map((id) => ({ id })) })
 	}
-	if (/^\/api\/w\/[^/]+\/jobs\/queue\/list$/.test(path)) {
-		return Response.json([])
-	}
-	const jobGet = BENCHMARK_JOB_GET_PATH.exec(path)
-	if (jobGet) {
-		const id = decodeURIComponent(jobGet[2])
-		const job = getBenchmarkCompletedJob(decodeURIComponent(jobGet[1]), id)
-		if (!job) {
-			return Response.json({ error: `Job not found for "${id}"` }, { status: 404 })
-		}
-		// The real endpoint lets a caller drop the bulky fields. Ignoring that here would
-		// size the model's context off a payload it explicitly asked to shrink.
-		const query = new URLSearchParams(url.split('?')[1] ?? '')
-		if (query.get('no_logs') === 'true') {
-			delete job.logs
-		}
-		if (query.get('no_code') === 'true') {
-			delete job.raw_code
-		}
-		return Response.json(job)
-	}
-	const runByPath = BENCHMARK_RUN_BY_PATH.exec(path)
-	if (runByPath) {
-		const workspace = decodeURIComponent(runByPath[1])
-		const runnablePath = decodeURIComponent(runByPath[3])
-		const args = parseBenchmarkRequestBody(init?.body)
-		// The real endpoint answers with the bare job id as text, not JSON.
-		return new Response(
-			runByPath[2] === 'f'
-				? runBenchmarkFlowByPath({ workspace, path: runnablePath, args })
-				: runBenchmarkScriptByPath({ workspace, path: runnablePath, args })
-		)
-	}
 	if (path === '/api/embeddings/query_hub_scripts') {
 		const text = new URLSearchParams(url.split('?')[1] ?? '').get('text') ?? ''
 		return Response.json(searchBenchmarkHubScripts(text))
diff --git a/ai_evals/adapters/frontend/mockBackendApi.test.ts b/ai_evals/adapters/frontend/mockBackendApi.test.ts
index d9cfa08bf4..85bd1f3320 100644
--- a/ai_evals/adapters/frontend/mockBackendApi.test.ts
+++ b/ai_evals/adapters/frontend/mockBackendApi.test.ts
@@ -1,83 +1,18 @@
-import { afterEach, beforeEach, describe, expect, it } from 'bun:test'
-import {
-	createBenchmarkCompletedJob,
-	getBenchmarkCompletedJob,
-	handleBenchmarkApiFetch,
-	hasBenchmarkApiHandler,
-	listBenchmarkMcpTools,
-	resetBenchmarkMockBackend,
-	registerBenchmarkWorkspaceRunnables
-} from './mockBackend'
+import { describe, expect, it } from 'bun:test'
+import { handleBenchmarkApiFetch, hasBenchmarkApiHandler } from './mockBackend'
 
-const WORKSPACE = 'benchmark-api-ws'
+// `list_workers`'s client call is not faked, so its request really does leave as a relative
+// `/api/...` url that node's fetch cannot resolve. Without this route the tool throws instead
+// of answering.
+describe('benchmark API fetch handlers', () => {
+	it('lists workers, the way list_workers reaches them', async () => {
+		const url = '/api/workers/list?per_page=100'
 
-// A catalog entry with no fetch handler is a dead end: the catalog executor builds a
-// relative `/api/...` url, the stub declines it, and node's fetch throws on the relative
-// url instead of returning a result the model can act on. Mutating entries are reachable
-// too — the eval runners define no `requestConfirmation`, so `call_api_endpoint` executes
-// unconfirmed.
-describe('benchmark API catalog', () => {
-	beforeEach(() => resetBenchmarkMockBackend())
-	afterEach(() => resetBenchmarkMockBackend())
+		expect(hasBenchmarkApiHandler(url)).toBe(true)
+		const body = await handleBenchmarkApiFetch(url).json()
 
-	it('answers every endpoint it advertises', () => {
-		const unanswered = listBenchmarkMcpTools()
-			.map((tool) =>
-				`/api${tool.path.replace('{workspace}', WORKSPACE)}`.replace(/\{[^}]+\}/g, 'x')
-			)
-			.filter((url) => !hasBenchmarkApiHandler(url))
-
-		// The draft-covered entries are refused by name before any fetch, so they are
-		// advertised without a handler on purpose.
-		expect(unanswered).toEqual([
-			`/api/w/${WORKSPACE}/scripts/get/p/x`,
-			`/api/w/${WORKSPACE}/flows/create`,
-			`/api/w/${WORKSPACE}/schedules/delete/x`,
-			`/api/w/${WORKSPACE}/variables/get/x`
-		])
-	})
-
-	it('runs a deployed script by path, the way call_api_endpoint reaches it', async () => {
-		registerBenchmarkWorkspaceRunnables(WORKSPACE, {
-			scripts: [
-				{
-					path: 'f/evals/greet',
-					summary: 'Greet',
-					language: 'bun',
-					content: 'export async function main() {}'
-				}
-			]
-		})
-
-		const res = handleBenchmarkApiFetch(
-			`/api/w/${WORKSPACE}/jobs/run/p/${encodeURIComponent('f/evals/greet')}`,
-			{ method: 'POST', body: JSON.stringify({ name: 'ada' }) }
-		)
-
-		expect(res.status).toBe(200)
-		const job = getBenchmarkCompletedJob(WORKSPACE, (await res.text()).trim())
-		expect(job).toMatchObject({ success: true, args: { name: 'ada' } })
-	})
-
-	it('serves a recorded job so a model can check the run it just started', async () => {
-		const id = createBenchmarkCompletedJob({
-			workspace: WORKSPACE,
-			jobKind: 'preview',
-			result: 'Hello, World!'
-		})
-
-		const res = handleBenchmarkApiFetch(`/api/w/${WORKSPACE}/jobs_u/get/${id}`)
-
-		expect(res.status).toBe(200)
-		expect(await res.json()).toMatchObject({
-			id,
-			success: true,
-			result: 'Hello, World!'
-		})
-	})
-
-	it('404s an unknown job id instead of letting the fetch fall through', () => {
-		expect(hasBenchmarkApiHandler(`/api/w/${WORKSPACE}/jobs_u/get/missing`)).toBe(true)
-		expect(handleBenchmarkApiFetch(`/api/w/${WORKSPACE}/jobs_u/get/missing`).status).toBe(404)
+		// The tool counts the list and maps over it, so it needs a bare array, not an envelope.
+		expect(Array.isArray(body)).toBe(true)
+		expect(body[0]).toMatchObject({ worker: expect.any(String), worker_group: expect.any(String) })
 	})
 })
diff --git a/ai_evals/adapters/frontend/vitestAdapter.test.ts b/ai_evals/adapters/frontend/vitestAdapter.test.ts
index c9e889b9a0..0c8a22a987 100644
--- a/ai_evals/adapters/frontend/vitestAdapter.test.ts
+++ b/ai_evals/adapters/frontend/vitestAdapter.test.ts
@@ -5,8 +5,8 @@ import { mkdir, writeFile } from 'fs/promises'
 import { dirname, resolve } from 'path'
 import { handleBenchmarkApiFetch, hasBenchmarkApiHandler } from './mockBackend'
 
-// The API catalog executor issues relative fetch('/api/...') calls, which have
-// no meaning in the vitest environment — serve the ones the benchmark handles.
+// Some tools reach the backend by relative fetch('/api/...'), which has no meaning
+// in the vitest environment — serve the ones the benchmark handles.
 // Every other relative fetch keeps its normal behavior (it fails the same way
 // it does without this stub) so unrelated tools see an unchanged environment.
 // The frontend builds API URLs from location.origin (fetchAvailableModels does), and node has no
@@ -92,8 +92,7 @@ vi.mock('$lib/gen', async () => {
 		runBenchmarkFlowPreview,
 		runBenchmarkScriptByPath,
 		runBenchmarkScriptPreview,
-		updateBenchmarkDraft,
-		listBenchmarkMcpTools
+		updateBenchmarkDraft
 	} = await import('./mockBackend')
 
 	function wrapService<T extends object>(target: T, overrides: Record<string, unknown>): T {
@@ -434,12 +433,6 @@ vi.mock('$lib/gen', async () => {
 			queryResourceTypes: async (data: { workspace: string }) =>
 				hasBenchmarkWorkspace(data.workspace) ? [] : actual.ResourceService.queryResourceTypes(data)
 		}),
-		McpService: wrapService(actual.McpService, {
-			listMcpTools: async (data: { workspace: string }) =>
-				hasBenchmarkWorkspace(data.workspace)
-					? listBenchmarkMcpTools()
-					: actual.McpService.listMcpTools(data)
-		}),
 		VariableService: wrapService(actual.VariableService, {
 			existsVariable: async (data: { workspace: string; path: string }) =>
 				hasBenchmarkWorkspace(data.workspace)
diff --git a/ai_evals/cases/global.yaml b/ai_evals/cases/global.yaml
index 45316b2810..96aa3ab983 100644
--- a/ai_evals/cases/global.yaml
+++ b/ai_evals/cases/global.yaml
@@ -1112,9 +1112,9 @@
     - opens the Kafka triggers page
     - does not write, deploy, or delete anything
 
-- id: global-openpage7-compare-review
+- id: global-draft-does-not-open-compare
   prompt: |-
-    Create a TypeScript script draft at f/evals/global/compare_review_demo that returns the string "ok" (no need to test it), then open the review page so I can look over the pending change and deploy it myself.
+    Create a TypeScript script draft at f/evals/global/compare_review_demo that returns the string "ok" (no need to test it). I want to look over the change before it gets deployed.
   runtime:
     maxTurns: 8
   validate:
@@ -1122,6 +1122,24 @@
   toolExpect:
     requiredToolsUsed:
       - write_script
+    forbiddenToolsUsed:
+      - open_page
+      - deploy_workspace_item
+      - delete_workspace_item
+  skipJudge: true
+  judgeChecklist:
+    - creates the script draft without opening any workspace page
+    - does not deploy or delete anything
+
+- id: global-openpage7-compare-fork-deploy
+  prompt: |-
+    I'm done with my changes in this fork and want to ship them to the parent workspace myself. Take me there.
+  runtime:
+    maxTurns: 6
+  validate:
+    draftCountExactly: 0
+  toolExpect:
+    requiredToolsUsed:
       - open_page
     forbiddenToolsUsed:
       - deploy_workspace_item
@@ -1131,17 +1149,9 @@
         field: page
         stringIncludesAnyOf:
           - compare
-      # The eval chat is untracked (no modified-items mask), so the model must scope
-      # the review by passing the item it changed explicitly — an omitted mask would
-      # preselect every pending change in the workspace.
-      - tool: open_page
-        field: items
-        stringIncludesAnyOf:
-          - f/evals/global/compare_review_demo
   skipJudge: true
   judgeChecklist:
-    - creates the script draft, then opens the Compare & Deploy review page instead of deploying itself
-    - preselects only the created script on the review page
+    - opens Compare & Deploy only because the user explicitly wants to deploy the fork into its parent
     - does not deploy or delete anything
 
 - id: global-openpage8-runs-label-and-worker
@@ -1919,11 +1929,10 @@
     - when the lookup fails, tells the user instead of inventing table names
     - does not write scripts or resources to answer a read-only question
 
-# --- Dedicated tools preferred over the API catalog ---
-# The harness serves worker/queue reads itself (benchmark fetch handlers in
-# adapters/frontend), so these cases do not require an mcp-enabled eval backend.
-# The stale `api-catalog` in the id below is kept so results stay comparable
-# across benchmark runs.
+# --- Dedicated tools for workspace, run and instance state ---
+# The harness serves the worker read itself (a benchmark fetch handler in
+# adapters/frontend). The stale `api-catalog` in the id below is kept so
+# results stay comparable across benchmark runs.
 
 - id: global-test30-api-catalog-workers
   prompt: |-
@@ -1937,8 +1946,6 @@
     requiredToolsUsed:
       - list_workers
     forbiddenToolsUsed:
-      - call_api_get
-      - call_api_endpoint
       - write_script
       - deploy_workspace_item
   # Read-only workspace inspection produces no draft; validate via tool use.
@@ -1990,13 +1997,11 @@
     requiredToolsUsed:
       - test_run_script
     forbiddenToolsUsed:
-      - call_api_endpoint
       - deploy_workspace_item
       - delete_workspace_item
   # The judge only sees the drafts artifact and cannot observe runs, so it always
   # docks the prompt's "run it" requirement — validate deterministically instead:
-  # draft content via valueIncludes, the test run via toolExpect (test_run_script
-  # required, call_api_endpoint forbidden).
+  # draft content via valueIncludes, the test run via toolExpect.
   skipJudge: true
   judgeChecklist:
     - creates an AI draft of f/evals/global/format_greeting with the name uppercased in the greeting
@@ -2014,13 +2019,11 @@
     requiredToolsUsed:
       - delete_workspace_item
     forbiddenToolsUsed:
-      - call_api_endpoint
-      - search_api_endpoints
       - write_script
   # Deletion produces no draft; validate via tool use.
   skipJudge: true
   judgeChecklist:
-    - deletes the deployed script via delete_workspace_item rather than a raw API endpoint
+    - deletes the deployed script via delete_workspace_item
 
 - id: global-test33-run-deployed-script-with-form
   prompt: |-
@@ -2041,7 +2044,6 @@
       - read_workspace_item
     forbiddenToolsUsed:
       - test_run_script
-      - call_api_endpoint
       - write_script
       - deploy_workspace_item
     # An empty form pushes the work back onto the user, so the prefill is part of
@@ -2054,7 +2056,7 @@
   # Running produces no draft, and the judge cannot observe runs; validate via tool use.
   skipJudge: true
   judgeChecklist:
-    - runs the deployed script through run_script rather than a preview test run or a raw API endpoint
+    - runs the deployed script through run_script rather than a preview test run
     - passes the name "ada" so the confirmation form comes up prefilled
 
 - id: global-test34-run-with-secret-from-variable
@@ -2113,7 +2115,6 @@
       - read_workspace_item
     forbiddenToolsUsed:
       - test_run_flow
-      - call_api_endpoint
       - write_flow
       - deploy_workspace_item
     # An empty form pushes the work back onto the user, so the prefill is part of
@@ -2126,7 +2127,7 @@
   # Running produces no draft, and the judge cannot observe runs; validate via tool use.
   skipJudge: true
   judgeChecklist:
-    - runs the deployed flow through run_flow rather than a preview test run or a raw API endpoint
+    - runs the deployed flow through run_flow rather than a preview test run
     - passes the customer "acme" so the confirmation form comes up prefilled
 
 - id: global-test36-draft-flow-test-run-not-deployed
@@ -2151,7 +2152,6 @@
     # version instead — the edit would not be in what ran.
     forbiddenToolsUsed:
       - run_flow
-      - call_api_endpoint
       - deploy_workspace_item
   # The judge cannot observe runs, and the edit's content is already pinned by
   # global-test5 on this fixture; what this case guards is where the run went.
@@ -2611,3 +2611,40 @@
   judgeChecklist:
     - runs the existing script rather than rewriting it
     - passes the GitHub resource as the bare string $res:f/evals/global/github_main
+
+- id: global-drag-and-drop-app-not-editable
+  prompt: |-
+    Add a refresh button to the ops console app, and the same to the sales board app.
+  initial: ai_evals/fixtures/frontend/global/initial/apps_code_and_drag_and_drop.json
+  runtime:
+    maxTurns: 12
+  validate:
+    # One request, two apps, only one of them editable: the code app must come back with a
+    # draft and the drag-and-drop one must not. Refusing both, or editing both, fails here —
+    # which is what makes this a test of the distinction rather than of caution.
+    draftCountExactly: 1
+    requiredDrafts:
+      - type: app
+        path: f/evals/global/ops_console
+    forbiddenDrafts:
+      - type: app
+        path: f/evals/global/sales_board
+  toolExpect:
+    # Deliberately not constraining write_app_file/patch_app_file by argument: an entry there
+    # fails when its tool was never called, so naming both would fail on whichever the model
+    # did not pick. The draft assertions above cover the same ground, tool-agnostically.
+    forbiddenToolsUsed:
+      - init_app
+      - deploy_workspace_item
+      - delete_app_file
+      - delete_app_runnable
+  assistantExpect:
+    # A refusal leaves no draft for the judge to read, so the explanation is checked here.
+    # Only the app kind: substring tests cannot see paraphrase, and every wording of "I can't
+    # edit it" defeats a fixed list.
+    requiredMentionsAnyOf:
+      - - drag-and-drop
+        - drag and drop
+        - low-code
+        - no-code
+  skipJudge: true
diff --git a/ai_evals/fixtures/frontend/global/initial/apps_code_and_drag_and_drop.json b/ai_evals/fixtures/frontend/global/initial/apps_code_and_drag_and_drop.json
new file mode 100644
index 0000000000..fbef7b3e3d
--- /dev/null
+++ b/ai_evals/fixtures/frontend/global/initial/apps_code_and_drag_and_drop.json
@@ -0,0 +1,30 @@
+{
+  "user": {
+    "username": "admin",
+    "is_admin": true,
+    "folders": ["evals"],
+    "folders_read": ["evals"]
+  },
+  "workspace": {
+    "apps": [
+      {
+        "path": "f/evals/global/sales_board",
+        "summary": "Sales board",
+        "rawApp": false,
+        "value": {
+          "grid": []
+        }
+      },
+      {
+        "path": "f/evals/global/ops_console",
+        "summary": "Ops console",
+        "value": {
+          "files": {
+            "/App.tsx": "export default function App() {\n\treturn <div>Ops console</div>\n}\n"
+          },
+          "runnables": {}
+        }
+      }
+    ]
+  }
+}
diff --git a/backend/.sqlx/query-044310c0e7745867a24a9d3653ff29c87ce48ffd89fac070c8314556f884ce55.json b/backend/.sqlx/query-044310c0e7745867a24a9d3653ff29c87ce48ffd89fac070c8314556f884ce55.json
new file mode 100644
index 0000000000..be7ac83a7b
--- /dev/null
+++ b/backend/.sqlx/query-044310c0e7745867a24a9d3653ff29c87ce48ffd89fac070c8314556f884ce55.json
@@ -0,0 +1,43 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT s.hash as hash, dm.deployment_msg as deployment_msg, s.created_at as created_at, s.created_by as created_by\n        FROM script s LEFT JOIN deployment_metadata dm ON s.hash = dm.script_hash\n        WHERE s.workspace_id = $1 AND s.path = $2\n        ORDER by s.created_at DESC\n        LIMIT $3 OFFSET $4",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "hash",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "deployment_msg",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 2,
+        "name": "created_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 3,
+        "name": "created_by",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Int8",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false,
+      true,
+      false,
+      false
+    ]
+  },
+  "hash": "044310c0e7745867a24a9d3653ff29c87ce48ffd89fac070c8314556f884ce55"
+}
diff --git a/backend/.sqlx/query-c92cc71e6d10c41368f7aa75b0799c2e1e9ca0ed33077ade8d7560e7cc21fa06.json b/backend/.sqlx/query-06abbf945bee93349ff88f64906b96ea1e853ef202510281427cfa9beeff81b3.json
similarity index 52%
rename from backend/.sqlx/query-c92cc71e6d10c41368f7aa75b0799c2e1e9ca0ed33077ade8d7560e7cc21fa06.json
rename to backend/.sqlx/query-06abbf945bee93349ff88f64906b96ea1e853ef202510281427cfa9beeff81b3.json
index 8a4b957c2a..7adefa7eb8 100644
--- a/backend/.sqlx/query-c92cc71e6d10c41368f7aa75b0799c2e1e9ca0ed33077ade8d7560e7cc21fa06.json
+++ b/backend/.sqlx/query-06abbf945bee93349ff88f64906b96ea1e853ef202510281427cfa9beeff81b3.json
@@ -1,22 +1,22 @@
 {
   "db_name": "PostgreSQL",
-  "query": "DELETE FROM v2_job_queue WHERE id = $1 RETURNING 1",
+  "query": "SELECT 1 AS one FROM workspace_settings WHERE workspace_id = $1 FOR UPDATE",
   "describe": {
     "columns": [
       {
         "ordinal": 0,
-        "name": "?column?",
+        "name": "one",
         "type_info": "Int4"
       }
     ],
     "parameters": {
       "Left": [
-        "Uuid"
+        "Text"
       ]
     },
     "nullable": [
       null
     ]
   },
-  "hash": "c92cc71e6d10c41368f7aa75b0799c2e1e9ca0ed33077ade8d7560e7cc21fa06"
+  "hash": "06abbf945bee93349ff88f64906b96ea1e853ef202510281427cfa9beeff81b3"
 }
diff --git a/backend/.sqlx/query-06ce02cd7ce2f5a57355153edb573c242f9ba758db66e9a5e16f30e3e1494201.json b/backend/.sqlx/query-06ce02cd7ce2f5a57355153edb573c242f9ba758db66e9a5e16f30e3e1494201.json
new file mode 100644
index 0000000000..b543f00b44
--- /dev/null
+++ b/backend/.sqlx/query-06ce02cd7ce2f5a57355153edb573c242f9ba758db66e9a5e16f30e3e1494201.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE workspace_settings ws\n           SET datatable = (\n               SELECT jsonb_set(ws.datatable, '{datatables}', jsonb_object_agg(\n                   dt.key,\n                   CASE WHEN dt.value->'reference'->>'workspace_id' = $1\n                             AND dt.value->'reference'->>'datatable' = $2\n                       THEN jsonb_set(dt.value, '{reference,datatable}', to_jsonb($3::text))\n                       ELSE dt.value END\n               ))\n               FROM jsonb_each(ws.datatable->'datatables') dt\n           )\n           WHERE EXISTS (\n               SELECT 1 FROM jsonb_each(COALESCE(ws.datatable->'datatables', '{}'::jsonb)) d\n               WHERE d.value->'reference'->>'workspace_id' = $1\n                 AND d.value->'reference'->>'datatable' = $2\n           )",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "06ce02cd7ce2f5a57355153edb573c242f9ba758db66e9a5e16f30e3e1494201"
+}
diff --git a/backend/.sqlx/query-09e3f8fa8a9e64048971983584bfa00ab137c70b73f381452cadfae6e1cda934.json b/backend/.sqlx/query-09e3f8fa8a9e64048971983584bfa00ab137c70b73f381452cadfae6e1cda934.json
new file mode 100644
index 0000000000..a4d174992e
--- /dev/null
+++ b/backend/.sqlx/query-09e3f8fa8a9e64048971983584bfa00ab137c70b73f381452cadfae6e1cda934.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE draft AS d\n           SET path = $3::text,\n               value = (\n                   SELECT CASE\n                       WHEN s.clean -> 'path' = to_jsonb($2::text)\n                         OR s.clean -> 'draft_path' = to_jsonb($2::text)\n                           THEN to_json(\n                               s.clean\n                               || CASE WHEN s.clean -> 'path' = to_jsonb($2::text)\n                                       THEN jsonb_build_object('path', $3::text)\n                                       ELSE '{}'::jsonb END\n                               || CASE WHEN s.clean -> 'draft_path' = to_jsonb($2::text)\n                                       THEN jsonb_build_object('draft_path', $3::text)\n                                       ELSE '{}'::jsonb END\n                           )\n                       ELSE d.value\n                   END\n                   FROM (SELECT replace(replace(replace(d.value::text, chr(92) || chr(92), chr(1)),\n                                                chr(92) || 'u0000', ''), chr(1), chr(92) || chr(92))::jsonb AS clean) s\n               )\n           WHERE d.workspace_id = $1\n             AND d.path = $2::text\n             AND d.typ::text = ANY($4::text[])",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text",
+        "TextArray"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "09e3f8fa8a9e64048971983584bfa00ab137c70b73f381452cadfae6e1cda934"
+}
diff --git a/backend/.sqlx/query-0cc6770a81ecaecafe0d9b7100f94b329c4ec7978b016af4c964415e0c38396c.json b/backend/.sqlx/query-0cc6770a81ecaecafe0d9b7100f94b329c4ec7978b016af4c964415e0c38396c.json
new file mode 100644
index 0000000000..23d3b51c76
--- /dev/null
+++ b/backend/.sqlx/query-0cc6770a81ecaecafe0d9b7100f94b329c4ec7978b016af4c964415e0c38396c.json
@@ -0,0 +1,71 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT value as \"value!: sqlx::types::Json<Box<serde_json::value::RawValue>>\",\n                  created_at, base\n           FROM draft\n           WHERE workspace_id = $1\n             AND (email = $2 OR email IS NULL)\n             AND path = $3\n             AND typ = $4\n           ORDER BY email NULLS LAST\n           LIMIT 1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "value!: sqlx::types::Json<Box<serde_json::value::RawValue>>",
+        "type_info": "Json"
+      },
+      {
+        "ordinal": 1,
+        "name": "created_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 2,
+        "name": "base",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text",
+        {
+          "Custom": {
+            "name": "draft_kind",
+            "kind": {
+              "Enum": [
+                "script",
+                "flow",
+                "app",
+                "raw_app",
+                "resource",
+                "variable",
+                "trigger_schedule",
+                "trigger_webhook",
+                "trigger_default_email",
+                "trigger_email",
+                "trigger_http",
+                "trigger_websocket",
+                "trigger_postgres",
+                "trigger_kafka",
+                "trigger_nats",
+                "trigger_mqtt",
+                "trigger_sqs",
+                "trigger_gcp",
+                "trigger_azure",
+                "trigger_poll",
+                "trigger_cli",
+                "trigger_nextcloud",
+                "trigger_google",
+                "trigger_github",
+                "data_pipeline",
+                "trigger_amqp"
+              ]
+            }
+          }
+        }
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      true
+    ]
+  },
+  "hash": "0cc6770a81ecaecafe0d9b7100f94b329c4ec7978b016af4c964415e0c38396c"
+}
diff --git a/backend/.sqlx/query-0d10e0fa5cf4033c7d93c9ed56be8209046007917f44da954eccf2188e5bff1f.json b/backend/.sqlx/query-0d10e0fa5cf4033c7d93c9ed56be8209046007917f44da954eccf2188e5bff1f.json
new file mode 100644
index 0000000000..a99ffad770
--- /dev/null
+++ b/backend/.sqlx/query-0d10e0fa5cf4033c7d93c9ed56be8209046007917f44da954eccf2188e5bff1f.json
@@ -0,0 +1,29 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT permissioned_as, permissioned_as_email FROM v2_job\n                 WHERE id = $1 AND workspace_id = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "permissioned_as",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "permissioned_as_email",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false
+    ]
+  },
+  "hash": "0d10e0fa5cf4033c7d93c9ed56be8209046007917f44da954eccf2188e5bff1f"
+}
diff --git a/backend/.sqlx/query-0d9a83d77632bc0de19a48eddb7e6f80b2a41db4f1d352920d0c295ea3a018b1.json b/backend/.sqlx/query-0d9a83d77632bc0de19a48eddb7e6f80b2a41db4f1d352920d0c295ea3a018b1.json
new file mode 100644
index 0000000000..93251596cf
--- /dev/null
+++ b/backend/.sqlx/query-0d9a83d77632bc0de19a48eddb7e6f80b2a41db4f1d352920d0c295ea3a018b1.json
@@ -0,0 +1,64 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE draft\n           SET path = $3,\n               -- Both path keys, not just the typed one: the editors mirror the\n               -- typed path into the other while it differs from the row's path,\n               -- and the loaders prefer the mirror — left naming the old location\n               -- it un-does this move on the next save. `create_missing = false`\n               -- on both, so a draft carrying only one keeps only one.\n               value = to_json(\n                   jsonb_set(\n                       jsonb_set(\n                           CASE WHEN $7::text IS NULL THEN to_jsonb(value)\n                                ELSE jsonb_set(to_jsonb(value), ARRAY['summary'], to_jsonb($7::text))\n                           END,\n                           ARRAY[$5::text], to_jsonb($3::text), false\n                       ),\n                       ARRAY[$8::text], to_jsonb($3::text), false\n                   )\n               )\n           WHERE workspace_id = $1\n             AND path = $2\n             AND typ = $4\n             AND email = $6\n             -- A pre-sanitizer NUL escape makes `to_jsonb` raise 22P05. Excluded\n             -- here so the statement can't 500; reported below instead. Unlike the\n             -- passive carry, rewriting the value IS this operation, so skipping it\n             -- silently would move the row and leave its typed path stale.\n             AND position(chr(92) || 'u0000' in replace(value::text, chr(92) || chr(92), '')) = 0\n             -- Skipped on a summary-only edit, where the \"target\" row is this\n             -- row and the guard would refuse the update against itself.\n             AND ($2 = $3 OR NOT EXISTS (\n                 SELECT 1 FROM draft o\n                 WHERE o.workspace_id = $1 AND o.path = $3 AND o.typ::text = ANY($9::text[])\n                   -- Of this kind only the caller's own row and the legacy one collide:\n                   -- teammates' drafts of one item share its path by design, but a deploy\n                   -- there wipes those two together, so a second would discard edits the\n                   -- caller never saw. The other app kind is a different item on the same\n                   -- deployed path, so it collides whoever owns it.\n                   AND (o.typ <> $4 OR o.email = $6 OR o.email IS NULL)\n             ))\n           RETURNING id",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text",
+        {
+          "Custom": {
+            "name": "draft_kind",
+            "kind": {
+              "Enum": [
+                "script",
+                "flow",
+                "app",
+                "raw_app",
+                "resource",
+                "variable",
+                "trigger_schedule",
+                "trigger_webhook",
+                "trigger_default_email",
+                "trigger_email",
+                "trigger_http",
+                "trigger_websocket",
+                "trigger_postgres",
+                "trigger_kafka",
+                "trigger_nats",
+                "trigger_mqtt",
+                "trigger_sqs",
+                "trigger_gcp",
+                "trigger_azure",
+                "trigger_poll",
+                "trigger_cli",
+                "trigger_nextcloud",
+                "trigger_google",
+                "trigger_github",
+                "data_pipeline",
+                "trigger_amqp"
+              ]
+            }
+          }
+        },
+        "Text",
+        "Text",
+        "Text",
+        "Text",
+        "TextArray"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "0d9a83d77632bc0de19a48eddb7e6f80b2a41db4f1d352920d0c295ea3a018b1"
+}
diff --git a/backend/.sqlx/query-2b93351b9c2c91272c3f69c9c8eba192d2e4d087c7d7db8d3b257bb864c8265d.json b/backend/.sqlx/query-0f374865faa5bdf884345808a004ce891a85daa00e037aba4b65b60f87243bd3.json
similarity index 65%
rename from backend/.sqlx/query-2b93351b9c2c91272c3f69c9c8eba192d2e4d087c7d7db8d3b257bb864c8265d.json
rename to backend/.sqlx/query-0f374865faa5bdf884345808a004ce891a85daa00e037aba4b65b60f87243bd3.json
index b82fcf2e17..2ff7820d86 100644
--- a/backend/.sqlx/query-2b93351b9c2c91272c3f69c9c8eba192d2e4d087c7d7db8d3b257bb864c8265d.json
+++ b/backend/.sqlx/query-0f374865faa5bdf884345808a004ce891a85daa00e037aba4b65b60f87243bd3.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "INSERT INTO datatable_migrations (workspace_id, datatable, timestamp, name, code_up, code_down) VALUES ($1, $2, $3, $4, $5, $6) ON CONFLICT (workspace_id, datatable, timestamp) DO UPDATE SET name = EXCLUDED.name, code_up = EXCLUDED.code_up, code_down = EXCLUDED.code_down WHERE NOT $7 OR (datatable_migrations.name = $8::text AND datatable_migrations.code_up = $9::text AND datatable_migrations.code_down IS NOT DISTINCT FROM $10::text)",
+  "query": "INSERT INTO datatable_migrations (workspace_id, datatable, timestamp, name, code_up, code_down) VALUES ($1, $2, $3, $4, $5, $6) ON CONFLICT (workspace_id, datatable, timestamp) DO UPDATE SET name = EXCLUDED.name, code_up = EXCLUDED.code_up, code_down = EXCLUDED.code_down WHERE datatable_migrations.name = $7::text AND datatable_migrations.code_up = $8::text AND datatable_migrations.code_down IS NOT DISTINCT FROM $9::text",
   "describe": {
     "columns": [],
     "parameters": {
@@ -11,7 +11,6 @@
         "Varchar",
         "Text",
         "Text",
-        "Bool",
         "Text",
         "Text",
         "Text"
@@ -19,5 +18,5 @@
     },
     "nullable": []
   },
-  "hash": "2b93351b9c2c91272c3f69c9c8eba192d2e4d087c7d7db8d3b257bb864c8265d"
+  "hash": "0f374865faa5bdf884345808a004ce891a85daa00e037aba4b65b60f87243bd3"
 }
diff --git a/backend/.sqlx/query-11af34e5fe5b8ed59453d58628ed5fb3b2120835158f22d715b73460f6a55108.json b/backend/.sqlx/query-11af34e5fe5b8ed59453d58628ed5fb3b2120835158f22d715b73460f6a55108.json
new file mode 100644
index 0000000000..fdf0049344
--- /dev/null
+++ b/backend/.sqlx/query-11af34e5fe5b8ed59453d58628ed5fb3b2120835158f22d715b73460f6a55108.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM draft_move WHERE email = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "11af34e5fe5b8ed59453d58628ed5fb3b2120835158f22d715b73460f6a55108"
+}
diff --git a/backend/.sqlx/query-132bab72036874c33805ff194fce6641817d09528f9d1b7210abe9881b817710.json b/backend/.sqlx/query-132bab72036874c33805ff194fce6641817d09528f9d1b7210abe9881b817710.json
new file mode 100644
index 0000000000..15d1703e5d
--- /dev/null
+++ b/backend/.sqlx/query-132bab72036874c33805ff194fce6641817d09528f9d1b7210abe9881b817710.json
@@ -0,0 +1,32 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO remote_deploy_token\n             (workspace_id, email, base_url, remote_workspace_id, token, remote_email, proxy_key,\n              connected_at, member_since, target_changed_at)\n         SELECT $1, $2, $3, $4, $5, $6, $7, $8, $9, $10\n         WHERE $9::timestamptz IS NOT NULL\n            OR EXISTS (SELECT 1 FROM token WHERE token_hash = $11)\n         ON CONFLICT (workspace_id, email) DO UPDATE SET\n             base_url = EXCLUDED.base_url, remote_workspace_id = EXCLUDED.remote_workspace_id,\n             token = EXCLUDED.token, remote_email = EXCLUDED.remote_email,\n             proxy_key = EXCLUDED.proxy_key, connected_at = EXCLUDED.connected_at,\n             member_since = EXCLUDED.member_since, target_changed_at = EXCLUDED.target_changed_at\n         WHERE remote_deploy_token.connected_at < EXCLUDED.connected_at\n         RETURNING connected_at",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "connected_at",
+        "type_info": "Timestamptz"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Text",
+        "Varchar",
+        "Varchar",
+        "Timestamptz",
+        "Timestamptz",
+        "Timestamptz",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "132bab72036874c33805ff194fce6641817d09528f9d1b7210abe9881b817710"
+}
diff --git a/backend/.sqlx/query-9a1483a81f5b086e0765d3d69483e29b09f66090e1f9d394564c16d921d2e66c.json b/backend/.sqlx/query-148fbee57c6abbb6f361818c5b6bfc8a1db451d31dfddbb5be945b3551c8becb.json
similarity index 57%
rename from backend/.sqlx/query-9a1483a81f5b086e0765d3d69483e29b09f66090e1f9d394564c16d921d2e66c.json
rename to backend/.sqlx/query-148fbee57c6abbb6f361818c5b6bfc8a1db451d31dfddbb5be945b3551c8becb.json
index e751b8fc7c..09e5b51ab9 100644
--- a/backend/.sqlx/query-9a1483a81f5b086e0765d3d69483e29b09f66090e1f9d394564c16d921d2e66c.json
+++ b/backend/.sqlx/query-148fbee57c6abbb6f361818c5b6bfc8a1db451d31dfddbb5be945b3551c8becb.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT s.hash as hash, dm.deployment_msg as deployment_msg, s.created_at as created_at\n        FROM script s LEFT JOIN deployment_metadata dm ON s.hash = dm.script_hash\n        WHERE s.workspace_id = $1 AND s.path = $2\n        ORDER by s.created_at DESC",
+  "query": "SELECT s.hash as hash, dm.deployment_msg as deployment_msg, s.created_at as created_at, s.created_by as created_by\n        FROM script s LEFT JOIN deployment_metadata dm ON s.hash = dm.script_hash\n        WHERE s.workspace_id = $1 AND s.path = $2\n        ORDER by s.created_at DESC LIMIT 1",
   "describe": {
     "columns": [
       {
@@ -17,6 +17,11 @@
         "ordinal": 2,
         "name": "created_at",
         "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 3,
+        "name": "created_by",
+        "type_info": "Varchar"
       }
     ],
     "parameters": {
@@ -28,8 +33,9 @@
     "nullable": [
       false,
       true,
+      false,
       false
     ]
   },
-  "hash": "9a1483a81f5b086e0765d3d69483e29b09f66090e1f9d394564c16d921d2e66c"
+  "hash": "148fbee57c6abbb6f361818c5b6bfc8a1db451d31dfddbb5be945b3551c8becb"
 }
diff --git a/backend/.sqlx/query-14cef81d324504d9cc90a9ffeb9f73daf9e09cac11685988bc861cc348a0c518.json b/backend/.sqlx/query-14cef81d324504d9cc90a9ffeb9f73daf9e09cac11685988bc861cc348a0c518.json
new file mode 100644
index 0000000000..45fbabdae9
--- /dev/null
+++ b/backend/.sqlx/query-14cef81d324504d9cc90a9ffeb9f73daf9e09cac11685988bc861cc348a0c518.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT remote_deploy_target FROM workspace_settings WHERE workspace_id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "remote_deploy_target",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "14cef81d324504d9cc90a9ffeb9f73daf9e09cac11685988bc861cc348a0c518"
+}
diff --git a/backend/.sqlx/query-1740f8bd6f9e084a470a775151e751e1317e7398dfaf1dfde5c57169cc146c9d.json b/backend/.sqlx/query-1740f8bd6f9e084a470a775151e751e1317e7398dfaf1dfde5c57169cc146c9d.json
new file mode 100644
index 0000000000..46b7d2509c
--- /dev/null
+++ b/backend/.sqlx/query-1740f8bd6f9e084a470a775151e751e1317e7398dfaf1dfde5c57169cc146c9d.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE v2_job_queue q SET scheduled_for = now()\n         FROM (SELECT id, scheduled_for FROM v2_job_queue WHERE id = $1 AND workspace_id = $2 FOR UPDATE) prev\n         WHERE q.id = prev.id AND NOT q.running AND q.suspend = 0 AND q.canceled_by IS NULL\n            AND q.scheduled_for > now()\n         RETURNING prev.scheduled_for",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "scheduled_for",
+        "type_info": "Timestamptz"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "1740f8bd6f9e084a470a775151e751e1317e7398dfaf1dfde5c57169cc146c9d"
+}
diff --git a/backend/.sqlx/query-18b38efcb141101192b372e7d7e7e47481877f3ab717682f3b84e665c95a5214.json b/backend/.sqlx/query-18b38efcb141101192b372e7d7e7e47481877f3ab717682f3b84e665c95a5214.json
new file mode 100644
index 0000000000..d26cdf3a7d
--- /dev/null
+++ b/backend/.sqlx/query-18b38efcb141101192b372e7d7e7e47481877f3ab717682f3b84e665c95a5214.json
@@ -0,0 +1,49 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT a.id as app_id, av.id as version_id, dm.deployment_msg as deployment_msg,\n                av.created_by as created_by, av.created_at as created_at\n        FROM app a\n        JOIN LATERAL (\n            SELECT av2.id, COALESCE(v.ord, 0) AS ord\n            FROM app_version av2\n            LEFT JOIN unnest(a.versions) WITH ORDINALITY AS v(id, ord) ON v.id = av2.id\n            WHERE av2.app_id = a.id\n            ORDER BY ord DESC, av2.id DESC\n            LIMIT $3 OFFSET $4\n        ) page ON TRUE\n        JOIN app_version av ON av.id = page.id\n        LEFT JOIN deployment_metadata dm ON av.id = dm.app_version\n        WHERE a.workspace_id = $1 AND a.path = $2\n        ORDER BY page.ord DESC",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "app_id",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "version_id",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 2,
+        "name": "deployment_msg",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
+        "name": "created_by",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 4,
+        "name": "created_at",
+        "type_info": "Timestamptz"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Int8",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      true,
+      false,
+      false
+    ]
+  },
+  "hash": "18b38efcb141101192b372e7d7e7e47481877f3ab717682f3b84e665c95a5214"
+}
diff --git a/backend/.sqlx/query-46f00a75b2e7e4ac70758a9687070f68bc0421f1aa228f80157adda63191d33b.json b/backend/.sqlx/query-1c6859291963a9ca38d73f500213a575bfcd4469524f0dc8812470737759f02b.json
similarity index 74%
rename from backend/.sqlx/query-46f00a75b2e7e4ac70758a9687070f68bc0421f1aa228f80157adda63191d33b.json
rename to backend/.sqlx/query-1c6859291963a9ca38d73f500213a575bfcd4469524f0dc8812470737759f02b.json
index dcd3573e92..7b78a7d9b4 100644
--- a/backend/.sqlx/query-46f00a75b2e7e4ac70758a9687070f68bc0421f1aa228f80157adda63191d33b.json
+++ b/backend/.sqlx/query-1c6859291963a9ca38d73f500213a575bfcd4469524f0dc8812470737759f02b.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "WITH legacy AS (\n                       DELETE FROM draft\n                       WHERE workspace_id = $1 AND path = $2 AND typ = $3 AND email IS NULL\n                       RETURNING value\n                   )\n                   INSERT INTO draft (workspace_id, email, path, typ, value, created_at)\n                   SELECT $1, $4, $2, $3, value, now() FROM legacy\n                   ON CONFLICT (workspace_id, path, typ, email) WHERE email IS NOT NULL\n                   DO UPDATE SET value = EXCLUDED.value, created_at = now()\n                   RETURNING 1 as \"one!\"",
+  "query": "WITH legacy AS (\n                       DELETE FROM draft\n                       WHERE workspace_id = $1 AND path = $2 AND typ = $3 AND email IS NULL\n                       RETURNING value, base\n                   )\n                   INSERT INTO draft (workspace_id, email, path, typ, value, created_at, base)\n                   SELECT $1, $4, $2, $3, value, now(), base FROM legacy\n                   ON CONFLICT (workspace_id, path, typ, email) WHERE email IS NOT NULL\n                   DO UPDATE SET value = EXCLUDED.value, created_at = now(), base = EXCLUDED.base\n                   RETURNING 1 as \"one!\"",
   "describe": {
     "columns": [
       {
@@ -55,5 +55,5 @@
       null
     ]
   },
-  "hash": "46f00a75b2e7e4ac70758a9687070f68bc0421f1aa228f80157adda63191d33b"
+  "hash": "1c6859291963a9ca38d73f500213a575bfcd4469524f0dc8812470737759f02b"
 }
diff --git a/backend/.sqlx/query-1d8ccd32266637d7f7915f92a8483dce0c9986f3847227c2f66daa84d4109d7d.json b/backend/.sqlx/query-1d8ccd32266637d7f7915f92a8483dce0c9986f3847227c2f66daa84d4109d7d.json
deleted file mode 100644
index b9cbc6c382..0000000000
--- a/backend/.sqlx/query-1d8ccd32266637d7f7915f92a8483dce0c9986f3847227c2f66daa84d4109d7d.json
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO workspace_settings (workspace_id, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url) SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url FROM workspace_settings WHERE workspace_id = $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "1d8ccd32266637d7f7915f92a8483dce0c9986f3847227c2f66daa84d4109d7d"
-}
diff --git a/backend/.sqlx/query-207db6c65949b85fda6d6289921bb04695b1c50e17755dad3bd162254f67458f.json b/backend/.sqlx/query-207db6c65949b85fda6d6289921bb04695b1c50e17755dad3bd162254f67458f.json
new file mode 100644
index 0000000000..e698dbecb2
--- /dev/null
+++ b/backend/.sqlx/query-207db6c65949b85fda6d6289921bb04695b1c50e17755dad3bd162254f67458f.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE remote_deploy_token SET token = $1\n                     WHERE workspace_id = $2 AND email = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "207db6c65949b85fda6d6289921bb04695b1c50e17755dad3bd162254f67458f"
+}
diff --git a/backend/.sqlx/query-232ff36c2d522383061cafbf9639698dbc44a18c0f016aae94a1705f06fd1e48.json b/backend/.sqlx/query-232ff36c2d522383061cafbf9639698dbc44a18c0f016aae94a1705f06fd1e48.json
new file mode 100644
index 0000000000..f32e47b387
--- /dev/null
+++ b/backend/.sqlx/query-232ff36c2d522383061cafbf9639698dbc44a18c0f016aae94a1705f06fd1e48.json
@@ -0,0 +1,18 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO draft_move (workspace_id, typ, old_path, new_path, email)\n             SELECT m.workspace_id, m.typ, m.old_path, $4, $5::text\n             FROM draft_move m\n             WHERE m.workspace_id = $1 AND m.typ::text = ANY($2::text[])\n               AND m.new_path = $3 AND m.email IS NULL\n               AND NOT EXISTS (\n                   SELECT 1 FROM draft_move o\n                   WHERE o.workspace_id = m.workspace_id AND o.typ = m.typ\n                     AND o.old_path = m.old_path AND o.email = $5::text\n               )",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "TextArray",
+        "Text",
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "232ff36c2d522383061cafbf9639698dbc44a18c0f016aae94a1705f06fd1e48"
+}
diff --git a/backend/.sqlx/query-297c7a40dfce729d44aa37bc7c65560517bd25e40c0752a00467829191e2eb98.json b/backend/.sqlx/query-297c7a40dfce729d44aa37bc7c65560517bd25e40c0752a00467829191e2eb98.json
new file mode 100644
index 0000000000..cda61b894a
--- /dev/null
+++ b/backend/.sqlx/query-297c7a40dfce729d44aa37bc7c65560517bd25e40c0752a00467829191e2eb98.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE workspace_settings ws\n           SET datatable = (\n               SELECT jsonb_set(ws.datatable, '{datatables}', jsonb_object_agg(\n                   dt.key,\n                   CASE WHEN dt.value->'reference'->>'workspace_id' = $2\n                       THEN jsonb_set(dt.value, '{reference,workspace_id}', to_jsonb($1::text))\n                       ELSE dt.value END\n               ))\n               FROM jsonb_each(ws.datatable->'datatables') dt\n           )\n           WHERE jsonb_typeof(ws.datatable->'datatables') = 'object'\n             AND ws.datatable::text LIKE '%\"reference\"%'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "297c7a40dfce729d44aa37bc7c65560517bd25e40c0752a00467829191e2eb98"
+}
diff --git a/backend/.sqlx/query-2a391cc1bfcd2f75b46144a394c01237e09c3060da88170f1f6e06468309d213.json b/backend/.sqlx/query-2a391cc1bfcd2f75b46144a394c01237e09c3060da88170f1f6e06468309d213.json
new file mode 100644
index 0000000000..a893edfbd7
--- /dev/null
+++ b/backend/.sqlx/query-2a391cc1bfcd2f75b46144a394c01237e09c3060da88170f1f6e06468309d213.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE capture_config SET server_id = NULL, last_server_ping = NULL\n             WHERE workspace_id = $1 AND trigger_kind = 'postgres'\n               AND (trigger_config->>'postgres_resource_path' = $2\n                    OR trigger_config->>'postgres_resource_path' LIKE $3)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "2a391cc1bfcd2f75b46144a394c01237e09c3060da88170f1f6e06468309d213"
+}
diff --git a/backend/.sqlx/query-2d6b117324eaf076a0ed06d2cb0ce73279957d6a39fdc6b1ecb6e0a1e02f921f.json b/backend/.sqlx/query-2d6b117324eaf076a0ed06d2cb0ce73279957d6a39fdc6b1ecb6e0a1e02f921f.json
new file mode 100644
index 0000000000..4b96519a06
--- /dev/null
+++ b/backend/.sqlx/query-2d6b117324eaf076a0ed06d2cb0ce73279957d6a39fdc6b1ecb6e0a1e02f921f.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO usr (workspace_id, username, email, is_admin, created_at, operator, disabled, role, is_service_account, added_via)\n         SELECT $1, username, email, is_admin, created_at, operator, disabled, role, is_service_account,\n                CASE WHEN $3 THEN NULL ELSE added_via END\n         FROM usr WHERE workspace_id = $2\n           AND (NOT $3 OR (NOT operator AND NOT disabled AND NOT is_service_account))\n         ON CONFLICT DO NOTHING",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text",
+        "Bool"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "2d6b117324eaf076a0ed06d2cb0ce73279957d6a39fdc6b1ecb6e0a1e02f921f"
+}
diff --git a/backend/.sqlx/query-2f39fce0ee700117f3e4c066e0b56ee979e4c392970278304e80368b770bb7b4.json b/backend/.sqlx/query-2f39fce0ee700117f3e4c066e0b56ee979e4c392970278304e80368b770bb7b4.json
new file mode 100644
index 0000000000..99b1a9472d
--- /dev/null
+++ b/backend/.sqlx/query-2f39fce0ee700117f3e4c066e0b56ee979e4c392970278304e80368b770bb7b4.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT add_admins_and_developers_to_forks FROM workspace_settings WHERE workspace_id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "add_admins_and_developers_to_forks",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "2f39fce0ee700117f3e4c066e0b56ee979e4c392970278304e80368b770bb7b4"
+}
diff --git a/backend/.sqlx/query-3190736818379ad22628aae3c5a25ab0199084b35664cbb0a586917bfa0da075.json b/backend/.sqlx/query-3190736818379ad22628aae3c5a25ab0199084b35664cbb0a586917bfa0da075.json
new file mode 100644
index 0000000000..90566827e7
--- /dev/null
+++ b/backend/.sqlx/query-3190736818379ad22628aae3c5a25ab0199084b35664cbb0a586917bfa0da075.json
@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT COUNT(DISTINCT email) FROM usr WHERE is_service_account AND NOT disabled",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "3190736818379ad22628aae3c5a25ab0199084b35664cbb0a586917bfa0da075"
+}
diff --git a/backend/.sqlx/query-334dbcd48fb59c96c62c2705ab2d1ce716cd52417f487cc1a8dd376017b2db7d.json b/backend/.sqlx/query-334dbcd48fb59c96c62c2705ab2d1ce716cd52417f487cc1a8dd376017b2db7d.json
new file mode 100644
index 0000000000..0c94309c58
--- /dev/null
+++ b/backend/.sqlx/query-334dbcd48fb59c96c62c2705ab2d1ce716cd52417f487cc1a8dd376017b2db7d.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = $1)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Name"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "334dbcd48fb59c96c62c2705ab2d1ce716cd52417f487cc1a8dd376017b2db7d"
+}
diff --git a/backend/.sqlx/query-359cd29f531d263a8cf7205e0869229a610767087f01e0154be8da0620fa114b.json b/backend/.sqlx/query-359cd29f531d263a8cf7205e0869229a610767087f01e0154be8da0620fa114b.json
deleted file mode 100644
index 23cf739f90..0000000000
--- a/backend/.sqlx/query-359cd29f531d263a8cf7205e0869229a610767087f01e0154be8da0620fa114b.json
+++ /dev/null
@@ -1,38 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "WITH all_audit AS (SELECT username, operation, timestamp FROM audit_partitioned UNION ALL SELECT username, operation, timestamp FROM audit),\n        active_users as (SELECT distinct username as email FROM all_audit WHERE timestamp > NOW() - INTERVAL '1 month' AND (operation = 'users.login' OR operation = 'oauth.login' OR operation = 'users.token.refresh')),\n        active_authors as (SELECT distinct email FROM usr WHERE usr.operator IS false AND email IN (SELECT email FROM active_users)),\n        active_authors_agg as (SELECT array_agg(email) as authors FROM active_authors),\n        active_ops_agg as (SELECT array_agg(email) as operators from active_users WHERE email NOT IN (SELECT email FROM active_authors))\n        SELECT active_authors_agg.authors, active_ops_agg.operators, array_length(active_authors_agg.authors, 1) as author_count, array_length(active_ops_agg.operators, 1) as operator_count FROM active_authors_agg, active_ops_agg",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "authors",
-        "type_info": "VarcharArray"
-      },
-      {
-        "ordinal": 1,
-        "name": "operators",
-        "type_info": "VarcharArray"
-      },
-      {
-        "ordinal": 2,
-        "name": "author_count",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 3,
-        "name": "operator_count",
-        "type_info": "Int4"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      null,
-      null,
-      null,
-      null
-    ]
-  },
-  "hash": "359cd29f531d263a8cf7205e0869229a610767087f01e0154be8da0620fa114b"
-}
diff --git a/backend/.sqlx/query-372db51a00e5cf37f00af4b7962b30d71c74fffbba3f5ac6197c985fd73e5c11.json b/backend/.sqlx/query-372db51a00e5cf37f00af4b7962b30d71c74fffbba3f5ac6197c985fd73e5c11.json
new file mode 100644
index 0000000000..f5a2ac20ed
--- /dev/null
+++ b/backend/.sqlx/query-372db51a00e5cf37f00af4b7962b30d71c74fffbba3f5ac6197c985fd73e5c11.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT EXISTS(SELECT 1 FROM v2_job_queue WHERE id = $1 AND workspace_id = $2)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "372db51a00e5cf37f00af4b7962b30d71c74fffbba3f5ac6197c985fd73e5c11"
+}
diff --git a/backend/.sqlx/query-3a015ab279785a15f89c89d8c4d155e85370d4c2b7ed14fbb510919e7624ca1c.json b/backend/.sqlx/query-3a015ab279785a15f89c89d8c4d155e85370d4c2b7ed14fbb510919e7624ca1c.json
new file mode 100644
index 0000000000..c4cc310dbf
--- /dev/null
+++ b/backend/.sqlx/query-3a015ab279785a15f89c89d8c4d155e85370d4c2b7ed14fbb510919e7624ca1c.json
@@ -0,0 +1,18 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO draft_move (workspace_id, typ, old_path, new_path, email)\n         SELECT $1, t::draft_kind, $3, $4, $5 FROM unnest($2::text[]) t",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "TextArray",
+        "Varchar",
+        "Varchar",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "3a015ab279785a15f89c89d8c4d155e85370d4c2b7ed14fbb510919e7624ca1c"
+}
diff --git a/backend/.sqlx/query-3a0ac41e645225bbe54b83f246500ca014154e76eb322646e7e4e753b6420acd.json b/backend/.sqlx/query-3a0ac41e645225bbe54b83f246500ca014154e76eb322646e7e4e753b6420acd.json
new file mode 100644
index 0000000000..b3b683eca1
--- /dev/null
+++ b/backend/.sqlx/query-3a0ac41e645225bbe54b83f246500ca014154e76eb322646e7e4e753b6420acd.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM token WHERE token_prefix = 'GONE_TOKEN'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "3a0ac41e645225bbe54b83f246500ca014154e76eb322646e7e4e753b6420acd"
+}
diff --git a/backend/.sqlx/query-3b6f1e9765de11ef2da0ec5388c72e4a01f50d48b76b90746eef72919c408e44.json b/backend/.sqlx/query-3b6f1e9765de11ef2da0ec5388c72e4a01f50d48b76b90746eef72919c408e44.json
new file mode 100644
index 0000000000..9901e61b6a
--- /dev/null
+++ b/backend/.sqlx/query-3b6f1e9765de11ef2da0ec5388c72e4a01f50d48b76b90746eef72919c408e44.json
@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT email, token FROM remote_deploy_token\n         WHERE workspace_id = $1 AND token <> '' FOR UPDATE",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "email",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "token",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false
+    ]
+  },
+  "hash": "3b6f1e9765de11ef2da0ec5388c72e4a01f50d48b76b90746eef72919c408e44"
+}
diff --git a/backend/.sqlx/query-3db5f1d8ec1f8d867cf01c066876122e78f0c76a93a1d9860e8dff05d9a02c09.json b/backend/.sqlx/query-3db5f1d8ec1f8d867cf01c066876122e78f0c76a93a1d9860e8dff05d9a02c09.json
new file mode 100644
index 0000000000..db2181ae3c
--- /dev/null
+++ b/backend/.sqlx/query-3db5f1d8ec1f8d867cf01c066876122e78f0c76a93a1d9860e8dff05d9a02c09.json
@@ -0,0 +1,18 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE draft_move SET new_path = $4\n         WHERE workspace_id = $1 AND typ::text = ANY($2::text[])\n           AND new_path = $3 AND ($5::text IS NULL OR email = $5)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "TextArray",
+        "Text",
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "3db5f1d8ec1f8d867cf01c066876122e78f0c76a93a1d9860e8dff05d9a02c09"
+}
diff --git a/backend/.sqlx/query-4692810d2be817bbb5de9b476d68d695941bd4fb5ccef393e4da522ed479d601.json b/backend/.sqlx/query-4692810d2be817bbb5de9b476d68d695941bd4fb5ccef393e4da522ed479d601.json
new file mode 100644
index 0000000000..b0ad1eaf86
--- /dev/null
+++ b/backend/.sqlx/query-4692810d2be817bbb5de9b476d68d695941bd4fb5ccef393e4da522ed479d601.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE postgres_trigger SET server_id = NULL, last_server_ping = NULL\n         WHERE workspace_id = $1\n           AND (postgres_resource_path = $2 OR postgres_resource_path LIKE $3)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "4692810d2be817bbb5de9b476d68d695941bd4fb5ccef393e4da522ed479d601"
+}
diff --git a/backend/.sqlx/query-bd2609f999054c5a2a85f2aafe4005bc22731c27f0bf27b3b06ec426a05eda2e.json b/backend/.sqlx/query-4d2c91937d87d385290b918af0238825cdd7784d0d611cd0069b15d11039ac56.json
similarity index 82%
rename from backend/.sqlx/query-bd2609f999054c5a2a85f2aafe4005bc22731c27f0bf27b3b06ec426a05eda2e.json
rename to backend/.sqlx/query-4d2c91937d87d385290b918af0238825cdd7784d0d611cd0069b15d11039ac56.json
index 578edc6044..5c0e45b0d4 100644
--- a/backend/.sqlx/query-bd2609f999054c5a2a85f2aafe4005bc22731c27f0bf27b3b06ec426a05eda2e.json
+++ b/backend/.sqlx/query-4d2c91937d87d385290b918af0238825cdd7784d0d611cd0069b15d11039ac56.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        UPDATE schedule SET\n            schedule                = $1,\n            timezone                = $2,\n            args                    = $3,\n            on_failure              = $4,\n            on_failure_times        = $5,\n            on_failure_exact        = $6,\n            on_failure_extra_args   = $7,\n            on_recovery             = $8,\n            on_recovery_times       = $9,\n            on_recovery_extra_args  = $10,\n            on_success              = $11,\n            on_success_extra_args   = $12,\n            ws_error_handler_muted  = $13,\n            retry                   = $14,\n            summary                 = $15,\n            no_flow_overlap         = $16,\n            tag                     = $17,\n            paused_until            = $18,\n            path                    = $19,\n            workspace_id            = $20,\n            cron_version            = COALESCE($21, cron_version),\n            description             = $22,\n            dynamic_skip            = $23,\n            email                   = $24,\n            edited_by               = $25,\n            permissioned_as         = $26,\n            labels                  = COALESCE($27, labels)\n        WHERE path = $19 AND workspace_id = $20\n        RETURNING\n            workspace_id,\n            path,\n            edited_by,\n            edited_at,\n            schedule,\n            timezone,\n            enabled,\n            script_path,\n            is_flow,\n            args AS \"args: _\",\n            extra_perms,\n            email,\n            permissioned_as,\n            error,\n            on_failure,\n            on_failure_times,\n            on_failure_exact,\n            on_failure_extra_args AS \"on_failure_extra_args: _\",\n            on_recovery,\n            on_recovery_times,\n            on_recovery_extra_args AS \"on_recovery_extra_args: _\",\n            on_success,\n            on_success_extra_args AS \"on_success_extra_args: _\",\n            ws_error_handler_muted,\n            retry,\n            no_flow_overlap,\n            summary,\n            description,\n            tag,\n            paused_until,\n            cron_version,\n            dynamic_skip,\n            labels\n        ",
+  "query": "\n        UPDATE schedule SET\n            schedule                = $1,\n            timezone                = $2,\n            args                    = $3,\n            on_failure              = $4,\n            on_failure_times        = $5,\n            on_failure_exact        = $6,\n            on_failure_extra_args   = $7,\n            on_recovery             = $8,\n            on_recovery_times       = $9,\n            on_recovery_extra_args  = $10,\n            on_success              = $11,\n            on_success_extra_args   = $12,\n            ws_error_handler_muted  = $13,\n            retry                   = $14,\n            summary                 = $15,\n            no_flow_overlap         = $16,\n            tag                     = $17,\n            paused_until            = $18,\n            path                    = $19,\n            workspace_id            = $20,\n            cron_version            = COALESCE($21, cron_version),\n            description             = $22,\n            dynamic_skip            = $23,\n            email                   = $24,\n            edited_by               = $25,\n            edited_at               = now(),\n            permissioned_as         = $26,\n            labels                  = COALESCE($27, labels)\n        WHERE path = $19 AND workspace_id = $20\n        RETURNING\n            workspace_id,\n            path,\n            edited_by,\n            edited_at,\n            schedule,\n            timezone,\n            enabled,\n            script_path,\n            is_flow,\n            args AS \"args: _\",\n            extra_perms,\n            email,\n            permissioned_as,\n            error,\n            on_failure,\n            on_failure_times,\n            on_failure_exact,\n            on_failure_extra_args AS \"on_failure_extra_args: _\",\n            on_recovery,\n            on_recovery_times,\n            on_recovery_extra_args AS \"on_recovery_extra_args: _\",\n            on_success,\n            on_success_extra_args AS \"on_success_extra_args: _\",\n            ws_error_handler_muted,\n            retry,\n            no_flow_overlap,\n            summary,\n            description,\n            tag,\n            paused_until,\n            cron_version,\n            dynamic_skip,\n            labels\n        ",
   "describe": {
     "columns": [
       {
@@ -236,5 +236,5 @@
       true
     ]
   },
-  "hash": "bd2609f999054c5a2a85f2aafe4005bc22731c27f0bf27b3b06ec426a05eda2e"
+  "hash": "4d2c91937d87d385290b918af0238825cdd7784d0d611cd0069b15d11039ac56"
 }
diff --git a/backend/.sqlx/query-5048e21546f9710697100100e1255ab103979433bc386d7c89d0e30db12bfd57.json b/backend/.sqlx/query-5048e21546f9710697100100e1255ab103979433bc386d7c89d0e30db12bfd57.json
new file mode 100644
index 0000000000..804e294296
--- /dev/null
+++ b/backend/.sqlx/query-5048e21546f9710697100100e1255ab103979433bc386d7c89d0e30db12bfd57.json
@@ -0,0 +1,29 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT ws.workspace_id AS \"workspace_id!\", dt.key AS \"datatable!\"\n           FROM workspace_settings ws\n           CROSS JOIN LATERAL jsonb_each(COALESCE(ws.datatable->'datatables', '{}'::jsonb)) dt\n           WHERE dt.value->'reference'->>'workspace_id' = $1\n             AND dt.value->'reference'->>'datatable' = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "workspace_id!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "datatable!",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      null
+    ]
+  },
+  "hash": "5048e21546f9710697100100e1255ab103979433bc386d7c89d0e30db12bfd57"
+}
diff --git a/backend/.sqlx/query-51e1741eb9e959945302fd6f7e8c621b9b03b92f6c20ab1bdd1637232f26952d.json b/backend/.sqlx/query-51e1741eb9e959945302fd6f7e8c621b9b03b92f6c20ab1bdd1637232f26952d.json
new file mode 100644
index 0000000000..b6babc98b0
--- /dev/null
+++ b/backend/.sqlx/query-51e1741eb9e959945302fd6f7e8c621b9b03b92f6c20ab1bdd1637232f26952d.json
@@ -0,0 +1,41 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT clock_timestamp() AS \"started_at!\", s.remote_deploy_target,\n                  s.remote_deploy_target_changed_at,\n                  (SELECT u.created_at FROM usr u\n                   WHERE u.workspace_id = s.workspace_id AND u.email = $2) AS member_since\n           FROM workspace_settings s WHERE s.workspace_id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "started_at!",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 1,
+        "name": "remote_deploy_target",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 2,
+        "name": "remote_deploy_target_changed_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 3,
+        "name": "member_since",
+        "type_info": "Timestamptz"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null,
+      true,
+      true,
+      null
+    ]
+  },
+  "hash": "51e1741eb9e959945302fd6f7e8c621b9b03b92f6c20ab1bdd1637232f26952d"
+}
diff --git a/backend/.sqlx/query-530fe81babd82e7b4a9142962c62750560e459acc7c83c48d47d7bdad29051be.json b/backend/.sqlx/query-530fe81babd82e7b4a9142962c62750560e459acc7c83c48d47d7bdad29051be.json
new file mode 100644
index 0000000000..65266cbae0
--- /dev/null
+++ b/backend/.sqlx/query-530fe81babd82e7b4a9142962c62750560e459acc7c83c48d47d7bdad29051be.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO token (token_hash, token_prefix, token, email, label, super_admin, read_only)\n         VALUES (encode(sha256('READ_ONLY_TOKEN'::bytea), 'hex'), 'READ_ONLY_', 'READ_ONLY_TOKEN',\n                 'test@windmill.dev', 'read only', false, true)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "530fe81babd82e7b4a9142962c62750560e459acc7c83c48d47d7bdad29051be"
+}
diff --git a/backend/.sqlx/query-538dd1779874e4003932d7f17750239c625f85e25b3364bf2edf566f518c8ee2.json b/backend/.sqlx/query-538dd1779874e4003932d7f17750239c625f85e25b3364bf2edf566f518c8ee2.json
new file mode 100644
index 0000000000..03613519ad
--- /dev/null
+++ b/backend/.sqlx/query-538dd1779874e4003932d7f17750239c625f85e25b3364bf2edf566f518c8ee2.json
@@ -0,0 +1,29 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT ws.workspace_id AS \"workspace_id!\", dt.key AS \"datatable!\"\n               FROM workspace_settings ws\n               CROSS JOIN LATERAL jsonb_each(COALESCE(ws.datatable->'datatables', '{}'::jsonb)) dt\n               WHERE dt.value->'reference'->>'workspace_id' = $1\n                 AND dt.value->'reference'->>'datatable' = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "workspace_id!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "datatable!",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      null
+    ]
+  },
+  "hash": "538dd1779874e4003932d7f17750239c625f85e25b3364bf2edf566f518c8ee2"
+}
diff --git a/backend/.sqlx/query-5517b714165f959a1df1a0ac9cbe848344974bc2271459ba4ae5952274c11429.json b/backend/.sqlx/query-5517b714165f959a1df1a0ac9cbe848344974bc2271459ba4ae5952274c11429.json
new file mode 100644
index 0000000000..c29a42c56b
--- /dev/null
+++ b/backend/.sqlx/query-5517b714165f959a1df1a0ac9cbe848344974bc2271459ba4ae5952274c11429.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE workspace_settings SET remote_deploy_target_changed_at = '2000-01-01'\n         WHERE workspace_id = 'test-workspace'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "5517b714165f959a1df1a0ac9cbe848344974bc2271459ba4ae5952274c11429"
+}
diff --git a/backend/.sqlx/query-58e5cfe9eb87bda9f7de87c403861b6e7b9d35a41594681e2a92a87359e6a018.json b/backend/.sqlx/query-58e5cfe9eb87bda9f7de87c403861b6e7b9d35a41594681e2a92a87359e6a018.json
new file mode 100644
index 0000000000..f4f7acd0b7
--- /dev/null
+++ b/backend/.sqlx/query-58e5cfe9eb87bda9f7de87c403861b6e7b9d35a41594681e2a92a87359e6a018.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT username FROM usr WHERE workspace_id = $1 AND email = $2 AND disabled = false",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "username",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "58e5cfe9eb87bda9f7de87c403861b6e7b9d35a41594681e2a92a87359e6a018"
+}
diff --git a/backend/.sqlx/query-5959c60da91f1e62080a4455e2a4627cb1fd3d8c70210bf7f38cb222dd15d88f.json b/backend/.sqlx/query-5959c60da91f1e62080a4455e2a4627cb1fd3d8c70210bf7f38cb222dd15d88f.json
new file mode 100644
index 0000000000..b78808a389
--- /dev/null
+++ b/backend/.sqlx/query-5959c60da91f1e62080a4455e2a4627cb1fd3d8c70210bf7f38cb222dd15d88f.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM draft_move dest\n         WHERE dest.email = $1\n           AND EXISTS (SELECT 1 FROM draft_move src\n                       WHERE src.email = $2\n                         AND src.workspace_id = dest.workspace_id\n                         AND src.old_path = dest.old_path\n                         AND src.typ = dest.typ)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "5959c60da91f1e62080a4455e2a4627cb1fd3d8c70210bf7f38cb222dd15d88f"
+}
diff --git a/backend/.sqlx/query-5b292c49ce6b64f4de61f74e18831b3f107fc6d0312ac3da9247a922bcb05b67.json b/backend/.sqlx/query-5b292c49ce6b64f4de61f74e18831b3f107fc6d0312ac3da9247a922bcb05b67.json
new file mode 100644
index 0000000000..7633c95854
--- /dev/null
+++ b/backend/.sqlx/query-5b292c49ce6b64f4de61f74e18831b3f107fc6d0312ac3da9247a922bcb05b67.json
@@ -0,0 +1,43 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT t.token, t.remote_email, t.proxy_key, t.connected_at FROM remote_deploy_token t\n         JOIN workspace_settings s ON s.workspace_id = t.workspace_id\n         WHERE t.workspace_id = $1 AND t.email = $2 AND t.base_url = $3\n           AND t.remote_workspace_id = $4 AND t.token <> ''\n           AND s.remote_deploy_target_changed_at IS NOT DISTINCT FROM t.target_changed_at\n           AND (EXISTS (SELECT 1 FROM usr u WHERE u.workspace_id = t.workspace_id\n                          AND u.email = t.email AND u.created_at = t.member_since)\n                OR EXISTS (SELECT 1 FROM password p WHERE p.email = t.email AND p.super_admin))",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "token",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 1,
+        "name": "remote_email",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "proxy_key",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "connected_at",
+        "type_info": "Timestamptz"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      false
+    ]
+  },
+  "hash": "5b292c49ce6b64f4de61f74e18831b3f107fc6d0312ac3da9247a922bcb05b67"
+}
diff --git a/backend/.sqlx/query-a6decdebcd9750691f20f874b66a9c6f2ede08c33605c6a3c3dfc213a3eda76a.json b/backend/.sqlx/query-5ccfbd0f345b9b86ca356008def6cc1011a49fc8d8ad046ac572e81cf8938995.json
similarity index 63%
rename from backend/.sqlx/query-a6decdebcd9750691f20f874b66a9c6f2ede08c33605c6a3c3dfc213a3eda76a.json
rename to backend/.sqlx/query-5ccfbd0f345b9b86ca356008def6cc1011a49fc8d8ad046ac572e81cf8938995.json
index 0532a5d3a0..7cd917d623 100644
--- a/backend/.sqlx/query-a6decdebcd9750691f20f874b66a9c6f2ede08c33605c6a3c3dfc213a3eda76a.json
+++ b/backend/.sqlx/query-5ccfbd0f345b9b86ca356008def6cc1011a49fc8d8ad046ac572e81cf8938995.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        UPDATE workspace_settings\n        SET\n            ai_config = source_ws.ai_config,\n            large_file_storage = source_ws.large_file_storage,\n            ducklake = source_ws.ducklake,\n            dbt_warehouses = source_ws.dbt_warehouses,\n            datatable = source_ws.datatable,\n            git_app_installations = source_ws.git_app_installations\n        FROM workspace_settings source_ws\n        WHERE source_ws.workspace_id = $1\n        AND workspace_settings.workspace_id = $2\n        ",
+  "query": "\n        UPDATE workspace_settings\n        SET\n            ai_config = source_ws.ai_config,\n            large_file_storage = source_ws.large_file_storage,\n            ducklake = source_ws.ducklake,\n            dbt_warehouses = source_ws.dbt_warehouses,\n            datatable = source_ws.datatable,\n            git_app_installations = source_ws.git_app_installations,\n            add_admins_and_developers_to_forks = source_ws.add_admins_and_developers_to_forks\n        FROM workspace_settings source_ws\n        WHERE source_ws.workspace_id = $1\n        AND workspace_settings.workspace_id = $2\n        ",
   "describe": {
     "columns": [],
     "parameters": {
@@ -11,5 +11,5 @@
     },
     "nullable": []
   },
-  "hash": "a6decdebcd9750691f20f874b66a9c6f2ede08c33605c6a3c3dfc213a3eda76a"
+  "hash": "5ccfbd0f345b9b86ca356008def6cc1011a49fc8d8ad046ac572e81cf8938995"
 }
diff --git a/backend/.sqlx/query-6b58f2df413a867a44311fd779a2017c41b9a0e3985a25372e5f64723124e473.json b/backend/.sqlx/query-6b58f2df413a867a44311fd779a2017c41b9a0e3985a25372e5f64723124e473.json
new file mode 100644
index 0000000000..20b5bd1a94
--- /dev/null
+++ b/backend/.sqlx/query-6b58f2df413a867a44311fd779a2017c41b9a0e3985a25372e5f64723124e473.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO remote_deploy_token\n             (workspace_id, email, base_url, remote_workspace_id, token, remote_email, proxy_key,\n              connected_at)\n         VALUES ($1, $2, '', '', '', '', '', clock_timestamp())\n         ON CONFLICT (workspace_id, email) DO UPDATE SET\n             token = '', proxy_key = '', connected_at = clock_timestamp()",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "6b58f2df413a867a44311fd779a2017c41b9a0e3985a25372e5f64723124e473"
+}
diff --git a/backend/.sqlx/query-94fd0a57cfc9341b2e9deae60506c6c06aa6934b87200da14231f12f65149cd3.json b/backend/.sqlx/query-6c57c46c5a0462f379ed6a22ae97e363009177fdc45d795447a920f455f193cc.json
similarity index 77%
rename from backend/.sqlx/query-94fd0a57cfc9341b2e9deae60506c6c06aa6934b87200da14231f12f65149cd3.json
rename to backend/.sqlx/query-6c57c46c5a0462f379ed6a22ae97e363009177fdc45d795447a920f455f193cc.json
index d54260b4f7..b8a19247ca 100644
--- a/backend/.sqlx/query-94fd0a57cfc9341b2e9deae60506c6c06aa6934b87200da14231f12f65149cd3.json
+++ b/backend/.sqlx/query-6c57c46c5a0462f379ed6a22ae97e363009177fdc45d795447a920f455f193cc.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "DELETE FROM token_expiry_notification n\n         USING token t\n         WHERE n.token_hash = t.token_hash\n           AND n.expiration > now()\n           AND n.expiration <= now() + interval '7 days'\n         RETURNING t.token_prefix, t.label, t.email, t.workspace_id",
+  "query": "DELETE FROM token_expiry_notification n\n         USING token t\n         WHERE n.token_hash = t.token_hash\n           AND n.expiration > now()\n           AND n.expiration <= now() + make_interval(days => $1)\n         RETURNING t.token_prefix, t.label, t.email, t.workspace_id",
   "describe": {
     "columns": [
       {
@@ -25,7 +25,9 @@
       }
     ],
     "parameters": {
-      "Left": []
+      "Left": [
+        "Int4"
+      ]
     },
     "nullable": [
       false,
@@ -34,5 +36,5 @@
       true
     ]
   },
-  "hash": "94fd0a57cfc9341b2e9deae60506c6c06aa6934b87200da14231f12f65149cd3"
+  "hash": "6c57c46c5a0462f379ed6a22ae97e363009177fdc45d795447a920f455f193cc"
 }
diff --git a/backend/.sqlx/query-6f9fb5d72f486358fa25d6887bd69b93910e028f140c07048f2c1c8d63ee6909.json b/backend/.sqlx/query-6f9fb5d72f486358fa25d6887bd69b93910e028f140c07048f2c1c8d63ee6909.json
new file mode 100644
index 0000000000..d87d3aeba5
--- /dev/null
+++ b/backend/.sqlx/query-6f9fb5d72f486358fa25d6887bd69b93910e028f140c07048f2c1c8d63ee6909.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO global_settings (name, value) VALUES ($1, $2)\n         ON CONFLICT (name) DO UPDATE SET value = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "6f9fb5d72f486358fa25d6887bd69b93910e028f140c07048f2c1c8d63ee6909"
+}
diff --git a/backend/.sqlx/query-6fcdb09cdd7fedd7e54fdc0e49203f453fc1b85272fe212c0e1bf0ebd28bf58a.json b/backend/.sqlx/query-6fcdb09cdd7fedd7e54fdc0e49203f453fc1b85272fe212c0e1bf0ebd28bf58a.json
deleted file mode 100644
index 17fbb0d5bb..0000000000
--- a/backend/.sqlx/query-6fcdb09cdd7fedd7e54fdc0e49203f453fc1b85272fe212c0e1bf0ebd28bf58a.json
+++ /dev/null
@@ -1,38 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        WITH capped AS (\n            SELECT timestamp, operation, resource, parameters\n            FROM audit_partitioned\n            WHERE workspace_id = 'admins'\n              AND operation = 'workspace_fairness.capped'\n            UNION ALL\n            SELECT timestamp, operation, resource, parameters\n            FROM audit\n            WHERE workspace_id = 'admins'\n              AND operation = 'workspace_fairness.capped'\n            ORDER BY timestamp DESC\n            LIMIT 200\n        ), uncapped AS (\n            SELECT timestamp, operation, resource, parameters\n            FROM audit_partitioned\n            WHERE workspace_id = 'admins'\n              AND operation = 'workspace_fairness.uncapped'\n            UNION ALL\n            SELECT timestamp, operation, resource, parameters\n            FROM audit\n            WHERE workspace_id = 'admins'\n              AND operation = 'workspace_fairness.uncapped'\n            ORDER BY timestamp DESC\n            LIMIT 200\n        )\n        SELECT timestamp AS \"timestamp!\",\n               operation::text AS \"operation!\",\n               resource AS workspace_id,\n               parameters\n        FROM (SELECT * FROM capped UNION ALL SELECT * FROM uncapped) e\n        ORDER BY timestamp DESC\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "timestamp!",
-        "type_info": "Timestamptz"
-      },
-      {
-        "ordinal": 1,
-        "name": "operation!",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 2,
-        "name": "workspace_id",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 3,
-        "name": "parameters",
-        "type_info": "Jsonb"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      null,
-      null,
-      null,
-      null
-    ]
-  },
-  "hash": "6fcdb09cdd7fedd7e54fdc0e49203f453fc1b85272fe212c0e1bf0ebd28bf58a"
-}
diff --git a/backend/.sqlx/query-71ee2cb6661cca1fa4d8874a7f6d368347c59f36fd87df6dc7996152ccb84af0.json b/backend/.sqlx/query-71ee2cb6661cca1fa4d8874a7f6d368347c59f36fd87df6dc7996152ccb84af0.json
new file mode 100644
index 0000000000..a03fab7081
--- /dev/null
+++ b/backend/.sqlx/query-71ee2cb6661cca1fa4d8874a7f6d368347c59f36fd87df6dc7996152ccb84af0.json
@@ -0,0 +1,38 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT id, name, enabled, pwd FROM datatable_role",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "name",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "enabled",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 3,
+        "name": "pwd",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      true
+    ]
+  },
+  "hash": "71ee2cb6661cca1fa4d8874a7f6d368347c59f36fd87df6dc7996152ccb84af0"
+}
diff --git a/backend/.sqlx/query-75e6b5cd52d63ac094c90abd1524bc7a919692a96b076b8aaf24d812723531c8.json b/backend/.sqlx/query-75e6b5cd52d63ac094c90abd1524bc7a919692a96b076b8aaf24d812723531c8.json
new file mode 100644
index 0000000000..27c62583f1
--- /dev/null
+++ b/backend/.sqlx/query-75e6b5cd52d63ac094c90abd1524bc7a919692a96b076b8aaf24d812723531c8.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT EXISTS(SELECT 1 FROM usr WHERE email = $1 AND is_service_account IS true\n            AND ($2::varchar IS NULL OR workspace_id = $2))",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Varchar"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "75e6b5cd52d63ac094c90abd1524bc7a919692a96b076b8aaf24d812723531c8"
+}
diff --git a/backend/.sqlx/query-7761959d05fff8c314d04c1bc9fb4e84a61008dbec0995ae192f1b3a1c261579.json b/backend/.sqlx/query-7761959d05fff8c314d04c1bc9fb4e84a61008dbec0995ae192f1b3a1c261579.json
new file mode 100644
index 0000000000..c8b20a20ea
--- /dev/null
+++ b/backend/.sqlx/query-7761959d05fff8c314d04c1bc9fb4e84a61008dbec0995ae192f1b3a1c261579.json
@@ -0,0 +1,72 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO draft (workspace_id, email, path, typ, value, created_at, base)\n               VALUES ($1, $2, $3::text, $4,\n                       CASE WHEN $10::bool\n                            THEN to_json($5::text::jsonb || jsonb_strip_nulls(jsonb_build_object(\n                                'path', CASE WHEN $5::text::jsonb -> 'path' = to_jsonb($11::text)\n                                             THEN to_jsonb($3::text) END,\n                                'draft_path', CASE WHEN $5::text::jsonb -> 'draft_path' = to_jsonb($11::text)\n                                                   THEN to_jsonb($3::text) END)))\n                            ELSE $5::text::json\n                       END,\n                       COALESCE($8::timestamptz, now()), $9)\n               ON CONFLICT (workspace_id, path, typ, email) WHERE email IS NOT NULL\n               DO UPDATE SET value = CASE\n                                 WHEN NOT $10::bool\n                                   OR position(chr(92) || 'u0000' in replace(draft.value::text, chr(92) || chr(92), '')) > 0\n                                     THEN EXCLUDED.value\n                                 ELSE to_json((to_jsonb(EXCLUDED.value) - 'path' - 'draft_path')\n                                     || jsonb_strip_nulls(jsonb_build_object(\n                                         'path', to_jsonb(draft.value) -> 'path',\n                                         'draft_path', to_jsonb(draft.value) -> 'draft_path')))\n                             END,\n                             created_at = EXCLUDED.created_at,\n                             base = EXCLUDED.base\n               WHERE $7::bool = true\n                  OR $6::timestamptz IS NULL\n                  OR draft.created_at <= $6::timestamptz\n               RETURNING path, created_at",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "created_at",
+        "type_info": "Timestamptz"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Text",
+        {
+          "Custom": {
+            "name": "draft_kind",
+            "kind": {
+              "Enum": [
+                "script",
+                "flow",
+                "app",
+                "raw_app",
+                "resource",
+                "variable",
+                "trigger_schedule",
+                "trigger_webhook",
+                "trigger_default_email",
+                "trigger_email",
+                "trigger_http",
+                "trigger_websocket",
+                "trigger_postgres",
+                "trigger_kafka",
+                "trigger_nats",
+                "trigger_mqtt",
+                "trigger_sqs",
+                "trigger_gcp",
+                "trigger_azure",
+                "trigger_poll",
+                "trigger_cli",
+                "trigger_nextcloud",
+                "trigger_google",
+                "trigger_github",
+                "data_pipeline",
+                "trigger_amqp"
+              ]
+            }
+          }
+        },
+        "Text",
+        "Timestamptz",
+        "Bool",
+        "Timestamptz",
+        "Text",
+        "Bool",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false
+    ]
+  },
+  "hash": "7761959d05fff8c314d04c1bc9fb4e84a61008dbec0995ae192f1b3a1c261579"
+}
diff --git a/backend/.sqlx/query-797896e0152046844dbfee9d0e57e0055d742e44119bfb31ae7ff37a89b34d14.json b/backend/.sqlx/query-797896e0152046844dbfee9d0e57e0055d742e44119bfb31ae7ff37a89b34d14.json
new file mode 100644
index 0000000000..ce3d615eb0
--- /dev/null
+++ b/backend/.sqlx/query-797896e0152046844dbfee9d0e57e0055d742e44119bfb31ae7ff37a89b34d14.json
@@ -0,0 +1,18 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM draft_move\n         WHERE workspace_id = $1 AND typ::text = ANY($2::text[])\n           AND old_path IN ($3, $4) AND ($5::text IS NULL OR email = $5)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "TextArray",
+        "Varchar",
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "797896e0152046844dbfee9d0e57e0055d742e44119bfb31ae7ff37a89b34d14"
+}
diff --git a/backend/.sqlx/query-79799b5a2e499df6c28e286c42b9ad2db940c2455ab19cc95e5198baf96d5629.json b/backend/.sqlx/query-79799b5a2e499df6c28e286c42b9ad2db940c2455ab19cc95e5198baf96d5629.json
new file mode 100644
index 0000000000..c36b6fb361
--- /dev/null
+++ b/backend/.sqlx/query-79799b5a2e499df6c28e286c42b9ad2db940c2455ab19cc95e5198baf96d5629.json
@@ -0,0 +1,29 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        SELECT ws.workspace_id AS \"workspace_id!\", dt.key AS \"datatable!\"\n        FROM workspace_settings ws\n        JOIN workspace w ON w.id = ws.workspace_id AND w.deleted = false\n        CROSS JOIN LATERAL jsonb_each(COALESCE(ws.datatable->'datatables', '{}'::jsonb)) dt\n        WHERE ws.workspace_id <> $1\n          AND dt.value->'database'->>'resource_type' = 'instance'\n          AND dt.value->'database'->>'resource_path' = $2\n        ORDER BY ws.workspace_id, dt.key\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "workspace_id!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "datatable!",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      null
+    ]
+  },
+  "hash": "79799b5a2e499df6c28e286c42b9ad2db940c2455ab19cc95e5198baf96d5629"
+}
diff --git a/backend/.sqlx/query-88a134e4ca82d5ce0334977c7713021ae3e99a5a61ea1c944c1df1368746dfa5.json b/backend/.sqlx/query-7b33adb5cf051bc123340982b97a80a96ee43e1c91d9907d50cc2ee14111623e.json
similarity index 78%
rename from backend/.sqlx/query-88a134e4ca82d5ce0334977c7713021ae3e99a5a61ea1c944c1df1368746dfa5.json
rename to backend/.sqlx/query-7b33adb5cf051bc123340982b97a80a96ee43e1c91d9907d50cc2ee14111623e.json
index 7cfe9aa070..541832d45f 100644
--- a/backend/.sqlx/query-88a134e4ca82d5ce0334977c7713021ae3e99a5a61ea1c944c1df1368746dfa5.json
+++ b/backend/.sqlx/query-7b33adb5cf051bc123340982b97a80a96ee43e1c91d9907d50cc2ee14111623e.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT workspace.id, workspace.name, usr.username, workspace_settings.color, workspace.parent_workspace_id,\n                workspace.is_dev_workspace, workspace.dev_workspace_label,\n                workspace.owner AS \"created_by?\",\n                CASE WHEN usr.operator THEN workspace_settings.operator_settings ELSE NULL END as operator_settings,\n                usr.disabled\n         FROM workspace\n         JOIN usr ON usr.workspace_id = workspace.id\n         JOIN workspace_settings ON workspace_settings.workspace_id = workspace.id\n         WHERE usr.email = $1 AND workspace.deleted = false",
+  "query": "SELECT workspace.id, workspace.name, usr.username, workspace_settings.color, workspace.parent_workspace_id,\n                workspace.is_dev_workspace, workspace.dev_workspace_label,\n                workspace.owner AS \"created_by?\",\n                CASE WHEN usr.operator THEN workspace_settings.operator_settings ELSE NULL END as operator_settings,\n                usr.disabled, usr.is_service_account\n         FROM workspace\n         JOIN usr ON usr.workspace_id = workspace.id\n         JOIN workspace_settings ON workspace_settings.workspace_id = workspace.id\n         WHERE usr.email = $1 AND workspace.deleted = false",
   "describe": {
     "columns": [
       {
@@ -52,6 +52,11 @@
         "ordinal": 9,
         "name": "disabled",
         "type_info": "Bool"
+      },
+      {
+        "ordinal": 10,
+        "name": "is_service_account",
+        "type_info": "Bool"
       }
     ],
     "parameters": {
@@ -69,8 +74,9 @@
       true,
       false,
       null,
+      false,
       false
     ]
   },
-  "hash": "88a134e4ca82d5ce0334977c7713021ae3e99a5a61ea1c944c1df1368746dfa5"
+  "hash": "7b33adb5cf051bc123340982b97a80a96ee43e1c91d9907d50cc2ee14111623e"
 }
diff --git a/backend/.sqlx/query-7ff60d155510303e307c47dcb6153ccaac72871eb68822d8e296c0d747e55f35.json b/backend/.sqlx/query-7ff60d155510303e307c47dcb6153ccaac72871eb68822d8e296c0d747e55f35.json
new file mode 100644
index 0000000000..6a004023a0
--- /dev/null
+++ b/backend/.sqlx/query-7ff60d155510303e307c47dcb6153ccaac72871eb68822d8e296c0d747e55f35.json
@@ -0,0 +1,43 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT flow_version.id, flow_version.created_at, flow_version.created_by, deployment_metadata.deployment_msg FROM flow_version\n        LEFT JOIN deployment_metadata ON flow_version.id = deployment_metadata.flow_version\n        WHERE flow_version.path = $1 AND flow_version.workspace_id = $2\n        ORDER BY flow_version.created_at DESC\n        LIMIT $3 OFFSET $4",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "created_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 2,
+        "name": "created_by",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "deployment_msg",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Int8",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      true
+    ]
+  },
+  "hash": "7ff60d155510303e307c47dcb6153ccaac72871eb68822d8e296c0d747e55f35"
+}
diff --git a/backend/.sqlx/query-81d5cceb2e405e1d17730dfa93a32f1bca7b235af9db581147d838454a4c9083.json b/backend/.sqlx/query-81d5cceb2e405e1d17730dfa93a32f1bca7b235af9db581147d838454a4c9083.json
new file mode 100644
index 0000000000..40b6e22db6
--- /dev/null
+++ b/backend/.sqlx/query-81d5cceb2e405e1d17730dfa93a32f1bca7b235af9db581147d838454a4c9083.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM remote_deploy_token WHERE workspace_id = $1\n           AND ($2::text IS NULL OR base_url <> $2 OR remote_workspace_id <> $3)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "81d5cceb2e405e1d17730dfa93a32f1bca7b235af9db581147d838454a4c9083"
+}
diff --git a/backend/.sqlx/query-86af9d51a158ea5cb6161461ecddf2a63695f8cbf8af648da5a0a77a5b9d02ba.json b/backend/.sqlx/query-86af9d51a158ea5cb6161461ecddf2a63695f8cbf8af648da5a0a77a5b9d02ba.json
new file mode 100644
index 0000000000..7627d9828d
--- /dev/null
+++ b/backend/.sqlx/query-86af9d51a158ea5cb6161461ecddf2a63695f8cbf8af648da5a0a77a5b9d02ba.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO datatable_role (id, name, enabled, pwd) VALUES ($1, $2, $3, $4)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Bool",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "86af9d51a158ea5cb6161461ecddf2a63695f8cbf8af648da5a0a77a5b9d02ba"
+}
diff --git a/backend/.sqlx/query-87afd5289e54b6accda8a399ec3c66df3d19217059f62903be3c74eadb9c15d5.json b/backend/.sqlx/query-87afd5289e54b6accda8a399ec3c66df3d19217059f62903be3c74eadb9c15d5.json
deleted file mode 100644
index 8cdb2d5907..0000000000
--- a/backend/.sqlx/query-87afd5289e54b6accda8a399ec3c66df3d19217059f62903be3c74eadb9c15d5.json
+++ /dev/null
@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO draft (workspace_id, path, typ, value, created_at, email)\n         SELECT $2, path, typ,\n                CASE WHEN typ IN ('script', 'flow')\n                     THEN to_json(to_jsonb(value) - 'on_behalf_of')\n                     ELSE value END,\n                created_at, email\n         FROM draft\n         WHERE workspace_id = $1 AND (email = $3 OR email IS NULL)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Varchar",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "87afd5289e54b6accda8a399ec3c66df3d19217059f62903be3c74eadb9c15d5"
-}
diff --git a/backend/.sqlx/query-8ce4461e7dd087782a239972c173786891eb99e9ba86b11cfb17d28856babd2e.json b/backend/.sqlx/query-8ce4461e7dd087782a239972c173786891eb99e9ba86b11cfb17d28856babd2e.json
new file mode 100644
index 0000000000..c732c4549d
--- /dev/null
+++ b/backend/.sqlx/query-8ce4461e7dd087782a239972c173786891eb99e9ba86b11cfb17d28856babd2e.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE remote_deploy_token SET token = $1 WHERE workspace_id = 'test-workspace'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "8ce4461e7dd087782a239972c173786891eb99e9ba86b11cfb17d28856babd2e"
+}
diff --git a/backend/.sqlx/query-dc4a57df3becc610f631ef22c116450390addbfae85fecc61c991d94167e6e99.json b/backend/.sqlx/query-8ebe054b41793f1a7b85f1f8d29cd21d12fa1207b58bfc46249c250cdcdb5363.json
similarity index 93%
rename from backend/.sqlx/query-dc4a57df3becc610f631ef22c116450390addbfae85fecc61c991d94167e6e99.json
rename to backend/.sqlx/query-8ebe054b41793f1a7b85f1f8d29cd21d12fa1207b58bfc46249c250cdcdb5363.json
index 01c0fd19af..7a822a8d6a 100644
--- a/backend/.sqlx/query-dc4a57df3becc610f631ef22c116450390addbfae85fecc61c991d94167e6e99.json
+++ b/backend/.sqlx/query-8ebe054b41793f1a7b85f1f8d29cd21d12fa1207b58bfc46249c250cdcdb5363.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        SELECT\n            workspace_id,\n            slack_team_id,\n            teams_team_id,\n            teams_team_name,\n            teams_team_guid,\n            slack_name,\n            slack_command_script,\n            teams_command_script,\n            slack_email,\n            slack_oauth_client_id,\n            slack_oauth_client_secret,\n            customer_id,\n            plan,\n            webhook,\n            ai_config,\n            dbt_warehouses,\n            large_file_storage,\n            datatable,\n            ducklake,\n            git_sync,\n            deploy_ui,\n            default_app,\n            default_scripts,\n            mute_critical_alerts,\n            color,\n            operator_settings,\n            git_app_installations,\n            auto_invite,\n            error_handler,\n            success_handler,\n            public_app_execution_limit_per_minute,\n            error_handler_fallback_to_instance_alerts,\n            guest_access_enabled,\n            guest_jwt_public_key,\n            guest_jwt_jwks_url\n        FROM\n            workspace_settings\n        WHERE\n            workspace_id = $1\n        ",
+  "query": "\n        SELECT\n            workspace_id,\n            slack_team_id,\n            teams_team_id,\n            teams_team_name,\n            teams_team_guid,\n            slack_name,\n            slack_command_script,\n            teams_command_script,\n            slack_email,\n            slack_oauth_client_id,\n            slack_oauth_client_secret,\n            customer_id,\n            plan,\n            webhook,\n            ai_config,\n            dbt_warehouses,\n            large_file_storage,\n            datatable,\n            ducklake,\n            git_sync,\n            deploy_ui,\n            default_app,\n            default_scripts,\n            mute_critical_alerts,\n            color,\n            operator_settings,\n            git_app_installations,\n            auto_invite,\n            error_handler,\n            success_handler,\n            public_app_execution_limit_per_minute,\n            error_handler_fallback_to_instance_alerts,\n            guest_access_enabled,\n            guest_jwt_public_key,\n            guest_jwt_jwks_url,\n            add_admins_and_developers_to_forks\n        FROM\n            workspace_settings\n        WHERE\n            workspace_id = $1\n        ",
   "describe": {
     "columns": [
       {
@@ -177,6 +177,11 @@
         "ordinal": 34,
         "name": "guest_jwt_jwks_url",
         "type_info": "Text"
+      },
+      {
+        "ordinal": 35,
+        "name": "add_admins_and_developers_to_forks",
+        "type_info": "Bool"
       }
     ],
     "parameters": {
@@ -219,8 +224,9 @@
       false,
       false,
       true,
-      true
+      true,
+      false
     ]
   },
-  "hash": "dc4a57df3becc610f631ef22c116450390addbfae85fecc61c991d94167e6e99"
+  "hash": "8ebe054b41793f1a7b85f1f8d29cd21d12fa1207b58bfc46249c250cdcdb5363"
 }
diff --git a/backend/.sqlx/query-3c057e0284f1219865b8f7dc6eb3c1293c4b72d0b52abeefd1e954617984a2d8.json b/backend/.sqlx/query-91e2456814ac29534f5a1f65a3bb97462276930f0a83ffb458f7cb26035c8c3d.json
similarity index 59%
rename from backend/.sqlx/query-3c057e0284f1219865b8f7dc6eb3c1293c4b72d0b52abeefd1e954617984a2d8.json
rename to backend/.sqlx/query-91e2456814ac29534f5a1f65a3bb97462276930f0a83ffb458f7cb26035c8c3d.json
index 3206ba4433..57dbc41a9f 100644
--- a/backend/.sqlx/query-3c057e0284f1219865b8f7dc6eb3c1293c4b72d0b52abeefd1e954617984a2d8.json
+++ b/backend/.sqlx/query-91e2456814ac29534f5a1f65a3bb97462276930f0a83ffb458f7cb26035c8c3d.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "DELETE FROM datatable_migrations WHERE workspace_id = $1 AND datatable = $2 AND timestamp = $3 RETURNING name",
+  "query": "DELETE FROM datatable_migrations WHERE workspace_id = $1 AND datatable = $2 AND timestamp = $3 AND code_up = $4 AND code_down IS NOT DISTINCT FROM $5 RETURNING name",
   "describe": {
     "columns": [
       {
@@ -13,12 +13,14 @@
       "Left": [
         "Text",
         "Text",
-        "Int8"
+        "Int8",
+        "Text",
+        "Text"
       ]
     },
     "nullable": [
       false
     ]
   },
-  "hash": "3c057e0284f1219865b8f7dc6eb3c1293c4b72d0b52abeefd1e954617984a2d8"
+  "hash": "91e2456814ac29534f5a1f65a3bb97462276930f0a83ffb458f7cb26035c8c3d"
 }
diff --git a/backend/.sqlx/query-960d6eca64de008f821b1e96345530f057d91c0e0986fdc0de7d9a3ef0c143e2.json b/backend/.sqlx/query-960d6eca64de008f821b1e96345530f057d91c0e0986fdc0de7d9a3ef0c143e2.json
new file mode 100644
index 0000000000..7d819b9b84
--- /dev/null
+++ b/backend/.sqlx/query-960d6eca64de008f821b1e96345530f057d91c0e0986fdc0de7d9a3ef0c143e2.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE remote_deploy_token SET workspace_id = $1 WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "960d6eca64de008f821b1e96345530f057d91c0e0986fdc0de7d9a3ef0c143e2"
+}
diff --git a/backend/.sqlx/query-965f9fb9d73f21695cf9c4018107bf8dec0a9b1c38a6776f8b3db7f2f8a883b7.json b/backend/.sqlx/query-965f9fb9d73f21695cf9c4018107bf8dec0a9b1c38a6776f8b3db7f2f8a883b7.json
new file mode 100644
index 0000000000..a7fe120abb
--- /dev/null
+++ b/backend/.sqlx/query-965f9fb9d73f21695cf9c4018107bf8dec0a9b1c38a6776f8b3db7f2f8a883b7.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE remote_deploy_token SET connected_at = clock_timestamp() + interval '1 hour'\n         WHERE workspace_id = 'test-workspace' AND email = 'test@windmill.dev'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "965f9fb9d73f21695cf9c4018107bf8dec0a9b1c38a6776f8b3db7f2f8a883b7"
+}
diff --git a/backend/.sqlx/query-9723edfd6de38cf0bf21123a46d88fa7d0b650b5cfd80c099f785f5e411062e5.json b/backend/.sqlx/query-9723edfd6de38cf0bf21123a46d88fa7d0b650b5cfd80c099f785f5e411062e5.json
new file mode 100644
index 0000000000..4704ddd84e
--- /dev/null
+++ b/backend/.sqlx/query-9723edfd6de38cf0bf21123a46d88fa7d0b650b5cfd80c099f785f5e411062e5.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM draft_move WHERE workspace_id = $1 AND typ::text = ANY($2::text[])\n           AND (old_path = $3 OR (new_path = $3 AND $4::text IS NULL))",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "TextArray",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "9723edfd6de38cf0bf21123a46d88fa7d0b650b5cfd80c099f785f5e411062e5"
+}
diff --git a/backend/.sqlx/query-975e404ac3a6258bb8220e122e3de094c7ab23330fdbc74d6e4ad472ddd3c820.json b/backend/.sqlx/query-975e404ac3a6258bb8220e122e3de094c7ab23330fdbc74d6e4ad472ddd3c820.json
new file mode 100644
index 0000000000..87666986a3
--- /dev/null
+++ b/backend/.sqlx/query-975e404ac3a6258bb8220e122e3de094c7ab23330fdbc74d6e4ad472ddd3c820.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO global_settings (name, value) VALUES ($1, $2)\n         ON CONFLICT (name) DO UPDATE SET value = $2, updated_at = now()",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "975e404ac3a6258bb8220e122e3de094c7ab23330fdbc74d6e4ad472ddd3c820"
+}
diff --git a/backend/.sqlx/query-9a2345e35c9f44578aa7dde994fdde0be9e0d192e0aee224bff78d8bd2ccbd8b.json b/backend/.sqlx/query-9a2345e35c9f44578aa7dde994fdde0be9e0d192e0aee224bff78d8bd2ccbd8b.json
new file mode 100644
index 0000000000..0bc09d9430
--- /dev/null
+++ b/backend/.sqlx/query-9a2345e35c9f44578aa7dde994fdde0be9e0d192e0aee224bff78d8bd2ccbd8b.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE v2_job_completed SET status = 'canceled'::job_status, canceled_by = $2, canceled_reason = $3 WHERE id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "9a2345e35c9f44578aa7dde994fdde0be9e0d192e0aee224bff78d8bd2ccbd8b"
+}
diff --git a/backend/.sqlx/query-9b61979cc78e8b7b63ffa6a59cf3d29ae8b924200c46da457a9346379c60fa9f.json b/backend/.sqlx/query-9b61979cc78e8b7b63ffa6a59cf3d29ae8b924200c46da457a9346379c60fa9f.json
new file mode 100644
index 0000000000..112ca1603f
--- /dev/null
+++ b/backend/.sqlx/query-9b61979cc78e8b7b63ffa6a59cf3d29ae8b924200c46da457a9346379c60fa9f.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE workspace_settings SET remote_deploy_target = $1::jsonb,\n             remote_deploy_target_changed_at = CASE\n                 WHEN remote_deploy_target IS DISTINCT FROM $1::jsonb THEN clock_timestamp()\n                 ELSE remote_deploy_target_changed_at END\n         WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Jsonb",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "9b61979cc78e8b7b63ffa6a59cf3d29ae8b924200c46da457a9346379c60fa9f"
+}
diff --git a/backend/.sqlx/query-9bd1995747f0073b3a866d1238e78f7e6dfa9185056f7731547ff05b8176b271.json b/backend/.sqlx/query-9bd1995747f0073b3a866d1238e78f7e6dfa9185056f7731547ff05b8176b271.json
new file mode 100644
index 0000000000..9c4d587c01
--- /dev/null
+++ b/backend/.sqlx/query-9bd1995747f0073b3a866d1238e78f7e6dfa9185056f7731547ff05b8176b271.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE workspace_settings SET add_admins_and_developers_to_forks = $1 WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Bool",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "9bd1995747f0073b3a866d1238e78f7e6dfa9185056f7731547ff05b8176b271"
+}
diff --git a/backend/.sqlx/query-9d1b202844e6935e636d1570a92d46af4419dda9410ffc46f19bc38e56efe609.json b/backend/.sqlx/query-9d1b202844e6935e636d1570a92d46af4419dda9410ffc46f19bc38e56efe609.json
new file mode 100644
index 0000000000..f882ce2986
--- /dev/null
+++ b/backend/.sqlx/query-9d1b202844e6935e636d1570a92d46af4419dda9410ffc46f19bc38e56efe609.json
@@ -0,0 +1,18 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM draft_move\n         WHERE workspace_id = $1 AND typ::text = ANY($2::text[])\n           AND new_path = $4 AND old_path <> $3 AND ($5::text IS NULL OR email = $5)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "TextArray",
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "9d1b202844e6935e636d1570a92d46af4419dda9410ffc46f19bc38e56efe609"
+}
diff --git a/backend/.sqlx/query-9f663180166f53d117e794f3f3a5723a0a43db163ecca7d5a63d4e74ab1d3be1.json b/backend/.sqlx/query-9f663180166f53d117e794f3f3a5723a0a43db163ecca7d5a63d4e74ab1d3be1.json
new file mode 100644
index 0000000000..4dd7ea9bd8
--- /dev/null
+++ b/backend/.sqlx/query-9f663180166f53d117e794f3f3a5723a0a43db163ecca7d5a63d4e74ab1d3be1.json
@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT pg_advisory_xact_lock(hashtext('datatable_role_catalog'))",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "pg_advisory_xact_lock",
+        "type_info": "Void"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "9f663180166f53d117e794f3f3a5723a0a43db163ecca7d5a63d4e74ab1d3be1"
+}
diff --git a/backend/.sqlx/query-a0f1c0df6bc2f1fbca50edee90e42c94445536e201b322eda6f7a90bdf38f36a.json b/backend/.sqlx/query-a0f1c0df6bc2f1fbca50edee90e42c94445536e201b322eda6f7a90bdf38f36a.json
deleted file mode 100644
index 3ed4f5a316..0000000000
--- a/backend/.sqlx/query-a0f1c0df6bc2f1fbca50edee90e42c94445536e201b322eda6f7a90bdf38f36a.json
+++ /dev/null
@@ -1,35 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT flow_version.id, flow_version.created_at, deployment_metadata.deployment_msg FROM flow_version \n        LEFT JOIN deployment_metadata ON flow_version.id = deployment_metadata.flow_version\n        WHERE flow_version.path = $1 AND flow_version.workspace_id = $2 \n        ORDER BY flow_version.created_at DESC",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Int8"
-      },
-      {
-        "ordinal": 1,
-        "name": "created_at",
-        "type_info": "Timestamptz"
-      },
-      {
-        "ordinal": 2,
-        "name": "deployment_msg",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      true
-    ]
-  },
-  "hash": "a0f1c0df6bc2f1fbca50edee90e42c94445536e201b322eda6f7a90bdf38f36a"
-}
diff --git a/backend/.sqlx/query-a1bcf143135ecb9f32709a56a353d3246dc238920c3e155caa9cf767246fa6fb.json b/backend/.sqlx/query-a1bcf143135ecb9f32709a56a353d3246dc238920c3e155caa9cf767246fa6fb.json
new file mode 100644
index 0000000000..18ee22083e
--- /dev/null
+++ b/backend/.sqlx/query-a1bcf143135ecb9f32709a56a353d3246dc238920c3e155caa9cf767246fa6fb.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE workspace_settings SET auto_invite = (COALESCE(auto_invite, '{}'::jsonb) - 'domain') || $1::jsonb WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Jsonb",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "a1bcf143135ecb9f32709a56a353d3246dc238920c3e155caa9cf767246fa6fb"
+}
diff --git a/backend/.sqlx/query-a1ed94ef0a6d4f7bc89ac4a2341bc06dc95d60ec92469523935f5a18a4d3f907.json b/backend/.sqlx/query-a1ed94ef0a6d4f7bc89ac4a2341bc06dc95d60ec92469523935f5a18a4d3f907.json
new file mode 100644
index 0000000000..c536425f1d
--- /dev/null
+++ b/backend/.sqlx/query-a1ed94ef0a6d4f7bc89ac4a2341bc06dc95d60ec92469523935f5a18a4d3f907.json
@@ -0,0 +1,85 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT\n                 -- The guard's own predicate, ordered own row, then legacy, then another\n                 -- user's other-kind row: each needs a different remedy, and a bare\n                 -- LIMIT 1 would name an arbitrary one.\n                 (SELECT typ::text FROM draft WHERE workspace_id = $1 AND path = $3\n                  AND typ::text = ANY($6::text[])\n                  AND (typ <> $2 OR email = $4 OR email IS NULL)\n                  ORDER BY CASE WHEN email = $4 THEN 0 WHEN email IS NULL THEN 1 ELSE 2 END\n                  LIMIT 1) as \"at_target\",\n                 EXISTS(SELECT 1 FROM draft WHERE workspace_id = $1 AND path = $3\n                        AND typ::text = ANY($6::text[]) AND email = $4) as \"at_target_own!\",\n                 EXISTS(SELECT 1 FROM draft WHERE workspace_id = $1 AND path = $3\n                        AND typ::text = ANY($6::text[]) AND email IS NULL) as \"at_target_legacy!\",\n                 EXISTS(SELECT 1 FROM draft WHERE workspace_id = $1 AND path = $5\n                        AND typ = $2 AND email = $4\n                        AND position(chr(92) || 'u0000' in replace(value::text, chr(92) || chr(92), '')) > 0\n                       ) as \"poisoned!\",\n                 EXISTS(SELECT 1 FROM draft WHERE workspace_id = $1 AND path = $5\n                        AND typ = $2 AND email IS NULL) as \"legacy!\" ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "at_target",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 1,
+        "name": "at_target_own!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 2,
+        "name": "at_target_legacy!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 3,
+        "name": "poisoned!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 4,
+        "name": "legacy!",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        {
+          "Custom": {
+            "name": "draft_kind",
+            "kind": {
+              "Enum": [
+                "script",
+                "flow",
+                "app",
+                "raw_app",
+                "resource",
+                "variable",
+                "trigger_schedule",
+                "trigger_webhook",
+                "trigger_default_email",
+                "trigger_email",
+                "trigger_http",
+                "trigger_websocket",
+                "trigger_postgres",
+                "trigger_kafka",
+                "trigger_nats",
+                "trigger_mqtt",
+                "trigger_sqs",
+                "trigger_gcp",
+                "trigger_azure",
+                "trigger_poll",
+                "trigger_cli",
+                "trigger_nextcloud",
+                "trigger_google",
+                "trigger_github",
+                "data_pipeline",
+                "trigger_amqp"
+              ]
+            }
+          }
+        },
+        "Text",
+        "Text",
+        "Text",
+        "TextArray"
+      ]
+    },
+    "nullable": [
+      null,
+      null,
+      null,
+      null,
+      null
+    ]
+  },
+  "hash": "a1ed94ef0a6d4f7bc89ac4a2341bc06dc95d60ec92469523935f5a18a4d3f907"
+}
diff --git a/backend/.sqlx/query-a57de2bb0442a5ee8a607cd63cfcf675de175796184f620cb4b09670c8b0b19f.json b/backend/.sqlx/query-a57de2bb0442a5ee8a607cd63cfcf675de175796184f620cb4b09670c8b0b19f.json
new file mode 100644
index 0000000000..f3b2cb571e
--- /dev/null
+++ b/backend/.sqlx/query-a57de2bb0442a5ee8a607cd63cfcf675de175796184f620cb4b09670c8b0b19f.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE capture_config SET server_id = NULL, last_server_ping = NULL\n         WHERE workspace_id = $1 AND trigger_kind = 'postgres'\n           AND (trigger_config->>'postgres_resource_path' = $2\n                OR trigger_config->>'postgres_resource_path' LIKE $3)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "a57de2bb0442a5ee8a607cd63cfcf675de175796184f620cb4b09670c8b0b19f"
+}
diff --git a/backend/.sqlx/query-a725d5b99b65a1637406179b058a1ff36620099c6b87fd82a59eae1e35303c07.json b/backend/.sqlx/query-a725d5b99b65a1637406179b058a1ff36620099c6b87fd82a59eae1e35303c07.json
new file mode 100644
index 0000000000..2acc85fcd4
--- /dev/null
+++ b/backend/.sqlx/query-a725d5b99b65a1637406179b058a1ff36620099c6b87fd82a59eae1e35303c07.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE draft_move SET workspace_id = $1 WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "a725d5b99b65a1637406179b058a1ff36620099c6b87fd82a59eae1e35303c07"
+}
diff --git a/backend/.sqlx/query-a866da25370c8b829fd8038c55c0f43e27a6eea453415495b66c50045defacff.json b/backend/.sqlx/query-a866da25370c8b829fd8038c55c0f43e27a6eea453415495b66c50045defacff.json
new file mode 100644
index 0000000000..18951e2a87
--- /dev/null
+++ b/backend/.sqlx/query-a866da25370c8b829fd8038c55c0f43e27a6eea453415495b66c50045defacff.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM usr WHERE workspace_id = 'test-workspace' AND email = 'test@windmill.dev'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "a866da25370c8b829fd8038c55c0f43e27a6eea453415495b66c50045defacff"
+}
diff --git a/backend/.sqlx/query-a9ae6c222727b7078fd25ed91f51c363a4e5719b5ceb17e8194c2eb038f59c68.json b/backend/.sqlx/query-a9ae6c222727b7078fd25ed91f51c363a4e5719b5ceb17e8194c2eb038f59c68.json
new file mode 100644
index 0000000000..6529400823
--- /dev/null
+++ b/backend/.sqlx/query-a9ae6c222727b7078fd25ed91f51c363a4e5719b5ceb17e8194c2eb038f59c68.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE remote_deploy_token SET token = 'not-under-this-key'\n         WHERE workspace_id = 'test-workspace'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "a9ae6c222727b7078fd25ed91f51c363a4e5719b5ceb17e8194c2eb038f59c68"
+}
diff --git a/backend/.sqlx/query-af1bc312f13d7590a138e2de4996dab8e5ac9c774cf81df9da85ac3c40e8b3c7.json b/backend/.sqlx/query-af1bc312f13d7590a138e2de4996dab8e5ac9c774cf81df9da85ac3c40e8b3c7.json
new file mode 100644
index 0000000000..4ec7511c7c
--- /dev/null
+++ b/backend/.sqlx/query-af1bc312f13d7590a138e2de4996dab8e5ac9c774cf81df9da85ac3c40e8b3c7.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO token (token_hash, token_prefix, token, email, label, super_admin)\n         VALUES (encode(sha256('GONE_TOKEN'::bytea), 'hex'), 'GONE_TOKEN', 'GONE_TOKEN',\n                 'test@windmill.dev', 'gone', true)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "af1bc312f13d7590a138e2de4996dab8e5ac9c774cf81df9da85ac3c40e8b3c7"
+}
diff --git a/backend/.sqlx/query-255ba68caa78d0e814ea817693a319f769907025f9c7d1150d45e8ecb1bff4ab.json b/backend/.sqlx/query-b2014ff45992b34c08f27419c26e975ff2b1baee63651e0ce79156b331389923.json
similarity index 52%
rename from backend/.sqlx/query-255ba68caa78d0e814ea817693a319f769907025f9c7d1150d45e8ecb1bff4ab.json
rename to backend/.sqlx/query-b2014ff45992b34c08f27419c26e975ff2b1baee63651e0ce79156b331389923.json
index 245c65a7a8..77cd542d6b 100644
--- a/backend/.sqlx/query-255ba68caa78d0e814ea817693a319f769907025f9c7d1150d45e8ecb1bff4ab.json
+++ b/backend/.sqlx/query-b2014ff45992b34c08f27419c26e975ff2b1baee63651e0ce79156b331389923.json
@@ -1,15 +1,15 @@
 {
   "db_name": "PostgreSQL",
-  "query": "UPDATE workspace_settings SET auto_invite = $1 WHERE workspace_id = $2",
+  "query": "DELETE FROM remote_deploy_token WHERE email = $1 AND workspace_id = $2",
   "describe": {
     "columns": [],
     "parameters": {
       "Left": [
-        "Jsonb",
+        "Text",
         "Text"
       ]
     },
     "nullable": []
   },
-  "hash": "255ba68caa78d0e814ea817693a319f769907025f9c7d1150d45e8ecb1bff4ab"
+  "hash": "b2014ff45992b34c08f27419c26e975ff2b1baee63651e0ce79156b331389923"
 }
diff --git a/backend/.sqlx/query-d631a26e5531589ff37e677f91a4f1d9f850e3e46c17130dd580426cda7a9f65.json b/backend/.sqlx/query-b30fb28004897cd1d201a416cdabf124a055eb44b3c5892fd18ff7baf6010ae9.json
similarity index 74%
rename from backend/.sqlx/query-d631a26e5531589ff37e677f91a4f1d9f850e3e46c17130dd580426cda7a9f65.json
rename to backend/.sqlx/query-b30fb28004897cd1d201a416cdabf124a055eb44b3c5892fd18ff7baf6010ae9.json
index 8cef9fc8aa..c15e0edb33 100644
--- a/backend/.sqlx/query-d631a26e5531589ff37e677f91a4f1d9f850e3e46c17130dd580426cda7a9f65.json
+++ b/backend/.sqlx/query-b30fb28004897cd1d201a416cdabf124a055eb44b3c5892fd18ff7baf6010ae9.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "UPDATE token SET label = $1\n           WHERE email = $2 AND token_prefix = $3\n             AND (label IS NULL OR (\n                 label <> 'session'\n                 AND label <> 'guest_session'\n                 AND lower(label) NOT LIKE 'ephemeral%'\n                 AND label <> 'debugger-token'\n                 AND label NOT LIKE 'mcp-oauth-%'\n                 AND NOT starts_with(label, 'embed_app:')\n                 AND NOT starts_with(label, 'sdk_app:')\n                 AND NOT starts_with(label, 'impersonation:')\n             ))\n           RETURNING token_prefix",
+  "query": "UPDATE token SET label = $1\n           WHERE email = $2 AND token_prefix = $3\n             AND (label IS NULL OR (\n                 label <> 'session'\n                 AND label <> 'guest_session'\n                 AND lower(label) NOT LIKE 'ephemeral%'\n                 AND label <> 'debugger-token'\n                 AND label NOT LIKE 'mcp-oauth-%'\n                 AND NOT starts_with(label, 'embed_app:')\n                 AND NOT starts_with(label, 'sdk_app:')\n                 AND NOT starts_with(label, 'impersonation:')\n                 AND NOT starts_with(label, 'cli-login:')\n                 AND NOT starts_with(label, 'remote-deploy:')\n             ))\n           RETURNING token_prefix",
   "describe": {
     "columns": [
       {
@@ -20,5 +20,5 @@
       false
     ]
   },
-  "hash": "d631a26e5531589ff37e677f91a4f1d9f850e3e46c17130dd580426cda7a9f65"
+  "hash": "b30fb28004897cd1d201a416cdabf124a055eb44b3c5892fd18ff7baf6010ae9"
 }
diff --git a/backend/.sqlx/query-b42af37fb474bea4c5419b0a46d9eadfe384013ab970ccf9c5effd1c78321b7c.json b/backend/.sqlx/query-b42af37fb474bea4c5419b0a46d9eadfe384013ab970ccf9c5effd1c78321b7c.json
new file mode 100644
index 0000000000..65c7f47b30
--- /dev/null
+++ b/backend/.sqlx/query-b42af37fb474bea4c5419b0a46d9eadfe384013ab970ccf9c5effd1c78321b7c.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT ws.datatable->'datatables' FROM workspace_settings ws\n             WHERE ws.workspace_id = $1 FOR UPDATE",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "?column?",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "b42af37fb474bea4c5419b0a46d9eadfe384013ab970ccf9c5effd1c78321b7c"
+}
diff --git a/backend/.sqlx/query-b9842d2d8abf382bd82d8fa1de012373638be391f884f81dc387ffc465badac6.json b/backend/.sqlx/query-b9842d2d8abf382bd82d8fa1de012373638be391f884f81dc387ffc465badac6.json
new file mode 100644
index 0000000000..4b3a2f33e9
--- /dev/null
+++ b/backend/.sqlx/query-b9842d2d8abf382bd82d8fa1de012373638be391f884f81dc387ffc465badac6.json
@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT jsonb_object_keys(value->'databases') FROM global_settings\n         WHERE name = 'custom_instance_pg_databases'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "jsonb_object_keys",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "b9842d2d8abf382bd82d8fa1de012373638be391f884f81dc387ffc465badac6"
+}
diff --git a/backend/.sqlx/query-b98844926ff127c528ed3e7bc63bf1ebed0192be267983e8fbd18f79997e6142.json b/backend/.sqlx/query-b98844926ff127c528ed3e7bc63bf1ebed0192be267983e8fbd18f79997e6142.json
deleted file mode 100644
index 94cf77ebc5..0000000000
--- a/backend/.sqlx/query-b98844926ff127c528ed3e7bc63bf1ebed0192be267983e8fbd18f79997e6142.json
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO usr (workspace_id, username, email, is_admin, created_at, operator, disabled, role, is_service_account, added_via)\n         SELECT $1, username, email, is_admin, created_at, operator, disabled, role, is_service_account, added_via\n         FROM usr WHERE workspace_id = $2\n         ON CONFLICT DO NOTHING",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "b98844926ff127c528ed3e7bc63bf1ebed0192be267983e8fbd18f79997e6142"
-}
diff --git a/backend/.sqlx/query-bd8ac169ad15346f28f561233fe340efd453512c1464a413af2393ab8bfea9ee.json b/backend/.sqlx/query-bd8ac169ad15346f28f561233fe340efd453512c1464a413af2393ab8bfea9ee.json
new file mode 100644
index 0000000000..8a59831e8a
--- /dev/null
+++ b/backend/.sqlx/query-bd8ac169ad15346f28f561233fe340efd453512c1464a413af2393ab8bfea9ee.json
@@ -0,0 +1,47 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT a.id as app_id, av.id as version_id, dm.deployment_msg as deployment_msg,\n                av.created_by as created_by, av.created_at as created_at\n        FROM app a JOIN app_version av\n             ON av.id = a.versions[array_upper(a.versions, 1)] AND av.app_id = a.id\n        LEFT JOIN deployment_metadata dm ON av.id = dm.app_version\n        WHERE a.workspace_id = $1 AND a.path = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "app_id",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "version_id",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 2,
+        "name": "deployment_msg",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
+        "name": "created_by",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 4,
+        "name": "created_at",
+        "type_info": "Timestamptz"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      true,
+      false,
+      false
+    ]
+  },
+  "hash": "bd8ac169ad15346f28f561233fe340efd453512c1464a413af2393ab8bfea9ee"
+}
diff --git a/backend/.sqlx/query-c1d026c886799dabc39ce73e1fe09ccb175c7271df75d67aa9c72ad6f825a992.json b/backend/.sqlx/query-c1d026c886799dabc39ce73e1fe09ccb175c7271df75d67aa9c72ad6f825a992.json
new file mode 100644
index 0000000000..f5fde93bf7
--- /dev/null
+++ b/backend/.sqlx/query-c1d026c886799dabc39ce73e1fe09ccb175c7271df75d67aa9c72ad6f825a992.json
@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM usr WHERE email = $1 RETURNING username, workspace_id",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "username",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "workspace_id",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false
+    ]
+  },
+  "hash": "c1d026c886799dabc39ce73e1fe09ccb175c7271df75d67aa9c72ad6f825a992"
+}
diff --git a/backend/.sqlx/query-c5451ea9d9fa5146af242d1ee8c19ebd65b80e7ed9f29b9fb2e03767c2aa94ba.json b/backend/.sqlx/query-c5451ea9d9fa5146af242d1ee8c19ebd65b80e7ed9f29b9fb2e03767c2aa94ba.json
new file mode 100644
index 0000000000..5d8ca8dc00
--- /dev/null
+++ b/backend/.sqlx/query-c5451ea9d9fa5146af242d1ee8c19ebd65b80e7ed9f29b9fb2e03767c2aa94ba.json
@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT ws.workspace_id AS \"workspace_id!\", dt.key AS \"datatable!\"\n           FROM workspace_settings ws\n           CROSS JOIN LATERAL jsonb_each(COALESCE(ws.datatable->'datatables', '{}'::jsonb)) dt\n           WHERE dt.value->'reference'->>'workspace_id' = $1\n           ORDER BY ws.workspace_id, dt.key",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "workspace_id!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "datatable!",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      null
+    ]
+  },
+  "hash": "c5451ea9d9fa5146af242d1ee8c19ebd65b80e7ed9f29b9fb2e03767c2aa94ba"
+}
diff --git a/backend/.sqlx/query-c703da3c3e133536dda9721644561af624ab6de67a5c82967f4df8117fe50bc7.json b/backend/.sqlx/query-c703da3c3e133536dda9721644561af624ab6de67a5c82967f4df8117fe50bc7.json
new file mode 100644
index 0000000000..4ed2afc15b
--- /dev/null
+++ b/backend/.sqlx/query-c703da3c3e133536dda9721644561af624ab6de67a5c82967f4df8117fe50bc7.json
@@ -0,0 +1,47 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT q.scheduled_for, s.path, s.schedule, s.cron_version, s.timezone\n         FROM v2_job j\n         JOIN v2_job_queue q USING (id)\n         JOIN schedule s ON s.workspace_id = j.workspace_id AND s.path = j.trigger\n         WHERE j.id = $1 AND j.workspace_id = $2 AND j.trigger_kind = 'schedule'\n            AND j.parent_job IS NULL AND q.scheduled_for > now()",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "scheduled_for",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 1,
+        "name": "path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "schedule",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "cron_version",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 4,
+        "name": "timezone",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      true,
+      false
+    ]
+  },
+  "hash": "c703da3c3e133536dda9721644561af624ab6de67a5c82967f4df8117fe50bc7"
+}
diff --git a/backend/.sqlx/query-c85d362fe2e652d4ac01a35bf470e80b993020a2ff5dcb5849dc570d52798587.json b/backend/.sqlx/query-c85d362fe2e652d4ac01a35bf470e80b993020a2ff5dcb5849dc570d52798587.json
new file mode 100644
index 0000000000..7a7da4308d
--- /dev/null
+++ b/backend/.sqlx/query-c85d362fe2e652d4ac01a35bf470e80b993020a2ff5dcb5849dc570d52798587.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM datatable_role WHERE id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "c85d362fe2e652d4ac01a35bf470e80b993020a2ff5dcb5849dc570d52798587"
+}
diff --git a/backend/.sqlx/query-c96486a83ba0f4bf8daf3c525d6f67554643d0e730bec2e64840ad3d1862e540.json b/backend/.sqlx/query-c96486a83ba0f4bf8daf3c525d6f67554643d0e730bec2e64840ad3d1862e540.json
new file mode 100644
index 0000000000..7422dd2333
--- /dev/null
+++ b/backend/.sqlx/query-c96486a83ba0f4bf8daf3c525d6f67554643d0e730bec2e64840ad3d1862e540.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM remote_deploy_token WHERE email = 'test@windmill.dev'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "c96486a83ba0f4bf8daf3c525d6f67554643d0e730bec2e64840ad3d1862e540"
+}
diff --git a/backend/.sqlx/query-cad45b99cd110589665e864f73403c2b12a3cf12ee81e67b0e9e520b3315e7d6.json b/backend/.sqlx/query-cad45b99cd110589665e864f73403c2b12a3cf12ee81e67b0e9e520b3315e7d6.json
new file mode 100644
index 0000000000..85c999e3ba
--- /dev/null
+++ b/backend/.sqlx/query-cad45b99cd110589665e864f73403c2b12a3cf12ee81e67b0e9e520b3315e7d6.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE workspace_settings\n                 SET remote_deploy_target = $1, remote_deploy_target_changed_at = now()\n                 WHERE workspace_id = 'test-workspace'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "cad45b99cd110589665e864f73403c2b12a3cf12ee81e67b0e9e520b3315e7d6"
+}
diff --git a/backend/.sqlx/query-5c141db5cd6806cc27696a38b7f56a190dbea3ff59e2961658dd1677365e0fdf.json b/backend/.sqlx/query-cbb59234f5a2d2e866aa6ceea8981bd3618b90615f7afab360dfbd6fb567b45b.json
similarity index 60%
rename from backend/.sqlx/query-5c141db5cd6806cc27696a38b7f56a190dbea3ff59e2961658dd1677365e0fdf.json
rename to backend/.sqlx/query-cbb59234f5a2d2e866aa6ceea8981bd3618b90615f7afab360dfbd6fb567b45b.json
index 3d61a47eb1..f631078e76 100644
--- a/backend/.sqlx/query-5c141db5cd6806cc27696a38b7f56a190dbea3ff59e2961658dd1677365e0fdf.json
+++ b/backend/.sqlx/query-cbb59234f5a2d2e866aa6ceea8981bd3618b90615f7afab360dfbd6fb567b45b.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "UPDATE v2_job_status SET\n                    flow_status = jsonb_set(\n                        jsonb_set(flow_status, ARRAY['modules', $3::INTEGER::TEXT, 'job'], to_jsonb($1::UUID::TEXT)),\n                        ARRAY['modules', $3::INTEGER::TEXT, 'type'],\n                        to_jsonb('InProgress'::text)\n                    )\n                WHERE id = $2",
+  "query": "UPDATE v2_job_status SET\n                    flow_status = jsonb_set(\n                        jsonb_set(flow_status, ARRAY['modules', $3::INTEGER::TEXT, 'job'], to_jsonb($1::UUID::TEXT)),\n                        ARRAY['modules', $3::INTEGER::TEXT, 'type'],\n                        to_jsonb('InProgress'::text)\n                    )\n                WHERE id = $2\n                  AND NOT COALESCE(\n                      flow_status->'modules'->$3::INTEGER @> '{\"type\": \"InProgress\", \"parallel\": true}',\n                      false\n                  )",
   "describe": {
     "columns": [],
     "parameters": {
@@ -12,5 +12,5 @@
     },
     "nullable": []
   },
-  "hash": "5c141db5cd6806cc27696a38b7f56a190dbea3ff59e2961658dd1677365e0fdf"
+  "hash": "cbb59234f5a2d2e866aa6ceea8981bd3618b90615f7afab360dfbd6fb567b45b"
 }
diff --git a/backend/.sqlx/query-d0548225d92e6e7d0eb9a0227a6522398d2a3ae99d0568b785e63749d6f3225a.json b/backend/.sqlx/query-d0548225d92e6e7d0eb9a0227a6522398d2a3ae99d0568b785e63749d6f3225a.json
new file mode 100644
index 0000000000..2ff2722f77
--- /dev/null
+++ b/backend/.sqlx/query-d0548225d92e6e7d0eb9a0227a6522398d2a3ae99d0568b785e63749d6f3225a.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE workspace_settings ws\n           SET datatable = (\n               SELECT jsonb_set(ws.datatable, '{datatables}', jsonb_object_agg(\n                   dt.key,\n                   (SELECT CASE WHEN r.v->'governed_by'->>'workspace_id' = $2\n                               THEN jsonb_set(r.v, '{governed_by,workspace_id}', to_jsonb($1::text))\n                               ELSE r.v END\n                    FROM (SELECT CASE WHEN dt.value->'reference'->>'workspace_id' = $2\n                                     THEN jsonb_set(dt.value, '{reference,workspace_id}', to_jsonb($1::text))\n                                     ELSE dt.value END AS v) r)\n               ))\n               FROM jsonb_each(ws.datatable->'datatables') dt\n           )\n           WHERE jsonb_typeof(ws.datatable->'datatables') = 'object'\n             AND (ws.datatable::text LIKE '%\"reference\"%'\n                  OR ws.datatable::text LIKE '%\"governed_by\"%')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "d0548225d92e6e7d0eb9a0227a6522398d2a3ae99d0568b785e63749d6f3225a"
+}
diff --git a/backend/.sqlx/query-d21d9d7e37045529ae4b73febc145cb080009a7a6d9ef33111755b470ff5abe2.json b/backend/.sqlx/query-d21d9d7e37045529ae4b73febc145cb080009a7a6d9ef33111755b470ff5abe2.json
new file mode 100644
index 0000000000..cde3e698d9
--- /dev/null
+++ b/backend/.sqlx/query-d21d9d7e37045529ae4b73febc145cb080009a7a6d9ef33111755b470ff5abe2.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM remote_deploy_token WHERE workspace_id = $1 AND email = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "d21d9d7e37045529ae4b73febc145cb080009a7a6d9ef33111755b470ff5abe2"
+}
diff --git a/backend/.sqlx/query-d305aed6172e25707492677b6cd3b8f3f6ea8f2c8f5bdc1a97736c8e52378ee9.json b/backend/.sqlx/query-d305aed6172e25707492677b6cd3b8f3f6ea8f2c8f5bdc1a97736c8e52378ee9.json
new file mode 100644
index 0000000000..4031e19231
--- /dev/null
+++ b/backend/.sqlx/query-d305aed6172e25707492677b6cd3b8f3f6ea8f2c8f5bdc1a97736c8e52378ee9.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE usr SET created_at = created_at - interval '1 hour'\n         WHERE workspace_id = 'test-workspace' AND email = 'test2@windmill.dev'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "d305aed6172e25707492677b6cd3b8f3f6ea8f2c8f5bdc1a97736c8e52378ee9"
+}
diff --git a/backend/.sqlx/query-d48ca62c86b1af7a9dd2450c1c28dc45020a2a553d8874c49f9eafedea5a9d40.json b/backend/.sqlx/query-d48ca62c86b1af7a9dd2450c1c28dc45020a2a553d8874c49f9eafedea5a9d40.json
new file mode 100644
index 0000000000..49875acd78
--- /dev/null
+++ b/backend/.sqlx/query-d48ca62c86b1af7a9dd2450c1c28dc45020a2a553d8874c49f9eafedea5a9d40.json
@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT dt.key AS \"datatable!\"\n           FROM workspace_settings ws\n           CROSS JOIN LATERAL jsonb_each(COALESCE(ws.datatable->'datatables', '{}'::jsonb)) dt\n           WHERE ws.workspace_id = $1\n             AND dt.key <> $2\n             AND NOT dt.value ? 'permissions'\n             AND dt.value->'database'->>'resource_type' = 'instance'\n             AND dt.value->'database'->>'resource_path' = $3\n           ORDER BY dt.key",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "datatable!",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "d48ca62c86b1af7a9dd2450c1c28dc45020a2a553d8874c49f9eafedea5a9d40"
+}
diff --git a/backend/.sqlx/query-8aae160c589adf02e20b7e6ba860b66fb08f156776b96b7f3701aed330a7d000.json b/backend/.sqlx/query-d50d7a93f5c97570e3ef51ef542de41e9c1a9230911a2331d7127572722e340e.json
similarity index 54%
rename from backend/.sqlx/query-8aae160c589adf02e20b7e6ba860b66fb08f156776b96b7f3701aed330a7d000.json
rename to backend/.sqlx/query-d50d7a93f5c97570e3ef51ef542de41e9c1a9230911a2331d7127572722e340e.json
index d05c5b11af..edc0efd9ca 100644
--- a/backend/.sqlx/query-8aae160c589adf02e20b7e6ba860b66fb08f156776b96b7f3701aed330a7d000.json
+++ b/backend/.sqlx/query-d50d7a93f5c97570e3ef51ef542de41e9c1a9230911a2331d7127572722e340e.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "WITH active_users AS (SELECT distinct username as email FROM (SELECT username, timestamp, operation FROM audit_partitioned UNION ALL SELECT username, timestamp, operation FROM audit) AS a WHERE timestamp > NOW() - INTERVAL '1 month' AND (operation = 'users.login' OR operation = 'oauth.login' OR operation = 'users.token.refresh')),\n            authors as (SELECT distinct email FROM usr WHERE usr.operator IS false)\n            SELECT email as \"email!\", (email NOT IN (SELECT email FROM authors)) as operator_only, NULL::bool as is_workspace_admin, login_type::text, verified as \"verified!\", super_admin as \"super_admin!\", devops as \"devops!\", name, company, username, first_time_user as \"first_time_user!\", role_source as \"role_source!\", disabled as \"disabled!\", NULL::text as workspace_id\n            FROM password\n            WHERE email IN (SELECT email FROM active_users)\n            UNION ALL\n            SELECT email as \"email!\", operator as operator_only, is_admin as is_workspace_admin, 'service_account'::text as login_type, true as \"verified!\", false as \"super_admin!\", false as \"devops!\", NULL::text as name, NULL::text as company, username, false as \"first_time_user!\", 'service_account'::text as \"role_source!\", disabled as \"disabled!\", workspace_id\n            FROM usr\n            WHERE is_service_account IS true\n            ORDER BY \"super_admin!\" DESC, \"devops!\" DESC\n            LIMIT $1 OFFSET $2",
+  "query": "WITH active_users AS (SELECT distinct username as email FROM audit_partitioned WHERE timestamp > NOW() - INTERVAL '1 month' AND (operation = 'users.login' OR operation = 'oauth.login' OR operation = 'users.token.refresh')),\n            authors as (SELECT distinct email FROM usr WHERE usr.operator IS false)\n            SELECT email as \"email!\", (email NOT IN (SELECT email FROM authors)) as operator_only, NULL::bool as is_workspace_admin, login_type::text, verified as \"verified!\", super_admin as \"super_admin!\", devops as \"devops!\", name, company, username, first_time_user as \"first_time_user!\", role_source as \"role_source!\", disabled as \"disabled!\", NULL::text as workspace_id\n            FROM password\n            WHERE email IN (SELECT email FROM active_users)\n            UNION ALL\n            SELECT email as \"email!\", operator as operator_only, is_admin as is_workspace_admin, 'service_account'::text as login_type, true as \"verified!\", false as \"super_admin!\", false as \"devops!\", NULL::text as name, NULL::text as company, username, false as \"first_time_user!\", 'service_account'::text as \"role_source!\", disabled as \"disabled!\", workspace_id\n            FROM usr\n            WHERE is_service_account IS true\n            ORDER BY \"super_admin!\" DESC, \"devops!\" DESC\n            LIMIT $1 OFFSET $2",
   "describe": {
     "columns": [
       {
@@ -97,5 +97,5 @@
       null
     ]
   },
-  "hash": "8aae160c589adf02e20b7e6ba860b66fb08f156776b96b7f3701aed330a7d000"
+  "hash": "d50d7a93f5c97570e3ef51ef542de41e9c1a9230911a2331d7127572722e340e"
 }
diff --git a/backend/.sqlx/query-d5fb5dde6300862f978739a3d9249fc2b3e7697c0da7d3195398933d3d81aadf.json b/backend/.sqlx/query-d5fb5dde6300862f978739a3d9249fc2b3e7697c0da7d3195398933d3d81aadf.json
new file mode 100644
index 0000000000..6297c4d366
--- /dev/null
+++ b/backend/.sqlx/query-d5fb5dde6300862f978739a3d9249fc2b3e7697c0da7d3195398933d3d81aadf.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT datatable FROM workspace_settings WHERE workspace_id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "datatable",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "d5fb5dde6300862f978739a3d9249fc2b3e7697c0da7d3195398933d3d81aadf"
+}
diff --git a/backend/.sqlx/query-d8186f0cee285aa50db7626409aec7e0504b068ffa8bb185d9384ce1422fd3d1.json b/backend/.sqlx/query-d8186f0cee285aa50db7626409aec7e0504b068ffa8bb185d9384ce1422fd3d1.json
deleted file mode 100644
index 70872a1328..0000000000
--- a/backend/.sqlx/query-d8186f0cee285aa50db7626409aec7e0504b068ffa8bb185d9384ce1422fd3d1.json
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM audit WHERE timestamp <= now() - ($1::bigint::text || ' s')::interval",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Int8"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "d8186f0cee285aa50db7626409aec7e0504b068ffa8bb185d9384ce1422fd3d1"
-}
diff --git a/backend/.sqlx/query-da5057c86607327bafc2942c218025ca9181a0c396405984d87e422e129521c1.json b/backend/.sqlx/query-da5057c86607327bafc2942c218025ca9181a0c396405984d87e422e129521c1.json
new file mode 100644
index 0000000000..4e63a2afa6
--- /dev/null
+++ b/backend/.sqlx/query-da5057c86607327bafc2942c218025ca9181a0c396405984d87e422e129521c1.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE workspace_settings ws\n               SET datatable = (\n                   SELECT jsonb_set(ws.datatable, '{datatables}', jsonb_object_agg(\n                       dt.key,\n                       CASE WHEN dt.value->'reference'->>'workspace_id' = $1\n                                 AND dt.value->'reference'->>'datatable' = $2\n                           THEN jsonb_set(dt.value, '{reference,datatable}', to_jsonb($3::text))\n                           ELSE dt.value END\n                   ))\n                   FROM jsonb_each(ws.datatable->'datatables') dt\n               )\n               WHERE jsonb_typeof(ws.datatable->'datatables') = 'object'\n                 AND ws.datatable::text LIKE '%\"reference\"%'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "da5057c86607327bafc2942c218025ca9181a0c396405984d87e422e129521c1"
+}
diff --git a/backend/.sqlx/query-dc37f9ad685a2f2bd781be8678e0548a860815f30e866362344434f23aa7c83c.json b/backend/.sqlx/query-dc37f9ad685a2f2bd781be8678e0548a860815f30e866362344434f23aa7c83c.json
new file mode 100644
index 0000000000..02d889c38b
--- /dev/null
+++ b/backend/.sqlx/query-dc37f9ad685a2f2bd781be8678e0548a860815f30e866362344434f23aa7c83c.json
@@ -0,0 +1,38 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH active_users as (SELECT distinct username as email FROM audit_partitioned WHERE timestamp > NOW() - INTERVAL '1 month' AND (operation = 'users.login' OR operation = 'oauth.login' OR operation = 'users.token.refresh')),\n        active_authors as (SELECT distinct email FROM usr WHERE usr.operator IS false AND email IN (SELECT email FROM active_users)),\n        active_authors_agg as (SELECT array_agg(email) as authors FROM active_authors),\n        active_ops_agg as (SELECT array_agg(email) as operators from active_users WHERE email NOT IN (SELECT email FROM active_authors))\n        SELECT active_authors_agg.authors, active_ops_agg.operators, array_length(active_authors_agg.authors, 1) as author_count, array_length(active_ops_agg.operators, 1) as operator_count FROM active_authors_agg, active_ops_agg",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "authors",
+        "type_info": "VarcharArray"
+      },
+      {
+        "ordinal": 1,
+        "name": "operators",
+        "type_info": "VarcharArray"
+      },
+      {
+        "ordinal": 2,
+        "name": "author_count",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 3,
+        "name": "operator_count",
+        "type_info": "Int4"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      null,
+      null,
+      null,
+      null
+    ]
+  },
+  "hash": "dc37f9ad685a2f2bd781be8678e0548a860815f30e866362344434f23aa7c83c"
+}
diff --git a/backend/.sqlx/query-dc8dfc37559e9b6713bde48155f48b5a2c7b8199eace1508e102b60d1ff40c04.json b/backend/.sqlx/query-dc8dfc37559e9b6713bde48155f48b5a2c7b8199eace1508e102b60d1ff40c04.json
new file mode 100644
index 0000000000..def9ee0edb
--- /dev/null
+++ b/backend/.sqlx/query-dc8dfc37559e9b6713bde48155f48b5a2c7b8199eace1508e102b60d1ff40c04.json
@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT value->'roles' FROM global_settings WHERE name = 'custom_instance_pg_databases'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "?column?",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "dc8dfc37559e9b6713bde48155f48b5a2c7b8199eace1508e102b60d1ff40c04"
+}
diff --git a/backend/.sqlx/query-dfa54341a687431ea46ec842ab4167bcfd875cb4646ef859a7b855428bf48290.json b/backend/.sqlx/query-dfa54341a687431ea46ec842ab4167bcfd875cb4646ef859a7b855428bf48290.json
new file mode 100644
index 0000000000..7acdcf8801
--- /dev/null
+++ b/backend/.sqlx/query-dfa54341a687431ea46ec842ab4167bcfd875cb4646ef859a7b855428bf48290.json
@@ -0,0 +1,38 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        WITH capped AS (\n            SELECT timestamp, operation, resource, parameters\n            FROM audit_partitioned\n            WHERE workspace_id = 'admins'\n              AND operation = 'workspace_fairness.capped'\n            ORDER BY timestamp DESC\n            LIMIT 200\n        ), uncapped AS (\n            SELECT timestamp, operation, resource, parameters\n            FROM audit_partitioned\n            WHERE workspace_id = 'admins'\n              AND operation = 'workspace_fairness.uncapped'\n            ORDER BY timestamp DESC\n            LIMIT 200\n        )\n        SELECT timestamp AS \"timestamp!\",\n               operation::text AS \"operation!\",\n               resource AS workspace_id,\n               parameters\n        FROM (SELECT * FROM capped UNION ALL SELECT * FROM uncapped) e\n        ORDER BY timestamp DESC\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "timestamp!",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 1,
+        "name": "operation!",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 2,
+        "name": "workspace_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "parameters",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      null,
+      null,
+      null,
+      null
+    ]
+  },
+  "hash": "dfa54341a687431ea46ec842ab4167bcfd875cb4646ef859a7b855428bf48290"
+}
diff --git a/backend/.sqlx/query-e159b2ff15633f85e839ee4fe1ec2ecd11caf228ea8d0f52ad66def595644250.json b/backend/.sqlx/query-e159b2ff15633f85e839ee4fe1ec2ecd11caf228ea8d0f52ad66def595644250.json
new file mode 100644
index 0000000000..3f7245f35f
--- /dev/null
+++ b/backend/.sqlx/query-e159b2ff15633f85e839ee4fe1ec2ecd11caf228ea8d0f52ad66def595644250.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE postgres_trigger SET server_id = NULL, last_server_ping = NULL\n             WHERE workspace_id = $1\n               AND (postgres_resource_path = $2 OR postgres_resource_path LIKE $3)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "e159b2ff15633f85e839ee4fe1ec2ecd11caf228ea8d0f52ad66def595644250"
+}
diff --git a/backend/.sqlx/query-e2061df65ffd4a72146c4ca316829265289c8d6f625ac272655c88e1ad0b1745.json b/backend/.sqlx/query-e2061df65ffd4a72146c4ca316829265289c8d6f625ac272655c88e1ad0b1745.json
new file mode 100644
index 0000000000..0e3c0182a9
--- /dev/null
+++ b/backend/.sqlx/query-e2061df65ffd4a72146c4ca316829265289c8d6f625ac272655c88e1ad0b1745.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT datatable FROM workspace_settings WHERE workspace_id = $1 FOR UPDATE",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "datatable",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "e2061df65ffd4a72146c4ca316829265289c8d6f625ac272655c88e1ad0b1745"
+}
diff --git a/backend/.sqlx/query-e2760debbb69182f1385bfe8e18933eeff7396430607c02cbd0cc682d5c34d61.json b/backend/.sqlx/query-e2760debbb69182f1385bfe8e18933eeff7396430607c02cbd0cc682d5c34d61.json
new file mode 100644
index 0000000000..9930e0494f
--- /dev/null
+++ b/backend/.sqlx/query-e2760debbb69182f1385bfe8e18933eeff7396430607c02cbd0cc682d5c34d61.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT canceled_by IS NOT NULL AS \"canceled!\" FROM v2_job_completed WHERE id = $1 AND workspace_id = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "canceled!",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "e2760debbb69182f1385bfe8e18933eeff7396430607c02cbd0cc682d5c34d61"
+}
diff --git a/backend/.sqlx/query-e428f0cdb9077bffe2b7271d9b5f30ed81e8c26a9f1e65f423078947153ff9dd.json b/backend/.sqlx/query-e428f0cdb9077bffe2b7271d9b5f30ed81e8c26a9f1e65f423078947153ff9dd.json
new file mode 100644
index 0000000000..57b5e2abd1
--- /dev/null
+++ b/backend/.sqlx/query-e428f0cdb9077bffe2b7271d9b5f30ed81e8c26a9f1e65f423078947153ff9dd.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE draft_move SET email = $1 WHERE email = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "e428f0cdb9077bffe2b7271d9b5f30ed81e8c26a9f1e65f423078947153ff9dd"
+}
diff --git a/backend/.sqlx/query-e524e89440004953cc0b1cb57b8df6bc09f19cf53b141fac5aefa981463d39fa.json b/backend/.sqlx/query-e524e89440004953cc0b1cb57b8df6bc09f19cf53b141fac5aefa981463d39fa.json
new file mode 100644
index 0000000000..af8d0eb1ab
--- /dev/null
+++ b/backend/.sqlx/query-e524e89440004953cc0b1cb57b8df6bc09f19cf53b141fac5aefa981463d39fa.json
@@ -0,0 +1,29 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT ws.workspace_id AS \"workspace_id!\", dt.key AS \"datatable!\"\n               FROM workspace_settings ws\n               CROSS JOIN LATERAL jsonb_each(COALESCE(ws.datatable->'datatables', '{}'::jsonb)) dt\n               WHERE EXISTS (\n                   SELECT 1 FROM (VALUES ('reference'), ('governed_by')) k(link)\n                   WHERE dt.value->k.link->>'workspace_id' = $1\n                     AND dt.value->k.link->>'datatable' = $2\n               )",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "workspace_id!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "datatable!",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      null
+    ]
+  },
+  "hash": "e524e89440004953cc0b1cb57b8df6bc09f19cf53b141fac5aefa981463d39fa"
+}
diff --git a/backend/.sqlx/query-e6140682ebc65083f48714ab3299fdb239ef507e23003db03aff7d35b02c540b.json b/backend/.sqlx/query-e6140682ebc65083f48714ab3299fdb239ef507e23003db03aff7d35b02c540b.json
new file mode 100644
index 0000000000..f218653d46
--- /dev/null
+++ b/backend/.sqlx/query-e6140682ebc65083f48714ab3299fdb239ef507e23003db03aff7d35b02c540b.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO draft (workspace_id, path, typ, value, created_at, email, base)\n         SELECT $2, path, typ,\n                to_json(\n                    CASE WHEN typ IN ('script', 'flow') THEN clean - 'on_behalf_of' ELSE clean END\n                    - CASE WHEN typ = 'flow' THEN 'version_id'\n                           WHEN typ IN ('app', 'raw_app') THEN 'parent_version'\n                           ELSE '' END\n                ),\n                created_at, email,\n                CASE WHEN typ = 'script' THEN base END\n         FROM (\n             SELECT d.path, d.typ, d.created_at, d.email, d.base,\n                    replace(replace(replace(d.value::text, chr(92) || chr(92), chr(1)), chr(92) || 'u0000', ''), chr(1), chr(92) || chr(92))::jsonb AS clean\n             FROM draft d\n             WHERE d.workspace_id = $1 AND (d.email = $3 OR d.email IS NULL)\n         ) s",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "e6140682ebc65083f48714ab3299fdb239ef507e23003db03aff7d35b02c540b"
+}
diff --git a/backend/.sqlx/query-e63da92247045f2aaaa62b9d6ee17510fd05d0b7c5311b61e7257ccd07b16da2.json b/backend/.sqlx/query-e63da92247045f2aaaa62b9d6ee17510fd05d0b7c5311b61e7257ccd07b16da2.json
new file mode 100644
index 0000000000..926add8159
--- /dev/null
+++ b/backend/.sqlx/query-e63da92247045f2aaaa62b9d6ee17510fd05d0b7c5311b61e7257ccd07b16da2.json
@@ -0,0 +1,59 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT m.new_path FROM draft_move m\n           WHERE m.workspace_id = $1 AND m.typ = $2 AND m.old_path = $3\n             AND (m.email IS NULL OR m.email = $4)\n             AND NOT EXISTS (\n                 SELECT 1 FROM draft d\n                 WHERE d.workspace_id = $1 AND d.typ = $2 AND d.path = $3\n                   AND d.email IS NOT DISTINCT FROM $4\n             )\n           ORDER BY m.email IS NULL\n           LIMIT 1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "new_path",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        {
+          "Custom": {
+            "name": "draft_kind",
+            "kind": {
+              "Enum": [
+                "script",
+                "flow",
+                "app",
+                "raw_app",
+                "resource",
+                "variable",
+                "trigger_schedule",
+                "trigger_webhook",
+                "trigger_default_email",
+                "trigger_email",
+                "trigger_http",
+                "trigger_websocket",
+                "trigger_postgres",
+                "trigger_kafka",
+                "trigger_nats",
+                "trigger_mqtt",
+                "trigger_sqs",
+                "trigger_gcp",
+                "trigger_azure",
+                "trigger_poll",
+                "trigger_cli",
+                "trigger_nextcloud",
+                "trigger_google",
+                "trigger_github",
+                "data_pipeline",
+                "trigger_amqp"
+              ]
+            }
+          }
+        },
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "e63da92247045f2aaaa62b9d6ee17510fd05d0b7c5311b61e7257ccd07b16da2"
+}
diff --git a/backend/.sqlx/query-ede15bff96152f209aff756830cbc76b5afa1af6ed324376989117b1054c3447.json b/backend/.sqlx/query-e6e31fdf705896c81f9a0f45d47c1b93db0406aaf278bccba07be00e9f937e2a.json
similarity index 78%
rename from backend/.sqlx/query-ede15bff96152f209aff756830cbc76b5afa1af6ed324376989117b1054c3447.json
rename to backend/.sqlx/query-e6e31fdf705896c81f9a0f45d47c1b93db0406aaf278bccba07be00e9f937e2a.json
index 1c247ad5b5..7462224850 100644
--- a/backend/.sqlx/query-ede15bff96152f209aff756830cbc76b5afa1af6ed324376989117b1054c3447.json
+++ b/backend/.sqlx/query-e6e31fdf705896c81f9a0f45d47c1b93db0406aaf278bccba07be00e9f937e2a.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        SELECT\n            workspace_id,\n            slack_team_id,\n            slack_name,\n            teams_team_id,\n            teams_team_name,\n            teams_team_guid,\n            mute_critical_alerts,\n            guest_access_enabled,\n            deploy_ui,\n            large_file_storage,\n            datatable\n        FROM\n            workspace_settings\n        WHERE\n            workspace_id = $1\n        ",
+  "query": "\n        SELECT\n            workspace_id,\n            slack_team_id,\n            slack_name,\n            teams_team_id,\n            teams_team_name,\n            teams_team_guid,\n            mute_critical_alerts,\n            guest_access_enabled,\n            add_admins_and_developers_to_forks,\n            deploy_ui,\n            large_file_storage,\n            datatable\n        FROM\n            workspace_settings\n        WHERE\n            workspace_id = $1\n        ",
   "describe": {
     "columns": [
       {
@@ -45,16 +45,21 @@
       },
       {
         "ordinal": 8,
+        "name": "add_admins_and_developers_to_forks",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 9,
         "name": "deploy_ui",
         "type_info": "Jsonb"
       },
       {
-        "ordinal": 9,
+        "ordinal": 10,
         "name": "large_file_storage",
         "type_info": "Jsonb"
       },
       {
-        "ordinal": 10,
+        "ordinal": 11,
         "name": "datatable",
         "type_info": "Jsonb"
       }
@@ -73,10 +78,11 @@
       true,
       true,
       false,
+      false,
       true,
       true,
       true
     ]
   },
-  "hash": "ede15bff96152f209aff756830cbc76b5afa1af6ed324376989117b1054c3447"
+  "hash": "e6e31fdf705896c81f9a0f45d47c1b93db0406aaf278bccba07be00e9f937e2a"
 }
diff --git a/backend/.sqlx/query-ebaf3ed3097621da59dd201b5a4b9d1f440692f183c7c378f59e4b73f1c6e241.json b/backend/.sqlx/query-ebaf3ed3097621da59dd201b5a4b9d1f440692f183c7c378f59e4b73f1c6e241.json
new file mode 100644
index 0000000000..e5de67e73f
--- /dev/null
+++ b/backend/.sqlx/query-ebaf3ed3097621da59dd201b5a4b9d1f440692f183c7c378f59e4b73f1c6e241.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE workspace_settings\n               SET datatable = jsonb_set(\n                   jsonb_set(\n                       datatable #- ARRAY['datatables', $2, 'reference'],\n                       ARRAY['datatables', $2, 'database'], $3::jsonb),\n                   ARRAY['datatables', $2, 'forked_from'], $4::jsonb\n               )\n               WHERE workspace_id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Jsonb",
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "ebaf3ed3097621da59dd201b5a4b9d1f440692f183c7c378f59e4b73f1c6e241"
+}
diff --git a/backend/.sqlx/query-ed2eb32d445164e7ab5fb735e01f86505bc499320e08d1aad15a9a82c3823c0b.json b/backend/.sqlx/query-ed2eb32d445164e7ab5fb735e01f86505bc499320e08d1aad15a9a82c3823c0b.json
new file mode 100644
index 0000000000..b11e41fe89
--- /dev/null
+++ b/backend/.sqlx/query-ed2eb32d445164e7ab5fb735e01f86505bc499320e08d1aad15a9a82c3823c0b.json
@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM v2_job_queue WHERE id = $1 RETURNING canceled_by, canceled_reason",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "canceled_by",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "canceled_reason",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      true,
+      true
+    ]
+  },
+  "hash": "ed2eb32d445164e7ab5fb735e01f86505bc499320e08d1aad15a9a82c3823c0b"
+}
diff --git a/backend/.sqlx/query-ee3ed82783b5b7d2f41f16a1d94f006687bd9de4611203b5dd0c28eacee02842.json b/backend/.sqlx/query-ee3ed82783b5b7d2f41f16a1d94f006687bd9de4611203b5dd0c28eacee02842.json
new file mode 100644
index 0000000000..a1d873778f
--- /dev/null
+++ b/backend/.sqlx/query-ee3ed82783b5b7d2f41f16a1d94f006687bd9de4611203b5dd0c28eacee02842.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_settings (workspace_id, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url, add_admins_and_developers_to_forks, remote_deploy_target, remote_deploy_target_changed_at) SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url, add_admins_and_developers_to_forks, remote_deploy_target, remote_deploy_target_changed_at FROM workspace_settings WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "ee3ed82783b5b7d2f41f16a1d94f006687bd9de4611203b5dd0c28eacee02842"
+}
diff --git a/backend/.sqlx/query-ef98b0fab16d3b19997fd639b74a895cce1e8ae010307431e6787d20c7b25780.json b/backend/.sqlx/query-ef98b0fab16d3b19997fd639b74a895cce1e8ae010307431e6787d20c7b25780.json
new file mode 100644
index 0000000000..3b89a91024
--- /dev/null
+++ b/backend/.sqlx/query-ef98b0fab16d3b19997fd639b74a895cce1e8ae010307431e6787d20c7b25780.json
@@ -0,0 +1,41 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT flow_version.id, flow_version.created_at, flow_version.created_by, deployment_metadata.deployment_msg FROM flow_version \n        LEFT JOIN deployment_metadata ON flow_version.id = deployment_metadata.flow_version\n        WHERE flow_version.path = $1 AND flow_version.workspace_id = $2 \n        ORDER BY flow_version.created_at DESC",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "created_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 2,
+        "name": "created_by",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "deployment_msg",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      true
+    ]
+  },
+  "hash": "ef98b0fab16d3b19997fd639b74a895cce1e8ae010307431e6787d20c7b25780"
+}
diff --git a/backend/.sqlx/query-a2122e8520268919e2ddc85ef46b5f9322229bb2a1e104b6eabaf2a697c2776a.json b/backend/.sqlx/query-f3cd54017710536747b8aca797a8b983774ee2127dceb790181ed91b987f44ff.json
similarity index 85%
rename from backend/.sqlx/query-a2122e8520268919e2ddc85ef46b5f9322229bb2a1e104b6eabaf2a697c2776a.json
rename to backend/.sqlx/query-f3cd54017710536747b8aca797a8b983774ee2127dceb790181ed91b987f44ff.json
index 0f43afed39..6964dfa8d6 100644
--- a/backend/.sqlx/query-a2122e8520268919e2ddc85ef46b5f9322229bb2a1e104b6eabaf2a697c2776a.json
+++ b/backend/.sqlx/query-f3cd54017710536747b8aca797a8b983774ee2127dceb790181ed91b987f44ff.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        SELECT\n            nt.external_id,\n            nt.workspace_id,\n            nt.service_name AS \"service_name!: ServiceName\",\n            nt.script_path,\n            nt.is_flow,\n            nt.webhook_token_hash,\n            nt.service_config,\n            nt.error,\n            nt.created_at,\n            nt.updated_at,\n            nt.summary,\n            nt.enabled\n        FROM\n            native_trigger nt\n        WHERE\n            nt.workspace_id = $1 AND\n            nt.service_name = $2 AND\n            ($5::text IS NULL OR nt.script_path = $5) AND\n            ($6::bool IS NULL OR nt.is_flow = $6) AND\n            (\n                (nt.is_flow = false AND EXISTS (\n                    SELECT 1 FROM script s\n                    WHERE s.workspace_id = nt.workspace_id\n                    AND s.path = nt.script_path\n                ))\n                OR\n                (nt.is_flow = true AND EXISTS (\n                    SELECT 1 FROM flow f\n                    WHERE f.workspace_id = nt.workspace_id\n                    AND f.path = nt.script_path\n                ))\n            )\n        LIMIT $3\n        OFFSET $4\n        ",
+  "query": "\n        SELECT\n            nt.external_id,\n            nt.workspace_id,\n            nt.service_name AS \"service_name!: ServiceName\",\n            nt.script_path,\n            nt.is_flow,\n            nt.webhook_token_hash,\n            nt.service_config,\n            nt.error,\n            nt.created_at,\n            nt.updated_at,\n            nt.summary,\n            nt.enabled\n        FROM\n            native_trigger nt\n        WHERE\n            nt.workspace_id = $1 AND\n            nt.service_name = $2 AND\n            ($5::text IS NULL OR nt.script_path = $5) AND\n            ($6::bool IS NULL OR nt.is_flow = $6) AND\n            (\n                (nt.is_flow = false AND EXISTS (\n                    SELECT 1 FROM script s\n                    WHERE s.workspace_id = nt.workspace_id\n                    AND s.path = nt.script_path\n                ))\n                OR\n                (nt.is_flow = true AND EXISTS (\n                    SELECT 1 FROM flow f\n                    WHERE f.workspace_id = nt.workspace_id\n                    AND f.path = nt.script_path\n                ))\n            ) AND\n            ( $7\n              OR nt.script_path = ANY($8)\n              OR EXISTS ( SELECT 1 FROM unnest($9::text[]) AS pfx\n                          WHERE nt.script_path = pfx\n                             OR left(nt.script_path, length(pfx) + 1) = pfx || '/' ) )\n        LIMIT $3\n        OFFSET $4\n        ",
   "describe": {
     "columns": [
       {
@@ -93,7 +93,10 @@
         "Int8",
         "Int8",
         "Text",
-        "Bool"
+        "Bool",
+        "Bool",
+        "TextArray",
+        "TextArray"
       ]
     },
     "nullable": [
@@ -111,5 +114,5 @@
       false
     ]
   },
-  "hash": "a2122e8520268919e2ddc85ef46b5f9322229bb2a1e104b6eabaf2a697c2776a"
+  "hash": "f3cd54017710536747b8aca797a8b983774ee2127dceb790181ed91b987f44ff"
 }
diff --git a/backend/.sqlx/query-f3ee09fb17955ca8d886f446d397063c4094546a7807343b570b823796372cef.json b/backend/.sqlx/query-f3ee09fb17955ca8d886f446d397063c4094546a7807343b570b823796372cef.json
new file mode 100644
index 0000000000..64183afaad
--- /dev/null
+++ b/backend/.sqlx/query-f3ee09fb17955ca8d886f446d397063c4094546a7807343b570b823796372cef.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT workspace_id FROM workspace_settings WHERE datatable::text LIKE $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "workspace_id",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "f3ee09fb17955ca8d886f446d397063c4094546a7807343b570b823796372cef"
+}
diff --git a/backend/.sqlx/query-f4adc9e26ebfebce18a29fb2c21bf06394cacb8a9699a608327b097e0ac1363e.json b/backend/.sqlx/query-f4adc9e26ebfebce18a29fb2c21bf06394cacb8a9699a608327b097e0ac1363e.json
new file mode 100644
index 0000000000..b3dd09e2ba
--- /dev/null
+++ b/backend/.sqlx/query-f4adc9e26ebfebce18a29fb2c21bf06394cacb8a9699a608327b097e0ac1363e.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE workspace_settings\n           SET datatable = CASE WHEN $3::jsonb = 'null'::jsonb\n               THEN datatable #- ARRAY['datatables', $2, 'permissions']\n               ELSE jsonb_set(datatable, ARRAY['datatables', $2, 'permissions'], $3::jsonb)\n           END\n           WHERE workspace_id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "f4adc9e26ebfebce18a29fb2c21bf06394cacb8a9699a608327b097e0ac1363e"
+}
diff --git a/backend/.sqlx/query-f7ece5036ad92e485b5e15a70e5052b42aaf5c87e5be6333b2df67a81990c8a6.json b/backend/.sqlx/query-f7ece5036ad92e485b5e15a70e5052b42aaf5c87e5be6333b2df67a81990c8a6.json
new file mode 100644
index 0000000000..1be51feb85
--- /dev/null
+++ b/backend/.sqlx/query-f7ece5036ad92e485b5e15a70e5052b42aaf5c87e5be6333b2df67a81990c8a6.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE workspace_settings ws\n           SET datatable = (\n               SELECT jsonb_set(ws.datatable, '{datatables}', jsonb_object_agg(\n                   dt.key,\n                   (SELECT CASE WHEN r.v->'governed_by'->>'workspace_id' = $1\n                                     AND r.v->'governed_by'->>'datatable' = $2\n                               THEN jsonb_set(r.v, '{governed_by,datatable}', to_jsonb($3::text))\n                               ELSE r.v END\n                    FROM (SELECT CASE WHEN dt.value->'reference'->>'workspace_id' = $1\n                                           AND dt.value->'reference'->>'datatable' = $2\n                                     THEN jsonb_set(dt.value, '{reference,datatable}', to_jsonb($3::text))\n                                     ELSE dt.value END AS v) r)\n               ))\n               FROM jsonb_each(ws.datatable->'datatables') dt\n           )\n           WHERE EXISTS (\n               SELECT 1 FROM jsonb_each(COALESCE(ws.datatable->'datatables', '{}'::jsonb)) d,\n                    LATERAL (VALUES ('reference'), ('governed_by')) k(link)\n               WHERE d.value->k.link->>'workspace_id' = $1\n                 AND d.value->k.link->>'datatable' = $2\n           )",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "f7ece5036ad92e485b5e15a70e5052b42aaf5c87e5be6333b2df67a81990c8a6"
+}
diff --git a/backend/.sqlx/query-a37c2c4d5656d4b44433de84c454046f7586e36b7bd6a4679d70c359d4aacfcf.json b/backend/.sqlx/query-f9692bba979c2b5a22e65106a330a0c0827dea6115daf9d006f8ccda0d041d76.json
similarity index 59%
rename from backend/.sqlx/query-a37c2c4d5656d4b44433de84c454046f7586e36b7bd6a4679d70c359d4aacfcf.json
rename to backend/.sqlx/query-f9692bba979c2b5a22e65106a330a0c0827dea6115daf9d006f8ccda0d041d76.json
index 5661c59faf..c3e7b0168d 100644
--- a/backend/.sqlx/query-a37c2c4d5656d4b44433de84c454046f7586e36b7bd6a4679d70c359d4aacfcf.json
+++ b/backend/.sqlx/query-f9692bba979c2b5a22e65106a330a0c0827dea6115daf9d006f8ccda0d041d76.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT COUNT(*) FROM usr WHERE is_service_account = true",
+  "query": "SELECT count(*) FROM remote_deploy_token WHERE email = 'test2@windmill.dev'",
   "describe": {
     "columns": [
       {
@@ -16,5 +16,5 @@
       null
     ]
   },
-  "hash": "a37c2c4d5656d4b44433de84c454046f7586e36b7bd6a4679d70c359d4aacfcf"
+  "hash": "f9692bba979c2b5a22e65106a330a0c0827dea6115daf9d006f8ccda0d041d76"
 }
diff --git a/backend/.sqlx/query-fc2081d9077c743bc3978ae1905db558549b2356fc6ac8f0557aa40e1345ff46.json b/backend/.sqlx/query-fc2081d9077c743bc3978ae1905db558549b2356fc6ac8f0557aa40e1345ff46.json
new file mode 100644
index 0000000000..27cb37b876
--- /dev/null
+++ b/backend/.sqlx/query-fc2081d9077c743bc3978ae1905db558549b2356fc6ac8f0557aa40e1345ff46.json
@@ -0,0 +1,31 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT d.email IS NULL as \"legacy!\", COALESCE(u.username, p.username) as username\n           FROM draft d\n           LEFT JOIN usr u ON u.workspace_id = d.workspace_id AND u.email = d.email\n           LEFT JOIN password p ON p.email = d.email AND p.super_admin = true\n           WHERE d.workspace_id = $1 AND d.path = $2 AND d.typ::text = ANY($3::text[])\n             -- A row a move already brought here from the very path being renamed is this\n             -- rename's own draft, not an item in its way: the record says which owners\n             -- it moved (all of them for an item move, one for a draft-only move). Any\n             -- other row is a second item and still collides.\n             AND NOT EXISTS (\n                 SELECT 1 FROM draft_move m\n                 WHERE m.workspace_id = $1 AND m.typ::text = ANY($3::text[])\n                   AND m.old_path = $4 AND m.new_path = $2\n                   AND (m.email IS NULL OR m.email IS NOT DISTINCT FROM d.email)\n             )\n           ORDER BY 2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "legacy!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 1,
+        "name": "username",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "TextArray",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null,
+      null
+    ]
+  },
+  "hash": "fc2081d9077c743bc3978ae1905db558549b2356fc6ac8f0557aa40e1345ff46"
+}
diff --git a/backend/.sqlx/query-fcb34e643b888122766e115a01394ab31ac856252aaa76c75ea27a447009c363.json b/backend/.sqlx/query-fcb34e643b888122766e115a01394ab31ac856252aaa76c75ea27a447009c363.json
new file mode 100644
index 0000000000..26920a2943
--- /dev/null
+++ b/backend/.sqlx/query-fcb34e643b888122766e115a01394ab31ac856252aaa76c75ea27a447009c363.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE datatable_role SET name = $2, enabled = $3, pwd = $4 WHERE id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Varchar",
+        "Bool",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "fcb34e643b888122766e115a01394ab31ac856252aaa76c75ea27a447009c363"
+}
diff --git a/backend/AGENTS.md b/backend/AGENTS.md
index 7bd84dfca3..750e0594e1 100644
--- a/backend/AGENTS.md
+++ b/backend/AGENTS.md
@@ -23,7 +23,7 @@
 ## Cargo features & running the dev backend
 
 The dev backend runs under `cargo watch` and is launched by default with **only
-`--features quickjs`** (see the tmux backend pane). That baseline compiles fast but
+`--features quickjs`** (see the backend pane). That baseline compiles fast but
 **deliberately omits most functionality** — notably S3/object storage, the S3 proxy, all
 EE code, MCP, and every non-JS language runtime. A running server never gains a feature you
 didn't compile in: feature-gated routes 404 or return a `"requires <feature>"` stub. So if
@@ -33,22 +33,30 @@ MUST **restart the backend with the appropriate features** for what you're worki
 ### Restarting the dev backend with the right features
 
 Restart in the **same pane**, so the relaunch inherits that pane's `DATABASE_URL`, `BACKEND_PORT`
-and the rest of `runtime.env`. Scope every kill to this worktree — **never**
+and the rest of the worktree environment. Scope every kill to this worktree — **never**
 `pkill -f target/debug/windmill`, which kills every sibling worktree's backend.
 
-1. Find the backend pane by what it is running, not by index. The index depends on the webmux
-   profile: pane 1 is the backend under `full`, but the *frontend* under `frontendOnly`.
+1. Find the backend pane by where it is running, not by index. Under herdr the two server panes
+   sit in the worktree's `backend/` and `frontend/`, so match on `cwd`:
+
+   ```bash
+   herdr pane list --workspace "$HERDR_WORKSPACE_ID"
+   ```
+
+   Under webmux they are tmux panes, and the index depends on the profile: pane 1 is the backend
+   under `full`, but the *frontend* under `frontendOnly`.
 
    ```bash
    WIN=$(tmux display-message -p -t "$TMUX_PANE" '#{window_id}')
    tmux list-panes -t "$WIN" -F '#{pane_index} #{pane_current_command} #{pane_pid}'
    ```
 
-2. Read the feature set it is **actually** running. `CARGO_FEATURES` in `runtime.env` is only what
-   the pane started with, and goes stale the first time anyone restarts by hand:
+2. Read the feature set it is **actually** running. The `CARGO_FEATURES` the worktree was created
+   with is only what the pane started with, and goes stale the first time anyone restarts by hand:
 
    ```bash
-   ps --ppid <pane_pid> -o args=
+   herdr pane process-info --pane <pane_id>   # foreground_processes[].argv
+   ps --ppid <pane_pid> -o args=              # under webmux
    # /home/hugo/.cargo/bin/cargo-watch watch -x run --features quickjs
    ```
 
@@ -56,22 +64,25 @@ and the rest of `runtime.env`. Scope every kill to this worktree — **never**
    explicitly:
 
    ```bash
-   tmux send-keys -t "$WIN.<idx>" C-c
-   tmux send-keys -t "$WIN.<idx>" 'PORT=$BACKEND_PORT cargo watch -x "run --features quickjs,private,parquet"' Enter
+   herdr pane send-keys <pane_id> C-c
+   herdr pane run <pane_id> 'PORT=$BACKEND_PORT cargo watch -x "run --features quickjs,private,parquet"'
+   # under webmux: tmux send-keys -t "$WIN.<idx>" C-c, then the same command line with Enter
    ```
 
    Carry over every feature the old command had unless you mean to drop one — rebuilding the list
    from memory is how a backend silently loses `quickjs`.
 
-4. Persist the new set so a recreated pane starts with it: set `CARGO_FEATURES` in the
-   worktree's `.env.local`, which `scripts/post-create.sh` writes and webmux reads. Do **not**
-   edit `runtime.env` for this — webmux regenerates it from metadata and `.env.local` every time
-   the worktree is opened, so an edit there is lost on the next reopen. Either way the change
-   only affects a future pane; step 3 is what takes effect now.
+4. Persist the new set so a recreated pane starts with it: set `CARGO_FEATURES` in the worktree's
+   `.env.local`, which the worktree hooks write. A herdr pane sources that file directly, so the
+   next pane picks the value up. A webmux pane sources `webmux/runtime.env` instead, which webmux
+   regenerates from metadata and `.env.local` when the worktree is *opened* — so the value lands
+   on the next reopen, not the next pane, and editing `runtime.env` by hand is lost at that same
+   reopen. Either way the change only affects a future pane; step 3 is what takes effect now.
 
-5. Re-capture the pane until `health check completed` appears before hitting the API. A cold
-   rebuild takes ~60s, and the previous run's success line is still in the scrollback, so a
-   capture taken too early reads as ready when it isn't.
+5. Re-read the pane (`herdr pane read <pane_id> --source recent-unwrapped`, or `tmux
+   capture-pane`) until `health check completed` appears before hitting the API. A cold rebuild
+   takes ~60s, and the previous run's success line is still in the scrollback, so a capture taken
+   too early reads as ready when it isn't.
 
 cargo-watch only re-runs on a file change, so after an idle/failed run `touch README.md` (from
 `backend/`, where the watch runs) is a cheap retrigger (touching a `.rs` forces a full rebuild).
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 5f5d5f2151..87bf7f64be 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -588,15 +588,15 @@ dependencies = [
 
 [[package]]
 name = "astral-tokio-tar"
-version = "0.5.6"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec179a06c1769b1e42e1e2cbe74c7dcdb3d6383c838454d063eaac5bbb7ebbe5"
+checksum = "b18457efd137254e016bbde5e1d88df61c4e1a5ae2223746e56123bac6af2463"
 dependencies = [
- "filetime",
  "futures-core",
  "libc",
  "portable-atomic",
  "rustc-hash 2.1.3",
+ "rustix 1.1.5",
  "tokio",
  "tokio-stream",
  "xattr",
@@ -928,9 +928,9 @@ checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
 [[package]]
 name = "aws-config"
-version = "1.8.3"
+version = "1.8.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0baa720ebadea158c5bda642ac444a2af0cdf7bb66b46d1e4533de5d1f449d0"
+checksum = "8a8fc176d53d6fe85017f230405e3255cedb4a02221cb55ed6d76dccbbb099b2"
 dependencies = [
  "aws-credential-types",
  "aws-runtime",
@@ -938,8 +938,8 @@ dependencies = [
  "aws-sdk-ssooidc",
  "aws-sdk-sts",
  "aws-smithy-async",
- "aws-smithy-http 0.62.6",
- "aws-smithy-json 0.61.9",
+ "aws-smithy-http 0.63.4",
+ "aws-smithy-json 0.62.4",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
  "aws-smithy-types",
@@ -1070,15 +1070,16 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-config"
-version = "1.68.0"
+version = "1.101.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7de8bcff88ff2948bf2154204b7eba0ea30698c1c23770c4a917505fb9fcbd5"
+checksum = "0360cf8f8ab0e328f89b5c60bdcc6203ebce83b8a018c05ed177c4f32f819aff"
 dependencies = [
  "aws-credential-types",
  "aws-runtime",
  "aws-smithy-async",
- "aws-smithy-http 0.62.6",
- "aws-smithy-json 0.61.9",
+ "aws-smithy-http 0.63.4",
+ "aws-smithy-json 0.62.4",
+ "aws-smithy-observability",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
  "aws-smithy-types",
@@ -1086,7 +1087,7 @@ dependencies = [
  "bytes",
  "fastrand 2.5.0",
  "http 0.2.12",
- "once_cell",
+ "http 1.5.0",
  "regex-lite",
  "tracing",
 ]
@@ -1144,15 +1145,16 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-sqs"
-version = "1.77.0"
+version = "1.94.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a6dcd63dffae1f7872df42ce9f1f0f785f8c9a3d3e880ef6c171d0415439df"
+checksum = "0894909314920ab2c907110e7f91b9f7a6c826bdc830ccf36079c69af2b82335"
 dependencies = [
  "aws-credential-types",
  "aws-runtime",
  "aws-smithy-async",
- "aws-smithy-http 0.62.6",
- "aws-smithy-json 0.61.9",
+ "aws-smithy-http 0.63.4",
+ "aws-smithy-json 0.62.4",
+ "aws-smithy-observability",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
  "aws-smithy-types",
@@ -1160,6 +1162,7 @@ dependencies = [
  "bytes",
  "fastrand 2.5.0",
  "http 0.2.12",
+ "http 1.5.0",
  "regex-lite",
  "tracing",
 ]
@@ -1214,15 +1217,16 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-sts"
-version = "1.79.0"
+version = "1.98.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "317377afba3498fca4948c5d32b399ef9a5ad35561a1e8a6f2ac7273dabf802d"
+checksum = "89c4f19655ab0856375e169865c91264de965bd74c407c7f1e403184b1049409"
 dependencies = [
  "aws-credential-types",
  "aws-runtime",
  "aws-smithy-async",
- "aws-smithy-http 0.62.6",
- "aws-smithy-json 0.61.9",
+ "aws-smithy-http 0.63.4",
+ "aws-smithy-json 0.62.4",
+ "aws-smithy-observability",
  "aws-smithy-query",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
@@ -1231,6 +1235,7 @@ dependencies = [
  "aws-types",
  "fastrand 2.5.0",
  "http 0.2.12",
+ "http 1.5.0",
  "regex-lite",
  "tracing",
 ]
@@ -1340,7 +1345,7 @@ dependencies = [
  "hyper 0.14.32",
  "hyper 1.11.1",
  "hyper-rustls 0.24.2",
- "hyper-rustls 0.27.9",
+ "hyper-rustls 0.27.10",
  "hyper-util",
  "pin-project-lite",
  "rustls 0.21.12",
@@ -2221,7 +2226,7 @@ dependencies = [
  "memmap2",
  "num-traits",
  "num_cpus",
- "rand 0.9.0",
+ "rand 0.9.5",
  "rand_distr",
  "rayon",
  "safetensors",
@@ -2257,7 +2262,7 @@ dependencies = [
  "candle-nn",
  "fancy-regex 0.17.0",
  "num-traits",
- "rand 0.9.0",
+ "rand 0.9.5",
  "rayon",
  "serde",
  "serde_json",
@@ -2311,9 +2316,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.4.6"
+version = "1.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3eb0f42d6c360dc3f8a821f6bf2fdea7f72bfd36b3076eb0e6d1e9e0752fff4"
+checksum = "54413ede23c2daf518f35156dfde027feb2374004d63bd497f983c8db9c0e313"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -3996,7 +4001,7 @@ dependencies = [
  "http 1.5.0",
  "http-body-util",
  "hyper 1.11.1",
- "hyper-rustls 0.27.9",
+ "hyper-rustls 0.27.10",
  "hyper-util",
  "ipnet",
  "percent-encoding",
@@ -4199,7 +4204,7 @@ dependencies = [
  "deno_tls",
  "http-body-util",
  "hyper 1.11.1",
- "hyper-rustls 0.27.9",
+ "hyper-rustls 0.27.10",
  "hyper-util",
  "log",
  "once_cell",
@@ -5055,9 +5060,9 @@ dependencies = [
 
 [[package]]
 name = "find-msvc-tools"
-version = "0.1.12"
+version = "0.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e0f1c7c3a72c66fd80abe965175f7523475c0489a87d3ff9d6e8c87d87a9d2d"
+checksum = "ef25905e51abafe4dcea6c15fec58c57b601cdbd0ee53d22ea1d3016c587d39b"
 
 [[package]]
 name = "fixedbitset"
@@ -5101,7 +5106,7 @@ checksum = "719a903cc23e4a89e87962c2a80fdb45cdaad0983a89bd150bb57b4c8571a7d5"
 dependencies = [
  "half",
  "num-traits",
- "rand 0.9.0",
+ "rand 0.9.5",
  "rand_distr",
 ]
 
@@ -5497,9 +5502,9 @@ dependencies = [
 
 [[package]]
 name = "generator"
-version = "0.8.9"
+version = "0.8.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3b854b0e584ead1a33f18b2fcad7cf7be18b3875c78816b753639aa501513ae"
+checksum = "54ade96dc9003043bce7c035c85a9df5a858bfb2039c5a2e6fdf00f324f6c551"
 dependencies = [
  "cc",
  "cfg-if",
@@ -5833,7 +5838,7 @@ dependencies = [
  "cfg-if",
  "crunchy",
  "num-traits",
- "rand 0.9.0",
+ "rand 0.9.5",
  "rand_distr",
  "zerocopy",
 ]
@@ -5975,7 +5980,7 @@ dependencies = [
  "log",
  "native-tls",
  "num_cpus",
- "rand 0.9.0",
+ "rand 0.9.5",
  "reqwest 0.12.28",
  "serde",
  "serde_json",
@@ -6002,7 +6007,7 @@ dependencies = [
  "idna",
  "ipnet",
  "once_cell",
- "rand 0.9.0",
+ "rand 0.9.5",
  "serde",
  "thiserror 2.0.20",
  "tinyvec",
@@ -6024,7 +6029,7 @@ dependencies = [
  "moka",
  "once_cell",
  "parking_lot",
- "rand 0.9.0",
+ "rand 0.9.5",
  "resolv-conf",
  "serde",
  "smallvec",
@@ -6258,7 +6263,7 @@ dependencies = [
  "headers",
  "http 1.5.0",
  "hyper 1.11.1",
- "hyper-rustls 0.27.9",
+ "hyper-rustls 0.27.10",
  "hyper-util",
  "pin-project-lite",
  "tokio",
@@ -6317,9 +6322,9 @@ dependencies = [
 
 [[package]]
 name = "hyper-rustls"
-version = "0.27.9"
+version = "0.27.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
+checksum = "dfa8e654703247911e29c23fbeaa261834bd9bb74efba2f9acddc37bfb127f53"
 dependencies = [
  "http 1.5.0",
  "hyper 1.11.1",
@@ -6949,13 +6954,14 @@ dependencies = [
 
 [[package]]
 name = "jsonwebtoken"
-version = "8.3.0"
+version = "9.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6971da4d9c3aa03c3d8f3ff0f4155b534aad021292003895a469716b2a230378"
+checksum = "5a87cc7a48537badeae96744432de36f4be2b4a34a05a5ef32e9dd8a1c169dde"
 dependencies = [
- "base64 0.21.7",
- "pem 1.1.1",
- "ring 0.16.20",
+ "base64 0.22.1",
+ "js-sys",
+ "pem",
+ "ring 0.17.14",
  "serde",
  "serde_json",
  "simple_asn1",
@@ -6963,17 +6969,20 @@ dependencies = [
 
 [[package]]
 name = "jsonwebtoken"
-version = "9.3.1"
+version = "10.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a87cc7a48537badeae96744432de36f4be2b4a34a05a5ef32e9dd8a1c169dde"
+checksum = "eba32bfb4ffdeaca3e34431072faf01745c9b26d25504aa7a6cf5684334fc4fc"
 dependencies = [
+ "aws-lc-rs",
  "base64 0.22.1",
+ "getrandom 0.2.17",
  "js-sys",
- "pem 3.0.6",
- "ring 0.17.14",
+ "pem",
  "serde",
  "serde_json",
+ "signature",
  "simple_asn1",
+ "zeroize",
 ]
 
 [[package]]
@@ -7062,13 +7071,13 @@ dependencies = [
  "http-body-util",
  "hyper 1.11.1",
  "hyper-http-proxy",
- "hyper-rustls 0.27.9",
+ "hyper-rustls 0.27.10",
  "hyper-timeout",
  "hyper-util",
  "jsonpath-rust",
  "k8s-openapi",
  "kube-core",
- "pem 3.0.6",
+ "pem",
  "rustls 0.23.35",
  "secrecy",
  "serde",
@@ -7308,9 +7317,9 @@ dependencies = [
 
 [[package]]
 name = "libredox"
-version = "0.1.24"
+version = "0.1.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6480ccc157a1389bb2e4891b24751b0f798ba640d22386f23143fbcc89da195a"
+checksum = "61ff90caf6077a803a240f62fdbe88645a890bbca49ef8174c3cb0404362171d"
 dependencies = [
  "bitflags 2.13.2",
  "libc",
@@ -7932,9 +7941,9 @@ dependencies = [
  "lru 0.18.4",
  "mysql_common",
  "native-tls",
- "pem 3.0.6",
+ "pem",
  "percent-encoding",
- "rand 0.10.2",
+ "rand 0.10.3",
  "serde",
  "socket2 0.6.5",
  "thiserror 2.0.20",
@@ -8440,7 +8449,7 @@ dependencies = [
  "parking_lot",
  "percent-encoding",
  "quick-xml",
- "rand 0.9.0",
+ "rand 0.9.5",
  "reqwest 0.12.28",
  "ring 0.17.14",
  "rustls-pemfile 2.2.0",
@@ -8809,7 +8818,7 @@ dependencies = [
  "futures-util",
  "opentelemetry 0.30.0",
  "percent-encoding",
- "rand 0.9.0",
+ "rand 0.9.5",
  "serde_json",
  "thiserror 2.0.20",
  "tokio",
@@ -8911,7 +8920,7 @@ dependencies = [
  "hmac",
  "pkcs12",
  "pkcs5",
- "rand 0.9.0",
+ "rand 0.9.5",
  "rc2",
  "sha1",
  "sha2 0.10.9",
@@ -9075,15 +9084,6 @@ dependencies = [
  "hmac",
 ]
 
-[[package]]
-name = "pem"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8835c273a76a90455d7344889b0964598e3316e2a79ede8e36f16bdcf2228b8"
-dependencies = [
- "base64 0.13.1",
-]
-
 [[package]]
 name = "pem"
 version = "3.0.6"
@@ -9123,9 +9123,9 @@ checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
 [[package]]
 name = "pest"
-version = "2.9.1"
+version = "2.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d45aeb61b4bf818e12d4205f2466f8c4748f85f4fce0146d1c03d69d753f0ad"
+checksum = "45d3aca230fad2e6f6317ca0a72724338c4960cb97168a85cdee66df4a9a21a8"
 dependencies = [
  "memchr",
  "ucd-trie",
@@ -9133,9 +9133,9 @@ dependencies = [
 
 [[package]]
 name = "pest_derive"
-version = "2.9.1"
+version = "2.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89cc5a242e25ed4e7704d0be240f2cfbe20a8c27e7e252d94835be93d92dc39f"
+checksum = "284b60557f2c4a2e72ad3f2d34d42685a2fa4a6a61d0d2a10c0ae2a5e916c2cf"
 dependencies = [
  "pest",
  "pest_generator",
@@ -9143,9 +9143,9 @@ dependencies = [
 
 [[package]]
 name = "pest_generator"
-version = "2.9.1"
+version = "2.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7abf21475cc3820fe4b2ca2dc2142902f67a02189f3b5b3a229f4febc01a43e5"
+checksum = "1d9d1f08a115309ee99268cf85e5228e0e56aa9caf8841ec12866b6be07c3109"
 dependencies = [
  "pest",
  "pest_meta",
@@ -9156,9 +9156,9 @@ dependencies = [
 
 [[package]]
 name = "pest_meta"
-version = "2.9.1"
+version = "2.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adba4db388f687393c18c51348d44a41d870ca9df71a2c98172ea3035dc6936e"
+checksum = "ed93ba1a9ffcca32130a5188701c81c0c49cf00d4b7c5007d5148951d743adcb"
 dependencies = [
  "pest",
 ]
@@ -9504,7 +9504,7 @@ dependencies = [
  "hmac",
  "md-5 0.10.6",
  "memchr",
- "rand 0.9.0",
+ "rand 0.9.5",
  "sha2 0.10.9",
  "stringprep",
 ]
@@ -9879,7 +9879,7 @@ dependencies = [
  "bytes",
  "getrandom 0.4.3",
  "lru-slab",
- "rand 0.10.2",
+ "rand 0.10.3",
  "rand_pcg",
  "ring 0.17.14",
  "rustc-hash 2.1.3",
@@ -9959,20 +9959,19 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.9.0"
+version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3779b94aeb87e8bd4e834cee3650289ee9e0d5677f976ecdb6d219e5f4f6cd94"
+checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
 dependencies = [
  "rand_chacha 0.9.0",
  "rand_core 0.9.5",
- "zerocopy",
 ]
 
 [[package]]
 name = "rand"
-version = "0.10.2"
+version = "0.10.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
+checksum = "65c9fb96cbc91e3478eaae79a69fcd3f1ae4ad052e471fe6732fff548984b4af"
 dependencies = [
  "chacha20",
  "getrandom 0.4.3",
@@ -10049,7 +10048,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6a8615d50dcf34fa31f7ab52692afec947c4dd0ab803cc87cb3b0b4570ff7463"
 dependencies = [
  "num-traits",
- "rand 0.9.0",
+ "rand 0.9.5",
 ]
 
 [[package]]
@@ -10125,7 +10124,7 @@ version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "75e669e5202259b5314d1ea5397316ad400819437857b90861765f24c4cf80a2"
 dependencies = [
- "pem 3.0.6",
+ "pem",
  "ring 0.17.14",
  "rustls-pki-types",
  "time",
@@ -10339,7 +10338,7 @@ dependencies = [
  "http-body 1.1.0",
  "http-body-util",
  "hyper 1.11.1",
- "hyper-rustls 0.27.9",
+ "hyper-rustls 0.27.10",
  "hyper-tls",
  "hyper-util",
  "js-sys",
@@ -10387,7 +10386,7 @@ dependencies = [
  "http-body 1.1.0",
  "http-body-util",
  "hyper 1.11.1",
- "hyper-rustls 0.27.9",
+ "hyper-rustls 0.27.10",
  "hyper-util",
  "js-sys",
  "log",
@@ -10464,7 +10463,7 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dc05fbf560421a0357a750cbe78c7ca19d4923918490daabba313d5dbc871e47"
 dependencies = [
- "rand 0.10.2",
+ "rand 0.10.3",
 ]
 
 [[package]]
@@ -10552,7 +10551,7 @@ dependencies = [
  "oauth2",
  "pastey",
  "pin-project-lite",
- "rand 0.10.2",
+ "rand 0.10.3",
  "reqwest 0.13.5",
  "rmcp-macros",
  "schemars 1.2.2",
@@ -11114,7 +11113,7 @@ dependencies = [
  "openssl-sys",
  "pkg-config",
  "quick-xml",
- "rand 0.9.0",
+ "rand 0.9.5",
  "serde",
  "thiserror 2.0.20",
  "url",
@@ -13397,7 +13396,7 @@ dependencies = [
  "pin-project-lite",
  "postgres-protocol",
  "postgres-types",
- "rand 0.9.0",
+ "rand 0.9.5",
  "socket2 0.6.5",
  "tokio",
  "tokio-util",
@@ -14089,7 +14088,7 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "470dbf6591da1b39d43c14523b2b469c86879a53e8b758c8e090a470fe7b1fbe"
 dependencies = [
- "rand 0.9.0",
+ "rand 0.9.5",
  "uuid",
  "web-time",
 ]
@@ -14172,9 +14171,9 @@ checksum = "5c1cb5db39152898a79168971543b1cb5020dff7fe43c8dc468b0885f5e29df5"
 
 [[package]]
 name = "unicode-id-start"
-version = "1.4.0"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81b79ad29b5e19de4260020f8919b443b2ef0277d242ce532ec7b7a2cc8b6007"
+checksum = "0825d2e09dcae814a4273c1e1435979d414ede25b2ee235b1545da6682483765"
 
 [[package]]
 name = "unicode-ident"
@@ -14793,7 +14792,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14810,13 +14809,13 @@ dependencies = [
  "git-version",
  "hex",
  "hmac",
- "jsonwebtoken 8.3.0",
+ "jsonwebtoken 10.4.0",
  "lazy_static",
  "once_cell",
  "opentelemetry 0.30.0",
  "opentelemetry_sdk 0.30.0",
  "prometheus",
- "rand 0.9.0",
+ "rand 0.9.5",
  "rdkafka",
  "reqwest 0.13.5",
  "rumqttc",
@@ -14881,7 +14880,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -14915,7 +14914,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14928,7 +14927,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -14961,7 +14960,7 @@ dependencies = [
  "hyper 1.11.1",
  "indexmap 2.14.2",
  "itertools 0.14.0",
- "jsonwebtoken 8.3.0",
+ "jsonwebtoken 10.4.0",
  "lazy_static",
  "libxml",
  "magic-crypt",
@@ -14976,7 +14975,7 @@ dependencies = [
  "prometheus",
  "quick-xml",
  "quick_cache",
- "rand 0.9.0",
+ "rand 0.9.5",
  "regex",
  "reqwest 0.13.5",
  "rsa",
@@ -15068,7 +15067,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15091,7 +15090,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15108,14 +15107,14 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
  "chrono",
  "http 1.5.0",
  "itertools 0.14.0",
- "jsonwebtoken 8.3.0",
+ "jsonwebtoken 10.4.0",
  "lazy_static",
  "quick_cache",
  "reqwest 0.13.5",
@@ -15134,7 +15133,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -15144,7 +15143,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15161,7 +15160,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
@@ -15183,7 +15182,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15206,7 +15205,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15222,7 +15221,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15244,7 +15243,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15266,7 +15265,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15280,7 +15279,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -15292,7 +15291,7 @@ dependencies = [
  "futures",
  "hex",
  "hmac",
- "rand 0.9.0",
+ "rand 0.9.5",
  "rdkafka",
  "reqwest 0.13.5",
  "rmcp",
@@ -15315,7 +15314,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15340,7 +15339,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15368,7 +15367,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15390,7 +15389,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15410,8 +15409,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
+ "anyhow",
  "axum 0.8.9",
  "chrono",
  "futures",
@@ -15436,6 +15436,9 @@ dependencies = [
  "windmill-native-triggers",
  "windmill-object-store",
  "windmill-parser",
+ "windmill-parser-bash",
+ "windmill-parser-go",
+ "windmill-parser-graphql",
  "windmill-parser-py",
  "windmill-parser-py-asset",
  "windmill-parser-sql",
@@ -15448,7 +15451,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15470,13 +15473,14 @@ dependencies = [
  "windmill-ai",
  "windmill-alerting",
  "windmill-api-auth",
+ "windmill-audit",
  "windmill-common",
  "windmill-object-store",
 ]
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "lazy_static",
  "serde",
@@ -15488,7 +15492,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "argon2",
  "axum 0.8.9",
@@ -15512,7 +15516,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15526,10 +15530,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
+ "constant_time_eq 0.3.1",
  "futures",
  "hex",
  "http 1.5.0",
@@ -15537,6 +15542,7 @@ dependencies = [
  "lazy_static",
  "magic-crypt",
  "regex",
+ "reqwest 0.13.5",
  "serde",
  "serde_json",
  "sha2 0.10.9",
@@ -15545,6 +15551,7 @@ dependencies = [
  "tokio",
  "tokio-postgres",
  "tracing",
+ "url",
  "uuid",
  "windmill-api-auth",
  "windmill-api-jobs",
@@ -15561,7 +15568,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15575,7 +15582,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15594,7 +15601,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -15634,7 +15641,7 @@ dependencies = [
  "hyper 1.11.1",
  "indexmap 2.14.2",
  "itertools 0.14.0",
- "jsonwebtoken 8.3.0",
+ "jsonwebtoken 10.4.0",
  "lazy_static",
  "magic-crypt",
  "mail-send",
@@ -15654,12 +15661,15 @@ dependencies = [
  "postgres-native-tls 0.5.3",
  "prometheus",
  "quick_cache",
- "rand 0.9.0",
+ "rand 0.9.5",
+ "rcgen",
  "regex",
  "reqwest 0.13.5",
  "reqwest-middleware",
  "reqwest-retry",
  "rsa",
+ "rustls 0.23.35",
+ "rustls-native-certs 0.8.4",
  "schemars 0.8.22",
  "semver 1.0.28",
  "serde",
@@ -15680,6 +15690,7 @@ dependencies = [
  "tikv-jemalloc-ctl",
  "tokio",
  "tokio-postgres",
+ "tokio-rustls 0.26.5",
  "tokio-stream",
  "tokio-util",
  "tonic 0.13.1",
@@ -15690,6 +15701,7 @@ dependencies = [
  "url",
  "urlencoding",
  "uuid",
+ "webpki-roots 1.0.9",
  "windmill-macros",
  "windmill-parser",
  "windmill-parser-py",
@@ -15701,7 +15713,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "chrono",
  "futures",
@@ -15721,7 +15733,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "regex",
  "serde",
@@ -15738,7 +15750,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -15765,7 +15777,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15782,7 +15794,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15798,7 +15810,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15819,7 +15831,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15850,7 +15862,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -15875,7 +15887,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -15910,7 +15922,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15928,7 +15940,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15937,7 +15949,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15949,7 +15961,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15961,7 +15973,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15973,7 +15985,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15985,7 +15997,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15997,7 +16009,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -16008,7 +16020,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -16019,7 +16031,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -16031,7 +16043,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -16042,7 +16054,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -16064,7 +16076,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -16076,7 +16088,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16090,7 +16102,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -16107,7 +16119,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16120,7 +16132,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -16132,7 +16144,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16150,7 +16162,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -16166,7 +16178,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -16182,7 +16194,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16196,7 +16208,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -16215,7 +16227,7 @@ dependencies = [
  "once_cell",
  "prometheus",
  "quick_cache",
- "rand 0.9.0",
+ "rand 0.9.5",
  "regex",
  "reqwest 0.13.5",
  "serde",
@@ -16235,7 +16247,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "const_format",
@@ -16275,7 +16287,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -16286,7 +16298,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -16321,7 +16333,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16345,7 +16357,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16355,7 +16367,7 @@ dependencies = [
  "hyper 1.11.1",
  "itertools 0.14.0",
  "lazy_static",
- "rand 0.9.0",
+ "rand 0.9.5",
  "reqwest 0.13.5",
  "serde",
  "serde_json",
@@ -16378,7 +16390,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-amqp"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16405,7 +16417,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16419,7 +16431,7 @@ dependencies = [
  "itertools 0.14.0",
  "lazy_static",
  "quick_cache",
- "rand 0.9.0",
+ "rand 0.9.5",
  "reqwest 0.13.5",
  "serde",
  "serde_json",
@@ -16438,7 +16450,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16458,7 +16470,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16470,7 +16482,7 @@ dependencies = [
  "google-cloud-pubsub",
  "http 1.5.0",
  "itertools 0.14.0",
- "jsonwebtoken 8.3.0",
+ "jsonwebtoken 10.4.0",
  "lazy_static",
  "quick_cache",
  "reqwest 0.13.5",
@@ -16492,7 +16504,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16528,7 +16540,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16551,7 +16563,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16575,7 +16587,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -16599,7 +16611,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16614,7 +16626,7 @@ dependencies = [
  "pg_escape",
  "postgres-native-tls 0.5.2",
  "quick_cache",
- "rand 0.9.0",
+ "rand 0.9.5",
  "rust_decimal",
  "serde",
  "serde_json",
@@ -16634,7 +16646,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16662,7 +16674,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16687,14 +16699,14 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "bitflags 2.13.2",
  "chrono",
  "hex",
  "itertools 0.14.0",
- "rand 0.9.0",
+ "rand 0.9.5",
  "serde",
  "serde_json",
  "sqlx",
@@ -16706,7 +16718,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -16735,10 +16747,10 @@ dependencies = [
  "hmac",
  "hudsucker",
  "hyper-http-proxy",
- "hyper-rustls 0.27.9",
+ "hyper-rustls 0.27.10",
  "hyper-util",
  "itertools 0.14.0",
- "jsonwebtoken 8.3.0",
+ "jsonwebtoken 10.4.0",
  "lazy_static",
  "libffi-sys",
  "libloading",
@@ -16752,14 +16764,14 @@ dependencies = [
  "opentelemetry-proto 0.30.0",
  "oracle",
  "parquet",
- "pem 3.0.6",
+ "pem",
  "pep440_rs",
  "postgres-native-tls 0.5.3",
  "process-wrap",
  "prometheus",
  "prost",
  "quick_cache",
- "rand 0.9.0",
+ "rand 0.9.5",
  "rcgen",
  "regex",
  "reqwest 0.13.5",
@@ -16824,7 +16836,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "bytes",
  "futures",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 395e49afdc..2e81eb2637 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.814.0"
+version = "1.817.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -88,7 +88,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.814.0"
+version = "1.817.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
@@ -493,7 +493,7 @@ sql-builder = "^3"
 # behind a feature and changed `hash_password`), so a float breaks the build.
 argon2 = "0.6"
 quick_cache = "^0"
-rand = "=0.9.0"
+rand = "^0.9.3"
 rand_core = { version = "^0", features = ["std"] }
 arc-swap = "1"
 ed25519-dalek = { version = "2", features = ["rand_core"] }
@@ -514,7 +514,7 @@ reqwest = { version = "^0.13", features = ["json", "stream", "gzip", "multipart"
 eventsource-stream = "0.2.3"
 time = "^0"
 serde_urlencoded = "^0"
-astral-tokio-tar = "^0.5.6"
+astral-tokio-tar = "^0.6.2"
 tempfile = "^3"
 x509-parser = "^0.16"
 tokio-util = { version = "=0.7.17", features = ["io"] }
@@ -523,7 +523,7 @@ itertools = "^0.14.0"
 regex = "^1"
 semver = "^1"
 aws-sigv4 = "^1.3.4"
-aws-sdk-config = "=1.68.0"
+aws-sdk-config = "^1.94.0"
 aws-sdk-rds = "^1"
 async-trait = "0.1.88"
 
@@ -637,7 +637,9 @@ libxml = { version = "=0.3.3" }
 samael = { git="https://github.com/njaremko/samael", rev="f879f1942ec1b34b6d3027ce7e4724ad95d15dfa", features = ["xmlsec"] }
 gcp_auth = "0.9.0"
 rust_decimal = { version = "^1", features = ["db-postgres", "serde-float"]}
-jsonwebtoken = "8.3.0"
+# aws_lc_rs, not rust_crypto: the RustCrypto backend refuses RSA keys above 4096 bits, and
+# external/guest JWT issuers may sign with 8192-bit keys.
+jsonwebtoken = { version = "^10.3", features = ["aws_lc_rs"] }
 pem = "3.0.1"
 nix = { version = "0.27.1", features = ["process", "signal"] }
 fs4 = "0.13"
@@ -683,8 +685,8 @@ aws-sdk-bedrockruntime = "=1.122.0"
 aws-credential-types = "^1"
 aws-smithy-types = "^1"
 aws-sdk-secretsmanager = "^1"
-aws-sdk-sqs = "=1.77.0"
-aws-sdk-sts = "=1.79.0"
+aws-sdk-sqs = "^1.89.0"
+aws-sdk-sts = "^1.91.0"
 aws-sdk-sso = "=1.77.0"
 aws-sdk-ssooidc = "=1.78.0"
 rustls = "=0.23.35"
@@ -755,4 +757,5 @@ hyper-http-proxy = { version = "1", default-features = false, features = ["rustl
 hyper-rustls = { version = "0.27", default-features = false, features = ["http1", "http2", "ring", "tls12"] }
 tokio-rustls = { version = "0.26", default-features = false, features = ["ring", "tls12"] }
 rustls-native-certs = "0.8"
+webpki-roots = "1"
 rcgen = "0.13"
diff --git a/backend/THREAT_MODEL.md b/backend/THREAT_MODEL.md
index af33877078..73a4b53227 100644
--- a/backend/THREAT_MODEL.md
+++ b/backend/THREAT_MODEL.md
@@ -97,7 +97,7 @@ published advisory history (73 GHSA advisories, several rated 9.9 critical).
 | id | threat | actor | surface | asset | impact | likelihood | status | controls | evidence |
 |---|---|---|---|---|---|---|---|---|---|
 | T1 | SQL injection in app/internal query builders and trigger clauses compromises the metadata DB and connected databases | remote_auth | EP8 | Database, downstream connected systems | critical | almost_certain | partially_mitigated | sqlx parameterized queries elsewhere; query-builder safety reviews | GHSA-225c-j3xq-g6x6, GHSA-78p7-jc72-gv66, GHSA-hvc7-f67h-jx3g, GHSA-wrrg-f89m-f84q, GHSA-79vf-3qwm-2w64, GHSA-55p6-fxj4-v983, GHSA-5g4v-49rj-r52r, GHSA-x6cq-7xr8-53x3, 2cf4bb180b |
-| T2 | Server-side request forgery via proxies/executors reaches cloud metadata, internal network, and downstream credentials | remote_auth | EP6, EP7 | Cloud metadata, internal network, downstream connected systems, resource creds | critical | almost_certain | partially_mitigated | SSRF URL validation + redirect-following disabled added piecemeal; MCP private URL access requires the instance-wide `ALLOW_PRIVATE_MCP_SERVER_URLS` opt-in; WebSocket trigger URLs (stored, test, and runnable-resolved) are SSRF-validated at connect time behind the `ALLOW_PRIVATE_WEBSOCKET_URLS` opt-in, and the trigger test route now requires `:write` scope; SAML IdP metadata URLs are SSRF-validated at load time behind the `ALLOW_PRIVATE_SAML_METADATA_URLS` opt-in; outbound network isolation (`clone_newnet`) is opt-in and off by default | GHSA-3ggp-h37f-5qfw, GHSA-98qq-g8rh-xhff, GHSA-hfw8-27mx-63jm, GHSA-3r59-qvvc-774j, GHSA-4pj9-w5jc-g8w7, GHSA-8hh3-jf25-78j5, GHSA-3pjm-4w7f-3r2w, GHSA-f44c-x9hq-h68r, GHSA-j4h4-f8fj-3m3c, 4b06881918, 96a8eb63d4, dbd3942ef3 |
+| T2 | Server-side request forgery via proxies/executors reaches cloud metadata, internal network, and downstream credentials | remote_auth | EP6, EP7 | Cloud metadata, internal network, downstream connected systems, resource creds | critical | almost_certain | partially_mitigated | SSRF URL validation + redirect-following disabled added piecemeal; MCP private URL access requires the instance-wide `ALLOW_PRIVATE_MCP_SERVER_URLS` opt-in; WebSocket trigger URLs (stored, test, and runnable-resolved) are SSRF-validated at connect time behind the `ALLOW_PRIVATE_WEBSOCKET_URLS` opt-in, and the trigger test route now requires `:write` scope; SAML IdP metadata URLs are SSRF-validated at load time behind the `ALLOW_PRIVATE_SAML_METADATA_URLS` opt-in; workspace webhook URLs are SSRF-checked when saved, not when sent, behind the `ALLOW_PRIVATE_WEBHOOK_URLS` opt-in; outbound network isolation (`clone_newnet`) is opt-in and off by default | GHSA-3ggp-h37f-5qfw, GHSA-98qq-g8rh-xhff, GHSA-hfw8-27mx-63jm, GHSA-3r59-qvvc-774j, GHSA-4pj9-w5jc-g8w7, GHSA-8hh3-jf25-78j5, GHSA-3pjm-4w7f-3r2w, GHSA-f44c-x9hq-h68r, GHSA-j4h4-f8fj-3m3c, 4b06881918, 96a8eb63d4, dbd3942ef3 |
 | T3 | Broken authorization / IDOR lets a scoped token or low-privilege member read scripts, job data, and secrets across folders and workspaces | remote_auth | EP5, EP2, EP1 | Scripts, job data, secrets, isolation | critical | almost_certain | partially_mitigated | RLS, token scopes, folder ACLs, view-token HMAC (added incrementally); on managed, sensitive tenants can opt into dedicated DB/worker/namespace, but the shared tier IS the software boundary | GHSA-qfg7-x243-5hg4, GHSA-8x8x-88qc-qp4r, GHSA-2ppx-66jv-wpw5, GHSA-x3x7-g97v-mp59, GHSA-j276-g4h8-g6h5, GHSA-8mv7-hmrg-96xv, GHSA-x2wf-f962-7frq, GHSA-qc7c-gcw6-h4xp, GHSA-vxc5-w28p-m9xw, GHSA-2g34-wfvr-5qqj, GHSA-w7p6-wpxm-pp66, 7edf3f0212, 89a7a37776, ab11c7747a, 664edcdfb7 |
 | T4 | Remote code execution by injecting attacker-controlled identifiers into generated worker wrappers | remote_auth | EP10 | Worker host, isolation, downstream | critical | likely | partially_mitigated | entrypoint/env-var-name validation added | GHSA-wxjq-w5pj-jqhx, GHSA-5f5q-2vg2-r2x4, GHSA-8q8j-mm3g-5c2q (CVE-2026-33881), bf93657fee, bd05bcadde, 22ec4da5f0 |
 | T5 | Worker compromise & cross-tenant access via weak-by-default isolation (nsjail off by default → user code runs with only PID-ns `unshare`); sandbox escape where nsjail/dind/podman is enabled | remote_auth | EP9, EP15 | Worker host, isolation, downstream | critical | likely | unmitigated | nsjail off by default everywhere (`DISABLE_NSJAIL=true`); shipped compose gives PID-ns `unshare` only (`FAVOR_UNSHARE_PID=true`), bare installs get no isolation. Where nsjail enabled: read-only remounts, jail-tmp refusal, podman socket gating | GHSA-6qr8-xhg4-453q, GHSA-3vpp-vf62-wqp6, f8467f38c8, df5aec0f5d, f1b6746e0e |
diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 317ca12c5e..06b1b10a9a 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-d252afcc80e77fcc4f9a2a346b80908c8605a6c0
+c099af43bad922fd57ed0449ab717ffa047b5546
diff --git a/backend/generate_mcp_endpoints_tools/generate_mcp_tools.py b/backend/generate_mcp_endpoints_tools/generate_mcp_tools.py
index 72feb5392e..4c78f0524e 100644
--- a/backend/generate_mcp_endpoints_tools/generate_mcp_tools.py
+++ b/backend/generate_mcp_endpoints_tools/generate_mcp_tools.py
@@ -128,11 +128,16 @@ def extract_separate_schemas(parameters: List[Dict[str, Any]], request_body: Opt
                     r for r in body_schema['required'] if r in include_fields
                 ]
 
-        # Apply opaque_fields: simplify listed properties to {"type": "object"}
+        # Apply opaque_fields: simplify listed properties to {"type": "object"},
+        # keeping the description, which is all a caller learns about the field
         if body_schema and opaque_fields and 'properties' in body_schema:
             for field in opaque_fields:
                 if field in body_schema['properties']:
-                    body_schema['properties'][field] = {"type": "object"}
+                    opaque = {"type": "object"}
+                    description = body_schema['properties'][field].get('description')
+                    if description:
+                        opaque['description'] = description
+                    body_schema['properties'][field] = opaque
 
         # If we have required fields specified and a body schema, update the required array
         if body_schema and required_fields:
diff --git a/backend/migrations/20260908142148_datatable_role_catalog.down.sql b/backend/migrations/20260908142148_datatable_role_catalog.down.sql
new file mode 100644
index 0000000000..8d3f12bc4a
--- /dev/null
+++ b/backend/migrations/20260908142148_datatable_role_catalog.down.sql
@@ -0,0 +1,18 @@
+-- Refuse while the catalog holds anything. Each row is a live Postgres login with a password
+-- only this table carries, so dropping it would leave credentials on the cluster that Windmill can
+-- no longer disable, delete or even name — and re-applying could not recreate them, because the
+-- role names would already be taken. Cleaning them up here is not an option either: dropping a
+-- role means reassigning what it owns in *every* instance database, and a migration runs in one.
+--
+-- Delete the roles through instance settings first; that path does the cluster work.
+LOCK TABLE datatable_role IN ACCESS EXCLUSIVE MODE;
+
+DO $$
+BEGIN
+    IF EXISTS (SELECT 1 FROM datatable_role) THEN
+        RAISE EXCEPTION 'Cannot roll back: % data table role(s) still exist as Postgres logins. Delete them in instance settings first, which drops them from the cluster.',
+            (SELECT count(*) FROM datatable_role);
+    END IF;
+END $$;
+
+DROP TABLE IF EXISTS datatable_role;
diff --git a/backend/migrations/20260908142148_datatable_role_catalog.up.sql b/backend/migrations/20260908142148_datatable_role_catalog.up.sql
new file mode 100644
index 0000000000..59cce4cc08
--- /dev/null
+++ b/backend/migrations/20260908142148_datatable_role_catalog.up.sql
@@ -0,0 +1,21 @@
+-- The instance's data table role catalog: one row per Postgres login Windmill created for data
+-- table access.
+--
+-- A table rather than a `global_settings` key, because the value is a set of live cluster
+-- credentials and that table has generic read, list, write and CLI round-trip paths that know
+-- nothing about what they are carrying. Every one of them is a way to leak the passwords or to
+-- overwrite the catalog with a copy that has none, and a row nothing generic touches has none of
+-- those. One row per role also makes two concurrent creates two inserts rather than a
+-- read-modify-write over one document.
+CREATE TABLE datatable_role (
+    id VARCHAR(50) PRIMARY KEY,
+    -- The Postgres role name, verbatim. Unique because it is the cluster's own key.
+    name VARCHAR(63) NOT NULL UNIQUE,
+    enabled BOOLEAN NOT NULL DEFAULT true,
+    -- Generated by Windmill, never entered by anyone, and never leaves the server.
+    pwd TEXT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+GRANT ALL ON datatable_role TO windmill_user;
+GRANT ALL ON datatable_role TO windmill_admin;
diff --git a/backend/migrations/20260914133558_draft_base_version.down.sql b/backend/migrations/20260914133558_draft_base_version.down.sql
new file mode 100644
index 0000000000..07fc93ba30
--- /dev/null
+++ b/backend/migrations/20260914133558_draft_base_version.down.sql
@@ -0,0 +1 @@
+ALTER TABLE draft DROP COLUMN base;
diff --git a/backend/migrations/20260914133558_draft_base_version.up.sql b/backend/migrations/20260914133558_draft_base_version.up.sql
new file mode 100644
index 0000000000..835816d70c
--- /dev/null
+++ b/backend/migrations/20260914133558_draft_base_version.up.sql
@@ -0,0 +1,14 @@
+-- The version a draft forked from, as one opaque text id whatever the kind: a
+-- script hash (hex), a flow_version.id, an app_version.id. NULL for a draft that
+-- was never forked from a deploy and for kinds that keep no lineage.
+ALTER TABLE draft ADD COLUMN base TEXT;
+
+-- A U+0000 inside a `json` value makes `->>` raise 22P05; such rows keep NULL and
+-- get their base on their next save.
+UPDATE draft SET base = CASE typ::text
+    WHEN 'script' THEN value ->> 'parent_hash'
+    WHEN 'flow' THEN value ->> 'version_id'
+    ELSE value ->> 'parent_version'
+  END
+WHERE typ::text IN ('script', 'flow', 'app', 'raw_app')
+  AND position(chr(92) || 'u0000' in replace(value::text, chr(92) || chr(92), '')) = 0;
diff --git a/backend/migrations/20260914154128_draft_move.down.sql b/backend/migrations/20260914154128_draft_move.down.sql
new file mode 100644
index 0000000000..6fff84e4bb
--- /dev/null
+++ b/backend/migrations/20260914154128_draft_move.down.sql
@@ -0,0 +1 @@
+DROP TABLE draft_move;
diff --git a/backend/migrations/20260914154128_draft_move.up.sql b/backend/migrations/20260914154128_draft_move.up.sql
new file mode 100644
index 0000000000..e68e36c5ff
--- /dev/null
+++ b/backend/migrations/20260914154128_draft_move.up.sql
@@ -0,0 +1,17 @@
+-- Where an item's drafts went when it moved, so a draft save still addressed to the
+-- old path (an editor left open across the move, a chat, the CLI) lands on the moved
+-- draft instead of starting a new item there. `email` NULL records a deployed item's
+-- move and applies to every user; set, it records that user's draft-only move.
+CREATE TABLE draft_move (
+    id BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    workspace_id VARCHAR(50) NOT NULL REFERENCES workspace(id) ON DELETE CASCADE,
+    typ DRAFT_KIND NOT NULL,
+    old_path VARCHAR(255) NOT NULL,
+    new_path VARCHAR(255) NOT NULL,
+    email VARCHAR(255)
+);
+
+CREATE INDEX draft_move_old_path_idx ON draft_move (workspace_id, typ, old_path);
+
+GRANT ALL ON draft_move TO windmill_user;
+GRANT ALL ON draft_move TO windmill_admin;
diff --git a/backend/migrations/20260918092041_add_admins_and_developers_to_forks.down.sql b/backend/migrations/20260918092041_add_admins_and_developers_to_forks.down.sql
new file mode 100644
index 0000000000..4e8ac47c69
--- /dev/null
+++ b/backend/migrations/20260918092041_add_admins_and_developers_to_forks.down.sql
@@ -0,0 +1 @@
+ALTER TABLE workspace_settings DROP COLUMN add_admins_and_developers_to_forks;
diff --git a/backend/migrations/20260918092041_add_admins_and_developers_to_forks.up.sql b/backend/migrations/20260918092041_add_admins_and_developers_to_forks.up.sql
new file mode 100644
index 0000000000..bb3502d362
--- /dev/null
+++ b/backend/migrations/20260918092041_add_admins_and_developers_to_forks.up.sql
@@ -0,0 +1 @@
+ALTER TABLE workspace_settings ADD COLUMN add_admins_and_developers_to_forks BOOLEAN NOT NULL DEFAULT false;
diff --git a/backend/migrations/20260919213810_remote_deploy.down.sql b/backend/migrations/20260919213810_remote_deploy.down.sql
new file mode 100644
index 0000000000..ae26684ac6
--- /dev/null
+++ b/backend/migrations/20260919213810_remote_deploy.down.sql
@@ -0,0 +1,4 @@
+DROP TABLE IF EXISTS remote_deploy_token;
+ALTER TABLE workspace_settings
+    DROP COLUMN IF EXISTS remote_deploy_target,
+    DROP COLUMN IF EXISTS remote_deploy_target_changed_at;
diff --git a/backend/migrations/20260919213810_remote_deploy.up.sql b/backend/migrations/20260919213810_remote_deploy.up.sql
new file mode 100644
index 0000000000..c32f81fd88
--- /dev/null
+++ b/backend/migrations/20260919213810_remote_deploy.up.sql
@@ -0,0 +1,35 @@
+-- The workspace on another Windmill instance this workspace deploys into from the UI:
+-- `{"base_url": ..., "workspace_id": ...}`, and when it last changed. A token connected under an
+-- earlier change counts for nothing, even once the setting points back at the target it was for.
+ALTER TABLE workspace_settings
+    ADD COLUMN remote_deploy_target JSONB,
+    ADD COLUMN remote_deploy_target_changed_at TIMESTAMPTZ;
+
+-- One user's token for the remote deploy target, encrypted with the workspace key.
+-- `base_url`/`remote_workspace_id` name the target it was granted for: a token is only
+-- ever sent to that target, so re-pointing the workspace setting cannot redirect it.
+-- Keyed by the account rather than by membership, since a superadmin deploys from workspaces
+-- it is not a member of. The account key cascades: whatever deletes or renames an account
+-- takes its tokens along, so a later account with the same address cannot inherit them.
+CREATE TABLE remote_deploy_token (
+    workspace_id VARCHAR(50) NOT NULL REFERENCES workspace(id) ON DELETE CASCADE,
+    email VARCHAR(255) NOT NULL REFERENCES password(email) ON DELETE CASCADE ON UPDATE CASCADE,
+    base_url VARCHAR(1000) NOT NULL,
+    remote_workspace_id VARCHAR(50) NOT NULL,
+    token TEXT NOT NULL,
+    remote_email VARCHAR(255) NOT NULL,
+    -- Part of every proxy URL, and readable only by its owner through the API: a link from
+    -- elsewhere, which rides the session cookie, cannot know it and so cannot spend the token.
+    proxy_key VARCHAR(64) NOT NULL,
+    -- When the connect that wrote the row started, or when a disconnect emptied it.
+    connected_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    -- What the connect ran under: the `created_at` of the owner's membership (NULL for a
+    -- superadmin with none) and the target's `remote_deploy_target_changed_at`. The row counts
+    -- only while both are still the same, so a re-add or a target change voids it.
+    member_since TIMESTAMPTZ,
+    target_changed_at TIMESTAMPTZ,
+    PRIMARY KEY (workspace_id, email)
+);
+
+GRANT ALL ON remote_deploy_token TO windmill_user;
+GRANT ALL ON remote_deploy_token TO windmill_admin;
diff --git a/backend/migrations/20260923173023_ai_instruction_resource_type.down.sql b/backend/migrations/20260923173023_ai_instruction_resource_type.down.sql
new file mode 100644
index 0000000000..25b81b8c69
--- /dev/null
+++ b/backend/migrations/20260923173023_ai_instruction_resource_type.down.sql
@@ -0,0 +1,6 @@
+-- `created_by` tells this migration's row from one a user created by hand; a hub
+-- sync updates in place and leaves it alone.
+DELETE FROM resource_type
+WHERE workspace_id = 'admins'
+  AND name = 'ai_instruction'
+  AND created_by = 'system';
diff --git a/backend/migrations/20260923173023_ai_instruction_resource_type.up.sql b/backend/migrations/20260923173023_ai_instruction_resource_type.up.sql
new file mode 100644
index 0000000000..1b89469a91
--- /dev/null
+++ b/backend/migrations/20260923173023_ai_instruction_resource_type.up.sql
@@ -0,0 +1,15 @@
+-- Folder instructions for the AI chat: a markdown file resource whose
+-- `value.content` applies to every item under the directory it lives in.
+-- `format_extension` makes the resource editor render it as a plain .md file.
+-- Seeded under 'admins' so every workspace sees it before the next hub sync.
+INSERT INTO resource_type (workspace_id, name, schema, description, created_by, format_extension, edited_at)
+VALUES (
+    'admins',
+    'ai_instruction',
+    '{"type": "object", "properties": {"content": {"type": "string"}}}',
+    'Instructions for the AI chat that apply to every item under the folder this resource lives in, like an AGENTS.md: an ai_instruction at f/billing/AGENTS is given to the assistant whenever it works on something under f/billing/. The file body is the instructions it follows.',
+    'system',
+    'md',
+    now()
+)
+ON CONFLICT (workspace_id, name) DO NOTHING;
diff --git a/backend/parsers/windmill-parser-ts/src/lib.rs b/backend/parsers/windmill-parser-ts/src/lib.rs
index 271ad4835b..ac75080994 100644
--- a/backend/parsers/windmill-parser-ts/src/lib.rs
+++ b/backend/parsers/windmill-parser-ts/src/lib.rs
@@ -16,11 +16,13 @@ use windmill_parser::{
 
 use swc_common::{sync::Lrc, FileName, SourceMap, SourceMapper, Span, Spanned};
 use swc_ecma_ast::{
-    ArrayLit, AssignPat, BigInt, BindingIdent, Bool, Decl, ExportDecl, Expr, Ident, IdentName, Lit,
-    MemberExpr, MemberProp, ModuleDecl, ModuleItem, Number, ObjectLit, ObjectPat, Param, Pat, Stmt,
-    Str, TsArrayType, TsEntityName, TsInterfaceDecl, TsKeywordType, TsKeywordTypeKind, TsLit,
-    TsLitType, TsOptionalType, TsParenthesizedType, TsPropertySignature, TsType, TsTypeAliasDecl,
-    TsTypeAnn, TsTypeElement, TsTypeLit, TsTypeRef, TsUnionOrIntersectionType, TsUnionType,
+    ArrayLit, AssignPat, BigInt, BindingIdent, Bool, Decl, ExportDecl, Expr, ExprOrSpread, Ident,
+    IdentName, KeyValueProp, Lit, MemberExpr, MemberProp, ModuleDecl, ModuleItem, Number,
+    ObjectLit, ObjectPat, Param, Pat, Prop, PropName, PropOrSpread, Stmt, Str, TsArrayType,
+    TsEntityName, TsInterfaceDecl, TsKeywordType, TsKeywordTypeKind, TsLit, TsLitType,
+    TsOptionalType, TsParenthesizedType, TsPropertySignature, TsType, TsTypeAliasDecl, TsTypeAnn,
+    TsTypeElement, TsTypeLit, TsTypeRef, TsUnionOrIntersectionType, TsUnionType, UnaryExpr,
+    UnaryOp,
 };
 use swc_ecma_parser::{lexer::Lexer, EsSyntax, Parser, StringInput, Syntax, TsSyntax};
 
@@ -578,6 +580,15 @@ fn parse_param(
                 }
             };
 
+            let literal = match &*right {
+                Expr::Object(_) | Expr::Array(_) if !skip_dflt => literal_json(&right),
+                _ => None,
+            };
+            // Types an untyped object default that is not a plain literal (`{ a: x }`).
+            let literal_shape = match &*right {
+                Expr::Object(_) => Some(Typ::Object(ObjectType::new(None, None))),
+                _ => None,
+            };
             let dflt = if skip_dflt {
                 None
             } else {
@@ -593,14 +604,19 @@ fn parse_param(
                     Expr::Lit(Lit::Num(Number { value, .. })) => Some(serde_json::json!(value)),
                     Expr::Lit(Lit::BigInt(BigInt { value, .. })) => Some(serde_json::json!(value)),
                     Expr::Lit(Lit::Bool(Bool { value, .. })) => Some(Value::Bool(value)),
-                    Expr::Object(ObjectLit { span, .. }) => eval_span(span, cm),
-                    Expr::Array(ArrayLit { span, .. }) => eval_span(span, cm),
+                    Expr::Object(ObjectLit { span, .. }) | Expr::Array(ArrayLit { span, .. }) => {
+                        literal.or_else(|| eval_span(span, cm))
+                    }
                     _ => None,
                 }
             };
 
-            if typ == Typ::Unknown && dflt.is_some() {
-                typ = json_to_typ(dflt.as_ref().unwrap(), false);
+            if typ == Typ::Unknown {
+                match &dflt {
+                    Some(d) => typ = json_to_typ(d, false),
+                    None if !skip_dflt => typ = literal_shape.unwrap_or(Typ::Unknown),
+                    None => {}
+                }
             }
             Ok(Arg {
                 otyp,
@@ -636,6 +652,59 @@ fn parse_param(
     r
 }
 
+/// A default written as a plain literal, read off the AST: `['a']` and `{ a: 1 }` are
+/// not JSON, and outside wasm nothing can evaluate them (see `eval_sync`).
+fn literal_json(expr: &Expr) -> Option<Value> {
+    let num = |v: f64| {
+        if v.fract() == 0.0 && v.abs() < 9007199254740992.0 {
+            Some(serde_json::json!(v as i64))
+        } else {
+            serde_json::Number::from_f64(v).map(Value::Number)
+        }
+    };
+    match expr {
+        Expr::Lit(Lit::Str(s)) => Some(Value::String(s.value.to_string())),
+        Expr::Lit(Lit::Num(n)) => num(n.value),
+        Expr::Lit(Lit::Bool(b)) => Some(Value::Bool(b.value)),
+        Expr::Lit(Lit::Null(_)) => Some(Value::Null),
+        Expr::Unary(UnaryExpr { op: UnaryOp::Minus, arg, .. }) => match &**arg {
+            Expr::Lit(Lit::Num(n)) => num(-n.value),
+            _ => None,
+        },
+        Expr::Paren(p) => literal_json(&p.expr),
+        Expr::Array(a) => a
+            .elems
+            .iter()
+            .map(|e| match e {
+                Some(ExprOrSpread { spread: None, expr }) => literal_json(expr),
+                _ => None,
+            })
+            .collect::<Option<Vec<_>>>()
+            .map(Value::Array),
+        Expr::Object(o) => o
+            .props
+            .iter()
+            .map(|p| match p {
+                PropOrSpread::Prop(p) => match &**p {
+                    Prop::KeyValue(KeyValueProp { key, value }) => {
+                        let key = match key {
+                            PropName::Ident(i) => i.sym.to_string(),
+                            PropName::Str(s) => s.value.to_string(),
+                            PropName::Num(n) => n.value.to_string(),
+                            _ => return None,
+                        };
+                        Some((key, literal_json(value)?))
+                    }
+                    _ => None,
+                },
+                _ => None,
+            })
+            .collect::<Option<serde_json::Map<_, _>>>()
+            .map(Value::Object),
+        _ => None,
+    }
+}
+
 fn eval_span(span: Span, cm: &Lrc<SourceMap>) -> Option<Value> {
     let expr = cm
         .span_to_snippet(span)
@@ -1361,5 +1430,7 @@ pub fn eval_sync(code: &str) -> Result<serde_json::Value, String> {
 
 #[cfg(not(target_arch = "wasm32"))]
 pub fn eval_sync(_code: &str) -> Result<serde_json::Value, String> {
-    panic!("eval_sync is only available in wasm32")
+    // The server parses signatures with defaults too: a default that is not JSON
+    // (`{ a: 1 }`, `['x']`) is then left out rather than failing the parse.
+    Err("evaluating a JavaScript default needs the wasm build".to_string())
 }
diff --git a/backend/parsers/windmill-parser-ts/tests/tests.rs b/backend/parsers/windmill-parser-ts/tests/tests.rs
index 4206dd68f8..b4abc23488 100644
--- a/backend/parsers/windmill-parser-ts/tests/tests.rs
+++ b/backend/parsers/windmill-parser-ts/tests/tests.rs
@@ -7,6 +7,38 @@ mod tests {
         remove_pinned_import_specifiers,
     };
 
+    /// The server parses defaults natively, where a non-JSON literal cannot be evaluated
+    /// but must still type and default the argument as the editor's wasm parse does.
+    #[test]
+    fn non_json_literal_defaults_parse_natively() {
+        let code =
+            "export function main(opts = { enabled: true, 'n': -1 }, tags = ['a'], o = { a: x }) {}";
+        let sig = parse_deno_signature(code, false, false, None).unwrap();
+        let defaults: Vec<_> = sig
+            .args
+            .iter()
+            .map(|a| (a.typ.clone(), a.default.clone()))
+            .collect();
+        assert_eq!(
+            defaults,
+            vec![
+                (
+                    Typ::Object(ObjectType::new(
+                        None,
+                        Some(vec![
+                            ObjectProperty::new("enabled".into(), Box::new(Typ::Bool)),
+                            ObjectProperty::new("n".into(), Box::new(Typ::Int)),
+                        ])
+                    )),
+                    Some(json!({"enabled": true, "n": -1}))
+                ),
+                (Typ::List(Box::new(Typ::Str(None))), Some(json!(["a"]))),
+                // Not a plain literal: typed by its shape, with no default value.
+                (Typ::Object(ObjectType::new(None, None)), None),
+            ]
+        );
+    }
+
     #[test]
     fn test_imports_basic() {
         let code = r#"
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index 335b3f79cf..ccba27bcc5 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -267,6 +267,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ec6fb3fe69024a75fa7e1bfb48aa6cf59706a101658ea01bfd33b2b248a038f"
 dependencies = [
  "aws-lc-sys",
+ "untrusted 0.7.1",
  "zeroize",
 ]
 
@@ -374,12 +375,6 @@ dependencies = [
  "windows-link",
 ]
 
-[[package]]
-name = "base64"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
-
 [[package]]
 name = "base64"
 version = "0.21.7"
@@ -780,9 +775,9 @@ dependencies = [
 
 [[package]]
 name = "cmov"
-version = "0.5.3"
+version = "0.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f88a43d011fc4a6876cb7344703e297c71dda42494fee094d5f7c76bf13f746"
+checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
 
 [[package]]
 name = "colorchoice"
@@ -1337,7 +1332,7 @@ checksum = "da0e4dd2a88388a1f4ccc7c9ce104604dab68d9f408dc34cd45823d5a9069095"
 dependencies = [
  "futures-core",
  "futures-sink",
- "spin 0.9.8",
+ "spin",
 ]
 
 [[package]]
@@ -1535,7 +1530,7 @@ dependencies = [
  "cfg-if",
  "js-sys",
  "libc",
- "wasi",
+ "wasi 0.11.1+wasi-snapshot-preview1",
  "wasm-bindgen",
 ]
 
@@ -2186,16 +2181,20 @@ dependencies = [
 
 [[package]]
 name = "jsonwebtoken"
-version = "8.3.0"
+version = "10.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6971da4d9c3aa03c3d8f3ff0f4155b534aad021292003895a469716b2a230378"
+checksum = "eba32bfb4ffdeaca3e34431072faf01745c9b26d25504aa7a6cf5684334fc4fc"
 dependencies = [
- "base64 0.21.7",
+ "aws-lc-rs",
+ "base64 0.22.1",
+ "getrandom 0.2.17",
+ "js-sys",
  "pem",
- "ring 0.16.20",
  "serde",
  "serde_json",
+ "signature",
  "simple_asn1",
+ "zeroize",
 ]
 
 [[package]]
@@ -2225,7 +2224,7 @@ version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 dependencies = [
- "spin 0.9.8",
+ "spin",
 ]
 
 [[package]]
@@ -2581,7 +2580,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a69bcab0ad47271a0234d9422b131806bf3968021e5dc9328caf2d4cd58557fc"
 dependencies = [
  "libc",
- "wasi",
+ "wasi 0.11.1+wasi-snapshot-preview1",
  "windows-sys 0.61.2",
 ]
 
@@ -2598,7 +2597,7 @@ dependencies = [
  "httparse",
  "memchr",
  "mime",
- "spin 0.9.8",
+ "spin",
  "version_check",
 ]
 
@@ -2817,7 +2816,7 @@ dependencies = [
  "num-integer",
  "num-iter",
  "num-traits",
- "rand 0.8.5",
+ "rand 0.8.6",
  "smallvec",
  "zeroize",
 ]
@@ -2903,15 +2902,14 @@ checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
 
 [[package]]
 name = "openssl"
-version = "0.10.78"
+version = "0.10.80"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f38c4372413cdaaf3cc79dd92d29d7d9f5ab09b51b10dded508fb90bb70b9222"
+checksum = "a45fa2aa886c42762255da344f0a0d313e254066c46aad76f300c3d3da62d967"
 dependencies = [
  "bitflags",
  "cfg-if",
  "foreign-types",
  "libc",
- "once_cell",
  "openssl-macros",
  "openssl-sys",
 ]
@@ -2935,9 +2933,9 @@ checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.114"
+version = "0.9.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13ce1245cd07fcc4cfdb438f7507b0c7e4f3849a69fd84d52374c66d83741bb6"
+checksum = "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695"
 dependencies = [
  "cc",
  "libc",
@@ -2994,11 +2992,12 @@ checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
 
 [[package]]
 name = "pem"
-version = "1.1.1"
+version = "3.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8835c273a76a90455d7344889b0964598e3316e2a79ede8e36f16bdcf2228b8"
+checksum = "1d30c53c26bc5b31a98cd02d20f25a7c8567146caf63ed593a9d87b2775291be"
 dependencies = [
- "base64 0.13.1",
+ "base64 0.22.1",
+ "serde_core",
 ]
 
 [[package]]
@@ -3047,6 +3046,16 @@ dependencies = [
  "phf_shared 0.12.1",
 ]
 
+[[package]]
+name = "phf"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
+dependencies = [
+ "phf_shared 0.13.1",
+ "serde",
+]
+
 [[package]]
 name = "phf_codegen"
 version = "0.11.3"
@@ -3064,7 +3073,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d"
 dependencies = [
  "phf_shared 0.11.3",
- "rand 0.8.5",
+ "rand 0.8.6",
 ]
 
 [[package]]
@@ -3098,6 +3107,15 @@ dependencies = [
  "siphasher 1.0.2",
 ]
 
+[[package]]
+name = "phf_shared"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
+dependencies = [
+ "siphasher 1.0.2",
+]
+
 [[package]]
 name = "php-parser-rs"
 version = "0.1.3"
@@ -3169,9 +3187,9 @@ dependencies = [
 
 [[package]]
 name = "postgres-protocol"
-version = "0.6.11"
+version = "0.6.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56201207dac53e2f38e848e31b4b91616a6bb6e0c7205b77718994a7f49e70fc"
+checksum = "08808e3c483c46e999108051c78334f473d5adb59d78bb80a1268c7e6aa6c514"
 dependencies = [
  "base64 0.22.1",
  "byteorder",
@@ -3187,9 +3205,9 @@ dependencies = [
 
 [[package]]
 name = "postgres-types"
-version = "0.2.9"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "613283563cd90e1dfc3518d548caee47e0e725455ed619881f5cf21f36de4b48"
+checksum = "851ca9db4932932d69f3ea811b1abe63087a0f740a47692619dd40d4899b68be"
 dependencies = [
  "array-init",
  "bit-vec 0.6.3",
@@ -3197,7 +3215,7 @@ dependencies = [
  "chrono",
  "fallible-iterator",
  "postgres-protocol",
- "serde",
+ "serde_core",
  "serde_json",
  "uuid",
 ]
@@ -3394,16 +3412,16 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.11.14"
+version = "0.11.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
+checksum = "4fcb935c5bec503c2f0e306bdd3e58bb9029dcb14fa8d9ac76e3a5256ac0763e"
 dependencies = [
  "aws-lc-rs",
  "bytes",
  "getrandom 0.3.4",
  "lru-slab",
- "rand 0.9.0",
- "ring 0.17.14",
+ "rand 0.9.5",
+ "ring",
  "rustc-hash 2.1.1",
  "rustls",
  "rustls-pki-types",
@@ -3457,9 +3475,9 @@ checksum = "dc33ff2d4973d518d823d61aa239014831e521c75da58e3df4840d3f47749d09"
 
 [[package]]
 name = "rand"
-version = "0.8.5"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a"
 dependencies = [
  "libc",
  "rand_chacha 0.3.1",
@@ -3468,13 +3486,12 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.9.0"
+version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3779b94aeb87e8bd4e834cee3650289ee9e0d5677f976ecdb6d219e5f4f6cd94"
+checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
 dependencies = [
  "rand_chacha 0.9.0",
  "rand_core 0.9.5",
- "zerocopy",
 ]
 
 [[package]]
@@ -3752,22 +3769,7 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "503c78f59814e2664c9980b739b19e40f549233ecf39928040ee54fdd431f614"
 dependencies = [
- "rand 0.8.5",
-]
-
-[[package]]
-name = "ring"
-version = "0.16.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3053cf52e236a3ed746dfc745aa9cacf1b791d846bdaf412f60a8d7d6e17c8fc"
-dependencies = [
- "cc",
- "libc",
- "once_cell",
- "spin 0.5.2",
- "untrusted 0.7.1",
- "web-sys",
- "winapi",
+ "rand 0.8.6",
 ]
 
 [[package]]
@@ -3843,7 +3845,7 @@ dependencies = [
  "borsh",
  "bytes",
  "num-traits",
- "rand 0.8.5",
+ "rand 0.8.6",
  "rkyv",
  "serde",
  "serde_json",
@@ -3901,7 +3903,7 @@ checksum = "758025cb5fccfd3bc2fd74708fd4682be41d99e5dff73c377c0646c6012c73a4"
 dependencies = [
  "aws-lc-rs",
  "once_cell",
- "ring 0.17.14",
+ "ring",
  "rustls-pki-types",
  "rustls-webpki",
  "subtle",
@@ -3959,12 +3961,12 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.9"
+version = "0.103.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7df23109aa6c1567d1c575b9952556388da57401e4ace1d15f79eedad0d8f53"
+checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
 dependencies = [
  "aws-lc-rs",
- "ring 0.17.14",
+ "ring",
  "rustls-pki-types",
  "untrusted 0.9.0",
 ]
@@ -4199,15 +4201,16 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.143"
+version = "1.0.151"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d401abef1d108fbd9cbaebc3e46611f4b1021f714a0597a71f41ee463f5f4a5a"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
 dependencies = [
  "indexmap",
  "itoa",
  "memchr",
- "ryu",
  "serde",
+ "serde_core",
+ "zmij",
 ]
 
 [[package]]
@@ -4426,12 +4429,6 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "spin"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
-
 [[package]]
 name = "spin"
 version = "0.9.8"
@@ -4594,7 +4591,7 @@ dependencies = [
  "memchr",
  "once_cell",
  "percent-encoding",
- "rand 0.8.5",
+ "rand 0.8.6",
  "rsa",
  "serde",
  "sha1",
@@ -4605,7 +4602,7 @@ dependencies = [
  "thiserror 2.0.18",
  "tracing",
  "uuid",
- "whoami",
+ "whoami 1.6.1",
 ]
 
 [[package]]
@@ -4636,7 +4633,7 @@ dependencies = [
  "memchr",
  "num-bigint",
  "once_cell",
- "rand 0.8.5",
+ "rand 0.8.6",
  "serde",
  "serde_json",
  "sha2 0.10.9",
@@ -4646,7 +4643,7 @@ dependencies = [
  "thiserror 2.0.18",
  "tracing",
  "uuid",
- "whoami",
+ "whoami 1.6.1",
 ]
 
 [[package]]
@@ -5063,9 +5060,9 @@ checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"
 
 [[package]]
 name = "tar"
-version = "0.4.45"
+version = "0.4.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22692a6476a21fa75fdfc11d452fda482af402c008cdbaf3476414e122040973"
+checksum = "3f6221d9a6003c78398e3b239969f352578258df48c8eb051caadae0015bc840"
 dependencies = [
  "filetime",
  "libc",
@@ -5274,9 +5271,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-postgres"
-version = "0.7.13"
+version = "0.7.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c95d533c83082bb6490e0189acaa0bbeef9084e60471b696ca6988cd0541fb0"
+checksum = "a528f7d280f6d5b9cd149635c8705b0dd049754bc67d81d31fa25169a93809d3"
 dependencies = [
  "async-trait",
  "byteorder",
@@ -5287,15 +5284,15 @@ dependencies = [
  "log",
  "parking_lot",
  "percent-encoding",
- "phf 0.11.3",
+ "phf 0.13.1",
  "pin-project-lite",
  "postgres-protocol",
  "postgres-types",
- "rand 0.9.0",
- "socket2 0.5.10",
+ "rand 0.10.1",
+ "socket2 0.6.3",
  "tokio",
  "tokio-util",
- "whoami",
+ "whoami 2.1.0",
 ]
 
 [[package]]
@@ -5797,7 +5794,7 @@ dependencies = [
  "getopts",
  "log",
  "phf_codegen",
- "rand 0.8.5",
+ "rand 0.8.6",
 ]
 
 [[package]]
@@ -5919,6 +5916,15 @@ version = "0.11.1+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
+[[package]]
+name = "wasi"
+version = "0.14.7+wasi-0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "883478de20367e224c0090af9cf5f9fa85bed63a95c1abf3afc5c083ebc06e8c"
+dependencies = [
+ "wasip2",
+]
+
 [[package]]
 name = "wasip2"
 version = "1.0.2+wasi-0.2.9"
@@ -5943,6 +5949,15 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
 
+[[package]]
+name = "wasite"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "66fe902b4a6b8028a753d5424909b764ccf79b7a209eac9bf97e59cda9f71a42"
+dependencies = [
+ "wasi 0.14.7+wasi-0.2.4",
+]
+
 [[package]]
 name = "wasm-bindgen"
 version = "0.2.103"
@@ -6154,7 +6169,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5d4a4db5077702ca3015d3d02d74974948aba2ad9e12ab7df718ee64ccd7e97d"
 dependencies = [
  "libredox",
- "wasite",
+ "wasite 0.1.0",
+]
+
+[[package]]
+name = "whoami"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fae98cf96deed1b7572272dfc777713c249ae40aa1cf8862e091e8b745f5361"
+dependencies = [
+ "libredox",
+ "wasite 1.0.2",
  "web-sys",
 ]
 
@@ -6191,7 +6216,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6233,9 +6258,10 @@ dependencies = [
  "pep440_rs",
  "phf 0.11.3",
  "pin-project-lite",
+ "pkcs1",
  "postgres-native-tls",
  "quick_cache",
- "rand 0.9.0",
+ "rand 0.9.5",
  "regex",
  "reqwest",
  "reqwest-middleware",
@@ -6244,8 +6270,10 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_yml",
+ "sha1",
  "sha2 0.10.9",
  "size",
+ "spki",
  "sqlx",
  "strum 0.27.2",
  "strum_macros 0.27.2",
@@ -6274,7 +6302,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6286,7 +6314,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "convert_case",
  "serde",
@@ -6295,7 +6323,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6307,7 +6335,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6319,7 +6347,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6331,7 +6359,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6343,7 +6371,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6355,7 +6383,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6366,7 +6394,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6377,7 +6405,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6389,7 +6417,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6400,7 +6428,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6422,7 +6450,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6434,7 +6462,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6448,7 +6476,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6465,7 +6493,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6478,7 +6506,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6490,7 +6518,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6508,7 +6536,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6524,7 +6552,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6540,7 +6568,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6572,7 +6600,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6586,14 +6614,14 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.814.0"
+version = "1.817.0"
 dependencies = [
  "anyhow",
  "bitflags",
  "chrono",
  "hex",
  "itertools 0.14.0",
- "rand 0.9.0",
+ "rand 0.9.5",
  "serde",
  "serde_json",
  "sqlx",
@@ -7282,6 +7310,20 @@ name = "zeroize"
 version = "1.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+dependencies = [
+ "zeroize_derive",
+]
+
+[[package]]
+name = "zeroize_derive"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c50655cbb0fe3fc43170059e702f1ce5e19b84cec58dc87b037a09935c2f328"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
 
 [[package]]
 name = "zerotrie"
@@ -7315,3 +7357,9 @@ dependencies = [
  "quote",
  "syn 2.0.117",
 ]
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index 1262be6a3b..0244b7b106 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.814.0"
+version = "1.817.0"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/parsers/windmill-parser/src/asset_parser.rs b/backend/parsers/windmill-parser/src/asset_parser.rs
index 30c6047255..70fe5aa28a 100644
--- a/backend/parsers/windmill-parser/src/asset_parser.rs
+++ b/backend/parsers/windmill-parser/src/asset_parser.rs
@@ -730,7 +730,12 @@ pub fn parse_asset_syntax(
     s: &str,
     enable_default_syntax: bool,
 ) -> Option<(AssetKind, Cow<'_, str>)> {
-    if enable_default_syntax && s == "datatable" {
+    // `datatable` and `datatable?role=analyst` both name the default data table: the role picks
+    // which Postgres login the connection is made as, not which data table is read.
+    if enable_default_syntax
+        && s.strip_prefix("datatable")
+            .is_some_and(|rest| rest.is_empty() || rest.starts_with('?'))
+    {
         return Some((AssetKind::DataTable, Cow::Borrowed("main")));
     } else if enable_default_syntax && s == "ducklake" {
         return Some((AssetKind::Ducklake, Cow::Borrowed("main")));
@@ -741,6 +746,14 @@ pub fn parse_asset_syntax(
             if *kind == AssetKind::Dbt {
                 return Some((*kind, Cow::Owned(canonicalize_table_asset_path(suffix))));
             }
+            // Same reasoning as above, for the explicit form. Specific to data tables: a
+            // `Resource`'s `?table=` is part of what it names, and stripping it would merge two
+            // different assets.
+            if *kind == AssetKind::DataTable {
+                if let Some((path, _role)) = suffix.split_once('?') {
+                    return Some((*kind, Cow::Borrowed(path)));
+                }
+            }
             // The suffix is kept verbatim. For S3 the path encodes the storage:
             // `s3://<storage>/<key>`, with an EMPTY storage segment for the
             // workspace default — so `s3:///key` yields `/key` (leading slash
@@ -1692,6 +1705,25 @@ fn parse_trigger_spec(s: &str) -> Option<TriggerSpec> {
 mod pipeline_annotation_tests {
     use super::*;
 
+    #[test]
+    fn a_datatable_role_is_not_part_of_the_asset_it_names() {
+        // The role picks which Postgres login the connection is made as, so two references that
+        // differ only by role are the same asset and must land on one graph node.
+        assert_eq!(
+            parse_asset_syntax("datatable://sales?role=analytics", false),
+            Some((AssetKind::DataTable, Cow::Borrowed("sales")))
+        );
+        assert_eq!(
+            parse_asset_syntax("datatable?role=analytics", true),
+            Some((AssetKind::DataTable, Cow::Borrowed("main")))
+        );
+        // A resource's `?table=` is part of what it names, so it is kept.
+        assert_eq!(
+            parse_asset_syntax("$res:f/db/pg?table=users", false),
+            Some((AssetKind::Resource, Cow::Borrowed("f/db/pg?table=users")))
+        );
+    }
+
     #[test]
     fn s3_path_keeps_storage_distinction() {
         // An S3 asset path is `<storage>/<key>` with an empty storage segment
diff --git a/backend/parsers/windmill-parser/src/json_schema.rs b/backend/parsers/windmill-parser/src/json_schema.rs
new file mode 100644
index 0000000000..6ca216dd89
--- /dev/null
+++ b/backend/parsers/windmill-parser/src/json_schema.rs
@@ -0,0 +1,402 @@
+use serde_json::{json, Map, Value};
+
+use crate::{MainArgSignature, ObjectProperty, Typ};
+
+/// The run-form schema of a script's `main`, derived the way the editor derives it
+/// (`inferArgs` in the frontend, `argSigToJsonSchemaType` in `windmill-utils-internal`),
+/// so a script deployed without a schema gets the one the editor would have sent.
+/// `previous` is the schema of the version being superseded: as in the editor, it is
+/// updated in place, so what the user set on it (argument order, descriptions, ...)
+/// survives wherever the code still agrees with it.
+pub fn main_arg_schema(sig: &MainArgSignature, previous: Option<&Value>) -> Value {
+    let mut schema = match previous {
+        Some(Value::Object(p)) => p.clone(),
+        _ => json!({
+            "$schema": "https://json-schema.org/draft/2020-12/schema",
+            "type": "object",
+        })
+        .as_object()
+        .cloned()
+        .unwrap_or_default(),
+    };
+    let mut old_props = match schema.remove("properties") {
+        Some(Value::Object(p)) => p,
+        _ => Map::new(),
+    };
+    let mut properties = Map::new();
+    let mut required = vec![];
+    for arg in &sig.args {
+        let mut prop = match old_props.remove(&arg.name) {
+            Some(Value::Object(p)) => p,
+            _ => fresh_property(),
+        };
+        if !matches!(arg.typ, Typ::OneOf(_)) {
+            prop.remove("oneOf");
+        }
+        apply_typ(&arg.typ, &mut prop);
+        // `T | T[]` marks an argument debouncing accumulates into.
+        if let Some(otyp) = arg
+            .otyp
+            .as_deref()
+            .filter(|o| o.contains('[') && o.contains('|'))
+        {
+            prop.insert("originalType".into(), json!(otyp));
+        }
+        match &arg.default {
+            Some(d) => prop.insert("default".into(), d.clone()),
+            None => prop.remove("default"),
+        };
+        if !arg.has_default {
+            required.push(json!(arg.name));
+        }
+        properties.insert(arg.name.clone(), Value::Object(prop));
+    }
+    schema.insert("properties".into(), Value::Object(properties));
+    schema.insert("required".into(), Value::Array(required));
+    if sig.has_cmd_binding == Some(true) {
+        schema.insert("x-windmill-ps-cmd-binding".into(), json!(true));
+        schema.insert(
+            "x-windmill-ps-supports-should-process".into(),
+            json!(sig.supports_should_process.unwrap_or(false)),
+        );
+    } else {
+        schema.remove("x-windmill-ps-cmd-binding");
+        schema.remove("x-windmill-ps-supports-should-process");
+    }
+    Value::Object(schema)
+}
+
+/// Keys a user sets on a property in the schema editor, kept whatever the code says.
+const USER_FIELDS: &[&str] = &[
+    "description",
+    "pattern",
+    "min",
+    "max",
+    "currency",
+    "currencyLocale",
+    "multiselect",
+    "customErrorMessage",
+    "required",
+    "showExpr",
+    "password",
+    "order",
+    "dateFormat",
+    "title",
+    "placeholder",
+];
+
+/// Item keys a list the parser cannot see into keeps from the previous schema.
+const ITEMS_USER_FIELDS: &[&str] = &[
+    "properties",
+    "required",
+    "additionalProperties",
+    "enum",
+    "resourceType",
+    "contentEncoding",
+    "description",
+];
+
+fn fresh_property() -> Map<String, Value> {
+    let mut p = Map::new();
+    p.insert("description".into(), json!(""));
+    p.insert("type".into(), json!(""));
+    p
+}
+
+fn object_properties(
+    props: &[ObjectProperty],
+    old: Option<&Map<String, Value>>,
+) -> Map<String, Value> {
+    props
+        .iter()
+        .map(|p| {
+            let mut prop = old
+                .and_then(|o| o.get(&p.key))
+                .and_then(Value::as_object)
+                .cloned()
+                .unwrap_or_else(fresh_property);
+            apply_typ(&p.typ, &mut prop);
+            (p.key.clone(), Value::Object(prop))
+        })
+        .collect()
+}
+
+fn kept_items(old: &Map<String, Value>) -> Value {
+    let old_items = old.get("items").and_then(Value::as_object);
+    let mut items = Map::new();
+    items.insert(
+        "type".into(),
+        old_items
+            .and_then(|i| i.get("type"))
+            .filter(|t| t.as_str().is_some_and(|t| !t.is_empty()))
+            .cloned()
+            .unwrap_or(json!("object")),
+    );
+    if let Some(old_items) = old_items {
+        for f in ITEMS_USER_FIELDS {
+            if let Some(v) = old_items.get(*f) {
+                items.insert(f.to_string(), v.clone());
+            }
+        }
+    }
+    Value::Object(items)
+}
+
+/// Port of `argSigToJsonSchemaType`: rewrites `old` in place to carry `typ`.
+fn apply_typ(typ: &Typ, old: &mut Map<String, Value>) {
+    let mut new = Map::new();
+    // Keys the editor sets to `undefined`, which drops them from the stored JSON.
+    let mut unset: Vec<&str> = vec![];
+    let mut set = |k: &str, v: Value| {
+        new.insert(k.to_string(), v);
+    };
+    match typ {
+        Typ::Int => set("type", json!("integer")),
+        Typ::Float => set("type", json!("number")),
+        Typ::Bool => set("type", json!("boolean")),
+        Typ::Email => {
+            set("type", json!("string"));
+            set("format", json!("email"));
+        }
+        Typ::Sql => {
+            set("type", json!("string"));
+            set("format", json!("sql"));
+        }
+        Typ::Bytes => {
+            set("type", json!("string"));
+            set("contentEncoding", json!("base64"));
+            set("originalType", json!("bytes"));
+        }
+        Typ::Datetime => {
+            set("type", json!("string"));
+            set("format", json!("date-time"));
+        }
+        Typ::Date => {
+            set("type", json!("string"));
+            set("format", json!("date"));
+        }
+        Typ::OneOf(variants) => {
+            set("type", json!("object"));
+            let old_variants = old.get("oneOf").and_then(Value::as_array);
+            let one_of: Vec<Value> = variants
+                .iter()
+                .map(|v| {
+                    let old_variant = old_variants
+                        .and_then(|o| o.iter().find(|o| o.get("title") == Some(&json!(v.label))))
+                        .and_then(Value::as_object);
+                    let old_props = old_variant
+                        .and_then(|o| o.get("properties"))
+                        .and_then(Value::as_object);
+                    let mut variant = json!({
+                        "type": "object",
+                        "title": v.label,
+                        "properties": object_properties(&v.properties, old_props),
+                    });
+                    if let Some(order) = old_variant.and_then(|o| o.get("order")) {
+                        variant["order"] = order.clone();
+                    }
+                    variant
+                })
+                .collect();
+            set("oneOf", Value::Array(one_of));
+        }
+        Typ::Object(o) => {
+            set("type", json!("object"));
+            if let Some(name) = &o.name {
+                set("format", json!(format!("resource-{name}")));
+            }
+            if let Some(props) = &o.props {
+                let old_props = old.get("properties").and_then(Value::as_object);
+                set(
+                    "properties",
+                    Value::Object(object_properties(props, old_props)),
+                );
+            }
+        }
+        Typ::Str(variants) => {
+            set("type", json!("string"));
+            match variants {
+                Some(v) => {
+                    set("originalType", json!("enum"));
+                    set("enum", json!(v));
+                }
+                None => {
+                    set("originalType", json!("string"));
+                    match old.get("enum") {
+                        Some(e) if old.get("originalType") == Some(&json!("string")) => {
+                            set("enum", e.clone())
+                        }
+                        _ => unset.push("enum"),
+                    }
+                }
+            }
+        }
+        Typ::Resource(name) => {
+            set("type", json!("object"));
+            set("format", json!(format!("resource-{name}")));
+        }
+        Typ::DynSelect(name) => {
+            set("type", json!("object"));
+            set("format", json!(format!("dynselect-{name}")));
+        }
+        Typ::DynMultiselect(name) => {
+            set("type", json!("object"));
+            set("format", json!(format!("dynmultiselect-{name}")));
+        }
+        Typ::List(inner) => {
+            set("type", json!("array"));
+            let (items, original_type) = match inner.as_ref() {
+                Typ::Int | Typ::Float => (json!({"type": "number"}), "number[]"),
+                Typ::Bytes => (
+                    json!({"type": "string", "contentEncoding": "base64"}),
+                    "bytes[]",
+                ),
+                Typ::Str(Some(v)) => (json!({"type": "string", "enum": v}), "enum[]"),
+                Typ::Str(None) => {
+                    let mut items = json!({"type": "string"});
+                    if let Some(e) = old.get("items").and_then(|i| i.get("enum")) {
+                        items["enum"] = e.clone();
+                    }
+                    (items, "string[]")
+                }
+                Typ::Resource(r) => (json!({"type": "resource", "resourceType": r}), "resource[]"),
+                Typ::Object(o) => {
+                    if let Some(name) = &o.name {
+                        set("format", json!(format!("resource-{name}")));
+                    }
+                    let items = match o.props.as_deref().filter(|p| !p.is_empty()) {
+                        Some(props) => json!({
+                            "type": "object",
+                            "properties": object_properties(props, None),
+                        }),
+                        None => kept_items(old),
+                    };
+                    (items, "record[]")
+                }
+                _ => (kept_items(old), "object[]"),
+            };
+            set("items", items);
+            set("originalType", json!(original_type));
+        }
+        // The parser cannot tell: whatever type the user gave the argument stands.
+        Typ::Unknown => set("type", old.get("type").cloned().unwrap_or(json!("object"))),
+    }
+
+    for f in USER_FIELDS {
+        if let Some(v) = old.get(*f) {
+            new.insert(f.to_string(), v.clone());
+        }
+    }
+
+    let old_type = old.get("type").cloned();
+    let new_type = new.get("type").cloned();
+    let old_format = old
+        .get("format")
+        .and_then(Value::as_str)
+        .map(str::to_string);
+    let new_format = new
+        .get("format")
+        .and_then(Value::as_str)
+        .map(str::to_string);
+    let is_date = |f: &Option<String>| matches!(f.as_deref(), Some("date" | "date-time"));
+    let mut keep_old_format = false;
+    // A changed type takes every key `new` sets, so none of the adjustments below
+    // apply: running them would carry the old type's date format or items over.
+    if old_type != new_type {
+    } else if new_format.as_deref() == Some("date-time") && old_format.as_deref() == Some("date") {
+        new.insert("format".into(), json!("date"));
+    } else if is_date(&new_format) {
+        keep_old_format = true;
+    } else if old.get("items").and_then(|i| i.get("type"))
+        != new.get("items").and_then(|i| i.get("type"))
+    {
+        old.remove("items");
+    } else if old_type == Some(json!("string")) && old_format.is_some() {
+        keep_old_format = true;
+    }
+    if keep_old_format {
+        match old.get("format") {
+            Some(f) => {
+                new.insert("format".into(), f.clone());
+            }
+            None => {
+                new.remove("format");
+                unset.push("format");
+            }
+        }
+    }
+    if (old_type != new_type || new_type != Some(json!("string"))) && !new.contains_key("format") {
+        old.remove("format");
+    }
+
+    for k in unset {
+        if !new.contains_key(k) {
+            old.remove(k);
+        }
+    }
+    old.extend(new);
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::{Arg, ObjectType};
+
+    fn arg(name: &str, typ: Typ, default: Option<Value>) -> Arg {
+        Arg {
+            name: name.to_string(),
+            has_default: default.is_some(),
+            default,
+            typ,
+            ..Default::default()
+        }
+    }
+
+    #[test]
+    fn keeps_what_the_user_set_on_the_previous_version() {
+        let sig = MainArgSignature {
+            args: vec![
+                arg("n", Typ::Int, None),
+                arg("db", Typ::Resource("postgresql".into()), None),
+                arg(
+                    "tags",
+                    Typ::List(Box::new(Typ::Str(None))),
+                    Some(json!(["a"])),
+                ),
+                arg(
+                    "opts",
+                    Typ::Object(ObjectType::new(None, None)),
+                    Some(json!({})),
+                ),
+                arg("any", Typ::Unknown, None),
+            ],
+            ..Default::default()
+        };
+        let previous = json!({
+            "type": "object",
+            "order": ["db", "n"],
+            "properties": {
+                "n": {"type": "integer", "description": "how many", "min": 1, "nullable": true},
+                "tags": {"type": "array", "items": {"type": "string", "enum": ["a", "b"]}},
+                "gone": {"type": "string"},
+            },
+        });
+        let schema = main_arg_schema(&sig, Some(&previous));
+        assert_eq!(schema["order"], json!(["db", "n"]));
+        assert_eq!(schema["required"], json!(["n", "db", "any"]));
+        assert_eq!(
+            schema["properties"]["n"],
+            json!({"type": "integer", "description": "how many", "min": 1, "nullable": true})
+        );
+        assert!(schema["properties"].get("gone").is_none());
+        assert_eq!(schema["properties"]["db"]["format"], "resource-postgresql");
+        assert_eq!(
+            schema["properties"]["tags"]["items"],
+            json!({"type": "string", "enum": ["a", "b"]})
+        );
+        assert_eq!(schema["properties"]["tags"]["default"], json!(["a"]));
+        assert_eq!(schema["properties"]["opts"]["type"], "object");
+        // Untyped in the code and new: any JSON value, as the editor stores it.
+        assert_eq!(schema["properties"]["any"]["type"], "");
+    }
+}
diff --git a/backend/parsers/windmill-parser/src/lib.rs b/backend/parsers/windmill-parser/src/lib.rs
index 4270edcc79..7ca226b432 100644
--- a/backend/parsers/windmill-parser/src/lib.rs
+++ b/backend/parsers/windmill-parser/src/lib.rs
@@ -15,6 +15,7 @@ use serde_json::Value;
 pub mod asset_parser;
 pub mod duckdb_builtins;
 pub mod duckdb_macros;
+pub mod json_schema;
 pub mod sql_materialize;
 
 /// S3 output format for SQL queries (moved here to avoid pulling sqlx into WASM via windmill-types)
diff --git a/backend/src/main.rs b/backend/src/main.rs
index 316ed099f2..9e7a93cfcd 100644
--- a/backend/src/main.rs
+++ b/backend/src/main.rs
@@ -52,7 +52,8 @@ use windmill_common::{
         INSTANCE_EVENTS_WEBHOOK_SETTING, INSTANCE_PYTHON_VERSION_SETTING,
         JOB_DEFAULT_TIMEOUT_SECS_SETTING, JOB_ISOLATION_SETTING, JWT_SECRET_SETTING,
         KEEP_JOB_DIR_SETTING, LICENSE_KEY_SETTING, MAVEN_REPOS_SETTING, MAVEN_SETTINGS_XML_SETTING,
-        MONITOR_LOGS_ON_OBJECT_STORE_SETTING, NO_DEFAULT_MAVEN_SETTING,
+        MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING, MONITOR_LOGS_ON_OBJECT_STORE_SETTING,
+        NO_DEFAULT_MAVEN_SETTING,
         NPM_CONFIG_REGISTRY_SETTING, NSJAIL_TMPFS_SIZE_MB_SETTING, NSJAIL_TMP_BACKING_SETTING,
         NUGET_CONFIG_SETTING, OAUTH_SETTING, OTEL_SETTING, OTEL_TRACES_RETENTION_SECS_SETTING,
         OTEL_TRACING_PROXY_SETTING, PIP_INDEX_URL_SETTING, POWERSHELL_REPO_PAT_SETTING,
@@ -126,7 +127,8 @@ use windmill_worker::{
 
 use crate::monitor::{
     initial_load, load_concurrency_key_max_queued, load_disable_password_login,
-    load_fork_workspace_tag_append_fork_suffix, load_keep_job_dir, load_metrics_debug_enabled,
+    load_fork_workspace_tag_append_fork_suffix, load_keep_job_dir,
+    load_mcp_disable_token_query_param, load_metrics_debug_enabled,
     load_preview_tags_override, load_require_preexisting_user, load_retention_period_overrides,
     load_tag_per_workspace_enabled, load_tag_per_workspace_workspaces,
     load_workspace_fairness_duration_secs, load_workspace_fairness_enabled,
@@ -2164,6 +2166,9 @@ async fn process_notify_event(
                 DISABLE_PASSWORD_LOGIN_SETTING => {
                     load_disable_password_login(db).await;
                 }
+                MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING => {
+                    load_mcp_disable_token_query_param(db).await;
+                }
                 EXPOSE_METRICS_SETTING => {
                     tracing::info!("Metrics setting changed, restarting");
                     spawn_graceful_killpill(tx, db, 30, "metrics setting change", server_mode)
diff --git a/backend/src/monitor.rs b/backend/src/monitor.rs
index e250302209..7e4dbb820a 100644
--- a/backend/src/monitor.rs
+++ b/backend/src/monitor.rs
@@ -45,7 +45,10 @@ use windmill_common::otel_oss::{
 use windmill_common::{
     agent_workers::DECODED_AGENT_TOKEN,
     apps::APP_WORKSPACED_ROUTE,
-    auth::{create_token_for_owner, ephemeral_script_token_label, job_token_expiry_secs},
+    auth::{
+        create_token_for_owner, ephemeral_script_token_label, job_token_expiry_secs,
+        TOKEN_EXPIRY_WARNING_DAYS,
+    },
     ee_oss::CriticalErrorChannel,
     email_oss::send_email_if_possible,
     error,
@@ -62,6 +65,7 @@ use windmill_common::{
         FORK_WORKSPACE_TAG_APPEND_FORK_SUFFIX_SETTING, HUB_API_SECRET_SETTING,
         HUB_BASE_URL_SETTING, INSTANCE_PYTHON_VERSION_SETTING, JOB_DEFAULT_TIMEOUT_SECS_SETTING,
         JOB_ISOLATION_SETTING, JWT_SECRET_SETTING, KEEP_JOB_DIR_SETTING, LICENSE_KEY_SETTING,
+        MCP_DISABLE_TOKEN_QUERY_PARAM, MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING,
         MONITOR_LOGS_ON_OBJECT_STORE_SETTING, NPMRC_SETTING, NPM_CONFIG_REGISTRY_SETTING,
         NSJAIL_TMPFS_SIZE_MB_SETTING, NSJAIL_TMP_BACKING_SETTING, NUGET_CONFIG_SETTING,
         OTEL_SETTING, OTEL_TRACES_RETENTION_SECS_SETTING, OTEL_TRACING_PROXY_SETTING,
@@ -285,6 +289,15 @@ pub async fn initial_load(
     );
 
     if let Some(db) = conn.as_sql() {
+        // Outside the `server_mode` block below: a `MODE=mcp` process serves the MCP routes
+        // with `server_mode` false and would otherwise never read this at all. That mode
+        // joins no monitor loop, so there — as for every global setting, `base_url`
+        // included — this pass is the only read, and a change lands on restart.
+        pass.setting(
+            MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING,
+            false,
+            |v| async move { apply_mcp_disable_token_query_param(v) },
+        );
         pass.setting(DEFAULT_TAGS_PER_WORKSPACE_SETTING, false, |v| async move {
             apply_tag_per_workspace_enabled(v)
         });
@@ -1614,6 +1627,23 @@ pub fn apply_disable_password_login(value: Option<serde_json::Value>) {
     };
 }
 
+pub async fn load_mcp_disable_token_query_param(db: &DB) {
+    match load_value_from_global_settings(db, MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING).await {
+        Ok(v) => apply_mcp_disable_token_query_param(v),
+        Err(e) => tracing::error!("Error loading mcp_disable_token_query_param setting: {e:#}"),
+    };
+}
+
+pub fn apply_mcp_disable_token_query_param(value: Option<serde_json::Value>) {
+    match value {
+        Some(serde_json::Value::Bool(t)) => {
+            MCP_DISABLE_TOKEN_QUERY_PARAM.store(t, Ordering::Relaxed)
+        }
+        None => MCP_DISABLE_TOKEN_QUERY_PARAM.store(false, Ordering::Relaxed),
+        _ => (),
+    };
+}
+
 struct LogFile {
     file_path: String,
     hostname: String,
@@ -1923,20 +1953,6 @@ pub async fn delete_expired_items(db: &DB) -> () {
         tracing::error!("Error deleting expired shared AI artifacts: {:?}", e);
     }
 
-    let audit_retention_days = audit_log_retention_days().await;
-    let audit_retention_secs: i64 = audit_retention_days * 60 * 60 * 24;
-
-    // Clean up old (non-partitioned) audit table — will eventually be empty and dropped
-    if let Err(e) = sqlx::query_scalar!(
-        "DELETE FROM audit WHERE timestamp <= now() - ($1::bigint::text || ' s')::interval",
-        audit_retention_secs,
-    )
-    .fetch_all(db)
-    .await
-    {
-        tracing::error!("Error deleting audit log: {:?}", e);
-    }
-
     if let Err(e) = sqlx::query_scalar!(
         "DELETE FROM autoscaling_event WHERE applied_at <= now() - ($1::bigint::text || ' s')::interval",
         30 * 24 * 60 * 60, // 30 days
@@ -2198,7 +2214,7 @@ async fn cleanup_scheduled_job_deletions(db: &Pool<Postgres>) {
 }
 
 pub async fn check_expiring_tokens(db: &DB) {
-    // Find tokens expiring within 7 days that still have a pending notification row.
+    // Find tokens expiring within the warning window that still have a pending notification row.
     // The notification table stores token_hash (not plaintext) so the join works
     // even after the hash migration makes token.token nullable.
     let expiring_tokens_r = sqlx::query_as!(
@@ -2207,8 +2223,9 @@ pub async fn check_expiring_tokens(db: &DB) {
          USING token t
          WHERE n.token_hash = t.token_hash
            AND n.expiration > now()
-           AND n.expiration <= now() + interval '7 days'
+           AND n.expiration <= now() + make_interval(days => $1)
          RETURNING t.token_prefix, t.label, t.email, t.workspace_id",
+        TOKEN_EXPIRY_WARNING_DAYS,
     )
     .fetch_all(db)
     .await;
diff --git a/backend/summarized_schema.txt b/backend/summarized_schema.txt
index e27cb2893c..169eb81681 100644
--- a/backend/summarized_schema.txt
+++ b/backend/summarized_schema.txt
@@ -56,7 +56,7 @@ app_version_lite: id(bigint), value(jsonb)
   FK: (id) -> app_version(id)
 asset: workspace_id(char), path(char), kind(asset_kind), usage_access_type(asset_access_type), usage_path(char), usage_kind(asset_usage_kind), created_at(ts), id(bigint), columns(jsonb)
   FK: (workspace_id) -> workspace(id)
-audit: workspace_id(char), id(bigint), timestamp(ts), username(char), operation(char), action_kind(action_kind), resource(char), parameters(jsonb), email(char), span(char)
+audit_partitioned: workspace_id(char), id(bigint), timestamp(ts), username(char), operation(char), action_kind(action_kind), resource(char), parameters(jsonb), email(char), span(char)
 autoscaling_event: id(int), worker_group(text), event_type(autoscaling_event_type), desired_workers(int), applied_at(ts), reason(text)
 capture: workspace_id(char), path(char), created_at(ts), created_by(char), main_args(jsonb), is_flow(bool), trigger_kind(trigger_kind), preprocessor_args(jsonb), id(bigint)
   FK: (workspace_id) -> workspace(id)
@@ -171,6 +171,9 @@ postgres_trigger: path(char), script_path(char), is_flow(bool), workspace_id(cha
   FK: (workspace_id) -> workspace(id)
 raw_app: path(char), version(int), workspace_id(char), summary(char), edited_at(ts), data(text), extra_perms(jsonb), labels(text[])
   FK: (workspace_id) -> workspace(id)
+remote_deploy_token: workspace_id(char), email(char), base_url(char), remote_workspace_id(char), token(text), remote_email(char), proxy_key(char), connected_at(timestamptz), member_since(timestamptz), target_changed_at(timestamptz)
+  FK: (email) -> password(email)
+  FK: (workspace_id) -> workspace(id)
 resource: workspace_id(char), path(char), value(jsonb), description(text), resource_type(char), extra_perms(jsonb), edited_at(ts), created_by(char), labels(text[])
   FK: (workspace_id) -> workspace(id)
 resource_type: workspace_id(char), name(char), schema(jsonb), description(text), edited_at(ts), created_by(char), format_extension(char), is_fileset(bool), display_name(char)
@@ -234,7 +237,7 @@ workspace_protection_rule: workspace_id(char), name(char), rules(int), bypass_gr
   FK: (workspace_id) -> workspace(id)
 workspace_runnable_dependencies: flow_path(char), runnable_path(char), script_hash(bigint), runnable_is_flow(bool), workspace_id(char), app_path(char), id(bigint), runnable_is_agent(bool)
   FK: (app_path, workspace_id) -> app(path, workspace_id) | (flow_path, workspace_id) -> flow(path, workspace_id)
-workspace_settings: workspace_id(char), slack_team_id(char), slack_name(char), slack_command_script(char), slack_email(char), customer_id(char), plan(char), webhook(text), ai_config(jsonb), large_file_storage(jsonb), git_sync(jsonb), default_app(char), default_scripts(jsonb), deploy_ui(jsonb), mute_critical_alerts(bool), color(char), operator_settings(jsonb), teams_command_script(text), teams_team_id(text), teams_team_name(text), git_app_installations(jsonb), ducklake(jsonb), slack_oauth_client_id(char), slack_oauth_client_secret(char), datatable(jsonb), teams_team_guid(text), auto_invite(jsonb), error_handler(jsonb), success_handler(jsonb), public_app_execution_limit_per_minute(int), dbt_warehouses(jsonb), guest_access_enabled(bool), guest_jwt_public_key(text), guest_jwt_jwks_url(text), ai_sessions_backup_generation(int)
+workspace_settings: workspace_id(char), slack_team_id(char), slack_name(char), slack_command_script(char), slack_email(char), customer_id(char), plan(char), webhook(text), ai_config(jsonb), large_file_storage(jsonb), git_sync(jsonb), default_app(char), default_scripts(jsonb), deploy_ui(jsonb), mute_critical_alerts(bool), color(char), operator_settings(jsonb), teams_command_script(text), teams_team_id(text), teams_team_name(text), git_app_installations(jsonb), ducklake(jsonb), slack_oauth_client_id(char), slack_oauth_client_secret(char), datatable(jsonb), teams_team_guid(text), auto_invite(jsonb), error_handler(jsonb), success_handler(jsonb), public_app_execution_limit_per_minute(int), dbt_warehouses(jsonb), guest_access_enabled(bool), guest_jwt_public_key(text), guest_jwt_jwks_url(text), ai_sessions_backup_generation(int), add_admins_and_developers_to_forks(bool), remote_deploy_target(jsonb), remote_deploy_target_changed_at(ts)
   FK: (workspace_id) -> workspace(id)
 zombie_job_counter: job_id(uuid), counter(int)
   FK: (job_id) -> v2_job(id)
diff --git a/backend/tests/app_guest_execution_mode.rs b/backend/tests/app_guest_execution_mode.rs
index 7af2e0794e..105458847a 100644
--- a/backend/tests/app_guest_execution_mode.rs
+++ b/backend/tests/app_guest_execution_mode.rs
@@ -577,24 +577,13 @@ async fn guests_mode_needs_a_scopable_path(db: Pool<Postgres>) -> anyhow::Result
     .send()
     .await?;
     assert_eq!(resp.status(), 400, "renamed to a `,` path while in Guests");
-    let resp = authed(
-        client().post(format!("{ws}/apps/update/{APP_PATH}")),
-        ADMIN_TOKEN,
-    )
-    .json(&json!({ "path": "u/test-user/My App" }))
-    .send()
-    .await?;
-    assert_eq!(
-        resp.status(),
-        200,
-        "a space is literal: {}",
-        resp.text().await?
-    );
 
-    // Set on update: an app that already sits on such a path cannot be switched.
+    // Set on update: an app that already sits on such a path cannot be switched. Path
+    // validation now refuses these paths on every write, so plant the kind of app saved
+    // before it did.
     let resp = authed(client().post(format!("{ws}/apps/create")), ADMIN_TOKEN)
         .json(&json!({
-            "path": "u/test-user/x:y",
+            "path": "u/test-user/legacy",
             "summary": "App",
             "value": {},
             "policy": { "execution_mode": "publisher", "triggerables_v2": {} }
@@ -602,6 +591,12 @@ async fn guests_mode_needs_a_scopable_path(db: Pool<Postgres>) -> anyhow::Result
         .send()
         .await?;
     assert_eq!(resp.status(), 201, "{}", resp.text().await?);
+    sqlx::query(
+        "UPDATE app SET path = 'u/test-user/x:y'
+         WHERE workspace_id = 'test-workspace' AND path = 'u/test-user/legacy'",
+    )
+    .execute(&db)
+    .await?;
     let resp = authed(
         client().post(format!("{ws}/apps/update/u/test-user/x:y")),
         ADMIN_TOKEN,
@@ -610,6 +605,8 @@ async fn guests_mode_needs_a_scopable_path(db: Pool<Postgres>) -> anyhow::Result
     .send()
     .await?;
     assert_eq!(resp.status(), 400, "switched to Guests on a `:` path");
+    let body = resp.text().await?;
+    assert!(body.contains("cannot be set to Guests"), "{body}");
 
     Ok(())
 }
diff --git a/backend/tests/app_version_order.rs b/backend/tests/app_version_order.rs
new file mode 100644
index 0000000000..e3557ad55c
--- /dev/null
+++ b/backend/tests/app_version_order.rs
@@ -0,0 +1,193 @@
+//! The deployed order of an app's versions is the order they were appended to
+//! `app.versions`, not the order of their `created_at`.
+//!
+//! `app_version.created_at` defaults to `now()`, which in Postgres is the
+//! transaction's start time, while the append happens under the app row's lock.
+//! Two deploys that overlap therefore land in one order and carry timestamps in
+//! the other. The head the editor guards against, and the sequence the diff
+//! picker numbers, both have to follow the array.
+//!
+//! Users from the `base` fixture: test-user (admin, token SECRET_TOKEN).
+
+use serde_json::json;
+use sqlx::{Pool, Postgres};
+use windmill_test_utils::*;
+
+const TOKEN: &str = "SECRET_TOKEN";
+
+#[sqlx::test(fixtures("base"))]
+async fn test_app_head_follows_the_append_order_not_the_timestamps(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let ws = format!(
+        "http://localhost:{}/api/w/test-workspace",
+        server.addr.port()
+    );
+    let client = reqwest::Client::new();
+
+    let res = client
+        .post(format!("{ws}/apps/create"))
+        .header("Authorization", format!("Bearer {TOKEN}"))
+        .json(&json!({
+            "path": "u/test-user/order_app",
+            "summary": "ordered",
+            "value": {},
+            "policy": { "execution_mode": "publisher", "triggerables": {} }
+        }))
+        .send()
+        .await?;
+    assert!(res.status().is_success(), "{}", res.text().await?);
+
+    let first: i64 = sqlx::query_scalar(
+        "SELECT versions[array_upper(versions, 1)] FROM app
+         WHERE workspace_id = 'test-workspace' AND path = 'u/test-user/order_app'",
+    )
+    .fetch_one(&db)
+    .await?;
+
+    // The overlapping deploy: appended after `first`, so it is the version that
+    // landed, but stamped before it, so a timestamp sort puts it underneath.
+    let second: i64 = sqlx::query_scalar(
+        "INSERT INTO app_version (app_id, value, created_by, created_at, raw_app)
+         SELECT app_id, value, 'racer', created_at - interval '1 hour', raw_app
+         FROM app_version WHERE id = $1
+         RETURNING id",
+    )
+    .bind(first)
+    .fetch_one(&db)
+    .await?;
+    sqlx::query(
+        "UPDATE app SET versions = array_append(versions, $1::bigint)
+         WHERE workspace_id = 'test-workspace' AND path = 'u/test-user/order_app'",
+    )
+    .bind(second)
+    .execute(&db)
+    .await?;
+
+    let head: serde_json::Value = client
+        .get(format!(
+            "{ws}/apps/get_latest_version/u/test-user/order_app"
+        ))
+        .header("Authorization", format!("Bearer {TOKEN}"))
+        .send()
+        .await?
+        .json()
+        .await?;
+    assert_eq!(
+        head["version"], second,
+        "the head is the version appended last, not the newest timestamp: {head}"
+    );
+
+    let history: Vec<serde_json::Value> = client
+        .get(format!("{ws}/apps/history/p/u/test-user/order_app"))
+        .header("Authorization", format!("Bearer {TOKEN}"))
+        .send()
+        .await?
+        .json()
+        .await?;
+    let listed: Vec<i64> = history
+        .iter()
+        .map(|v| v["version"].as_i64().unwrap())
+        .collect();
+    assert_eq!(
+        listed,
+        vec![second, first],
+        "the history lists in deployed order, so it leads with the head"
+    );
+
+    // Enough versions that a page cannot hold them, so "asked for nothing" and "asked for
+    // a page" are visibly different answers.
+    let mut appended = vec![second, first];
+    for _ in 0..24 {
+        let extra: i64 = sqlx::query_scalar(
+            "INSERT INTO app_version (app_id, value, created_by, created_at, raw_app)
+             SELECT app_id, value, 'bulk', created_at, raw_app FROM app_version WHERE id = $1
+             RETURNING id",
+        )
+        .bind(first)
+        .fetch_one(&db)
+        .await?;
+        sqlx::query(
+            "UPDATE app SET versions = array_append(versions, $1::bigint)
+             WHERE workspace_id = 'test-workspace' AND path = 'u/test-user/order_app'",
+        )
+        .bind(extra)
+        .execute(&db)
+        .await?;
+        appended.insert(0, extra);
+    }
+
+    let versions_at = |query: &str| {
+        let url = format!("{ws}/apps/history/p/u/test-user/order_app{query}");
+        let client = client.clone();
+        async move {
+            let rows: Vec<serde_json::Value> = client
+                .get(url)
+                .header("Authorization", format!("Bearer {TOKEN}"))
+                .send()
+                .await?
+                .json()
+                .await?;
+            Ok::<_, anyhow::Error>(
+                rows.iter()
+                    .map(|v| v["version"].as_i64().unwrap())
+                    .collect::<Vec<_>>(),
+            )
+        }
+    };
+
+    // The deployment-history panel and the CLI read this endpoint without paging, so
+    // asking for no page has to keep answering with the whole history.
+    assert_eq!(
+        versions_at("").await?,
+        appended,
+        "an unpaginated request still answers whole"
+    );
+    assert_eq!(
+        versions_at("?per_page=10").await?,
+        appended[..10],
+        "a page holds what was asked for, newest first"
+    );
+    assert_eq!(
+        versions_at("?per_page=10&page=2").await?,
+        appended[10..20],
+        "the next page carries on where the first left off, skipping nothing"
+    );
+    // A page past the end runs off it rather than overflowing into one. (The clamp on an
+    // asked-for size is pinned where it lives, in `paginate_optional`'s own test.)
+    assert!(
+        versions_at("?per_page=10&page=99999999")
+            .await?
+            .is_empty(),
+        "a page past the end is empty"
+    );
+    // Naming only the page still asks for a page, rather than an offset into a listing
+    // sized to hold everything — which would answer nothing at all.
+    assert_eq!(
+        versions_at("?page=1").await?,
+        appended,
+        "a first page with no size named holds the history"
+    );
+
+    // A version that never entered the deployed sequence — one a restore or a fork copy
+    // could leave behind — still has to be reachable, after the ones that did.
+    let stray: i64 = sqlx::query_scalar(
+        "INSERT INTO app_version (app_id, value, created_by, created_at, raw_app)
+         SELECT app_id, value, 'stray', created_at, raw_app FROM app_version WHERE id = $1
+         RETURNING id",
+    )
+    .bind(first)
+    .fetch_one(&db)
+    .await?;
+    let mut with_stray = appended.clone();
+    with_stray.push(stray);
+    assert_eq!(
+        versions_at("").await?,
+        with_stray,
+        "a version outside app.versions is listed, and after the deployed sequence"
+    );
+
+    Ok(())
+}
diff --git a/backend/tests/bun_jobs.rs b/backend/tests/bun_jobs.rs
index 63d5341ba3..14f8c422a4 100644
--- a/backend/tests/bun_jobs.rs
+++ b/backend/tests/bun_jobs.rs
@@ -1303,6 +1303,62 @@ async fn test_bun_wac_inline_task_cache_is_per_task(db: Pool<Postgres>) -> anyho
     Ok(())
 }
 
+/// A task that picks its own worker tag is held to CUSTOM_TAGS like a flow step: with none
+/// set, only a superadmin may send it to `gpu`, so the workflow fails instead of queueing it.
+#[sqlx::test(fixtures("base"))]
+async fn test_bun_wac_task_tag_outside_custom_tags(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let content = r#"
+import { workflow, task } from "windmill-client";
+
+const onGpu = task(async (n: number) => {
+  return n * 2;
+}, { tag: "gpu" });
+
+export const main = workflow(async (n: number) => {
+  return await onGpu(n);
+});
+"#
+    .to_owned();
+
+    let job = RunJob::from(JobPayload::Code(RawCode {
+        hash: None,
+        content,
+        path: None,
+        language: ScriptLang::Bun,
+        lock: None,
+        concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default()
+            .into(),
+        debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
+        cache_ttl: None,
+        cache_ignore_s3_path: None,
+        dedicated_worker: None,
+        modules: None,
+        tag: None,
+    }))
+    .arg("n", serde_json::json!(5))
+    .as_user("test-user-2", "test2@windmill.dev")
+    .run_until_complete(&db, false, port)
+    .await;
+
+    assert!(!job.success, "the workflow must fail");
+    let result = job.json_result().unwrap();
+    let message = result["error"]["message"].as_str().unwrap_or_default();
+    assert!(
+        message.contains("task 'onGpu' cannot run on tag 'gpu'"),
+        "unexpected error: {result}"
+    );
+    let children: i64 = sqlx::query_scalar("SELECT count(*) FROM v2_job WHERE parent_job = $1")
+        .bind(job.id)
+        .fetch_one(&db)
+        .await?;
+    assert_eq!(children, 0, "no child is queued on the refused tag");
+    Ok(())
+}
+
 // ============================================================================
 // Environment Variable Tests
 // ============================================================================
diff --git a/backend/tests/datatable_migration_add_down.rs b/backend/tests/datatable_migration_add_down.rs
index 3cd39e0fa3..47ea4c253b 100644
--- a/backend/tests/datatable_migration_add_down.rs
+++ b/backend/tests/datatable_migration_add_down.rs
@@ -142,3 +142,35 @@ async fn test_add_down_to_an_applied_migration(db: Pool<Postgres>) -> anyhow::Re
 
     Ok(())
 }
+
+/// A definition saved before `-- role` annotations were parsed can open with a comment that now
+/// reads as a malformed one. It never gets through a role check again, so an admin must still be
+/// able to finish it rather than be refused on its annotation.
+#[sqlx::test(fixtures("datatable_migrations_grants"))]
+async fn test_add_down_to_a_migration_whose_comment_predates_role_annotations(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    setup_applied_migration_without_down(&db).await?;
+    let code_up = format!("-- Role table for widgets\n{CODE_UP}");
+    sqlx::query("UPDATE datatable_migrations SET code_up = $1 WHERE workspace_id = 'dtmig-ws'")
+        .bind(&code_up)
+        .execute(&db)
+        .await?;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let resp = authed(reqwest::Client::new().post(format!(
+        "http://localhost:{}/api/w/dtmig-ws/workspaces/upsert_datatable_migration/main",
+        server.addr.port()
+    )))
+    .json(&json!({
+        "timestamp": VERSION,
+        "name": "create_widgets",
+        "code_up": code_up,
+        "code_down": CODE_DOWN,
+    }))
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 200, "{}", resp.text().await?);
+    Ok(())
+}
diff --git a/backend/tests/dependency_map.rs b/backend/tests/dependency_map.rs
index 4520cae848..f4b74525fb 100644
--- a/backend/tests/dependency_map.rs
+++ b/backend/tests/dependency_map.rs
@@ -521,10 +521,8 @@ def main():
             .await
             .unwrap();
 
-        assert_eq!(
-            res.text().await.unwrap(),
-            "app f/rel/root_app updated (npath: \"f/rel/root_app_renamed\")"
-        );
+        let deployed: serde_json::Value = res.json().await.unwrap();
+        assert_eq!(deployed["path"], "f/rel/root_app_renamed", "{deployed}");
 
         let mut completed = listen_for_completed_jobs(&db).await;
         in_test_worker(&db, completed.next(), port).await;
diff --git a/backend/tests/drafts_move_mirror.rs b/backend/tests/drafts_move_mirror.rs
new file mode 100644
index 0000000000..d619381c46
--- /dev/null
+++ b/backend/tests/drafts_move_mirror.rs
@@ -0,0 +1,74 @@
+//! Moving a draft must carry both of its path keys.
+//!
+//! A draft value holds a typed path and a mirror the editors keep beside it while
+//! it differs from the row's path (`path`/`draft_path`; which is which depends on
+//! the kind). The loaders prefer the mirror, so a move that rewrote only the typed
+//! key left the mirror naming the old location: reopening the item restored the
+//! old path, and the next autosave wrote it back — undoing the move silently.
+//!
+//! This pins `move_draft`, including that a draft with no mirror never gains one.
+//! A deploy's carry follows the keys only where they still name the old path
+//! (`drafts_save_follows_move` pins that).
+
+use serde_json::Value;
+use sqlx::{Pool, Postgres};
+
+use windmill_test_utils::*;
+
+async fn move_to(port: u16, from: &str, to: &str) -> anyhow::Result<String> {
+    let resp = reqwest::Client::new()
+        .post(format!(
+            "http://localhost:{port}/api/w/test-workspace/drafts/move/script/{from}"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&serde_json::json!({ "new_path": to }))
+        .send()
+        .await?;
+    // Asserted here so a rejected move fails as itself, rather than as a JSON
+    // parse error in the read-back below.
+    let status = resp.status();
+    let body = resp.text().await?;
+    assert!(status.is_success(), "move {from} -> {to} failed: {body}");
+    Ok(body)
+}
+
+/// The stored draft value at `path`, read back through the API so this test needs
+/// no `sqlx::query!` (which would want an offline cache entry of its own).
+async fn value_at(port: u16, path: &str) -> anyhow::Result<Value> {
+    let body: Value = reqwest::Client::new()
+        .get(format!(
+            "http://localhost:{port}/api/w/test-workspace/drafts/get_own/script/{path}"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .send()
+        .await?
+        .json()
+        .await?;
+    Ok(body
+        .get("value")
+        .cloned()
+        .unwrap_or_else(|| panic!("no draft at {path}: {body}")))
+}
+
+#[sqlx::test(fixtures("base", "drafts_move_mirror"))]
+async fn test_move_carries_both_path_keys(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    move_to(port, "u/test-user/draft_mirror", "u/test-user/renamed").await?;
+    move_to(port, "u/test-user/draft_plain", "u/test-user/plain2").await?;
+
+    // The mirror follows: left at `u/test-user/friendly` it would win at load and
+    // walk the item back there.
+    let moved = value_at(port, "u/test-user/renamed").await?;
+    assert_eq!(moved["path"], "u/test-user/renamed");
+    assert_eq!(moved["draft_path"], "u/test-user/renamed");
+
+    // A draft that never had a mirror must not be given one.
+    let plain = value_at(port, "u/test-user/plain2").await?;
+    assert_eq!(plain["path"], "u/test-user/plain2");
+    assert_eq!(plain.get("draft_path"), None, "mirror injected: {plain}");
+
+    Ok(())
+}
diff --git a/backend/tests/drafts_move_taken.rs b/backend/tests/drafts_move_taken.rs
new file mode 100644
index 0000000000..40318ca2ef
--- /dev/null
+++ b/backend/tests/drafts_move_taken.rs
@@ -0,0 +1,250 @@
+//! A rename onto a path that already holds a draft is refused.
+//!
+//! Nothing deployed can sit at a rename's destination (the deploy conflicts on
+//! that), but a draft can: a never-deployed item, or a draft left on an archived
+//! script. Moving onto it would merge two items or strand a row, so the rename
+//! itself fails, in its own transaction, and the source stays deployed. The
+//! destination draft here is the deployer's own, which is the same collision.
+
+use serde_json::{json, Value};
+use sqlx::{Pool, Postgres};
+
+use windmill_test_utils::*;
+
+/// Hex form of script hash 7010, the way the API takes a parent hash.
+const HEAD_HASH: &str = "0000000000001b62";
+
+#[sqlx::test(fixtures("base", "drafts_move_taken"))]
+async fn test_rename_onto_a_draft_is_refused(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let client = reqwest::Client::new();
+
+    let resp = client
+        .post(format!(
+            "http://localhost:{port}/api/w/test-workspace/scripts/create"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({
+            "path": "u/test-user/mvtaken_b",
+            "parent_hash": HEAD_HASH,
+            "summary": "A",
+            "description": "",
+            "content": "export function main() { return 1 }",
+            "language": "deno",
+            "schema": {}
+        }))
+        .send()
+        .await?;
+    let status = resp.status();
+    let body = resp.text().await?;
+    assert_eq!(status, 400, "rename onto a draft was not refused: {body}");
+    assert!(
+        body.contains("already has a draft"),
+        "unexpected refusal: {body}"
+    );
+
+    // The whole deploy rolled back: the source is still the live head, and the
+    // draft at the destination is untouched.
+    let head: Value = client
+        .get(format!(
+            "http://localhost:{port}/api/w/test-workspace/scripts/get/p/u/test-user/mvtaken_a"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .send()
+        .await?
+        .json()
+        .await?;
+    assert_eq!(head["hash"], HEAD_HASH, "source was replaced: {head}");
+    assert_eq!(head["archived"], false, "source was archived: {head}");
+
+    let draft: Value = client
+        .get(format!("http://localhost:{port}/api/w/test-workspace/drafts/get_own/script/u/test-user/mvtaken_b"))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .send()
+        .await?
+        .json()
+        .await?;
+    assert_eq!(
+        draft["value"]["summary"], "B",
+        "destination draft changed: {draft}"
+    );
+
+    Ok(())
+}
+
+/// A legacy (ownerless) draft occupies its path too: a deploy there deletes it together
+/// with the caller's own row, so a move that parks a second draft beside it would discard
+/// edits the caller never saw. Only an admin can clear it, so the refusal says so.
+#[sqlx::test(fixtures("base", "drafts_move_taken"))]
+async fn test_draft_move_refuses_a_legacy_destination(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let resp = reqwest::Client::new()
+        .post(format!(
+            "http://localhost:{port}/api/w/test-workspace/drafts/move/script/u/test-user/mvtaken_b"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({ "new_path": "u/test-user/mvtaken_legacy" }))
+        .send()
+        .await?;
+    let status = resp.status();
+    let body = resp.text().await?;
+    assert_eq!(status, 400, "move onto a legacy draft was allowed: {body}");
+    assert!(
+        body.contains("legacy workspace draft") && body.contains("workspace admin"),
+        "the refusal did not point at the one remedy: {body}"
+    );
+
+    // Both rows stayed where they were: the caller's own, and the legacy one the list
+    // synthesizes under the caller's name.
+    let list: Vec<Value> = reqwest::Client::new()
+        .get(format!(
+            "http://localhost:{port}/api/w/test-workspace/drafts/list"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .send()
+        .await?
+        .json()
+        .await?;
+    let mut at = list
+        .iter()
+        .filter_map(|d| Some((d["kind"].as_str()?, d["path"].as_str()?)))
+        .filter(|(_, p)| p.starts_with("u/test-user/mvtaken_b") || p.ends_with("mvtaken_legacy"))
+        .collect::<Vec<_>>();
+    at.sort();
+    assert_eq!(
+        at,
+        vec![
+            ("script", "u/test-user/mvtaken_b"),
+            ("script", "u/test-user/mvtaken_legacy")
+        ],
+        "{list:?}"
+    );
+    Ok(())
+}
+
+/// A classic app and a raw app deploy into the same table, so a draft-only move onto
+/// the other kind's draft must be refused: deploying either path afterwards deletes
+/// the caller's drafts of both kinds, taking the loser's item with it.
+#[sqlx::test(fixtures("base", "drafts_move_taken"))]
+async fn test_draft_move_refuses_the_other_app_kind(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let resp = reqwest::Client::new()
+        .post(format!(
+            "http://localhost:{port}/api/w/test-workspace/drafts/move/raw_app/u/test-user/mvtaken_raw"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({ "new_path": "u/test-user/mvtaken_app" }))
+        .send()
+        .await?;
+    let status = resp.status();
+    let body = resp.text().await?;
+    assert_eq!(
+        status, 400,
+        "move onto a classic app draft was allowed: {body}"
+    );
+    assert!(
+        body.contains("already have a draft at 'u/test-user/mvtaken_app' (app)"),
+        "the refusal did not name the occupying kind: {body}"
+    );
+
+    // Both drafts are untouched.
+    let list: Vec<Value> = reqwest::Client::new()
+        .get(format!(
+            "http://localhost:{port}/api/w/test-workspace/drafts/list"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .send()
+        .await?
+        .json()
+        .await?;
+    let mut at = list
+        .iter()
+        .filter(|d| matches!(d["kind"].as_str(), Some("app") | Some("raw_app")))
+        .filter_map(|d| Some((d["kind"].as_str()?, d["path"].as_str()?)))
+        .collect::<Vec<_>>();
+    at.sort();
+    assert_eq!(
+        at,
+        vec![
+            ("app", "u/test-user/mvtaken_app"),
+            ("raw_app", "u/test-user/mvtaken_raw")
+        ],
+        "{list:?}"
+    );
+    Ok(())
+}
+
+/// Teammates' drafts of one item share its path by design, so another user's row is no
+/// obstacle — except across the app pair, where the two kinds are different items on one
+/// deployed path: deploying either strands the other, and deleting the app takes both.
+#[sqlx::test(fixtures("base", "drafts_move_taken"))]
+async fn test_draft_move_refuses_another_users_other_app_kind(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let move_to = |kind: &'static str, from: &'static str, to: &'static str| async move {
+        let resp = reqwest::Client::new()
+            .post(format!(
+                "http://localhost:{port}/api/w/test-workspace/drafts/move/{kind}/{from}"
+            ))
+            .header("Authorization", "Bearer SECRET_TOKEN")
+            .json(&json!({ "new_path": to }))
+            .send()
+            .await?;
+        Ok::<_, anyhow::Error>((resp.status(), resp.text().await?))
+    };
+
+    let (status, body) = move_to(
+        "app",
+        "u/test-user/mvtaken_app",
+        "u/test-user/mvtaken_theirs",
+    )
+    .await?;
+    assert_eq!(
+        status, 400,
+        "a classic app was moved onto another user's raw app: {body}"
+    );
+    assert!(
+        body.contains("holds another user's raw app draft"),
+        "the refusal did not name the occupant: {body}"
+    );
+
+    // And the other direction, where the occupant reads as the classic kind.
+    let (status, body) = move_to(
+        "raw_app",
+        "u/test-user/mvtaken_raw",
+        "u/test-user/mvtaken_app_theirs",
+    )
+    .await?;
+    assert_eq!(
+        status, 400,
+        "a raw app was moved onto another user's classic app: {body}"
+    );
+    assert!(
+        body.contains("holds another user's app draft"),
+        "the refusal did not name the occupant: {body}"
+    );
+
+    // The same-kind case is the ordinary one: two users' drafts of one raw app.
+    let (status, body) = move_to(
+        "raw_app",
+        "u/test-user/mvtaken_raw",
+        "u/test-user/mvtaken_theirs",
+    )
+    .await?;
+    assert!(
+        status.is_success(),
+        "a raw app was refused beside another user's raw-app draft: {body}"
+    );
+    Ok(())
+}
diff --git a/backend/tests/drafts_nul.rs b/backend/tests/drafts_nul.rs
index d7314b8fb6..2a77fe772a 100644
--- a/backend/tests/drafts_nul.rs
+++ b/backend/tests/drafts_nul.rs
@@ -78,3 +78,46 @@ async fn test_draft_write_strips_nul(db: Pool<Postgres>) -> anyhow::Result<()> {
 
     Ok(())
 }
+
+/// The lineage the server derives for `draft.base` comes from the same value: read before
+/// the sanitizer, a NUL in it costs the draft its base, which then reads as up to date
+/// whatever the head is.
+#[sqlx::test(fixtures("drafts_nul"))]
+async fn test_draft_base_is_derived_from_sanitized_value(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/dnul-ws");
+
+    let resp = authed(client().post(format!(
+        "{base}/drafts/update/script/u/dnul-admin/poisoned_base"
+    )))
+    .json(&json!({
+        "value": {
+            "summary": "s",
+            "path": "u/dnul-admin/poisoned_base",
+            "content": "x",
+            "parent_hash": "0000000000001b62\u{0}"
+        }
+    }))
+    .send()
+    .await?;
+    assert_eq!(
+        resp.status(),
+        200,
+        "save refused: {}",
+        resp.text().await.unwrap_or_default()
+    );
+
+    let stored: Option<String> = sqlx::query_scalar(
+        "SELECT base FROM draft WHERE workspace_id = 'dnul-ws' AND path = 'u/dnul-admin/poisoned_base'",
+    )
+    .fetch_one(&db)
+    .await?;
+    assert_eq!(
+        stored.as_deref(),
+        Some("0000000000001b62"),
+        "the NUL cost the draft its base: {stored:?}"
+    );
+    Ok(())
+}
diff --git a/backend/tests/drafts_save_follows_move.rs b/backend/tests/drafts_save_follows_move.rs
new file mode 100644
index 0000000000..afbec56c75
--- /dev/null
+++ b/backend/tests/drafts_save_follows_move.rs
@@ -0,0 +1,587 @@
+//! A draft save addressed to a path its item moved away from lands on the moved draft.
+//!
+//! A move carries every draft on the item to the new path and records where they
+//! went. An editor left open across it still saves to the old path; the server puts
+//! the save on the moved draft, keeps the path keys the move gave it, and names the
+//! new path so the editor can follow. Without the record the save would plant a
+//! phantom draft-only item at the old location.
+
+use serde_json::{json, Value};
+use sqlx::{Pool, Postgres};
+
+use windmill_test_utils::*;
+
+/// Hex form of script hash 7030, the way the API takes a parent hash.
+const HEAD_HASH: &str = "0000000000001b76";
+
+async fn own_draft_value(port: u16, path: &str) -> anyhow::Result<Value> {
+    let draft: Value = reqwest::Client::new()
+        .get(format!(
+            "http://localhost:{port}/api/w/test-workspace/drafts/get_own/script/{path}"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .send()
+        .await?
+        .json()
+        .await?;
+    Ok(draft["value"].clone())
+}
+
+async fn own_draft_paths(port: u16) -> anyhow::Result<Vec<String>> {
+    let list: Vec<Value> = reqwest::Client::new()
+        .get(format!(
+            "http://localhost:{port}/api/w/test-workspace/drafts/list"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .send()
+        .await?
+        .json()
+        .await?;
+    Ok(list
+        .iter()
+        .filter(|d| d["kind"] == "script")
+        .filter_map(|d| d["path"].as_str().map(String::from))
+        .filter(|p| p.starts_with("u/test-user/follow_"))
+        .collect())
+}
+
+#[sqlx::test(fixtures("base", "drafts_save_follows_move"))]
+async fn test_save_follows_a_rename(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let client = reqwest::Client::new();
+
+    // Rename from Home: a redeploy of the deployed content at the new path that
+    // keeps the deployer's own draft, so the draft is carried rather than consumed.
+    let resp = client
+        .post(format!(
+            "http://localhost:{port}/api/w/test-workspace/scripts/create"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({
+            "path": "u/test-user/follow_b",
+            "parent_hash": HEAD_HASH,
+            "summary": "A",
+            "description": "",
+            "content": "export function main() { return 1 }",
+            "language": "deno",
+            "schema": {},
+            "skip_draft_deletion": true
+        }))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 201, "rename failed: {}", resp.text().await?);
+    assert_eq!(own_draft_paths(port).await?, vec!["u/test-user/follow_b"]);
+    // A script draft's `path` is where deploying it lands, so it moves with the row.
+    assert_eq!(
+        own_draft_value(port, "u/test-user/follow_b").await?["path"],
+        "u/test-user/follow_b"
+    );
+
+    // The editor is still on the old path and writes that path back into the value.
+    let saved: Value = client
+        .post(format!(
+            "http://localhost:{port}/api/w/test-workspace/drafts/update/script/u/test-user/follow_a"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({
+            "value": {
+                "path": "u/test-user/follow_a",
+                "parent_hash": HEAD_HASH,
+                "summary": "A",
+                "content": "edited after the move"
+            }
+        }))
+        .send()
+        .await?
+        .json()
+        .await?;
+    assert_eq!(saved["status"], "saved", "save refused: {saved}");
+    assert_eq!(
+        saved["path"], "u/test-user/follow_b",
+        "save did not follow the row: {saved}"
+    );
+
+    // The write landed on the carried row; nothing reappeared at the old path.
+    assert_eq!(own_draft_paths(port).await?, vec!["u/test-user/follow_b"]);
+    let draft = own_draft_value(port, "u/test-user/follow_b").await?;
+    assert_eq!(draft["content"], "edited after the move", "{draft}");
+    assert_eq!(draft["path"], "u/test-user/follow_b", "{draft}");
+
+    Ok(())
+}
+
+/// A draft-only move rewrites both path keys. The owner's open editor still carries
+/// the typed path it had, which names neither the old nor the new path; the moved
+/// draft's own keys have to win, or the save walks the item back.
+#[sqlx::test(fixtures("base", "drafts_save_follows_move"))]
+async fn test_save_follows_a_draft_only_move(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let client = reqwest::Client::new();
+
+    let resp = client
+        .post(format!(
+            "http://localhost:{port}/api/w/test-workspace/drafts/move/script/u/test-user/draft_store"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({ "new_path": "u/test-user/moved" }))
+        .send()
+        .await?;
+    assert!(
+        resp.status().is_success(),
+        "move failed: {}",
+        resp.text().await?
+    );
+
+    let saved: Value = client
+        .post(format!(
+            "http://localhost:{port}/api/w/test-workspace/drafts/update/script/u/test-user/draft_store"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({
+            "value": {
+                "path": "u/test-user/friendly",
+                "draft_path": "u/test-user/friendly",
+                "summary": "D",
+                "content": "edited after the move"
+            }
+        }))
+        .send()
+        .await?
+        .json()
+        .await?;
+    assert_eq!(saved["path"], "u/test-user/moved", "{saved}");
+
+    let draft = own_draft_value(port, "u/test-user/moved").await?;
+    assert_eq!(draft["content"], "edited after the move", "{draft}");
+    assert_eq!(draft["path"], "u/test-user/moved", "{draft}");
+    assert_eq!(draft["draft_path"], "u/test-user/moved", "{draft}");
+    Ok(())
+}
+
+/// Rename `from` to `to` the way Home does: redeploy the deployed content at the new
+/// path, keeping the deployer's own draft so it is carried rather than consumed.
+/// Returns the new head's hash.
+async fn rename(port: u16, from_hash: &str, to: &str) -> anyhow::Result<String> {
+    let resp = reqwest::Client::new()
+        .post(format!(
+            "http://localhost:{port}/api/w/test-workspace/scripts/create"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({
+            "path": to,
+            "parent_hash": from_hash,
+            "summary": "A",
+            "description": "",
+            "content": "export function main() { return 1 }",
+            "language": "deno",
+            "schema": {},
+            "skip_draft_deletion": true
+        }))
+        .send()
+        .await?;
+    let status = resp.status();
+    let hash = resp.text().await?;
+    assert_eq!(status, 201, "rename to {to} failed: {hash}");
+    Ok(hash)
+}
+
+/// Save the draft as an editor still bound to `url_path` would. Returns the path the
+/// save landed at.
+async fn save_at(port: u16, url_path: &str, content: &str) -> anyhow::Result<String> {
+    let saved: Value = reqwest::Client::new()
+        .post(format!(
+            "http://localhost:{port}/api/w/test-workspace/drafts/update/script/{url_path}"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({
+            "value": { "path": url_path, "summary": "A", "content": content, "language": "deno" }
+        }))
+        .send()
+        .await?
+        .json()
+        .await?;
+    assert_eq!(saved["status"], "saved", "save refused: {saved}");
+    Ok(saved["path"].as_str().unwrap_or_default().to_string())
+}
+
+/// A record is kept to one hop, and a move back to the path it left ends it: both are
+/// three statements whose order decides the answer.
+#[sqlx::test(fixtures("base", "drafts_save_follows_move"))]
+async fn test_move_records_stay_one_hop(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let b = rename(port, HEAD_HASH, "u/test-user/follow_b").await?;
+    let _c = rename(port, &b, "u/test-user/follow_c").await?;
+    assert_eq!(
+        save_at(port, "u/test-user/follow_a", "after two moves").await?,
+        "u/test-user/follow_c",
+        "a save at the first path did not reach the last"
+    );
+    assert_eq!(own_draft_paths(port).await?, vec!["u/test-user/follow_c"]);
+    Ok(())
+}
+
+#[sqlx::test(fixtures("base", "drafts_save_follows_move"))]
+async fn test_move_back_ends_the_record(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let b = rename(port, HEAD_HASH, "u/test-user/follow_b").await?;
+    let _a = rename(port, &b, "u/test-user/follow_a").await?;
+    assert_eq!(
+        save_at(port, "u/test-user/follow_a", "after moving back").await?,
+        "u/test-user/follow_a",
+        "a save was routed off the path the item moved back to"
+    );
+    assert_eq!(own_draft_paths(port).await?, vec!["u/test-user/follow_a"]);
+    Ok(())
+}
+
+/// A rename carries a teammate's row too: both its path keys follow, and the version
+/// it forked from does not move. A restamp there would clear their out-of-date prompt
+/// and let them deploy over the mover's version believing they were current.
+#[sqlx::test(fixtures("base", "drafts_save_follows_move"))]
+async fn test_a_teammates_draft_follows_with_its_base(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    rename(port, HEAD_HASH, "u/test-user/follow_b").await?;
+
+    // Read from the pool: the teammate's row is another user's, and this asserts on
+    // `base`, which no endpoint exposes for someone else's draft.
+    let row: (String, String, Option<String>) = sqlx::query_as(
+        "SELECT value::jsonb ->> 'path', value::jsonb ->> 'draft_path', base
+         FROM draft WHERE workspace_id = 'test-workspace' AND typ = 'script'
+           AND email = 'test2@windmill.dev'",
+    )
+    .fetch_one(&db)
+    .await?;
+    assert_eq!(row.0, "u/test-user/follow_b", "typed path did not follow");
+    assert_eq!(row.1, "u/test-user/follow_b", "mirror did not follow");
+    assert_eq!(
+        row.2.as_deref(),
+        Some(HEAD_HASH),
+        "the teammate's base was restamped by someone else's rename"
+    );
+    Ok(())
+}
+
+/// An item move and then the owner's own move of what is left: the two records have
+/// different scopes, so the owner's move has to extend the chain in its own scope or
+/// a save addressed to the first path stops at the abandoned middle one.
+#[sqlx::test(fixtures("base", "drafts_save_follows_move"))]
+async fn test_an_owner_move_extends_an_item_move(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    rename(port, HEAD_HASH, "u/test-user/follow_b").await?;
+    // Archiving the script at the new path leaves the carried draft as a draft-only
+    // item, which its owner can move through `/drafts/move`.
+    sqlx::query("UPDATE script SET archived = true WHERE path = 'u/test-user/follow_b'")
+        .execute(&db)
+        .await?;
+    let resp = reqwest::Client::new()
+        .post(format!(
+            "http://localhost:{port}/api/w/test-workspace/drafts/move/script/u/test-user/follow_b"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({ "new_path": "u/test-user/follow_c" }))
+        .send()
+        .await?;
+    assert!(
+        resp.status().is_success(),
+        "move failed: {}",
+        resp.text().await?
+    );
+
+    assert_eq!(
+        save_at(port, "u/test-user/follow_a", "after both moves").await?,
+        "u/test-user/follow_c",
+        "a save at the first path stopped at the path the owner's move left"
+    );
+    assert_eq!(own_draft_paths(port).await?, vec!["u/test-user/follow_c"]);
+    Ok(())
+}
+
+/// Redeploying at a path an owner's move routed away from ends that route: the live item
+/// owns its path again, and its saves must not follow the draft that left.
+#[sqlx::test(fixtures("base", "drafts_save_follows_move"))]
+async fn test_redeploy_at_a_routed_path_ends_the_route(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    // `move_draft` ignores archived rows, so an archived script's draft can be moved away.
+    sqlx::query("UPDATE script SET archived = true WHERE path = 'u/test-user/follow_a'")
+        .execute(&db)
+        .await?;
+    let resp = reqwest::Client::new()
+        .post(format!(
+            "http://localhost:{port}/api/w/test-workspace/drafts/move/script/u/test-user/follow_a"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({ "new_path": "u/test-user/follow_b" }))
+        .send()
+        .await?;
+    assert!(
+        resp.status().is_success(),
+        "move failed: {}",
+        resp.text().await?
+    );
+
+    // Unarchiving redeploys at the same path, with the archived version as parent.
+    rename(port, HEAD_HASH, "u/test-user/follow_a").await?;
+
+    assert_eq!(
+        save_at(port, "u/test-user/follow_a", "for the live script").await?,
+        "u/test-user/follow_a",
+        "a save for the redeployed script followed the draft that moved away"
+    );
+    Ok(())
+}
+
+/// A draft written before the NUL sanitizer still has to follow a move: its path keys are
+/// what a deploy of it would land on, so the carry rewrites them, sanitizing the value it
+/// could not otherwise parse.
+#[sqlx::test(fixtures("base", "drafts_save_follows_move"))]
+async fn test_a_poisoned_draft_follows_a_rename(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    // The teammate's row, rewritten the way a pre-sanitizer client left one: a real NUL
+    // escape in the content, both path keys naming the path the item is about to leave.
+    sqlx::query(
+        r#"UPDATE draft SET value = '{"path": "u/test-user/follow_a", "draft_path": "u/test-user/follow_a",
+             "parent_hash": "0000000000001b76", "summary": "A", "content": "a\u0000b"}'
+           WHERE email = 'test2@windmill.dev'"#,
+    )
+    .execute(&db)
+    .await?;
+
+    rename(port, HEAD_HASH, "u/test-user/follow_b").await?;
+
+    let row: (String, String, String) = sqlx::query_as(
+        "SELECT value::jsonb ->> 'path', value::jsonb ->> 'draft_path', value::jsonb ->> 'content'
+         FROM draft WHERE email = 'test2@windmill.dev'",
+    )
+    .fetch_one(&db)
+    .await?;
+    assert_eq!(row.0, "u/test-user/follow_b", "typed path did not follow");
+    assert_eq!(row.1, "u/test-user/follow_b", "mirror did not follow");
+    assert_eq!(row.2, "ab", "the NUL survived the rewrite");
+    Ok(())
+}
+
+/// A discard whose answer is lost is retried, and the retry finds nothing to delete. It
+/// still has to name where the item went: the editor asking is on the path it left, and a
+/// reload there lands on nothing.
+#[sqlx::test(fixtures("base", "drafts_save_follows_move"))]
+async fn test_a_retried_discard_still_names_the_destination(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let client = reqwest::Client::new();
+
+    rename(port, HEAD_HASH, "u/test-user/follow_b").await?;
+
+    let discard = |token: &'static str| {
+        let client = client.clone();
+        async move {
+            client
+                .post(format!(
+                    "http://localhost:{port}/api/w/test-workspace/drafts/update/script/u/test-user/follow_a"
+                ))
+                .header("Authorization", format!("Bearer {token}"))
+                .json(&json!({ "value": null }))
+                .send()
+                .await?
+                .json::<Value>()
+                .await
+        }
+    };
+
+    let first = discard("SECRET_TOKEN").await?;
+    assert_eq!(first["status"], "saved", "{first}");
+    assert_eq!(first["path"], "u/test-user/follow_b", "{first}");
+
+    let retry = discard("SECRET_TOKEN").await?;
+    assert_eq!(
+        retry["status"], "saved",
+        "the retry was not idempotent: {retry}"
+    );
+    assert_eq!(retry["path"], "u/test-user/follow_b", "{retry}");
+
+    // A third user has no draft on this item, so their discard deletes nothing and the
+    // destination is a move record and nothing else: it is answered only to a caller who
+    // can read that path.
+    let other = discard("SECRET_TOKEN_3").await?;
+    assert_eq!(other["status"], "saved", "{other}");
+    assert_eq!(
+        other["path"],
+        Value::Null,
+        "a user who cannot read the destination was told where the item went: {other}"
+    );
+    Ok(())
+}
+
+/// The legacy workspace-level row is carried by a rename like any other draft, and the
+/// record that routes saves to it covers every caller — so discarding it from a page that
+/// still names the old path has to reach it where it went.
+#[sqlx::test(fixtures("base", "drafts_save_follows_move"))]
+async fn test_a_legacy_discard_follows_a_rename(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    sqlx::query(
+        r#"INSERT INTO draft (workspace_id, path, typ, value, email)
+           VALUES ('test-workspace', 'u/test-user/follow_a', 'script',
+                   '{"path": "u/test-user/follow_a", "summary": "legacy", "content": "x"}', NULL)"#,
+    )
+    .execute(&db)
+    .await?;
+
+    rename(port, HEAD_HASH, "u/test-user/follow_b").await?;
+
+    let resp = reqwest::Client::new()
+        .post(format!(
+            "http://localhost:{port}/api/w/test-workspace/drafts/update/script/u/test-user/follow_a"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({ "value": null, "legacy": true }))
+        .send()
+        .await?;
+    assert!(
+        resp.status().is_success(),
+        "discard failed: {}",
+        resp.text().await?
+    );
+
+    let left: i64 = sqlx::query_scalar(
+        "SELECT count(*) FROM draft WHERE workspace_id = 'test-workspace' AND email IS NULL",
+    )
+    .fetch_one(&db)
+    .await?;
+    assert_eq!(
+        left, 0,
+        "the legacy draft survived a discard aimed at its old path"
+    );
+    Ok(())
+}
+
+/// Deploying a draft that a move carried off an archived script: its parent is still the
+/// version at the old path, so the deploy renames from there and carries what is left over
+/// — onto the very draft being deployed. That row is this deploy's own, not an item in its
+/// way, or the deploy is refused and every retry refuses again.
+#[sqlx::test(fixtures("base", "drafts_save_follows_move"))]
+async fn test_a_moved_draft_deploys_at_its_new_path(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    sqlx::query("UPDATE script SET archived = true WHERE path = 'u/test-user/follow_a'")
+        .execute(&db)
+        .await?;
+    let resp = reqwest::Client::new()
+        .post(format!(
+            "http://localhost:{port}/api/w/test-workspace/drafts/move/script/u/test-user/follow_a"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({ "new_path": "u/test-user/follow_b" }))
+        .send()
+        .await?;
+    assert!(
+        resp.status().is_success(),
+        "move failed: {}",
+        resp.text().await?
+    );
+
+    // Deploy it where it now lives, still parented on the archived version it forked from.
+    let resp = reqwest::Client::new()
+        .post(format!(
+            "http://localhost:{port}/api/w/test-workspace/scripts/create"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({
+            "path": "u/test-user/follow_b",
+            "parent_hash": HEAD_HASH,
+            "summary": "A",
+            "description": "",
+            "content": "export function main() { return 2 }",
+            "language": "deno",
+            "schema": {}
+        }))
+        .send()
+        .await?;
+    let status = resp.status();
+    let body = resp.text().await?;
+    assert_eq!(status, 201, "the moved draft could not be deployed: {body}");
+    Ok(())
+}
+
+/// A route is only as good as the item it points at: when an unrelated item claims the
+/// destination, a save still addressed to the old path must stay where it is rather than
+/// land on that item's draft.
+#[sqlx::test(fixtures("base", "drafts_save_follows_move"))]
+async fn test_a_reused_destination_ends_the_route(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    sqlx::query("UPDATE script SET archived = true WHERE path = 'u/test-user/follow_a'")
+        .execute(&db)
+        .await?;
+    let resp = reqwest::Client::new()
+        .post(format!(
+            "http://localhost:{port}/api/w/test-workspace/drafts/move/script/u/test-user/follow_a"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({ "new_path": "u/test-user/follow_b" }))
+        .send()
+        .await?;
+    assert!(
+        resp.status().is_success(),
+        "move failed: {}",
+        resp.text().await?
+    );
+    // Someone else's item takes the destination, and the moved draft goes with the
+    // deploy that consumes it.
+    sqlx::query("DELETE FROM draft WHERE workspace_id = 'test-workspace' AND path = 'u/test-user/follow_b'")
+        .execute(&db)
+        .await?;
+    let resp = reqwest::Client::new()
+        .post(format!(
+            "http://localhost:{port}/api/w/test-workspace/scripts/create"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({
+            "path": "u/test-user/follow_b",
+            "summary": "unrelated",
+            "description": "",
+            "content": "export function main() { return 3 }",
+            "language": "deno",
+            "schema": {}
+        }))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 201, "create failed: {}", resp.text().await?);
+
+    assert_eq!(
+        save_at(port, "u/test-user/follow_a", "after the destination was reused").await?,
+        "u/test-user/follow_a",
+        "a save was routed onto the item that now owns the destination"
+    );
+    Ok(())
+}
diff --git a/backend/tests/fixtures/drafts_move_mirror.sql b/backend/tests/fixtures/drafts_move_mirror.sql
new file mode 100644
index 0000000000..e96d985eae
--- /dev/null
+++ b/backend/tests/fixtures/drafts_move_mirror.sql
@@ -0,0 +1,16 @@
+-- Fixture for the two-path-key move test.
+--
+-- Two draft-only scripts owned by test-user, both parked at a generated storage
+-- key the way a session-created draft is. One carries the `draft_path` mirror the
+-- session editor writes while the typed path differs from that key; the other
+-- carries no mirror at all, which is what a plain draft looks like.
+
+INSERT INTO draft (workspace_id, path, typ, value, email) VALUES
+    ('test-workspace', 'u/test-user/draft_mirror', 'script',
+     '{"path": "u/test-user/friendly", "draft_path": "u/test-user/friendly",
+       "content": "x", "language": "bun", "summary": "S"}',
+     'test@windmill.dev'),
+    ('test-workspace', 'u/test-user/draft_plain', 'script',
+     '{"path": "u/test-user/draft_plain",
+       "content": "x", "language": "bun", "summary": "S"}',
+     'test@windmill.dev');
diff --git a/backend/tests/fixtures/drafts_move_taken.sql b/backend/tests/fixtures/drafts_move_taken.sql
new file mode 100644
index 0000000000..5fee11b942
--- /dev/null
+++ b/backend/tests/fixtures/drafts_move_taken.sql
@@ -0,0 +1,37 @@
+-- Fixture for refusing a rename onto a path a draft already occupies.
+--
+-- A deployed script at `u/test-user/mvtaken_a` (hash 7010 = 0x1b62), and a
+-- never-deployed draft of test-user's own at `u/test-user/mvtaken_b`, the path
+-- the rename will target. Nothing deployed lives at the target, so only the
+-- draft can refuse the move.
+
+INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by,
+                    schema, summary, description, lock, extra_perms)
+VALUES ('test-workspace', 7010, 'u/test-user/mvtaken_a',
+        'export function main() { return 1 }',
+        'deno', 'script', 'test-user', '{}', 'A', '', '', '{}');
+
+INSERT INTO draft (workspace_id, path, typ, value, email)
+VALUES ('test-workspace', 'u/test-user/mvtaken_b', 'script',
+        '{"path": "u/test-user/mvtaken_b", "summary": "B", "content": ""}',
+        'test@windmill.dev');
+
+-- An ownerless (pre per-user drafts) row at a third path: a deploy there deletes it
+-- together with the caller's, so it occupies the path just as an own draft does.
+INSERT INTO draft (workspace_id, path, typ, value, email)
+VALUES ('test-workspace', 'u/test-user/mvtaken_legacy', 'script',
+        '{"path": "u/test-user/mvtaken_legacy", "summary": "legacy", "content": ""}',
+        NULL);
+
+-- A draft-only classic app and a draft-only raw app of the same owner. They share
+-- the `app` table, so one occupies the other's path. The third is another user's raw
+-- app: a different item at its own path, not a second copy of anyone's.
+INSERT INTO draft (workspace_id, path, typ, value, email) VALUES
+    ('test-workspace', 'u/test-user/mvtaken_app', 'app',
+     '{"summary": "classic", "value": {}}', 'test@windmill.dev'),
+    ('test-workspace', 'u/test-user/mvtaken_raw', 'raw_app',
+     '{"summary": "raw", "files": {}}', 'test@windmill.dev'),
+    ('test-workspace', 'u/test-user/mvtaken_theirs', 'raw_app',
+     '{"summary": "theirs", "files": {}}', 'test2@windmill.dev'),
+    ('test-workspace', 'u/test-user/mvtaken_app_theirs', 'app',
+     '{"summary": "theirs", "value": {}}', 'test2@windmill.dev');
diff --git a/backend/tests/fixtures/drafts_save_follows_move.sql b/backend/tests/fixtures/drafts_save_follows_move.sql
new file mode 100644
index 0000000000..16a41feb1a
--- /dev/null
+++ b/backend/tests/fixtures/drafts_save_follows_move.sql
@@ -0,0 +1,29 @@
+-- Fixture for saving a draft to the path its item moved away from.
+--
+-- A deployed script at `u/test-user/follow_a` (hash 7030 = 0x1b76) with the
+-- deployer's own draft on it. The test renames the script and then saves the
+-- draft from an editor still bound to the old path.
+
+INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by,
+                    schema, summary, description, lock, extra_perms)
+VALUES ('test-workspace', 7030, 'u/test-user/follow_a',
+        'export function main() { return 1 }',
+        'deno', 'script', 'test-user', '{}', 'A', '', '', '{}');
+
+INSERT INTO draft (workspace_id, path, typ, value, email, base)
+VALUES ('test-workspace', 'u/test-user/follow_a', 'script',
+        '{"path": "u/test-user/follow_a", "parent_hash": "0000000000001b76", "summary": "A", "content": "draft"}',
+        'test@windmill.dev', '0000000000001b76');
+
+-- A draft-only script parked at a generated storage key, its typed path elsewhere.
+INSERT INTO draft (workspace_id, path, typ, value, email)
+VALUES ('test-workspace', 'u/test-user/draft_store', 'script',
+        '{"path": "u/test-user/friendly", "draft_path": "u/test-user/friendly", "summary": "D", "content": "draft"}',
+        'test@windmill.dev');
+
+-- A teammate's draft on the same deployed script, forked from the same head. The
+-- rename must carry it too, without touching the version it forked from.
+INSERT INTO draft (workspace_id, path, typ, value, email, base)
+VALUES ('test-workspace', 'u/test-user/follow_a', 'script',
+        '{"path": "u/test-user/follow_a", "draft_path": "u/test-user/follow_a", "parent_hash": "0000000000001b76", "summary": "A", "content": "teammate draft"}',
+        'test2@windmill.dev', '0000000000001b76');
diff --git a/backend/tests/flow_engine_parity.rs b/backend/tests/flow_engine_parity.rs
index 78e45e404b..7ea221c2e8 100644
--- a/backend/tests/flow_engine_parity.rs
+++ b/backend/tests/flow_engine_parity.rs
@@ -2877,6 +2877,131 @@ async fn test_flow_env_imported_flow_with_nested_branch(db: Pool<Postgres>) -> a
     Ok(())
 }
 
+// A branch/loop sub-flow of a deployed flow is marked at push when its parent has no flow_env,
+// own or inherited, so its worker skips `fetch_root_flow_env`. With an env two scopes up (root
+// → loop → imported flow without env → parallel loop → leaf) nothing may be marked and the
+// root's value must reach the leaf; with no env anywhere every loop iteration is marked.
+#[cfg(feature = "deno_core")]
+#[sqlx::test(fixtures("base"))]
+async fn test_flow_env_marks_sub_flows_only_without_ancestor_env(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    // Deployed, so their loops run as `FlowNode` sub-flows.
+    let deploy = |path: &'static str, version: i64, value: serde_json::Value| {
+        let db = db.clone();
+        async move {
+            sqlx::query(
+                "INSERT INTO flow(workspace_id, summary, description, path, versions, schema, value, edited_by) VALUES ('test-workspace', '', '', $1, ARRAY[$2]::bigint[], '{}'::jsonb, $3, 'system')",
+            )
+            .bind(path)
+            .bind(version)
+            .bind(&value)
+            .execute(&db)
+            .await?;
+            sqlx::query(
+                "INSERT INTO flow_version(id, workspace_id, path, schema, value, created_by) VALUES ($1, 'test-workspace', $2, '{}'::jsonb, $3, 'system')",
+            )
+            .bind(version)
+            .bind(path)
+            .bind(&value)
+            .execute(&db)
+            .await?;
+            RunJob::from(JobPayload::FlowDependencies {
+                path: path.to_string(),
+                dedicated_worker: None,
+                version,
+                debouncing_settings: Default::default(),
+            })
+            .run_until_complete(&db, false, port)
+            .await;
+            anyhow::Ok(())
+        }
+    };
+    deploy(
+        "f/system/imported_loop_no_env",
+        9991004,
+        json!({ "modules": [{ "id": "inner", "value": {
+            "type": "forloopflow",
+            "iterator": { "type": "javascript", "expr": "[1, 2]" },
+            "skip_failures": false,
+            "parallel": true,
+            "modules": [{ "id": "leaf", "value": {
+                "type": "rawscript",
+                "language": "deno",
+                "content": "export function main(key: any) { return key ?? null; }",
+                "input_transforms": { "key": { "type": "javascript", "expr": "flow_env.KEY" } }
+            }}, { "id": "tail", "value": {
+                // A single simple step is inlined rather than stored as a flow node.
+                "type": "rawscript",
+                "language": "deno",
+                "content": "export function main(prev: any) { return prev; }",
+                "input_transforms": { "prev": { "type": "javascript", "expr": "results.leaf" } }
+            }}]
+        }}]}),
+    )
+    .await?;
+    let root = |flow_env: serde_json::Value| {
+        json!({ "flow_env": flow_env, "modules": [{ "id": "outer", "value": {
+            "type": "forloopflow",
+            "iterator": { "type": "javascript", "expr": "[1]" },
+            "skip_failures": false,
+            "parallel": false,
+            "modules": [{ "id": "import", "value": {
+                "type": "flow",
+                "path": "f/system/imported_loop_no_env",
+                "input_transforms": {}
+            }}]
+        }}]})
+    };
+    deploy(
+        "f/system/root_with_env",
+        9991005,
+        root(json!({ "KEY": "from-root" })),
+    )
+    .await?;
+    deploy("f/system/root_no_env", 9991006, root(json!(null))).await?;
+
+    let run = |path: &'static str, version: i64| {
+        let db = db.clone();
+        async move {
+            let completed = RunJob::from(JobPayload::Flow {
+                path: path.to_string(),
+                dedicated_worker: None,
+                apply_preprocessor: false,
+                version,
+                labels: None,
+            })
+            .run_until_complete(&db, false, port)
+            .await;
+            // The mark of every loop iteration pushed under the run.
+            let marks = sqlx::query_as::<_, (String, Option<bool>)>(
+                "SELECT j.kind::text, (c.flow_status->>'no_inherited_flow_env')::bool
+                 FROM v2_job j JOIN v2_job_completed c ON c.id = j.id
+                 WHERE COALESCE(j.root_job, j.parent_job) = $1
+                   AND j.flow_step_id IN ('outer', 'inner')",
+            )
+            .bind(completed.id)
+            .fetch_all(&db)
+            .await?;
+            anyhow::Ok((completed.json_result().unwrap(), marks))
+        }
+    };
+
+    let (result, marks) = run("f/system/root_with_env", 9991005).await?;
+    assert_eq!(result, json!([["from-root", "from-root"]]));
+    assert_eq!(marks, vec![("flownode".to_string(), None); 3]);
+
+    let (result, marks) = run("f/system/root_no_env", 9991006).await?;
+    assert_eq!(result, json!([[null, null]]));
+    assert_eq!(marks, vec![("flownode".to_string(), Some(true)); 3]);
+
+    Ok(())
+}
+
 // stop_after_if predicate sees flow_env. Regression for the eval at line 614
 // of `update_flow_status_after_job_completion_internal` which used to pass
 // `None` for flow_env unconditionally.
@@ -3312,3 +3437,60 @@ export function main(i: number) {
 
     Ok(())
 }
+
+// A `$flow_expr[...]` step tag is resolved from the flow's state before the step is pushed, and
+// one that cannot be resolved fails the step instead of queueing it on a tag no worker serves.
+#[cfg(feature = "deno_core")]
+#[sqlx::test(fixtures("base"))]
+async fn test_flow_expr_step_tag(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+
+    let step = |id: &str, tag: Option<&str>| {
+        flow_module(
+            id,
+            FlowModuleValue::RawScript {
+                input_transforms: Default::default(),
+                language: ScriptLang::Deno,
+                content: "export function main() { return { lang: 'bun' } }".to_string(),
+                path: None,
+                lock: None,
+                tag: tag.map(str::to_string),
+                concurrency_settings: Default::default(),
+                is_trigger: None,
+                assets: None,
+            },
+        )
+    };
+    let flow = FlowValue {
+        modules: vec![
+            step("a", None),
+            step("b", Some("$flow_expr[results.a.lang]")),
+            step("c", Some("nobody-serves-$flow_expr[a.lang]")),
+        ],
+        same_worker: false,
+        ..Default::default()
+    };
+
+    let job = RunJob::from(JobPayload::RawFlow { value: flow, path: None, restarted_from: None })
+        .run_until_complete(&db, false, server.addr.port())
+        .await;
+
+    let b_tag = sqlx::query_scalar::<_, String>(
+        "SELECT tag FROM v2_job WHERE parent_job = $1 AND flow_step_id = 'b'",
+    )
+    .bind(job.id)
+    .fetch_one(&db)
+    .await?;
+    assert_eq!(b_tag, "bun");
+
+    assert!(!job.success);
+    let result = job.json_result().unwrap();
+    let message = result["error"]["message"].as_str().unwrap_or_default();
+    assert!(
+        message.contains("Could not resolve the step tag `nobody-serves-$flow_expr[a.lang]`"),
+        "got {result:?}"
+    );
+
+    Ok(())
+}
diff --git a/backend/tests/instance_config.rs b/backend/tests/instance_config.rs
index 64d7854173..26a46d272e 100644
--- a/backend/tests/instance_config.rs
+++ b/backend/tests/instance_config.rs
@@ -1530,6 +1530,31 @@ async fn declarative_sync_rejects_an_unusable_instance_banner(db: Pool<Postgres>
     );
 }
 
+#[sqlx::test(fixtures("base"))]
+async fn declarative_sync_rejects_a_malformed_max_token_expiration(db: Pool<Postgres>) {
+    clear_settings_and_configs(&db).await;
+    let before = count_global_settings(&db).await;
+
+    let mut desired = BTreeMap::new();
+    desired.insert(
+        "max_token_expiration_days".to_string(),
+        serde_json::json!("7.0"),
+    );
+
+    let err = windmill_common::instance_config::sync_global_settings_declarative(
+        &db,
+        &BTreeMap::new(),
+        &desired,
+    )
+    .await
+    .expect_err("a ceiling the token routes cannot read must fail the sync");
+    assert!(
+        err.to_string().contains("max_token_expiration_days"),
+        "the error should name the offending setting, got: {err}"
+    );
+    assert_eq!(count_global_settings(&db).await, before);
+}
+
 #[sqlx::test(fixtures("base"))]
 async fn declarative_sync_rejects_an_unusable_default_allowed_origins(db: Pool<Postgres>) {
     // The declarative writers (the sync-config CLI, the operator's ConfigMap
@@ -1583,3 +1608,34 @@ async fn declarative_sync_rejects_an_unusable_default_allowed_origins(db: Pool<P
     .await
     .expect("a valid origin list must sync");
 }
+
+/// The accent color is interpolated into a stylesheet every user loads, so the operator
+/// path must refuse anything but `#rrggbb` just like the settings API does.
+#[sqlx::test(fixtures("base"))]
+async fn declarative_sync_rejects_a_non_hex_accent_color(db: Pool<Postgres>) {
+    clear_settings_and_configs(&db).await;
+
+    let mut desired = BTreeMap::new();
+    desired.insert(
+        "accent_color".to_string(),
+        serde_json::json!("#000;}body{display:none"),
+    );
+    let err = windmill_common::instance_config::sync_global_settings_declarative(
+        &db,
+        &BTreeMap::new(),
+        &desired,
+    )
+    .await
+    .expect_err("a non-hex accent color must fail the sync");
+    assert!(err.to_string().contains("accent_color"), "got: {err}");
+    assert!(get_global_setting(&db, "accent_color").await.is_none());
+
+    desired.insert("accent_color".to_string(), serde_json::json!("#1f9d55"));
+    windmill_common::instance_config::sync_global_settings_declarative(
+        &db,
+        &BTreeMap::new(),
+        &desired,
+    )
+    .await
+    .expect("a hex accent color must sync");
+}
diff --git a/backend/tests/job_payload.rs b/backend/tests/job_payload.rs
index c538cbe6e1..1a973f6fe6 100644
--- a/backend/tests/job_payload.rs
+++ b/backend/tests/job_payload.rs
@@ -239,6 +239,7 @@ mod job_payload {
             let result = RunJob::from(JobPayload::FlowNode {
                 id,
                 path: "f/system/hello_with_nodes_flow/forloop-0".into(),
+                no_inherited_flow_env: false,
             })
             .arg("iter", json!({ "value": "tests", "index": 0 }))
             .run_until_complete(&db, false, port)
diff --git a/backend/tests/job_token_log_masking.rs b/backend/tests/job_token_log_masking.rs
new file mode 100644
index 0000000000..5d7de27218
--- /dev/null
+++ b/backend/tests/job_token_log_masking.rs
@@ -0,0 +1,108 @@
+/*
+ * The job's own token (`$WM_TOKEN`) stays valid well past the job it was minted
+ * for, and job logs are persisted to `job_logs` and optionally to object storage,
+ * so a script that echoes the token would otherwise park a live credential in
+ * durable storage. `run_worker` registers the token with `sensitive_log_masks`
+ * for the job it pulled; this pins that the persisted log carries the masked form.
+ */
+
+use sqlx::{Pool, Postgres};
+use windmill_common::{
+    jobs::{JobPayload, RawCode},
+    scripts::ScriptLang,
+};
+use windmill_test_utils::*;
+
+/// Prefix of a serialized job token: `jwt_` plus the base64 of a JWT header.
+/// The masked form keeps only `jwt` + the last three characters, so it never matches.
+const RAW_TOKEN_PREFIX: &str = "jwt_ey";
+
+#[sqlx::test(fixtures("base"))]
+async fn test_job_token_masked_in_persisted_logs(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let job = RunJob::from(JobPayload::Code(RawCode {
+        hash: None,
+        content: "echo \"running with --token $WM_TOKEN\"".to_string(),
+        path: None,
+        lock: None,
+        language: ScriptLang::Bash,
+        cache_ttl: None,
+        cache_ignore_s3_path: None,
+        dedicated_worker: None,
+        concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default()
+            .into(),
+        debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
+        modules: None,
+        tag: None,
+    }))
+    .run_until_complete(&db, false, port)
+    .await;
+    assert!(job.success, "job should have succeeded");
+
+    let logs =
+        sqlx::query_scalar::<_, Option<String>>("SELECT logs FROM job_logs WHERE job_id = $1")
+            .bind(job.id)
+            .fetch_one(&db)
+            .await?
+            .unwrap_or_default();
+
+    assert!(
+        !logs.contains(RAW_TOKEN_PREFIX),
+        "an unmasked job token reached the persisted logs: {logs}"
+    );
+    assert!(
+        logs.contains("secret value was masked"),
+        "expected the masking notice in logs: {logs}"
+    );
+    Ok(())
+}
+
+/// nativets runs V8 in-process and persists `console.log` output through its own
+/// channel, so it is masked by a different mechanism than the bash case above and
+/// needs its own guard.
+#[cfg(feature = "deno_core")]
+#[sqlx::test(fixtures("base"))]
+async fn test_job_token_masked_in_nativets_logs(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let job = RunJob::from(JobPayload::Code(RawCode {
+        hash: None,
+        content: "export async function main() {\n  console.log('running with --token ' + process.env.WM_TOKEN);\n  return 'ok';\n}".to_string(),
+        path: None,
+        lock: None,
+        language: ScriptLang::Nativets,
+        cache_ttl: None,
+        cache_ignore_s3_path: None,
+        dedicated_worker: None,
+        concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default()
+            .into(),
+        debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
+        modules: None,
+        tag: None,
+    }))
+    .run_until_complete(&db, false, port)
+    .await;
+    assert!(job.success, "job should have succeeded");
+
+    let logs =
+        sqlx::query_scalar::<_, Option<String>>("SELECT logs FROM job_logs WHERE job_id = $1")
+            .bind(job.id)
+            .fetch_one(&db)
+            .await?
+            .unwrap_or_default();
+
+    assert!(
+        !logs.contains(RAW_TOKEN_PREFIX),
+        "an unmasked job token reached the persisted logs: {logs}"
+    );
+    assert!(
+        logs.contains("secret value was masked"),
+        "expected the masking notice in logs: {logs}"
+    );
+    Ok(())
+}
diff --git a/backend/tests/jobs_read_auth.rs b/backend/tests/jobs_read_auth.rs
index c8c154c250..8c5bfee0eb 100644
--- a/backend/tests/jobs_read_auth.rs
+++ b/backend/tests/jobs_read_auth.rs
@@ -516,10 +516,14 @@ async fn test_single_job_read_authorization(db: Pool<Postgres>) -> anyhow::Resul
         Some("SECRET_TOKEN_2"),
     )
     .await;
-    assert!(status.is_success(), "owner must mint a resume secret: {secret}");
+    assert!(
+        status.is_success(),
+        "owner must mint a resume secret: {secret}"
+    );
     let secret = secret.trim().trim_matches('"').to_string();
-    let approval_result =
-        format!("completed/get_result/{STEP_JOB}?suspended_job={STEP_JOB}&resume_id=0&secret={secret}");
+    let approval_result = format!(
+        "completed/get_result/{STEP_JOB}?suspended_job={STEP_JOB}&resume_id=0&secret={secret}"
+    );
     let (status, body) = get(&base, &approval_result, None).await;
     assert!(
         status.is_success(),
@@ -991,6 +995,89 @@ async fn test_single_job_read_authorization(db: Pool<Postgres>) -> anyhow::Resul
         !status.is_success(),
         "a public token must not let an anonymous caller cancel the run (got {status}): {body}"
     );
+    // ---- RUN_NOW is gated like cancel, and only moves a job still waiting for a
+    //      future start. ----
+    let run_now = format!("queue/run_now/{RUNNING_JOB}");
+    let (status, body) = post(&authed_base, &run_now, Some("SECRET_TOKEN_3")).await;
+    assert_eq!(
+        status,
+        reqwest::StatusCode::FORBIDDEN,
+        "viewer must not start another user's job early (got {status}): {body}"
+    );
+    let (status, body) = post(&authed_base, &run_now, Some("SECRET_TOKEN_2")).await;
+    assert_eq!(
+        status,
+        reqwest::StatusCode::BAD_REQUEST,
+        "a running job has no future start to move (got {status}): {body}"
+    );
+    sqlx::query(
+        "UPDATE v2_job_queue SET running = false, scheduled_for = now() + interval '1 hour'
+         WHERE id = $1::uuid",
+    )
+    .bind(RUNNING_JOB)
+    .execute(&db)
+    .await?;
+    let (status, body) = post(&authed_base, &run_now, Some("SECRET_TOKEN_2")).await;
+    assert!(
+        status.is_success(),
+        "owner must start their deferred job now (got {status}): {body}"
+    );
+    let due: bool =
+        sqlx::query_scalar("SELECT scheduled_for <= now() FROM v2_job_queue WHERE id = $1::uuid")
+            .bind(RUNNING_JOB)
+            .fetch_one(&db)
+            .await?;
+    assert!(due, "run_now must make the job due immediately");
+
+    // A schedule tick that is not due yet is refused: the schedule would queue that same
+    // tick again on completion and run twice.
+    sqlx::query(
+        "INSERT INTO schedule (workspace_id, path, edited_by, schedule, script_path, permissioned_as)
+         VALUES ('test-workspace', 'u/test-user-2/daily', 'test-user-2', '0 0 3 * * *',
+                 'u/test-user-2/running_secret', 'u/test-user-2')",
+    )
+    .execute(&db)
+    .await?;
+    sqlx::query(
+        "UPDATE v2_job SET trigger_kind = 'schedule', trigger = 'u/test-user-2/daily'
+         WHERE id = $1::uuid",
+    )
+    .bind(RUNNING_JOB)
+    .execute(&db)
+    .await?;
+    sqlx::query(
+        "UPDATE v2_job_queue SET scheduled_for =
+            (date_trunc('day', now() AT TIME ZONE 'UTC') + interval '1 day 3 hours') AT TIME ZONE 'UTC'
+         WHERE id = $1::uuid",
+    )
+    .bind(RUNNING_JOB)
+    .execute(&db)
+    .await?;
+    let (status, body) = post(&authed_base, &run_now, Some("SECRET_TOKEN_2")).await;
+    assert_eq!(
+        status,
+        reqwest::StatusCode::BAD_REQUEST,
+        "an upcoming schedule tick must not be started early (got {status}): {body}"
+    );
+    // A tick a concurrency limit pushed past its time is off the cron occurrences and
+    // may still be started early.
+    sqlx::query(
+        "UPDATE v2_job_queue SET scheduled_for = now() + interval '1 hour 37 seconds 123 milliseconds'
+         WHERE id = $1::uuid",
+    )
+    .bind(RUNNING_JOB)
+    .execute(&db)
+    .await?;
+    let (status, body) = post(&authed_base, &run_now, Some("SECRET_TOKEN_2")).await;
+    assert!(
+        status.is_success(),
+        "a deferred schedule tick must still start now (got {status}): {body}"
+    );
+    sqlx::query("UPDATE v2_job SET trigger_kind = NULL, trigger = NULL WHERE id = $1::uuid")
+        .bind(RUNNING_JOB)
+        .execute(&db)
+        .await?;
+
     // The owner still cancels their own job (no over-blocking). Keep this last: it
     // takes RUNNING_JOB out of the queue.
     let (status, body) = post(
diff --git a/backend/tests/perpetual_cancel_race.rs b/backend/tests/perpetual_cancel_race.rs
new file mode 100644
index 0000000000..df239eb7ab
--- /dev/null
+++ b/backend/tests/perpetual_cancel_race.rs
@@ -0,0 +1,183 @@
+//! A cancel reaches the queue row first and the worker only later: one landing after the worker's
+//! last read of that row completes the run carrying no `canceled_by` of its own, and a perpetual
+//! script must still stop rather than restart as if nothing had been cancelled.
+
+use serde_json::json;
+use sqlx::{types::Json, Pool, Postgres};
+use uuid::Uuid;
+use windmill_queue::{add_completed_job, get_mini_completed_job};
+
+const W_ID: &str = "test-workspace";
+const PATH: &str = "u/test-user/loop";
+
+async fn start_perpetual_run(db: &Pool<Postgres>) -> anyhow::Result<Uuid> {
+    sqlx::query(
+        "INSERT INTO script (workspace_id, hash, path, summary, description, content, created_by, \
+            language, lock, restart_unless_cancelled) \
+         VALUES ($1, 1, $2, '', '', 'echo', 'test-user', 'bash', '', true)",
+    )
+    .bind(W_ID)
+    .bind(PATH)
+    .execute(db)
+    .await?;
+    let id = Uuid::new_v4();
+    sqlx::query(
+        "INSERT INTO v2_job (id, workspace_id, created_by, created_at, permissioned_as, \
+            permissioned_as_email, kind, runnable_id, runnable_path, script_lang, tag, args, \
+            visible_to_owner) \
+         VALUES ($1, $2, 'test-user', now(), 'u/test-user', 'test@windmill.dev', 'script', 1, \
+            $3, 'bash', 'bash', '{\"n\": 1}', true)",
+    )
+    .bind(id)
+    .bind(W_ID)
+    .bind(PATH)
+    .execute(db)
+    .await?;
+    sqlx::query(
+        "INSERT INTO v2_job_queue (id, workspace_id, scheduled_for, running, started_at, tag) \
+         VALUES ($1, $2, now(), true, now(), 'bash')",
+    )
+    .bind(id)
+    .bind(W_ID)
+    .execute(db)
+    .await?;
+    Ok(id)
+}
+
+/// Waits for another connection to be stuck on the queue row of `id`, which is where the
+/// completion's delete lands while the cancel is uncommitted.
+async fn wait_until_blocked_on(db: &Pool<Postgres>, id: Uuid) -> anyhow::Result<()> {
+    for _ in 0..100 {
+        let blocked: bool = sqlx::query_scalar(
+            "SELECT EXISTS (SELECT 1 FROM pg_locks l JOIN v2_job_queue q \
+               ON q.ctid = ('(' || l.page || ',' || l.tuple || ')')::tid \
+             WHERE NOT l.granted AND l.locktype = 'tuple' AND q.id = $1) \
+             OR EXISTS (SELECT 1 FROM pg_stat_activity \
+             WHERE wait_event_type = 'Lock' AND query LIKE '%v2_job_queue%')",
+        )
+        .bind(id)
+        .fetch_one(db)
+        .await?;
+        if blocked {
+            return Ok(());
+        }
+        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+    }
+    anyhow::bail!("the completion never reached the delete, so the race was not exercised")
+}
+
+/// The same cancel, one step earlier: still being written when the completion reads the queue row,
+/// which reads it without a lock. Only the delete that follows waits for the writer.
+#[sqlx::test(fixtures("base"))]
+async fn a_cancel_still_being_written_is_kept(db: Pool<Postgres>) -> anyhow::Result<()> {
+    let running = start_perpetual_run(&db).await?;
+    let job = get_mini_completed_job(&running, W_ID, &db).await?.unwrap();
+
+    let mut cancel = db.begin().await?;
+    sqlx::query(
+        "UPDATE v2_job_queue SET canceled_by = 'test-user', canceled_reason = 'stop' WHERE id = $1",
+    )
+    .bind(running)
+    .execute(&mut *cancel)
+    .await?;
+
+    let completing = tokio::spawn({
+        let db = db.clone();
+        async move {
+            add_completed_job(
+                &db,
+                &job,
+                true,
+                false,
+                Json(&json!("done")),
+                None,
+                0,
+                None,
+                false,
+                None,
+                false,
+            )
+            .await
+        }
+    });
+    // Committing on a timer would let a slow completion read the cancel through the insert
+    // instead, leaving the half this test is for unexercised and green. Waiting for the delete to
+    // block on the row is what puts it there.
+    wait_until_blocked_on(&db, running).await?;
+    cancel.commit().await?;
+    completing.await??;
+
+    let (status, canceled_by): (String, Option<String>) =
+        sqlx::query_as("SELECT status::text, canceled_by FROM v2_job_completed WHERE id = $1")
+            .bind(running)
+            .fetch_one(&db)
+            .await?;
+    assert_eq!(status, "canceled", "the run is recorded as canceled");
+    assert_eq!(canceled_by.as_deref(), Some("test-user"));
+
+    let queued: Vec<Uuid> = sqlx::query_scalar(
+        "SELECT q.id FROM v2_job_queue q JOIN v2_job j USING (id) \
+         WHERE j.workspace_id = $1 AND j.runnable_path = $2",
+    )
+    .bind(W_ID)
+    .bind(PATH)
+    .fetch_all(&db)
+    .await?;
+    assert!(
+        queued.is_empty(),
+        "a canceled perpetual run queues no next one: {queued:?}"
+    );
+    Ok(())
+}
+
+#[sqlx::test(fixtures("base"))]
+async fn a_cancel_landing_after_the_worker_read_its_row_is_kept(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    let running = start_perpetual_run(&db).await?;
+    sqlx::query(
+        "UPDATE v2_job_queue SET canceled_by = 'test-user', canceled_reason = 'stop' WHERE id = $1",
+    )
+    .bind(running)
+    .execute(&db)
+    .await?;
+
+    let job = get_mini_completed_job(&running, W_ID, &db).await?.unwrap();
+    add_completed_job(
+        &db,
+        &job,
+        true,
+        false,
+        Json(&json!("done")),
+        None,
+        0,
+        // What the worker carries when the cancel landed after it last read the row.
+        None,
+        false,
+        None,
+        false,
+    )
+    .await?;
+
+    let (status, canceled_by): (String, Option<String>) =
+        sqlx::query_as("SELECT status::text, canceled_by FROM v2_job_completed WHERE id = $1")
+            .bind(running)
+            .fetch_one(&db)
+            .await?;
+    assert_eq!(status, "canceled", "the run is recorded as canceled");
+    assert_eq!(canceled_by.as_deref(), Some("test-user"));
+
+    let queued: Vec<Uuid> = sqlx::query_scalar(
+        "SELECT q.id FROM v2_job_queue q JOIN v2_job j USING (id) \
+         WHERE j.workspace_id = $1 AND j.runnable_path = $2",
+    )
+    .bind(W_ID)
+    .bind(PATH)
+    .fetch_all(&db)
+    .await?;
+    assert!(
+        queued.is_empty(),
+        "a canceled perpetual run queues no next one: {queued:?}"
+    );
+    Ok(())
+}
diff --git a/backend/tests/raw_apps_list_scope.rs b/backend/tests/raw_apps_list_scope.rs
new file mode 100644
index 0000000000..503bca7577
--- /dev/null
+++ b/backend/tests/raw_apps_list_scope.rs
@@ -0,0 +1,76 @@
+//! `GET /raw_apps/list` must honor a path-scoped token. The route layer only checks
+//! the scope domain and RLS knows nothing of token scopes, so the per-path filter
+//! lives in the handler, ahead of the page's LIMIT.
+
+use sqlx::{Pool, Postgres};
+use windmill_test_utils::*;
+
+async fn list_paths(port: u16, token: &str, query: &str) -> anyhow::Result<Vec<String>> {
+    let resp = reqwest::Client::new()
+        .get(format!(
+            "http://localhost:{port}/api/w/test-workspace/raw_apps/list?{query}"
+        ))
+        .header("Authorization", format!("Bearer {token}"))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 200, "list: {}", resp.text().await?);
+    let body: Vec<serde_json::Value> = resp.json().await?;
+    let mut paths: Vec<String> = body
+        .iter()
+        .map(|a| a["path"].as_str().unwrap().to_string())
+        .collect();
+    paths.sort();
+    Ok(paths)
+}
+
+#[sqlx::test(fixtures("base"))]
+async fn test_raw_apps_list_filters_by_token_scope(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    // The list sorts by edited_at desc, so the out-of-scope apps fill the first page
+    // unless the scope is applied before the LIMIT.
+    for (path, age_minutes) in [
+        ("f/other/c", 0),
+        ("u/test-userx/d", 1),
+        ("u/test-user/a", 2),
+        ("u/test-user/sub/b", 3),
+        // A `prefix/*` grant also covers the path at the prefix itself.
+        ("u/test-user", 4),
+    ] {
+        sqlx::query(
+            "INSERT INTO raw_app (path, workspace_id, data, edited_at)
+             VALUES ($1, 'test-workspace', '', now() - make_interval(mins => $2))",
+        )
+        .bind(path)
+        .bind(age_minutes)
+        .execute(&db)
+        .await?;
+    }
+    sqlx::query(
+        "INSERT INTO token (token_hash, token_prefix, token, email, label, scopes)
+         VALUES (encode(sha256('SCOPED_TOKEN'::bytea), 'hex'), 'SCOPED_TOK', 'SCOPED_TOKEN',
+                 'test@windmill.dev', 'scoped', ARRAY['raw_apps:read:u/test-user/*'])",
+    )
+    .execute(&db)
+    .await?;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    // The same user through an unscoped token sees every row.
+    assert_eq!(
+        list_paths(port, "SECRET_TOKEN", "").await?,
+        [
+            "f/other/c",
+            "u/test-user",
+            "u/test-user/a",
+            "u/test-user/sub/b",
+            "u/test-userx/d"
+        ]
+    );
+    assert_eq!(
+        list_paths(port, "SCOPED_TOKEN", "per_page=3").await?,
+        ["u/test-user", "u/test-user/a", "u/test-user/sub/b"]
+    );
+    Ok(())
+}
diff --git a/backend/tests/script_schema_inference.rs b/backend/tests/script_schema_inference.rs
new file mode 100644
index 0000000000..083716f8df
--- /dev/null
+++ b/backend/tests/script_schema_inference.rs
@@ -0,0 +1,115 @@
+use std::collections::HashMap;
+
+use serde_json::{json, Value};
+use sqlx::{Pool, Postgres};
+use windmill_api_client::types::{NewScript, ScriptLang};
+use windmill_test_utils::init_client;
+
+const PATH: &str = "u/test-user/inferred_schema";
+
+fn bun_ns(content: &str, parent_hash: Option<String>) -> NewScript {
+    NewScript {
+        draft_only: None,
+        content: content.into(),
+        language: ScriptLang::Bun,
+        lock: None,
+        parent_hash,
+        path: PATH.into(),
+        concurrent_limit: None,
+        concurrency_time_window_s: None,
+        cache_ttl: None,
+        dedicated_worker: None,
+        description: "".to_string(),
+        envs: vec![],
+        is_template: None,
+        kind: None,
+        summary: "".to_string(),
+        tag: None,
+        // What this client sends for "no schema".
+        schema: HashMap::new(),
+        ws_error_handler_muted: Some(false),
+        priority: None,
+        delete_after_secs: None,
+        timeout: None,
+        restart_unless_cancelled: None,
+        deployment_message: None,
+        concurrency_key: None,
+        visible_to_runner_only: None,
+        auto_kind: None,
+        codebase: None,
+        has_preprocessor: None,
+        on_behalf_of_email: None,
+        assets: vec![],
+        modules: None,
+    }
+}
+
+async fn head(db: &Pool<Postgres>) -> anyhow::Result<(i64, Value)> {
+    Ok(sqlx::query_as(
+        "SELECT hash, schema::jsonb FROM script \
+         WHERE workspace_id = 'test-workspace' AND path = $1 AND archived = false",
+    )
+    .bind(PATH)
+    .fetch_one(db)
+    .await?)
+}
+
+/// A deploy without a schema (MCP, a bare API call) gets the one the editor would
+/// have sent, and a new version keeps what the user wrote on the previous one's.
+#[sqlx::test(fixtures("base"))]
+async fn schemaless_deploy_infers_schema_keeping_annotations(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    let (client, _port, _s) = init_client(db.clone()).await;
+
+    client
+        .create_script(
+            "test-workspace",
+            &bun_ns(
+                "export function main(n: number, name = \"x\") { return n }",
+                None,
+            ),
+        )
+        .await?;
+    let (hash, schema) = head(&db).await?;
+    assert_eq!(schema["required"], json!(["n"]));
+    assert_eq!(schema["properties"]["n"]["type"], "number");
+    assert_eq!(schema["properties"]["name"]["default"], "x");
+
+    sqlx::query(
+        "UPDATE script SET schema = jsonb_set(schema::jsonb, '{properties,n,description}', \
+         '\"how many\"')::json WHERE hash = $1",
+    )
+    .bind(hash)
+    .execute(&db)
+    .await?;
+
+    client
+        .create_script(
+            "test-workspace",
+            &bun_ns(
+                "export function main(n: number, flag: boolean) { return n }",
+                Some(format!("{hash:016x}")),
+            ),
+        )
+        .await?;
+    let (hash, schema) = head(&db).await?;
+    assert_eq!(schema["required"], json!(["n", "flag"]));
+    assert_eq!(schema["properties"]["n"]["description"], "how many");
+    assert_eq!(schema["properties"]["flag"]["type"], "boolean");
+    assert!(schema["properties"].get("name").is_none());
+
+    // Code that does not parse keeps the schema rather than losing it for good.
+    client
+        .create_script(
+            "test-workspace",
+            &bun_ns(
+                "export function main(n: number {",
+                Some(format!("{hash:016x}")),
+            ),
+        )
+        .await?;
+    assert_eq!(head(&db).await?.1, schema);
+
+    Ok(())
+}
diff --git a/backend/tests/worker.rs b/backend/tests/worker.rs
index b8bd6b30a7..d7fb992280 100644
--- a/backend/tests/worker.rs
+++ b/backend/tests/worker.rs
@@ -5439,7 +5439,7 @@ async fn test_duckdb_ffi(db: Pool<Postgres>) -> anyhow::Result<()> {
 }
 
 /// Test that flow substeps with tags that are not available for the workspace fail.
-/// This validates that `check_tag_available_for_workspace_internal` is properly called
+/// This validates that `check_tag_available_for_push` is properly called
 /// when pushing jobs from worker_flow.
 #[sqlx::test(fixtures("base"))]
 #[serial]
@@ -5512,17 +5512,178 @@ async fn test_flow_substep_tag_availability_check(db: Pool<Postgres>) -> anyhow:
     Ok(())
 }
 
+/// A step's `$flow_expr[...]` tag is checked on the queue it resolves to, not on its text: the
+/// custom tags list `bun` alone, which admits the step resolving to it and refuses the one that
+/// lands elsewhere.
+#[cfg(feature = "deno_core")]
+#[sqlx::test(fixtures("base"))]
+#[serial]
+async fn test_flow_substep_tag_checked_on_resolved_value(db: Pool<Postgres>) -> anyhow::Result<()> {
+    use windmill_common::worker::{CustomTags, CUSTOM_TAGS_PER_WORKSPACE};
+
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+
+    CUSTOM_TAGS_PER_WORKSPACE.store(std::sync::Arc::new(CustomTags::from(vec![
+        "bun".to_string()
+    ])));
+
+    let step = |id: &str, tag: Option<&str>| {
+        json!({
+            "id": id,
+            "value": {
+                "type": "rawscript",
+                "language": "deno",
+                "content": "export function main() { return { lang: 'bun' } }",
+                "tag": tag,
+            },
+        })
+    };
+    let flow: FlowValue = serde_json::from_value(json!({
+        "modules": [
+            step("a", None),
+            step("b", Some("$flow_expr[results.a.lang]")),
+            step("c", Some("$flow_expr[results.a.lang]-gpu")),
+        ],
+    }))?;
+
+    // A non-superadmin, so the custom tags apply.
+    let job = RunJob::from(JobPayload::RawFlow { value: flow, path: None, restarted_from: None })
+        .as_user("test-user-2", "test2@windmill.dev")
+        .run_until_complete(&db, false, server.addr.port())
+        .await;
+    CUSTOM_TAGS_PER_WORKSPACE.store(std::sync::Arc::new(CustomTags::default()));
+
+    let b_tag = sqlx::query_scalar::<_, String>(
+        "SELECT tag FROM v2_job WHERE parent_job = $1 AND flow_step_id = 'b'",
+    )
+    .bind(job.id)
+    .fetch_one(&db)
+    .await?;
+    assert_eq!(b_tag, "bun");
+
+    assert!(!job.success);
+    let result = job.json_result().unwrap();
+    let message = result["error"]["message"].as_str().unwrap_or_default();
+    assert!(
+        message.contains("(resolved to bun-gpu) is not included in the allowed CUSTOM_TAGS"),
+        "got {result:?}"
+    );
+
+    Ok(())
+}
+
+/// A flow whose preprocessor runs lands on its tag filled in from the preprocessor's output, so
+/// running it judges the tag as written: even raw args that fill it in to a listed tag do not
+/// admit a template nobody listed.
+#[cfg(feature = "deno_core")]
+#[sqlx::test(fixtures("base", "hello"))]
+#[serial]
+async fn test_flow_tag_judged_as_written_before_preprocessor(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    use windmill_common::worker::{CustomTags, CUSTOM_TAGS_PER_WORKSPACE};
+
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let set_flow_tag = |tag: &'static str| {
+        let db = db.clone();
+        async move {
+            sqlx::query("UPDATE flow SET tag = $1 WHERE path = 'f/system/hello_with_preprocessor'")
+                .bind(tag)
+                .execute(&db)
+                .await?;
+            // Flow info is cached per version, which a real redeploy would bump.
+            windmill_common::FLOW_INFO_CACHE
+                .remove(&("test-workspace".to_string(), 1443253234253456));
+            anyhow::Ok(())
+        }
+    };
+    // As a non-superadmin, so the custom tags apply.
+    let run_as_user = |entries: &[&str], query: &str| {
+        CUSTOM_TAGS_PER_WORKSPACE.store(std::sync::Arc::new(CustomTags::from(
+            entries.iter().map(|e| e.to_string()).collect(),
+        )));
+        reqwest::Client::new()
+            .post(format!(
+                "http://localhost:{port}/api/w/test-workspace/jobs/run/f/f/system/hello_with_preprocessor{query}"
+            ))
+            .bearer_auth("SECRET_TOKEN_2")
+            .json(&json!({ "foo": "bar" }))
+            .send()
+    };
+
+    sqlx::query(
+        "UPDATE flow SET extra_perms = '{\"u/test-user-2\": false}'
+         WHERE path = 'f/system/hello_with_preprocessor'",
+    )
+    .execute(&db)
+    .await?;
+    set_flow_tag("pp-$args[foo]").await?;
+    let refused = run_as_user(&["pp-bar"], "").await?;
+    let refused_status = refused.status();
+    let refused_body = refused.text().await?;
+    // `push` drops a `?tag=` of such a flow, so it does not stand in for the flow's own tag.
+    let overridden = run_as_user(&["pp-bar"], "?tag=pp-bar").await?.status();
+    let admitted = run_as_user(&["pp-$args[foo]"], "").await?.status();
+    // A tag the preprocessor cannot change is known now, so patterns apply to it.
+    set_flow_tag("pp-large").await?;
+    let static_admitted = run_as_user(&["pp-$args[size]"], "").await?.status();
+
+    // Nothing a flow's tag can read resolves `$flow_expr[...]`, so the flow keeps its tag.
+    set_flow_tag("$flow_expr[flow_input.foo]").await?;
+    CUSTOM_TAGS_PER_WORKSPACE.store(std::sync::Arc::new(CustomTags::default()));
+    let unresolvable = RunJob::from(JobPayload::Flow {
+        path: "f/system/hello_with_preprocessor".to_string(),
+        dedicated_worker: None,
+        apply_preprocessor: true,
+        version: 1443253234253456,
+        labels: None,
+    })
+    .as_user("test-user-2", "test2@windmill.dev")
+    .run_until_complete(&db, false, port)
+    .await;
+
+    assert_eq!(refused_status, 400, "got {refused_body}");
+    assert!(
+        refused_body.contains("Tag pp-$args[foo] is not included"),
+        "got {refused_body}"
+    );
+    assert_eq!(overridden, 400);
+    assert!(admitted.is_success(), "got {admitted}");
+    assert!(static_admitted.is_success(), "got {static_admitted}");
+
+    assert!(unresolvable.success, "got {:?}", unresolvable.json_result());
+    let tag = sqlx::query_scalar::<_, String>("SELECT tag FROM v2_job WHERE id = $1")
+        .bind(unresolvable.id)
+        .fetch_one(&db)
+        .await?;
+    assert_eq!(tag, "flow");
+
+    Ok(())
+}
+
 /// The `*` fork marker only grants through a real `parent_workspace_id` lineage lookup, which the
 /// parse-level unit tests cannot reach: they hand `applies_to_workspace` a synthetic chain, so a
 /// regression in the lookup or in the `is_fork_scoped()` gate that skips it would pass them.
 #[sqlx::test(fixtures("base"))]
 #[serial]
 async fn test_fork_marker_tag_admission_through_lineage(db: Pool<Postgres>) -> anyhow::Result<()> {
-    use windmill_common::jobs::check_tag_available_for_workspace_internal;
     use windmill_common::worker::{CustomTags, CUSTOM_TAGS_PER_WORKSPACE};
 
     initialize_tracing().await;
 
+    // For a non-superadmin caller (a superadmin would bypass the scope check entirely).
+    async fn allowed(db: &Pool<Postgres>, w_id: &str, tag: &str) -> bool {
+        let no_args = std::collections::HashMap::new();
+        let args = windmill_queue::PushArgs::from(&no_args);
+        windmill_queue::check_tag_available_for_push(db, w_id, tag, &args, false, None)
+            .await
+            .is_ok()
+    }
+
     // The ancestor chain is cached process-wide by workspace id, so use one no other test takes.
     let fork = "wm-fork-tagmarker";
     sqlx::query!(
@@ -5538,27 +5699,18 @@ async fn test_fork_marker_tag_admission_through_lineage(db: Pool<Postgres>) -> a
         "bare(test-workspace)".to_string(),
     ])));
 
-    // A non-superadmin caller (a superadmin would bypass the scope check entirely).
-    let is_super_admin = false;
-
     for (w_id, tag) in [("test-workspace", "bare"), ("test-workspace", "forky")] {
         assert!(
-            check_tag_available_for_workspace_internal(&db, w_id, tag, is_super_admin, None)
-                .await
-                .is_ok(),
+            allowed(&db, w_id, tag).await,
             "{tag} should be available in the workspace it names"
         );
     }
     assert!(
-        check_tag_available_for_workspace_internal(&db, fork, "forky", is_super_admin, None)
-            .await
-            .is_ok(),
+        allowed(&db, fork, "forky").await,
         "a `*` tag must be granted to a fork through its parent lineage"
     );
     assert!(
-        check_tag_available_for_workspace_internal(&db, fork, "bare", is_super_admin, None)
-            .await
-            .is_err(),
+        !allowed(&db, fork, "bare").await,
         "an unmarked tag must not reach a fork of the workspace it names"
     );
 
@@ -5567,6 +5719,122 @@ async fn test_fork_marker_tag_admission_through_lineage(db: Pool<Postgres>) -> a
     Ok(())
 }
 
+/// A workspace-scoped pattern admits the tags in its range only from the workspaces its scope
+/// allows, and a tag listed by its own name with a scope stays inside that scope whatever pattern
+/// it fits. The fork lineage and `$workspace` are resolved for a matching pattern.
+#[sqlx::test(fixtures("base"))]
+#[serial]
+async fn test_scoped_custom_tag_pattern_admission(db: Pool<Postgres>) -> anyhow::Result<()> {
+    use windmill_common::worker::{CustomTags, CUSTOM_TAGS_PER_WORKSPACE};
+
+    initialize_tracing().await;
+
+    // For a non-superadmin caller (a superadmin would bypass the scope check entirely).
+    async fn check(db: &Pool<Postgres>, w_id: &str, tag: &str, size: &str) -> Result<(), String> {
+        let args = std::collections::HashMap::from([(
+            "size".to_string(),
+            serde_json::value::to_raw_value(size).unwrap(),
+        )]);
+        let args = windmill_queue::PushArgs::from(&args);
+        windmill_queue::check_tag_available_for_push(db, w_id, tag, &args, false, None)
+            .await
+            .map_err(|e| e.to_string())
+    }
+    async fn allowed(db: &Pool<Postgres>, w_id: &str, tag: &str, size: &str) -> bool {
+        check(db, w_id, tag, size).await.is_ok()
+    }
+    async fn allowed_as_written(db: &Pool<Postgres>, w_id: &str, tag: &str) -> bool {
+        windmill_common::jobs::check_tag_available_for_workspace_internal(
+            db,
+            w_id,
+            tag,
+            None,
+            std::future::ready(w_id.to_string()),
+            false,
+            None,
+        )
+        .await
+        .is_ok()
+    }
+
+    // The ancestor chain is cached process-wide by workspace id, so use one no other test takes.
+    let fork = "wm-fork-tagpattern";
+    sqlx::query!(
+        "INSERT INTO workspace (id, name, owner, parent_workspace_id)
+         VALUES ($1, $1, 'test-user', 'test-workspace')",
+        fork
+    )
+    .execute(&db)
+    .await?;
+
+    CUSTOM_TAGS_PER_WORKSPACE.store(std::sync::Arc::new(CustomTags::from(vec![
+        "gpu-$args[size]".to_string(),
+        "$args[size]-secret(test-workspace)".to_string(),
+        "gpu-secret(other)".to_string(),
+        "$workspace-$args[size](test-workspace*)".to_string(),
+        "urgent".to_string(),
+        "urgent(other)".to_string(),
+    ])));
+
+    let confined = check(&db, "test-workspace", "gpu-$args[size]", "secret").await;
+    let checks = [
+        (
+            "scoped pattern from its workspace",
+            allowed(&db, "test-workspace", "cpu-secret", "").await,
+        ),
+        (
+            "scoped pattern refused elsewhere",
+            !allowed(&db, "other", "cpu-secret", "").await,
+        ),
+        ("confined tag refused past the patterns it fits", confined.is_err()),
+        (
+            "global pattern for the tags nothing confines",
+            allowed(&db, "test-workspace", "gpu-large", "").await,
+        ),
+        (
+            "confined tag from its workspace",
+            allowed(&db, "other", "gpu-secret", "").await,
+        ),
+        // Listing the tag by name without a scope as well keeps it open everywhere.
+        (
+            "tag listed both globally and scoped",
+            allowed(&db, "test-workspace", "urgent", "").await,
+        ),
+        // The fork's `$workspace` is its parent's, whose tags its lineage reaches. Written as the
+        // resolved tag, not as the entry, so only the pattern can admit it.
+        (
+            "fork-scoped `$workspace` pattern from a fork",
+            allowed(&db, fork, "test-workspace-large", "").await,
+        ),
+        (
+            "fork-scoped `$workspace` pattern refused elsewhere",
+            !allowed(&db, "other", "$workspace-$args[size]", "large").await,
+        ),
+        (
+            "as written from its workspace",
+            allowed_as_written(&db, "test-workspace", "$args[size]-secret").await,
+        ),
+        (
+            "as written refused elsewhere",
+            !allowed_as_written(&db, "other", "$args[size]-secret").await,
+        ),
+    ];
+    CUSTOM_TAGS_PER_WORKSPACE.store(std::sync::Arc::new(CustomTags::default()));
+
+    for (what, ok) in checks {
+        assert!(ok, "{what}");
+    }
+    let confined = confined.unwrap_err();
+    assert!(
+        confined.contains("the custom tag gpu-secret(other) restricts it to other workspaces")
+            && confined.contains("gpu-$args[size]")
+            && confined.contains("$args[size]-secret(test-workspace)"),
+        "got {confined}"
+    );
+
+    Ok(())
+}
+
 #[cfg(all(feature = "quickjs", feature = "python"))]
 #[sqlx::test(fixtures("base"))]
 async fn test_whileloop_propagates_inner_iterator_eval_failure(
diff --git a/backend/windmill-ai/src/ai_types.rs b/backend/windmill-ai/src/ai_types.rs
index 69c8ac4538..599cf0cca3 100644
--- a/backend/windmill-ai/src/ai_types.rs
+++ b/backend/windmill-ai/src/ai_types.rs
@@ -210,7 +210,9 @@ pub fn validate_model_pricing_json(ai_config: &serde_json::Value) -> Result<(),
             return Err(format!("Price override for {} is not an object", key));
         };
         for field in ["input", "output", "cache_read", "cache_write"] {
-            let Some(rate) = price.get(field) else { continue };
+            let Some(rate) = price.get(field) else {
+                continue;
+            };
             let rate = rate
                 .as_f64()
                 .filter(|r| r.is_finite() && *r >= 0.0 && *r <= MAX_MODEL_RATE);
@@ -223,9 +225,98 @@ pub fn validate_model_pricing_json(ai_config: &serde_json::Value) -> Result<(),
         }
         for required in ["input", "output"] {
             if !price.contains_key(required) {
-                return Err(format!("Price override for {} is missing {}", key, required));
+                return Err(format!(
+                    "Price override for {} is missing {}",
+                    key, required
+                ));
             }
         }
     }
     Ok(())
 }
+
+// ============================================================================
+// Per-model token maps
+// ============================================================================
+
+/// One `provider:model` -> tokens map of the AI config, with the bounds the API
+/// documents for it. Both maps are validated the same way, so the bounds live here
+/// rather than at each call site.
+pub struct TokenMap {
+    pub field: &'static str,
+    pub label: &'static str,
+    pub min: i64,
+    pub max: i64,
+}
+
+/// The chat compacts its history as it nears the window, so a value below any real
+/// model's window would compact every turn; the ceiling is far above any shipped
+/// model and only catches typos.
+pub const CONTEXT_WINDOWS: TokenMap = TokenMap {
+    field: "context_window_per_model",
+    label: "Context window",
+    min: 1024,
+    max: 10_000_000,
+};
+
+/// The completion cap the chat asks the provider for.
+pub const OUTPUT_LIMITS: TokenMap =
+    TokenMap { field: "max_tokens_per_model", label: "Output limit", min: 1, max: 2_000_000 };
+
+pub const TOKEN_MAPS: [TokenMap; 2] = [CONTEXT_WINDOWS, OUTPUT_LIMITS];
+
+pub fn validate_token_limit(map: &TokenMap, key: &str, tokens: i64) -> Result<(), String> {
+    if (map.min..=map.max).contains(&tokens) {
+        Ok(())
+    } else {
+        Err(format!(
+            "{} for {} must be between {} and {} tokens",
+            map.label, key, map.min, map.max
+        ))
+    }
+}
+
+/// Bound these maps in the untyped instance AI config, for the reason given on
+/// `validate_model_pricing_json`.
+pub fn validate_token_maps_json(ai_config: &serde_json::Value) -> Result<(), String> {
+    for map in TOKEN_MAPS.iter() {
+        let entries = match ai_config.get(map.field) {
+            None | Some(serde_json::Value::Null) => continue,
+            Some(v) => v
+                .as_object()
+                .ok_or_else(|| format!("{} must be an object", map.field))?,
+        };
+        for (key, tokens) in entries {
+            let tokens = tokens
+                .as_i64()
+                .ok_or_else(|| format!("{} for {} must be an integer", map.label, key))?;
+            validate_token_limit(map, key, tokens)?;
+        }
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    #[test]
+    fn instance_token_maps_are_bounded_integers() {
+        assert!(validate_token_maps_json(&json!({})).is_ok());
+        for map in TOKEN_MAPS.iter() {
+            let entry = |value| json!({ map.field: { "customai:m": value } });
+            assert!(validate_token_maps_json(&entry(json!(map.min))).is_ok());
+            assert!(validate_token_maps_json(&entry(json!(map.max))).is_ok());
+            for bad in [
+                json!(map.min - 1),
+                json!(map.max + 1),
+                json!(4096.5),
+                json!("4096"),
+            ] {
+                assert!(validate_token_maps_json(&entry(bad)).is_err());
+            }
+            assert!(validate_token_maps_json(&json!({ map.field: [4096] })).is_err());
+        }
+    }
+}
diff --git a/backend/windmill-api-auth/src/auth.rs b/backend/windmill-api-auth/src/auth.rs
index 6e5aa6b1da..869f40e14c 100644
--- a/backend/windmill-api-auth/src/auth.rs
+++ b/backend/windmill-api-auth/src/auth.rs
@@ -1073,7 +1073,8 @@ fn no_auth_admin_authed() -> ApiAuthed {
 }
 
 /// Resolves OptJobAuthed from request parts.
-/// Takes ownership of Parts and returns them back.
+/// Takes ownership of Parts and returns them back, memoized into the extensions so a
+/// second extraction in the same request is free.
 #[allow(unreachable_code, unused_mut)]
 pub async fn resolve_opt_job_authed(
     mut parts: Parts,
@@ -1089,10 +1090,11 @@ pub async fn resolve_opt_job_authed(
         ));
     }
 
-    let already_authed = parts.extensions.get::<OptJobAuthed>().cloned();
-
-    if let Some(authed) = already_authed {
-        return Ok((authed, parts));
+    // Safe only while what the route checks below read is fixed before the first
+    // extraction: path and method always are, `workspace_id` only while every
+    // `GatewayWorkspaceId` writer stays layered outside auth extraction.
+    if let Some(opt_job_authed) = parts.extensions.get::<OptJobAuthed>().cloned() {
+        return Ok((opt_job_authed, parts));
     }
 
     let already_tokened = parts.extensions.get::<Tokened>().cloned();
@@ -1185,6 +1187,9 @@ pub async fn resolve_opt_job_authed(
                 if let Some(workspace_id) = workspace_id {
                     Span::current().record("workspace_id", &workspace_id);
                 }
+                // Separate from the ApiAuthed insert above, which handlers taking
+                // `Extension<ApiAuthed>` read.
+                parts.extensions.insert(opt_job_authed.clone());
                 return Ok((opt_job_authed, parts));
             }
         }
@@ -1311,3 +1316,69 @@ pub async fn list_tokens_internal(
 
     Ok(Json(tokens))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Dropping the `AUTH_CACHE` entry between the two resolutions is what makes a memo
+    /// hit observable: only a working memo can answer the second one.
+    #[tokio::test]
+    async fn resolve_opt_job_authed_is_memoized() {
+        // Never connected: an AUTH_CACHE hit resolves without a query, and AuthCache
+        // only needs the handle to exist. Without the timeout a regression — which
+        // falls through to a real lookup — spends sqlx's 30s default failing.
+        let db = sqlx::postgres::PgPoolOptions::new()
+            .acquire_timeout(std::time::Duration::from_millis(50))
+            .connect_lazy("postgres://memo@127.0.0.1:1/memo")
+            .expect("lazy pool");
+
+        let token = "memo_guard_token";
+        // Workspace-scoped: a job token on a workspace-less route is refused by
+        // check_job_token_for_global_route before the memo is ever taken.
+        let key = ("memo_workspace".to_string(), token.to_string());
+        let job_id = uuid::Uuid::from_u128(0x6d656d6f);
+        AUTH_CACHE.insert(
+            key.clone(),
+            ExpiringAuthCache {
+                authed: ApiAuthed {
+                    email: "memo@windmill.dev".to_string(),
+                    username: "memo".to_string(),
+                    ..Default::default()
+                },
+                expiry: chrono::Utc::now() + chrono::Duration::hours(1),
+                job_id: Some(job_id),
+            },
+        );
+
+        #[cfg(feature = "enterprise")]
+        let cache = AuthCache::new(db, None, None);
+        #[cfg(not(feature = "enterprise"))]
+        let cache = AuthCache::new(db, None);
+
+        let mut parts = http::Request::builder()
+            .uri("/api/w/memo_workspace/jobs/list")
+            .header(http::header::AUTHORIZATION, format!("Bearer {token}"))
+            .body(())
+            .unwrap()
+            .into_parts()
+            .0;
+        parts.extensions.insert(Arc::new(cache));
+
+        let (_, parts) = resolve_opt_job_authed(parts)
+            .await
+            .map_err(|(e, _)| e)
+            .expect("first resolution");
+
+        AUTH_CACHE.remove(&key);
+
+        let (second, _) = resolve_opt_job_authed(parts)
+            .await
+            .map_err(|(e, _)| e)
+            .expect("second resolution must hit the memo, not re-resolve");
+        assert_eq!(second.authed.username, "memo");
+        // The wrapper must survive whole: memoizing only the inner ApiAuthed and
+        // rebuilding around it drops the provenance forbid_elevated_job_token gates on.
+        assert_eq!(second.job_id, Some(job_id));
+    }
+}
diff --git a/backend/windmill-api-auth/src/lib.rs b/backend/windmill-api-auth/src/lib.rs
index 0e26c2a8b8..bb1586db68 100644
--- a/backend/windmill-api-auth/src/lib.rs
+++ b/backend/windmill-api-auth/src/lib.rs
@@ -1249,6 +1249,10 @@ pub async fn register_token_expiry_notification(
     if !windmill_common::auth::is_user_token(label) {
         return;
     }
+    let warning_days = windmill_common::auth::TOKEN_EXPIRY_WARNING_DAYS;
+    if expiration <= chrono::Utc::now() + chrono::Duration::days(warning_days.into()) {
+        return;
+    }
     if let Err(e) = sqlx::query!(
         "INSERT INTO token_expiry_notification (token_hash, expiration) VALUES ($1, $2) ON CONFLICT DO NOTHING",
         token_hash,
diff --git a/backend/windmill-api-flows/src/flows.rs b/backend/windmill-api-flows/src/flows.rs
index 5ac0e0588c..c7df69879e 100644
--- a/backend/windmill-api-flows/src/flows.rs
+++ b/backend/windmill-api-flows/src/flows.rs
@@ -51,7 +51,10 @@ use windmill_common::{
     jobs::JobPayload,
     schedule::Schedule,
     triggers::MovedNativeTrigger,
-    utils::{http_get_from_hub, not_found_if_none, paginate, Pagination, RunnableKind, StripPath},
+    utils::{
+        http_get_from_hub, not_found_if_none, paginate, paginate_optional, Pagination,
+        RunnableKind, StripPath,
+    },
 };
 use windmill_dep_map::scoped_dependency_map::ScopedDependencyMap;
 use windmill_git_sync::{handle_deployment_metadata, DeployedObject};
@@ -747,6 +750,14 @@ async fn create_flow(
         .execute(&mut *tx)
         .await?;
     }
+    windmill_common::user_drafts::clear_draft_moves_from(
+        &mut tx,
+        &w_id,
+        &[UserDraftItemKind::Flow],
+        &nf.path,
+        None,
+    )
+    .await?;
 
     audit_log(
         &mut *tx,
@@ -915,25 +926,36 @@ pub struct FlowVersion {
     pub created_at: chrono::DateTime<chrono::Utc>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub deployment_msg: Option<String>,
+    /// Who deployed this version — the diff's version picker names them so a reader
+    /// can tell their own deploys from a teammate's.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub created_by: Option<String>,
 }
 
 async fn get_flow_history(
     authed: ApiAuthed,
     Extension(user_db): Extension<UserDB>,
     Path((w_id, path)): Path<(String, StripPath)>,
+    Query(pagination): Query<Pagination>,
 ) -> JsonResult<Vec<FlowVersion>> {
     let path = path.to_path();
     check_scopes(&authed, || format!("flows:read:{}", path))?;
+    // Unasked-for, this listing stays whole: the history panels, the restart picker and
+    // the CLI all read it without paging. The diff picker asks for a page.
+    let (per_page, offset) = paginate_optional(pagination);
     let mut tx = user_db.begin(&authed).await?;
 
     let flows = sqlx::query_as!(
         FlowVersion,
-        "SELECT flow_version.id, flow_version.created_at, deployment_metadata.deployment_msg FROM flow_version 
+        "SELECT flow_version.id, flow_version.created_at, flow_version.created_by, deployment_metadata.deployment_msg FROM flow_version
         LEFT JOIN deployment_metadata ON flow_version.id = deployment_metadata.flow_version
-        WHERE flow_version.path = $1 AND flow_version.workspace_id = $2 
-        ORDER BY flow_version.created_at DESC",
+        WHERE flow_version.path = $1 AND flow_version.workspace_id = $2
+        ORDER BY flow_version.created_at DESC
+        LIMIT $3 OFFSET $4",
         path,
-        w_id
+        w_id,
+        per_page,
+        offset,
     )
     .fetch_all(&mut *tx)
     .await?;
@@ -953,7 +975,7 @@ async fn get_latest_version(
 
     let version = sqlx::query_as!(
         FlowVersion,
-        "SELECT flow_version.id, flow_version.created_at, deployment_metadata.deployment_msg FROM flow_version 
+        "SELECT flow_version.id, flow_version.created_at, flow_version.created_by, deployment_metadata.deployment_msg FROM flow_version 
         LEFT JOIN deployment_metadata ON flow_version.id = deployment_metadata.flow_version
         WHERE flow_version.path = $1 AND flow_version.workspace_id = $2 
         ORDER BY flow_version.created_at DESC",
@@ -1438,6 +1460,20 @@ async fn update_flow(
         .await?;
     }
 
+    if is_new_path {
+        // Everything left at the old path is a draft this deploy didn't consume
+        // — teammates' rows, and the deployer's own when the caller asked us to
+        // keep it. Carry them rather than strand them.
+        windmill_common::user_drafts::move_drafts_for_path(
+            &mut tx,
+            &w_id,
+            &[UserDraftItemKind::Flow],
+            flow_path,
+            &nf.path,
+        )
+        .await?;
+    }
+
     audit_log(
         &mut *tx,
         &authed,
diff --git a/backend/windmill-api-groups/src/folders.rs b/backend/windmill-api-groups/src/folders.rs
index 646f764ec6..c52b8a6316 100644
--- a/backend/windmill-api-groups/src/folders.rs
+++ b/backend/windmill-api-groups/src/folders.rs
@@ -800,6 +800,14 @@ async fn delete_folder(
 
     not_found_if_none(get_folderopt(&mut tx, &w_id, &name).await?, "Folder", &name)?;
 
+    // See the same call in `delete_group`: a freed name must not stay in a tenant list.
+    windmill_common::workspaces::remove_datatable_tenant_in_workspace(
+        &mut tx,
+        &w_id,
+        &format!("f/{name}"),
+    )
+    .await?;
+
     let del = sqlx::query_scalar!(
         "DELETE FROM folder WHERE name = $1 AND workspace_id = $2 RETURNING 1",
         name,
diff --git a/backend/windmill-api-groups/src/groups.rs b/backend/windmill-api-groups/src/groups.rs
index c931cf2255..0209af8585 100644
--- a/backend/windmill-api-groups/src/groups.rs
+++ b/backend/windmill-api-groups/src/groups.rs
@@ -797,6 +797,15 @@ async fn delete_group(
     }
     not_found_if_none(get_group_opt(&mut tx, &w_id, &name).await?, "Group", &name)?;
 
+    // A tenant list names a principal, so a freed name must not linger in one: a later group
+    // reusing it would silently inherit the data table access this one had.
+    windmill_common::workspaces::remove_datatable_tenant_in_workspace(
+        &mut tx,
+        &w_id,
+        &format!("g/{name}"),
+    )
+    .await?;
+
     sqlx::query!(
         "DELETE FROM usr_to_group WHERE group_ = $1 AND workspace_id = $2",
         name,
diff --git a/backend/windmill-api-integration-tests/tests/datatable_acl.rs b/backend/windmill-api-integration-tests/tests/datatable_acl.rs
new file mode 100644
index 0000000000..4310830ae2
--- /dev/null
+++ b/backend/windmill-api-integration-tests/tests/datatable_acl.rs
@@ -0,0 +1,108 @@
+//! Who may read and change a data table's grants and owners. On the Enterprise Edition: its
+//! administrators, from the workspace that governs it. Without it: nobody. Each refusal is decided
+//! before anything connects to the data table, so the fixture's database never has to exist.
+
+use serde_json::{json, Value};
+use sqlx::{Pool, Postgres};
+
+use windmill_test_utils::*;
+
+fn grant_select_on_public() -> Value {
+    json!({
+        "target": {"kind": "schema", "schema": "public"},
+        "change": {"type": "grant", "role": "analytics", "privileges": ["SELECT"],
+                   "scope": "all_tables"},
+        "statements": [r#"GRANT SELECT ON ALL TABLES IN SCHEMA "public" TO "analytics""#]
+    })
+}
+
+async fn post_acl(
+    port: u16,
+    w_id: &str,
+    action: &str,
+    token: &str,
+) -> anyhow::Result<reqwest::Response> {
+    Ok(reqwest::Client::new()
+        .post(format!(
+            "http://localhost:{port}/api/w/{w_id}/workspaces/datatable_acl/main/{action}"
+        ))
+        .header("Authorization", format!("Bearer {token}"))
+        .json(&grant_select_on_public())
+        .send()
+        .await?)
+}
+
+/// A fork reaches the data table through a pointer: it may use it, never change what each role may
+/// touch on it — not even as an admin of the fork.
+#[cfg(all(feature = "private", feature = "enterprise"))]
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn a_fork_cannot_change_access_on_the_data_table_it_points_at(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    for action in ["plan", "apply"] {
+        let resp = post_acl(port, "wm-fork-dt", action, "SECRET_TOKEN_2").await?;
+        assert_eq!(resp.status(), 401, "{action}: {}", resp.text().await?);
+    }
+    Ok(())
+}
+
+#[cfg(all(feature = "private", feature = "enterprise"))]
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn a_member_who_is_not_an_admin_cannot_change_access(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    for action in ["plan", "apply"] {
+        let resp = post_acl(port, "test-workspace", action, "SECRET_TOKEN_2").await?;
+        assert_eq!(resp.status(), 401, "{action}: {}", resp.text().await?);
+    }
+    Ok(())
+}
+
+/// Not even reading, and not even on a data table that is not under roles — which any member
+/// reaches, so only the edition stands between them and the instance's credentials.
+#[cfg(not(all(feature = "private", feature = "enterprise")))]
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn only_the_enterprise_edition_has_the_access_editor(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    sqlx::query(
+        "UPDATE workspace_settings
+         SET datatable = datatable #- '{datatables,main,permissions}'
+         WHERE workspace_id = 'test-workspace'",
+    )
+    .execute(&db)
+    .await?;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let read = reqwest::Client::new()
+        .get(format!(
+            "http://localhost:{port}/api/w/test-workspace/workspaces/datatable_acl/main?kind=database"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .send()
+        .await?;
+    let mut responses = vec![("read", read)];
+    for action in ["plan", "apply"] {
+        responses.push((
+            action,
+            post_acl(port, "test-workspace", action, "SECRET_TOKEN").await?,
+        ));
+    }
+    for (action, resp) in responses {
+        assert_eq!(resp.status(), 400, "{action}");
+        let body = resp.text().await?;
+        assert!(
+            body.contains("Data table roles are a Windmill Enterprise Edition feature"),
+            "{action}: {body}"
+        );
+    }
+    Ok(())
+}
diff --git a/backend/windmill-api-integration-tests/tests/datatable_roles.rs b/backend/windmill-api-integration-tests/tests/datatable_roles.rs
new file mode 100644
index 0000000000..4948a0098a
--- /dev/null
+++ b/backend/windmill-api-integration-tests/tests/datatable_roles.rs
@@ -0,0 +1,1758 @@
+//! Who may connect to a data table as which role, across the two shapes an entry can take: one
+//! that owns its database, and a fork's pointer at it.
+
+use serde_json::{json, Value};
+use sqlx::{Pool, Postgres};
+
+use windmill_test_utils::*;
+
+fn client() -> reqwest::Client {
+    reqwest::Client::new()
+}
+
+fn authed(builder: reqwest::RequestBuilder, token: &str) -> reqwest::RequestBuilder {
+    builder.header("Authorization", format!("Bearer {token}"))
+}
+
+/// The `analytics` role's tenant list as stored, so a cascade can be observed directly.
+async fn tenants(db: &Pool<Postgres>, w_id: &str) -> Vec<String> {
+    let value: Option<Value> = sqlx::query_scalar(
+        "SELECT datatable->'datatables'->'main'->'permissions'->'roles'->'role1'->'tenants'
+         FROM workspace_settings WHERE workspace_id = $1",
+    )
+    .bind(w_id)
+    .fetch_one(db)
+    .await
+    .unwrap();
+    serde_json::from_value(value.unwrap_or(json!([]))).unwrap()
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn freeing_a_principal_takes_its_datatable_tenant(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/test-workspace");
+
+    assert_eq!(
+        tenants(&db, "test-workspace").await,
+        vec!["u/test-user-2", "g/analysts", "f/finance"]
+    );
+
+    let resp = authed(
+        client().delete(format!("{base}/groups/delete/analysts")),
+        "SECRET_TOKEN",
+    )
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 200, "delete group: {}", resp.text().await?);
+
+    let resp = authed(
+        client().delete(format!("{base}/folders/delete/finance")),
+        "SECRET_TOKEN",
+    )
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 200, "delete folder: {}", resp.text().await?);
+
+    let resp = authed(
+        client().delete(format!("{base}/users/delete/test-user-2")),
+        "SECRET_TOKEN",
+    )
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 200, "delete user: {}", resp.text().await?);
+
+    // Leaving is the other way a membership ends, and there are two `/leave` routes — the one the
+    // UI and the generated client call is this one. A tenant left behind here comes back with the
+    // person on rejoin, or attaches to whoever takes the username next.
+    sqlx::query(
+        r#"UPDATE workspace_settings SET datatable = jsonb_set(datatable,
+             '{datatables,main,permissions,roles,role1,tenants}', '["u/test-user-3"]'::jsonb)
+           WHERE workspace_id = 'test-workspace'"#,
+    )
+    .execute(&db)
+    .await?;
+    let resp = authed(
+        client().post(format!("{base}/workspaces/leave")),
+        "SECRET_TOKEN_3",
+    )
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 200, "leave: {}", resp.text().await?);
+    // Nothing left naming a principal that no longer exists: a later group or account reusing one
+    // of those names must not inherit the access this one had.
+    assert!(
+        tenants(&db, "test-workspace").await.is_empty(),
+        "leaving kept the tenant: {:?}",
+        tenants(&db, "test-workspace").await
+    );
+    Ok(())
+}
+
+#[cfg(all(feature = "private", feature = "enterprise"))]
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn a_fork_uses_the_data_table_it_points_at_but_never_administers_it(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let fork = format!("http://localhost:{port}/api/w/wm-fork-dt/workspaces");
+
+    // `test-user-2` is an admin of the fork and a plain member of the parent. The roles they can
+    // use are the ones the parent's tenants give them there, not what their fork admin bit says.
+    let resp = authed(
+        client().get(format!("{fork}/datatable_usable_roles/main")),
+        "SECRET_TOKEN_2",
+    )
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 200);
+    let body: Value = resp.json().await?;
+    assert_eq!(body["roles"], json!(["analytics"]), "{body}");
+    assert_eq!(body["default_role"], "analytics");
+
+    // The drawer names the workspace that decides, and refuses to let the fork edit it.
+    let resp = authed(
+        client().get(format!("{fork}/datatable_permissions/main")),
+        "SECRET_TOKEN_2",
+    )
+    .send()
+    .await?;
+    let body: Value = resp.json().await?;
+    assert_eq!(body["governing_workspace_id"], "test-workspace");
+    assert_eq!(body["editable"], false, "{body}");
+
+    let resp = authed(
+        client().post(format!("{fork}/datatable_permissions/main")),
+        "SECRET_TOKEN_2",
+    )
+    .json(&json!({"permissioned": true, "default_role": "admin",
+                  "roles": [{"id": "admin", "tenants": ["*"]}]}))
+    .send()
+    .await?;
+    assert_eq!(
+        resp.status(),
+        401,
+        "a fork admin widened the parent's access"
+    );
+
+    // Nor by saving the settings form: the pointer is server-owned, so a payload naming the
+    // parent's database leaves the entry exactly as it was.
+    let resp = authed(
+        client().post(format!("{fork}/edit_datatable_config")),
+        "SECRET_TOKEN_2",
+    )
+    .json(&json!({
+        "settings": {"datatables": {"main": {
+            "database": {"resource_type": "instance", "resource_path": "dt_main"}
+        }}},
+        "renames": [], "deleted_datatables": []
+    }))
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 200, "{}", resp.text().await?);
+
+    let entry: Option<Value> = sqlx::query_scalar(
+        "SELECT datatable->'datatables'->'main' FROM workspace_settings WHERE workspace_id = $1",
+    )
+    .bind("wm-fork-dt")
+    .fetch_one(&db)
+    .await?;
+    let entry = entry.unwrap();
+    assert_eq!(
+        entry["reference"]["workspace_id"], "test-workspace",
+        "{entry}"
+    );
+    assert!(entry["database"].is_null(), "{entry}");
+    Ok(())
+}
+
+#[cfg(all(feature = "private", feature = "enterprise"))]
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn a_second_entry_on_the_same_database_is_reported_rather_than_governed(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    // A copy of the parent's entry, as a fork created before data table roles would hold. It keeps
+    // its own access, so the owner is told about it instead of being told it is covered.
+    sqlx::query(
+        r#"UPDATE workspace_settings SET datatable = '{"datatables": {"copy": {
+            "database": {"resource_type": "instance", "resource_path": "dt_main"}}}}'::jsonb
+           WHERE workspace_id = 'wm-fork-dt'"#,
+    )
+    .execute(&db)
+    .await?;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let resp = authed(
+        client().get(format!(
+            "http://localhost:{port}/api/w/test-workspace/workspaces/datatable_permissions/main"
+        )),
+        "SECRET_TOKEN",
+    )
+    .send()
+    .await?;
+    let body: Value = resp.json().await?;
+    assert_eq!(
+        body["ungoverned_reachers"],
+        json!([{"workspace_id": "wm-fork-dt", "datatable": "copy"}]),
+        "{body}"
+    );
+    Ok(())
+}
+
+#[cfg(all(feature = "private", feature = "enterprise"))]
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn a_resource_backed_data_table_cannot_be_put_under_roles(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    // A role is a login on Windmill's own cluster. A resource-backed data table dials a host the
+    // workspace admin chose, so accepting one here would hand that host a real cluster credential.
+    sqlx::query(
+        r#"UPDATE workspace_settings SET datatable = '{"datatables": {"byo": {
+            "database": {"resource_type": "postgresql", "resource_path": "u/test-user/pg"}}}}'::jsonb
+           WHERE workspace_id = 'test-workspace'"#,
+    )
+    .execute(&db)
+    .await?;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/test-workspace/workspaces");
+
+    let resp = authed(
+        client().get(format!("{base}/datatable_permissions/byo")),
+        "SECRET_TOKEN",
+    )
+    .send()
+    .await?;
+    let body: Value = resp.json().await?;
+    assert_eq!(body["supported"], false, "{body}");
+
+    let resp = authed(
+        client().post(format!("{base}/datatable_permissions/byo")),
+        "SECRET_TOKEN",
+    )
+    .json(&json!({"permissioned": true, "default_role": "role1",
+                  "roles": [{"id": "role1", "tenants": ["*"]}]}))
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 400, "{}", resp.text().await?);
+    Ok(())
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn a_fork_renaming_its_own_entry_leaves_the_governing_bookkeeping_alone(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    // The parent's migration definitions. A rename or delete through the fork's settings form
+    // resolves through the pointer, so without a guard it would relabel or wipe these.
+    sqlx::query(
+        "INSERT INTO datatable_migrations (workspace_id, datatable, timestamp, name, code_up)
+         VALUES ('test-workspace', 'main', 1, 'init', 'SELECT 1')",
+    )
+    .execute(&db)
+    .await?;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let resp = authed(
+        client().post(format!(
+            "http://localhost:{port}/api/w/wm-fork-dt/workspaces/edit_datatable_config"
+        )),
+        "SECRET_TOKEN_2",
+    )
+    .json(&json!({
+        "settings": {"datatables": {}},
+        "renames": [],
+        "deleted_datatables": ["main"]
+    }))
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 200, "{}", resp.text().await?);
+
+    let left: i64 = sqlx::query_scalar(
+        "SELECT COUNT(*) FROM datatable_migrations WHERE workspace_id = 'test-workspace'",
+    )
+    .fetch_one(&db)
+    .await?;
+    assert_eq!(left, 1, "the fork's delete reached the parent's migrations");
+    Ok(())
+}
+
+#[cfg(all(feature = "private", feature = "enterprise"))]
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn a_caller_who_is_not_a_member_of_the_governing_workspace_reaches_nothing(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    // A fork member who was never added to the parent. Their fork membership says nothing there,
+    // and the email lookup that would evaluate them as a member of it finds no row.
+    sqlx::query(
+        "INSERT INTO usr (workspace_id, email, username, is_admin, role)
+         VALUES ('wm-fork-dt', 'test3@windmill.dev', 'test-user-3', false, 'User')",
+    )
+    .execute(&db)
+    .await?;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let resp = authed(
+        client().get(format!(
+            "http://localhost:{port}/api/w/wm-fork-dt/workspaces/datatable_usable_roles/main"
+        )),
+        "SECRET_TOKEN_3",
+    )
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 200);
+    let body: Value = resp.json().await?;
+    assert_eq!(body["roles"], json!([]), "{body}");
+    Ok(())
+}
+
+#[cfg(all(feature = "private", feature = "enterprise"))]
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn a_caller_with_no_identity_reaches_a_permissioned_data_table_not_at_all(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    use windmill_common::workspaces::{get_datatable_resource_from_db, DatatableAccess};
+
+    initialize_tracing().await;
+    // The compatibility story for an agent worker that predates data table roles and sends no job
+    // id: it keeps resolving an unpermissioned data table, and is refused on a permissioned one
+    // rather than handed an unattributed admin connection.
+    let refused = get_datatable_resource_from_db(
+        &db,
+        "test-workspace",
+        "main",
+        None,
+        DatatableAccess::NoIdentity,
+    )
+    .await;
+    assert!(refused.is_err(), "an unidentified caller was let in");
+
+    sqlx::query(
+        "UPDATE workspace_settings
+         SET datatable = datatable #- '{datatables,main,permissions}'
+         WHERE workspace_id = 'test-workspace'",
+    )
+    .execute(&db)
+    .await?;
+    let resolved = get_datatable_resource_from_db(
+        &db,
+        "test-workspace",
+        "main",
+        None,
+        DatatableAccess::NoIdentity,
+    )
+    .await?;
+    assert_eq!(resolved["dbname"], "dt_main", "{resolved}");
+    Ok(())
+}
+
+#[cfg(all(feature = "private", feature = "enterprise"))]
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn concurrent_role_creations_both_survive(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    // Postgres roles are cluster-wide and this cluster is shared with every other test database,
+    // so the names have to be unique to this run.
+    let suffix: String = uuid::Uuid::new_v4().simple().to_string()[..8].to_string();
+    let names = [format!("wmtest_a_{suffix}"), format!("wmtest_b_{suffix}")];
+
+    // The cluster DDL is not visible to another transaction until commit, so without the lock both
+    // of these pass their `pg_roles` existence check and one loses — leaving a live cluster login
+    // the catalog never recorded.
+    let create = |name: String| async move {
+        let resp = authed(
+            client().post(format!(
+                "http://localhost:{port}/api/settings/datatable_roles"
+            )),
+            "SECRET_TOKEN",
+        )
+        .json(&json!({ "name": name }))
+        .send()
+        .await?;
+        let status = resp.status();
+        let body = resp.text().await?;
+        Ok::<_, anyhow::Error>((status, body))
+    };
+    let outcome = async {
+        let (a, b) = tokio::join!(create(names[0].clone()), create(names[1].clone()));
+        let (a, b) = (a?, b?);
+        assert_eq!(a.0, 200, "{}", a.1);
+        assert_eq!(b.0, 200, "{}", b.1);
+
+        let catalog = windmill_common::datatable_roles::read_role_catalog(&db).await?;
+        let recorded: Vec<&str> = catalog.values().map(|r| r.name.as_str()).collect();
+        for name in &names {
+            assert!(
+                recorded.contains(&name.as_str()),
+                "{name} is a live cluster login the catalog forgot: {recorded:?}"
+            );
+        }
+        Ok::<_, anyhow::Error>(())
+    }
+    .await;
+
+    // Roles are cluster-wide, so they outlive this test's throwaway database. Dropped whatever
+    // happened above — a failing run is exactly the one that created them and did not record them.
+    for name in &names {
+        let _ = sqlx::query(&format!("DROP ROLE IF EXISTS \"{name}\""))
+            .execute(&db)
+            .await;
+    }
+    outcome
+}
+
+#[cfg(all(feature = "private", feature = "enterprise"))]
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn a_role_delete_that_fails_part_way_leaves_the_role_disabled(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let suffix: String = uuid::Uuid::new_v4().simple().to_string()[..8].to_string();
+    let name = format!("wmtest_del_{suffix}");
+
+    let outcome = async {
+        let created: Value = authed(
+            client().post(format!(
+                "http://localhost:{port}/api/settings/datatable_roles"
+            )),
+            "SECRET_TOKEN",
+        )
+        .json(&json!({ "name": name }))
+        .send()
+        .await?
+        .error_for_status()?
+        .json()
+        .await?;
+        let id = created["id"].as_str().unwrap().to_string();
+
+        // Each database's pass commits on its own, so one that cannot be reached fails the delete
+        // after the others may already have stripped the role.
+        sqlx::query(
+            "UPDATE global_settings SET value = jsonb_set(value, '{databases,wm_unreachable}', '{}')
+             WHERE name = 'custom_instance_pg_databases'",
+        )
+        .execute(&db)
+        .await?;
+
+        let resp = authed(
+            client().delete(format!(
+                "http://localhost:{port}/api/settings/datatable_roles/{id}"
+            )),
+            "SECRET_TOKEN",
+        )
+        .send()
+        .await?;
+        let status = resp.status();
+        let body = resp.text().await?;
+        assert_eq!(status, 400, "{body}");
+
+        let catalog = windmill_common::datatable_roles::read_role_catalog(&db).await?;
+        let role = catalog
+            .get(&id)
+            .expect("a failed delete keeps the entry to retry");
+        assert!(
+            !role.enabled,
+            "a half-deleted role is still enabled in the catalog"
+        );
+        let can_login: bool =
+            sqlx::query_scalar("SELECT rolcanlogin FROM pg_roles WHERE rolname = $1")
+                .bind(&name)
+                .fetch_one(&db)
+                .await?;
+        assert!(!can_login, "a half-deleted role can still log in");
+        Ok::<_, anyhow::Error>(())
+    }
+    .await;
+
+    let _ = sqlx::query(&format!("DROP ROLE IF EXISTS \"{name}\""))
+        .execute(&db)
+        .await;
+    outcome
+}
+
+#[cfg(all(feature = "private", feature = "enterprise"))]
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn renaming_a_governing_data_table_carries_its_forks(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    // A pointer names the governing data table by name, so a rename that does not follow leaves
+    // every fork resolving to nothing — the data table vanishes from their pickers and their jobs
+    // stop, with nothing in the renaming workspace to suggest why.
+    let resp = authed(
+        client().post(format!(
+            "http://localhost:{port}/api/w/test-workspace/workspaces/edit_datatable_config"
+        )),
+        "SECRET_TOKEN",
+    )
+    .json(&json!({
+        "settings": {"datatables": {"renamed": {
+            "database": {"resource_type": "instance", "resource_path": "dt_main"}
+        }}},
+        "renames": [{"from": "main", "to": "renamed"}],
+        "deleted_datatables": []
+    }))
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 200, "{}", resp.text().await?);
+
+    let entry: Option<Value> = sqlx::query_scalar(
+        "SELECT datatable->'datatables'->'main' FROM workspace_settings WHERE workspace_id = $1",
+    )
+    .bind("wm-fork-dt")
+    .fetch_one(&db)
+    .await?;
+    let entry = entry.unwrap();
+    assert_eq!(entry["reference"]["datatable"], "renamed", "{entry}");
+
+    // And it still resolves, which is the thing the fork actually cares about.
+    let resp = authed(
+        client().get(format!(
+            "http://localhost:{port}/api/w/wm-fork-dt/workspaces/datatable_usable_roles/main"
+        )),
+        "SECRET_TOKEN_2",
+    )
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 200, "{}", resp.text().await?);
+    Ok(())
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn a_rename_has_to_match_the_save_it_claims_to_describe(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let url =
+        format!("http://localhost:{port}/api/w/test-workspace/workspaces/edit_datatable_config");
+
+    let instance =
+        |path: &str| json!({"database": {"resource_type": "instance", "resource_path": path}});
+
+    // Fork pointers are rewritten from the rename list, so a rename nobody performed moves every
+    // fork of one data table onto another. `main` survives this save, so it was not renamed.
+    let resp = authed(client().post(&url), "SECRET_TOKEN")
+        .json(&json!({
+            "settings": {"datatables": {"main": instance("dt_main"), "decoy": instance("dt_two")}},
+            "renames": [{"from": "main", "to": "decoy"}],
+            "deleted_datatables": []
+        }))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 400, "a forged rename was accepted");
+
+    let entry: Option<Value> = sqlx::query_scalar(
+        "SELECT datatable->'datatables'->'main'->'reference' FROM workspace_settings
+         WHERE workspace_id = $1",
+    )
+    .bind("wm-fork-dt")
+    .fetch_one(&db)
+    .await?;
+    assert_eq!(
+        entry.unwrap()["datatable"],
+        "main",
+        "the fork was repointed anyway"
+    );
+
+    // A swap is two renames whose sources and targets cross. It cannot be done one at a time —
+    // `datatables` is keyed by name — so refusing it would be a regression, and applying the two
+    // in order without a temporary name would carry `main`'s pointers back to `main`.
+    let resp = authed(client().post(&url), "SECRET_TOKEN")
+        .json(&json!({
+            "settings": {"datatables": {"main": instance("dt_two"), "other": instance("dt_main")}},
+            "renames": [{"from": "main", "to": "other"}, {"from": "other", "to": "main"}],
+            "deleted_datatables": []
+        }))
+        .send()
+        .await?;
+    // `other` does not exist yet, so this particular pair is still refused — the swap shape is
+    // covered by the pair below, which starts from two real data tables.
+    assert_eq!(resp.status(), 400, "{}", resp.text().await?);
+
+    sqlx::query(
+        r#"UPDATE workspace_settings SET datatable = jsonb_set(datatable, '{datatables,other}',
+             '{"database": {"resource_type": "instance", "resource_path": "dt_two"}}'::jsonb)
+           WHERE workspace_id = 'test-workspace'"#,
+    )
+    .execute(&db)
+    .await?;
+
+    let resp = authed(client().post(&url), "SECRET_TOKEN")
+        .json(&json!({
+            "settings": {"datatables": {"main": instance("dt_two"), "other": instance("dt_main")}},
+            "renames": [{"from": "main", "to": "other"}, {"from": "other", "to": "main"}],
+            "deleted_datatables": []
+        }))
+        .send()
+        .await?;
+    assert_eq!(
+        resp.status(),
+        200,
+        "a swap was refused: {}",
+        resp.text().await?
+    );
+
+    // The fork named `main`, which is now called `other`.
+    let entry: Option<Value> = sqlx::query_scalar(
+        "SELECT datatable->'datatables'->'main'->'reference' FROM workspace_settings
+         WHERE workspace_id = $1",
+    )
+    .bind("wm-fork-dt")
+    .fetch_one(&db)
+    .await?;
+    assert_eq!(
+        entry.unwrap()["datatable"],
+        "other",
+        "the swap did not carry the pointer"
+    );
+    Ok(())
+}
+
+async fn database_exists(db: &Pool<Postgres>, name: &str) -> anyhow::Result<bool> {
+    Ok(
+        sqlx::query_scalar("SELECT EXISTS (SELECT 1 FROM pg_database WHERE datname = $1)")
+            .bind(name)
+            .fetch_one(db)
+            .await?,
+    )
+}
+
+async fn workspace_exists(db: &Pool<Postgres>, id: &str) -> anyhow::Result<bool> {
+    Ok(
+        sqlx::query_scalar("SELECT EXISTS (SELECT 1 FROM workspace WHERE id = $1)")
+            .bind(id)
+            .fetch_one(db)
+            .await?,
+    )
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn a_data_table_under_roles_is_cloned_only_with_its_grants(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    // The database a fork's copy of `main` goes into is named after the fork. Every request below
+    // is refused before it is created, so the cluster-wide name never collides with a sibling run.
+    let target = "wm_fork_copy__main";
+    let fork = |token: &str, forked: Value| {
+        authed(
+            client().post(format!(
+                "http://localhost:{port}/api/w/test-workspace/workspaces/create_fork"
+            )),
+            token,
+        )
+        .json(&json!({"id": "wm-fork-copy", "name": "copy", "forked_datatables": [forked]}))
+    };
+
+    // Rows are a workspace admin's to copy, as they were before roles.
+    let resp = fork(
+        "SECRET_TOKEN_2",
+        json!({"name": "main", "new_dbname": target, "fork_behavior": "schema_and_data"}),
+    )
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 403, "{}", resp.text().await?);
+    assert!(!database_exists(&db, target).await?);
+
+    // Even the schema alone lists every table, which a member covered by no role cannot read in
+    // the parent.
+    let resp = fork(
+        "SECRET_TOKEN_3",
+        json!({"name": "main", "new_dbname": target, "fork_behavior": "schema_only"}),
+    )
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 401, "{}", resp.text().await?);
+    assert!(!database_exists(&db, target).await?);
+
+    // Refused in the first phase too, before a git branch is created for a fork that cannot be.
+    let resp = authed(
+        client().post(format!(
+            "http://localhost:{port}/api/w/test-workspace/workspaces/create_workspace_fork_branch"
+        )),
+        "SECRET_TOKEN_3",
+    )
+    .json(
+        &json!({"id": "wm-fork-copy", "name": "copy", "forked_datatables": [
+            {"name": "main", "new_dbname": target, "fork_behavior": "schema_only"}
+        ]}),
+    )
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 401, "{}", resp.text().await?);
+
+    // A database the request did not create — whatever the data table, under roles or not — may be
+    // a copy left behind by a deleted fork, which the entry would reach without its governance.
+    let resp = fork(
+        "SECRET_TOKEN",
+        json!({"name": "other", "new_dbname": "wm_fork_copy__other"}),
+    )
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 400);
+    assert!(
+        resp.text().await?.contains("fork_behavior"),
+        "a database the fork did not create was taken"
+    );
+    assert!(!workspace_exists(&db, "wm-fork-copy").await?);
+
+    // The copy an admin asks for goes ahead in an edition that replays grants, and is refused
+    // before any database exists in one that does not. The fixture's database does not exist, so
+    // the dump fails either way — and leaves neither a database nor a fork behind.
+    let resp = fork(
+        "SECRET_TOKEN",
+        json!({"name": "main", "new_dbname": target, "fork_behavior": "schema_only"}),
+    )
+    .send()
+    .await?;
+    assert_ne!(resp.status(), 200);
+    let body = resp.text().await?;
+    #[cfg(all(feature = "private", feature = "enterprise"))]
+    assert!(body.contains("pg_dump"), "{body}");
+    #[cfg(not(all(feature = "private", feature = "enterprise")))]
+    assert!(body.contains("Enterprise Edition"), "{body}");
+    assert!(!database_exists(&db, target).await?);
+    assert!(!workspace_exists(&db, "wm-fork-copy").await?);
+    Ok(())
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn a_clone_takes_its_roles_from_the_data_table_it_was_cloned_from(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    sqlx::query(
+        r#"UPDATE workspace_settings SET datatable = jsonb_set(datatable, '{datatables,copy}', '{
+               "database": {"resource_type": "instance", "resource_path": "wm_fork_dt__copy"},
+               "governed_by": {"workspace_id": "test-workspace", "datatable": "main"},
+               "forked_from": {}
+           }'::jsonb) WHERE workspace_id = 'wm-fork-dt'"#,
+    )
+    .execute(&db)
+    .await?;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let fork = format!("http://localhost:{port}/api/w/wm-fork-dt/workspaces");
+
+    // `test-user-2` administers the fork, and is only a tenant of `analytics` in the parent.
+    let resp = authed(
+        client().get(format!("{fork}/datatable_usable_roles/copy")),
+        "SECRET_TOKEN_2",
+    )
+    .send()
+    .await?;
+    let body: Value = resp.json().await?;
+    assert_eq!(body["roles"], json!(["analytics"]), "{body}");
+
+    let resp = authed(
+        client().get(format!("{fork}/datatable_permissions/copy")),
+        "SECRET_TOKEN_2",
+    )
+    .send()
+    .await?;
+    let body: Value = resp.json().await?;
+    assert_eq!(body["editable"], false, "{body}");
+    assert_eq!(body["clone_of"]["workspace_id"], "test-workspace", "{body}");
+
+    // Nobody changes a clone's roles, a superadmin included: they are the source's.
+    for token in ["SECRET_TOKEN_2", "SECRET_TOKEN"] {
+        let resp = authed(
+            client().post(format!("{fork}/datatable_permissions/copy")),
+            token,
+        )
+        .json(&json!({"permissioned": false}))
+        .send()
+        .await?;
+        assert_eq!(resp.status(), 400, "{token} changed a clone's roles");
+    }
+
+    // A settings save cannot clear the link.
+    let resp = authed(
+        client().post(format!("{fork}/edit_datatable_config")),
+        "SECRET_TOKEN_2",
+    )
+    .json(&json!({
+        "settings": {"datatables": {"main": {}, "copy": {
+            "database": {"resource_type": "instance", "resource_path": "wm_fork_dt__copy"}
+        }}},
+        "renames": [], "deleted_datatables": []
+    }))
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 200, "{}", resp.text().await?);
+    let governed_by: Option<Value> = sqlx::query_scalar(
+        "SELECT datatable->'datatables'->'copy'->'governed_by' FROM workspace_settings
+         WHERE workspace_id = 'wm-fork-dt'",
+    )
+    .fetch_one(&db)
+    .await?;
+    assert_eq!(governed_by.unwrap()["datatable"], "main");
+
+    // Nor move it, a superadmin included: its grants were replayed into that database alone.
+    let resp = authed(
+        client().post(format!("{fork}/edit_datatable_config")),
+        "SECRET_TOKEN",
+    )
+    .json(&json!({
+        "settings": {"datatables": {"main": {}, "copy": {
+            "database": {"resource_type": "instance", "resource_path": "wm_fork_dt__elsewhere"}
+        }}},
+        "renames": [], "deleted_datatables": []
+    }))
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 400, "{}", resp.text().await?);
+
+    // Nor reach its database through a second entry without roles, which would connect as `admin`.
+    let resp = authed(
+        client().post(format!(
+            "http://localhost:{port}/api/w/test-workspace/workspaces/edit_datatable_config"
+        )),
+        "SECRET_TOKEN",
+    )
+    .json(&json!({
+        "settings": {"datatables": {
+            "main": {"database": {"resource_type": "instance", "resource_path": "dt_main"}},
+            "alias": {"database": {"resource_type": "instance", "resource_path": "wm_fork_dt__copy"}}
+        }},
+        "renames": [], "deleted_datatables": []
+    }))
+    .send()
+    .await?;
+    let status = resp.status();
+    let body = resp.text().await?;
+    assert_eq!(status, 400, "{body}");
+    assert!(body.contains("without carrying those roles"), "{body}");
+    Ok(())
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn a_data_table_under_roles_is_not_copied_without_its_grants(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let resp = authed(
+        client().post(format!(
+            "http://localhost:{port}/api/w/test-workspace/workspaces/create_pg_database"
+        )),
+        "SECRET_TOKEN",
+    )
+    .json(&json!({"source": "datatable://main", "target_dbname": "wm_fork_dt_copy"}))
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 400);
+    assert!(
+        resp.text().await?.contains("under roles"),
+        "the fork's database was created for a copy that cannot happen"
+    );
+
+    let resp = authed(
+        client().post(format!(
+            "http://localhost:{port}/api/w/test-workspace/workspaces/import_pg_database"
+        )),
+        "SECRET_TOKEN",
+    )
+    .json(
+        &json!({"source": "datatable://main", "target": "datatable://main",
+                  "fork_behavior": "schema_only"}),
+    )
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 400);
+    assert!(
+        resp.text().await?.contains("under roles"),
+        "the copy was refused for some other reason"
+    );
+    Ok(())
+}
+
+/// The fork's `forked_from` for one of its entries; `None` whether it is absent or `null`.
+async fn forked_from_of(db: &Pool<Postgres>, name: &str) -> Option<Value> {
+    sqlx::query_scalar::<_, Option<Value>>(
+        "SELECT datatable->'datatables'->$1::text->'forked_from'
+         FROM workspace_settings WHERE workspace_id = 'wm-fork-dt'",
+    )
+    .bind(name)
+    .fetch_one(db)
+    .await
+    .unwrap()
+    .filter(|v| !v.is_null())
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn a_clone_stamp_is_carried_but_its_schema_baseline_advances(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    // Whether an entry is a clone is what marks its database droppable, so a save can neither
+    // stamp nor unstamp one. The schema baseline inside the stamp is what the fork's schema diff
+    // advances after applying a change; dropping it would offer that same change again.
+    sqlx::query(
+        r#"UPDATE workspace_settings SET datatable = '{"datatables": {
+             "clone": {"database": {"resource_type": "instance", "resource_path": "wm_fork_dt__clone"},
+                       "forked_from": {"schema": {}}},
+             "plain": {"database": {"resource_type": "instance", "resource_path": "dt_plain"}}}}'::jsonb
+           WHERE workspace_id = 'wm-fork-dt'"#,
+    )
+    .execute(&db)
+    .await?;
+    let server = ApiServer::start(db.clone()).await?;
+    let url = format!(
+        "http://localhost:{}/api/w/wm-fork-dt/workspaces/edit_datatable_config",
+        server.addr.port()
+    );
+    let clone_db = json!({"resource_type": "instance", "resource_path": "wm_fork_dt__clone"});
+    let plain_db = json!({"resource_type": "instance", "resource_path": "dt_plain"});
+    let baseline = json!({"schema": {"public": {"orders": {"id": "int4"}}}});
+
+    let resp = authed(client().post(&url), "SECRET_TOKEN_2")
+        .json(&json!({"settings": {"datatables": {
+            "clone": {"database": clone_db, "forked_from": baseline},
+            "plain": {"database": plain_db, "forked_from": {"schema": {}}}
+        }}}))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 200, "{}", resp.text().await?);
+    assert_eq!(
+        forked_from_of(&db, "clone").await,
+        Some(baseline.clone()),
+        "the schema diff's baseline did not advance"
+    );
+    assert_eq!(
+        forked_from_of(&db, "plain").await,
+        None,
+        "a save stamped a clone"
+    );
+
+    let resp = authed(client().post(&url), "SECRET_TOKEN_2")
+        .json(&json!({"settings": {"datatables": {
+            "clone": {"database": clone_db}, "plain": {"database": plain_db}
+        }}}))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 200, "{}", resp.text().await?);
+    assert_eq!(
+        forked_from_of(&db, "clone").await,
+        Some(baseline),
+        "a save unstamped a clone"
+    );
+    Ok(())
+}
+
+#[cfg(all(feature = "private", feature = "enterprise"))]
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn roles_cannot_be_turned_on_while_a_trigger_streams_the_data_table(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    // A replication stream reads every row whatever the roles grant, so a data table carries one
+    // or the other. An enabled trigger on it — here a fork's, through its pointer — keeps roles
+    // from being turned on, and disabling it is what lets them on.
+    sqlx::query(
+        "UPDATE workspace_settings SET datatable = datatable #- '{datatables,main,permissions}'
+         WHERE workspace_id = 'test-workspace'",
+    )
+    .execute(&db)
+    .await?;
+    sqlx::query(
+        r#"INSERT INTO postgres_trigger (path, script_path, is_flow, workspace_id, edited_by,
+             postgres_resource_path, replication_slot_name, publication_name, permissioned_as, mode)
+           VALUES ('u/test-user-2/fork_stream', 'u/test-user-2/s', false, 'wm-fork-dt',
+                   'test-user-2', 'datatable://main', 'slot_fork', 'pub_fork', 'u/test-user-2',
+                   'enabled')"#,
+    )
+    .execute(&db)
+    .await?;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let url = format!(
+        "http://localhost:{}/api/w/test-workspace/workspaces/datatable_permissions/main",
+        server.addr.port()
+    );
+    let turn_on = json!({"permissioned": true, "default_role": "admin",
+                         "roles": [{"id": "admin", "tenants": ["*"]}]});
+
+    let resp = authed(client().post(&url), "SECRET_TOKEN")
+        .json(&turn_on)
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 400);
+    assert!(
+        resp.text()
+            .await?
+            .contains("wm-fork-dt/u/test-user-2/fork_stream"),
+        "the refusal does not name the trigger to disable"
+    );
+
+    // Disabled, but its listener pinged just now and stops only at its next heartbeat.
+    sqlx::query(
+        "UPDATE postgres_trigger SET mode = 'disabled', server_id = NULL, last_server_ping = now()
+         WHERE path = 'u/test-user-2/fork_stream'",
+    )
+    .execute(&db)
+    .await?;
+    let resp = authed(client().post(&url), "SECRET_TOKEN")
+        .json(&turn_on)
+        .send()
+        .await?;
+    assert_eq!(
+        resp.status(),
+        400,
+        "roles went on while a disabled trigger's listener was still attached: {}",
+        resp.text().await?
+    );
+
+    sqlx::query(
+        "UPDATE postgres_trigger SET last_server_ping = now() - interval '20 seconds'
+         WHERE path = 'u/test-user-2/fork_stream'",
+    )
+    .execute(&db)
+    .await?;
+    let resp = authed(client().post(&url), "SECRET_TOKEN")
+        .json(&turn_on)
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 200, "{}", resp.text().await?);
+    Ok(())
+}
+
+#[cfg(all(feature = "private", feature = "enterprise"))]
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn roles_going_on_wait_for_a_trigger_being_enabled(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    sqlx::query(
+        "UPDATE workspace_settings SET datatable = datatable #- '{datatables,main,permissions}'
+         WHERE workspace_id = 'test-workspace'",
+    )
+    .execute(&db)
+    .await?;
+
+    // A trigger enable in flight: it holds the stream lock and its row is not committed yet, so a
+    // roles save that looked for streams now would miss it and its listener would connect to a
+    // data table it is about to be refused.
+    let mut enabling = db.begin().await?;
+    windmill_common::datatable_roles::lock_datatable_streams(&mut *enabling, false).await?;
+    sqlx::query(
+        r#"INSERT INTO postgres_trigger (path, script_path, is_flow, workspace_id, edited_by,
+             postgres_resource_path, replication_slot_name, publication_name, permissioned_as, mode)
+           VALUES ('u/test-user-2/racing_stream', 'u/test-user-2/s', false, 'wm-fork-dt',
+                   'test-user-2', 'datatable://main', 'slot_race', 'pub_race', 'u/test-user-2',
+                   'enabled')"#,
+    )
+    .execute(&mut *enabling)
+    .await?;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let url = format!(
+        "http://localhost:{}/api/w/test-workspace/workspaces/datatable_permissions/main",
+        server.addr.port()
+    );
+    let save = tokio::spawn(
+        authed(client().post(&url), "SECRET_TOKEN")
+            .json(&json!({"permissioned": true, "default_role": "admin",
+                          "roles": [{"id": "admin", "tenants": ["*"]}]}))
+            .send(),
+    );
+    tokio::time::sleep(std::time::Duration::from_millis(500)).await;
+    assert!(
+        !save.is_finished(),
+        "roles went on while a trigger was being enabled"
+    );
+    enabling.commit().await?;
+
+    let resp = save.await??;
+    assert_eq!(resp.status(), 400);
+    assert!(
+        resp.text()
+            .await?
+            .contains("wm-fork-dt/u/test-user-2/racing_stream"),
+        "the roles save missed the trigger enabled while it waited"
+    );
+    Ok(())
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn a_stored_name_containing_a_question_mark_resolves_as_itself(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    // Names could contain `?` before they were restricted, and such an entry is still stored.
+    sqlx::query(
+        "UPDATE workspace_settings
+         SET datatable = jsonb_set(datatable, '{datatables,legacy?dt}', datatable->'datatables'->'main')
+         WHERE workspace_id = 'test-workspace'",
+    )
+    .execute(&db)
+    .await?;
+
+    let resolve = |reference: &'static str| {
+        let db = db.clone();
+        async move {
+            windmill_common::workspaces::parse_datatable_ref_for(&db, "test-workspace", reference)
+                .await
+        }
+    };
+    assert_eq!(resolve("legacy?dt").await?, ("legacy?dt".to_string(), None));
+    assert_eq!(
+        resolve("main?role=analytics").await?,
+        ("main".to_string(), Some("analytics".to_string()))
+    );
+    assert!(
+        resolve("main?dt").await.is_err(),
+        "an unknown parameter was ignored"
+    );
+
+    sqlx::query(
+        "UPDATE workspace_settings
+         SET datatable = jsonb_set(datatable, '{datatables,main?role=analytics}', datatable->'datatables'->'main')
+         WHERE workspace_id = 'test-workspace'",
+    )
+    .execute(&db)
+    .await?;
+    assert!(
+        resolve("main?role=analytics").await.is_err(),
+        "a reference naming both a stored data table and a role on another resolved to one of them"
+    );
+    Ok(())
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn a_settings_save_dropping_a_governing_entry_names_the_forks_it_strands(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    // The whole map and no `deleted_datatables`, as a settings sync sends it.
+    let resp = authed(
+        client().post(format!(
+            "http://localhost:{}/api/w/test-workspace/workspaces/edit_datatable_config",
+            server.addr.port()
+        )),
+        "SECRET_TOKEN",
+    )
+    .json(&json!({ "settings": { "datatables": {} } }))
+    .send()
+    .await?;
+    let status = resp.status();
+    let body = resp.text().await?;
+    assert_eq!(status, 200, "{body}");
+    let result: Value = serde_json::from_str(&body)?;
+    assert!(
+        result["stranded_references"]
+            .as_array()
+            .is_some_and(|refs| refs.iter().any(|r| r["workspace_id"] == "wm-fork-dt")),
+        "the fork left pointing at nothing was not named: {body}"
+    );
+    Ok(())
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn an_entry_without_roles_cannot_newly_reach_a_database_under_roles(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    sqlx::query(
+        r#"UPDATE workspace_settings SET datatable = jsonb_set(datatable, '{datatables,other}',
+             '{"database": {"resource_type": "instance", "resource_path": "dt_other"}}')
+           WHERE workspace_id = 'test-workspace'"#,
+    )
+    .execute(&db)
+    .await?;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    // Whole-map saves with no `renames`, as a settings sync sends them.
+    let dt_main =
+        json!({ "database": { "resource_type": "instance", "resource_path": "dt_main" } });
+    let dt_other =
+        json!({ "database": { "resource_type": "instance", "resource_path": "dt_other" } });
+    for (case, w_id, datatables) in [
+        (
+            "a rename to a new name",
+            "test-workspace",
+            json!({ "main_renamed": dt_main, "other": dt_other }),
+        ),
+        (
+            "an existing name repointed",
+            "test-workspace",
+            json!({ "other": dt_main }),
+        ),
+        (
+            "another workspace's entry",
+            "wm-fork-dt",
+            json!({ "direct": dt_main }),
+        ),
+    ] {
+        let resp = authed(
+            client().post(format!(
+                "http://localhost:{port}/api/w/{w_id}/workspaces/edit_datatable_config"
+            )),
+            "SECRET_TOKEN",
+        )
+        .json(&json!({ "settings": { "datatables": datatables } }))
+        .send()
+        .await?;
+        let status = resp.status();
+        let body = resp.text().await?;
+        assert!(
+            status == 400 && body.contains("which a data table under roles uses"),
+            "{case} reached the database under roles without them ({status}): {body}"
+        );
+    }
+
+    let still_governed: bool = sqlx::query_scalar(
+        "SELECT (datatable->'datatables'->'main') ? 'permissions' FROM workspace_settings
+         WHERE workspace_id = 'test-workspace'",
+    )
+    .fetch_one(&db)
+    .await?;
+    assert!(still_governed, "the refused save still took effect");
+    Ok(())
+}
+
+/// Browsing names the role it connects as, and a role the caller may not use is refused rather
+/// than quietly listed as the default. The refusal is decided before connecting, so the fixture's
+/// database never has to exist.
+#[cfg(all(feature = "private", feature = "enterprise"))]
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn browsing_as_a_role_the_caller_may_not_use_is_refused(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/test-workspace/workspaces");
+
+    // `test-user-2` is a tenant of `analytics` only.
+    let resp = authed(
+        client().get(format!(
+            "{base}/list_datatable_tables?role_for=main&role=admin"
+        )),
+        "SECRET_TOKEN_2",
+    )
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 200);
+    let body: Value = resp.json().await?;
+    let entry = body
+        .as_array()
+        .and_then(|a| a.iter().find(|e| e["datatable_name"] == "main"))
+        .expect("main is listed");
+    assert_eq!(entry["usable_roles"], json!(["analytics"]), "{entry}");
+    assert_eq!(entry["default_role"], "analytics", "{entry}");
+    assert_eq!(entry["permissioned"], true, "{entry}");
+    assert_eq!(entry["instance"], true, "{entry}");
+    let error = entry["error"].as_str().unwrap_or_default();
+    assert!(
+        error.contains("Not allowed to use role 'admin'"),
+        "listed as another role than the one asked for: {entry}"
+    );
+
+    let resp = authed(
+        client().get(format!(
+            "{base}/get_datatable_table_schema?datatable_name=main&schema_name=public&table_name=t&role=admin"
+        )),
+        "SECRET_TOKEN_2",
+    )
+    .send()
+    .await?;
+    let status = resp.status();
+    let text = resp.text().await?;
+    assert!(
+        text.contains("Not allowed to use role 'admin'"),
+        "{status}: {text}"
+    );
+
+    // A role means nothing without the data table it belongs to.
+    let resp = authed(
+        client().get(format!("{base}/list_datatable_tables?role=analytics")),
+        "SECRET_TOKEN_2",
+    )
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 400, "{}", resp.text().await?);
+    Ok(())
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn an_alias_saved_elsewhere_waits_for_roles_going_on_for_its_database(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    sqlx::query(
+        r#"UPDATE workspace_settings SET datatable = jsonb_set(datatable, '{datatables,other}',
+             '{"database": {"resource_type": "instance", "resource_path": "dt_other"}}')
+           WHERE workspace_id = 'test-workspace'"#,
+    )
+    .execute(&db)
+    .await?;
+
+    // Roles going on for `dt_other`, not committed yet: it holds only its own workspace's settings
+    // row, so an alias saved from another workspace that looked for roles now would miss them.
+    let enabling = {
+        let mut tx = db.begin().await?;
+        windmill_common::datatable_roles::lock_instance_databases_governance(
+            &mut *tx,
+            ["dt_other"],
+        )
+        .await?;
+        sqlx::query(
+            r#"UPDATE workspace_settings SET datatable = jsonb_set(datatable,
+                 '{datatables,other,permissions}',
+                 '{"default_role": "admin", "roles": {"admin": {"tenants": ["*"]}}}')
+               WHERE workspace_id = 'test-workspace'"#,
+        )
+        .execute(&mut *tx)
+        .await?;
+        tx
+    };
+
+    let server = ApiServer::start(db.clone()).await?;
+    let url = format!(
+        "http://localhost:{}/api/w/wm-fork-dt/workspaces/edit_datatable_config",
+        server.addr.port()
+    );
+    let save = tokio::spawn(
+        authed(client().post(&url), "SECRET_TOKEN")
+            .json(&json!({ "settings": { "datatables": {
+                "direct": { "database": { "resource_type": "instance", "resource_path": "dt_other" } }
+            } } }))
+            .send(),
+    );
+    tokio::time::sleep(std::time::Duration::from_millis(500)).await;
+    assert!(
+        !save.is_finished(),
+        "an alias was saved while roles were going on for its database"
+    );
+    enabling.commit().await?;
+
+    let resp = save.await??;
+    let status = resp.status();
+    let body = resp.text().await?;
+    assert!(
+        status == 400 && body.contains("which a data table under roles uses"),
+        "the alias reached the database whose roles went on while it waited ({status}): {body}"
+    );
+    Ok(())
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn a_fork_waits_for_a_rename_of_the_data_table_it_keeps(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    // A rename in flight holds the parent's settings row and moves only the pointers it can see; a
+    // fork being created is invisible to it, so the fork has to read the name the rename commits.
+    let mut renaming = db.begin().await?;
+    sqlx::query(
+        "SELECT 1 FROM workspace_settings WHERE workspace_id = 'test-workspace' FOR UPDATE",
+    )
+    .execute(&mut *renaming)
+    .await?;
+    sqlx::query(
+        "UPDATE workspace_settings SET datatable = jsonb_set(datatable #- '{datatables,main}',
+           '{datatables,renamed}', datatable->'datatables'->'main')
+         WHERE workspace_id = 'test-workspace'",
+    )
+    .execute(&mut *renaming)
+    .await?;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let url = format!(
+        "http://localhost:{}/api/w/test-workspace/workspaces/create_fork",
+        server.addr.port()
+    );
+    let fork = tokio::spawn(
+        authed(client().post(&url), "SECRET_TOKEN")
+            .json(&json!({ "id": "wm-fork-race", "name": "race", "color": "#0000ff" }))
+            .send(),
+    );
+    tokio::time::sleep(std::time::Duration::from_millis(500)).await;
+    assert!(
+        !fork.is_finished(),
+        "the fork copied the parent's data tables while a rename held them"
+    );
+    renaming.commit().await?;
+
+    let resp = fork.await??;
+    assert!(resp.status().is_success(), "{}", resp.text().await?);
+    let datatables: Option<Value> = sqlx::query_scalar(
+        "SELECT datatable->'datatables' FROM workspace_settings WHERE workspace_id = 'wm-fork-race'",
+    )
+    .fetch_one(&db)
+    .await?;
+    let datatables = datatables.unwrap();
+    assert_eq!(
+        datatables["renamed"]["reference"],
+        json!({ "workspace_id": "test-workspace", "datatable": "renamed" }),
+        "{datatables}"
+    );
+    Ok(())
+}
+
+async fn enable_migrations_on_main(db: &Pool<Postgres>) -> anyhow::Result<()> {
+    sqlx::query(
+        "UPDATE workspace_settings
+         SET datatable = jsonb_set(datatable, '{datatables,main,migrations_enabled}', 'true')
+         WHERE workspace_id = 'test-workspace'",
+    )
+    .execute(db)
+    .await?;
+    Ok(())
+}
+
+#[cfg(all(feature = "private", feature = "enterprise"))]
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn a_migration_is_written_only_by_who_may_run_it(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    enable_migrations_on_main(&db).await?;
+    let server = ApiServer::start(db.clone()).await?;
+    let base = format!(
+        "http://localhost:{}/api/w/test-workspace/workspaces",
+        server.addr.port()
+    );
+    let create = |token: &str, body: Value| {
+        authed(
+            client()
+                .post(format!("{base}/create_datatable_migration/main"))
+                .json(&body),
+            token,
+        )
+        .send()
+    };
+    let upsert = |token: &str, code_up: &str| {
+        authed(
+            client()
+                .post(format!("{base}/upsert_datatable_migration/main"))
+                .json(&json!({"timestamp": 20260101000000i64, "name": "m", "code_up": code_up})),
+            token,
+        )
+        .send()
+    };
+
+    // `test-user-2` holds `analytics` and nothing else, so of a migration they may store only
+    // what they could run: SQL that declares no role runs as admin, in the up or the down.
+    for body in [
+        json!({"name": "m", "code_up": "DROP TABLE t"}),
+        json!({"name": "m", "code_up": "-- role analytics\nSELECT 1", "code_down": "DROP TABLE t"}),
+    ] {
+        let resp = create("SECRET_TOKEN_2", body.clone()).await?;
+        assert_eq!(resp.status(), 401, "{body}: {}", resp.text().await?);
+    }
+    let resp = create(
+        "SECRET_TOKEN_2",
+        json!({"name": "m", "code_up": "-- role analytics\nSELECT 1"}),
+    )
+    .await?;
+    assert_eq!(resp.status(), 200, "{}", resp.text().await?);
+
+    // An admin's migration re-pushed as stored writes nothing, so it passes. Replacing it removes
+    // SQL they could not run, even with SQL they could, so it is refused like deleting it.
+    let resp = upsert("SECRET_TOKEN", "DROP TABLE t").await?;
+    assert_eq!(resp.status(), 200, "{}", resp.text().await?);
+    let resp = upsert("SECRET_TOKEN_2", "DROP TABLE t").await?;
+    assert_eq!(resp.status(), 200, "{}", resp.text().await?);
+    for code_up in ["DROP TABLE u", "-- role analytics\nSELECT 1"] {
+        let resp = upsert("SECRET_TOKEN_2", code_up).await?;
+        assert_eq!(resp.status(), 401, "{code_up}: {}", resp.text().await?);
+    }
+    let resp = authed(
+        client().delete(format!(
+            "{base}/delete_datatable_migration/main/20260101000000"
+        )),
+        "SECRET_TOKEN_2",
+    )
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 401, "{}", resp.text().await?);
+
+    let code_up: String = sqlx::query_scalar(
+        "SELECT code_up FROM datatable_migrations
+         WHERE workspace_id = 'test-workspace' AND timestamp = 20260101000000",
+    )
+    .fetch_one(&db)
+    .await?;
+    assert_eq!(code_up, "DROP TABLE t");
+    Ok(())
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn an_operator_neither_writes_nor_runs_a_migration(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    enable_migrations_on_main(&db).await?;
+    // Off roles, where every role check passes everyone, so only the operator guard is left to
+    // refuse.
+    sqlx::query(
+        "UPDATE workspace_settings SET datatable = datatable #- '{datatables,main,permissions}'
+         WHERE workspace_id = 'test-workspace'",
+    )
+    .execute(&db)
+    .await?;
+    // A token of its own: the auth cache is process-wide, and the other tests here authenticate
+    // `SECRET_TOKEN_3` in this workspace as a non-operator.
+    sqlx::raw_sql(
+        "UPDATE usr SET operator = true, role = 'Operator'
+         WHERE workspace_id = 'test-workspace' AND username = 'test-user-3';
+         INSERT INTO token (token_hash, token_prefix, token, email, label, super_admin)
+         VALUES (encode(sha256('DT_OPERATOR_TOKEN'::bytea), 'hex'), 'DT_OPERATO',
+                 'DT_OPERATOR_TOKEN', 'test3@windmill.dev', 'operator', false);",
+    )
+    .execute(&db)
+    .await?;
+    let server = ApiServer::start(db.clone()).await?;
+    let base = format!(
+        "http://localhost:{}/api/w/test-workspace/workspaces",
+        server.addr.port()
+    );
+    let migration = json!({"timestamp": 20260101000000i64, "name": "m", "code_up": "SELECT 1"});
+
+    for request in [
+        client()
+            .post(format!("{base}/create_datatable_migration/main"))
+            .json(&migration),
+        client()
+            .post(format!("{base}/upsert_datatable_migration/main"))
+            .json(&migration),
+        client().delete(format!(
+            "{base}/delete_datatable_migration/main/20260101000000"
+        )),
+        client().post(format!("{base}/run_datatable_migrations/main")),
+        client().post(format!("{base}/rollback_datatable_migrations/main")),
+        client().post(format!("{base}/generate_initial_datatable_migration/main")),
+    ] {
+        let resp = authed(request, "DT_OPERATOR_TOKEN").send().await?;
+        let status = resp.status();
+        let text = resp.text().await?;
+        assert!(
+            status == 401 && text.contains("Operators cannot"),
+            "{status}: {text}"
+        );
+    }
+
+    // The same write from a developer is accepted: what refused the operator is theirs alone.
+    let resp = authed(
+        client()
+            .post(format!("{base}/upsert_datatable_migration/main"))
+            .json(&migration),
+        "SECRET_TOKEN_2",
+    )
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 200, "{}", resp.text().await?);
+    Ok(())
+}
+
+#[cfg(not(all(feature = "private", feature = "enterprise")))]
+const ENTERPRISE_REFUSAL: &str = "Data table roles are a Windmill Enterprise Edition feature";
+
+#[cfg(not(all(feature = "private", feature = "enterprise")))]
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn every_roles_route_is_an_enterprise_feature(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let api = format!("http://localhost:{}/api", server.addr.port());
+    let dt = format!("{api}/w/test-workspace/workspaces");
+
+    for (method, url, body) in [
+        (
+            reqwest::Method::GET,
+            format!("{api}/settings/datatable_roles"),
+            None,
+        ),
+        (
+            reqwest::Method::POST,
+            format!("{api}/settings/datatable_roles"),
+            Some(json!({ "name": "wmtest_ce" })),
+        ),
+        (
+            reqwest::Method::POST,
+            format!("{api}/settings/datatable_roles/role1"),
+            Some(json!({ "enabled": false })),
+        ),
+        (
+            reqwest::Method::DELETE,
+            format!("{api}/settings/datatable_roles/role1"),
+            None,
+        ),
+        (
+            reqwest::Method::GET,
+            format!("{dt}/datatable_permissions/main"),
+            None,
+        ),
+        (
+            reqwest::Method::POST,
+            format!("{dt}/datatable_permissions/main"),
+            Some(json!({ "permissioned": false })),
+        ),
+        (
+            reqwest::Method::GET,
+            format!("{dt}/datatable_usable_roles/main"),
+            None,
+        ),
+    ] {
+        let mut request = authed(client().request(method.clone(), &url), "SECRET_TOKEN");
+        if let Some(body) = body {
+            request = request.json(&body);
+        }
+        let resp = request.send().await?;
+        let status = resp.status();
+        let text = resp.text().await?;
+        assert!(
+            status == 400 && text.contains(ENTERPRISE_REFUSAL),
+            "{method} {url} answered {status}: {text}"
+        );
+    }
+
+    // Refused, not acted on: the catalog row and the data table's roles are where they were.
+    let untouched: (i64, bool) = sqlx::query_as(
+        "SELECT (SELECT count(*) FROM datatable_role),
+                (datatable->'datatables'->'main') ? 'permissions'
+         FROM workspace_settings WHERE workspace_id = 'test-workspace'",
+    )
+    .fetch_one(&db)
+    .await?;
+    assert_eq!(untouched, (1, true));
+    Ok(())
+}
+
+#[cfg(not(all(feature = "private", feature = "enterprise")))]
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn without_the_enterprise_edition_a_data_table_under_roles_is_refused_a_connection(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    use windmill_common::workspaces::{get_datatable_resource_from_db, DatatableAccess};
+    initialize_tracing().await;
+
+    // Saved under roles, as an enterprise build left it: refused whoever asks, never `admin`.
+    for access in [DatatableAccess::Unchecked, DatatableAccess::NoIdentity] {
+        let err = get_datatable_resource_from_db(&db, "test-workspace", "main", None, access)
+            .await
+            .expect_err("a data table under roles resolved");
+        assert!(err.to_string().contains(ENTERPRISE_REFUSAL), "{err}");
+    }
+
+    // Not under roles, it resolves as it always has, including when `admin` is named — which every
+    // migration does; naming any other role on it is refused.
+    sqlx::query(
+        "UPDATE workspace_settings SET datatable = datatable #- '{datatables,main,permissions}'
+         WHERE workspace_id = 'test-workspace'",
+    )
+    .execute(&db)
+    .await?;
+    for role in [None, Some("admin")] {
+        let resolved = get_datatable_resource_from_db(
+            &db,
+            "test-workspace",
+            "main",
+            role,
+            DatatableAccess::NoIdentity,
+        )
+        .await?;
+        assert_eq!(resolved["dbname"], "dt_main", "{resolved}");
+    }
+    let err = get_datatable_resource_from_db(
+        &db,
+        "test-workspace",
+        "main",
+        Some("analytics"),
+        DatatableAccess::Unchecked,
+    )
+    .await
+    .expect_err("a named role resolved");
+    assert!(err.to_string().contains(ENTERPRISE_REFUSAL), "{err}");
+    Ok(())
+}
+
+/// A save blocked on an instance database's lock is not a user of it until it commits one: the
+/// cleanup for a database whose setup failed lets that save through and reads what it left.
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn cleanup_waits_out_a_save_racing_it_for_an_instance_database(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let key = "instance_database:dt_probe";
+
+    // Queues cleanup behind `holder`, then a save behind cleanup, so cleanup takes the lock with
+    // the save already waiting on it — the ordering the waiter check is for.
+    let race = |commit: bool| {
+        let db = db.clone();
+        async move {
+            let mut holder = db.acquire().await?;
+            sqlx::query("SELECT pg_advisory_lock(hashtext($1))")
+                .bind(key)
+                .execute(&mut *holder)
+                .await?;
+
+            let cleanup = tokio::spawn({
+                let db = db.clone();
+                async move { windmill_common::drop_unused_instance_database(&db, "dt_probe").await }
+            });
+            tokio::time::sleep(std::time::Duration::from_millis(300)).await;
+
+            let save = tokio::spawn({
+                let db = db.clone();
+                async move {
+                    let mut tx = db.begin().await?;
+                    windmill_common::lock_instance_databases(&mut tx, ["dt_probe"]).await?;
+                    sqlx::query(
+                        r#"UPDATE workspace_settings SET datatable = jsonb_set(datatable,
+                             '{datatables,probe}',
+                             '{"database": {"resource_type": "instance", "resource_path": "dt_probe"}}')
+                           WHERE workspace_id = 'test-workspace'"#,
+                    )
+                    .execute(&mut *tx)
+                    .await?;
+                    if commit {
+                        tx.commit().await?;
+                    } else {
+                        tx.rollback().await?;
+                    }
+                    Ok::<_, anyhow::Error>(())
+                }
+            });
+            tokio::time::sleep(std::time::Duration::from_millis(300)).await;
+
+            sqlx::query("SELECT pg_advisory_unlock(hashtext($1))")
+                .bind(key)
+                .execute(&mut *holder)
+                .await?;
+            save.await??;
+            Ok::<_, anyhow::Error>(cleanup.await??)
+        }
+    };
+
+    assert!(
+        matches!(race(false).await?, windmill_common::Cleanup::Dropped),
+        "a save that rolled back kept the database, whose name then blocks every retry"
+    );
+    let kept = race(true).await?;
+    let windmill_common::Cleanup::InUse(users) = kept else {
+        anyhow::bail!("the database was dropped under a save that committed a reference to it")
+    };
+    assert_eq!(users, vec!["test-workspace".to_string()]);
+    Ok(())
+}
diff --git a/backend/windmill-api-integration-tests/tests/fixtures/datatable_roles.sql b/backend/windmill-api-integration-tests/tests/fixtures/datatable_roles.sql
new file mode 100644
index 0000000000..55d50d212c
--- /dev/null
+++ b/backend/windmill-api-integration-tests/tests/fixtures/datatable_roles.sql
@@ -0,0 +1,45 @@
+-- A data table under roles in `test-workspace`, and a fork whose entry points at it rather than
+-- carrying a copy. `test-user-2` is a non-admin of the parent and an admin of the fork: the shape
+-- the pointer exists for.
+
+-- Empty registry: role provisioning grants CONNECT on every database named here, and the data
+-- table's `dt_main` is a name in workspace settings, not a database that exists.
+INSERT INTO global_settings (name, value) VALUES
+    ('custom_instance_pg_databases', '{"user_pwd": "pw", "databases": {}}'::jsonb)
+    ON CONFLICT (name) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO datatable_role (id, name, enabled, pwd) VALUES ('role1', 'analytics', true, 'pw');
+
+UPDATE workspace_settings SET datatable = '{
+    "datatables": {
+        "main": {
+            "database": {"resource_type": "instance", "resource_path": "dt_main"},
+            "permissions": {
+                "default_role": "role1",
+                "roles": {
+                    "admin": {"tenants": []},
+                    "role1": {"tenants": ["u/test-user-2", "g/analysts", "f/finance"]}
+                }
+            }
+        }
+    }
+}'::jsonb WHERE workspace_id = 'test-workspace';
+
+INSERT INTO group_ (workspace_id, name, summary, extra_perms) VALUES
+	('test-workspace', 'analysts', 'Analysts', '{}');
+INSERT INTO folder (workspace_id, name, display_name, owners, extra_perms) VALUES
+	('test-workspace', 'finance', 'finance', '{}', '{}');
+
+INSERT INTO workspace (id, name, owner, parent_workspace_id) VALUES
+	('wm-fork-dt', 'fork of test-workspace', 'test2@windmill.dev', 'test-workspace');
+INSERT INTO workspace_key (workspace_id, kind, key) VALUES ('wm-fork-dt', 'cloud', 'test-key');
+INSERT INTO group_ (workspace_id, name, summary, extra_perms) VALUES
+	('wm-fork-dt', 'all', 'All users', '{}');
+INSERT INTO usr (workspace_id, email, username, is_admin, role) VALUES
+	('wm-fork-dt', 'test2@windmill.dev', 'test-user-2', true, 'Admin');
+
+INSERT INTO workspace_settings (workspace_id, datatable) VALUES ('wm-fork-dt', '{
+    "datatables": {
+        "main": {"reference": {"workspace_id": "test-workspace", "datatable": "main"}}
+    }
+}'::jsonb);
diff --git a/backend/windmill-api-integration-tests/tests/fork_clone_on_behalf_of.rs b/backend/windmill-api-integration-tests/tests/fork_clone_on_behalf_of.rs
index dae02f3e5a..bc6c10f1ee 100644
--- a/backend/windmill-api-integration-tests/tests/fork_clone_on_behalf_of.rs
+++ b/backend/windmill-api-integration-tests/tests/fork_clone_on_behalf_of.rs
@@ -311,3 +311,130 @@ async fn test_fork_keeps_only_resolvable_on_behalf_of(db: Pool<Postgres>) -> any
 
     Ok(())
 }
+
+/// Apps, schedules, triggers and their drafts cannot drop an identity the way scripts and flows
+/// do, so one naming nobody in the fork goes to its creator while one that still resolves stays.
+/// Forked as an admin, whose app policies the clone otherwise keeps.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_fork_repoints_unresolvable_identities(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let base_url = format!("http://localhost:{}/api", server.addr.port());
+
+    let stranger = json!({
+        "on_behalf_of": "u/test-user-2",
+        "on_behalf_of_email": "test2@windmill.dev",
+        "execution_mode": "publisher",
+    });
+    sqlx::query(
+        "INSERT INTO app (workspace_id, path, summary, policy, versions)
+         VALUES ('test-workspace', 'u/test-user/stranger', '', $1, '{}'),
+                ('test-workspace', 'u/test-user/group', '', $2, '{}')",
+    )
+    .bind(&stranger)
+    .bind(json!({
+        "on_behalf_of": "g/all",
+        "on_behalf_of_email": "group-all@windmill.dev",
+        "execution_mode": "publisher",
+    }))
+    .execute(&db)
+    .await?;
+    // The clone re-aggregates `versions` from `app_version`, and the column is NOT NULL.
+    sqlx::query(
+        "WITH v AS (
+            INSERT INTO app_version (app_id, value, created_by)
+            SELECT id, '{}'::json, 'test-user' FROM app WHERE workspace_id = 'test-workspace'
+            RETURNING id, app_id
+         )
+         UPDATE app SET versions = ARRAY[v.id] FROM v WHERE app.id = v.app_id",
+    )
+    .execute(&db)
+    .await?;
+    sqlx::query(
+        "INSERT INTO draft (workspace_id, path, typ, value, created_at, email)
+         VALUES ('test-workspace', 'u/test-user/stranger', 'raw_app', $1::json, NOW(), 'test@windmill.dev'),
+                ('test-workspace', 'u/test-user/stranger', 'trigger_websocket', $2::json, NOW(), 'test@windmill.dev'),
+                ('test-workspace', 'u/test-user/nul', 'raw_app', $3::json, NOW(), 'test@windmill.dev')",
+    )
+    .bind(json!({ "policy": stranger }))
+    .bind(json!({ "permissioned_as": "u/test-user-2" }))
+    // Saved before drafts were stripped of NULs: any jsonb parse of it raises, so it must be
+    // skipped rather than abort the fork. Built from parts because a NUL escape can't sit in source.
+    .bind(format!(
+        r#"{{"policy":{{"on_behalf_of":"u/test-user-2"}},"files":{{"f":"a{}u0000"}}}}"#,
+        "\\"
+    ))
+    .execute(&db)
+    .await?;
+    sqlx::query(
+        "INSERT INTO schedule (workspace_id, path, edited_by, schedule, script_path, email, permissioned_as, enabled)
+         VALUES ('test-workspace', 'u/test-user/stranger', 'test-user', '0 0 * * * *', 'u/test-user/s', 'test2@windmill.dev', 'u/test-user-2', false)",
+    )
+    .execute(&db)
+    .await?;
+    sqlx::query(
+        "INSERT INTO websocket_trigger (workspace_id, path, url, script_path, is_flow, edited_by, permissioned_as, mode)
+         VALUES ('test-workspace', 'u/test-user/stranger', 'ws://localhost', 'u/test-user/s', false, 'test-user', 'u/test-user-2', 'disabled')",
+    )
+    .execute(&db)
+    .await?;
+
+    let resp = reqwest::Client::new()
+        .post(format!(
+            "{base_url}/w/test-workspace/workspaces/create_fork"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({ "id": "wm-fork-repoint", "name": "Fork", "color": "#0000ff" }))
+        .send()
+        .await?;
+    assert!(
+        resp.status().is_success(),
+        "creating the fork: {}",
+        resp.text().await?
+    );
+
+    let text = |sql: &'static str| sqlx::query_scalar::<_, String>(sql).fetch_one(&db);
+    assert_eq!(
+        text("SELECT (policy->>'on_behalf_of') || ' ' || (policy->>'on_behalf_of_email') FROM app WHERE workspace_id = 'wm-fork-repoint' AND path = 'u/test-user/stranger'").await?,
+        "u/test-user test@windmill.dev"
+    );
+    assert_eq!(
+        text("SELECT policy->>'on_behalf_of' FROM app WHERE workspace_id = 'wm-fork-repoint' AND path = 'u/test-user/group'").await?,
+        "g/all"
+    );
+    assert_eq!(
+        text("SELECT value->'policy'->>'on_behalf_of' FROM draft WHERE workspace_id = 'wm-fork-repoint' AND path = 'u/test-user/stranger' AND typ = 'raw_app'").await?,
+        "u/test-user"
+    );
+    // `clone_drafts` strips a NUL escape as it copies, so the row reaches the fork
+    // parseable and the repoint below reaches it like any other draft's. The rule this
+    // guards is that the fork completes and no identity naming nobody survives it; the
+    // skip only ever existed because `to_jsonb` raises on a value still holding one.
+    assert_eq!(
+        text("SELECT CASE WHEN strpos(value::text, 'u/test-user-2') > 0 THEN 'kept' ELSE 'rewritten' END FROM draft WHERE workspace_id = 'wm-fork-repoint' AND path = 'u/test-user/nul'").await?,
+        "rewritten"
+    );
+    // And it arrives without the poison that made it a special case.
+    assert_eq!(
+        text("SELECT CASE WHEN position(chr(92) || 'u0000' in value::text) > 0 THEN 'poisoned' ELSE 'clean' END FROM draft WHERE workspace_id = 'wm-fork-repoint' AND path = 'u/test-user/nul'").await?,
+        "clean"
+    );
+    assert_eq!(
+        text("SELECT value->>'permissioned_as' FROM draft WHERE workspace_id = 'wm-fork-repoint' AND typ = 'trigger_websocket'").await?,
+        "u/test-user"
+    );
+    assert_eq!(
+        text("SELECT permissioned_as || ' ' || email FROM schedule WHERE workspace_id = 'wm-fork-repoint'").await?,
+        "u/test-user test@windmill.dev"
+    );
+    assert_eq!(
+        text(
+            "SELECT permissioned_as FROM websocket_trigger WHERE workspace_id = 'wm-fork-repoint'"
+        )
+        .await?,
+        "u/test-user"
+    );
+
+    Ok(())
+}
diff --git a/backend/windmill-api-integration-tests/tests/fork_members.rs b/backend/windmill-api-integration-tests/tests/fork_members.rs
new file mode 100644
index 0000000000..5f4baced1f
--- /dev/null
+++ b/backend/windmill-api-integration-tests/tests/fork_members.rs
@@ -0,0 +1,75 @@
+use serde_json::json;
+use sqlx::{Pool, Postgres};
+
+use windmill_test_utils::*;
+
+/// With `add_admins_and_developers_to_forks` on, a fork starts with the parent's admins and
+/// developers at their parent role, even when a developer forks it; operators are left out. The
+/// copies are manual members: a parent membership that came from an instance group must not carry
+/// that provenance into a fork that does not configure the group.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_fork_adds_parent_admins_and_developers(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let base_url = format!(
+        "http://localhost:{}/api/w/test-workspace/workspaces",
+        server.addr.port()
+    );
+    let client = reqwest::Client::new();
+
+    sqlx::query(
+        "UPDATE usr SET operator = true WHERE workspace_id = 'test-workspace' AND username = 'test-user-3'",
+    )
+    .execute(&db)
+    .await?;
+    sqlx::query(
+        "INSERT INTO usr (workspace_id, email, username, is_admin, added_via)
+         VALUES ('test-workspace', 'test4@windmill.dev', 'test-user-4', false,
+                 '{\"source\": \"instance_group\", \"group\": \"devs\"}')",
+    )
+    .execute(&db)
+    .await?;
+
+    let resp = client
+        .post(format!(
+            "{base_url}/edit_add_admins_and_developers_to_forks"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({ "add_admins_and_developers_to_forks": true }))
+        .send()
+        .await?;
+    assert!(
+        resp.status().is_success(),
+        "enabling the setting: {}",
+        resp.text().await?
+    );
+
+    let resp = client
+        .post(format!("{base_url}/create_fork"))
+        .header("Authorization", "Bearer SECRET_TOKEN_2")
+        .json(&json!({ "id": "wm-fork-team", "name": "Team fork" }))
+        .send()
+        .await?;
+    assert!(
+        resp.status().is_success(),
+        "creating the fork: {}",
+        resp.text().await?
+    );
+
+    let members: Vec<(String, bool, bool)> = sqlx::query_as(
+        "SELECT username, is_admin, added_via IS NULL FROM usr
+         WHERE workspace_id = 'wm-fork-team' ORDER BY username",
+    )
+    .fetch_all(&db)
+    .await?;
+    assert_eq!(
+        members,
+        vec![
+            ("test-user".to_string(), true, true),
+            ("test-user-2".to_string(), false, true),
+            ("test-user-4".to_string(), false, true),
+        ]
+    );
+
+    Ok(())
+}
diff --git a/backend/windmill-api-integration-tests/tests/max_token_expiration.rs b/backend/windmill-api-integration-tests/tests/max_token_expiration.rs
new file mode 100644
index 0000000000..b748ce49a1
--- /dev/null
+++ b/backend/windmill-api-integration-tests/tests/max_token_expiration.rs
@@ -0,0 +1,239 @@
+//! `max_token_expiration_days`: the instance-wide ceiling on how far ahead a token a caller
+//! picks the lifetime of may expire, and the service-account exemption.
+
+use serde_json::json;
+use sqlx::types::chrono::{DateTime, Utc};
+use sqlx::{Pool, Postgres};
+use windmill_test_utils::*;
+
+const DAY: u64 = 24 * 60 * 60;
+
+fn client() -> reqwest::Client {
+    reqwest::Client::new()
+}
+
+fn from_now(secs: u64) -> DateTime<Utc> {
+    Utc::now() + std::time::Duration::from_secs(secs)
+}
+
+async fn set_max(db: &Pool<Postgres>, value: serde_json::Value) {
+    sqlx::query(
+        "INSERT INTO global_settings (name, value) VALUES ('max_token_expiration_days', $1)
+         ON CONFLICT (name) DO UPDATE SET value = EXCLUDED.value",
+    )
+    .bind(value)
+    .execute(db)
+    .await
+    .unwrap();
+}
+
+/// Mints as `test2@windmill.dev`, a plain member of `test-workspace`.
+async fn create_token(port: u16, body: serde_json::Value) -> reqwest::Response {
+    client()
+        .post(format!("http://localhost:{port}/api/users/tokens/create"))
+        .header("Authorization", "Bearer SECRET_TOKEN_2")
+        .json(&body)
+        .send()
+        .await
+        .unwrap()
+}
+
+async fn stored_expiration(db: &Pool<Postgres>, label: &str) -> Option<DateTime<Utc>> {
+    sqlx::query_scalar::<_, Option<DateTime<Utc>>>("SELECT expiration FROM token WHERE label = $1")
+        .bind(label)
+        .fetch_one(db)
+        .await
+        .unwrap()
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_max_token_expiration_days_shortens_user_tokens(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let resp = create_token(port, json!({ "label": "unset" })).await;
+    assert_eq!(resp.status(), 201);
+    assert_eq!(
+        stored_expiration(&db, "unset").await,
+        None,
+        "with no setting a token may still have no expiration"
+    );
+
+    // Refused at write time: the token routes can only read a value they cannot parse as no
+    // ceiling at all.
+    let resp = client()
+        .post(format!(
+            "http://localhost:{port}/api/settings/global/max_token_expiration_days"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({ "value": 7.5 }))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 400);
+
+    set_max(&db, json!(7)).await;
+
+    // The token form reads the ceiling as whoever is creating the token, usually not a
+    // superadmin, so it can offer only expirations the server would keep.
+    let resp = client()
+        .get(format!(
+            "http://localhost:{port}/api/settings/global/max_token_expiration_days"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN_2")
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 200);
+    assert_eq!(resp.text().await?, "7");
+
+    let resp = create_token(port, json!({ "label": "none asked" })).await;
+    assert_eq!(resp.status(), 201);
+    let expiration = stored_expiration(&db, "none asked")
+        .await
+        .expect("a token asking for no expiration gets the ceiling");
+    assert!(
+        expiration > from_now(6 * DAY) && expiration <= from_now(7 * DAY),
+        "expected the 7 day ceiling, got {expiration}"
+    );
+
+    let resp = create_token(
+        port,
+        json!({ "label": "past the ceiling", "expiration": from_now(30 * DAY) }),
+    )
+    .await;
+    assert_eq!(resp.status(), 201);
+    let expiration = stored_expiration(&db, "past the ceiling").await.unwrap();
+    assert!(
+        expiration > from_now(6 * DAY) && expiration <= from_now(7 * DAY),
+        "expected an expiration past the ceiling to be shortened to it, got {expiration}"
+    );
+
+    let resp = create_token(
+        port,
+        json!({ "label": "within", "expiration": from_now(3 * DAY) }),
+    )
+    .await;
+    assert_eq!(resp.status(), 201);
+    let expiration = stored_expiration(&db, "within").await.unwrap();
+    assert!(
+        expiration <= from_now(3 * DAY),
+        "an expiration within the ceiling must be kept, got {expiration}"
+    );
+
+    // The settings UI stores an integer, but the YAML instance config and config sync can write
+    // the same whole number as a string or as `5.0`. Reading either as "unset" would silently
+    // drop the ceiling, while the token form (`parseMaxTokenExpirationDays`) still showed it.
+    for (stored, label) in [
+        (json!("5"), "string setting"),
+        (json!(5.0), "float setting"),
+    ] {
+        set_max(&db, stored).await;
+        let resp = create_token(port, json!({ "label": label })).await;
+        assert_eq!(resp.status(), 201);
+        let expiration = stored_expiration(&db, label).await;
+        assert!(
+            expiration.is_some_and(|e| e > from_now(4 * DAY) && e <= from_now(5 * DAY)),
+            "{label}: expected the 5 day ceiling, got {expiration:?}"
+        );
+    }
+
+    // A superadmin impersonating a user picks the lifetime too, so the ceiling applies there;
+    // left out, it would be the one way to mint a token that never expires.
+    let resp = client()
+        .post(format!(
+            "http://localhost:{port}/api/users/tokens/impersonate"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({ "label": "impersonated", "impersonate_email": "test3@windmill.dev" }))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 201);
+    assert!(
+        stored_expiration(&db, "impersonated").await.is_some(),
+        "an impersonation token asking for no expiration gets the ceiling"
+    );
+
+    Ok(())
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_service_accounts_are_exempt(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    set_max(&db, json!(7)).await;
+    // The same email is a service account in one workspace and an ordinary user in another.
+    sqlx::query(
+        "UPDATE usr SET is_service_account = true
+         WHERE email = 'test2@windmill.dev' AND workspace_id = 'test-workspace'",
+    )
+    .execute(&db)
+    .await?;
+    sqlx::query("INSERT INTO workspace (id, name, owner) VALUES ('other', 'other', 'test-user')")
+        .execute(&db)
+        .await?;
+    sqlx::query("INSERT INTO workspace_settings (workspace_id) VALUES ('other')")
+        .execute(&db)
+        .await?;
+    sqlx::query(
+        "INSERT INTO usr (workspace_id, email, username, is_admin, role)
+         VALUES ('other', 'test2@windmill.dev', 'test-user-2', false, 'User')",
+    )
+    .execute(&db)
+    .await?;
+
+    // The token form decides the exemption from this list, so it must carry each membership's flag.
+    let memberships: serde_json::Value = client()
+        .get(format!("http://localhost:{port}/api/workspaces/users"))
+        .header("Authorization", "Bearer SECRET_TOKEN_2")
+        .send()
+        .await?
+        .json()
+        .await?;
+    for (workspace, is_service_account) in [("test-workspace", true), ("other", false)] {
+        let membership = memberships["workspaces"]
+            .as_array()
+            .and_then(|ws| ws.iter().find(|w| w["id"] == workspace))
+            .unwrap_or_else(|| panic!("{workspace} missing from {memberships}"));
+        assert_eq!(membership["is_service_account"], json!(is_service_account));
+    }
+
+    for (label, workspace_id, exempt) in [
+        ("own workspace", Some("test-workspace"), true),
+        ("other workspace", Some("other"), false),
+        // A workspace-less token has no workspace to match, so a service account anywhere counts.
+        ("global", None, true),
+    ] {
+        let resp = create_token(
+            port,
+            json!({ "label": label, "workspace_id": workspace_id }),
+        )
+        .await;
+        assert_eq!(resp.status(), 201);
+        assert_eq!(
+            stored_expiration(&db, label).await.is_none(),
+            exempt,
+            "{label}: expected exempt = {exempt}"
+        );
+    }
+
+    // Impersonation checks the impersonated account, not the superadmin minting the token.
+    let resp = client()
+        .post(format!(
+            "http://localhost:{port}/api/users/tokens/impersonate"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({ "label": "impersonated service account", "impersonate_email": "test2@windmill.dev" }))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 201);
+    assert_eq!(
+        stored_expiration(&db, "impersonated service account").await,
+        None
+    );
+
+    Ok(())
+}
diff --git a/backend/windmill-api-integration-tests/tests/mcp_token_query_param.rs b/backend/windmill-api-integration-tests/tests/mcp_token_query_param.rs
new file mode 100644
index 0000000000..d0d6e070f6
--- /dev/null
+++ b/backend/windmill-api-integration-tests/tests/mcp_token_query_param.rs
@@ -0,0 +1,102 @@
+//! The `mcp_disable_token_query_param` switch closes the URL-borne credential path.
+//!
+//! The rejection is a middleware layered between the `WWW-Authenticate` decorator and
+//! everything that reads a token, on both the workspaced and the gateway mount. Each half of
+//! that sandwich is pinned: the `WWW-Authenticate` header on the refusal catches the layer
+//! being moved outward (a client would lose the pointer that starts OAuth discovery), and
+//! refusing a token that was never valid catches it being moved inward past authentication
+//! (the URL-borne token would be hashed and looked up before anything refused it).
+#![cfg(feature = "mcp")]
+
+use std::sync::atomic::Ordering;
+
+use serde_json::json;
+use sqlx::{Pool, Postgres};
+
+use windmill_common::global_settings::MCP_DISABLE_TOKEN_QUERY_PARAM;
+use windmill_test_utils::*;
+
+/// Workspace-less with an `mcp:` scope, which is what the gateway mount requires; the
+/// workspaced mount takes its workspace from the path, so one token reaches both.
+async fn insert_mcp_token(db: &Pool<Postgres>) -> anyhow::Result<()> {
+    sqlx::query(
+        "INSERT INTO token (token_hash, token_prefix, token, email, label, super_admin, scopes)
+         VALUES (encode(sha256('MCP_TOKEN'::bytea), 'hex'), 'MCP_TOK', 'MCP_TOKEN', 'test@windmill.dev', 'mcp token', true, ARRAY['mcp:all'])",
+    )
+    .execute(db)
+    .await?;
+    Ok(())
+}
+
+/// A token that is not in `token` at all. Authentication would refuse it on its own, so a
+/// refusal carrying the middleware's own wording is evidence nothing looked it up first.
+const BOGUS_TOKEN: &str = "NOT_A_REAL_TOKEN";
+
+async fn tools_list(url: &str) -> anyhow::Result<reqwest::Response> {
+    Ok(reqwest::Client::new()
+        .post(url)
+        .header("Accept", "application/json, text/event-stream")
+        .json(&json!({ "jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": {} }))
+        .send()
+        .await?)
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_mcp_token_query_param_switch(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    set_jwt_secret().await;
+    insert_mcp_token(&db).await?;
+    let server = ApiServer::start_mcp(db.clone()).await?;
+    let port = server.addr.port();
+    let workspaced =
+        format!("http://localhost:{port}/api/mcp/w/test-workspace/mcp?token=MCP_TOKEN");
+    let gateway = format!("http://localhost:{port}/api/mcp/gateway?token=MCP_TOKEN");
+
+    assert_eq!(
+        tools_list(&workspaced).await?.status(),
+        200,
+        "a URL-borne token is the documented default and must keep working while the switch is off"
+    );
+    assert_eq!(tools_list(&gateway).await?.status(), 200);
+
+    MCP_DISABLE_TOKEN_QUERY_PARAM.store(true, Ordering::Relaxed);
+
+    for url in [&workspaced, &gateway] {
+        let resp = tools_list(url).await?;
+        assert_eq!(
+            resp.status(),
+            401,
+            "{url} still admitted a token in the URL"
+        );
+        // What sends the client into the OAuth flow rather than leaving it stuck on a 401.
+        assert!(
+            resp.headers().contains_key("www-authenticate"),
+            "{url} rejected without pointing at the authorization server"
+        );
+    }
+
+    // Refused before authentication, not after: an invalid token gets the middleware's own
+    // message rather than the generic 401 that looking it up would produce.
+    let resp = tools_list(&format!(
+        "http://localhost:{port}/api/mcp/w/test-workspace/mcp?token={BOGUS_TOKEN}"
+    ))
+    .await?;
+    assert_eq!(resp.status(), 401);
+    assert!(
+        resp.text().await?.contains("does not accept a token in the MCP URL"),
+        "an invalid URL token was answered by authentication, so the token was read before \
+         the switch refused it"
+    );
+
+    // The header stays open: it is the channel the OAuth flow itself hands tokens over on.
+    let resp = reqwest::Client::new()
+        .post(format!("http://localhost:{port}/api/mcp/gateway"))
+        .header("Accept", "application/json, text/event-stream")
+        .header("Authorization", "Bearer MCP_TOKEN")
+        .json(&json!({ "jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": {} }))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 200);
+
+    Ok(())
+}
diff --git a/backend/windmill-api-integration-tests/tests/native_triggers.rs b/backend/windmill-api-integration-tests/tests/native_triggers.rs
index 059b3aa2d2..e7f0147323 100644
--- a/backend/windmill-api-integration-tests/tests/native_triggers.rs
+++ b/backend/windmill-api-integration-tests/tests/native_triggers.rs
@@ -12,7 +12,7 @@ use serde_json::json;
 use sqlx::{Pool, Postgres};
 
 use axum::http::StatusCode;
-use windmill_api_auth::ApiAuthed;
+use windmill_api_auth::{ApiAuthed, ScopePathFilter};
 use windmill_common::{
     error::Error,
     variables::{build_crypt, encrypt},
@@ -661,6 +661,7 @@ async fn test_rename_moves_native_trigger(db: Pool<Postgres>) -> anyhow::Result<
         None,
         Some("f/test/after"),
         Some(false),
+        ScopePathFilter::AllowAll,
     )
     .await?;
     assert_eq!(
@@ -672,6 +673,55 @@ async fn test_rename_moves_native_trigger(db: Pool<Postgres>) -> anyhow::Result<
     Ok(())
 }
 
+// ============================================================================
+// 6. Token scope filtering on list
+// ============================================================================
+
+/// A `native_triggers:read:f/test/*` token must only list triggers under `f/test/`, on the `/`
+/// boundary (`f/testx/` is out of scope).
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_list_native_triggers_scope_filter(db: Pool<Postgres>) -> anyhow::Result<()> {
+    for (i, path) in ["f/testx/out", "f/test/in"].into_iter().enumerate() {
+        insert_test_script(&db, path).await?;
+        store_native_trigger(
+            &db,
+            "test-workspace",
+            ServiceName::Nextcloud,
+            &format!("ext-{i}"),
+            &NativeTriggerConfig {
+                script_path: path.to_string(),
+                is_flow: false,
+                webhook_token: format!("abcdefghij123456789{i}"),
+            },
+            json!({"event": "OCP\\Files\\Events\\Node\\NodeCreatedEvent"}),
+            None,
+            true,
+        )
+        .await?;
+    }
+
+    let triggers = list_native_triggers(
+        &db,
+        "test-workspace",
+        ServiceName::Nextcloud,
+        None,
+        None,
+        None,
+        None,
+        ScopePathFilter::Restricted { exact: vec![], prefix: vec!["f/test".to_string()] },
+    )
+    .await?;
+    assert_eq!(
+        triggers
+            .iter()
+            .map(|t| t.script_path.as_str())
+            .collect::<Vec<_>>(),
+        vec!["f/test/in"]
+    );
+
+    Ok(())
+}
+
 // --- parse_stop_channel_params ---
 
 #[test]
diff --git a/backend/windmill-api-integration-tests/tests/remote_deploy.rs b/backend/windmill-api-integration-tests/tests/remote_deploy.rs
new file mode 100644
index 0000000000..27447c3095
--- /dev/null
+++ b/backend/windmill-api-integration-tests/tests/remote_deploy.rs
@@ -0,0 +1,297 @@
+use serde_json::json;
+use sqlx::{Pool, Postgres};
+
+use windmill_common::variables::{build_crypt, encrypt};
+use windmill_test_utils::*;
+
+fn client() -> reqwest::Client {
+    reqwest::Client::new()
+}
+
+fn authed(builder: reqwest::RequestBuilder) -> reqwest::RequestBuilder {
+    builder.header("Authorization", "Bearer SECRET_TOKEN")
+}
+
+/// The deploy target is this very server, which the proxy has no way to tell from another
+/// instance: it only ever knows the configured URL, the caller's stored token, and the path.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_remote_deploy_proxy(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/test-workspace/remote_deploy");
+
+    // Planted rather than set through the route, which is enterprise-gated. Unlike the route, it
+    // deletes no token for another target, which is what a connect landing just after the
+    // route's cleanup leaves behind.
+    let set_target = |base_url: String, workspace_id: &'static str| {
+        let db = db.clone();
+        async move {
+            sqlx::query!(
+                "UPDATE workspace_settings
+                 SET remote_deploy_target = $1, remote_deploy_target_changed_at = now()
+                 WHERE workspace_id = 'test-workspace'",
+                json!({ "base_url": base_url, "workspace_id": workspace_id })
+            )
+            .execute(&db)
+            .await
+            .unwrap();
+        }
+    };
+    set_target(format!("http://localhost:{port}"), "test-workspace").await;
+
+    let resp = authed(client().get(format!("{base}/target")))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 200);
+    let status = resp.json::<serde_json::Value>().await?;
+    assert_eq!(status["target"]["workspace_id"], "test-workspace");
+    assert!(status["connection"].is_null());
+
+    // Deploying before connecting names the step that is missing, rather than reaching the target
+    // with the caller's credentials for this instance.
+    let resp = authed(client().get(format!("{base}/proxy/none/users/whoami")))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 400);
+    assert!(resp.text().await?.contains("Connect to"));
+
+    let target =
+        json!({ "base_url": format!("http://localhost:{port}"), "workspace_id": "test-workspace" });
+
+    // A token obtained for another target is refused before it is sent anywhere.
+    let resp = authed(client().post(format!("{base}/connect")))
+        .json(&json!({"token": "SECRET_TOKEN", "target": { "base_url": format!("http://localhost:{port}"), "workspace_id": "elsewhere" }}))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 400);
+
+    // A token the target refuses is not stored.
+    let resp = authed(client().post(format!("{base}/connect")))
+        .json(&json!({"token": "not-a-token", "target": target}))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 400);
+
+    let resp = authed(client().post(format!("{base}/connect")))
+        .json(&json!({"token": "SECRET_TOKEN", "target": target}))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 200);
+    let connection = resp.json::<serde_json::Value>().await?;
+    assert_eq!(connection["remote_email"], "test@windmill.dev");
+    let key = connection["proxy_key"].as_str().unwrap().to_string();
+
+    let resp = authed(client().get(format!("{base}/proxy/{key}/users/whoami")))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 200);
+    // Whatever the remote returns is served from this origin, so it must never render as a page.
+    let csp = resp.headers()["content-security-policy"]
+        .to_str()?
+        .to_string();
+    assert!(csp.starts_with("sandbox"), "{csp}");
+    assert_eq!(
+        resp.json::<serde_json::Value>().await?["email"],
+        "test@windmill.dev"
+    );
+
+    // A link from elsewhere rides the session cookie but cannot know the key, so it cannot spend
+    // the stored token.
+    // Nor can a credential that may not use the proxy read the key, to build such a link itself.
+    sqlx::query!(
+        "INSERT INTO token (token_hash, token_prefix, token, email, label, super_admin, read_only)
+         VALUES (encode(sha256('READ_ONLY_TOKEN'::bytea), 'hex'), 'READ_ONLY_', 'READ_ONLY_TOKEN',
+                 'test@windmill.dev', 'read only', false, true)"
+    )
+    .execute(&db)
+    .await?;
+    let resp = client()
+        .get(format!("{base}/target"))
+        .header("Authorization", "Bearer READ_ONLY_TOKEN")
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 200);
+    assert!(resp.json::<serde_json::Value>().await?["connection"].is_null());
+
+    let guessed = "x".repeat(key.len());
+    let resp = authed(client().get(format!("{base}/proxy/{guessed}/users/whoami")))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 400);
+
+    // A connect locks nothing against a key rotation, so its row can land under the old key: that
+    // is no connection, which the drawer offers to replace, rather than an error on every deploy.
+    sqlx::query!(
+        "UPDATE remote_deploy_token SET token = 'not-under-this-key'
+         WHERE workspace_id = 'test-workspace'"
+    )
+    .execute(&db)
+    .await?;
+    let resp = authed(client().get(format!("{base}/target")))
+        .send()
+        .await?;
+    assert!(resp.json::<serde_json::Value>().await?["connection"].is_null());
+
+    // A target that refuses the stored token must not answer 401: the browser reads an
+    // unhandled 401 as its own session having expired and logs the user out of this instance.
+    let mc = build_crypt(&db, "test-workspace").await?;
+    sqlx::query!(
+        "UPDATE remote_deploy_token SET token = $1 WHERE workspace_id = 'test-workspace'",
+        encrypt(&mc, "revoked-token")
+    )
+    .execute(&db)
+    .await?;
+    let resp = authed(client().get(format!("{base}/proxy/{key}/users/whoami")))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 502);
+
+    // Nor does a connect lock anything against a removal from the workspace, so its row can land
+    // after the removal cleared the table: a row from an earlier membership must not come back
+    // with a re-add, even one whose `created_at` reads earlier than the connect (it is the start
+    // of the re-adding transaction).
+    let as_test2 =
+        |builder: reqwest::RequestBuilder| builder.header("Authorization", "Bearer SECRET_TOKEN_2");
+    let resp = as_test2(client().post(format!("{base}/connect")))
+        .json(&json!({"token": "SECRET_TOKEN_2", "target": target}))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 200);
+    let key2 = resp.json::<serde_json::Value>().await?["proxy_key"]
+        .as_str()
+        .unwrap()
+        .to_string();
+    let resp = as_test2(client().get(format!("{base}/target")))
+        .send()
+        .await?;
+    assert_eq!(
+        resp.json::<serde_json::Value>().await?["connection"]["proxy_key"],
+        key2.as_str()
+    );
+    sqlx::query!(
+        "UPDATE usr SET created_at = created_at - interval '1 hour'
+         WHERE workspace_id = 'test-workspace' AND email = 'test2@windmill.dev'"
+    )
+    .execute(&db)
+    .await?;
+    let resp = as_test2(client().get(format!("{base}/target")))
+        .send()
+        .await?;
+    assert!(resp.json::<serde_json::Value>().await?["connection"].is_null());
+    let resp = as_test2(client().get(format!("{base}/proxy/{key2}/users/whoami")))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 400);
+    assert!(resp.text().await?.contains("Connect to"));
+
+    // Deleting the account must take its token with it, or the next account created with that
+    // address would act on the remote as this one.
+    let resp = authed(client().delete(format!(
+        "http://localhost:{port}/api/users/delete/test2@windmill.dev"
+    )))
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 200);
+    let left = sqlx::query_scalar!(
+        "SELECT count(*) FROM remote_deploy_token WHERE email = 'test2@windmill.dev'"
+    )
+    .fetch_one(&db)
+    .await?;
+    assert_eq!(left, Some(0));
+
+    // The token was granted for one target and is never sent to another, so re-pointing the
+    // workspace leaves the caller unconnected instead of handing its token to the new target.
+    set_target(format!("http://localhost:{port}"), "other-workspace").await;
+    let resp = authed(client().get(format!("{base}/target")))
+        .send()
+        .await?;
+    assert!(resp.json::<serde_json::Value>().await?["connection"].is_null());
+    let resp = authed(client().get(format!("{base}/proxy/{key}/users/whoami")))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 400);
+
+    // The row for the old target outlived the change, as one from a connect in flight across it
+    // would: pointing the setting back must not revive it, even with a stamp that reads earlier
+    // than the connect.
+    set_target(format!("http://localhost:{port}"), "test-workspace").await;
+    sqlx::query!(
+        "UPDATE workspace_settings SET remote_deploy_target_changed_at = '2000-01-01'
+         WHERE workspace_id = 'test-workspace'"
+    )
+    .execute(&db)
+    .await?;
+    let resp = authed(client().get(format!("{base}/target")))
+        .send()
+        .await?;
+    assert!(resp.json::<serde_json::Value>().await?["connection"].is_null());
+
+    // A connect in flight across a disconnect must not undo it when it lands. The disconnect is
+    // stamped an hour ahead, as if every connect starting now had started before it.
+    let resp = authed(client().post(format!("{base}/connect")))
+        .json(&json!({"token": "SECRET_TOKEN", "target": target}))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 200);
+    let resp = authed(client().post(format!("{base}/disconnect")))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 200);
+    sqlx::query!(
+        "UPDATE remote_deploy_token SET connected_at = clock_timestamp() + interval '1 hour'
+         WHERE workspace_id = 'test-workspace' AND email = 'test@windmill.dev'"
+    )
+    .execute(&db)
+    .await?;
+    let resp = authed(client().post(format!("{base}/connect")))
+        .json(&json!({"token": "SECRET_TOKEN", "target": target}))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 400);
+    let resp = authed(client().get(format!("{base}/target")))
+        .send()
+        .await?;
+    assert!(resp.json::<serde_json::Value>().await?["connection"].is_null());
+
+    // A superadmin outside the workspace has no membership to bind to, so the row is bound to the
+    // account by the credential making the request: an account deleted during the remote call,
+    // and its address taken by another, must not inherit it. A deleted credential that auth still
+    // holds in its cache stands in for one whose account went away mid-call.
+    sqlx::query!(
+        "DELETE FROM usr WHERE workspace_id = 'test-workspace' AND email = 'test@windmill.dev'"
+    )
+    .execute(&db)
+    .await?;
+    sqlx::query!("DELETE FROM remote_deploy_token WHERE email = 'test@windmill.dev'")
+        .execute(&db)
+        .await?;
+    sqlx::query!(
+        "INSERT INTO token (token_hash, token_prefix, token, email, label, super_admin)
+         VALUES (encode(sha256('GONE_TOKEN'::bytea), 'hex'), 'GONE_TOKEN', 'GONE_TOKEN',
+                 'test@windmill.dev', 'gone', true)"
+    )
+    .execute(&db)
+    .await?;
+    let as_gone =
+        |builder: reqwest::RequestBuilder| builder.header("Authorization", "Bearer GONE_TOKEN");
+    let resp = as_gone(client().get(format!("{base}/target")))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 200);
+    sqlx::query!("DELETE FROM token WHERE token_prefix = 'GONE_TOKEN'")
+        .execute(&db)
+        .await?;
+    let resp = as_gone(client().post(format!("{base}/connect")))
+        .json(&json!({"token": "SECRET_TOKEN", "target": target}))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 400);
+    let resp = authed(client().post(format!("{base}/connect")))
+        .json(&json!({"token": "SECRET_TOKEN", "target": target}))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 200);
+
+    Ok(())
+}
diff --git a/backend/windmill-api-integration-tests/tests/token_expiry_warning.rs b/backend/windmill-api-integration-tests/tests/token_expiry_warning.rs
new file mode 100644
index 0000000000..667e064cca
--- /dev/null
+++ b/backend/windmill-api-integration-tests/tests/token_expiry_warning.rs
@@ -0,0 +1,49 @@
+//! Which user tokens get an "expiring soon" warning queued when they are created.
+
+use serde_json::json;
+use sqlx::types::chrono::Utc;
+use sqlx::{Pool, Postgres};
+use windmill_test_utils::*;
+
+const DAY: u64 = 24 * 60 * 60;
+
+async fn warning_queued(db: &Pool<Postgres>, label: &str) -> bool {
+    sqlx::query_scalar::<_, bool>(
+        "SELECT EXISTS(SELECT 1 FROM token_expiry_notification n
+            JOIN token t ON t.token_hash = n.token_hash WHERE t.label = $1)",
+    )
+    .bind(label)
+    .fetch_one(db)
+    .await
+    .unwrap()
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_short_lived_tokens_get_no_expiry_warning(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    for (label, lifetime) in [("short", DAY), ("long", 30 * DAY)] {
+        let resp = reqwest::Client::new()
+            .post(format!("http://localhost:{port}/api/users/tokens/create"))
+            .header("Authorization", "Bearer SECRET_TOKEN_2")
+            .json(&json!({
+                "label": label,
+                "expiration": Utc::now() + std::time::Duration::from_secs(lifetime),
+            }))
+            .send()
+            .await?;
+        assert_eq!(resp.status(), 201);
+    }
+
+    assert!(
+        !warning_queued(&db, "short").await,
+        "a token whose whole lifetime fits in the warning window must not be warned about"
+    );
+    assert!(
+        warning_queued(&db, "long").await,
+        "a longer-lived token still gets its warning"
+    );
+    Ok(())
+}
diff --git a/backend/windmill-api-integration-tests/tests/workspace_encryption_key_git_sync.rs b/backend/windmill-api-integration-tests/tests/workspace_encryption_key_git_sync.rs
index 8edfd39d61..a22ad974c3 100644
--- a/backend/windmill-api-integration-tests/tests/workspace_encryption_key_git_sync.rs
+++ b/backend/windmill-api-integration-tests/tests/workspace_encryption_key_git_sync.rs
@@ -275,6 +275,67 @@ async fn test_encryption_key_rotation_dispatches_batched_git_sync(
     Ok(())
 }
 
+/// Stored repository tokens and webhook secrets are encrypted under the
+/// workspace key but never synced, so a rotation has to carry them over even
+/// when the caller skips re-encrypting variables.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_encryption_key_rotation_reencrypts_git_sync_secrets(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    use windmill_common::variables::{build_crypt, crypt_from_key_with_suffix, decrypt, encrypt};
+    initialize_tracing().await;
+
+    create_folder(&db, "28103").await?;
+    create_git_repo_resource(&db).await?;
+    let sync_script_path = "f/28103/test_sync_script_git_secrets";
+    create_sync_script(&db, sync_script_path).await?;
+    setup_git_sync_config(&db, sync_script_path).await?;
+
+    let mc = build_crypt(&db, "test-workspace").await?;
+    sqlx::query(
+        r#"
+        UPDATE workspace_settings SET
+            git_credentials = jsonb_build_array(jsonb_build_object(
+                'token', $1::text, 'repo_identity', 'https://gitlab.example.com/grp/proj')),
+            git_sync = jsonb_set(git_sync, '{repositories,0,auto_pull}', jsonb_build_object(
+                'enabled', true, 'mode', 'webhook', 'webhook_id', 1, 'webhook_secret', $2::text))
+        WHERE workspace_id = 'test-workspace'
+        "#,
+    )
+    .bind(encrypt(&mc, "stored-token"))
+    .bind(encrypt(&mc, "hook-secret"))
+    .execute(&db)
+    .await?;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/test-workspace/workspaces");
+
+    let new_key = "c".repeat(64);
+    let resp = authed(client().post(format!("{base}/encryption_key")))
+        .json(&json!({"new_key": new_key, "skip_reencrypt": true}))
+        .send()
+        .await?;
+    assert_eq!(
+        resp.status(),
+        200,
+        "set_encryption_key failed: {}",
+        resp.text().await?
+    );
+
+    let (token, secret): (String, String) = sqlx::query_as(
+        "SELECT git_credentials->0->>'token', git_sync#>>'{repositories,0,auto_pull,webhook_secret}'
+         FROM workspace_settings WHERE workspace_id = 'test-workspace'",
+    )
+    .fetch_one(&db)
+    .await?;
+    let new_mc = crypt_from_key_with_suffix(&new_key, "");
+    assert_eq!(decrypt(&new_mc, token)?, "stored-token");
+    assert_eq!(decrypt(&new_mc, secret)?, "hook-secret");
+
+    Ok(())
+}
+
 /// Regression test for the non-debouncing fallback: a workspace whose sync
 /// script predates hub version 28103 must still receive git-sync jobs for the
 /// encryption_key entry and every re-encrypted secret. Before the fallback was
diff --git a/backend/windmill-api-integration-tests/tests/workspaces.rs b/backend/windmill-api-integration-tests/tests/workspaces.rs
index 25312cae27..29b8a0a611 100644
--- a/backend/windmill-api-integration-tests/tests/workspaces.rs
+++ b/backend/windmill-api-integration-tests/tests/workspaces.rs
@@ -319,6 +319,14 @@ async fn test_workspace_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
         .unwrap();
     assert_eq!(resp.status(), 200);
 
+    let resp = authed(client().post(format!("{base}/edit_webhook")))
+        .json(&json!({"webhook": "http://127.0.0.1/hook"}))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 400);
+    assert!(resp.text().await?.contains("ALLOW_PRIVATE_WEBHOOK_URLS"));
+
     // --- edit_auto_invite (EE-gated) ---
     let resp = authed(client().post(format!("{base}/edit_auto_invite")))
         .json(&json!({"operator": false, "invite_all": false, "auto_add": false}))
@@ -1166,3 +1174,47 @@ async fn test_create_service_account_drops_orphaned_group_memberships(
 
     Ok(())
 }
+
+#[cfg(feature = "private")]
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_edit_auto_invite_preserves_instance_groups(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    sqlx::query(
+        r#"UPDATE workspace_settings
+           SET auto_invite = '{"instance_groups": ["eng"], "instance_groups_roles": {"eng": "developer"}}'
+           WHERE workspace_id = 'test-workspace'"#,
+    )
+    .execute(&db)
+    .await?;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/test-workspace/workspaces");
+
+    // enable, then disable
+    for body in [
+        json!({"operator": false, "invite_all": true, "auto_add": false}),
+        json!({}),
+    ] {
+        let resp = authed(client().post(format!("{base}/edit_auto_invite")))
+            .json(&body)
+            .send()
+            .await?;
+        assert_eq!(resp.status(), 200, "{body}: {}", resp.text().await?);
+
+        let auto_invite: serde_json::Value = sqlx::query_scalar(
+            "SELECT auto_invite FROM workspace_settings WHERE workspace_id = 'test-workspace'",
+        )
+        .fetch_one(&db)
+        .await?;
+        assert_eq!(auto_invite["instance_groups"], json!(["eng"]), "{body}");
+        assert_eq!(
+            auto_invite["instance_groups_roles"],
+            json!({"eng": "developer"}),
+            "{body}"
+        );
+    }
+
+    Ok(())
+}
diff --git a/backend/windmill-api-jobs/src/execution.rs b/backend/windmill-api-jobs/src/execution.rs
index 7184f8ecec..9ad7189434 100644
--- a/backend/windmill-api-jobs/src/execution.rs
+++ b/backend/windmill-api-jobs/src/execution.rs
@@ -40,8 +40,8 @@ use windmill_common::{
     FlowVersionInfo, DB,
 };
 use windmill_queue::{
-    cancel_job, get_result_and_success_by_id_from_flow, parse_result_object, push, PushArgs,
-    PushArgsOwned, PushIsolationLevel,
+    cancel_job, check_tag_available_for_push, get_result_and_success_by_id_from_flow,
+    parse_result_object, push, tag_reads_args, PushArgs, PushArgsOwned, PushIsolationLevel,
 };
 
 use crate::types::RunJobQuery;
@@ -50,7 +50,27 @@ use crate::types::RunJobQuery;
 // Tag / license checks
 // ---------------------------------------------------------------------------
 
+/// `args` must be the ones the job is pushed with, see [`windmill_queue::check_tag_available_for_push`].
 pub async fn check_tag_available_for_workspace(
+    db: &DB,
+    w_id: &str,
+    tag: &Option<String>,
+    args: &PushArgs<'_>,
+    authed: &ApiAuthed,
+) -> error::Result<()> {
+    if let Some(tag) = tag.as_deref().filter(|t| !t.is_empty()) {
+        let tags = get_scope_tags(authed);
+        // Job-aware: a WM_TOKEN running as a superadmin must not unlock restricted tags.
+        let is_super_admin = windmill_api_auth::is_super_admin_authed(db, authed).await?;
+        check_tag_available_for_push(db, w_id, tag, args, is_super_admin, tags).await
+    } else {
+        Ok(())
+    }
+}
+
+/// [`check_tag_available_for_workspace`] for a tag filled in from values nothing can check yet,
+/// such as a flow's preprocessor output: only an entry spelled exactly like it admits it.
+pub async fn check_tag_as_written_available_for_workspace(
     db: &DB,
     w_id: &str,
     tag: &Option<String>,
@@ -60,7 +80,16 @@ pub async fn check_tag_available_for_workspace(
         let tags = get_scope_tags(authed);
         // Job-aware: a WM_TOKEN running as a superadmin must not unlock restricted tags.
         let is_super_admin = windmill_api_auth::is_super_admin_authed(db, authed).await?;
-        check_tag_available_for_workspace_internal(db, w_id, tag, is_super_admin, tags).await
+        check_tag_available_for_workspace_internal(
+            db,
+            w_id,
+            tag,
+            None,
+            std::future::ready(w_id.to_string()),
+            is_super_admin,
+            tags,
+        )
+        .await
     } else {
         Ok(())
     }
@@ -760,9 +789,25 @@ pub async fn run_flow<'c>(
         ..
     } = flow_version_info;
 
-    let tag = run_query.tag.clone().or(tag);
+    let flow_tag = tag;
+    let tag = run_query.tag.clone().or(flow_tag.clone());
+    let push_args = PushArgs { args: &args.args, extra: args.extra };
+    let apply_preprocessor =
+        !run_query.skip_preprocessor.unwrap_or(false) && has_preprocessor.unwrap_or(false);
 
-    check_tag_available_for_workspace(&db, &w_id, &tag, &authed).await?;
+    if !apply_preprocessor || run_query.tag.is_some() {
+        check_tag_available_for_workspace(&db, &w_id, &tag, &push_args, &authed).await?;
+    }
+    // `push` drops the tag of a flow whose preprocessor runs, and the worker then puts the flow on
+    // its own tag filled in from the preprocessor's output, after this caller's identity is gone.
+    // So that tag is the one to check, and an `$args[...]` in it is judged as written.
+    if apply_preprocessor {
+        if flow_tag.as_deref().is_some_and(tag_reads_args) {
+            check_tag_as_written_available_for_workspace(&db, &w_id, &flow_tag, &authed).await?;
+        } else {
+            check_tag_available_for_workspace(&db, &w_id, &flow_tag, &push_args, &authed).await?;
+        }
+    }
     let scheduled_for = run_query.get_scheduled_for(&db).await?;
 
     let return_tx = tx_o.is_some();
@@ -798,11 +843,10 @@ pub async fn run_flow<'c>(
             path: flow_path.to_string(),
             dedicated_worker,
             version,
-            apply_preprocessor: !run_query.skip_preprocessor.unwrap_or(false)
-                && has_preprocessor.unwrap_or(false),
+            apply_preprocessor,
             labels,
         },
-        PushArgs { args: &args.args, extra: args.extra },
+        push_args,
         authed.display_username(),
         email,
         permissioned_as,
@@ -988,7 +1032,8 @@ pub async fn push_script_job_by_path_into_queue<'c>(
     let scheduled_for = run_query.get_scheduled_for(&db).await?;
 
     let tag = run_query.tag.clone().or(tag);
-    check_tag_available_for_workspace(&db, &w_id, &tag, &authed).await?;
+    let push_args = PushArgs { args: &args.args, extra: args.extra };
+    check_tag_available_for_workspace(&db, &w_id, &tag, &push_args, &authed).await?;
 
     let return_tx = tx_o.is_some();
 
@@ -1020,7 +1065,7 @@ pub async fn push_script_job_by_path_into_queue<'c>(
         tx,
         &w_id,
         job_payload,
-        PushArgs { args: &args.args, extra: args.extra },
+        push_args,
         authed.display_username(),
         email,
         permissioned_as,
diff --git a/backend/windmill-api-schedule/src/lib.rs b/backend/windmill-api-schedule/src/lib.rs
index dfd4a6e3ba..78cd6eb378 100644
--- a/backend/windmill-api-schedule/src/lib.rs
+++ b/backend/windmill-api-schedule/src/lib.rs
@@ -619,6 +619,7 @@ async fn edit_schedule(
             dynamic_skip            = $23,
             email                   = $24,
             edited_by               = $25,
+            edited_at               = now(),
             permissioned_as         = $26,
             labels                  = COALESCE($27, labels)
         WHERE path = $19 AND workspace_id = $20
diff --git a/backend/windmill-api-scripts/Cargo.toml b/backend/windmill-api-scripts/Cargo.toml
index 8b34512872..72353c6f1b 100644
--- a/backend/windmill-api-scripts/Cargo.toml
+++ b/backend/windmill-api-scripts/Cargo.toml
@@ -30,7 +30,11 @@ windmill-parser-ts-asset.workspace = true
 windmill-parser-sql-asset.workspace = true
 windmill-parser-sql.workspace = true
 windmill-parser-yaml.workspace = true
+windmill-parser-bash.workspace = true
+windmill-parser-go.workspace = true
+windmill-parser-graphql.workspace = true
 
+anyhow.workspace = true
 axum.workspace = true
 futures.workspace = true
 http.workspace = true
diff --git a/backend/windmill-api-scripts/src/scripts.rs b/backend/windmill-api-scripts/src/scripts.rs
index a4667e4876..631e8606e6 100644
--- a/backend/windmill-api-scripts/src/scripts.rs
+++ b/backend/windmill-api-scripts/src/scripts.rs
@@ -55,7 +55,7 @@ use windmill_common::{
         min_version_supports_runnable_settings_v0, RunnableSettings, RunnableSettingsTrait,
     },
     scripts::{hash_script, ScriptRunnableSettingsHandle, ScriptRunnableSettingsInline},
-    utils::{paginate_without_limits, WarnAfterExt},
+    utils::{paginate_optional, paginate_without_limits, WarnAfterExt},
     worker::CLOUD_HOSTED,
 };
 use windmill_object_store::upload_artifact_to_store;
@@ -1132,6 +1132,96 @@ async fn validate_dbt_relation(
         })
 }
 
+/// The schema the editor would have derived from `content`, for a deploy that sends
+/// none (MCP, a bare API call). `None` for a language whose parser this build lacks,
+/// or code that does not parse.
+fn infer_main_schema(
+    language: &ScriptLang,
+    kind: Option<&ScriptKind>,
+    content: &str,
+    previous: Option<&serde_json::Value>,
+) -> Option<Schema> {
+    let entrypoint =
+        matches!(kind, Some(ScriptKind::Preprocessor)).then(|| "preprocessor".to_string());
+    // The database a SQL script runs against is an argument unless the code names
+    // it (`-- database f/...`), as in the editor.
+    let with_db = |sig: anyhow::Result<windmill_parser::MainArgSignature>, resource: &str| {
+        sig.map(|mut sig| {
+            if windmill_parser_sql::parse_db_resource(content).is_none() {
+                sig.args.insert(
+                    0,
+                    windmill_parser::Arg {
+                        name: "database".to_string(),
+                        typ: windmill_parser::Typ::Resource(resource.to_string()),
+                        ..Default::default()
+                    },
+                );
+            }
+            sig
+        })
+    };
+    let sig = match language {
+        ScriptLang::Bun | ScriptLang::Bunnative | ScriptLang::Deno | ScriptLang::Nativets => {
+            windmill_parser_ts::parse_deno_signature(content, false, false, entrypoint)
+        }
+        #[cfg(feature = "python")]
+        ScriptLang::Python3 => {
+            windmill_parser_py::parse_python_signature(content, entrypoint, false)
+        }
+        ScriptLang::Go => windmill_parser_go::parse_go_sig(content),
+        ScriptLang::Bash => windmill_parser_bash::parse_bash_sig(content),
+        ScriptLang::Powershell => windmill_parser_bash::parse_powershell_sig(content),
+        ScriptLang::Postgresql => {
+            with_db(windmill_parser_sql::parse_pgsql_sig(content), "postgresql")
+        }
+        ScriptLang::Mysql => with_db(windmill_parser_sql::parse_mysql_sig(content), "mysql"),
+        ScriptLang::Bigquery => {
+            with_db(windmill_parser_sql::parse_bigquery_sig(content), "bigquery")
+        }
+        ScriptLang::Snowflake => with_db(
+            windmill_parser_sql::parse_snowflake_sig(content),
+            "snowflake",
+        ),
+        ScriptLang::Mssql => with_db(
+            windmill_parser_sql::parse_mssql_sig(content),
+            "ms_sql_server",
+        ),
+        ScriptLang::OracleDB => {
+            with_db(windmill_parser_sql::parse_oracledb_sig(content), "oracledb")
+        }
+        ScriptLang::DuckDb => windmill_parser_sql::parse_duckdb_sig(content),
+        ScriptLang::Graphql => {
+            windmill_parser_graphql::parse_graphql_sig(content).map(|mut sig| {
+                sig.args.insert(
+                    0,
+                    windmill_parser::Arg {
+                        name: "api".to_string(),
+                        typ: windmill_parser::Typ::Resource("graphql".to_string()),
+                        ..Default::default()
+                    },
+                );
+                sig
+            })
+        }
+        ScriptLang::Ansible => windmill_parser_yaml::parse_ansible_sig(content),
+        _ => return None,
+    };
+    match sig {
+        Ok(sig) => serde_json::value::to_raw_value(&windmill_parser::json_schema::main_arg_schema(
+            &sig, previous,
+        ))
+        .ok()
+        .map(|v| Schema(sqlx::types::Json(v))),
+        Err(e) => {
+            tracing::warn!(
+                "could not infer the schema of a {} script: {e:#}",
+                language.as_str()
+            );
+            None
+        }
+    }
+}
+
 async fn create_script_internal<'c>(
     mut ns: NewScript,
     w_id: String,
@@ -1359,6 +1449,40 @@ async fn create_script_internal<'c>(
         parent_adopted_from_retired_path = ns.parent_hash.is_some();
     }
 
+    // Before hashing, so the hash and the no-op check see the schema that gets stored.
+    // `{}` counts as absent: an agent filling every tool argument sends it for "none".
+    let schema_absent = ns.schema.as_ref().is_none_or(|s| {
+        serde_json::from_str::<serde_json::Map<String, serde_json::Value>>(s.0.get())
+            .is_ok_and(|m| m.is_empty())
+    });
+    if schema_absent && !matches!(ns.language, ScriptLang::Dbt) {
+        let previous = match &ns.parent_hash {
+            Some(p_hash) => sqlx::query_scalar::<_, Option<sqlx::types::Json<serde_json::Value>>>(
+                "SELECT schema FROM script WHERE hash = $1 AND workspace_id = $2",
+            )
+            .bind(p_hash.0)
+            .bind(&w_id)
+            .fetch_optional(&mut *tx)
+            .await?
+            .flatten()
+            .map(|s| s.0),
+            None => None,
+        };
+        // Code the server cannot parse keeps the previous version's schema, as it
+        // does in the editor, rather than losing it for good.
+        ns.schema = infer_main_schema(
+            &ns.language,
+            ns.kind.as_ref(),
+            &ns.content,
+            previous.as_ref(),
+        )
+        .or_else(|| {
+            previous
+                .and_then(|p| serde_json::value::to_raw_value(&p).ok())
+                .map(|v| Schema(sqlx::types::Json(v)))
+        });
+    }
+
     // Must stay below the parent resolution above: an auto_parent deploy hashed before
     // it carries a first deploy's lineage, so redeploying content the path has held
     // before collides with that archived version instead of superseding it. The
@@ -2312,6 +2436,20 @@ async fn create_script_internal<'c>(
             .await?;
         }
 
+        if p_path != &ns.path {
+            // Everything left at the old path is a draft this deploy didn't
+            // consume — teammates' rows, and the deployer's own when the caller
+            // asked us to keep it. Carry them rather than strand them.
+            windmill_common::user_drafts::move_drafts_for_path(
+                &mut tx,
+                &w_id,
+                &[UserDraftItemKind::Script],
+                p_path,
+                &ns.path,
+            )
+            .await?;
+        }
+
         sqlx::query!(
             "UPDATE capture_config SET path = $1 WHERE path = $2 AND workspace_id = $3 AND is_flow IS FALSE",
             ns.path,
@@ -2389,19 +2527,32 @@ async fn create_script_internal<'c>(
                 tx = push_scheduled_job(&db, tx, &schedule, None, None).await?;
             }
         }
-    } else if !skip_draft_deletion {
-        // See the matching branch above — only wipe the deployer's own
-        // draft (plus the legacy NULL-email row).
-        sqlx::query!(
-            "DELETE FROM draft WHERE path = $1 AND workspace_id = $2 AND typ = 'script' \
-             AND (email = $3 OR email IS NULL)",
-            ns.path,
-            &w_id,
-            &authed.email,
-        )
-        .execute(&mut *tx)
-        .await?;
+    } else {
+        if !skip_draft_deletion {
+            // See the matching branch above — only wipe the deployer's own
+            // draft (plus the legacy NULL-email row).
+            sqlx::query!(
+                "DELETE FROM draft WHERE path = $1 AND workspace_id = $2 AND typ = 'script' \
+                 AND (email = $3 OR email IS NULL)",
+                ns.path,
+                &w_id,
+                &authed.email,
+            )
+            .execute(&mut *tx)
+            .await?;
+        }
     }
+    // Every deploy, not only a new script: an archived script's draft can be moved away
+    // (`move_draft` ignores archived rows), and unarchiving redeploys at the same path,
+    // where a route left behind would send the live script's saves to the moved draft.
+    windmill_common::user_drafts::clear_draft_moves_from(
+        &mut tx,
+        &w_id,
+        &[UserDraftItemKind::Script],
+        &ns.path,
+        p_path_opt.as_deref(),
+    )
+    .await?;
     if p_hashes.is_some() && !p_hashes.unwrap().is_empty() {
         audit_log(
             &mut *tx,
@@ -3061,17 +3212,24 @@ async fn get_script_history(
     authed: ApiAuthed,
     Extension(user_db): Extension<UserDB>,
     Path((w_id, path)): Path<(String, StripPath)>,
+    Query(pagination): Query<Pagination>,
 ) -> JsonResult<Vec<ScriptHistory>> {
     let path = path.to_path();
     check_scopes(&authed, || format!("scripts:read:{}", path))?;
+    // Unasked-for, this listing stays whole: the deployment-history panels, the restart
+    // picker and the CLI all read it without paging. The diff picker asks for a page.
+    let (per_page, offset) = paginate_optional(pagination);
     let mut tx = user_db.begin(&authed).await?;
     let query_result = sqlx::query!(
-        "SELECT s.hash as hash, dm.deployment_msg as deployment_msg, s.created_at as created_at
+        "SELECT s.hash as hash, dm.deployment_msg as deployment_msg, s.created_at as created_at, s.created_by as created_by
         FROM script s LEFT JOIN deployment_metadata dm ON s.hash = dm.script_hash
         WHERE s.workspace_id = $1 AND s.path = $2
-        ORDER by s.created_at DESC",
+        ORDER by s.created_at DESC
+        LIMIT $3 OFFSET $4",
         w_id,
         path,
+        per_page,
+        offset,
     )
     .fetch_all(&mut *tx)
     .await?;
@@ -3083,6 +3241,7 @@ async fn get_script_history(
             script_hash: ScriptHash(row.hash),
             deployment_msg: row.deployment_msg,
             created_at: Some(row.created_at),
+            created_by: Some(row.created_by),
         })
         .collect();
     return Ok(Json(result));
@@ -3097,7 +3256,7 @@ async fn get_latest_version(
     check_scopes(&authed, || format!("scripts:read:{}", path))?;
     let mut tx = user_db.begin(&authed).await?;
     let row_o = sqlx::query!(
-        "SELECT s.hash as hash, dm.deployment_msg as deployment_msg, s.created_at as created_at
+        "SELECT s.hash as hash, dm.deployment_msg as deployment_msg, s.created_at as created_at, s.created_by as created_by
         FROM script s LEFT JOIN deployment_metadata dm ON s.hash = dm.script_hash
         WHERE s.workspace_id = $1 AND s.path = $2
         ORDER by s.created_at DESC LIMIT 1",
@@ -3113,6 +3272,7 @@ async fn get_latest_version(
             script_hash: ScriptHash(row.hash),
             deployment_msg: row.deployment_msg,
             created_at: Some(row.created_at),
+            created_by: Some(row.created_by),
         };
         return Ok(Json(Some(result)));
     } else {
diff --git a/backend/windmill-api-settings/Cargo.toml b/backend/windmill-api-settings/Cargo.toml
index bc5078bce4..0ec99ef6d0 100644
--- a/backend/windmill-api-settings/Cargo.toml
+++ b/backend/windmill-api-settings/Cargo.toml
@@ -11,7 +11,7 @@ path = "src/lib.rs"
 [features]
 default = []
 enterprise = ["license"]
-private = ["windmill-common/private"]
+private = ["windmill-common/private", "windmill-audit/private"]
 parquet = ["windmill-common/parquet", "windmill-object-store/parquet"]
 license = ["dep:rsa"]
 
@@ -19,6 +19,7 @@ license = ["dep:rsa"]
 windmill-ai = { workspace = true, default-features = false }
 windmill-alerting.workspace = true
 windmill-api-auth.workspace = true
+windmill-audit.workspace = true
 windmill-common = { workspace = true, default-features = false }
 axum.workspace = true
 anyhow.workspace = true
diff --git a/backend/windmill-api-settings/src/datatable_roles_oss.rs b/backend/windmill-api-settings/src/datatable_roles_oss.rs
new file mode 100644
index 0000000000..885d13ee9d
--- /dev/null
+++ b/backend/windmill-api-settings/src/datatable_roles_oss.rs
@@ -0,0 +1,44 @@
+/*
+ * Author: Ruben Fiszel
+ * Copyright: Windmill Labs, Inc 2022
+ * This file and its contents are licensed under the AGPLv3 License.
+ * Please see the included NOTICE for copyright information and
+ * LICENSE-AGPL for a copy of the license.
+ */
+
+//! Where the data table role catalog endpoints come from: the enterprise implementation, or a
+//! refusal. Roles are an Enterprise Edition feature; see `windmill_common::datatable_roles_oss`.
+
+#[cfg(all(feature = "private", feature = "enterprise"))]
+pub(crate) use crate::datatable_roles_ee::{
+    create_datatable_role, delete_datatable_role, list_datatable_roles, update_datatable_role,
+};
+
+#[cfg(not(all(feature = "private", feature = "enterprise")))]
+pub(crate) use ce::*;
+
+// The routes stay registered so the API has one shape; each answers after authentication, before
+// anything is read.
+#[cfg(not(all(feature = "private", feature = "enterprise")))]
+mod ce {
+    use windmill_api_auth::ApiAuthed;
+    use windmill_common::{
+        datatable_roles_oss::datatable_roles_unavailable as unavailable, error::Result,
+    };
+
+    pub(crate) async fn list_datatable_roles(_authed: ApiAuthed) -> Result<String> {
+        Err(unavailable())
+    }
+
+    pub(crate) async fn create_datatable_role(_authed: ApiAuthed) -> Result<String> {
+        Err(unavailable())
+    }
+
+    pub(crate) async fn update_datatable_role(_authed: ApiAuthed) -> Result<String> {
+        Err(unavailable())
+    }
+
+    pub(crate) async fn delete_datatable_role(_authed: ApiAuthed) -> Result<String> {
+        Err(unavailable())
+    }
+}
diff --git a/backend/windmill-api-settings/src/lib.rs b/backend/windmill-api-settings/src/lib.rs
index 2e2b3290fa..bc52d85d54 100644
--- a/backend/windmill-api-settings/src/lib.rs
+++ b/backend/windmill-api-settings/src/lib.rs
@@ -17,6 +17,9 @@ mod audit_logs_s3;
 mod audit_logs_s3_backfill;
 #[cfg(feature = "parquet")]
 mod background_task;
+#[cfg(all(feature = "private", feature = "enterprise"))]
+mod datatable_roles_ee;
+mod datatable_roles_oss;
 #[cfg(feature = "private")]
 mod ee;
 pub mod ee_oss;
@@ -55,12 +58,13 @@ use windmill_common::{
     error::{self, pg_error_message, JsonResult, Result},
     get_database_url,
     global_settings::{
-        AI_CONFIG_SETTING, APP_WORKSPACED_ROUTE_SETTING, AUTOMATE_USERNAME_CREATION_SETTING,
-        CRITICAL_ALERT_MUTE_UI_SETTING, CUSTOM_TAGS_SETTING, DEFAULT_TAGS_WORKSPACES_SETTING,
-        DISABLE_HUB_SETTING, EMAIL_DOMAIN_SETTING, ENV_SETTINGS,
+        ACCENT_COLOR_SETTING, AI_CONFIG_SETTING, APP_WORKSPACED_ROUTE_SETTING,
+        AUTOMATE_USERNAME_CREATION_SETTING, CRITICAL_ALERT_MUTE_UI_SETTING, CUSTOM_TAGS_SETTING,
+        DEFAULT_TAGS_WORKSPACES_SETTING, DISABLE_HUB_SETTING, EMAIL_DOMAIN_SETTING, ENV_SETTINGS,
         GITHUB_APP_WEBHOOK_BASE_URL_SETTING, HTTP_ROUTE_DEFAULT_ALLOWED_ORIGINS_SETTING,
         HTTP_ROUTE_WORKSPACED_ROUTE_SETTING, HUB_ACCESSIBLE_URL_SETTING, HUB_BASE_URL_SETTING,
         INSTANCE_BANNER_SETTING, MAX_RETENTION_OVERRIDE_WORKSPACES,
+        MAX_TOKEN_EXPIRATION_DAYS_SETTING, MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING,
         RETENTION_PERIOD_SECS_OVERRIDES_SETTING, RUFF_CONFIG_SETTING, UNIQUE_ID_SETTING,
         WORKSPACE_FAIRNESS_DURATION_SECS_SETTING, WORKSPACE_FAIRNESS_ENABLED_SETTING,
         WORKSPACE_FAIRNESS_MAX_PERCENT_SETTING, WORKSPACE_FAIRNESS_MIN_TOTAL_SETTING,
@@ -111,6 +115,17 @@ async fn get_ruff_config_unauthed(Extension(db): Extension<DB>) -> error::Result
         .unwrap())
 }
 
+/// The announcement banner and accent color, which every signed-in session reads on each
+/// full page load.
+async fn get_instance_ui(
+    Extension(db): Extension<DB>,
+    _authed: ApiAuthed,
+) -> JsonResult<windmill_common::global_settings::InstanceUi> {
+    Ok(Json(
+        windmill_common::global_settings::get_instance_ui(&db).await?,
+    ))
+}
+
 pub fn global_service() -> Router {
     #[warn(unused_mut)]
     let r = Router::new()
@@ -122,6 +137,7 @@ pub fn global_service() -> Router {
             "/global/{key}",
             post(set_global_setting).get(get_global_setting),
         )
+        .route("/instance_ui", get(get_instance_ui))
         .route("/list_global", get(list_global_settings))
         .route("/github_app_stale_webhooks", get(github_app_stale_webhooks))
         .route(
@@ -151,6 +167,16 @@ pub fn global_service() -> Router {
             "/list_custom_instance_pg_databases",
             post(list_custom_instance_pg_databases),
         )
+        .route(
+            "/datatable_roles",
+            get(datatable_roles_oss::list_datatable_roles)
+                .post(datatable_roles_oss::create_datatable_role),
+        )
+        .route(
+            "/datatable_roles/{id}",
+            post(datatable_roles_oss::update_datatable_role)
+                .delete(datatable_roles_oss::delete_datatable_role),
+        )
         .route(
             "/refresh_custom_instance_user_pwd",
             post(refresh_custom_instance_user_pwd),
@@ -931,6 +957,8 @@ async fn run_setting_pre_write_hook(
         AI_CONFIG_SETTING => {
             windmill_ai::ai_types::validate_model_pricing_json(value)
                 .map_err(error::Error::BadRequest)?;
+            windmill_ai::ai_types::validate_token_maps_json(value)
+                .map_err(error::Error::BadRequest)?;
         }
         AUTOMATE_USERNAME_CREATION_SETTING => {
             if value.as_bool().unwrap_or(false) {
@@ -1182,6 +1210,12 @@ async fn run_setting_pre_write_hook(
                 }
             }
         }
+        MAX_TOKEN_EXPIRATION_DAYS_SETTING => {
+            windmill_common::global_settings::parse_max_token_expiration_days(Some(value))
+                .map_err(|e| {
+                    error::Error::BadRequest(format!("{MAX_TOKEN_EXPIRATION_DAYS_SETTING}: {e}"))
+                })?;
+        }
         INSTANCE_BANNER_SETTING => {
             match value {
                 // Clearing (delete row) is handled by the caller; allow it through.
@@ -1194,6 +1228,12 @@ async fn run_setting_pre_write_hook(
                 }
             }
         }
+        ACCENT_COLOR_SETTING => match value {
+            serde_json::Value::Null => {}
+            serde_json::Value::String(s) if s.trim().is_empty() => {}
+            v => windmill_common::global_settings::validate_accent_color(v)
+                .map_err(|e| error::Error::BadRequest(format!("{ACCENT_COLOR_SETTING}: {e}")))?,
+        },
         _ => {}
     }
     Ok(())
@@ -1343,6 +1383,12 @@ pub async fn get_global_setting(
         && key != HTTP_ROUTE_DEFAULT_ALLOWED_ORIGINS_SETTING
         && key != WS_BASE_URL_SETTING
         && key != INSTANCE_BANNER_SETTING
+        // The token form reads it to stop offering expirations the server would shorten.
+        && key != MAX_TOKEN_EXPIRATION_DAYS_SETTING
+        // Whoever is wiring up an MCP client reads it to know whether a URL-borne token
+        // would be refused, and they are usually not a superadmin. Not a secret: pointing
+        // any MCP client at the instance discovers the same answer.
+        && key != MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING
     {
         require_super_admin(&db, &authed).await?;
     }
@@ -1654,6 +1700,8 @@ struct CustomInstanceDbLogs {
     replication_user: String,
     #[serde(skip_serializing_if = "Option::is_none")]
     replication_user_error: Option<String>,
+    #[serde(skip_serializing_if = "String::is_empty")]
+    user_connect: String,
 }
 
 async fn list_custom_instance_pg_databases(
@@ -1871,9 +1919,57 @@ async fn setup_custom_instance_pg_database_inner(
         }
     }
 
+    // Everything above logged in as the DATABASE_URL user, but whatever uses the database logs
+    // in as custom_instance_user. A proxy that routes on the login name can accept one and
+    // refuse the other, which would otherwise surface only once a data table first connects.
+    let user_creds = PgDatabase {
+        user: Some(windmill_common::datatable_roles::CUSTOM_INSTANCE_USER.to_string()),
+        password: Some(windmill_common::utils::get_custom_pg_instance_password(db).await?),
+        ..pg_creds
+    };
+    let (client, connection) = user_creds
+        .connect(Some(db))
+        .await
+        .map_err(|e| custom_instance_user_connect_error(&user_creds.host, dbname, e))?;
+    let join_handle = tokio::spawn(async move { connection.await });
+    logs.user_connect = "OK".to_string();
+    drop(client); // /!\ Drop before joining to avoid deadlock
+    windmill_common::shutdown_pg_connection(join_handle).await?;
+
     Ok(())
 }
 
+fn custom_instance_user_connect_error(host: &str, dbname: &str, e: error::Error) -> error::Error {
+    let cause = match &e {
+        error::Error::Anyhow { error, .. } => format!("{error:#}"),
+        e => e.to_string(),
+    };
+    // Supavisor, Supabase's pooler, reads the tenant to route to from the login
+    // (`<user>.<project_ref>`), and only knows the logins configured for that tenant.
+    let lower = cause.to_lowercase();
+    let routing_refused = [
+        "enoidentifier",
+        "tenant identifier",
+        "tenant or user",
+        "tenant/user",
+    ]
+    .iter()
+    .any(|signature| lower.contains(signature));
+    if routing_refused {
+        error::Error::BadConfig(format!(
+            "DATABASE_URL reaches Postgres through a connection pooler ({host}) that picks the \
+             server to route to from the login name, and it refused custom_instance_user, the \
+             role Windmill uses for instance databases ({cause}). Instance databases cannot be \
+             used through this pooler: use your own Postgres database instead, or point \
+             DATABASE_URL at the Postgres server directly rather than at the pooler."
+        ))
+    } else {
+        error::Error::ExecutionErr(format!(
+            "Could not connect to {dbname} as custom_instance_user: {cause}"
+        ))
+    }
+}
+
 async fn drop_custom_instance_pg_database(
     authed: ApiAuthed,
     Extension(db): Extension<DB>,
@@ -2276,6 +2372,34 @@ mod tests {
     use std::collections::BTreeMap;
     use windmill_common::instance_config::{GlobalSettings, InstanceConfig, WorkerGroupConfig};
 
+    #[test]
+    fn supavisor_refusing_custom_instance_user_is_named() {
+        use windmill_common::error::{to_anyhow, Error};
+        let connect_error = |message: &str| {
+            let e = Error::from(to_anyhow(std::io::Error::other(message.to_string())));
+            super::custom_instance_user_connect_error(
+                "aws-0-eu-west-1.pooler.supabase.com",
+                "dt",
+                e,
+            )
+        };
+        for supavisor in [
+            "db error: FATAL: (ENOIDENTIFIER) no tenant identifier provided",
+            "db error: FATAL: Tenant or user not found",
+        ] {
+            assert!(
+                matches!(connect_error(supavisor), Error::BadConfig(m) if m.contains("connection pooler")),
+                "{supavisor}"
+            );
+        }
+        assert!(matches!(
+            connect_error(
+                "db error: FATAL: password authentication failed for user \"custom_instance_user\""
+            ),
+            Error::ExecutionErr(_)
+        ));
+    }
+
     #[test]
     fn instance_config_yaml_round_trip() {
         let config = InstanceConfig {
diff --git a/backend/windmill-api-users/src/users.rs b/backend/windmill-api-users/src/users.rs
index b7d30eaa4b..a1b1054a25 100644
--- a/backend/windmill-api-users/src/users.rs
+++ b/backend/windmill-api-users/src/users.rs
@@ -47,7 +47,10 @@ use windmill_audit::audit_oss::audit_log;
 use windmill_audit::ActionKind;
 use windmill_common::audit::AuditAuthor;
 use windmill_common::auth::{hash_token, safe_token_prefix, TOKEN_PREFIX_LEN};
-use windmill_common::global_settings::AUTOMATE_USERNAME_CREATION_SETTING;
+use windmill_common::global_settings::{
+    load_value_from_global_settings, parse_max_token_expiration_days,
+    AUTOMATE_USERNAME_CREATION_SETTING, MAX_TOKEN_EXPIRATION_DAYS_SETTING,
+};
 use windmill_common::oauth2::InstanceEvent;
 use windmill_common::per_minute_counter::PerMinuteCounter;
 use windmill_common::users::truncate_token;
@@ -524,7 +527,7 @@ async fn list_users_as_super_admin(
     let rows = if active_only.is_some_and(|x| x) {
         sqlx::query_as!(
             GlobalUserInfo,
-            r#"WITH active_users AS (SELECT distinct username as email FROM (SELECT username, timestamp, operation FROM audit_partitioned UNION ALL SELECT username, timestamp, operation FROM audit) AS a WHERE timestamp > NOW() - INTERVAL '1 month' AND (operation = 'users.login' OR operation = 'oauth.login' OR operation = 'users.token.refresh')),
+            r#"WITH active_users AS (SELECT distinct username as email FROM audit_partitioned WHERE timestamp > NOW() - INTERVAL '1 month' AND (operation = 'users.login' OR operation = 'oauth.login' OR operation = 'users.token.refresh')),
             authors as (SELECT distinct email FROM usr WHERE usr.operator IS false)
             SELECT email as "email!", (email NOT IN (SELECT email FROM authors)) as operator_only, NULL::bool as is_workspace_admin, login_type::text, verified as "verified!", super_admin as "super_admin!", devops as "devops!", name, company, username, first_time_user as "first_time_user!", role_source as "role_source!", disabled as "disabled!", NULL::text as workspace_id
             FROM password
@@ -1703,14 +1706,25 @@ async fn delete_user(
         .await?;
     windmill_common::user_drafts::delete_drafts_of_email(&mut *tx, &email_to_delete).await?;
 
-    let usernames = sqlx::query_scalar!(
-        "DELETE FROM usr WHERE email = $1 RETURNING username",
+    let memberships = sqlx::query!(
+        "DELETE FROM usr WHERE email = $1 RETURNING username, workspace_id",
         &email_to_delete
     )
     .fetch_all(&mut *tx)
     .await?;
 
-    for username in usernames {
+    for row in memberships {
+        let username = row.username;
+        // A tenant list names a principal of its workspace, so the name has to be freed in every
+        // workspace this account belonged to: a later account taking the username would otherwise
+        // inherit the data table access it had.
+        windmill_common::workspaces::remove_datatable_tenant_in_workspace(
+            &mut tx,
+            &row.workspace_id,
+            &format!("u/{username}"),
+        )
+        .await?;
+
         sqlx::query!("DELETE FROM password WHERE email = $1", &email_to_delete)
             .execute(&mut *tx)
             .await?;
@@ -2456,6 +2470,15 @@ pub async fn delete_workspace_user_internal(
     tx: &mut Transaction<'_, Postgres>,
     authed: Option<&ApiAuthed>, // None for system operations
 ) -> Result<()> {
+    // Same reasoning as the `extra_perms` sweep below: a freed username must not stay named
+    // anywhere that grants access, tenant lists included.
+    windmill_common::workspaces::remove_datatable_tenant_in_workspace(
+        tx,
+        w_id,
+        &format!("u/{username_to_delete}"),
+    )
+    .await?;
+
     // ---- Clean up extra_perms referencing this user ----
     let extra_perms_tables = [
         "script",
@@ -2540,6 +2563,14 @@ pub async fn delete_workspace_user_internal(
     .execute(&mut **tx)
     .await?;
 
+    sqlx::query!(
+        "DELETE FROM remote_deploy_token WHERE email = $1 AND workspace_id = $2",
+        email_to_delete,
+        w_id
+    )
+    .execute(&mut **tx)
+    .await?;
+
     sqlx::query!(
         "DELETE FROM usr_to_group WHERE usr = $1 AND workspace_id = $2",
         username_to_delete,
@@ -3072,11 +3103,68 @@ pub async fn create_guest_session_token<'c>(
 
 // create_token_internal is re-exported from windmill-api-auth above
 
+/// Applies the instance-wide ceiling on how long a token a caller picks the lifetime of may
+/// live (`create_token`, and `impersonate` for superadmins), returning the expiration to store:
+/// the requested one while it fits, the ceiling otherwise, and the ceiling as well when none was
+/// requested. Only the stored expiration is capped: tokens already stored when the setting is
+/// turned on or lowered keep theirs, since the auth lookup never reads the setting.
+///
+/// It shortens rather than refuses because most callers do not comply on their own. The CLI
+/// authorization page, `wmill user create-token` and the editor's language-server token each
+/// pick a lifetime, often none at all, without reading the setting (and CLIs already installed
+/// never will), so refusing would break logging in and the editor instead of the long-lived
+/// tokens the setting is aimed at.
+///
+/// Read from `global_settings` on each call rather than cached: token creation is rare
+/// enough that the round trip costs nothing, and the ceiling is then never served stale.
+///
+/// A token owned by a service account is exempt: in the workspace the token names, or in any
+/// workspace for a workspace-less token, which has none to match. Service accounts are the
+/// identity automation that needs a long-lived credential runs as. The cost is that any
+/// workspace admin can create and impersonate one to hold an uncapped token, so the ceiling
+/// bounds personal tokens rather than what an admin can obtain.
+async fn cap_token_expiration(
+    db: &DB,
+    owner_email: &str,
+    workspace_id: Option<&str>,
+    requested: Option<chrono::DateTime<chrono::Utc>>,
+) -> Result<Option<chrono::DateTime<chrono::Utc>>> {
+    let value = load_value_from_global_settings(db, MAX_TOKEN_EXPIRATION_DAYS_SETTING).await?;
+    let max_days = match parse_max_token_expiration_days(value.as_ref()) {
+        Ok(Some(max_days)) => max_days,
+        Ok(None) => return Ok(requested),
+        // Both write paths reject this, so only a row written around them gets here.
+        Err(e) => {
+            tracing::warn!("ignoring {MAX_TOKEN_EXPIRATION_DAYS_SETTING}: {e}");
+            return Ok(requested);
+        }
+    };
+    let max = chrono::Utc::now() + chrono::Duration::days(max_days);
+
+    let is_service_account = sqlx::query_scalar!(
+        "SELECT EXISTS(SELECT 1 FROM usr WHERE email = $1 AND is_service_account IS true
+            AND ($2::varchar IS NULL OR workspace_id = $2))",
+        owner_email,
+        workspace_id,
+    )
+    .fetch_one(db)
+    .await?
+    .unwrap_or(false);
+    if is_service_account {
+        return Ok(requested);
+    }
+
+    Ok(Some(match requested {
+        Some(expiration) if expiration < max => expiration,
+        _ => max,
+    }))
+}
+
 async fn create_token(
     Extension(db): Extension<DB>,
     authed: ApiAuthed,
     OptJobAuthed { job_id, .. }: OptJobAuthed,
-    Json(token_config): Json<NewToken>,
+    Json(mut token_config): Json<NewToken>,
 ) -> Result<(StatusCode, String)> {
     forbid_elevated_job_token(&db, &authed.email, job_id).await?;
     check_token_create_rate_limit(&authed.username)?;
@@ -3098,6 +3186,14 @@ async fn create_token(
 
     windmill_api_auth::ensure_scopes_within_caller(&authed, token_config.scopes.as_deref())?;
 
+    token_config.expiration = cap_token_expiration(
+        &db,
+        &authed.email,
+        token_config.workspace_id.as_deref(),
+        token_config.expiration,
+    )
+    .await?;
+
     let mut tx = db.begin().await?;
 
     let token = create_token_internal(&mut *tx, &db, &authed, token_config).await?;
@@ -3154,6 +3250,7 @@ async fn impersonate(
     .fetch_optional(&db)
     .await?
     .unwrap_or(false);
+    let expiration = cap_token_expiration(&db, &impersonated, None, new_token.expiration).await?;
     let mut tx = db.begin().await?;
 
     sqlx::query!(
@@ -3165,7 +3262,7 @@ async fn impersonate(
         plaintext as Option<&str>,
         impersonated,
         new_token.label,
-        new_token.expiration,
+        expiration,
         is_super_admin
     )
     .execute(&mut *tx)
@@ -3175,7 +3272,7 @@ async fn impersonate(
         &mut *tx,
         &t_hash,
         new_token.label.as_deref(),
-        new_token.expiration,
+        expiration,
     )
     .await;
 
@@ -3925,6 +4022,8 @@ async fn update_token_label(
                  AND NOT starts_with(label, 'embed_app:')
                  AND NOT starts_with(label, 'sdk_app:')
                  AND NOT starts_with(label, 'impersonation:')
+                 AND NOT starts_with(label, 'cli-login:')
+                 AND NOT starts_with(label, 'remote-deploy:')
              ))
            RETURNING token_prefix",
         req.label.as_deref(),
@@ -3965,13 +4064,31 @@ async fn leave_workspace(
 ) -> Result<String> {
     forbid_job_token_account_destruction(&authed)?;
     let mut tx = db.begin().await?;
-    sqlx::query!(
+    windmill_common::workspaces::remove_datatable_tenant_in_workspace(
+        &mut tx,
+        &w_id,
+        &format!("u/{}", authed.username),
+    )
+    .await?;
+    let left = sqlx::query!(
         "DELETE FROM usr WHERE workspace_id = $1 AND username = $2",
         &w_id,
         authed.username
     )
     .execute(&mut *tx)
-    .await?;
+    .await?
+    .rows_affected();
+    // A superadmin deploys from workspaces it is no member of; leaving none is no reason to drop
+    // its connection.
+    if left > 0 {
+        sqlx::query!(
+            "DELETE FROM remote_deploy_token WHERE email = $1 AND workspace_id = $2",
+            &authed.email,
+            &w_id
+        )
+        .execute(&mut *tx)
+        .await?;
+    }
 
     audit_log(
         &mut *tx,
diff --git a/backend/windmill-api-workers/src/lib.rs b/backend/windmill-api-workers/src/lib.rs
index 07bef364c8..0102f1b033 100644
--- a/backend/windmill-api-workers/src/lib.rs
+++ b/backend/windmill-api-workers/src/lib.rs
@@ -436,11 +436,6 @@ async fn get_workspace_fairness_events(
         WITH capped AS (
             SELECT timestamp, operation, resource, parameters
             FROM audit_partitioned
-            WHERE workspace_id = 'admins'
-              AND operation = 'workspace_fairness.capped'
-            UNION ALL
-            SELECT timestamp, operation, resource, parameters
-            FROM audit
             WHERE workspace_id = 'admins'
               AND operation = 'workspace_fairness.capped'
             ORDER BY timestamp DESC
@@ -448,11 +443,6 @@ async fn get_workspace_fairness_events(
         ), uncapped AS (
             SELECT timestamp, operation, resource, parameters
             FROM audit_partitioned
-            WHERE workspace_id = 'admins'
-              AND operation = 'workspace_fairness.uncapped'
-            UNION ALL
-            SELECT timestamp, operation, resource, parameters
-            FROM audit
             WHERE workspace_id = 'admins'
               AND operation = 'workspace_fairness.uncapped'
             ORDER BY timestamp DESC
diff --git a/backend/windmill-api-workspaces/Cargo.toml b/backend/windmill-api-workspaces/Cargo.toml
index 52a58aa1a3..7ca1f692ad 100644
--- a/backend/windmill-api-workspaces/Cargo.toml
+++ b/backend/windmill-api-workspaces/Cargo.toml
@@ -35,6 +35,7 @@ windmill-store.workspace = true
 
 axum.workspace = true
 chrono.workspace = true
+constant_time_eq.workspace = true
 futures = { workspace = true, optional = true }
 hex.workspace = true
 magic-crypt.workspace = true
@@ -42,6 +43,7 @@ http.workspace = true
 hyper.workspace = true
 lazy_static.workspace = true
 regex.workspace = true
+reqwest.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 sha2.workspace = true
@@ -49,5 +51,6 @@ sqlx.workspace = true
 tokio.workspace = true
 tokio-postgres.workspace = true
 tracing.workspace = true
+url.workspace = true
 uuid.workspace = true
 strum.workspace = true
diff --git a/backend/windmill-api-workspaces/src/datatable_acl.rs b/backend/windmill-api-workspaces/src/datatable_acl.rs
new file mode 100644
index 0000000000..04dc3d4e80
--- /dev/null
+++ b/backend/windmill-api-workspaces/src/datatable_acl.rs
@@ -0,0 +1,2034 @@
+/*
+ * Author: Ruben Fiszel
+ * Copyright: Windmill Labs, Inc 2022
+ * This file and its contents are licensed under the AGPLv3 License.
+ * Please see the included NOTICE for copyright information and
+ * LICENSE-AGPL for a copy of the license.
+ */
+
+//! Ownership and grants on the objects of an instance data table.
+//!
+//! [`datatable_permissions`](crate::datatable_permissions) decides who may connect as which role;
+//! this decides what each role may then touch. Every change is a real `GRANT`, `REVOKE`,
+//! `ALTER ... OWNER TO` or `ALTER DEFAULT PRIVILEGES`, so Postgres is what enforces it.
+//!
+//! Reading is open to anyone who reaches the data table. Planning and applying are for those who
+//! administer it — admins of the workspace that governs it, and superadmins. All of it is
+//! Enterprise Edition ([`crate::datatable_acl_oss`]).
+
+use std::collections::BTreeMap;
+
+use axum::{
+    extract::{Extension, Path, Query},
+    routing::{get, post},
+    Json, Router,
+};
+use serde::{Deserialize, Serialize};
+use tokio::sync::mpsc;
+use tokio_postgres::error::{DbError, SqlState};
+use tokio_postgres::AsyncMessage;
+
+use windmill_api_auth::ApiAuthed;
+use windmill_audit::audit_oss::audit_log;
+use windmill_audit::ActionKind;
+use windmill_common::datatable_roles::{
+    lock_role_catalog, quote_ident, read_role_catalog, read_role_catalog_tx, DatatableRoleCatalog,
+    ADMIN_DATATABLE_ROLE, CUSTOM_INSTANCE_USER,
+};
+use windmill_common::error::{pg_error_message, Error, JsonResult, Result};
+use windmill_common::workspaces::{resolve_governing_datatable, DataTable, GoverningDatatable};
+use windmill_common::{PgDatabase, DB};
+
+use crate::datatable_permissions::{ensure_governs_datatable, ensure_reaches_governing_datatable};
+
+pub(crate) fn routes() -> Router {
+    Router::new()
+        .route("/datatable_acl/{datatable_name}", get(get_datatable_acl))
+        .route(
+            "/datatable_acl/{datatable_name}/plan",
+            post(plan_datatable_acl),
+        )
+        .route(
+            "/datatable_acl/{datatable_name}/apply",
+            post(apply_datatable_acl),
+        )
+}
+
+/// What a read or a change is about.
+#[derive(Deserialize, Serialize, Debug, Clone, PartialEq)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub enum AclTarget {
+    /// The data table's own database — where the privilege to create schemas lives.
+    Database,
+    Schema {
+        schema: String,
+    },
+    Table {
+        schema: String,
+        table: String,
+    },
+}
+
+impl AclTarget {
+    /// The schema the target is in, absent for the database itself.
+    pub(crate) fn schema(&self) -> Option<&str> {
+        match self {
+            AclTarget::Database => None,
+            AclTarget::Schema { schema } => Some(schema),
+            AclTarget::Table { schema, .. } => Some(schema),
+        }
+    }
+
+    /// What it is called in a message.
+    pub(crate) fn label(&self, dbname: &str) -> String {
+        match self {
+            AclTarget::Database => dbname.to_string(),
+            AclTarget::Schema { schema } => schema.clone(),
+            AclTarget::Table { schema, table } => format!("{schema}.{table}"),
+        }
+    }
+}
+
+#[derive(Deserialize, Debug)]
+pub struct AclTargetQuery {
+    kind: String,
+    schema: Option<String>,
+    table: Option<String>,
+}
+
+impl TryFrom<AclTargetQuery> for AclTarget {
+    type Error = Error;
+    fn try_from(q: AclTargetQuery) -> Result<Self> {
+        match (q.kind.as_str(), q.schema, q.table) {
+            ("database", _, _) => Ok(AclTarget::Database),
+            ("schema", Some(schema), _) => Ok(AclTarget::Schema { schema }),
+            ("table", Some(schema), Some(table)) => Ok(AclTarget::Table { schema, table }),
+            ("schema" | "table", None, _) => {
+                Err(Error::BadRequest("This target needs a schema".to_string()))
+            }
+            ("table", _, None) => Err(Error::BadRequest(
+                "A table target needs a table".to_string(),
+            )),
+            (kind, _, _) => Err(Error::BadRequest(format!("Unknown ACL target '{kind}'"))),
+        }
+    }
+}
+
+/// Where a set of privileges applies, relative to the target.
+///
+/// `Future*` covers what does not exist yet: those become `ALTER DEFAULT PRIVILEGES`, which only
+/// binds objects created by the roles it names.
+#[derive(Deserialize, Serialize, Debug, Clone, Copy, PartialEq)]
+#[serde(rename_all = "snake_case")]
+pub enum GrantScope {
+    /// The target itself — the database, the schema, or the table.
+    Target,
+    AllTables,
+    AllSequences,
+    AllFunctions,
+    FutureTables,
+    FutureSequences,
+    FutureFunctions,
+}
+
+impl GrantScope {
+    pub(crate) fn is_future(&self) -> bool {
+        matches!(
+            self,
+            GrantScope::FutureTables | GrantScope::FutureSequences | GrantScope::FutureFunctions
+        )
+    }
+}
+
+/// A change to plan. One at a time: each is confirmed against its own SQL.
+#[derive(Deserialize, Serialize, Debug, Clone)]
+#[serde(tag = "type", rename_all = "snake_case")]
+pub enum AclChange {
+    /// Hand the target — and, for a schema, everything already in it but an extension's members,
+    /// which stay with the extension — to another role.
+    SetOwner {
+        role: String,
+    },
+    Grant {
+        role: String,
+        privileges: Vec<String>,
+        scope: GrantScope,
+    },
+    Revoke {
+        role: String,
+        privileges: Vec<String>,
+        scope: GrantScope,
+        /// Objects inside the target, empty for the target itself. `ON ALL TABLES` grants read
+        /// back per object, so they are revoked per object — and the same privileges on several
+        /// of them are revoked together.
+        #[serde(default)]
+        objects: Vec<AclObject>,
+    },
+}
+
+impl AclChange {
+    /// The role the change is about, as the editor names it.
+    fn role(&self) -> &str {
+        match self {
+            AclChange::SetOwner { role }
+            | AclChange::Grant { role, .. }
+            | AclChange::Revoke { role, .. } => role,
+        }
+    }
+}
+
+#[derive(Deserialize, Debug)]
+pub struct AclChangeRequest {
+    pub target: AclTarget,
+    pub change: AclChange,
+    /// The statements the plan showed. An apply runs only those: it plans again and refuses if the
+    /// result differs.
+    #[serde(default)]
+    pub statements: Option<Vec<String>>,
+}
+
+/// An object inside a schema, named the way `REVOKE ... ON <keyword>` needs it.
+#[derive(Deserialize, Serialize, Debug, Clone, PartialEq)]
+pub struct AclObject {
+    pub name: String,
+    /// `TABLE`, `SEQUENCE`, `FUNCTION`, `PROCEDURE` or `TYPE`: what the object is.
+    /// [`object_keyword`] turns it into the keyword a revoke takes; a type has none.
+    pub kind: String,
+    /// A routine is identified by its argument types, not by its name: two `f` in one schema are
+    /// two objects. Absent for everything else.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub args: Option<String>,
+}
+
+/// A grant as the database has it, under the role names the editor uses.
+#[derive(Serialize, Debug, PartialEq)]
+pub struct AclGrant {
+    /// A data table role's name, `admin` for `custom_instance_user`, else the raw Postgres role
+    /// (`PUBLIC` included).
+    pub grantee: String,
+    pub privileges: Vec<String>,
+    /// `None` for the target itself, else the object inside it.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub object: Option<AclObject>,
+    /// `TABLES` / `SEQUENCES` / `FUNCTIONS` / `TYPES` (or, on the database, `SCHEMAS`) when this
+    /// is a default privilege, which applies to objects that do not exist yet.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub future: Option<String>,
+    /// Where the grant comes from, each role once: who granted it, or for a default privilege the
+    /// role whose future objects it covers. A revoke of some of the privileges takes them back from
+    /// every source that gave them.
+    pub sources: Vec<AclSource>,
+}
+
+/// One role a grant comes from.
+#[derive(Serialize, Debug, PartialEq)]
+pub struct AclSource {
+    /// Under the same names as [`AclGrant::grantee`].
+    pub role: String,
+    /// What `role` gave of the grant's privileges. A revoke is held back only by a source out of
+    /// reach that gave some of what it takes back.
+    pub privileges: Vec<String>,
+    /// Whether this data table's connection can take back what `role` gave: on an object only the
+    /// owner's grants when it acts for the owner, or else its own (`grant_source!`); for a default
+    /// privilege, a creating role it acts for. What a source out of reach gave is not revocable
+    /// from here; privileges only other sources gave still are.
+    pub reachable: bool,
+}
+
+#[derive(Serialize, Debug)]
+pub struct DatatableAclInfo {
+    /// Under the same names as [`AclGrant::grantee`].
+    pub owner: String,
+    /// The roles a change may name: `admin`, then every role of the instance catalog. Only for a
+    /// caller who may change anything, as the catalog is in the permissions drawer.
+    pub roles: Vec<String>,
+    /// Whether this caller may plan and apply changes: they administer the data table, on an
+    /// edition that has the planner.
+    pub editable: bool,
+    /// Whether the data table is a clone, whose grants stay as they were copied from its source.
+    pub clone: bool,
+    /// Whether the server is Postgres 17 or later, which added the `MAINTAIN` table privilege.
+    pub supports_maintain: bool,
+    /// The database the target lives in, which no target carries itself.
+    pub dbname: String,
+    pub grants: Vec<AclGrant>,
+    /// What the target holds that is a target of its own: a database's schemas, a schema's tables.
+    pub children: Vec<String>,
+}
+
+#[derive(Serialize, Debug)]
+pub struct AclPlan {
+    pub statements: Vec<String>,
+    pub warnings: Vec<String>,
+}
+
+/// The Postgres role a role name stands for. A data table role is a login named exactly like the
+/// role, so this is the identity — except `admin`, which is `custom_instance_user`.
+///
+/// Anything else is refused, never resolved to some default: every statement a plan writes names
+/// the role it is about.
+pub(crate) fn pg_role_of(name: &str, catalog: &DatatableRoleCatalog) -> Result<String> {
+    if name == ADMIN_DATATABLE_ROLE {
+        return Ok(CUSTOM_INSTANCE_USER.to_string());
+    }
+    if catalog.values().any(|r| r.name == name) {
+        return Ok(name.to_string());
+    }
+    Err(Error::BadRequest(format!(
+        "'{name}' is not a data table role of this instance"
+    )))
+}
+
+/// The reverse of [`pg_role_of`], for display. A role that is not a data table role reads back as
+/// itself.
+pub(crate) fn role_name_of(pg_role: &str) -> String {
+    if pg_role == CUSTOM_INSTANCE_USER {
+        ADMIN_DATATABLE_ROLE.to_string()
+    } else {
+        pg_role.to_string()
+    }
+}
+
+/// Every role a change may name: `admin` first, then the catalog.
+fn role_names(catalog: &DatatableRoleCatalog) -> Vec<String> {
+    let mut names: Vec<String> = catalog.values().map(|r| r.name.clone()).collect();
+    names.sort();
+    names.insert(0, ADMIN_DATATABLE_ROLE.to_string());
+    names
+}
+
+fn ensure_instance(governing: &GoverningDatatable) -> Result<()> {
+    if governing.is_instance() {
+        return Ok(());
+    }
+    Err(Error::BadRequest(format!(
+        "Data table '{}' is backed by a Postgres resource, so its access is managed on that \
+         server directly. Only a data table on the Windmill instance's own database has data \
+         table roles to grant to.",
+        governing.name
+    )))
+}
+
+/// The data table's `admin` connection, and the notices Postgres sends on it.
+///
+/// Authorization: connects as `custom_instance_user` with the instance's own credentials and checks
+/// nothing. Callers MUST have authorized the request first — a request about to be refused must
+/// not get as far as this connection.
+async fn connect_as_admin_unchecked(
+    db: &DB,
+    governing: &GoverningDatatable,
+) -> Result<(
+    tokio_postgres::Client,
+    mpsc::UnboundedReceiver<DbError>,
+    String,
+)> {
+    ensure_instance(governing)?;
+    // Built from the authorized entry, never by resolving the settings again: a save in between
+    // could point the entry at a resource on another server and back, and this connection would
+    // then alter a database the later checks of the entry never see.
+    let mut pg = PgDatabase::parse_uri(&windmill_common::get_database_url().await?.as_str().await)?;
+    pg.dbname = governing
+        .datatable
+        .database
+        .as_ref()
+        .expect("a governing entry owns a database")
+        .resource_path
+        .clone();
+    pg.user = Some(CUSTOM_INSTANCE_USER.to_string());
+    pg.password = Some(windmill_common::utils::get_custom_pg_instance_password(db).await?);
+    let dbname = pg.dbname.clone();
+    let (client, notices) = connect_with_notices(db, &pg).await?;
+    Ok((client, notices, dbname))
+}
+
+/// A connection to `pg`, and the notices Postgres sends on it — which is where a grant or revoke
+/// that changed nothing is reported ([`execute_acl_statements`]).
+pub(crate) async fn connect_with_notices(
+    db: &DB,
+    pg: &PgDatabase,
+) -> Result<(tokio_postgres::Client, mpsc::UnboundedReceiver<DbError>)> {
+    let (client, connection) = pg.connect(Some(db)).await?;
+    Ok((
+        client,
+        drive_with_notices(connection, windmill_common::TokioPgConnection::poll_message),
+    ))
+}
+
+type PollMessage<C> =
+    fn(
+        &mut C,
+        &mut std::task::Context<'_>,
+    ) -> std::task::Poll<Option<std::result::Result<AsyncMessage, tokio_postgres::Error>>>;
+
+/// Drive `connection` in the background with `poll`, forwarding its notices.
+pub(crate) fn drive_with_notices<C: Send + 'static>(
+    mut connection: C,
+    poll: PollMessage<C>,
+) -> mpsc::UnboundedReceiver<DbError> {
+    // Unbounded: the driver must never wait on the receiver, which only drains once the statement
+    // the driver is carrying has completed.
+    let (notices_tx, notices) = mpsc::unbounded_channel();
+    tokio::spawn(async move {
+        loop {
+            match std::future::poll_fn(|cx| poll(&mut connection, cx)).await {
+                Some(Ok(AsyncMessage::Notice(notice))) => {
+                    let _ = notices_tx.send(notice);
+                }
+                Some(Ok(_)) => {}
+                Some(Err(e)) => {
+                    tracing::error!("Datatable ACL connection error: {e}");
+                    break;
+                }
+                None => break,
+            }
+        }
+    });
+    notices
+}
+
+/// Run `statements` in order on `tx`, failing on the first that errors or that Postgres only warns
+/// about. A privilege the connection cannot pass on is a warning to Postgres (`01007` / `01006`),
+/// which then carries on having changed nothing; returning drops the transaction, rolling back
+/// everything before it.
+///
+/// Authorization: none. Runs `statements` as the connection `tx` is on; callers MUST have authorized
+/// changing that database's access, and built the statements themselves.
+pub(crate) async fn execute_acl_statements(
+    tx: &tokio_postgres::Transaction<'_>,
+    notices: &mut mpsc::UnboundedReceiver<DbError>,
+    statements: &[String],
+) -> Result<()> {
+    while notices.try_recv().is_ok() {}
+    for statement in statements {
+        tx.batch_execute(statement).await.map_err(|e| {
+            Error::ExecutionErr(format!(
+                "Failed to run `{statement}`: {}",
+                pg_error_message(&e)
+            ))
+        })?;
+        while let Ok(notice) = notices.try_recv() {
+            if *notice.code() == SqlState::WARNING_PRIVILEGE_NOT_GRANTED
+                || *notice.code() == SqlState::WARNING_PRIVILEGE_NOT_REVOKED
+            {
+                return Err(Error::ExecutionErr(format!(
+                    "`{statement}` did not take effect ({}), so nothing was applied",
+                    notice.message()
+                )));
+            }
+        }
+    }
+    Ok(())
+}
+
+/// An object whose ownership follows the schema's.
+#[derive(Debug, PartialEq)]
+pub(crate) struct OwnedObject {
+    /// The keyword `ALTER ... OWNER TO` takes for this kind of object.
+    pub(crate) keyword: &'static str,
+    /// How Postgres names the object (`pg_identify_object`): schema-qualified, quoted where
+    /// needed, with a routine's arguments or an operator class's access method. It goes into the
+    /// statement as it is.
+    pub(crate) identity: String,
+}
+
+/// Everything a schema's change of owner takes along, in schema `$1`, as (kind, identity, owner
+/// oid), the first two as `pg_identify_object` gives them. The plan, the check of what this
+/// connection may move and the check after the move all read this one list, so what is moved and
+/// what is checked cannot differ.
+///
+/// Read from what depends on the schema rather than catalog by catalog, so no kind of object is
+/// left out by omission; array types, row types and indexes depend on another object instead.
+/// Left out: an object's internal parts (a range type's constructors and multirange, an identity
+/// column's sequence), a sequence tied to a column (it follows its table, and refuses an owner of
+/// its own), an extension's members, and what has no `ALTER ... OWNER` at all (an extension, a text
+/// search parser or template). Postgres records no owner for the bootstrap superuser, oid 10.
+macro_rules! schema_owned_objects {
+    () => {
+        "SELECT o.type AS kind, o.identity, COALESCE(s.refobjid, 10::oid) AS owner
+         FROM pg_depend d
+         CROSS JOIN LATERAL pg_identify_object(d.classid, d.objid, 0) o
+         LEFT JOIN pg_shdepend s
+             ON s.dbid = (SELECT oid FROM pg_database WHERE datname = current_database())
+            AND s.classid = d.classid AND s.objid = d.objid AND s.deptype = 'o'
+         WHERE d.refclassid = 'pg_namespace'::regclass AND d.deptype = 'n'
+           AND d.refobjid = (SELECT oid FROM pg_namespace WHERE nspname = $1)
+           AND d.classid <> ALL(ARRAY['pg_extension'::regclass, 'pg_ts_parser'::regclass,
+                                      'pg_ts_template'::regclass]::oid[])
+           AND NOT EXISTS (
+               SELECT 1 FROM pg_depend x
+               WHERE x.classid = d.classid AND x.objid = d.objid AND x.objsubid = 0
+                 AND (x.deptype IN ('i', 'e')
+                      OR (x.deptype = 'a' AND d.classid = 'pg_class'::regclass
+                          AND x.refobjsubid <> 0)))"
+    };
+}
+#[allow(unused_imports)]
+pub(crate) use schema_owned_objects;
+
+/// The keyword `ALTER ... OWNER TO` takes for a kind of object, as `pg_identify_object` names the
+/// kind. A kind missing here is refused rather than skipped, which would leave it behind.
+pub(crate) fn owned_keyword(kind: &str) -> Option<&'static str> {
+    Some(match kind {
+        "table" => "TABLE",
+        "view" => "VIEW",
+        "materialized view" => "MATERIALIZED VIEW",
+        "sequence" => "SEQUENCE",
+        "foreign table" => "FOREIGN TABLE",
+        "type" => "TYPE",
+        "function" | "procedure" | "aggregate" => "ROUTINE",
+        "collation" => "COLLATION",
+        "conversion" => "CONVERSION",
+        "operator" => "OPERATOR",
+        "operator class" => "OPERATOR CLASS",
+        "operator family" => "OPERATOR FAMILY",
+        "statistics object" => "STATISTICS",
+        "text search dictionary" => "TEXT SEARCH DICTIONARY",
+        "text search configuration" => "TEXT SEARCH CONFIGURATION",
+        _ => return None,
+    })
+}
+
+async fn read_owned_objects(
+    client: &tokio_postgres::Client,
+    schema: &str,
+) -> Result<Vec<OwnedObject>> {
+    let rows = client
+        .query(
+            concat!(
+                "SELECT kind, identity FROM (",
+                schema_owned_objects!(),
+                ") o ORDER BY kind, identity"
+            ),
+            &[&schema],
+        )
+        .await
+        .map_err(|e| {
+            Error::internal_err(format!(
+                "Failed to list the objects of schema '{schema}': {}",
+                pg_error_message(&e)
+            ))
+        })?;
+    rows.into_iter()
+        .map(|row| {
+            let kind: &str = row.get(0);
+            let identity: String = row.get(1);
+            match owned_keyword(kind) {
+                Some(keyword) => Ok(OwnedObject { keyword, identity }),
+                None => Err(Error::BadRequest(format!(
+                    "{identity} is a {kind}, whose owner cannot be changed from here, and schema \
+                     {schema} would change hands without it. Move it to another schema first."
+                ))),
+            }
+        })
+        .collect()
+}
+
+/// Default privileges set database-wide (no `IN SCHEMA`), as `(defaclrole, defaclobjtype, grantee,
+/// privilege_type)`. Postgres stores such an entry as a whole acl, the creator's own privileges
+/// included, so only what goes beyond the built-in default is a grant. It applies in every schema
+/// on top of the schema's own defaults, which cannot take it back.
+macro_rules! database_wide_defaults {
+    () => {
+        "SELECT d.defaclrole, d.defaclobjtype, a.grantee, a.privilege_type
+         FROM pg_default_acl d, aclexplode(d.defaclacl) a
+         WHERE d.defaclnamespace = 0
+           AND NOT EXISTS (
+               SELECT 1 FROM aclexplode(acldefault(
+                   CASE d.defaclobjtype WHEN 'S' THEN 's' ELSE d.defaclobjtype END, d.defaclrole)) x
+               WHERE x.grantee = a.grantee AND x.privilege_type = a.privilege_type)"
+    };
+}
+
+/// `TABLES`, `SEQUENCES`, `FUNCTIONS` or `TYPES`, as a `defaclobjtype` names them.
+fn default_objects_keyword(objtype: &str) -> &'static str {
+    match objtype {
+        "r" => "TABLES",
+        "S" => "SEQUENCES",
+        "T" => "TYPES",
+        _ => "FUNCTIONS",
+    }
+}
+
+/// What a schema's owner holds on what gets created there later. A change of owner hands the new
+/// owner the same and takes these back: otherwise every former owner keeps reaching whatever the
+/// other roles create there.
+#[derive(Debug, PartialEq)]
+pub(crate) struct FormerOwnerDefaults {
+    pub(crate) pg_role: String,
+    /// (creating role, `TABLES` / `SEQUENCES` / `FUNCTIONS` / `TYPES`), one per default privilege
+    /// it holds.
+    pub(crate) defaults: Vec<(String, &'static str)>,
+}
+
+/// The default privileges schema `schema`'s owner holds there — `None` when it holds none, or is
+/// `new_owner` already. Refused when one was set by a role this connection cannot act for: only
+/// a member of the creating role may change its defaults, so the revoke would fail at apply. Also
+/// refused when the owner holds defaults set database-wide, which no change to this schema takes
+/// back.
+async fn read_former_owner_defaults(
+    client: &tokio_postgres::Client,
+    schema: &str,
+    new_owner: &str,
+) -> Result<Option<FormerOwnerDefaults>> {
+    let database_wide = client
+        .query_opt(
+            concat!(
+                "SELECT pg_get_userbyid(n.nspowner), pg_get_userbyid(g.defaclrole),
+                        g.defaclobjtype::text
+                 FROM pg_namespace n, (",
+                database_wide_defaults!(),
+                ") g
+                 WHERE n.nspname = $1 AND g.grantee = n.nspowner
+                   AND g.defaclobjtype IN ('r', 'S', 'f', 'T')
+                   AND n.nspowner <> (SELECT oid FROM pg_roles WHERE rolname = $2)
+                 ORDER BY 2, 3
+                 LIMIT 1"
+            ),
+            &[&schema, &new_owner],
+        )
+        .await
+        .map_err(|e| {
+            Error::internal_err(format!(
+                "Failed to read the database-wide default privileges: {}",
+                pg_error_message(&e)
+            ))
+        })?;
+    if let Some(row) = database_wide {
+        let pg_role: String = row.get(0);
+        let creator: String = row.get(1);
+        return Err(Error::BadRequest(format!(
+            "{} holds default privileges set database-wide by {}, which no default of schema \
+             {schema} takes back, so it would keep reaching what is created here after the change \
+             of owner. Revoke them database-wide first: ALTER DEFAULT PRIVILEGES FOR ROLE {} \
+             REVOKE ALL PRIVILEGES ON {} FROM {}",
+            role_name_of(&pg_role),
+            role_name_of(&creator),
+            quote_ident(&creator),
+            default_objects_keyword(row.get(2)),
+            quote_ident(&pg_role)
+        )));
+    }
+
+    let rows = client
+        .query(
+            "SELECT DISTINCT pg_get_userbyid(n.nspowner), pg_get_userbyid(d.defaclrole),
+                    d.defaclobjtype::text, pg_has_role(d.defaclrole, 'USAGE')
+             FROM pg_namespace n
+             JOIN pg_default_acl d ON d.defaclnamespace = n.oid
+             CROSS JOIN LATERAL aclexplode(d.defaclacl) a
+             WHERE n.nspname = $1 AND a.grantee = n.nspowner
+               -- What the owner gives itself is about the objects it creates, not about owning
+               -- the schema, so a move leaves it alone.
+               AND a.grantee <> d.defaclrole
+               AND d.defaclobjtype IN ('r', 'S', 'f', 'T')
+               AND n.nspowner <> (SELECT oid FROM pg_roles WHERE rolname = $2)
+             ORDER BY 2, 3",
+            &[&schema, &new_owner],
+        )
+        .await
+        .map_err(|e| {
+            Error::internal_err(format!(
+                "Failed to read the default privileges of schema '{schema}': {}",
+                pg_error_message(&e)
+            ))
+        })?;
+    let Some(first) = rows.first() else {
+        return Ok(None);
+    };
+    let pg_role: String = first.get(0);
+    let plural = |row: &tokio_postgres::Row| default_objects_keyword(row.get(2));
+    if let Some(row) = rows.iter().find(|row| !row.get::<_, bool>(3)) {
+        let creator: String = row.get(1);
+        return Err(Error::BadRequest(format!(
+            "{} holds default privileges in schema {schema} from {creator}, which this data \
+             table's connection cannot act for, so they would outlive the change of owner. \
+             Revoke them as {creator} first: ALTER DEFAULT PRIVILEGES FOR ROLE {} IN SCHEMA {} \
+             REVOKE ALL PRIVILEGES ON {} FROM {}",
+            role_name_of(&pg_role),
+            quote_ident(&creator),
+            quote_ident(schema),
+            plural(row),
+            quote_ident(&pg_role)
+        )));
+    }
+    Ok(Some(FormerOwnerDefaults {
+        defaults: rows
+            .iter()
+            .map(|row| (row.get::<_, String>(1), plural(row)))
+            .collect(),
+        pg_role,
+    }))
+}
+
+/// What the catalog holds that a plan depends on, read before planning so the planner stays pure.
+#[derive(Debug, Default, PartialEq)]
+pub(crate) struct CatalogFacts {
+    /// Every role that may create objects here, but the one the change is about.
+    pub(crate) other_pg_roles: Vec<String>,
+    /// For a schema's change of owner: what moves along with it.
+    pub(crate) existing_objects: Vec<OwnedObject>,
+    /// For a schema's change of owner: the defaults it takes back from the owner it replaces.
+    pub(crate) former_owner: Option<FormerOwnerDefaults>,
+    /// For a revoke: each grant it takes back.
+    pub(crate) revoked_grants: Vec<RevokedGrant>,
+}
+
+/// A grant a revoke takes back, as the catalog records it: what `source` gave on `object` (the
+/// target itself when `None`), or for a default privilege on what `source` creates later.
+#[derive(Debug, PartialEq)]
+pub(crate) struct RevokedGrant {
+    pub(crate) object: Option<AclObject>,
+    /// The role that made the grant: its grantor, or the creating role of a default privilege.
+    pub(crate) source: String,
+    pub(crate) privileges: Vec<String>,
+}
+
+/// An `aclexplode` row's source and whether this connection can take back what it gave, on an
+/// object owned by `$owner`. A REVOKE speaks for the grantor Postgres picks itself — the owner,
+/// when the connection acts for the owner, and otherwise the connection — and `GRANTED BY` names
+/// nobody else, so a grant any other role made stays whatever the connection runs.
+macro_rules! grant_source {
+    ($owner:literal) => {
+        concat!(
+            "pg_get_userbyid(a.grantor), a.grantor = CASE WHEN pg_has_role(",
+            $owner,
+            ", 'USAGE') THEN ",
+            $owner,
+            " ELSE (SELECT oid FROM pg_roles WHERE rolname = current_user) END"
+        )
+    };
+}
+
+/// What relation `$2` of schema `$1` grants role `$3`, as (source, whether this connection can
+/// take it back, privilege).
+const RELATION_GRANTS: &str = concat!(
+    "SELECT ",
+    grant_source!("c.relowner"),
+    ", a.privilege_type
+     FROM pg_class c
+     JOIN pg_namespace n ON n.oid = c.relnamespace,
+          aclexplode(COALESCE(c.relacl, acldefault(
+              CASE c.relkind WHEN 'S' THEN 's' ELSE 'r' END::\"char\", c.relowner))) a
+     WHERE n.nspname = $1 AND c.relname = $2
+       AND c.relkind = ANY(ARRAY['r','p','v','m','S','f']::\"char\"[])
+       AND a.grantee = (SELECT oid FROM pg_roles WHERE rolname = $3)"
+);
+
+/// The grants a revoke takes back, read from the catalog rather than from the request: one per
+/// object and source that gave `pg_role` any of `privileges`. Refused when a source's grant is out
+/// of this connection's reach (`grant_source!`, or for a default privilege a creating role it does
+/// not act for): the revoke would leave that grant in place.
+async fn read_revoked_grants(
+    client: &tokio_postgres::Client,
+    dbname: &str,
+    target: &AclTarget,
+    scope: GrantScope,
+    objects: &[AclObject],
+    privileges: &[String],
+    pg_role: &str,
+) -> Result<Vec<RevokedGrant>> {
+    let read_error = |e: tokio_postgres::Error| {
+        Error::internal_err(format!(
+            "Failed to read what the revoke takes back: {}",
+            pg_error_message(&e)
+        ))
+    };
+    let wanted: Vec<String> = privileges.iter().map(|p| p.to_uppercase()).collect();
+    // (object, how it reads in a refusal, one row per source and privilege)
+    let mut read = Vec::new();
+    match (scope, target) {
+        (scope, AclTarget::Schema { schema }) if scope.is_future() => {
+            let (objtype, plural) = match scope {
+                GrantScope::FutureTables => ("r", "tables"),
+                GrantScope::FutureSequences => ("S", "sequences"),
+                _ => ("f", "functions"),
+            };
+            let database_wide = client
+                .query(
+                    concat!(
+                        "SELECT pg_get_userbyid(g.defaclrole), g.privilege_type FROM (",
+                        database_wide_defaults!(),
+                        ") g
+                         WHERE g.defaclobjtype::text = $1
+                           AND g.grantee = (SELECT oid FROM pg_roles WHERE rolname = $2)
+                         ORDER BY 1, 2"
+                    ),
+                    &[&objtype, &pg_role],
+                )
+                .await
+                .map_err(read_error)?;
+            let mut still_granted: BTreeMap<String, Vec<String>> = BTreeMap::new();
+            for row in database_wide {
+                let privilege: String = row.get(1);
+                if wanted.contains(&privilege) {
+                    still_granted.entry(row.get(0)).or_default().push(privilege);
+                }
+            }
+            if let Some((creator, taken)) = still_granted.into_iter().next() {
+                return Err(Error::BadRequest(format!(
+                    "{} also receives {} on {plural} {} creates through a default privilege set \
+                     database-wide, which no default of schema {schema} takes back. Revoke it \
+                     database-wide first: ALTER DEFAULT PRIVILEGES FOR ROLE {} REVOKE {} ON {} \
+                     FROM {}",
+                    role_name_of(pg_role),
+                    taken.join(", "),
+                    role_name_of(&creator),
+                    quote_ident(&creator),
+                    taken.join(", "),
+                    default_objects_keyword(objtype),
+                    quote_ident(pg_role)
+                )));
+            }
+            let rows = client
+                .query(
+                    "SELECT pg_get_userbyid(d.defaclrole), pg_has_role(d.defaclrole, 'USAGE'),
+                            a.privilege_type
+                     FROM pg_default_acl d
+                     JOIN pg_namespace n ON n.oid = d.defaclnamespace,
+                          aclexplode(d.defaclacl) a
+                     WHERE n.nspname = $1 AND d.defaclobjtype::text = $2
+                       AND a.grantee = (SELECT oid FROM pg_roles WHERE rolname = $3)",
+                    &[schema, &objtype, &pg_role],
+                )
+                .await
+                .map_err(read_error)?;
+            read.push((
+                None,
+                format!("{plural} created later in schema {schema}"),
+                rows,
+            ));
+        }
+        (GrantScope::Target, _) if objects.is_empty() => {
+            let rows = match target {
+                AclTarget::Database => {
+                    client
+                        .query(
+                            concat!(
+                                "SELECT ",
+                                grant_source!("d.datdba"),
+                                ", a.privilege_type
+                                 FROM pg_database d,
+                                      aclexplode(COALESCE(d.datacl, acldefault('d', d.datdba))) a
+                                 WHERE d.datname = current_database()
+                                   AND a.grantee = (SELECT oid FROM pg_roles WHERE rolname = $1)"
+                            ),
+                            &[&pg_role],
+                        )
+                        .await
+                }
+                AclTarget::Schema { schema } => {
+                    client
+                        .query(
+                            concat!(
+                                "SELECT ",
+                                grant_source!("n.nspowner"),
+                                ", a.privilege_type
+                                 FROM pg_namespace n,
+                                      aclexplode(COALESCE(n.nspacl, acldefault('n', n.nspowner))) a
+                                 WHERE n.nspname = $1
+                                   AND a.grantee = (SELECT oid FROM pg_roles WHERE rolname = $2)"
+                            ),
+                            &[schema, &pg_role],
+                        )
+                        .await
+                }
+                AclTarget::Table { schema, table } => {
+                    client
+                        .query(RELATION_GRANTS, &[schema, table, &pg_role])
+                        .await
+                }
+            }
+            .map_err(read_error)?;
+            read.push((None, target.label(dbname), rows));
+        }
+        (GrantScope::Target, AclTarget::Schema { schema }) => {
+            for object in objects {
+                let rows = match object_keyword(&object.kind)? {
+                    "ROUTINE" => {
+                        client
+                            .query(
+                                concat!(
+                                    "SELECT ",
+                                    grant_source!("p.proowner"),
+                                    ", a.privilege_type
+                                 FROM pg_proc p
+                                 JOIN pg_namespace n ON n.oid = p.pronamespace,
+                                      aclexplode(COALESCE(p.proacl, acldefault('f', p.proowner))) a
+                                 WHERE n.nspname = $1 AND p.proname = $2
+                                   AND pg_get_function_identity_arguments(p.oid) = $3
+                                   AND a.grantee = (SELECT oid FROM pg_roles WHERE rolname = $4)"
+                                ),
+                                &[
+                                    schema,
+                                    &object.name,
+                                    &object.args.as_deref().unwrap_or(""),
+                                    &pg_role,
+                                ],
+                            )
+                            .await
+                    }
+                    _ => {
+                        client
+                            .query(RELATION_GRANTS, &[schema, &object.name, &pg_role])
+                            .await
+                    }
+                }
+                .map_err(read_error)?;
+                read.push((
+                    Some(object.clone()),
+                    format!("{} {schema}.{}", object.kind.to_lowercase(), object.name),
+                    rows,
+                ));
+            }
+        }
+        // Every other scope and target is the planner's to refuse.
+        _ => {}
+    }
+
+    let mut revoked = Vec::new();
+    for (object, label, rows) in read {
+        let mut by_source: BTreeMap<String, (bool, Vec<String>)> = BTreeMap::new();
+        for row in rows {
+            let privilege: String = row.get(2);
+            if wanted.contains(&privilege) {
+                by_source
+                    .entry(row.get(0))
+                    .or_insert_with(|| (row.get(1), vec![]))
+                    .1
+                    .push(privilege);
+            }
+        }
+        for (source, (reachable, mut privileges)) in by_source {
+            if !reachable {
+                return Err(Error::BadRequest(format!(
+                    "{} on {label} was granted to {} by {source}, and Postgres takes a grant \
+                     back only through the role that made it, which this data table's \
+                     connection cannot speak for here. Revoke it as {source}.",
+                    privileges.join(", "),
+                    role_name_of(pg_role),
+                )));
+            }
+            privileges.sort();
+            privileges.dedup();
+            revoked.push(RevokedGrant { object: object.clone(), source, privileges });
+        }
+    }
+    Ok(revoked)
+}
+
+/// The keyword a `REVOKE ... ON` takes for one object, checked rather than interpolated: it lands
+/// in SQL unquoted.
+pub(crate) fn object_keyword(kind: &str) -> Result<&'static str> {
+    match kind.to_uppercase().as_str() {
+        "TABLE" | "VIEW" | "MATERIALIZED VIEW" | "FOREIGN TABLE" => Ok("TABLE"),
+        "SEQUENCE" => Ok("SEQUENCE"),
+        // `FUNCTION` names no procedure; `ROUTINE` names either.
+        "FUNCTION" | "PROCEDURE" | "ROUTINE" => Ok("ROUTINE"),
+        other => Err(Error::BadRequest(format!("Unknown object kind '{other}'"))),
+    }
+}
+
+/// Every object of a schema, named the way the catalog names it.
+async fn read_schema_objects(
+    client: &tokio_postgres::Client,
+    schema: &str,
+) -> Result<Vec<AclObject>> {
+    let rows = client
+        .query(
+            "SELECT CASE c.relkind WHEN 'S' THEN 'SEQUENCE' ELSE 'TABLE' END, c.relname, NULL::text
+             FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
+             WHERE n.nspname = $1 AND c.relkind = ANY(ARRAY['r','p','v','m','S','f']::\"char\"[])
+             UNION ALL
+             SELECT CASE p.prokind WHEN 'p' THEN 'PROCEDURE' ELSE 'FUNCTION' END, p.proname,
+                    pg_get_function_identity_arguments(p.oid)
+             FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+             WHERE n.nspname = $1",
+            &[&schema],
+        )
+        .await
+        .map_err(|e| {
+            Error::internal_err(format!(
+                "Failed to list the objects of schema '{schema}': {}",
+                pg_error_message(&e)
+            ))
+        })?;
+    Ok(rows
+        .into_iter()
+        .map(|row| AclObject { kind: row.get(0), name: row.get(1), args: row.get(2) })
+        .collect())
+}
+
+/// Replace the objects a revoke names with the catalog's own entry for each.
+///
+/// A routine is identified by its argument types, and those go into the statement as written —
+/// there is no quoting for them — so the request may name an object but never spell one: what
+/// reaches the SQL is read back from Postgres. An object that resolves to nothing is refused rather
+/// than dropped, since a revoke that silently covers less than it says is worse than an error.
+async fn resolve_acl_objects(
+    client: &tokio_postgres::Client,
+    target: &AclTarget,
+    objects: &[AclObject],
+) -> Result<Vec<AclObject>> {
+    if objects.is_empty() {
+        return Ok(vec![]);
+    }
+    let Some(schema) = target.schema() else {
+        return Err(Error::BadRequest(
+            "A database has no objects of its own to revoke on".to_string(),
+        ));
+    };
+    let known = read_schema_objects(client, schema).await?;
+    objects
+        .iter()
+        .map(|requested| {
+            let keyword = object_keyword(&requested.kind)?;
+            known
+                .iter()
+                .find(|k| {
+                    k.name == requested.name
+                        && k.args == requested.args
+                        && object_keyword(&k.kind).is_ok_and(|k| k == keyword)
+                })
+                .cloned()
+                .ok_or_else(|| {
+                    Error::NotFound(format!(
+                        "'{}' is not an object of schema '{schema}'",
+                        requested.name
+                    ))
+                })
+        })
+        .collect()
+}
+
+async fn read_owner(client: &tokio_postgres::Client, target: &AclTarget) -> Result<Option<String>> {
+    let row = match target {
+        AclTarget::Database => {
+            client
+                .query_opt(
+                    "SELECT pg_get_userbyid(datdba) FROM pg_database WHERE datname = current_database()",
+                    &[],
+                )
+                .await
+        }
+        AclTarget::Schema { schema } => {
+            client
+                .query_opt(
+                    // `public` is owned by `pg_database_owner`, a placeholder role whose membership
+                    // is whoever owns the database — naming it back would say nothing, so resolve
+                    // it to that owner.
+                    "SELECT pg_get_userbyid(owner) FROM (
+                         SELECT CASE WHEN n.nspowner = (SELECT oid FROM pg_roles WHERE rolname = 'pg_database_owner')
+                                     THEN (SELECT d.datdba FROM pg_database d WHERE d.datname = current_database())
+                                     ELSE n.nspowner END AS owner
+                         FROM pg_namespace n WHERE n.nspname = $1
+                     ) o",
+                    &[schema],
+                )
+                .await
+        }
+        AclTarget::Table { schema, table } => {
+            client
+                .query_opt(
+                    "SELECT pg_get_userbyid(c.relowner)
+                     FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
+                     WHERE n.nspname = $1 AND c.relname = $2",
+                    &[schema, table],
+                )
+                .await
+        }
+    }
+    .map_err(|e| Error::internal_err(format!("Failed to read the owner: {}", pg_error_message(&e))))?;
+    Ok(row.map(|row| row.get(0)))
+}
+
+async fn read_children(client: &tokio_postgres::Client, target: &AclTarget) -> Result<Vec<String>> {
+    let rows = match target {
+        AclTarget::Database => {
+            client
+                .query(
+                    "SELECT nspname::text FROM pg_namespace
+                     WHERE nspname <> 'information_schema' AND nspname NOT LIKE 'pg\\_%'
+                     ORDER BY nspname",
+                    &[],
+                )
+                .await
+        }
+        AclTarget::Schema { schema } => {
+            client
+                .query(
+                    "SELECT c.relname::text
+                     FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
+                     WHERE n.nspname = $1 AND c.relkind = ANY(ARRAY['r','p']::\"char\"[])
+                     ORDER BY c.relname",
+                    &[schema],
+                )
+                .await
+        }
+        AclTarget::Table { .. } => return Ok(vec![]),
+    }
+    .map_err(|e| {
+        Error::internal_err(format!(
+            "Failed to list what the target holds: {}",
+            pg_error_message(&e)
+        ))
+    })?;
+    Ok(rows.into_iter().map(|row| row.get(0)).collect())
+}
+
+async fn get_datatable_acl(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+    Path((w_id, datatable_name)): Path<(String, String)>,
+    Query(query): Query<AclTargetQuery>,
+) -> JsonResult<DatatableAclInfo> {
+    crate::datatable_acl_oss::ensure_datatable_acl_available()?;
+    let target: AclTarget = query.try_into()?;
+    let governing = resolve_governing_datatable(&db, &w_id, &datatable_name).await?;
+    ensure_reaches_governing_datatable(&db, &w_id, &datatable_name, &governing, &authed).await?;
+    ensure_instance(&governing)?;
+    let editable = ensure_governs_datatable(&db, &authed, &w_id, &governing)
+        .await
+        .is_ok();
+    let roles = if editable {
+        role_names(&read_role_catalog(&db).await?)
+    } else {
+        vec![]
+    };
+
+    let (client, _notices, dbname) = connect_as_admin_unchecked(&db, &governing).await?;
+    let owner = read_owner(&client, &target)
+        .await?
+        .ok_or_else(|| Error::NotFound(format!("{} not found", target.label(&dbname))))?;
+    let grants = read_grants(&client, &target).await?;
+    let supports_maintain: bool = client
+        .query_one(
+            "SELECT current_setting('server_version_num')::int >= 170000",
+            &[],
+        )
+        .await
+        .map_err(|e| {
+            Error::internal_err(format!(
+                "Failed to read the server version: {}",
+                pg_error_message(&e)
+            ))
+        })?
+        .get(0);
+    let children = read_children(&client, &target).await?;
+
+    Ok(Json(DatatableAclInfo {
+        owner: role_name_of(&owner),
+        roles,
+        editable,
+        clone: governing.governor.is_some(),
+        supports_maintain,
+        dbname,
+        grants,
+        children,
+    }))
+}
+
+async fn read_grants(client: &tokio_postgres::Client, target: &AclTarget) -> Result<Vec<AclGrant>> {
+    // `aclexplode` turns an acl array into one row per (grantee, privilege); grantee 0 is PUBLIC,
+    // which has no name to resolve. A NULL acl is not "no access" but Postgres's built-in default —
+    // the owner holds everything and, on a routine, PUBLIC may EXECUTE — hence `acldefault`. The
+    // owner's own entries are left out: what it holds comes with ownership, which the owner shows,
+    // not with a grant a revoke here could take back. Each row ends with its source — the grantor,
+    // or a default privilege's creating role — and whether this connection can take back what it
+    // gave.
+    // Column-level grants (`pg_attribute.attacl`) are not supported yet: they are neither read here
+    // nor revocable from the editor.
+    let mut rows = match target {
+        AclTarget::Database => {
+            let mut out = client
+                .query(
+                    concat!(
+                        "SELECT CASE WHEN a.grantee = 0 THEN 'PUBLIC' ELSE pg_get_userbyid(a.grantee) END,
+                                a.privilege_type, NULL::text, NULL::text, NULL::text, NULL::text, ",
+                        grant_source!("d.datdba"),
+                        " FROM pg_database d, aclexplode(COALESCE(d.datacl, acldefault('d', d.datdba))) a
+                         WHERE d.datname = current_database() AND a.grantee <> d.datdba"
+                    ),
+                    &[],
+                )
+                .await
+                .map_err(grant_read_error)?;
+            out.extend(
+                client
+                    .query(
+                        // Default privileges set database-wide reach what is created in every
+                        // schema, so they are the database's to show rather than any schema's.
+                        concat!(
+                            "SELECT CASE WHEN g.grantee = 0 THEN 'PUBLIC' ELSE pg_get_userbyid(g.grantee) END,
+                                    g.privilege_type, NULL::text,
+                                    CASE g.defaclobjtype
+                                        WHEN 'r' THEN 'TABLES' WHEN 'S' THEN 'SEQUENCES'
+                                        WHEN 'f' THEN 'FUNCTIONS' WHEN 'n' THEN 'SCHEMAS'
+                                        ELSE 'TYPES' END, NULL::text, NULL::text,
+                                    pg_get_userbyid(g.defaclrole), pg_has_role(g.defaclrole, 'USAGE')
+                             FROM (",
+                            database_wide_defaults!(),
+                            ") g"
+                        ),
+                        &[],
+                    )
+                    .await
+                    .map_err(grant_read_error)?,
+            );
+            out
+        }
+        AclTarget::Schema { schema } => {
+            let mut out = client
+                .query(
+                    concat!(
+                        "SELECT CASE WHEN a.grantee = 0 THEN 'PUBLIC' ELSE pg_get_userbyid(a.grantee) END,
+                                a.privilege_type, NULL::text, NULL::text, NULL::text, NULL::text, ",
+                        grant_source!("n.nspowner"),
+                        " FROM pg_namespace n, aclexplode(COALESCE(n.nspacl, acldefault('n', n.nspowner))) a
+                         WHERE n.nspname = $1 AND a.grantee <> n.nspowner"
+                    ),
+                    &[schema],
+                )
+                .await
+                .map_err(grant_read_error)?;
+            out.extend(
+                client
+                    .query(
+                        concat!(
+                            "SELECT CASE WHEN a.grantee = 0 THEN 'PUBLIC' ELSE pg_get_userbyid(a.grantee) END,
+                                    a.privilege_type, c.relname, NULL::text,
+                                    CASE c.relkind WHEN 'S' THEN 'SEQUENCE' ELSE 'TABLE' END,
+                                    NULL::text, ",
+                            grant_source!("c.relowner"),
+                            " FROM pg_class c
+                             JOIN pg_namespace n ON n.oid = c.relnamespace,
+                                  aclexplode(COALESCE(c.relacl, acldefault(
+                                      CASE c.relkind WHEN 'S' THEN 's' ELSE 'r' END::\"char\", c.relowner))) a
+                             WHERE n.nspname = $1
+                               AND c.relkind = ANY(ARRAY['r','p','v','m','S','f']::\"char\"[])
+                               AND a.grantee <> c.relowner"
+                        ),
+                        &[schema],
+                    )
+                    .await
+                    .map_err(grant_read_error)?,
+            );
+            out.extend(
+                client
+                    .query(
+                        // Routines carry their own acl in `pg_proc`; without this a grant made here
+                        // would vanish on the next read and could never be revoked back.
+                        concat!(
+                            "SELECT CASE WHEN a.grantee = 0 THEN 'PUBLIC' ELSE pg_get_userbyid(a.grantee) END,
+                                    a.privilege_type, p.proname, NULL::text,
+                                    CASE p.prokind WHEN 'p' THEN 'PROCEDURE' ELSE 'FUNCTION' END,
+                                    pg_get_function_identity_arguments(p.oid), ",
+                            grant_source!("p.proowner"),
+                            " FROM pg_proc p
+                             JOIN pg_namespace n ON n.oid = p.pronamespace,
+                                  aclexplode(COALESCE(p.proacl, acldefault('f', p.proowner))) a
+                             WHERE n.nspname = $1 AND a.grantee <> p.proowner"
+                        ),
+                        &[schema],
+                    )
+                    .await
+                    .map_err(grant_read_error)?,
+            );
+            out.extend(
+                client
+                    .query(
+                        // `USAGE` on a type is what lets a role use it in a column. Only a type the
+                        // schema holds in its own right has an acl: an array, a row type and a
+                        // multirange answer to their element, table or range.
+                        concat!(
+                            "SELECT CASE WHEN a.grantee = 0 THEN 'PUBLIC' ELSE pg_get_userbyid(a.grantee) END,
+                                    a.privilege_type, t.typname, NULL::text, 'TYPE', NULL::text, ",
+                            grant_source!("t.typowner"),
+                            " FROM pg_type t
+                         JOIN pg_depend d ON d.classid = 'pg_type'::regclass AND d.objid = t.oid
+                          AND d.refclassid = 'pg_namespace'::regclass AND d.deptype = 'n',
+                              aclexplode(COALESCE(t.typacl, acldefault('T', t.typowner))) a
+                         WHERE d.refobjid = (SELECT oid FROM pg_namespace WHERE nspname = $1)
+                           AND a.grantee <> t.typowner
+                           AND NOT EXISTS (
+                               SELECT 1 FROM pg_depend x
+                               WHERE x.classid = 'pg_type'::regclass AND x.objid = t.oid
+                                 AND x.objsubid = 0 AND x.deptype = 'i')"
+                        ),
+                        &[schema],
+                    )
+                    .await
+                    .map_err(grant_read_error)?,
+            );
+            out.extend(
+                client
+                    .query(
+                        // What a creating role set is taken back `FOR ROLE` that role, which only
+                        // a role acting for it may do.
+                        "SELECT CASE WHEN a.grantee = 0 THEN 'PUBLIC' ELSE pg_get_userbyid(a.grantee) END,
+                                a.privilege_type, NULL::text,
+                                CASE d.defaclobjtype
+                                    WHEN 'r' THEN 'TABLES' WHEN 'S' THEN 'SEQUENCES'
+                                    WHEN 'f' THEN 'FUNCTIONS' ELSE 'TYPES' END, NULL::text, NULL::text,
+                                pg_get_userbyid(d.defaclrole), pg_has_role(d.defaclrole, 'USAGE')
+                         FROM pg_default_acl d
+                         JOIN pg_namespace n ON n.oid = d.defaclnamespace,
+                              aclexplode(d.defaclacl) a
+                         WHERE n.nspname = $1",
+                        &[schema],
+                    )
+                    .await
+                    .map_err(grant_read_error)?,
+            );
+            out
+        }
+        AclTarget::Table { schema, table } => client
+            .query(
+                concat!(
+                    "SELECT CASE WHEN a.grantee = 0 THEN 'PUBLIC' ELSE pg_get_userbyid(a.grantee) END,
+                            a.privilege_type, NULL::text, NULL::text, NULL::text, NULL::text, ",
+                    grant_source!("c.relowner"),
+                    " FROM pg_class c
+                     JOIN pg_namespace n ON n.oid = c.relnamespace,
+                          aclexplode(COALESCE(c.relacl, acldefault(
+                              CASE c.relkind WHEN 'S' THEN 's' ELSE 'r' END::\"char\", c.relowner))) a
+                     WHERE n.nspname = $1 AND c.relname = $2 AND a.grantee <> c.relowner"
+                ),
+                &[schema, table],
+            )
+            .await
+            .map_err(grant_read_error)?,
+    };
+
+    // One row per privilege and source — and, for default privileges, per creating role. Fold them
+    // back into one entry per grantee and object that keeps every source and what each gave: a
+    // revoke takes a privilege back from every source that gave it.
+    let mut folded: BTreeMap<
+        (
+            String,
+            Option<(String, String, Option<String>)>,
+            Option<String>,
+        ),
+        (Vec<String>, BTreeMap<String, (bool, Vec<String>)>),
+    > = BTreeMap::new();
+    for row in rows.drain(..) {
+        let grantee: String = row.get(0);
+        let privilege: String = row.get(1);
+        let object: Option<String> = row.get(2);
+        let future: Option<String> = row.get(3);
+        let object_kind: Option<String> = row.get(4);
+        let object_args: Option<String> = row.get(5);
+        let source: String = row.get(6);
+        let reachable: bool = row.get(7);
+        let (privileges, sources) = folded
+            .entry((
+                role_name_of(&grantee),
+                object.map(|name| {
+                    (
+                        name,
+                        object_kind.unwrap_or_else(|| "TABLE".to_string()),
+                        object_args,
+                    )
+                }),
+                future,
+            ))
+            .or_default();
+        sources
+            .entry(role_name_of(&source))
+            .or_insert_with(|| (reachable, vec![]))
+            .1
+            .push(privilege.clone());
+        privileges.push(privilege);
+    }
+    Ok(folded
+        .into_iter()
+        .map(|((grantee, object, future), (mut privileges, sources))| {
+            privileges.sort();
+            privileges.dedup();
+            AclGrant {
+                grantee,
+                privileges,
+                object: object.map(|(name, kind, args)| AclObject { name, kind, args }),
+                future,
+                sources: sources
+                    .into_iter()
+                    .map(|(role, (reachable, mut privileges))| {
+                        privileges.sort();
+                        privileges.dedup();
+                        AclSource { role, privileges, reachable }
+                    })
+                    .collect(),
+            }
+        })
+        .collect())
+}
+
+fn grant_read_error(e: tokio_postgres::Error) -> Error {
+    Error::internal_err(format!("Failed to read grants: {}", pg_error_message(&e)))
+}
+
+/// Changing a data table's access is administering it. Checked in full before anything connects
+/// with the instance's credentials.
+async fn authorize_acl_change(
+    db: &DB,
+    authed: &ApiAuthed,
+    w_id: &str,
+    datatable_name: &str,
+) -> Result<GoverningDatatable> {
+    let governing = resolve_governing_datatable(db, w_id, datatable_name).await?;
+    ensure_governs_datatable(db, authed, w_id, &governing).await?;
+    ensure_instance(&governing)?;
+    Ok(governing)
+}
+
+static APPLY_SLOT: tokio::sync::Semaphore = tokio::sync::Semaphore::const_new(1);
+
+/// A role passes on only privileges it holds with grant option, and an instance database
+/// provisioned before data table roles gave `custom_instance_user` none. Adds that option to its
+/// database and `public` privileges, and nothing else: default privileges are left alone, since a
+/// schema's change of owner is planned against them. Best-effort, as a grant it fails to enable is
+/// refused when it runs.
+async fn ensure_grant_options(client: &tokio_postgres::Client, db: &DB, dbname: &str) {
+    let held = client
+        .query_one(
+            "SELECT has_database_privilege(current_database(), 'CONNECT WITH GRANT OPTION')
+                AND has_database_privilege(current_database(), 'CREATE WITH GRANT OPTION')
+                AND (to_regnamespace('public') IS NULL
+                     OR (has_schema_privilege('public', 'USAGE WITH GRANT OPTION')
+                         AND has_schema_privilege('public', 'CREATE WITH GRANT OPTION')))",
+            &[],
+        )
+        .await
+        .is_ok_and(|row| row.get::<_, bool>(0));
+    if held {
+        return;
+    }
+    if let Err(e) = grant_options_as_server(db, dbname).await {
+        tracing::warn!("Could not enable grant options on '{dbname}': {e}");
+    }
+}
+
+/// Only the database's owner, the server's own Postgres user, can hand out an option it holds.
+async fn grant_options_as_server(db: &DB, dbname: &str) -> Result<()> {
+    let server = PgDatabase::parse_uri(&windmill_common::get_database_url().await?.as_str().await)?;
+    let creds = PgDatabase { dbname: dbname.to_string(), ..server };
+    let (client, connection) = creds.connect(Some(db)).await?;
+    let join_handle = tokio::spawn(async move { connection.await });
+    let role = quote_ident(CUSTOM_INSTANCE_USER);
+    let result = client
+        .batch_execute(&format!(
+            "GRANT CONNECT, CREATE ON DATABASE {} TO {role} WITH GRANT OPTION;
+             DO $$ BEGIN
+               IF to_regnamespace('public') IS NOT NULL THEN
+                 GRANT USAGE, CREATE ON SCHEMA public TO {role} WITH GRANT OPTION;
+               END IF;
+             END $$;",
+            quote_ident(dbname)
+        ))
+        .await;
+    drop(client);
+    windmill_common::shutdown_pg_connection(join_handle).await?;
+    result.map_err(|e| {
+        Error::internal_err(format!(
+            "Failed to grant options on '{dbname}': {}",
+            pg_error_message(&e)
+        ))
+    })
+}
+
+/// Whether the governing entry an apply was authorized on is still the one in the settings, read
+/// under the lock: a save in between could have pointed it at another database or changed its roles.
+fn entry_unchanged(governing: &GoverningDatatable, entry_now: Option<serde_json::Value>) -> bool {
+    let Some(Ok(now)) = entry_now.map(serde_json::from_value::<DataTable>) else {
+        return false;
+    };
+    match (
+        serde_json::to_value(&now),
+        serde_json::to_value(&governing.datatable),
+    ) {
+        (Ok(now), Ok(authorized)) => now == authorized,
+        _ => false,
+    }
+}
+
+/// Plan one change against the catalog and the database as they are now.
+async fn build_plan(
+    client: &tokio_postgres::Client,
+    dbname: &str,
+    catalog: &DatatableRoleCatalog,
+    target: &AclTarget,
+    change: &AclChange,
+) -> Result<AclPlan> {
+    let role = change.role();
+    // `admin` is the login the data table itself reaches Postgres through, and the one every
+    // change here runs as: a revoke that lands leaves nothing able to grant it back.
+    if matches!(change, AclChange::Revoke { .. }) && role == ADMIN_DATATABLE_ROLE {
+        return Err(Error::BadRequest(format!(
+            "'{ADMIN_DATATABLE_ROLE}' is how this data table reaches its database; \
+             its own access is not revocable from here"
+        )));
+    }
+    let pg_role = pg_role_of(role, catalog)?;
+    let change = match change {
+        AclChange::Revoke { role, privileges, scope, objects } => AclChange::Revoke {
+            role: role.clone(),
+            privileges: privileges.clone(),
+            scope: *scope,
+            objects: resolve_acl_objects(client, target, objects).await?,
+        },
+        change => change.clone(),
+    };
+    // Default privileges are recorded per creating role, and a schema's new owner is kept in reach
+    // of what the others create there, so both are written for every role there is.
+    let other_pg_roles = role_names(catalog)
+        .iter()
+        .map(|name| pg_role_of(name, catalog))
+        .filter(|r| r.as_ref().map_or(true, |r| *r != pg_role))
+        .collect::<Result<Vec<_>>>()?;
+    let (existing_objects, former_owner) = match (&change, target) {
+        (AclChange::SetOwner { .. }, AclTarget::Schema { schema }) => (
+            read_owned_objects(client, schema).await?,
+            read_former_owner_defaults(client, schema, &pg_role).await?,
+        ),
+        _ => (vec![], None),
+    };
+    let revoked_grants = match &change {
+        AclChange::Revoke { privileges, scope, objects, .. } => {
+            read_revoked_grants(
+                client, dbname, target, *scope, objects, privileges, &pg_role,
+            )
+            .await?
+        }
+        _ => vec![],
+    };
+    if matches!(change, AclChange::SetOwner { .. }) {
+        if let Some((object, owner)) = unmanaged_owner(client, target).await? {
+            return Err(Error::BadRequest(format!(
+                "{object} is owned by {owner}, which this data table's connection cannot act \
+                 for, so its owner cannot be changed from here"
+            )));
+        }
+    }
+    let facts = CatalogFacts { other_pg_roles, existing_objects, former_owner, revoked_grants };
+    let mut plan =
+        crate::datatable_acl_oss::plan_statements(target, &change, dbname, &pg_role, &facts)?;
+    if matches!(change, AclChange::SetOwner { .. }) {
+        if let Some(missing) = missing_owner_privilege(client, target, &pg_role).await? {
+            plan.warnings.push(format!(
+                "{role} does not have {missing}, which Postgres requires of a new owner, so this \
+                 will be refused. Grant it first."
+            ));
+        }
+    }
+    Ok(plan)
+}
+
+/// Postgres only hands an object to a role that could have created it: a table to one with
+/// `CREATE` on its schema, a schema to one with `CREATE` on the database.
+async fn missing_owner_privilege(
+    client: &tokio_postgres::Client,
+    target: &AclTarget,
+    pg_role: &str,
+) -> Result<Option<String>> {
+    let (row, missing) = match target {
+        AclTarget::Table { schema, .. } => (
+            client
+                .query_one(
+                    "SELECT has_schema_privilege($1::name, $2::text, 'CREATE')",
+                    &[&pg_role, schema],
+                )
+                .await,
+            format!("CREATE on schema {schema}"),
+        ),
+        AclTarget::Schema { .. } => (
+            client
+                .query_one(
+                    "SELECT has_database_privilege($1::name, current_database(), 'CREATE')",
+                    &[&pg_role],
+                )
+                .await,
+            "CREATE on the database".to_string(),
+        ),
+        AclTarget::Database => return Ok(None),
+    };
+    let has: bool = row
+        .map_err(|e| {
+            Error::internal_err(format!(
+                "Failed to read the new owner's privileges: {}",
+                pg_error_message(&e)
+            ))
+        })?
+        .get(0);
+    Ok((!has).then_some(missing))
+}
+
+/// The first thing a change of owner would move that this connection cannot act for, with its
+/// owner. Postgres lets only a member of the current owner move an object, and every change runs as
+/// `custom_instance_user`, so an object it does not hold the owner of — `public`, owned by the
+/// database's owner, above all — is refused here rather than at apply. Running as the instance's
+/// own user instead would reach objects Windmill never created.
+async fn unmanaged_owner(
+    client: &tokio_postgres::Client,
+    target: &AclTarget,
+) -> Result<Option<(String, String)>> {
+    let read_error = |e: tokio_postgres::Error| {
+        Error::internal_err(format!(
+            "Failed to read who owns what the change moves: {}",
+            pg_error_message(&e)
+        ))
+    };
+    match target {
+        AclTarget::Database => Ok(None),
+        AclTarget::Table { schema, table } => {
+            let row = client
+                .query_opt(
+                    "SELECT pg_get_userbyid(c.relowner)
+                     FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
+                     WHERE n.nspname = $1 AND c.relname = $2 AND NOT pg_has_role(c.relowner, 'USAGE')",
+                    &[schema, table],
+                )
+                .await
+                .map_err(read_error)?;
+            Ok(row.map(|row| (format!("{schema}.{table}"), row.get(0))))
+        }
+        AclTarget::Schema { schema } => {
+            let row = client
+                .query_opt(
+                    concat!(
+                        "SELECT ord, identity, pg_get_userbyid(owner) FROM (
+                             SELECT 0 AS ord, NULL::text AS identity, n.nspowner AS owner
+                             FROM pg_namespace n WHERE n.nspname = $1
+                             UNION ALL
+                             SELECT 1, identity, owner FROM (",
+                        schema_owned_objects!(),
+                        ") m
+                         ) o WHERE NOT pg_has_role(owner, 'USAGE') ORDER BY ord, identity LIMIT 1"
+                    ),
+                    &[schema],
+                )
+                .await
+                .map_err(read_error)?;
+            Ok(row.map(|row| {
+                let label = row
+                    .get::<_, Option<String>>(1)
+                    .unwrap_or_else(|| format!("schema {schema}"));
+                (label, row.get(2))
+            }))
+        }
+    }
+}
+
+async fn plan_datatable_acl(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+    Path((w_id, datatable_name)): Path<(String, String)>,
+    Json(req): Json<AclChangeRequest>,
+) -> JsonResult<AclPlan> {
+    crate::datatable_acl_oss::ensure_datatable_acl_available()?;
+    let governing = authorize_acl_change(&db, &authed, &w_id, &datatable_name).await?;
+    let catalog = read_role_catalog(&db).await?;
+    let (client, _notices, dbname) = connect_as_admin_unchecked(&db, &governing).await?;
+    Ok(Json(
+        build_plan(&client, &dbname, &catalog, &req.target, &req.change).await?,
+    ))
+}
+
+async fn apply_datatable_acl(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+    Path((w_id, datatable_name)): Path<(String, String)>,
+    Json(req): Json<AclChangeRequest>,
+) -> Result<String> {
+    crate::datatable_acl_oss::ensure_datatable_acl_available()?;
+    let confirmed = req.statements.as_ref().ok_or_else(|| {
+        Error::BadRequest(
+            "An apply runs exactly the statements its plan showed; plan the change first"
+                .to_string(),
+        )
+    })?;
+    // Everything that needs the pool happens before the locks: once `tx` holds them, a second pool
+    // connection could wait forever on a pool that concurrent applies, queued on the same locks,
+    // have exhausted.
+    let governing = authorize_acl_change(&db, &authed, &w_id, &datatable_name).await?;
+    // Applies queue on an instance-wide lock while each holds a direct connection to the instance's
+    // Postgres; unbounded, the queue alone could exhaust its connection limit. One at a time per
+    // server, and the ones waiting hold no connection at all.
+    let _slot = APPLY_SLOT
+        .acquire()
+        .await
+        .map_err(|e| Error::internal_err(format!("ACL apply slot closed: {e}")))?;
+    let (mut client, mut notices, dbname) = connect_as_admin_unchecked(&db, &governing).await?;
+    ensure_grant_options(&client, &db, &dbname).await;
+
+    // Held until the change is committed: a role renamed or dropped meanwhile would change what
+    // the plan names, and a settings save could move the entry onto another database. Taken in the
+    // same order as the permissions save, so the two cannot deadlock.
+    let mut tx = db.begin().await?;
+    lock_role_catalog(&mut tx).await?;
+    let entry_now = sqlx::query_scalar::<_, Option<serde_json::Value>>(
+        "SELECT datatable->'datatables'->$2 FROM workspace_settings WHERE workspace_id = $1 FOR UPDATE",
+    )
+    .bind(&governing.workspace_id)
+    .bind(&governing.name)
+    .fetch_optional(&mut *tx)
+    .await?
+    .flatten();
+    let catalog = read_role_catalog_tx(&mut tx).await?;
+
+    let plan = build_plan(&client, &dbname, &catalog, &req.target, &req.change).await?;
+    if !entry_unchanged(&governing, entry_now) || &plan.statements != confirmed {
+        return Err(Error::BadRequest(
+            "The data table or its roles changed since this was planned, so it would no longer \
+             run what was confirmed. Plan it again."
+                .to_string(),
+        ));
+    }
+
+    // One transaction: a half-applied ownership transfer leaves one schema's objects owned by two
+    // different roles.
+    let pg_tx = client.transaction().await.map_err(|e| {
+        Error::internal_err(format!(
+            "Failed to open a transaction on the data table: {}",
+            pg_error_message(&e)
+        ))
+    })?;
+    execute_acl_statements(&pg_tx, &mut notices, &plan.statements).await?;
+
+    // A schema's objects were listed before the transaction opened; one committed since would stay
+    // with its old owner. One created while this transaction is still open can still slip past, as
+    // Postgres has no lock that holds creation in a schema back. That is benign: it stays with its
+    // creator, like anything created there later, and moving that table fixes it.
+    if let (AclChange::SetOwner { role }, AclTarget::Schema { schema }) = (&req.change, &req.target)
+    {
+        let new_owner = pg_role_of(role, &catalog)?;
+        let straggler = pg_tx
+            .query_opt(
+                concat!(
+                    "SELECT identity FROM (",
+                    schema_owned_objects!(),
+                    ") m WHERE owner <> (SELECT oid FROM pg_roles WHERE rolname = $2)
+                     ORDER BY 1 LIMIT 1"
+                ),
+                &[schema, &new_owner],
+            )
+            .await
+            .map_err(|e| {
+                Error::internal_err(format!(
+                    "Failed to check what the schema holds: {}",
+                    pg_error_message(&e)
+                ))
+            })?;
+        if let Some(row) = straggler {
+            return Err(Error::BadRequest(format!(
+                "{} appeared while this ran and would keep its old owner, so nothing was \
+                 applied. Plan it again.",
+                row.get::<_, String>(0)
+            )));
+        }
+    }
+
+    let target_label = req.target.label(&dbname);
+    audit_log(
+        &mut *tx,
+        &authed,
+        "workspaces.datatable_acl",
+        ActionKind::Update,
+        &governing.workspace_id,
+        Some(&governing.name),
+        Some(
+            [
+                ("target", target_label.as_str()),
+                ("change", change_kind(&req.change)),
+                ("role", req.change.role()),
+            ]
+            .into(),
+        ),
+    )
+    .await?;
+    pg_tx.commit().await.map_err(|e| {
+        Error::internal_err(format!(
+            "Failed to commit the changes: {}",
+            pg_error_message(&e)
+        ))
+    })?;
+    tx.commit().await?;
+
+    windmill_common::feature_usage::log_feature_usage(
+        "datatable",
+        "acl_applied",
+        change_kind(&req.change),
+    );
+
+    Ok(format!("Updated access on {target_label}"))
+}
+
+/// What kind of change, never what it named: the telemetry key and the audit's summary.
+fn change_kind(change: &AclChange) -> &'static str {
+    match change {
+        AclChange::SetOwner { .. } => "owner",
+        AclChange::Grant { scope, .. } | AclChange::Revoke { scope, .. } if scope.is_future() => {
+            "default_privileges"
+        }
+        AclChange::Grant { .. } => "grant",
+        AclChange::Revoke { .. } => "revoke",
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use windmill_common::datatable_roles::InstanceDatatableRole;
+
+    #[test]
+    fn a_role_is_its_own_postgres_role_except_admin() {
+        let catalog: DatatableRoleCatalog = BTreeMap::from([(
+            "role1".to_string(),
+            InstanceDatatableRole { name: "analytics".to_string(), enabled: true, pwd: None },
+        )]);
+        assert_eq!(
+            pg_role_of("admin", &catalog).unwrap(),
+            "custom_instance_user"
+        );
+        assert_eq!(pg_role_of("analytics", &catalog).unwrap(), "analytics");
+        assert_eq!(role_name_of("custom_instance_user"), "admin");
+        assert_eq!(role_name_of("analytics"), "analytics");
+        // A catalog id, a name the catalog lacks, or the admin login spelled out never stands for
+        // some other role.
+        for unknown in ["role1", "operator", "custom_instance_user", "PUBLIC", ""] {
+            assert!(
+                matches!(pg_role_of(unknown, &catalog), Err(Error::BadRequest(_))),
+                "{unknown}"
+            );
+        }
+    }
+
+    /// A connection to the test's own database, the way the handlers reach a data table's.
+    async fn catalog_client(pool: &sqlx::PgPool) -> tokio_postgres::Client {
+        let mut config: tokio_postgres::Config =
+            std::env::var("DATABASE_URL").unwrap().parse().unwrap();
+        config.dbname(pool.connect_options().get_database().unwrap());
+        let (client, connection) = config.connect(tokio_postgres::NoTls).await.unwrap();
+        tokio::spawn(connection);
+        client
+    }
+
+    /// What a revoke takes back is read from the catalog, per object and source, and only the
+    /// privileges it asks for: the planner renders exactly this, and refuses an empty read.
+    #[sqlx::test(migrations = false)]
+    async fn a_revoke_reads_back_only_what_it_asks_for(pool: sqlx::PgPool) {
+        let client = catalog_client(&pool).await;
+        // A predefined role, so that nothing is granted outside the test's own database.
+        client
+            .batch_execute(
+                "CREATE SCHEMA granted;
+                 CREATE TABLE granted.g (id int);
+                 GRANT SELECT, INSERT ON granted.g TO pg_read_all_data;",
+            )
+            .await
+            .unwrap();
+        let target = AclTarget::Table { schema: "granted".to_string(), table: "g".to_string() };
+        let revoked = read_revoked_grants(
+            &client,
+            "db",
+            &target,
+            GrantScope::Target,
+            &[],
+            &["select".to_string()],
+            "pg_read_all_data",
+        )
+        .await
+        .unwrap();
+        assert_eq!(revoked.len(), 1, "{revoked:?}");
+        assert_eq!(revoked[0].object, None);
+        assert_eq!(revoked[0].privileges, ["SELECT"]);
+        let held_none = read_revoked_grants(
+            &client,
+            "db",
+            &target,
+            GrantScope::Target,
+            &[],
+            &["update".to_string()],
+            "pg_read_all_data",
+        )
+        .await
+        .unwrap();
+        assert!(held_none.is_empty(), "{held_none:?}");
+        // Each source says what it gave: that, and not the whole row, is what a revoke of some of
+        // its privileges is held back by.
+        let grants = read_grants(
+            &client,
+            &AclTarget::Schema { schema: "granted".to_string() },
+        )
+        .await
+        .unwrap();
+        let on_g = grants
+            .iter()
+            .find(|g| {
+                g.grantee == "pg_read_all_data" && g.object.as_ref().is_some_and(|o| o.name == "g")
+            })
+            .unwrap();
+        assert_eq!(on_g.sources.len(), 1, "{:?}", on_g.sources);
+        assert_eq!(on_g.sources[0].privileges, ["INSERT", "SELECT"]);
+        assert!(on_g.sources[0].reachable);
+    }
+
+    /// A default privilege set database-wide applies in every schema on top of the schema's own,
+    /// which cannot take it back: the database shows it, and neither a schema's revoke of it nor a
+    /// change of owner away from its grantee may go ahead as if it were gone.
+    #[sqlx::test(migrations = false)]
+    async fn a_schema_cannot_take_back_a_database_wide_default(pool: sqlx::PgPool) {
+        let client = catalog_client(&pool).await;
+        client
+            .batch_execute(
+                "CREATE SCHEMA owned AUTHORIZATION pg_read_all_data;
+                 ALTER DEFAULT PRIVILEGES GRANT SELECT ON TABLES TO pg_read_all_data;
+                 ALTER DEFAULT PRIVILEGES IN SCHEMA owned
+                     GRANT SELECT, INSERT ON TABLES TO pg_read_all_data;
+                 CREATE SCHEMA creators AUTHORIZATION pg_monitor;
+                 ALTER DEFAULT PRIVILEGES FOR ROLE pg_monitor
+                     GRANT SELECT ON TABLES TO pg_read_all_stats;",
+            )
+            .await
+            .unwrap();
+        let creator: String = client
+            .query_one("SELECT current_user::text", &[])
+            .await
+            .unwrap()
+            .get(0);
+
+        let grants = read_grants(&client, &AclTarget::Database).await.unwrap();
+        let database_wide = grants
+            .iter()
+            .find(|g| g.grantee == "pg_read_all_data" && g.future.as_deref() == Some("TABLES"))
+            .unwrap_or_else(|| panic!("{grants:?}"));
+        assert_eq!(database_wide.privileges, ["SELECT"]);
+        // A database-wide entry also holds its creator's own privileges, which come with creating
+        // and are no grant: neither a row nor a refusal may stem from them.
+        assert!(
+            !grants
+                .iter()
+                .any(|g| g.future.is_some() && (g.grantee == creator || g.grantee == "pg_monitor")),
+            "{grants:?}"
+        );
+        assert_eq!(
+            database_wide.sources.len(),
+            1,
+            "{:?}",
+            database_wide.sources
+        );
+        assert_eq!(database_wide.sources[0].role, creator);
+
+        let schema = AclTarget::Schema { schema: "owned".to_string() };
+        let still_granted = read_revoked_grants(
+            &client,
+            "db",
+            &schema,
+            GrantScope::FutureTables,
+            &[],
+            &["select".to_string()],
+            "pg_read_all_data",
+        )
+        .await;
+        assert!(
+            matches!(&still_granted, Err(Error::BadRequest(m)) if m.contains("database-wide")),
+            "{still_granted:?}"
+        );
+        let schema_only = read_revoked_grants(
+            &client,
+            "db",
+            &schema,
+            GrantScope::FutureTables,
+            &[],
+            &["insert".to_string()],
+            "pg_read_all_data",
+        )
+        .await
+        .unwrap();
+        assert_eq!(schema_only.len(), 1, "{schema_only:?}");
+        assert_eq!(schema_only[0].privileges, ["INSERT"]);
+
+        let moved = read_former_owner_defaults(&client, "owned", "pg_write_all_data").await;
+        assert!(
+            matches!(&moved, Err(Error::BadRequest(m)) if m.contains("database-wide")),
+            "{moved:?}"
+        );
+        let moved_from_creator =
+            read_former_owner_defaults(&client, "creators", "pg_write_all_data").await;
+        assert!(
+            matches!(moved_from_creator, Ok(None)),
+            "{moved_from_creator:?}"
+        );
+    }
+
+    /// Defaults on types go with a schema's owner like the other kinds: once a database-wide
+    /// default takes PUBLIC's USAGE on types away, they are all that reaches a new type.
+    #[sqlx::test(migrations = false)]
+    async fn a_schemas_former_owner_defaults_include_types(pool: sqlx::PgPool) {
+        let client = catalog_client(&pool).await;
+        client
+            .batch_execute(
+                "CREATE SCHEMA typed AUTHORIZATION pg_read_all_data;
+                 ALTER DEFAULT PRIVILEGES IN SCHEMA typed GRANT USAGE ON TYPES TO pg_read_all_data;
+                 ALTER DEFAULT PRIVILEGES FOR ROLE pg_read_all_data IN SCHEMA typed
+                     GRANT SELECT ON TABLES TO pg_read_all_data;",
+            )
+            .await
+            .unwrap();
+        let creator: String = client
+            .query_one("SELECT current_user::text", &[])
+            .await
+            .unwrap()
+            .get(0);
+        let former = read_former_owner_defaults(&client, "typed", "pg_write_all_data")
+            .await
+            .unwrap();
+        assert_eq!(
+            former,
+            Some(FormerOwnerDefaults {
+                pg_role: "pg_read_all_data".to_string(),
+                defaults: vec![(creator, "TYPES")],
+            })
+        );
+    }
+
+    /// A kind of object the list misses stays with its old owner while the schema changes hands,
+    /// which only a real catalog shows.
+    #[sqlx::test(migrations = false)]
+    async fn a_schemas_owner_change_takes_every_object_in_it(pool: sqlx::PgPool) {
+        let client = catalog_client(&pool).await;
+        client
+            .batch_execute(
+                "CREATE SCHEMA moved;
+                 CREATE TABLE moved.t (id serial PRIMARY KEY, a int, b int);
+                 CREATE STATISTICS moved.st ON a, b FROM moved.t;
+                 CREATE TABLE moved.pt (id int) PARTITION BY RANGE (id);
+                 CREATE TABLE moved.pt1 PARTITION OF moved.pt FOR VALUES FROM (0) TO (10);
+                 CREATE TYPE moved.r AS RANGE (subtype = float8);
+                 CREATE TYPE moved.pair AS (a int, b int);
+                 CREATE TYPE moved.mood AS ENUM ('ok');
+                 CREATE DOMAIN moved.tags AS text[];
+                 CREATE COLLATION moved.coll (provider = libc, locale = 'C');",
+            )
+            .await
+            .unwrap();
+        let owned = read_owned_objects(&client, "moved").await.unwrap();
+        // Not the serial's sequence, the range's constructors and multirange, or any array or row
+        // type: each follows the object it belongs to.
+        assert_eq!(
+            owned
+                .iter()
+                .map(|o| (o.keyword, o.identity.as_str()))
+                .collect::<Vec<_>>(),
+            [
+                ("COLLATION", "moved.coll"),
+                ("STATISTICS", "moved.st"),
+                ("TABLE", "moved.pt"),
+                ("TABLE", "moved.pt1"),
+                ("TABLE", "moved.t"),
+                ("TYPE", "moved.mood"),
+                ("TYPE", "moved.pair"),
+                ("TYPE", "moved.r"),
+                ("TYPE", "moved.tags"),
+            ]
+        );
+    }
+}
diff --git a/backend/windmill-api-workspaces/src/datatable_acl_oss.rs b/backend/windmill-api-workspaces/src/datatable_acl_oss.rs
new file mode 100644
index 0000000000..59eb8cdbe0
--- /dev/null
+++ b/backend/windmill-api-workspaces/src/datatable_acl_oss.rs
@@ -0,0 +1,44 @@
+/*
+ * Author: Ruben Fiszel
+ * Copyright: Windmill Labs, Inc 2022
+ * This file and its contents are licensed under the AGPLv3 License.
+ * Please see the included NOTICE for copyright information and
+ * LICENSE-AGPL for a copy of the license.
+ */
+
+//! Where the ACL planner comes from: the enterprise one, or a refusal.
+//!
+//! Data table roles are an Enterprise Edition feature, and so is everything here — reading who
+//! owns what included. `private` alone is not that edition — community builds carry it — so the
+//! planner is behind `enterprise` as well.
+
+#[cfg(all(feature = "private", feature = "enterprise"))]
+pub(crate) use crate::datatable_acl_ee::plan_statements;
+
+#[cfg(all(feature = "private", feature = "enterprise"))]
+pub(crate) fn ensure_datatable_acl_available() -> windmill_common::error::Result<()> {
+    Ok(())
+}
+
+#[cfg(not(all(feature = "private", feature = "enterprise")))]
+use {
+    crate::datatable_acl::{AclChange, AclPlan, AclTarget, CatalogFacts},
+    windmill_common::{datatable_roles_oss::datatable_roles_unavailable, error::Result},
+};
+
+/// Checked first by every ACL route, before anything is read or connected to.
+#[cfg(not(all(feature = "private", feature = "enterprise")))]
+pub(crate) fn ensure_datatable_acl_available() -> Result<()> {
+    Err(datatable_roles_unavailable())
+}
+
+#[cfg(not(all(feature = "private", feature = "enterprise")))]
+pub(crate) fn plan_statements(
+    _target: &AclTarget,
+    _change: &AclChange,
+    _dbname: &str,
+    _pg_role: &str,
+    _facts: &CatalogFacts,
+) -> Result<AclPlan> {
+    Err(datatable_roles_unavailable())
+}
diff --git a/backend/windmill-api-workspaces/src/datatable_clone.rs b/backend/windmill-api-workspaces/src/datatable_clone.rs
new file mode 100644
index 0000000000..a57a2216e5
--- /dev/null
+++ b/backend/windmill-api-workspaces/src/datatable_clone.rs
@@ -0,0 +1,566 @@
+/*
+ * Author: Ruben Fiszel
+ * Copyright: Windmill Labs, Inc 2022
+ * This file and its contents are licensed under the AGPLv3 License.
+ * Please see the included NOTICE for copyright information and
+ * LICENSE-AGPL for a copy of the license.
+ */
+
+//! Copying a data table's database for the fork being created.
+//!
+//! The fork request makes its copies before it writes the fork: each is created, filled and — for a
+//! data table under roles — given the source's owners and grants. What each copy was made from
+//! stays in the request ([`MadeCopy`]), so the fork's transaction checks it against the source as it
+//! is then, and a fork that fails drops the instance copies it made ([`drop_copies_after`]) and names
+//! the others, which live on servers of the workspace's own.
+
+use std::collections::BTreeSet;
+
+use windmill_api_auth::ApiAuthed;
+use windmill_common::datatable_roles::{lock_role_catalog, read_role_catalog_tx};
+use windmill_common::error::{pg_error_message, Error, Result};
+use windmill_common::utils::require_admin;
+use windmill_common::worker::CLOUD_HOSTED;
+use windmill_common::workspaces::{
+    get_datatable_resource_from_db_unchecked, DataTableDatabase, DataTableForkBehavior,
+    GoverningDatatable,
+};
+use windmill_common::{PgDatabase, DB};
+
+use crate::datatable_acl::connect_with_notices;
+use crate::datatable_permissions::ensure_reaches_governing_datatable;
+use crate::workspaces::{
+    create_database_on_server, ensure_datatable_is_clonable, pg_dump_database, pg_import_dump,
+    DumpFile, PgDumpOptions,
+};
+
+/// A database this request created and filled for one data table of the fork.
+pub(crate) struct MadeCopy {
+    /// The data table's name, in the parent and in the fork.
+    pub(crate) name: String,
+    pub(crate) dbname: String,
+    pub(crate) behavior: DataTableForkBehavior,
+    /// The database the source resolved to when it was copied.
+    pub(crate) source_database: DataTableDatabase,
+    /// Whether the source's owners and grants were replayed into the copy: it was under roles.
+    pub(crate) replayed: bool,
+    /// For a resource-backed copy, the resource and variables its connection was resolved from.
+    pub(crate) connection: Option<ConnectionSnapshot>,
+}
+
+/// What a resource-backed data table's connection is resolved from: its resource, and every
+/// resource and variable that one references, as stored — and, for a secret kept in an external
+/// backend, the value that backend holds. The connection is resolved from the snapshot itself
+/// ([`ConnectionSnapshot::resolve`]), so it is exactly the one these rows describe.
+#[derive(PartialEq)]
+pub(crate) struct ConnectionSnapshot {
+    root: String,
+    resources: std::collections::BTreeMap<String, Option<serde_json::Value>>,
+    /// Stored value and whether it is secret.
+    variables: std::collections::BTreeMap<String, Option<(String, bool)>>,
+    external_secrets: std::collections::BTreeMap<String, String>,
+}
+
+/// Read the [`ConnectionSnapshot`] of resource `resource_path` in workspace `w_id`.
+///
+/// Authorization: none, and it holds secret values. Callers MUST have authorized using that
+/// resource, and never disclose the snapshot or what it resolves to.
+pub(crate) async fn connection_snapshot(
+    db: &DB,
+    conn: &mut sqlx::PgConnection,
+    w_id: &str,
+    resource_path: &str,
+) -> Result<ConnectionSnapshot> {
+    let root = resource_path.trim_start_matches("$res:").to_string();
+    let mut snapshot = ConnectionSnapshot {
+        root: root.clone(),
+        resources: Default::default(),
+        variables: Default::default(),
+        external_secrets: Default::default(),
+    };
+    let mut pending = vec![root];
+    while let Some(path) = pending.pop() {
+        if snapshot.resources.contains_key(&path) {
+            continue;
+        }
+        let value: Option<serde_json::Value> =
+            sqlx::query_scalar("SELECT value FROM resource WHERE workspace_id = $1 AND path = $2")
+                .bind(w_id)
+                .bind(&path)
+                .fetch_optional(&mut *conn)
+                .await?
+                .flatten();
+        let mut strings = vec![];
+        collect_strings(value.as_ref(), &mut strings);
+        for reference in strings {
+            if let Some(var) = reference.strip_prefix("$var:") {
+                if snapshot.variables.contains_key(var) {
+                    continue;
+                }
+                let row: Option<(String, bool)> = sqlx::query_as(
+                    "SELECT value, is_secret FROM variable WHERE workspace_id = $1 AND path = $2",
+                )
+                .bind(w_id)
+                .bind(var)
+                .fetch_optional(&mut *conn)
+                .await?;
+                if let Some((stored, true)) = &row {
+                    if windmill_common::secret_backend::is_external_stored_value(stored) {
+                        let secret = windmill_common::secret_backend::get_secret_value(
+                            db, w_id, var, stored,
+                        )
+                        .await?;
+                        snapshot.external_secrets.insert(var.to_string(), secret);
+                    }
+                }
+                snapshot.variables.insert(var.to_string(), row);
+            } else if let Some(res) = reference.strip_prefix("$res:") {
+                pending.push(res.to_string());
+            }
+        }
+        snapshot.resources.insert(path, value);
+    }
+    Ok(snapshot)
+}
+
+impl ConnectionSnapshot {
+    /// The connection these rows resolve to, as the data table's own resolution would: references
+    /// substituted, secrets decrypted.
+    pub(crate) async fn resolve(&self, db: &DB, w_id: &str) -> Result<serde_json::Value> {
+        let root = self.resource(&self.root)?;
+        self.substitute(db, w_id, root, 0).await
+    }
+
+    /// Whether the resource itself holds the connection's fields, which the fork repoints by setting
+    /// its `dbname`, rather than being a reference to another resource.
+    pub(crate) fn root_holds_connection(&self) -> bool {
+        self.resource(&self.root).is_ok_and(|v| v.is_object())
+    }
+
+    fn resource(&self, path: &str) -> Result<&serde_json::Value> {
+        self.resources
+            .get(path)
+            .and_then(|v| v.as_ref())
+            .ok_or_else(|| Error::NotFound(format!("resource {path} does not exist")))
+    }
+
+    fn substitute<'a>(
+        &'a self,
+        db: &'a DB,
+        w_id: &'a str,
+        value: &'a serde_json::Value,
+        depth: usize,
+    ) -> std::pin::Pin<Box<dyn std::future::Future<Output = Result<serde_json::Value>> + Send + 'a>>
+    {
+        Box::pin(async move {
+            if depth > 32 {
+                return Err(Error::BadRequest(
+                    "resource references nest too deeply".to_string(),
+                ));
+            }
+            Ok(match value {
+                serde_json::Value::Object(map) => {
+                    let mut out = serde_json::Map::new();
+                    for (key, val) in map {
+                        out.insert(key.clone(), self.substitute(db, w_id, val, depth).await?);
+                    }
+                    serde_json::Value::Object(out)
+                }
+                serde_json::Value::Array(items) => {
+                    let mut out = vec![];
+                    for val in items {
+                        out.push(self.substitute(db, w_id, val, depth).await?);
+                    }
+                    serde_json::Value::Array(out)
+                }
+                serde_json::Value::String(s) if s.starts_with("$res:") => {
+                    let path = &s[5..];
+                    self.substitute(db, w_id, self.resource(path)?, depth + 1)
+                        .await?
+                }
+                serde_json::Value::String(s) if s.starts_with("$var:") => {
+                    let path = &s[5..];
+                    let (stored, secret) = self
+                        .variables
+                        .get(path)
+                        .and_then(|v| v.as_ref())
+                        .ok_or_else(|| {
+                            Error::NotFound(format!("variable {path} does not exist"))
+                        })?;
+                    serde_json::Value::String(match (secret, self.external_secrets.get(path)) {
+                        (false, _) => stored.clone(),
+                        (true, Some(external)) => external.clone(),
+                        (true, None) => windmill_common::variables::decrypt(
+                            &windmill_common::variables::build_crypt(db, w_id).await?,
+                            stored.clone(),
+                        )
+                        .map_err(|e| {
+                            Error::internal_err(format!("Error decrypting variable {s}: {e}"))
+                        })?,
+                    })
+                }
+                other => other.clone(),
+            })
+        })
+    }
+}
+
+fn collect_strings<'a>(value: Option<&'a serde_json::Value>, out: &mut Vec<&'a str>) {
+    match value {
+        Some(serde_json::Value::String(s)) => out.push(s),
+        Some(serde_json::Value::Array(items)) => {
+            items.iter().for_each(|v| collect_strings(Some(v), out))
+        }
+        Some(serde_json::Value::Object(map)) => {
+            map.values().for_each(|v| collect_strings(Some(v), out))
+        }
+        _ => {}
+    }
+}
+
+/// What a data table of the fork should be copied as.
+pub(crate) struct CopyRequest<'a> {
+    pub(crate) name: &'a str,
+    pub(crate) dbname: &'a str,
+    pub(crate) behavior: DataTableForkBehavior,
+}
+
+/// Check that `authed` may copy each data table of `parent_w_id` as asked, before anything is
+/// created.
+///
+/// Who may copy is what it was before data table roles — anyone for the schema, an admin of the
+/// workspace for the rows — narrowed under roles to whoever may connect as one of them: even the
+/// schema alone lists every table, which under roles only role holders can read in the parent.
+pub(crate) async fn authorize_copies(
+    db: &DB,
+    authed: &ApiAuthed,
+    parent_w_id: &str,
+    requests: &[CopyRequest<'_>],
+) -> Result<()> {
+    for request in requests {
+        match request.behavior {
+            DataTableForkBehavior::KeepOriginal => {
+                return Err(Error::BadRequest(format!(
+                    "Data table '{}' is kept, which copies nothing",
+                    request.name
+                )))
+            }
+            DataTableForkBehavior::SchemaOnly => {}
+            DataTableForkBehavior::SchemaAndData => {
+                require_admin(authed.is_admin, &authed.username)?;
+                if *CLOUD_HOSTED {
+                    return Err(Error::BadRequest(
+                        "Cloning schema and data is not available on cloud".to_string(),
+                    ));
+                }
+            }
+        }
+        windmill_common::validate_dbname(request.dbname)?;
+        if !request.dbname.starts_with("wm_fork_") {
+            return Err(Error::BadRequest(format!(
+                "Forked datatable database name '{}' must start with 'wm_fork_'",
+                request.dbname
+            )));
+        }
+        let governing = ensure_datatable_is_clonable(db, parent_w_id, request.name).await?;
+        ensure_reaches_governing_datatable(db, parent_w_id, request.name, &governing, authed)
+            .await?;
+        if governing.datatable.permissions.is_some() {
+            crate::datatable_replay_oss::ensure_replay()?;
+        }
+    }
+    Ok(())
+}
+
+/// Make every copy in `requests`, in order, once [`authorize_copies`] allows them all. When one
+/// fails, the copies already made are dropped before the error is returned.
+pub(crate) async fn make_copies(
+    db: &DB,
+    authed: &ApiAuthed,
+    parent_w_id: &str,
+    requests: &[CopyRequest<'_>],
+) -> Result<Vec<MadeCopy>> {
+    authorize_copies(db, authed, parent_w_id, requests).await?;
+    let mut copies = Vec::with_capacity(requests.len());
+    for request in requests {
+        match make_copy(db, authed, parent_w_id, request).await {
+            Ok(copy) => copies.push(copy),
+            Err(e) => return Err(drop_copies_after(db, copies, e).await),
+        }
+    }
+    Ok(copies)
+}
+
+/// Drop every copy, returning `error` — with what could not be dropped appended, since nothing
+/// else will name those databases again.
+pub(crate) async fn drop_copies_after(db: &DB, copies: Vec<MadeCopy>, error: Error) -> Error {
+    let mut stranded = Vec::new();
+    for copy in copies {
+        if let Err(e) = drop_copy(db, &copy.source_database, &copy.dbname).await {
+            tracing::error!("Could not drop '{}' after a failed fork: {e}", copy.dbname);
+            stranded.push(format!("'{}' ({e})", copy.dbname));
+        }
+    }
+    if stranded.is_empty() {
+        error
+    } else {
+        Error::ExecutionErr(format!(
+            "{error}. These databases created for the fork could not be dropped: {}",
+            stranded.join(", ")
+        ))
+    }
+}
+
+async fn drop_copy(db: &DB, source_database: &DataTableDatabase, dbname: &str) -> Result<()> {
+    if source_database.resource_type
+        == windmill_common::workspaces::DataTableCatalogResourceType::Instance
+    {
+        match windmill_common::drop_unused_instance_database(db, dbname).await? {
+            windmill_common::Cleanup::Dropped => Ok(()),
+            windmill_common::Cleanup::InUse(users) => Err(Error::BadRequest(format!(
+                "kept, since workspaces {} now use it",
+                users.join(", ")
+            ))),
+            windmill_common::Cleanup::Waiter(pid) => Err(Error::BadRequest(format!(
+                "kept, since a request (pid {pid}) is still waiting to name it"
+            ))),
+        }
+    } else {
+        // On a server of the workspace's own, where a resource edited meanwhile can already name it
+        // and nothing locks such an edit: dropping it could take someone's data.
+        Err(Error::BadRequest(
+            "kept on its PostgreSQL server, where it may already be in use; drop it there once it \
+             is not, before forking the same data table under this id again"
+                .to_string(),
+        ))
+    }
+}
+
+async fn make_copy(
+    db: &DB,
+    authed: &ApiAuthed,
+    parent_w_id: &str,
+    request: &CopyRequest<'_>,
+) -> Result<MadeCopy> {
+    let governing = ensure_datatable_is_clonable(db, parent_w_id, request.name).await?;
+    let source_database = governing.datatable.database.clone().ok_or_else(|| {
+        Error::internal_err(format!(
+            "Data table '{}' resolves to an entry that owns no database",
+            request.name
+        ))
+    })?;
+    let is_instance = governing.is_instance();
+    // Resolved from the snapshot, not read again: the connection the copy is made on is then
+    // exactly what these rows describe, which the fork's own clone of them is checked against.
+    let (server, connection): (PgDatabase, Option<ConnectionSnapshot>) = if is_instance {
+        let server = serde_json::from_value(
+            get_datatable_resource_from_db_unchecked(db, parent_w_id, request.name).await?,
+        )
+        .map_err(|e| Error::internal_err(format!("Failed to parse database credentials: {e}")))?;
+        (server, None)
+    } else {
+        let snapshot = connection_snapshot(
+            db,
+            &mut *db.acquire().await?,
+            &governing.workspace_id,
+            &source_database.resource_path,
+        )
+        .await?;
+        if !snapshot.root_holds_connection() {
+            return Err(Error::BadRequest(format!(
+                "Data table '{}' uses resource '{}', which only refers to another resource: the \
+                 fork's copy of it could not be pointed at the copied database. Point the data \
+                 table at the resource holding the connection, then fork again.",
+                request.name, source_database.resource_path
+            )));
+        }
+        let server = serde_json::from_value(snapshot.resolve(db, &governing.workspace_id).await?)
+            .map_err(|e| {
+            Error::internal_err(format!("Failed to parse database credentials: {e}"))
+        })?;
+        (server, Some(snapshot))
+    };
+
+    // Dumped before the database exists, so a source that cannot be read leaves nothing behind.
+    // Ownership never carries over: the restore runs as the target's connection user. Grants do,
+    // except on the instance, where the replay below is what reproduces them.
+    let dump = pg_dump_database(
+        &server,
+        PgDumpOptions {
+            schema_only: request.behavior == DataTableForkBehavior::SchemaOnly,
+            no_owner: true,
+            no_acl: is_instance,
+            ..Default::default()
+        },
+    )
+    .await?;
+
+    if is_instance {
+        windmill_common::create_custom_instance_database(db, request.dbname, "datatable").await?;
+    } else {
+        create_database_on_server(db, &server, request.dbname).await?;
+    }
+
+    let target = PgDatabase { dbname: request.dbname.to_string(), ..server.clone() };
+    let filled = fill(
+        db,
+        authed,
+        parent_w_id,
+        request.name,
+        &governing,
+        &server,
+        &target,
+        &dump,
+    )
+    .await;
+    match filled {
+        Ok(replayed) => Ok(MadeCopy {
+            name: request.name.to_string(),
+            dbname: request.dbname.to_string(),
+            behavior: request.behavior,
+            source_database,
+            replayed,
+            connection,
+        }),
+        Err(e) => {
+            if let Err(drop_err) = drop_copy(db, &source_database, request.dbname).await {
+                tracing::error!(
+                    "Could not drop '{}' after a failed copy of data table '{}': {drop_err}",
+                    request.dbname,
+                    request.name
+                );
+                return Err(Error::ExecutionErr(format!(
+                    "{e}. The database '{}' created for the copy could not be dropped: {drop_err}",
+                    request.dbname
+                )));
+            }
+            Err(e)
+        }
+    }
+}
+
+/// Restore the dump into the new database and, for a data table under roles, replay the source's
+/// owners and grants into it. Returns whether it replayed.
+#[allow(clippy::too_many_arguments)]
+async fn fill(
+    db: &DB,
+    authed: &ApiAuthed,
+    parent_w_id: &str,
+    name: &str,
+    governing: &GoverningDatatable,
+    source: &PgDatabase,
+    target: &PgDatabase,
+    dump: &DumpFile,
+) -> Result<bool> {
+    pg_import_dump(target, dump).await?;
+
+    // Held until the replay commits: a role renamed or dropped meanwhile would change what the
+    // replay names, and a settings save could move the source onto another database or put it under
+    // roles. Taken in the same order as the permissions save and the ACL apply.
+    // On a connection of its own: the checks below take theirs from the pool, and a lock holder
+    // drawn from the pool too could leave a small one with nothing to give them.
+    let database_url = windmill_common::get_database_url().await?;
+    let mut lock_holder = <sqlx::PgConnection as sqlx::Connection>::connect_with(
+        &database_url.connect_options().await?,
+    )
+    .await
+    .map_err(|e| Error::internal_err(format!("Failed to connect to the database: {e}")))?;
+    let mut tx = sqlx::Connection::begin(&mut lock_holder).await?;
+    lock_role_catalog(&mut tx).await?;
+    lock_settings_rows(&mut tx, parent_w_id, name).await?;
+
+    // Everything so far was decided before the locks.
+    let now = ensure_datatable_is_clonable(db, parent_w_id, name).await?;
+    ensure_reaches_governing_datatable(db, parent_w_id, name, &now, authed).await?;
+    if !same_database(&now.datatable.database, &governing.datatable.database) {
+        return Err(Error::BadRequest(format!(
+            "Data table '{name}' moved to another database while it was being copied; fork again"
+        )));
+    }
+
+    let replayed = now.datatable.permissions.is_some();
+    if replayed {
+        crate::datatable_replay_oss::ensure_replay()?;
+        let catalog = read_role_catalog_tx(&mut tx).await?;
+        // The replay leaves `CONNECT` to the catalog, and creating the database only tried to set
+        // it: a copy `PUBLIC` could still connect to would admit logins the source turns away.
+        windmill_common::datatable_roles::converge_connect_grants_with(
+            db,
+            &target.dbname,
+            &catalog,
+        )
+        .await?;
+        let catalog_roles: BTreeSet<String> = catalog.values().map(|r| r.name.clone()).collect();
+        let (source, _source_notices) = connect_with_notices(db, source).await?;
+        let (mut target, mut notices) = connect_with_notices(db, target).await?;
+        // One transaction on the copy: a replay that stops halfway leaves objects owned by one role
+        // and granted as another.
+        let pg_tx = target.transaction().await.map_err(|e| {
+            Error::internal_err(format!(
+                "Failed to open a transaction on the copy: {}",
+                pg_error_message(&e)
+            ))
+        })?;
+        crate::datatable_replay_oss::replay_owners_and_grants(
+            &source,
+            &pg_tx,
+            &mut notices,
+            &catalog_roles,
+        )
+        .await?;
+        pg_tx.commit().await.map_err(|e| {
+            Error::internal_err(format!(
+                "Failed to commit the replayed grants: {}",
+                pg_error_message(&e)
+            ))
+        })?;
+    }
+    tx.commit().await?;
+    Ok(replayed)
+}
+
+/// Lock every settings row the resolution of data table `name` of `start_w_id` passes through, in
+/// the order it passes them — each pointer, the entry that owns the database, and each workspace its
+/// roles come from — and return them. Deleting or repointing any of them would leave a copy made
+/// for the resolution answering for another one.
+pub(crate) async fn lock_settings_rows(
+    tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
+    start_w_id: &str,
+    name: &str,
+) -> Result<Vec<String>> {
+    let mut path: Vec<(String, String)> = vec![];
+    let (mut w_id, mut datatable) = (start_w_id.to_string(), name.to_string());
+    loop {
+        if path.contains(&(w_id.clone(), datatable.clone())) || path.len() > 32 {
+            return Err(Error::BadRequest(format!(
+                "Data table '{name}' of workspace '{start_w_id}' resolves through a cycle"
+            )));
+        }
+        let entry: Option<serde_json::Value> = sqlx::query_scalar(
+            "SELECT datatable->'datatables'->$2 FROM workspace_settings
+             WHERE workspace_id = $1 FOR UPDATE",
+        )
+        .bind(&w_id)
+        .bind(&datatable)
+        .fetch_optional(&mut **tx)
+        .await?
+        .flatten();
+        path.push((w_id.clone(), datatable.clone()));
+        let entry: Option<windmill_common::workspaces::DataTable> =
+            entry.and_then(|e| serde_json::from_value(e).ok());
+        match entry.and_then(|e| e.reference.or(e.governed_by)) {
+            Some(next) => (w_id, datatable) = (next.workspace_id, next.datatable),
+            None => break,
+        }
+    }
+    Ok(path.into_iter().map(|(w_id, _)| w_id).collect())
+}
+
+pub(crate) fn same_database(a: &Option<DataTableDatabase>, b: &Option<DataTableDatabase>) -> bool {
+    match (a, b) {
+        (Some(a), Some(b)) => {
+            a.resource_type == b.resource_type && a.resource_path == b.resource_path
+        }
+        _ => false,
+    }
+}
diff --git a/backend/windmill-api-workspaces/src/datatable_migrations.rs b/backend/windmill-api-workspaces/src/datatable_migrations.rs
index ef5ea37e1d..df1fac203b 100644
--- a/backend/windmill-api-workspaces/src/datatable_migrations.rs
+++ b/backend/windmill-api-workspaces/src/datatable_migrations.rs
@@ -30,6 +30,7 @@ use windmill_api_auth::{require_super_admin, ApiAuthed};
 use windmill_api_jobs::run_wait_result_internal;
 use windmill_audit::audit_oss::audit_log;
 use windmill_audit::ActionKind;
+use windmill_common::datatable_roles::ADMIN_DATATABLE_ROLE;
 use windmill_common::db::UserDB;
 use windmill_common::error::{pg_error_message, Error, JsonResult, Result};
 use windmill_common::jobs::{JobPayload, RawCode};
@@ -38,7 +39,11 @@ use windmill_common::runnable_settings::{ConcurrencySettingsWithCustom, Debounci
 use windmill_common::scripts::ScriptLang;
 use windmill_common::users::username_to_permissioned_as;
 use windmill_common::worker::to_raw_value;
-use windmill_common::workspaces::get_datatable_resource_from_db_unchecked;
+use windmill_common::worker::SqlAnnotations;
+use windmill_common::workspaces::{
+    ensure_can_use_datatable_role, ensure_datatable_admin_access,
+    get_datatable_resource_from_db_unchecked, resolve_governing_datatable, DatatableAccess,
+};
 use windmill_common::{PgDatabase, DB};
 use windmill_git_sync::{
     handle_deployment_metadata, handle_deployment_metadata_batch, DeployedObject,
@@ -86,6 +91,79 @@ pub(crate) fn routes() -> Router {
         )
 }
 
+/// Refuse a migration whose role this caller may not use, before a job is pushed or a version
+/// recorded.
+///
+/// A migration that declares `-- role <name>` runs as that role, so the caller has to be one of its
+/// tenants. One that declares none runs as `admin` and reaches every object in the database
+/// whatever the roles grant, so it is for the admins of the workspace that governs the data table
+/// — a fork can run a migration under a role it holds, never a migration under `admin`.
+///
+/// The executor re-checks the role when it resolves the connection, so this is not the boundary. It
+/// is what makes the refusal legible: which migration, and which role.
+async fn ensure_migration_role_allowed(
+    db: &DB,
+    w_id: &str,
+    datatable_name: &str,
+    authed: &ApiAuthed,
+    sql: &str,
+    migration: &str,
+) -> Result<()> {
+    let access = DatatableAccess::Authed(authed.to_authed_ref());
+    match SqlAnnotations::datatable_role(sql)? {
+        Some(role) => {
+            ensure_can_use_datatable_role(db, w_id, datatable_name, Some(&role), &access, migration)
+                .await
+        }
+        None => ensure_datatable_admin_access(db, w_id, datatable_name, &access)
+            .await
+            .map_err(|e| {
+                Error::NotAuthorized(format!(
+                    "{migration} declares no role, so it would run as admin. {e}"
+                ))
+            }),
+    }
+}
+
+/// Refuse writing or deleting a migration definition unless this caller may run both its up and its
+/// down. A definition is run later by whoever applies or rolls back pending migrations, as the role
+/// it declares, so gating only the run would let anyone plant SQL for a data table's admin to run.
+async fn ensure_may_edit_migration(
+    db: &DB,
+    w_id: &str,
+    datatable_name: &str,
+    authed: &ApiAuthed,
+    migration: &str,
+    code_up: &str,
+    code_down: Option<&str>,
+) -> Result<()> {
+    // Admin access reaches everything a role can, so it edits any definition without reading its
+    // annotation, which one saved before annotations were parsed may no longer pass. A refusal
+    // there would leave such a definition impossible to delete or fix.
+    let access = DatatableAccess::Authed(authed.to_authed_ref());
+    if ensure_datatable_admin_access(db, w_id, datatable_name, &access)
+        .await
+        .is_ok()
+    {
+        return Ok(());
+    }
+    for sql in std::iter::once(code_up).chain(code_down) {
+        ensure_migration_role_allowed(db, w_id, datatable_name, authed, sql, migration).await?;
+    }
+    Ok(())
+}
+
+/// Operators run deployed code only, and a migration is SQL written or run by hand. Checked before
+/// anything else, including the role checks: on a data table not under roles those pass everyone.
+fn ensure_not_operator(authed: &ApiAuthed) -> Result<()> {
+    if authed.is_operator {
+        return Err(Error::NotAuthorized(
+            "Operators cannot manage or run data table migrations".to_string(),
+        ));
+    }
+    Ok(())
+}
+
 #[derive(Serialize)]
 struct AppliedMigration {
     version: i64,
@@ -128,7 +206,18 @@ async fn datatable_database_arg(
     .await?
     .ok_or_else(|| Error::internal_err(format!("datatable {datatable_name} not found")))?;
 
-    Ok(to_raw_value(&format!("datatable://{datatable_name}")))
+    // `?role=admin` rather than a bare reference, so a migration that declares no `-- role` runs
+    // as the connection that owns the schema instead of falling through to the data table's
+    // default role — which is what `ensure_migration_role_allowed` gated it as, and which is the
+    // only role a DDL statement can be expected to succeed under. A migration that does declare a
+    // role overrides this: the annotation wins over the reference.
+    //
+    // A legacy name containing `?` cannot be migrated through this reference: the appended query
+    // makes it neither an exact name nor a parseable one. Accepted on purpose, since such names can
+    // no longer be created and none are expected to carry migrations.
+    Ok(to_raw_value(&format!(
+        "datatable://{datatable_name}?role={ADMIN_DATATABLE_ROLE}"
+    )))
 }
 
 /// Run a migration's SQL as a normal Windmill `postgresql` job, permissioned as
@@ -384,6 +473,12 @@ async fn run_datatable_migrations(
     Path((w_id, datatable_name)): Path<(String, String)>,
     Query(query): Query<RunDatatableMigrationsQuery>,
 ) -> JsonResult<RunDatatableMigrationsResult> {
+    ensure_not_operator(&authed)?;
+    // Before the admin connection is opened at all: the bookkeeping below is created and read
+    // through it, so a caller no role covers must be refused here rather than after the fact.
+    crate::datatable_permissions::ensure_reaches_datatable(&db, &w_id, &datatable_name, &authed)
+        .await?;
+
     audit_log(
         &db,
         &authed,
@@ -440,6 +535,15 @@ async fn run_datatable_migrations(
         if applied_versions.contains(&m.timestamp) {
             continue;
         }
+        ensure_migration_role_allowed(
+            &db,
+            &w_id,
+            &datatable_name,
+            &authed,
+            &m.code_up,
+            &format!("Migration {} ({})", m.timestamp, m.name),
+        )
+        .await?;
         run_datatable_migration_job(&db, &user_db, &authed, &w_id, &database_arg, &m.code_up)
             .await
             .map_err(|e| {
@@ -506,6 +610,12 @@ async fn rollback_datatable_migrations(
     Path((w_id, datatable_name)): Path<(String, String)>,
     Query(query): Query<RollbackDatatableMigrationsQuery>,
 ) -> JsonResult<RollbackDatatableMigrationsResult> {
+    ensure_not_operator(&authed)?;
+    // Before the admin connection is opened at all: the bookkeeping below is created and read
+    // through it, so a caller no role covers must be refused here rather than after the fact.
+    crate::datatable_permissions::ensure_reaches_datatable(&db, &w_id, &datatable_name, &authed)
+        .await?;
+
     audit_log(
         &db,
         &authed,
@@ -588,6 +698,16 @@ async fn rollback_datatable_migrations(
         ))
     })?;
 
+    ensure_migration_role_allowed(
+        &db,
+        &w_id,
+        &datatable_name,
+        &authed,
+        &code_down,
+        &format!("Migration {} ({})", version, definition.name),
+    )
+    .await?;
+
     let database_arg = datatable_database_arg(&db, &w_id, &datatable_name).await?;
     run_datatable_migration_job(&db, &user_db, &authed, &w_id, &database_arg, &code_down)
         .await
@@ -748,10 +868,15 @@ async fn read_applied_datatable_versions(
 
 /// List a data table's migrations annotated with whether each has been applied.
 async fn datatable_migrations_status(
-    _authed: ApiAuthed,
+    authed: ApiAuthed,
     Extension(db): Extension<DB>,
     Path((w_id, datatable_name)): Path<(String, String)>,
 ) -> JsonResult<DatatableMigrationsStatusResult> {
+    // Reads `_wm_migrations` through the data table's admin connection, so it answers to the same
+    // question as running one: may you reach this data table at all.
+    crate::datatable_permissions::ensure_reaches_datatable(&db, &w_id, &datatable_name, &authed)
+        .await?;
+
     let enabled = datatable_migrations_enabled(&db, &w_id, &datatable_name).await?;
     if !enabled {
         return Ok(Json(DatatableMigrationsStatusResult {
@@ -1125,9 +1250,20 @@ async fn create_datatable_migration(
     Path((w_id, datatable_name)): Path<(String, String)>,
     Json(payload): Json<CreateDatatableMigration>,
 ) -> JsonResult<DatatableMigration> {
+    ensure_not_operator(&authed)?;
     validate_datatable_path_segment(&datatable_name)?;
     validate_migration_name(&payload.name)?;
     ensure_datatable_migrations_enabled(&db, &w_id, &datatable_name).await?;
+    ensure_may_edit_migration(
+        &db,
+        &w_id,
+        &datatable_name,
+        &authed,
+        &format!("Migration '{}'", payload.name),
+        &payload.code_up,
+        payload.code_down.as_deref(),
+    )
+    .await?;
 
     let mut tx = db.begin().await?;
     let timestamp = insert_datatable_migration_def(
@@ -1179,6 +1315,34 @@ async fn delete_datatable_migration(
     Extension(db): Extension<DB>,
     Path((w_id, datatable_name, timestamp)): Path<(String, String, i64)>,
 ) -> Result<String> {
+    ensure_not_operator(&authed)?;
+    let deleted_message = format!("Deleted migration {} from {}", timestamp, datatable_name);
+
+    // A definition already gone is not an error: `wmill sync push` deletes whatever the repo
+    // dropped, which may no longer exist here.
+    let Some(definition) = sqlx::query!(
+        "SELECT name, code_up, code_down FROM datatable_migrations \
+         WHERE workspace_id = $1 AND datatable = $2 AND timestamp = $3",
+        &w_id,
+        &datatable_name,
+        timestamp,
+    )
+    .fetch_optional(&db)
+    .await?
+    else {
+        return Ok(deleted_message);
+    };
+    ensure_may_edit_migration(
+        &db,
+        &w_id,
+        &datatable_name,
+        &authed,
+        &format!("Migration {} ({})", timestamp, definition.name),
+        &definition.code_up,
+        definition.code_down.as_deref(),
+    )
+    .await?;
+
     // Hold the run-serialization lock across the applied-check and the delete: a
     // run snapshots a migration's SQL before recording its version, so an
     // unserialized delete could race it and leave `_wm_migrations` pointing at a
@@ -1206,19 +1370,46 @@ async fn delete_datatable_migration(
         )));
     }
 
+    // Delete only the SQL the role check above cleared: it read the definition without the lock,
+    // and a rewrite that landed since was never checked.
     let deleted_name = sqlx::query_scalar!(
         "DELETE FROM datatable_migrations \
          WHERE workspace_id = $1 AND datatable = $2 AND timestamp = $3 \
+           AND code_up = $4 AND code_down IS NOT DISTINCT FROM $5 \
          RETURNING name",
         &w_id,
         &datatable_name,
         timestamp,
+        &definition.code_up,
+        definition.code_down.as_deref(),
     )
     .fetch_optional(&db)
     .await?;
     // The definition is removed; runs may resume (audit/deploy metadata below
     // don't need the lock).
     drop(lock_client);
+    let Some(name) = deleted_name else {
+        // Nothing matched either because another delete got there first, which is this one's
+        // outcome too, or because the definition was rewritten.
+        let still_defined = sqlx::query_scalar!(
+            "SELECT EXISTS(SELECT 1 FROM datatable_migrations \
+             WHERE workspace_id = $1 AND datatable = $2 AND timestamp = $3)",
+            &w_id,
+            &datatable_name,
+            timestamp,
+        )
+        .fetch_one(&db)
+        .await?
+        .unwrap_or(false);
+        if !still_defined {
+            return Ok(deleted_message);
+        }
+        return Err(Error::BadRequest(format!(
+            "Migration {} on data table '{}' changed while it was being deleted. Reload it and \
+             retry.",
+            timestamp, datatable_name
+        )));
+    };
 
     audit_log(
         &db,
@@ -1231,23 +1422,10 @@ async fn delete_datatable_migration(
     )
     .await?;
 
-    // Only tally a change if a migration was actually deleted.
-    if let Some(name) = deleted_name {
-        record_datatable_migration_deployment(
-            &authed,
-            &db,
-            &w_id,
-            &datatable_name,
-            timestamp,
-            &name,
-        )
+    record_datatable_migration_deployment(&authed, &db, &w_id, &datatable_name, timestamp, &name)
         .await?;
-    }
 
-    Ok(format!(
-        "Deleted migration {} from {}",
-        timestamp, datatable_name
-    ))
+    Ok(deleted_message)
 }
 
 #[derive(Deserialize)]
@@ -1268,6 +1446,7 @@ async fn upsert_datatable_migration(
     Path((w_id, datatable_name)): Path<(String, String)>,
     Json(payload): Json<UpsertDatatableMigration>,
 ) -> Result<String> {
+    ensure_not_operator(&authed)?;
     validate_datatable_path_segment(&datatable_name)?;
     validate_migration_name(&payload.name)?;
     ensure_datatable_migrations_enabled(&db, &w_id, &datatable_name).await?;
@@ -1293,9 +1472,9 @@ async fn upsert_datatable_migration(
     // run-serialization lock across the applied-check and the write below so an
     // in-flight run can't record a version for the SQL we're about to overwrite.
     // Held until the end of the handler (well past the write). The exempt
-    // upserts need no lock: a new or unchanged one overwrites nothing, and one
-    // that only adds a down leaves the `code_up` a concurrent run is recording
-    // a version for untouched.
+    // upserts need no lock: a new one overwrites nothing, and one that only adds
+    // a down leaves the `code_up` a concurrent run is recording a version for
+    // untouched.
     let only_adds_down = existing.as_ref().is_some_and(|existing| {
         existing.name == payload.name
             && existing.code_up == payload.code_up
@@ -1307,8 +1486,40 @@ async fn upsert_datatable_migration(
             && existing.code_up == payload.code_up
             && existing.code_down == payload.code_down
     });
+    let upserted_message = format!(
+        "Upserted migration {} in {}",
+        payload.timestamp, datatable_name
+    );
+    // A re-push of the definition as stored changes nothing, so it is not checked, written, audited,
+    // synced or counted. Writing it anyway would re-create a definition deleted since the read above.
+    if unchanged {
+        return Ok(upserted_message);
+    }
+    ensure_may_edit_migration(
+        &db,
+        &w_id,
+        &datatable_name,
+        &authed,
+        &format!("Migration {} ({})", payload.timestamp, payload.name),
+        &payload.code_up,
+        payload.code_down.as_deref(),
+    )
+    .await?;
+    // Replacing a definition removes the one stored, so it answers to the same check as a delete.
+    if let Some(existing) = existing.as_ref() {
+        ensure_may_edit_migration(
+            &db,
+            &w_id,
+            &datatable_name,
+            &authed,
+            &format!("Migration {} ({})", payload.timestamp, existing.name),
+            &existing.code_up,
+            existing.code_down.as_deref(),
+        )
+        .await?;
+    }
     let _run_lock = match existing.as_ref() {
-        Some(_) if !only_adds_down && !unchanged => {
+        Some(_) if !only_adds_down => {
             // Fail closed: if we can't lock/read the applied set (e.g. the
             // data-table database is temporarily unreachable), refuse the change
             // rather than risk overwriting a migration that has already run.
@@ -1338,31 +1549,27 @@ async fn upsert_datatable_migration(
         _ => None,
     };
 
-    // An exempt upsert judged the row from an unlocked read and then writes
-    // without the lock, so that whole read is re-tested here, where `ON CONFLICT
-    // DO UPDATE` re-reads the row under a row lock. Otherwise a request working
-    // from a stale definition silently reverts whatever changed in between — a
-    // second addition's down, or a locked rewrite of the up whose new SQL a run
-    // may already have recorded a version for. Reading no row at all is part of
-    // the premise: the equality is NULL when `$8` is, so a version created in the
-    // meantime is refused rather than overwritten.
-    let recheck_observed = _run_lock.is_none();
+    // The role checks, and the exemptions from the lock, all judged the row from the unlocked read
+    // above, so that whole read is re-tested here, where `ON CONFLICT DO UPDATE` re-reads the row
+    // under a row lock. Otherwise a request working from a stale definition silently replaces
+    // whatever changed in between: SQL the role checks never saw, or a locked rewrite of the up
+    // whose new SQL a run may already have recorded a version for. Reading no row at all is part of
+    // the premise: the equality is NULL when `$7` is, so a version created in the meantime is
+    // refused rather than overwritten.
     let written = sqlx::query!(
         "INSERT INTO datatable_migrations (workspace_id, datatable, timestamp, name, code_up, code_down) \
          VALUES ($1, $2, $3, $4, $5, $6) \
          ON CONFLICT (workspace_id, datatable, timestamp) DO UPDATE \
          SET name = EXCLUDED.name, code_up = EXCLUDED.code_up, code_down = EXCLUDED.code_down \
-         WHERE NOT $7 \
-            OR (datatable_migrations.name = $8::text \
-                AND datatable_migrations.code_up = $9::text \
-                AND datatable_migrations.code_down IS NOT DISTINCT FROM $10::text)",
+         WHERE datatable_migrations.name = $7::text \
+           AND datatable_migrations.code_up = $8::text \
+           AND datatable_migrations.code_down IS NOT DISTINCT FROM $9::text",
         &w_id,
         &datatable_name,
         payload.timestamp,
         &payload.name,
         &payload.code_up,
         payload.code_down.as_deref(),
-        recheck_observed,
         existing.as_ref().map(|e| e.name.as_str()),
         existing.as_ref().map(|e| e.code_up.as_str()),
         existing.as_ref().and_then(|e| e.code_down.as_deref()),
@@ -1401,24 +1608,17 @@ async fn upsert_datatable_migration(
     )
     .await?;
 
-    // An unchanged re-push is not counted: `wmill sync push` sends every migration
-    // on every sync, so counting those would swamp the definitions people write.
-    if !unchanged {
-        windmill_common::feature_usage::log_feature_usage(
-            "datatable",
-            "migration_created",
-            if existing.is_none() {
-                "synced"
-            } else {
-                "edited"
-            },
-        );
-    }
+    windmill_common::feature_usage::log_feature_usage(
+        "datatable",
+        "migration_created",
+        if existing.is_none() {
+            "synced"
+        } else {
+            "edited"
+        },
+    );
 
-    Ok(format!(
-        "Upserted migration {} in {}",
-        payload.timestamp, datatable_name
-    ))
+    Ok(upserted_message)
 }
 
 /// Generate the first migration for a data table by snapshotting its current
@@ -1431,6 +1631,16 @@ async fn generate_initial_datatable_migration(
     Extension(db): Extension<DB>,
     Path((w_id, datatable_name)): Path<(String, String)>,
 ) -> JsonResult<DatatableMigration> {
+    ensure_not_operator(&authed)?;
+    // Returns a `pg_dump` of the whole schema and writes into the data table's own bookkeeping, so
+    // it answers to the workspace that governs it rather than to whoever is asking.
+    ensure_datatable_admin_access(
+        &db,
+        &w_id,
+        &datatable_name,
+        &DatatableAccess::Authed(authed.to_authed_ref()),
+    )
+    .await?;
     validate_datatable_path_segment(&datatable_name)?;
     ensure_datatable_migrations_enabled(&db, &w_id, &datatable_name).await?;
 
@@ -1601,9 +1811,21 @@ pub(crate) struct DatatableRename {
     pub(crate) to: String,
 }
 
-async fn resolve_datatable_pg(db: &DB, w_id: &str, datatable: &str) -> Result<PgDatabase> {
+/// The database whose `_wm_migrations` a rename or delete of `datatable` in `w_id` should touch —
+/// `None` when that is somebody else's.
+///
+/// A fork's entry points at the workspace that governs the data table, so renaming or removing it
+/// changes what the fork calls the data table and nothing more. Following the pointer here would
+/// let a fork admin relabel or wipe the *governing* workspace's migration bookkeeping through
+/// their own settings form, and the parent would then re-run every migration from zero.
+async fn resolve_datatable_pg(db: &DB, w_id: &str, datatable: &str) -> Result<Option<PgDatabase>> {
+    let governing = resolve_governing_datatable(db, w_id, datatable).await?;
+    if governing.workspace_id != w_id {
+        return Ok(None);
+    }
     let db_resource = get_datatable_resource_from_db_unchecked(db, w_id, datatable).await?;
     serde_json::from_value(db_resource)
+        .map(Some)
         .map_err(|e| Error::internal_err(format!("Failed to parse database credentials: {}", e)))
 }
 
@@ -1621,7 +1843,9 @@ fn ignore_missing_wm_migrations(e: tokio_postgres::Error) -> Result<()> {
 
 /// Drop a data table's rows from its own database's `_wm_migrations`.
 async fn remote_forget_datatable_migrations(db: &DB, w_id: &str, datatable: &str) -> Result<()> {
-    let pg_db = resolve_datatable_pg(db, w_id, datatable).await?;
+    let Some(pg_db) = resolve_datatable_pg(db, w_id, datatable).await? else {
+        return Ok(());
+    };
     let (client, connection) = pg_db.connect(Some(db)).await?;
     tokio::spawn(async move {
         let _ = connection.await;
@@ -1646,7 +1870,9 @@ async fn remote_rename_datatable_migrations(
     from: &str,
     to: &str,
 ) -> Result<()> {
-    let pg_db = resolve_datatable_pg(db, w_id, resolve_by).await?;
+    let Some(pg_db) = resolve_datatable_pg(db, w_id, resolve_by).await? else {
+        return Ok(());
+    };
     let (client, connection) = pg_db.connect(Some(db)).await?;
     tokio::spawn(async move {
         let _ = connection.await;
diff --git a/backend/windmill-api-workspaces/src/datatable_permissions.rs b/backend/windmill-api-workspaces/src/datatable_permissions.rs
new file mode 100644
index 0000000000..69e04e328d
--- /dev/null
+++ b/backend/windmill-api-workspaces/src/datatable_permissions.rs
@@ -0,0 +1,79 @@
+/*
+ * Author: Ruben Fiszel
+ * Copyright: Windmill Labs, Inc 2022
+ * This file and its contents are licensed under the AGPLv3 License.
+ * Please see the included NOTICE for copyright information and
+ * LICENSE-AGPL for a copy of the license.
+ */
+
+//! Who may connect to a data table as which role.
+//!
+//! The decision lives on the data table entry of the workspace that governs it, which is not
+//! necessarily the workspace asking: a fork's entry points at its parent's, and everything here
+//! resolves through that pointer first. Nothing in this module runs SQL against the data table —
+//! a save is tenant lists and a default, and the Postgres roles themselves are the instance
+//! catalog's business.
+
+use axum::{routing::get, Router};
+
+use windmill_api_auth::ApiAuthed;
+use windmill_common::error::Result;
+use windmill_common::workspaces::GoverningDatatable;
+use windmill_common::DB;
+
+use crate::datatable_permissions_oss as roles;
+
+pub(crate) fn routes() -> Router {
+    Router::new()
+        .route(
+            "/datatable_permissions/{datatable_name}",
+            get(roles::get_datatable_permissions).post(roles::set_datatable_permissions),
+        )
+        .route(
+            "/datatable_usable_roles/{datatable_name}",
+            get(roles::list_usable_datatable_roles),
+        )
+}
+
+/// Administering a data table — its permissions, its migrations that declare no role, its exports
+/// — is for the admins of the workspace that governs it. A fork can use the data table; it never
+/// administers it.
+// The gate for whatever administers a data table under roles, which the routes of this module alone
+// do not always reach.
+#[allow(dead_code)]
+pub(crate) async fn ensure_governs_datatable(
+    db: &DB,
+    authed: &ApiAuthed,
+    w_id: &str,
+    governing: &GoverningDatatable,
+) -> Result<()> {
+    roles::ensure_governs_datatable(db, authed, w_id, governing).await
+}
+
+/// Refuse a caller that no tenant of this data table covers.
+///
+/// The bookkeeping endpoints below open the data table's `admin` connection to read or create
+/// `_wm_migrations` before they know which migration will run — so without this, someone covered
+/// by no role at all can still force admin-backed reads and writes on a database they may not
+/// touch. It asks only "may you reach this data table as anything"; which role a given migration
+/// runs as is still decided per migration, and by the executor after that.
+pub(crate) async fn ensure_reaches_datatable(
+    db: &DB,
+    w_id: &str,
+    datatable_name: &str,
+    authed: &ApiAuthed,
+) -> Result<()> {
+    roles::ensure_reaches_datatable(db, w_id, datatable_name, authed).await
+}
+
+/// [`ensure_reaches_datatable`] against an entry already resolved, for a caller that goes on to
+/// connect from that same entry.
+pub(crate) async fn ensure_reaches_governing_datatable(
+    db: &DB,
+    w_id: &str,
+    datatable_name: &str,
+    governing: &GoverningDatatable,
+    authed: &ApiAuthed,
+) -> Result<()> {
+    roles::ensure_reaches_governing_datatable(db, w_id, datatable_name, governing, authed).await
+}
diff --git a/backend/windmill-api-workspaces/src/datatable_permissions_oss.rs b/backend/windmill-api-workspaces/src/datatable_permissions_oss.rs
new file mode 100644
index 0000000000..736493cc2d
--- /dev/null
+++ b/backend/windmill-api-workspaces/src/datatable_permissions_oss.rs
@@ -0,0 +1,112 @@
+/*
+ * Author: Ruben Fiszel
+ * Copyright: Windmill Labs, Inc 2022
+ * This file and its contents are licensed under the AGPLv3 License.
+ * Please see the included NOTICE for copyright information and
+ * LICENSE-AGPL for a copy of the license.
+ */
+
+//! Where the data table permissions endpoints and their gates come from: the enterprise
+//! implementation, or a refusal. Roles are an Enterprise Edition feature; see
+//! `windmill_common::datatable_roles_oss`.
+
+#[cfg(all(feature = "private", feature = "enterprise"))]
+pub(crate) use crate::datatable_permissions_ee::{
+    ensure_governs_datatable, ensure_reaches_datatable, ensure_reaches_governing_datatable,
+    get_datatable_permissions, list_usable_datatable_roles, set_datatable_permissions,
+    usable_datatable_roles,
+};
+
+#[cfg(not(all(feature = "private", feature = "enterprise")))]
+pub(crate) use ce::*;
+
+#[cfg(not(all(feature = "private", feature = "enterprise")))]
+mod ce {
+    use windmill_api_auth::ApiAuthed;
+    use windmill_common::{
+        datatable_roles_oss::datatable_roles_unavailable as unavailable,
+        error::Result,
+        workspaces::{resolve_governing_datatable, GoverningDatatable},
+        DB,
+    };
+
+    /// Nobody administers a data table's roles without them.
+    #[allow(dead_code)]
+    pub(crate) async fn ensure_governs_datatable(
+        _db: &DB,
+        _authed: &ApiAuthed,
+        _w_id: &str,
+        _governing: &GoverningDatatable,
+    ) -> Result<()> {
+        Err(unavailable())
+    }
+
+    /// A data table not under roles is reached as it was before roles existed. One under roles is
+    /// refused: no role of it can be connected as.
+    pub(crate) async fn ensure_reaches_datatable(
+        db: &DB,
+        w_id: &str,
+        datatable_name: &str,
+        _authed: &ApiAuthed,
+    ) -> Result<()> {
+        let governing = resolve_governing_datatable(db, w_id, datatable_name).await?;
+        if governing.datatable.permissions.is_none() {
+            Ok(())
+        } else {
+            Err(unavailable())
+        }
+    }
+
+    pub(crate) async fn ensure_reaches_governing_datatable(
+        _db: &DB,
+        _w_id: &str,
+        _datatable_name: &str,
+        governing: &GoverningDatatable,
+        _authed: &ApiAuthed,
+    ) -> Result<()> {
+        if governing.datatable.permissions.is_none() {
+            Ok(())
+        } else {
+            Err(unavailable())
+        }
+    }
+
+    // The routes stay registered so the API has one shape; each answers after authentication,
+    // before anything is read.
+
+    pub(crate) async fn get_datatable_permissions(_authed: ApiAuthed) -> Result<String> {
+        Err(unavailable())
+    }
+
+    pub(crate) async fn set_datatable_permissions(_authed: ApiAuthed) -> Result<String> {
+        Err(unavailable())
+    }
+
+    pub(crate) async fn list_usable_datatable_roles(_authed: ApiAuthed) -> Result<String> {
+        Err(unavailable())
+    }
+
+    pub(crate) struct UsableDatatableRoles {
+        pub(crate) permissioned: bool,
+        pub(crate) roles: Vec<String>,
+        pub(crate) default_role: String,
+    }
+
+    /// A data table not under roles is used as `admin`, as before roles existed. One under roles
+    /// is refused: no role of it can be connected as.
+    pub(crate) async fn usable_datatable_roles(
+        _db: &DB,
+        _authed: &ApiAuthed,
+        _w_id: &str,
+        governing: &GoverningDatatable,
+    ) -> Result<UsableDatatableRoles> {
+        if governing.datatable.permissions.is_some() {
+            return Err(unavailable());
+        }
+        Ok(UsableDatatableRoles {
+            permissioned: false,
+            roles: vec![],
+            default_role: windmill_common::datatable_roles::ADMIN_DATATABLE_ROLE.to_string(),
+        })
+    }
+}
diff --git a/backend/windmill-api-workspaces/src/datatable_replay_oss.rs b/backend/windmill-api-workspaces/src/datatable_replay_oss.rs
new file mode 100644
index 0000000000..edcf8e402b
--- /dev/null
+++ b/backend/windmill-api-workspaces/src/datatable_replay_oss.rs
@@ -0,0 +1,48 @@
+/*
+ * Author: Ruben Fiszel
+ * Copyright: Windmill Labs, Inc 2022
+ * This file and its contents are licensed under the AGPLv3 License.
+ * Please see the included NOTICE for copyright information and
+ * LICENSE-AGPL for a copy of the license.
+ */
+
+//! Where the replay of a data table's owners and grants into its copy comes from: the enterprise
+//! one, or a refusal. Without it a data table under roles is not copied at all: its rows would
+//! arrive owned by the admin connection with no grant for any role.
+
+#[cfg(all(feature = "private", feature = "enterprise"))]
+pub(crate) use crate::datatable_replay_ee::replay_owners_and_grants;
+
+#[cfg(all(feature = "private", feature = "enterprise"))]
+pub(crate) fn ensure_replay() -> windmill_common::error::Result<()> {
+    Ok(())
+}
+
+#[cfg(not(all(feature = "private", feature = "enterprise")))]
+use {
+    std::collections::BTreeSet,
+    tokio::sync::mpsc,
+    tokio_postgres::error::DbError,
+    windmill_common::error::{Error, Result},
+};
+
+/// Checked before anything is created.
+#[cfg(not(all(feature = "private", feature = "enterprise")))]
+pub(crate) fn ensure_replay() -> Result<()> {
+    Err(Error::BadRequest(
+        "Cloning a data table under roles is a Windmill Enterprise Edition feature: the copy \
+         needs the source's owners and grants replayed. Fork it keeping the original database \
+         instead."
+            .to_string(),
+    ))
+}
+
+#[cfg(not(all(feature = "private", feature = "enterprise")))]
+pub(crate) async fn replay_owners_and_grants(
+    _source: &tokio_postgres::Client,
+    _target: &tokio_postgres::Transaction<'_>,
+    _notices: &mut mpsc::UnboundedReceiver<DbError>,
+    _catalog_roles: &BTreeSet<String>,
+) -> Result<()> {
+    ensure_replay()
+}
diff --git a/backend/windmill-api-workspaces/src/lib.rs b/backend/windmill-api-workspaces/src/lib.rs
index 22f2a2c5bb..c437d7e2b4 100644
--- a/backend/windmill-api-workspaces/src/lib.rs
+++ b/backend/windmill-api-workspaces/src/lib.rs
@@ -1,11 +1,26 @@
 #[cfg(feature = "parquet")]
 pub mod ai_session_backups;
 pub mod data_metrics;
+pub mod datatable_acl;
+pub mod datatable_acl_oss;
+pub mod datatable_clone;
 pub mod datatable_migrations;
+pub mod datatable_permissions;
+pub mod datatable_permissions_oss;
+pub mod datatable_replay_oss;
 pub mod deployment_requests;
+pub mod remote_deploy;
 pub mod workspaces;
 pub mod workspaces_extra;
 pub mod workspaces_oss;
 
 #[cfg(feature = "private")]
 pub mod workspaces_ee;
+
+#[cfg(all(feature = "private", feature = "enterprise"))]
+pub mod datatable_acl_ee;
+#[cfg(all(feature = "private", feature = "enterprise"))]
+pub mod datatable_replay_ee;
+
+#[cfg(all(feature = "private", feature = "enterprise"))]
+pub mod datatable_permissions_ee;
diff --git a/backend/windmill-api-workspaces/src/remote_deploy.rs b/backend/windmill-api-workspaces/src/remote_deploy.rs
new file mode 100644
index 0000000000..3e701cbf14
--- /dev/null
+++ b/backend/windmill-api-workspaces/src/remote_deploy.rs
@@ -0,0 +1,794 @@
+/*
+ * Author: Ruben Fiszel
+ * Copyright: Windmill Labs, Inc 2026
+ * This file and its contents are licensed under the AGPLv3 License.
+ * Please see the included NOTICE for copyright information and
+ * LICENSE-AGPL for a copy of the license.
+ */
+
+//! Deploying from the UI into a workspace of another Windmill instance.
+//!
+//! The browser runs the same deploy it runs between two workspaces of this instance, and sends
+//! every call aimed at the target through [`proxy`], which forwards it to the remote workspace
+//! with the caller's own token for that instance. The remote authorizes and audits the deploy as
+//! that person, so nothing here needs to know what a deploy is made of.
+
+use std::time::Duration;
+
+use axum::{
+    body::{Body, Bytes},
+    extract::{DefaultBodyLimit, Extension, OriginalUri, Path},
+    http::{header, HeaderMap, Method, StatusCode},
+    response::Response,
+    routing::{any, get, post},
+    Json, Router,
+};
+use chrono::{DateTime, Utc};
+use lazy_static::lazy_static;
+use magic_crypt::MagicCrypt256;
+use regex::Regex;
+use serde::{Deserialize, Serialize};
+use windmill_api_auth::{is_effectively_unscoped, ApiAuthed, Tokened};
+use windmill_audit::{audit_oss::audit_log, ActionKind};
+use windmill_common::{
+    auth::hash_token,
+    error::{error_source_chain, Error, Result},
+    ssrf::validate_url_for_ssrf,
+    utils::{configure_client, rd_string, require_admin},
+    variables::{build_crypt, decrypt, encrypt},
+    worker::CLOUD_HOSTED,
+    DB,
+};
+
+lazy_static! {
+    static ref REMOTE_WORKSPACE_ID: Regex = Regex::new("^[a-zA-Z0-9_-]{1,50}$").unwrap();
+    /// Shared so that a deploy's calls reuse connections. A cloud instance instead builds a client
+    /// per request, pinned to the addresses it just validated for that target.
+    static ref REMOTE_CLIENT: reqwest::Client = remote_client_builder().build().unwrap();
+}
+
+const PROXY_PREFIX: &str = "/remote_deploy/proxy/";
+
+pub fn workspaced_service(proxy_body_limit: usize) -> Router {
+    Router::new()
+        .route("/target", get(get_target).post(set_target))
+        .route("/connect", post(connect))
+        .route("/disconnect", post(disconnect))
+        // `{key}` is the caller's `proxy_key`. The session cookie is `SameSite=Lax`, so it rides a
+        // top-level navigation from any site: without a value such a link cannot know, it could
+        // spend the stored token, to run something on the remote or to render its content on this
+        // origin. `Sec-Fetch-Site` is no substitute, since plain-http instances never receive it.
+        .route(
+            "/proxy/{key}/{*rest}",
+            any(proxy).layer(DefaultBodyLimit::max(proxy_body_limit)),
+        )
+}
+
+/// A request URI as logs should record it: with the proxy key masked, since that key is what keeps
+/// a link from spending a stored remote token.
+pub struct RedactedUri<'a>(pub &'a axum::http::Uri);
+
+impl std::fmt::Display for RedactedUri<'_> {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        let Some((head, keyed)) = self.0.path().split_once(PROXY_PREFIX) else {
+            return self.0.fmt(f);
+        };
+        let rest = keyed.find('/').map_or("", |i| &keyed[i..]);
+        write!(f, "{head}{PROXY_PREFIX}***{rest}")?;
+        match self.0.query() {
+            Some(query) => write!(f, "?{query}"),
+            None => Ok(()),
+        }
+    }
+}
+
+#[derive(Serialize, Deserialize, Clone, Debug)]
+pub struct RemoteDeployTarget {
+    /// Root URL of the remote instance, without `/api`.
+    pub base_url: String,
+    pub workspace_id: String,
+}
+
+impl RemoteDeployTarget {
+    fn normalized(self) -> Result<Self> {
+        let base_url = self.base_url.trim().trim_end_matches('/').to_string();
+        let parsed = url::Url::parse(&base_url)
+            .map_err(|e| Error::BadRequest(format!("Invalid remote instance URL: {e}")))?;
+        if !matches!(parsed.scheme(), "http" | "https") || parsed.host_str().is_none() {
+            return Err(Error::BadRequest(
+                "The remote instance URL must be an http(s) URL with a host".to_string(),
+            ));
+        }
+        if !parsed.username().is_empty()
+            || parsed.password().is_some()
+            || parsed.query().is_some()
+            || parsed.fragment().is_some()
+        {
+            return Err(Error::BadRequest(
+                "The remote instance URL must not carry credentials, a query or a fragment"
+                    .to_string(),
+            ));
+        }
+        let workspace_id = self.workspace_id.trim().to_string();
+        if !REMOTE_WORKSPACE_ID.is_match(&workspace_id) {
+            return Err(Error::BadRequest(format!(
+                "Invalid remote workspace id: {workspace_id}"
+            )));
+        }
+        Ok(Self { base_url, workspace_id })
+    }
+
+    fn api_url(&self, suffix: &str) -> String {
+        format!("{}/api/w/{}/{suffix}", self.base_url, self.workspace_id)
+    }
+}
+
+#[derive(Serialize)]
+struct RemoteDeployConnection {
+    remote_email: String,
+    /// Goes in every proxy URL, see [`workspaced_service`].
+    proxy_key: String,
+    connected_at: DateTime<Utc>,
+}
+
+#[derive(Serialize)]
+struct RemoteDeployStatus {
+    target: Option<RemoteDeployTarget>,
+    /// The caller's own connection to `target`.
+    connection: Option<RemoteDeployConnection>,
+}
+
+/// A stored token acts on another instance as its owner, with none of the restrictions of the
+/// credential that reaches it. Only the owner acting directly with full rights may use or replace
+/// it: a job token runs as whoever a `wm_deployers` member pointed `on_behalf_of` at, and a
+/// scoped or read-only token was never granted this.
+fn require_own_credentials(authed: &ApiAuthed) -> Result<()> {
+    if authed.job_id.is_some()
+        || authed.read_only
+        || !is_effectively_unscoped(authed.scopes.as_deref())
+    {
+        return Err(Error::PermissionDenied(
+            "Deploying to a remote instance requires your own session or an unscoped token, \
+             not a job, scoped or read-only token"
+                .to_string(),
+        ));
+    }
+    Ok(())
+}
+
+fn parse_target(target: Option<serde_json::Value>) -> Result<Option<RemoteDeployTarget>> {
+    target
+        .map(serde_json::from_value)
+        .transpose()
+        .map_err(|e| Error::internal_err(format!("reading the remote deploy target: {e}")))
+}
+
+fn no_target(w_id: &str) -> Error {
+    Error::BadRequest(format!(
+        "Workspace {w_id} has no remote deploy target. An admin sets it in the workspace \
+         settings, under Dev workspace"
+    ))
+}
+
+async fn load_target(db: &DB, w_id: &str) -> Result<Option<RemoteDeployTarget>> {
+    let target = sqlx::query_scalar!(
+        "SELECT remote_deploy_target FROM workspace_settings WHERE workspace_id = $1",
+        w_id
+    )
+    .fetch_optional(db)
+    .await?
+    .flatten();
+    parse_target(target)
+}
+
+async fn require_target(db: &DB, w_id: &str) -> Result<RemoteDeployTarget> {
+    load_target(db, w_id).await?.ok_or_else(|| no_target(w_id))
+}
+
+fn remote_client_builder() -> reqwest::ClientBuilder {
+    configure_client(reqwest::ClientBuilder::new())
+        .user_agent("windmill/remote-deploy")
+        .redirect(reqwest::redirect::Policy::none())
+        .connect_timeout(Duration::from_secs(10))
+        .timeout(Duration::from_secs(120))
+}
+
+async fn remote_client(target: &RemoteDeployTarget) -> Result<reqwest::Client> {
+    // A workspace admin chose the URL. A self-hosted instance may deploy into its own private
+    // network, as it may reach a private git remote; a cloud workspace must not.
+    if !*CLOUD_HOSTED {
+        return Ok(REMOTE_CLIENT.clone());
+    }
+    validate_url_for_ssrf(&target.base_url)
+        .await?
+        .apply_dns_pinning(remote_client_builder())
+        .build()
+        .map_err(|e| Error::internal_err(format!("building the remote deploy client: {e}")))
+}
+
+fn unreachable(target: &RemoteDeployTarget, e: reqwest::Error) -> Error {
+    Error::BadGateway(format!(
+        "Could not reach the remote instance {}: {}",
+        target.base_url,
+        error_source_chain(&e)
+    ))
+}
+
+/// Responses carrying a `proxy_key` must not be kept by any cache between here and the browser.
+const NO_STORE: [(header::HeaderName, &str); 1] = [(header::CACHE_CONTROL, "no-store")];
+
+struct StoredConnection {
+    token: String,
+    remote_email: String,
+    proxy_key: String,
+    connected_at: DateTime<Utc>,
+}
+
+/// The caller's connection to `target`, if they may still use it.
+///
+/// `connect` takes no lock against what clears these rows (a removal from the workspace, a target
+/// change, a key rotation): writers take those rows in every order, so any lock it held could close
+/// a deadlock. A row can therefore land after one of them ran, however long its remote call took,
+/// and is voided here instead, by identity rather than by comparing times: it counts only while
+/// the target setting and the owner's membership are the very ones it was connected under (see
+/// `member_since`, `target_changed_at`) or the owner is a superadmin, and while it decrypts. An
+/// emptied row is a disconnect's.
+async fn load_connection(
+    db: &DB,
+    w_id: &str,
+    email: &str,
+    target: &RemoteDeployTarget,
+) -> Result<Option<StoredConnection>> {
+    let Some(row) = sqlx::query_as!(
+        StoredConnection,
+        "SELECT t.token, t.remote_email, t.proxy_key, t.connected_at FROM remote_deploy_token t
+         JOIN workspace_settings s ON s.workspace_id = t.workspace_id
+         WHERE t.workspace_id = $1 AND t.email = $2 AND t.base_url = $3
+           AND t.remote_workspace_id = $4 AND t.token <> ''
+           AND s.remote_deploy_target_changed_at IS NOT DISTINCT FROM t.target_changed_at
+           AND (EXISTS (SELECT 1 FROM usr u WHERE u.workspace_id = t.workspace_id
+                          AND u.email = t.email AND u.created_at = t.member_since)
+                OR EXISTS (SELECT 1 FROM password p WHERE p.email = t.email AND p.super_admin))",
+        w_id,
+        email,
+        &target.base_url,
+        &target.workspace_id
+    )
+    .fetch_optional(db)
+    .await?
+    else {
+        return Ok(None);
+    };
+    match decrypt(&build_crypt(db, w_id).await?, row.token) {
+        Ok(token) => Ok(Some(StoredConnection { token, ..row })),
+        Err(e) => {
+            tracing::warn!("remote deploy token of {email} in {w_id} does not decrypt: {e}");
+            Ok(None)
+        }
+    }
+}
+
+async fn get_target(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+    Path(w_id): Path<String>,
+) -> Result<(
+    [(header::HeaderName, &'static str); 1],
+    Json<RemoteDeployStatus>,
+)> {
+    let target = load_target(&db, &w_id).await?;
+    // The connection carries the proxy key. A credential that may not use the proxy (see
+    // `require_own_credentials`) must not read it either: it could hand its owner a working link.
+    let connection = match &target {
+        Some(target) if require_own_credentials(&authed).is_ok() => {
+            load_connection(&db, &w_id, &authed.email, target)
+                .await?
+                .map(|c| RemoteDeployConnection {
+                    remote_email: c.remote_email,
+                    proxy_key: c.proxy_key,
+                    connected_at: c.connected_at,
+                })
+        }
+        _ => None,
+    };
+    Ok((NO_STORE, Json(RemoteDeployStatus { target, connection })))
+}
+
+#[derive(Deserialize)]
+struct SetRemoteDeployTarget {
+    target: Option<RemoteDeployTarget>,
+}
+
+async fn set_target(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+    Path(w_id): Path<String>,
+    Json(request): Json<SetRemoteDeployTarget>,
+) -> Result<String> {
+    if !cfg!(feature = "enterprise") {
+        return Err(Error::BadRequest(
+            "Deploying to another instance is only available on Windmill Enterprise Edition"
+                .to_string(),
+        ));
+    }
+    // Everyone who connects afterwards hands their token to this URL.
+    require_own_credentials(&authed)?;
+    require_admin(authed.is_admin, &authed.username)?;
+    let target = request
+        .target
+        .map(RemoteDeployTarget::normalized)
+        .transpose()?;
+
+    let mut tx = db.begin().await?;
+    let (base_url, remote_workspace_id) = match &target {
+        Some(t) => (Some(t.base_url.as_str()), Some(t.workspace_id.as_str())),
+        None => (None, None),
+    };
+    audit_log(
+        &mut *tx,
+        &authed,
+        "workspaces.edit_remote_deploy_target",
+        ActionKind::Update,
+        &w_id,
+        None,
+        Some(
+            [
+                ("base_url", base_url.unwrap_or("")),
+                ("remote_workspace_id", remote_workspace_id.unwrap_or("")),
+            ]
+            .into(),
+        ),
+    )
+    .await?;
+    let target_json = target
+        .as_ref()
+        .map(serde_json::to_value)
+        .transpose()
+        .map_err(|e| Error::internal_err(e.to_string()))?;
+    sqlx::query!(
+        "UPDATE workspace_settings SET remote_deploy_target = $1::jsonb,
+             remote_deploy_target_changed_at = CASE
+                 WHEN remote_deploy_target IS DISTINCT FROM $1::jsonb THEN clock_timestamp()
+                 ELSE remote_deploy_target_changed_at END
+         WHERE workspace_id = $2",
+        target_json,
+        &w_id
+    )
+    .execute(&mut *tx)
+    .await?;
+    // A token is only ever sent to the target it was granted for, so the ones for any other
+    // target are dead credentials.
+    sqlx::query!(
+        "DELETE FROM remote_deploy_token WHERE workspace_id = $1
+           AND ($2::text IS NULL OR base_url <> $2 OR remote_workspace_id <> $3)",
+        &w_id,
+        base_url,
+        remote_workspace_id
+    )
+    .execute(&mut *tx)
+    .await?;
+    tx.commit().await?;
+
+    Ok(match target {
+        Some(t) => format!(
+            "Workspace {w_id} deploys to {} on {}",
+            t.workspace_id, t.base_url
+        ),
+        None => format!("Removed the remote deploy target of workspace {w_id}"),
+    })
+}
+
+#[derive(Deserialize)]
+struct ConnectRequest {
+    token: String,
+    /// The target the caller got the token for, as the drawer showed it.
+    target: RemoteDeployTarget,
+}
+
+#[derive(Deserialize)]
+struct RemoteWhoami {
+    email: String,
+}
+
+async fn connect(
+    authed: ApiAuthed,
+    Tokened { token: credential }: Tokened,
+    Extension(db): Extension<DB>,
+    Path(w_id): Path<String>,
+    Json(request): Json<ConnectRequest>,
+) -> Result<(
+    [(header::HeaderName, &'static str); 1],
+    Json<RemoteDeployConnection>,
+)> {
+    require_own_credentials(&authed)?;
+    // Read before the remote call, which can take long enough for any of it to change: the row is
+    // bound to the target version and the membership seen here (see `load_connection`), and
+    // stamped with when this connect started, so that a disconnect or a newer connect made while
+    // it runs keeps it from landing.
+    let start = sqlx::query!(
+        r#"SELECT clock_timestamp() AS "started_at!", s.remote_deploy_target,
+                  s.remote_deploy_target_changed_at,
+                  (SELECT u.created_at FROM usr u
+                   WHERE u.workspace_id = s.workspace_id AND u.email = $2) AS member_since
+           FROM workspace_settings s WHERE s.workspace_id = $1"#,
+        &w_id,
+        &authed.email
+    )
+    .fetch_optional(&db)
+    .await?
+    .ok_or_else(|| no_target(&w_id))?;
+    let target = parse_target(start.remote_deploy_target)?.ok_or_else(|| no_target(&w_id))?;
+    // A token is only ever sent to the instance it was meant for. Without this, re-pointing the
+    // target between the user getting a token and posting it here would hand it to the new one;
+    // after this check the token still goes to `target` only, never to what the setting became.
+    let requested = request.target.normalized()?;
+    if requested.base_url != target.base_url || requested.workspace_id != target.workspace_id {
+        return Err(Error::BadRequest(
+            "The remote deploy target changed since you started connecting; reload and connect \
+             again"
+                .to_string(),
+        ));
+    }
+    let token = request.token.trim();
+    if token.is_empty() {
+        return Err(Error::BadRequest("The token is empty".to_string()));
+    }
+
+    let response = remote_client(&target)
+        .await?
+        .get(target.api_url("users/whoami"))
+        .bearer_auth(token)
+        .send()
+        .await
+        .map_err(|e| unreachable(&target, e))?;
+    let status = response.status();
+    if !status.is_success() {
+        let body = response.text().await.unwrap_or_default();
+        return Err(Error::BadRequest(format!(
+            "{} did not accept this token for workspace {} ({status}): {body}",
+            target.base_url, target.workspace_id
+        )));
+    }
+    let whoami: RemoteWhoami = response.json().await.map_err(|e| {
+        Error::BadGateway(format!(
+            "{} did not answer like a Windmill instance: {}",
+            target.base_url,
+            error_source_chain(&e)
+        ))
+    })?;
+
+    let proxy_key = rd_string(32);
+    let mc = build_crypt(&db, &w_id).await?;
+    // No lock against removals, target changes or key rotations: `load_connection` voids a row
+    // that lands after one of them. A disconnect or a newer connect stamps the row itself, which
+    // this one then leaves alone. Without a membership to bind to, the row is bound to the account
+    // through the credential making this request, which deleting the account removes (except
+    // through `leave_instance`, which leaves its tokens): the address could otherwise be deleted
+    // and taken by a new account while the remote call runs, and the foreign key would accept it.
+    let mut tx = db.begin().await?;
+    let connected_at = sqlx::query_scalar!(
+        "INSERT INTO remote_deploy_token
+             (workspace_id, email, base_url, remote_workspace_id, token, remote_email, proxy_key,
+              connected_at, member_since, target_changed_at)
+         SELECT $1, $2, $3, $4, $5, $6, $7, $8, $9, $10
+         WHERE $9::timestamptz IS NOT NULL
+            OR EXISTS (SELECT 1 FROM token WHERE token_hash = $11)
+         ON CONFLICT (workspace_id, email) DO UPDATE SET
+             base_url = EXCLUDED.base_url, remote_workspace_id = EXCLUDED.remote_workspace_id,
+             token = EXCLUDED.token, remote_email = EXCLUDED.remote_email,
+             proxy_key = EXCLUDED.proxy_key, connected_at = EXCLUDED.connected_at,
+             member_since = EXCLUDED.member_since, target_changed_at = EXCLUDED.target_changed_at
+         WHERE remote_deploy_token.connected_at < EXCLUDED.connected_at
+         RETURNING connected_at",
+        &w_id,
+        &authed.email,
+        &target.base_url,
+        &target.workspace_id,
+        encrypt(&mc, token),
+        &whoami.email,
+        &proxy_key,
+        start.started_at,
+        start.member_since,
+        start.remote_deploy_target_changed_at,
+        hash_token(&credential)
+    )
+    .fetch_optional(&mut *tx)
+    .await?
+    .ok_or_else(|| {
+        Error::BadRequest(match start.member_since {
+            Some(_) => "This connect was not saved: you disconnected or connected again while it \
+                        was running"
+                .to_string(),
+            None => format!(
+                "This connect was not saved: you disconnected, connected again or signed out \
+                 while it was running. Connecting workspace {w_id} without being one of its \
+                 members needs a session or an API token of this instance"
+            ),
+        })
+    })?;
+    audit_log(
+        &mut *tx,
+        &authed,
+        "workspaces.remote_deploy_connect",
+        ActionKind::Create,
+        &w_id,
+        Some(&whoami.email),
+        Some([("base_url", target.base_url.as_str())].into()),
+    )
+    .await?;
+    tx.commit().await?;
+
+    Ok((
+        NO_STORE,
+        Json(RemoteDeployConnection { remote_email: whoami.email, proxy_key, connected_at }),
+    ))
+}
+
+async fn disconnect(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+    Path(w_id): Path<String>,
+) -> Result<String> {
+    require_own_credentials(&authed)?;
+    let mut tx = db.begin().await?;
+    // Emptied rather than deleted, and stamped, even with no connection yet: a connect that started
+    // before this must not bring one back when it lands (see `connect`).
+    sqlx::query!(
+        "INSERT INTO remote_deploy_token
+             (workspace_id, email, base_url, remote_workspace_id, token, remote_email, proxy_key,
+              connected_at)
+         VALUES ($1, $2, '', '', '', '', '', clock_timestamp())
+         ON CONFLICT (workspace_id, email) DO UPDATE SET
+             token = '', proxy_key = '', connected_at = clock_timestamp()",
+        &w_id,
+        &authed.email
+    )
+    .execute(&mut *tx)
+    .await?;
+    audit_log(
+        &mut *tx,
+        &authed,
+        "workspaces.remote_deploy_disconnect",
+        ActionKind::Delete,
+        &w_id,
+        None,
+        None,
+    )
+    .await?;
+    tx.commit().await?;
+    Ok(format!(
+        "Disconnected from the remote deploy target of {w_id}"
+    ))
+}
+
+/// The remote URL for the request path after the proxy prefix and key, as the client sent it.
+///
+/// `url` rewrites a path while parsing it: it resolves dot segments (`%2e` spellings included)
+/// and turns backslashes into slashes. Either would reach a route other than the one this
+/// instance authorized — outside the remote workspace, or a route its read-only check does not
+/// recognize — so a path the parser would change is refused rather than forwarded.
+fn forwarded_url(
+    target: &RemoteDeployTarget,
+    original_path: &str,
+    query: Option<&str>,
+) -> Result<url::Url> {
+    let suffix = original_path
+        .split_once(PROXY_PREFIX)
+        .and_then(|(_, keyed)| keyed.split_once('/'))
+        .map(|(_, suffix)| suffix)
+        .unwrap_or_default();
+    let invalid = || Error::BadRequest(format!("Invalid remote deploy path: {suffix}"));
+    let base_path = url::Url::parse(&target.base_url)
+        .map_err(|_| invalid())?
+        .path()
+        .trim_end_matches('/')
+        .to_string();
+    let mut url = url::Url::parse(&target.api_url(suffix)).map_err(|_| invalid())?;
+    let expected_path = format!("{base_path}/api/w/{}/{suffix}", target.workspace_id);
+    if suffix.is_empty() || url.path() != expected_path {
+        return Err(invalid());
+    }
+    url.set_query(query);
+    Ok(url)
+}
+
+async fn proxy(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+    Path((w_id, key, _rest)): Path<(String, String, String)>,
+    OriginalUri(uri): OriginalUri,
+    method: Method,
+    headers: HeaderMap,
+    body: Bytes,
+) -> Result<Response> {
+    require_own_credentials(&authed)?;
+    let target = require_target(&db, &w_id).await?;
+    let url = forwarded_url(&target, uri.path(), uri.query())?;
+    let stored = load_connection(&db, &w_id, &authed.email, &target)
+        .await?
+        .ok_or_else(|| {
+            Error::BadRequest(format!(
+                "Connect to {} with your own token before deploying there",
+                target.base_url
+            ))
+        })?;
+    if !constant_time_eq::constant_time_eq(key.as_bytes(), stored.proxy_key.as_bytes()) {
+        return Err(Error::BadRequest(
+            "This remote deploy link is not yours or is out of date; reload the page".to_string(),
+        ));
+    }
+
+    // Only what describes the payload: the caller's cookie and token belong to this instance.
+    let mut request = remote_client(&target)
+        .await?
+        .request(method, url)
+        .bearer_auth(stored.token)
+        .body(body);
+    for name in [header::CONTENT_TYPE, header::ACCEPT] {
+        if let Some(value) = headers.get(&name) {
+            request = request.header(name, value.clone());
+        }
+    }
+    let response = request.send().await.map_err(|e| unreachable(&target, e))?;
+
+    let status = response.status();
+    // Passed through, a 401 would read as this instance's session having expired and log the
+    // user out of it.
+    if status == StatusCode::UNAUTHORIZED {
+        let body = response.text().await.unwrap_or_default();
+        return Err(Error::BadGateway(format!(
+            "{} rejected your stored token: {body}",
+            target.base_url
+        )));
+    }
+    if status.is_redirection() {
+        let location = response
+            .headers()
+            .get(header::LOCATION)
+            .and_then(|l| l.to_str().ok())
+            .unwrap_or_default()
+            .to_string();
+        return Err(Error::BadGateway(format!(
+            "{} redirected to {location}. Set the remote deploy target to the URL it redirects to",
+            target.base_url
+        )));
+    }
+    // The body is the remote's and may be anything its users stored (an uploaded file, a job
+    // result typed `text/html`); served from this origin it must never render as a page here.
+    let mut builder = Response::builder()
+        .status(status)
+        .header(header::X_CONTENT_TYPE_OPTIONS, "nosniff")
+        .header(
+            header::CONTENT_SECURITY_POLICY,
+            "sandbox; default-src 'none'",
+        );
+    if let Some(content_type) = response.headers().get(header::CONTENT_TYPE) {
+        builder = builder.header(header::CONTENT_TYPE, content_type);
+    }
+    builder
+        .body(Body::from_stream(response.bytes_stream()))
+        .map_err(|e| Error::internal_err(format!("building the proxied response: {e}")))
+}
+
+/// Move the stored remote tokens to a new workspace key. A token that no longer decrypts is
+/// dropped: its owner connects again. A disconnect's emptied row is kept, as the stamp that keeps
+/// an older connect from landing.
+pub(crate) async fn reencrypt_tokens(
+    conn: &mut sqlx::PgConnection,
+    w_id: &str,
+    old: &MagicCrypt256,
+    new: &MagicCrypt256,
+) -> Result<()> {
+    let rows = sqlx::query!(
+        "SELECT email, token FROM remote_deploy_token
+         WHERE workspace_id = $1 AND token <> '' FOR UPDATE",
+        w_id
+    )
+    .fetch_all(&mut *conn)
+    .await?;
+    for row in rows {
+        match decrypt(old, row.token) {
+            Ok(plain) => {
+                sqlx::query!(
+                    "UPDATE remote_deploy_token SET token = $1
+                     WHERE workspace_id = $2 AND email = $3",
+                    encrypt(new, &plain),
+                    w_id,
+                    row.email
+                )
+                .execute(&mut *conn)
+                .await?;
+            }
+            Err(_) => {
+                sqlx::query!(
+                    "DELETE FROM remote_deploy_token WHERE workspace_id = $1 AND email = $2",
+                    w_id,
+                    row.email
+                )
+                .execute(&mut *conn)
+                .await?;
+            }
+        }
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn forwarded_url_refuses_paths_the_parser_rewrites() {
+        let target = RemoteDeployTarget {
+            base_url: "https://prod.example.com/windmill".to_string(),
+            workspace_id: "prod".to_string(),
+        };
+        let prefix = "/api/w/dev/remote_deploy/proxy/someKey";
+        let url = forwarded_url(
+            &target,
+            &format!("{prefix}/scripts/get/p/f/team/my%20script"),
+            Some("with_starred_info=true"),
+        )
+        .unwrap();
+        assert_eq!(
+            url.as_str(),
+            "https://prod.example.com/windmill/api/w/prod/scripts/get/p/f/team/my%20script?with_starred_info=true"
+        );
+        for path in [
+            format!("{prefix}/../../users/list"),
+            format!("{prefix}/%2e%2e/%2e%2e/users/list"),
+            format!("{prefix}/jobs\\run_wait_result\\p/f/team/action"),
+            prefix.to_string(),
+        ] {
+            assert!(
+                forwarded_url(&target, &path, None).is_err(),
+                "{path} should be refused"
+            );
+        }
+    }
+
+    #[test]
+    fn redacted_uri_masks_the_proxy_key() {
+        let proxied: axum::http::Uri = "/api/w/dev/remote_deploy/proxy/secretKey/flows/get/f/a?x=1"
+            .parse()
+            .unwrap();
+        assert_eq!(
+            RedactedUri(&proxied).to_string(),
+            "/api/w/dev/remote_deploy/proxy/***/flows/get/f/a?x=1"
+        );
+        let other: axum::http::Uri = "/api/w/dev/flows/list?x=1".parse().unwrap();
+        assert_eq!(RedactedUri(&other).to_string(), "/api/w/dev/flows/list?x=1");
+    }
+
+    #[test]
+    fn target_normalization() {
+        let target = RemoteDeployTarget {
+            base_url: "  https://prod.example.com/  ".to_string(),
+            workspace_id: " prod ".to_string(),
+        }
+        .normalized()
+        .unwrap();
+        assert_eq!(target.base_url, "https://prod.example.com");
+        assert_eq!(
+            target.api_url("flows/create"),
+            "https://prod.example.com/api/w/prod/flows/create"
+        );
+
+        for (base_url, workspace_id) in [
+            ("ftp://prod.example.com", "prod"),
+            ("https://user:pass@prod.example.com", "prod"),
+            ("https://prod.example.com?token=x", "prod"),
+            ("https://prod.example.com", "prod/../admins"),
+        ] {
+            assert!(
+                RemoteDeployTarget {
+                    base_url: base_url.to_string(),
+                    workspace_id: workspace_id.to_string(),
+                }
+                .normalized()
+                .is_err(),
+                "{base_url} {workspace_id} should be refused"
+            );
+        }
+    }
+}
diff --git a/backend/windmill-api-workspaces/src/workspaces.rs b/backend/windmill-api-workspaces/src/workspaces.rs
index 2bef0d28ab..8ebd4eeb26 100644
--- a/backend/windmill-api-workspaces/src/workspaces.rs
+++ b/backend/windmill-api-workspaces/src/workspaces.rs
@@ -12,6 +12,7 @@ use windmill_api_auth::{
 };
 use windmill_api_users::users::WorkspaceInvite;
 use windmill_common::email_oss::send_email_if_possible;
+use windmill_common::ssrf::{validate_webhook_url, webhook_ssrf_error_message};
 use windmill_common::usernames::{get_instance_username_or_create_pending, VALID_USERNAME};
 use windmill_common::webhook::WebhookShared;
 use windmill_common::{BASE_URL, DB};
@@ -38,17 +39,19 @@ use windmill_common::global_settings::HTTP_ROUTE_WORKSPACED_ROUTE;
 use windmill_common::query_builders::{render_db_quoted_identifier, DbType};
 use windmill_common::users::username_to_permissioned_as;
 use windmill_common::variables::{
-    build_crypt, decrypt, encrypt, SECRET_SALT, WORKSPACE_CRYPT_CACHE,
+    crypt_from_key_with_suffix, decrypt, encrypt, WORKSPACE_CRYPT_CACHE,
 };
 use windmill_common::worker::{to_raw_value, CLOUD_HOSTED};
 use windmill_common::workspaces::GitRepositorySettings;
 #[cfg(feature = "enterprise")]
 use windmill_common::workspaces::WorkspaceDeploymentUISettings;
 use windmill_common::workspaces::{
-    check_deploy_rules, check_user_against_rule, get_datatable_resource_from_db_unchecked,
+    check_deploy_rules, check_user_against_rule, get_datatable_resource_from_db,
+    get_datatable_resource_from_db_unchecked, parse_datatable_ref_for, resolve_governing_datatable,
     validate_dev_workspace_id, validate_fork_workspace_id, validate_workspace_name, DataTable,
-    DataTableCatalogResourceType, DataTableForkBehavior, ProtectionRuleKind, ProtectionRules,
-    ProtectionRuleset, RuleCheckResult, WorkspaceGitSyncSettings, DEV_WORKSPACE_LOCK_RULE_NAME,
+    DataTableCatalogResourceType, DataTableForkBehavior, DatatableAccess, GoverningDatatable,
+    ProtectionRuleKind, ProtectionRules, ProtectionRuleset, RuleCheckResult,
+    WorkspaceGitSyncSettings, DEV_WORKSPACE_LOCK_RULE_NAME,
 };
 use windmill_common::workspaces::{Ducklake, DucklakeCatalogResourceType};
 use windmill_common::PgDatabase;
@@ -141,6 +144,8 @@ pub fn workspaced_service() -> Router {
             get(test_datatable_connection),
         )
         .merge(crate::datatable_migrations::routes())
+        .merge(crate::datatable_permissions::routes())
+        .merge(crate::datatable_acl::routes())
         .route("/git_sync_enabled", get(get_git_sync_enabled))
         .route("/git_sync_deploy_mode", get(get_git_sync_deploy_mode))
         .route("/edit_git_sync_config", post(edit_git_sync_config))
@@ -152,6 +157,10 @@ pub fn workspaced_service() -> Router {
         .route("/edit_deploy_ui_config", post(edit_deploy_ui_config))
         .route("/edit_default_app", post(edit_default_app))
         .route("/edit_guest_access", post(edit_guest_access))
+        .route(
+            "/edit_add_admins_and_developers_to_forks",
+            post(edit_add_admins_and_developers_to_forks),
+        )
         .route("/edit_guest_jwt_key", post(edit_guest_jwt_key))
         .route("/guest_usage", get(get_guest_usage))
         .route("/default_app", get(get_default_app))
@@ -335,6 +344,7 @@ pub struct WorkspaceSettings {
     pub guest_jwt_public_key: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub guest_jwt_jwks_url: Option<String>,
+    pub add_admins_and_developers_to_forks: bool,
 }
 
 /// Subset of `WorkspaceSettings` that is safe to return to any workspace
@@ -360,6 +370,8 @@ pub struct WorkspacePublicSettings {
     /// Not sensitive, and the app editor needs it to say whether the guest rung is
     /// live -- an app can be set to `guest` while the workspace has guests off.
     pub guest_access_enabled: bool,
+    /// Read by the fork dialog, which tells the forker who else the fork will include.
+    pub add_admins_and_developers_to_forks: bool,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub deploy_ui: Option<serde_json::Value>,
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -490,8 +502,8 @@ struct CreateWorkspaceFork {
     id: String,
     name: String,
     color: Option<String>,
-    /// Datatable names that were forked. For each, the backend will update the
-    /// forked workspace's datatable config to point to the new database.
+    /// Data tables the fork gets a copy of rather than a pointer at the parent's. For each, the
+    /// fork's entry is pointed at the new database.
     #[serde(default)]
     forked_datatables: Vec<ForkedDatatableInfo>,
     /// Lakes the user explicitly chose to SHARE with the parent (the fork then reads and
@@ -523,6 +535,11 @@ struct CreateWorkspaceFork {
 struct ForkedDatatableInfo {
     name: String,
     new_dbname: String,
+    /// What this request copies into `new_dbname`, which it creates. Optional only so that the
+    /// entry older CLIs send — naming a database they created and filled themselves — is refused
+    /// with a message rather than a parse error.
+    #[serde(default)]
+    fork_behavior: Option<DataTableForkBehavior>,
 }
 
 #[derive(Deserialize)]
@@ -552,6 +569,7 @@ struct UserWorkspace {
     /// screen off this.
     pub created_by: Option<String>,
     pub disabled: bool,
+    pub is_service_account: bool,
 }
 
 #[derive(Deserialize)]
@@ -1122,7 +1140,8 @@ async fn get_settings(
             error_handler_fallback_to_instance_alerts,
             guest_access_enabled,
             guest_jwt_public_key,
-            guest_jwt_jwks_url
+            guest_jwt_jwks_url,
+            add_admins_and_developers_to_forks
         FROM
             workspace_settings
         WHERE
@@ -1140,6 +1159,8 @@ async fn get_settings(
     if let Some(git_sync) = settings.git_sync.as_mut() {
         redact_git_sync_webhook_secrets(git_sync);
     }
+    settings.datatable =
+        windmill_common::workspaces::strip_datatable_permissions(settings.datatable.take());
 
     Ok(Json(settings))
 }
@@ -1162,6 +1183,7 @@ async fn get_public_settings(
             teams_team_guid,
             mute_critical_alerts,
             guest_access_enabled,
+            add_admins_and_developers_to_forks,
             deploy_ui,
             large_file_storage,
             datatable
@@ -1176,8 +1198,10 @@ async fn get_public_settings(
     .await
     .map_err(|e| Error::internal_err(format!("getting public settings: {e:#}")))?;
 
-    let settings = not_found_if_none(settings, "workspace settings", &w_id)?;
+    let mut settings = not_found_if_none(settings, "workspace settings", &w_id)?;
     tx.commit().await?;
+    settings.datatable =
+        windmill_common::workspaces::strip_datatable_permissions(settings.datatable.take());
 
     Ok(Json(settings))
 }
@@ -1900,6 +1924,16 @@ async fn edit_webhook(
         ));
     }
 
+    // An empty URL is stored as-is and means "no webhook" to the sender.
+    if let Some(webhook) = ew.webhook.as_deref().filter(|w| !w.is_empty()) {
+        validate_webhook_url(webhook).await.map_err(|e| {
+            Error::BadRequest(format!(
+                "Webhook URL is not allowed: {}",
+                webhook_ssrf_error_message(&e)
+            ))
+        })?;
+    }
+
     let mut tx = db.begin().await?;
 
     if let Some(webhook) = &ew.webhook {
@@ -2184,6 +2218,12 @@ struct DataTableListItem {
     name: String,
     resource_type: String,
     resource_path: String,
+    /// The workspace whose entry governs this one, when it is not this workspace — a fork pointing
+    /// at its parent. Its permissions apply here, and only its admins may edit them.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    governing_workspace_id: Option<String>,
+    /// Whether the governing entry is under roles.
+    permissioned: bool,
 }
 
 async fn list_datatables(
@@ -2191,26 +2231,29 @@ async fn list_datatables(
     Extension(db): Extension<DB>,
     Path(w_id): Path<String>,
 ) -> JsonResult<Vec<DataTableListItem>> {
-    let config = sqlx::query_scalar!(
-        "SELECT datatable->'datatables' FROM workspace_settings WHERE workspace_id = $1",
-        &w_id
-    )
-    .fetch_one(&db)
-    .await?;
+    // A pointer entry owns no database, so what it resolves to is the only truthful answer here.
+    // One that resolves to nothing — a pointer whose workspace was deleted — is dropped rather than
+    // listed with a database it does not have; what happened is named where it is actionable
+    // instead: by the delete that stranded it, and by any attempt to use it.
+    let resolved =
+        windmill_common::workspaces::resolve_workspace_governing_datatables(&db, &w_id).await?;
 
-    let items: Vec<DataTableListItem> = match config {
-        Some(val) => {
-            let map: HashMap<String, DataTable> = serde_json::from_value(val).unwrap_or_default();
-            map.into_iter()
-                .map(|(name, dt)| DataTableListItem {
-                    name,
-                    resource_type: dt.database.resource_type.as_ref().to_string(),
-                    resource_path: dt.database.resource_path,
-                })
-                .collect()
-        }
-        None => vec![],
-    };
+    let mut items = Vec::with_capacity(resolved.len());
+    for (name, governing) in resolved {
+        let database = governing
+            .datatable
+            .database
+            .as_ref()
+            .expect("a governing entry owns a database");
+        items.push(DataTableListItem {
+            name,
+            resource_type: database.resource_type.as_ref().to_string(),
+            resource_path: database.resource_path.clone(),
+            governing_workspace_id: (governing.governing_workspace_id() != w_id)
+                .then(|| governing.governing_workspace_id().to_string()),
+            permissioned: governing.datatable.permissions.is_some(),
+        });
+    }
 
     Ok(Json(items))
 }
@@ -2246,6 +2289,25 @@ struct DataTableTables {
     schemas: TableListMap,
     #[serde(skip_serializing_if = "Option::is_none")]
     error: Option<String>,
+    /// On the instance database: the only kind that can be under roles or have its access edited.
+    instance: bool,
+    permissioned: bool,
+    /// The roles this caller may connect as, by name; empty when not under roles.
+    usable_roles: Vec<String>,
+    default_role: String,
+    /// What the role the listing connected as may create.
+    can_create_schema: bool,
+    creatable_schemas: Vec<String>,
+}
+
+#[derive(Deserialize)]
+struct ListDataTableTablesQuery {
+    /// List only this data table: each entry opens a connection to its database.
+    datatable_name: Option<String>,
+    /// The data table `role` applies to. Every other one is listed as its default role, since a
+    /// role name means nothing outside the data table it belongs to.
+    role_for: Option<String>,
+    role: Option<String>,
 }
 
 #[derive(Deserialize)]
@@ -2253,6 +2315,7 @@ struct GetDataTableSchemaQuery {
     datatable_name: String,
     schema_name: String,
     table_name: String,
+    role: Option<String>,
 }
 
 #[derive(Serialize, Debug)]
@@ -2298,6 +2361,15 @@ async fn test_datatable_connection(
     Path((w_id, datatable_name)): Path<(String, String)>,
 ) -> JsonResult<DataTableConnectionCheck> {
     require_admin(authed.is_admin, &authed.username)?;
+    // Reports what the admin connection can do, so it answers to the workspace that governs the
+    // data table rather than to whichever one is asking.
+    windmill_common::workspaces::ensure_datatable_admin_access(
+        &db,
+        &w_id,
+        &datatable_name,
+        &DatatableAccess::Authed(authed.to_authed_ref()),
+    )
+    .await?;
 
     let db_resource = get_datatable_resource_from_db_unchecked(&db, &w_id, &datatable_name).await?;
     let pg_db: PgDatabase = serde_json::from_value(db_resource)
@@ -2385,7 +2457,7 @@ async fn test_datatable_connection(
 }
 
 async fn list_datatable_schemas(
-    _authed: ApiAuthed,
+    authed: ApiAuthed,
     Extension(db): Extension<DB>,
     Path(w_id): Path<String>,
 ) -> JsonResult<Vec<DataTableSchema>> {
@@ -2393,7 +2465,7 @@ async fn list_datatable_schemas(
     let mut results = Vec::new();
 
     for datatable_name in datatable_names {
-        let schema = match get_datatable_schema(&db, &w_id, &datatable_name).await {
+        let schema = match get_datatable_schema(&db, &authed, &w_id, &datatable_name).await {
             Ok(schemas) => DataTableSchema { datatable_name, schemas, error: None },
             Err(e) => DataTableSchema {
                 datatable_name,
@@ -2408,40 +2480,106 @@ async fn list_datatable_schemas(
 }
 
 async fn list_datatable_tables(
-    _authed: ApiAuthed,
+    authed: ApiAuthed,
     Extension(db): Extension<DB>,
     Path(w_id): Path<String>,
+    Query(query): Query<ListDataTableTablesQuery>,
 ) -> JsonResult<Vec<DataTableTables>> {
-    let datatable_names = list_datatable_names(&db, &w_id).await?;
+    if query.role.is_some() && query.role_for.is_none() {
+        return Err(Error::BadRequest(
+            "`role` needs `role_for`, the data table it is a role of".to_string(),
+        ));
+    }
+    if let (Some(only), Some(role_for)) =
+        (query.datatable_name.as_deref(), query.role_for.as_deref())
+    {
+        if only != role_for {
+            return Err(Error::BadRequest(format!(
+                "`role_for` names '{role_for}', which `datatable_name` leaves out of the listing"
+            )));
+        }
+    }
+    let mut datatable_names = list_datatable_names(&db, &w_id).await?;
+    for named in [query.role_for.as_deref(), query.datatable_name.as_deref()]
+        .into_iter()
+        .flatten()
+    {
+        if !datatable_names.iter().any(|n| n == named) {
+            return Err(Error::NotFound(format!(
+                "No data table named '{named}' in this workspace"
+            )));
+        }
+    }
+    if let Some(only) = query.datatable_name.as_deref() {
+        datatable_names.retain(|n| n == only);
+    }
     let mut results = Vec::new();
 
     for datatable_name in datatable_names {
-        let tables = match get_datatable_tables(&db, &w_id, &datatable_name).await {
-            Ok(schemas) => DataTableTables { datatable_name, schemas, error: None },
-            Err(e) => DataTableTables {
-                datatable_name,
-                schemas: HashMap::new(),
-                error: Some(e.to_string()),
-            },
-        };
-        results.push(tables);
+        let role = query
+            .role
+            .as_deref()
+            .filter(|_| query.role_for.as_deref() == Some(datatable_name.as_str()));
+        results.push(list_one_datatable_tables(&db, &authed, &w_id, datatable_name, role).await);
     }
 
     Ok(Json(results))
 }
 
+async fn list_one_datatable_tables(
+    db: &DB,
+    authed: &ApiAuthed,
+    w_id: &str,
+    datatable_name: String,
+    role: Option<&str>,
+) -> DataTableTables {
+    let mut entry = DataTableTables {
+        datatable_name,
+        schemas: HashMap::new(),
+        error: None,
+        instance: false,
+        permissioned: false,
+        usable_roles: vec![],
+        default_role: windmill_common::datatable_roles::ADMIN_DATATABLE_ROLE.to_string(),
+        can_create_schema: false,
+        creatable_schemas: vec![],
+    };
+    let result: Result<()> = async {
+        let governing = resolve_governing_datatable(db, w_id, &entry.datatable_name).await?;
+        entry.instance = governing.is_instance();
+        let usable =
+            crate::datatable_permissions_oss::usable_datatable_roles(db, authed, w_id, &governing)
+                .await?;
+        entry.permissioned = usable.permissioned;
+        entry.usable_roles = usable.roles;
+        entry.default_role = usable.default_role;
+        let listing = get_datatable_tables(db, authed, w_id, &entry.datatable_name, role).await?;
+        entry.schemas = listing.schemas;
+        entry.can_create_schema = listing.can_create_schema;
+        entry.creatable_schemas = listing.creatable_schemas;
+        Ok(())
+    }
+    .await;
+    if let Err(e) = result {
+        entry.error = Some(e.to_string());
+    }
+    entry
+}
+
 async fn get_datatable_table_schema(
-    _authed: ApiAuthed,
+    authed: ApiAuthed,
     Extension(db): Extension<DB>,
     Path(w_id): Path<String>,
     Query(query): Query<GetDataTableSchemaQuery>,
 ) -> JsonResult<DataTableTableSchema> {
     let columns = get_datatable_table_columns(
         &db,
+        &authed,
         &w_id,
         &query.datatable_name,
         &query.schema_name,
         &query.table_name,
+        query.role.as_deref(),
     )
     .await?;
 
@@ -2469,13 +2607,38 @@ async fn list_datatable_names(db: &DB, w_id: &str) -> Result<Vec<String>> {
     .collect())
 }
 
-async fn get_datatable_schema(db: &DB, w_id: &str, datatable_name: &str) -> Result<SchemaMap> {
-    // Get the datatable resource (connection credentials)
-    let db_resource = get_datatable_resource_from_db_unchecked(db, w_id, datatable_name).await?;
+/// Connect to a data table as the caller, not as `admin`: the role they named, or the data table's
+/// default. A data table not under roles resolves as `admin`, exactly as it did before roles.
+///
+/// Every schema-browsing query below then reports what this Postgres role can actually reach,
+/// which is why they filter on `has_schema_privilege` — `pg_catalog` is world-readable, so an
+/// unfiltered listing would name schemas the connection cannot even enter.
+async fn resolve_datatable_pg_as_caller(
+    db: &DB,
+    authed: &ApiAuthed,
+    w_id: &str,
+    datatable_name: &str,
+    role: Option<&str>,
+) -> Result<PgDatabase> {
+    let db_resource = get_datatable_resource_from_db(
+        db,
+        w_id,
+        datatable_name,
+        role,
+        DatatableAccess::Authed(authed.to_authed_ref()),
+    )
+    .await?;
+    serde_json::from_value(db_resource)
+        .map_err(|e| Error::internal_err(format!("Failed to parse database credentials: {}", e)))
+}
 
-    // Parse the resource as PgDatabase
-    let pg_db: PgDatabase = serde_json::from_value(db_resource)
-        .map_err(|e| Error::internal_err(format!("Failed to parse database credentials: {}", e)))?;
+async fn get_datatable_schema(
+    db: &DB,
+    authed: &ApiAuthed,
+    w_id: &str,
+    datatable_name: &str,
+) -> Result<SchemaMap> {
+    let pg_db = resolve_datatable_pg_as_caller(db, authed, w_id, datatable_name, None).await?;
 
     // Connect to the datatable database
     let (client, connection) = pg_db.connect(Some(db)).await?;
@@ -2495,6 +2658,7 @@ async fn get_datatable_schema(db: &DB, w_id: &str, datatable_name: &str) -> Resu
             FROM pg_namespace
             WHERE nspname NOT IN ('information_schema', 'pg_toast', 'pg_catalog')
               AND nspname NOT LIKE 'pg_%'
+              AND has_schema_privilege(oid, 'USAGE')
             ORDER BY nspname
             "#,
             &[],
@@ -2562,10 +2726,20 @@ async fn get_datatable_schema(db: &DB, w_id: &str, datatable_name: &str) -> Resu
     Ok(schema_map)
 }
 
-async fn get_datatable_tables(db: &DB, w_id: &str, datatable_name: &str) -> Result<TableListMap> {
-    let db_resource = get_datatable_resource_from_db_unchecked(db, w_id, datatable_name).await?;
-    let pg_db: PgDatabase = serde_json::from_value(db_resource)
-        .map_err(|e| Error::internal_err(format!("Failed to parse database credentials: {}", e)))?;
+struct DatatableTableListing {
+    schemas: TableListMap,
+    can_create_schema: bool,
+    creatable_schemas: Vec<String>,
+}
+
+async fn get_datatable_tables(
+    db: &DB,
+    authed: &ApiAuthed,
+    w_id: &str,
+    datatable_name: &str,
+    role: Option<&str>,
+) -> Result<DatatableTableListing> {
+    let pg_db = resolve_datatable_pg_as_caller(db, authed, w_id, datatable_name, role).await?;
     let (client, connection) = pg_db.connect(Some(db)).await?;
 
     tokio::spawn(async move {
@@ -2577,10 +2751,11 @@ async fn get_datatable_tables(db: &DB, w_id: &str, datatable_name: &str) -> Resu
     let schema_rows = client
         .query(
             r#"
-            SELECT nspname::text AS schema_name
+            SELECT nspname::text AS schema_name, has_schema_privilege(oid, 'CREATE') AS can_create
             FROM pg_namespace
             WHERE nspname NOT IN ('information_schema', 'pg_toast', 'pg_catalog')
               AND nspname NOT LIKE 'pg_%'
+              AND has_schema_privilege(oid, 'USAGE')
             ORDER BY nspname
             "#,
             &[],
@@ -2590,11 +2765,29 @@ async fn get_datatable_tables(db: &DB, w_id: &str, datatable_name: &str) -> Resu
             Error::internal_err(format!("Failed to query schemas: {}", pg_error_message(&e)))
         })?;
 
+    let can_create_schema: bool = client
+        .query_one(
+            "SELECT has_database_privilege(current_database(), 'CREATE')",
+            &[],
+        )
+        .await
+        .map_err(|e| {
+            Error::internal_err(format!(
+                "Failed to read database privileges: {}",
+                pg_error_message(&e)
+            ))
+        })?
+        .get(0);
+
     let mut table_map: TableListMap = HashMap::new();
+    let mut creatable_schemas = Vec::new();
     let schema_names: Vec<String> = schema_rows
         .iter()
         .map(|row| {
             let name: String = row.get(0);
+            if row.get::<_, bool>(1) {
+                creatable_schemas.push(name.clone());
+            }
             table_map.entry(name.clone()).or_default();
             name
         })
@@ -2624,15 +2817,17 @@ async fn get_datatable_tables(db: &DB, w_id: &str, datatable_name: &str) -> Resu
         table_map.entry(table_schema).or_default().push(table_name);
     }
 
-    Ok(table_map)
+    Ok(DatatableTableListing { schemas: table_map, can_create_schema, creatable_schemas })
 }
 
 async fn get_datatable_table_columns(
     db: &DB,
+    authed: &ApiAuthed,
     w_id: &str,
     datatable_name: &str,
     schema_name: &str,
     table_name: &str,
+    role: Option<&str>,
 ) -> Result<ColumnMap> {
     if is_system_pg_schema(schema_name) {
         return Err(Error::BadRequest(format!(
@@ -2641,9 +2836,7 @@ async fn get_datatable_table_columns(
         )));
     }
 
-    let db_resource = get_datatable_resource_from_db_unchecked(db, w_id, datatable_name).await?;
-    let pg_db: PgDatabase = serde_json::from_value(db_resource)
-        .map_err(|e| Error::internal_err(format!("Failed to parse database credentials: {}", e)))?;
+    let pg_db = resolve_datatable_pg_as_caller(db, authed, w_id, datatable_name, role).await?;
     let (client, connection) = pg_db.connect(Some(db)).await?;
 
     tokio::spawn(async move {
@@ -2739,6 +2932,18 @@ fn truncate_column_default(default: String) -> String {
 mod tests {
     use super::*;
 
+    #[test]
+    fn a_dev_workspace_copies_into_the_fork_database_namespace() {
+        assert_eq!(
+            forked_datatable_dbname("wm-fork-my-fork", "main"),
+            "wm_fork_my_fork__main"
+        );
+        assert_eq!(
+            forked_datatable_dbname("my-dev", "main"),
+            "wm_fork_my_dev__main"
+        );
+    }
+
     /// The header of a pg_dump, followed by an object whose body also holds a `SET`.
     const DUMP: &str = "--\n\
         -- PostgreSQL database dump\n\
@@ -2853,7 +3058,10 @@ mod tests {
 }
 
 /// Resolve a source string to PgDatabase credentials with user-scoped permission checks.
-/// For `datatable://name`: accessible to everyone (variables are resolved internally).
+///
+/// For `datatable://name`: the **admin** connection, so it is gated on admin reach. Every caller
+/// copies, dumps or drops a whole database, and a dump taken under a restricted role would be a
+/// silently truncated copy rather than an error — which is worse than refusing.
 /// For `$res:path`: uses UserDB (row-level security) to verify the user can see the resource,
 /// then interpolates `$var:` references in the resource value.
 pub(crate) async fn resolve_pg_source_checked(
@@ -2864,6 +3072,13 @@ pub(crate) async fn resolve_pg_source_checked(
     source: &str,
 ) -> Result<PgDatabase> {
     let db_resource = if let Some(name) = source.strip_prefix("datatable://") {
+        windmill_common::workspaces::ensure_datatable_admin_access(
+            db,
+            w_id,
+            name,
+            &DatatableAccess::Authed(authed.to_authed_ref()),
+        )
+        .await?;
         get_datatable_resource_from_db_unchecked(db, w_id, name).await?
     } else if let Some(path) = source.strip_prefix("$res:") {
         let db_with_authed = windmill_common::db::DbWithOptAuthed::from_authed(
@@ -2904,22 +3119,13 @@ pub(crate) async fn resolve_pg_source_checked(
 /// Whether the data table `name` is backed by the Windmill instance's own PostgreSQL
 /// rather than a user resource.
 pub(crate) async fn is_instance_datatable(db: &DB, w_id: &str, name: &str) -> Result<bool> {
-    let config = sqlx::query_scalar!(
-        "SELECT datatable->'datatables'->$2 FROM workspace_settings WHERE workspace_id = $1",
-        w_id,
-        name
-    )
-    .fetch_optional(db)
-    .await?
-    .flatten();
-    Ok(config
-        .and_then(|v| {
-            v.get("database")
-                .and_then(|d| d.get("resource_type"))
-                .and_then(|r| r.as_str())
-                .map(|s| s == "instance")
-        })
-        .unwrap_or(false))
+    // Resolved rather than read: a pointer entry owns no database of its own, so only the entry it
+    // lands on can answer. A name that resolves to nothing keeps the historical `false`.
+    Ok(resolve_governing_datatable(db, w_id, name)
+        .await
+        .ok()
+        .and_then(|g| g.datatable.database)
+        .is_some_and(|d| d.resource_type == DataTableCatalogResourceType::Instance))
 }
 
 /// Same, for the `datatable://<name>` / `$res:<path>` form the import endpoints take.
@@ -3206,7 +3412,10 @@ async fn server_setting_names(pg_db: &PgDatabase) -> Result<HashSet<String>> {
 /// so a dump that breaks partway through imports partially and reads as a success.
 /// ON_ERROR_STOP surfaces the failure and --single-transaction makes the restore
 /// all-or-nothing, leaving the target as it was and the import retryable.
-async fn pg_import_dump(target_db: &PgDatabase, dump_file: &DumpFile) -> Result<()> {
+///
+/// Authorization: none. Writes into `target_db` with the credentials it carries; callers MUST have
+/// authorized writing to that database.
+pub(crate) async fn pg_import_dump(target_db: &PgDatabase, dump_file: &DumpFile) -> Result<()> {
     let supported_settings = server_setting_names(target_db).await?;
     comment_out_unsupported_settings(dump_file, &supported_settings).await?;
 
@@ -3250,6 +3459,14 @@ async fn create_pg_database(
 ) -> Result<String> {
     windmill_common::validate_dbname(&req.target_dbname)?;
 
+    // The copy this database is for is refused a call later, and nothing collects an instance
+    // database that no data table entry names. Refuse here too, so the clone stops before one
+    // exists rather than leaving an empty registered `wm_fork_…` behind.
+    if let Some(reference) = req.source.strip_prefix("datatable://") {
+        let (name, _) = parse_datatable_ref_for(&db, &w_id, reference).await?;
+        ensure_copied_without_roles(&ensure_datatable_is_clonable(&db, &w_id, &name).await?)?;
+    }
+
     // Non-superadmin: restrict dbname to wm_fork_ prefix
     if !windmill_api_auth::is_super_admin_authed(&db, &authed).await? {
         if !req.target_dbname.starts_with("wm_fork_") {
@@ -3266,50 +3483,62 @@ async fn create_pg_database(
     } else {
         let source_pg =
             resolve_pg_source_checked(&db, &user_db, &authed, &w_id, &req.source).await?;
-        let (client, connection) = source_pg.connect(Some(&db)).await?;
-        let join_handle = tokio::spawn(async move { connection.await });
-
-        let row = client
-            .query_one(
-                "SELECT EXISTS (SELECT 1 FROM pg_catalog.pg_database WHERE datname = $1)",
-                &[&req.target_dbname],
-            )
-            .await
-            .map_err(|e| {
-                Error::internal_err(format!(
-                    "Failed to check database existence: {}",
-                    pg_error_message(&e)
-                ))
-            })?;
-        let db_exists: bool = row.get(0);
-
-        if db_exists {
-            drop(client);
-            let _ = windmill_common::shutdown_pg_connection(join_handle).await;
-            return Err(Error::BadRequest(format!(
-                "Database '{}' already exists on the resource server",
-                req.target_dbname
-            )));
-        }
-
-        client
-            .execute(&format!("CREATE DATABASE \"{}\"", &req.target_dbname), &[])
-            .await
-            .map_err(|e| {
-                Error::internal_err(format!(
-                    "Failed to create database '{}': {}",
-                    req.target_dbname,
-                    pg_error_message(&e)
-                ))
-            })?;
-
-        drop(client);
-        windmill_common::shutdown_pg_connection(join_handle).await?;
+        create_database_on_server(&db, &source_pg, &req.target_dbname).await?;
     }
 
     Ok(format!("Created database '{}'", req.target_dbname))
 }
 
+/// `CREATE DATABASE` on the server `server` connects to, refusing a name already taken there.
+///
+/// Authorization: none. Callers MUST have authorized creating a database on that server — resolved
+/// from a data table or resource the caller may administer.
+pub(crate) async fn create_database_on_server(
+    db: &DB,
+    server: &PgDatabase,
+    dbname: &str,
+) -> Result<()> {
+    windmill_common::validate_dbname(dbname)?;
+    let (client, connection) = server.connect(Some(db)).await?;
+    let join_handle = tokio::spawn(async move { connection.await });
+
+    let row = client
+        .query_one(
+            "SELECT EXISTS (SELECT 1 FROM pg_catalog.pg_database WHERE datname = $1)",
+            &[&dbname],
+        )
+        .await
+        .map_err(|e| {
+            Error::internal_err(format!(
+                "Failed to check database existence: {}",
+                pg_error_message(&e)
+            ))
+        })?;
+    let db_exists: bool = row.get(0);
+
+    if db_exists {
+        drop(client);
+        let _ = windmill_common::shutdown_pg_connection(join_handle).await;
+        return Err(Error::BadRequest(format!(
+            "Database '{dbname}' already exists on the resource server"
+        )));
+    }
+
+    client
+        .execute(&format!("CREATE DATABASE \"{dbname}\""), &[])
+        .await
+        .map_err(|e| {
+            Error::internal_err(format!(
+                "Failed to create database '{dbname}': {}",
+                pg_error_message(&e)
+            ))
+        })?;
+
+    drop(client);
+    windmill_common::shutdown_pg_connection(join_handle).await?;
+    Ok(())
+}
+
 #[derive(Deserialize)]
 struct ImportPgDatabaseRequest {
     source: String,
@@ -3319,6 +3548,56 @@ struct ImportPgDatabaseRequest {
     fork_behavior: DataTableForkBehavior,
 }
 
+/// Whether data table `name` of `w_id` has a shape a copy can be made of, returning what governs
+/// it. Checked before anything is created — by the fork request for the copies it makes, and by
+/// `create_pg_database` — and again when the fork's entry is written.
+///
+/// It is not the check for a data table under roles: a copy of one is only correct with its
+/// owners and grants replayed, which the fork request does and the older endpoints refuse
+/// ([`ensure_copied_without_roles`]).
+///
+/// Authorization: none. Callers MUST have authorized reaching data table `name` of `w_id` before
+/// using what it returns.
+pub(crate) async fn ensure_datatable_is_clonable(
+    db: &DB,
+    w_id: &str,
+    name: &str,
+) -> Result<GoverningDatatable> {
+    let governing = resolve_governing_datatable(db, w_id, name).await?;
+    // The copy has to name a database of its own. A resource-backed entry reached through a
+    // pointer names one this workspace does not own, so there is nothing here to repoint.
+    let is_instance = governing
+        .datatable
+        .database
+        .as_ref()
+        .is_some_and(|d| d.resource_type == DataTableCatalogResourceType::Instance);
+    if governing.workspace_id != w_id && !is_instance {
+        return Err(Error::BadRequest(format!(
+            "Data table '{name}' points at a resource-backed data table in another workspace \
+             and cannot be copied; fork it from the workspace that owns it."
+        )));
+    }
+    Ok(governing)
+}
+
+/// Refuse a copy of a data table under roles through the endpoints that copy rows and nothing
+/// else.
+///
+/// `pg_dump` carries no roles and the import runs with `--no-privileges`, so such a copy arrives
+/// with its objects owned by the admin connection and no `GRANT` for any role: the tenants pass
+/// Windmill's check, connect as the role they were given, and are denied by Postgres on everything.
+/// A fork request that makes the copy itself replays the owners and grants instead.
+fn ensure_copied_without_roles(governing: &GoverningDatatable) -> Result<()> {
+    if governing.datatable.permissions.is_some() {
+        return Err(Error::BadRequest(format!(
+            "Data table '{}' is under roles, so a copy has to carry its owners and grants: \
+             clone it through the fork wizard or `wmill workspace fork`, which do.",
+            governing.name
+        )));
+    }
+    Ok(())
+}
+
 /// Import (pg_dump/pg_import) from source to target
 async fn import_pg_database(
     authed: ApiAuthed,
@@ -3331,6 +3610,11 @@ async fn import_pg_database(
         return Ok("No action needed for KeepOriginal behavior".to_string());
     }
 
+    if let Some(reference) = req.source.strip_prefix("datatable://") {
+        let (name, _) = parse_datatable_ref_for(&db, &w_id, reference).await?;
+        ensure_copied_without_roles(&ensure_datatable_is_clonable(&db, &w_id, &name).await?)?;
+    }
+
     if req.fork_behavior == DataTableForkBehavior::SchemaAndData {
         require_admin(authed.is_admin, &authed.username)?;
         if *CLOUD_HOSTED {
@@ -3449,6 +3733,15 @@ async fn edit_ducklake_config(
     }
 
     let mut tx = db.begin().await?;
+    windmill_common::lock_instance_databases(
+        &mut tx,
+        new_config.settings.ducklakes.values().filter_map(|lake| {
+            (lake.catalog.resource_type
+                == windmill_common::workspaces::DucklakeCatalogResourceType::Instance)
+                .then_some(lake.catalog.resource_path.as_str())
+        }),
+    )
+    .await?;
 
     let args_for_audit = format!("{:?}", new_config.settings);
     audit_log(
@@ -3524,24 +3817,54 @@ async fn edit_ducklake_config(
     Ok(format!("Edit ducklake config for workspace {}", &w_id))
 }
 
+/// What a save left behind. `stranded_references` names the data tables in other workspaces that
+/// were governed by one this save deleted — a field rather than a sentence in a success string,
+/// so the UI decides whether to warn on the data rather than on the server's prose.
+#[derive(Serialize)]
+pub struct EditDataTableConfigResult {
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    stranded_references: Vec<StrandedReference>,
+}
+
+#[derive(Serialize)]
+pub struct StrandedReference {
+    workspace_id: String,
+    datatable: String,
+}
+
 async fn edit_datatable_config(
     authed: ApiAuthed,
     Extension(db): Extension<DB>,
     Path(w_id): Path<String>,
     ApiAuthed { is_admin, username, .. }: ApiAuthed,
     Json(mut new_config): Json<EditDataTableConfig>,
-) -> Result<String> {
+) -> JsonResult<EditDataTableConfigResult> {
     require_admin(is_admin, &username)?;
     let is_superadmin = require_super_admin(&db, &authed).await.is_ok();
 
     let mut tx = db.begin().await?;
+    windmill_common::lock_instance_databases(
+        &mut tx,
+        new_config.settings.datatables.values().filter_map(|dt| {
+            dt.database
+                .as_ref()
+                .filter(|d| d.resource_type == DataTableCatalogResourceType::Instance)
+                .map(|d| d.resource_path.as_str())
+        }),
+    )
+    .await?;
 
+    // Read under the row lock this transaction will write with. `permissions`, `reference` and
+    // `forked_from` are carried across from what this read returns, so a permissions save
+    // committing between the read and the whole-document write below would be silently rolled back
+    // by it.
     let old_datatables: HashMap<String, DataTable> = serde_json::from_value(
         sqlx::query_scalar!(
-            "SELECT ws.datatable->'datatables' FROM workspace_settings ws WHERE ws.workspace_id = $1",
+            "SELECT ws.datatable->'datatables' FROM workspace_settings ws
+             WHERE ws.workspace_id = $1 FOR UPDATE",
             &w_id
         )
-        .fetch_one(&db)
+        .fetch_one(&mut *tx)
         .await?
         .unwrap_or(serde_json::Value::Null),
     )
@@ -3563,6 +3886,58 @@ async fn edit_datatable_config(
         crate::datatable_migrations::validate_datatable_path_segment(&r.from)?;
         crate::datatable_migrations::validate_new_datatable_name(&r.to)?;
     }
+    // A rename is a claim about what this save is doing, and other workspaces' pointers are
+    // rewritten from it — so the claim has to match the configuration it describes, or a caller
+    // can move every fork of one data table onto another by asserting a rename that did not
+    // happen. The shape below is what "these old keys became those new keys" actually means.
+    {
+        let old_keys = &old_datatables;
+        let new_keys = &new_config.settings.datatables;
+        let froms: std::collections::HashSet<&str> =
+            new_config.renames.iter().map(|r| r.from.as_str()).collect();
+        let tos: std::collections::HashSet<&str> =
+            new_config.renames.iter().map(|r| r.to.as_str()).collect();
+        if froms.len() != new_config.renames.len() {
+            return Err(Error::BadRequest(
+                "A data table is renamed twice in one save".to_string(),
+            ));
+        }
+        if tos.len() != new_config.renames.len() {
+            return Err(Error::BadRequest(
+                "Two data tables are renamed to the same name in one save".to_string(),
+            ));
+        }
+        for r in &new_config.renames {
+            if !old_keys.contains_key(&r.from) {
+                return Err(Error::BadRequest(format!(
+                    "Cannot rename data table '{}': this workspace has no such data table",
+                    r.from
+                )));
+            }
+            if !new_keys.contains_key(&r.to) {
+                return Err(Error::BadRequest(format!(
+                    "Cannot rename data table '{}' to '{}': the save does not contain '{}'",
+                    r.from, r.to, r.to
+                )));
+            }
+            // The source has to be gone, or gone-and-reoccupied by another rename — which is what
+            // a swap is. Without this, `main -> decoy` passes against a save that keeps both, and
+            // every fork of `main` silently follows onto a different data table.
+            if new_keys.contains_key(&r.from) && !tos.contains(r.from.as_str()) {
+                return Err(Error::BadRequest(format!(
+                    "Data table '{}' is renamed to '{}' but the save still contains '{}'",
+                    r.from, r.to, r.from
+                )));
+            }
+            // And the target has to be free, or freed by another rename.
+            if old_keys.contains_key(&r.to) && !froms.contains(r.to.as_str()) {
+                return Err(Error::BadRequest(format!(
+                    "Cannot rename data table '{}' to '{}': '{}' already exists",
+                    r.from, r.to, r.to
+                )));
+            }
+        }
+    }
 
     // Map new name -> old name so a renamed data table inherits the previous
     // flag instead of being treated as brand new.
@@ -3583,18 +3958,68 @@ async fn edit_datatable_config(
             .get(name.as_str())
             .copied()
             .unwrap_or(name.as_str());
-        dt.migrations_enabled = match old_datatables.get(lookup) {
+        let old = old_datatables.get(lookup);
+        dt.migrations_enabled = match old {
             Some(old) => old.migrations_enabled,
             None => {
                 // Keyed by how the substrate is serialized into `workspace_settings`,
                 // so these line up with the `datatable_configured` adoption counts.
-                created_substrates.push(match dt.database.resource_type {
-                    DataTableCatalogResourceType::Instance => "instance",
-                    DataTableCatalogResourceType::Postgresql => "postgresql",
+                created_substrates.push(match dt.database.as_ref().map(|d| d.resource_type) {
+                    Some(DataTableCatalogResourceType::Instance) => "instance",
+                    Some(DataTableCatalogResourceType::Postgresql) => "postgresql",
+                    None => "reference",
                 });
                 Some(true)
             }
         };
+        // Carried across from the stored entry rather than taken from the request. `permissions`
+        // is an access decision, edited through its own endpoint; `reference` is what makes a fork
+        // answer to the workspace that governs its data table, and letting a save clear it would
+        // hand the fork the database outright. `forked_from` is the clone stamp the fork flow
+        // writes: whether an entry has one is carried the same way, since it is what marks the
+        // database droppable, but the schema baseline inside it is the diff view's to advance.
+        // `governed_by` is a clone's `reference` for its roles, and clearing it would hand the
+        // fork the copied rows the same way.
+        dt.permissions = old.and_then(|old| old.permissions.clone());
+        dt.reference = old.and_then(|old| old.reference.clone());
+        dt.governed_by = old.and_then(|old| old.governed_by.clone());
+        dt.forked_from = match old.and_then(|old| old.forked_from.as_ref()) {
+            Some(stored) => Some(dt.forked_from.take().unwrap_or_else(|| stored.clone())),
+            None => None,
+        };
+        // A clone's roles and grants were replayed into the database it was copied into, and hold
+        // for that database alone: whoever saves, it stays where it is.
+        if dt.governed_by.is_some()
+            && !crate::datatable_clone::same_database(
+                &dt.database,
+                &old.and_then(|old| old.database.clone()),
+            )
+        {
+            return Err(Error::BadRequest(format!(
+                "Data table '{name}' is a clone taking its roles from the data table it was copied \
+                 from, and its grants hold for its own database only: it cannot be moved."
+            )));
+        }
+        // Carrying the block onto a resource-backed entry would produce a data table the chokepoint
+        // refuses on every job — a save that succeeds and breaks everything afterwards. Refuse it
+        // instead: turning roles off first is one step, and it keeps discarding an access decision
+        // something somebody chose rather than a side effect of moving a database.
+        if dt.permissions.is_some()
+            && dt
+                .database
+                .as_ref()
+                .is_some_and(|d| d.resource_type != DataTableCatalogResourceType::Instance)
+        {
+            return Err(Error::BadRequest(format!(
+                "Data table '{name}' is under roles, which only a data table on the instance \
+                 database can be. Turn its roles off before moving it to a PostgreSQL resource."
+            )));
+        }
+        // A pointer names no database of its own, so the form's empty `database` is correct there.
+        if dt.reference.is_some() {
+            dt.database = None;
+        }
+        windmill_common::workspaces::validate_datatable_shape(name, dt)?;
     }
 
     let args_for_audit = format!("{:?}", new_config.settings);
@@ -3609,16 +4034,32 @@ async fn edit_datatable_config(
     )
     .await?;
 
-    // Check that non-superadmins are not abusing Instance databases
+    // Check that non-superadmins are not abusing Instance databases, which reach a database this
+    // workspace does not own. Pointing an entry at another workspace's data table is not checked
+    // here because it cannot be requested at all: `reference` is overwritten from the stored entry
+    // above, for every caller.
+    //
+    // Compared against the entry the carried fields came from, not the one stored under the same
+    // name: otherwise swapping two names keeps each database in place while moving a clone's
+    // `governed_by` off the copy it governs.
     if !is_superadmin {
         for (name, dt) in new_config.settings.datatables.iter() {
-            if dt.database.resource_type == DataTableCatalogResourceType::Instance {
-                let old_dt = old_datatables.get(name);
-                if old_dt.is_none()
-                    || old_dt.unwrap().database.resource_type
-                        != DataTableCatalogResourceType::Instance
-                    || old_dt.unwrap().database.resource_path != dt.database.resource_path
-                {
+            let old_dt = old_datatables.get(
+                rename_src
+                    .get(name.as_str())
+                    .copied()
+                    .unwrap_or(name.as_str()),
+            );
+            if dt
+                .database
+                .as_ref()
+                .is_some_and(|d| d.resource_type == DataTableCatalogResourceType::Instance)
+            {
+                let unchanged = old_dt.and_then(|o| o.database.as_ref()).is_some_and(|o| {
+                    o.resource_type == DataTableCatalogResourceType::Instance
+                        && Some(&o.resource_path) == dt.database.as_ref().map(|d| &d.resource_path)
+                });
+                if !unchanged {
                     return Err(Error::BadRequest(
                         "Only superadmins can create or modify data tables with Instance databases"
                             .to_string(),
@@ -3628,6 +4069,85 @@ async fn edit_datatable_config(
         }
     }
 
+    // Worked out from the locked entries rather than taken from `deleted_datatables`: a settings
+    // sync sends the whole map without that list, and dropping a governing entry strands every
+    // fork pointing at it all the same.
+    let removed: Vec<String> = old_datatables
+        .keys()
+        .filter(|name| {
+            !new_config.settings.datatables.contains_key(*name)
+                && !new_config.renames.iter().any(|r| &r.from == *name)
+        })
+        .cloned()
+        .collect();
+
+    // A database under roles is reached only through an entry that carries them. Roles follow an
+    // entry through a declared rename alone, and a settings sync never declares one, so an entry
+    // without roles that newly points at such a database — a name added, or an existing one
+    // repointed — would answer everyone there as `admin`. That holds whichever workspace governs it.
+    let newly_pointed: Vec<(&String, &str)> = new_config
+        .settings
+        .datatables
+        .iter()
+        // A clone carries its roles through `governed_by` rather than `permissions`.
+        .filter(|(_, dt)| dt.permissions.is_none() && dt.governed_by.is_none())
+        .filter_map(|(name, dt)| {
+            let db = dt
+                .database
+                .as_ref()
+                .filter(|d| d.resource_type == DataTableCatalogResourceType::Instance)?;
+            let lookup = rename_src
+                .get(name.as_str())
+                .copied()
+                .unwrap_or(name.as_str());
+            let repointed = old_datatables
+                .get(lookup)
+                .and_then(|old| old.database.as_ref())
+                .is_none_or(|old_db| {
+                    old_db.resource_type != db.resource_type
+                        || old_db.resource_path != db.resource_path
+                });
+            repointed.then_some((name, db.resource_path.as_str()))
+        })
+        .collect();
+    // Another workspace turning roles on for the same database holds only its own settings row, so
+    // without this the scan below could read past its uncommitted write.
+    windmill_common::datatable_roles::lock_instance_databases_governance(
+        &mut *tx,
+        newly_pointed.iter().map(|(_, dbname)| *dbname),
+    )
+    .await?;
+    let governed_elsewhere: Vec<String> = if newly_pointed.is_empty() {
+        vec![]
+    } else {
+        sqlx::query_scalar(
+            "SELECT DISTINCT dt.value->'database'->>'resource_path' FROM workspace_settings ws
+             CROSS JOIN LATERAL jsonb_each(COALESCE(ws.datatable->'datatables', '{}'::jsonb)) dt
+             WHERE ws.workspace_id <> $1 AND (dt.value ? 'permissions' OR dt.value ? 'governed_by')
+               AND dt.value->'database'->>'resource_type' = 'instance'",
+        )
+        .bind(&w_id)
+        .fetch_all(&mut *tx)
+        .await?
+    };
+    for (name, dbname) in newly_pointed {
+        let governed_here = old_datatables.values().any(|old| {
+            (old.permissions.is_some() || old.governed_by.is_some())
+                && old.database.as_ref().is_some_and(|d| {
+                    d.resource_type == DataTableCatalogResourceType::Instance
+                        && d.resource_path == dbname
+                })
+        });
+        if governed_here || governed_elsewhere.iter().any(|g| g == dbname) {
+            return Err(Error::BadRequest(format!(
+                "Data table '{name}' would point at database '{dbname}', which a data table under \
+                 roles uses, without carrying those roles: everyone reaching '{name}' would connect \
+                 there as `admin`. Rename the data table under roles from the data table settings, \
+                 which carries its roles, or turn its roles off first."
+            )));
+        }
+    }
+
     let config: serde_json::Value = serde_json::to_value(new_config.settings)
         .map_err(|err| Error::internal_err(err.to_string()))?;
 
@@ -3649,6 +4169,47 @@ async fn edit_datatable_config(
         )
         .await?;
 
+    // A fork points at a data table by name, so a rename here has to follow or every fork's entry
+    // resolves to nothing. In two passes through a temporary name, like the migration cascade one
+    // layer down: applied in order, `sa -> sb` then `sb -> sa` would move what pointed at `sa` all
+    // the way back to `sa`, and `A -> B`, `B -> C` would carry `A`'s pointers to `C`. Each pointer
+    // moves once, from what it named before this save. Inside the transaction: the rename and the
+    // pointers that name it are one change, and half of it is a fork whose jobs stop.
+    for (i, r) in new_config.renames.iter().enumerate() {
+        repoint_datatable_references(&mut tx, &w_id, &r.from, &format!("__wm_rename_tmp/{i}"))
+            .await?;
+    }
+    for (i, r) in new_config.renames.iter().enumerate() {
+        repoint_datatable_references(&mut tx, &w_id, &format!("__wm_rename_tmp/{i}"), &r.to)
+            .await?;
+    }
+
+    // A deletion cannot be followed the same way — there is nothing to point at any more. Read who
+    // is left stranded so the caller is told, the way deleting a workspace does.
+    let mut stranded: Vec<StrandedReference> = Vec::new();
+    for name in &removed {
+        let rows = sqlx::query!(
+            r#"SELECT ws.workspace_id AS "workspace_id!", dt.key AS "datatable!"
+               FROM workspace_settings ws
+               CROSS JOIN LATERAL jsonb_each(COALESCE(ws.datatable->'datatables', '{}'::jsonb)) dt
+               WHERE EXISTS (
+                   SELECT 1 FROM (VALUES ('reference'), ('governed_by')) k(link)
+                   WHERE dt.value->k.link->>'workspace_id' = $1
+                     AND dt.value->k.link->>'datatable' = $2
+               )"#,
+            &w_id,
+            name,
+        )
+        .fetch_all(&mut *tx)
+        .await?;
+        stranded.extend(
+            rows.into_iter().map(|r| StrandedReference {
+                workspace_id: r.workspace_id,
+                datatable: r.datatable,
+            }),
+        );
+    }
+
     tx.commit().await?;
 
     for substrate in created_substrates {
@@ -3663,7 +4224,9 @@ async fn edit_datatable_config(
     )
     .await?;
 
-    Ok(format!("Edit datatable config for workspace {}", &w_id))
+    Ok(Json(EditDataTableConfigResult {
+        stranded_references: stranded,
+    }))
 }
 
 #[derive(Deserialize)]
@@ -4692,6 +5255,47 @@ async fn edit_guest_access(
     ))
 }
 
+#[derive(Deserialize)]
+struct EditAddAdminsAndDevelopersToForks {
+    add_admins_and_developers_to_forks: bool,
+}
+
+async fn edit_add_admins_and_developers_to_forks(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+    Path(w_id): Path<String>,
+    Json(EditAddAdminsAndDevelopersToForks { add_admins_and_developers_to_forks }): Json<
+        EditAddAdminsAndDevelopersToForks,
+    >,
+) -> Result<String> {
+    require_admin(authed.is_admin, &authed.username)?;
+
+    let mut tx = db.begin().await?;
+    sqlx::query!(
+        "UPDATE workspace_settings SET add_admins_and_developers_to_forks = $1 WHERE workspace_id = $2",
+        add_admins_and_developers_to_forks,
+        &w_id
+    )
+    .execute(&mut *tx)
+    .await?;
+
+    audit_log(
+        &mut *tx,
+        &authed,
+        "workspaces.edit_add_admins_and_developers_to_forks",
+        ActionKind::Update,
+        &w_id,
+        Some(&add_admins_and_developers_to_forks.to_string()),
+        None,
+    )
+    .await?;
+    tx.commit().await?;
+
+    Ok(format!(
+        "Adding admins and developers to new forks set to {add_admins_and_developers_to_forks} for workspace {w_id}"
+    ))
+}
+
 #[derive(Deserialize)]
 struct EditGuestJwtKey {
     /// A PEM public key (RS or ES family), or a JWKS URL, at most one. Both empty clears the
@@ -5280,9 +5884,6 @@ async fn set_encryption_key(
         ));
     }
 
-    // Build the previous cipher before the transaction (reads from cache/pool)
-    let previous_encryption_key = build_crypt(&db, w_id.as_str()).await?;
-
     let mut tx = db.begin().await?;
 
     // Under the row's lock, so two rotations racing serialize and each sees the key the
@@ -5316,17 +5917,14 @@ async fn set_encryption_key(
         None
     };
 
+    // From the keys read and written under the lock, never from `build_crypt`: its
+    // cache can still hold a key an earlier rotation replaced, and the git-sync
+    // secrets below are skipped rather than failed when they do not decrypt.
+    let previous_encryption_key = crypt_from_key_with_suffix(&previous_key, "");
+    let new_encryption_key = crypt_from_key_with_suffix(&request.new_key, "");
+
     let mut reencrypted_secret_paths: Vec<String> = Vec::new();
     if !request.skip_reencrypt.unwrap_or(false) {
-        // Build the new cipher directly from the key string, since the transaction
-        // hasn't committed yet and build_crypt() would read the old key from the pool.
-        let crypt_key = if let Some(ref salt) = SECRET_SALT.as_ref() {
-            format!("{}{}", request.new_key, salt)
-        } else {
-            request.new_key.clone()
-        };
-        let new_encryption_key = magic_crypt::new_magic_crypt!(crypt_key, 256);
-
         let mut truncated_new_key = request.new_key.clone();
         truncated_new_key.truncate(8);
         tracing::warn!(
@@ -5366,6 +5964,21 @@ async fn set_encryption_key(
         }
     }
 
+    reencrypt_git_sync_secrets(
+        &mut tx,
+        &w_id,
+        &previous_encryption_key,
+        &new_encryption_key,
+    )
+    .await?;
+    crate::remote_deploy::reencrypt_tokens(
+        &mut tx,
+        &w_id,
+        &previous_encryption_key,
+        &new_encryption_key,
+    )
+    .await?;
+
     tx.commit().await?;
 
     // Invalidate the cache only after the transaction has committed
@@ -5403,6 +6016,64 @@ async fn set_encryption_key(
     return Ok(());
 }
 
+/// Move the git-sync secrets the server keeps under the workspace key (stored
+/// repository tokens, webhook secrets) to the new key. They are never synced, so
+/// unlike variables they are still under the old key when the caller skips
+/// re-encryption.
+async fn reencrypt_git_sync_secrets(
+    conn: &mut sqlx::PgConnection,
+    w_id: &str,
+    old: &magic_crypt::MagicCrypt256,
+    new: &magic_crypt::MagicCrypt256,
+) -> Result<()> {
+    let Some((mut credentials, mut git_sync)) =
+        sqlx::query_as::<_, (serde_json::Value, Option<serde_json::Value>)>(
+            "SELECT git_credentials, git_sync FROM workspace_settings WHERE workspace_id = $1 FOR UPDATE",
+        )
+        .bind(w_id)
+        .fetch_optional(&mut *conn)
+        .await?
+    else {
+        return Ok(());
+    };
+    let reencrypt = |value: &mut serde_json::Value| {
+        let Some(ciphertext) = value.as_str() else {
+            return;
+        };
+        match decrypt(old, ciphertext.to_string()) {
+            Ok(plain) => *value = serde_json::Value::String(encrypt(new, &plain)),
+            // Left by an earlier rotation and unrecoverable either way; failing here
+            // would block every later rotation of the workspace.
+            Err(e) => tracing::warn!(
+                "a git-sync secret of workspace {w_id} does not decrypt under its current key, leaving it as is: {e}"
+            ),
+        }
+    };
+    for entry in credentials.as_array_mut().into_iter().flatten() {
+        if let Some(token) = entry.get_mut("token") {
+            reencrypt(token);
+        }
+    }
+    let repositories = git_sync
+        .as_mut()
+        .and_then(|g| g.get_mut("repositories"))
+        .and_then(|r| r.as_array_mut());
+    for repo in repositories.into_iter().flatten() {
+        if let Some(secret) = repo.pointer_mut("/auto_pull/webhook_secret") {
+            reencrypt(secret);
+        }
+    }
+    sqlx::query(
+        "UPDATE workspace_settings SET git_credentials = $2, git_sync = $3 WHERE workspace_id = $1",
+    )
+    .bind(w_id)
+    .bind(credentials)
+    .bind(git_sync)
+    .execute(&mut *conn)
+    .await?;
+    Ok(())
+}
+
 #[derive(Serialize)]
 struct UsedTriggers {
     pub websocket_used: bool,
@@ -5531,7 +6202,7 @@ async fn user_workspaces(
                 workspace.is_dev_workspace, workspace.dev_workspace_label,
                 workspace.owner AS \"created_by?\",
                 CASE WHEN usr.operator THEN workspace_settings.operator_settings ELSE NULL END as operator_settings,
-                usr.disabled
+                usr.disabled, usr.is_service_account
          FROM workspace
          JOIN usr ON usr.workspace_id = workspace.id
          JOIN workspace_settings ON workspace_settings.workspace_id = workspace.id
@@ -6352,7 +7023,8 @@ async fn update_workspace_settings(
             ducklake = source_ws.ducklake,
             dbt_warehouses = source_ws.dbt_warehouses,
             datatable = source_ws.datatable,
-            git_app_installations = source_ws.git_app_installations
+            git_app_installations = source_ws.git_app_installations,
+            add_admins_and_developers_to_forks = source_ws.add_admins_and_developers_to_forks
         FROM workspace_settings source_ws
         WHERE source_ws.workspace_id = $1
         AND workspace_settings.workspace_id = $2
@@ -6493,14 +7165,21 @@ async fn copy_workspace_members(
     tx: &mut Transaction<'_, Postgres>,
     source_workspace_id: &str,
     target_workspace_id: &str,
+    admins_and_developers_only: bool,
 ) -> Result<()> {
+    // Admins and developers join as manual members: the fork does not inherit the source's
+    // instance-group config, so a copied `instance_group` provenance would let the fork's
+    // reconciliation delete them and their data.
     sqlx::query!(
         "INSERT INTO usr (workspace_id, username, email, is_admin, created_at, operator, disabled, role, is_service_account, added_via)
-         SELECT $1, username, email, is_admin, created_at, operator, disabled, role, is_service_account, added_via
+         SELECT $1, username, email, is_admin, created_at, operator, disabled, role, is_service_account,
+                CASE WHEN $3 THEN NULL ELSE added_via END
          FROM usr WHERE workspace_id = $2
+           AND (NOT $3 OR (NOT operator AND NOT disabled AND NOT is_service_account))
          ON CONFLICT DO NOTHING",
         target_workspace_id,
         source_workspace_id,
+        admins_and_developers_only,
     )
     .execute(&mut **tx)
     .await?;
@@ -6917,6 +7596,127 @@ async fn clear_orphaned_compat_address(
     Ok(())
 }
 
+/// SQL boolean: the principal the `principal` expression yields resolves in the workspace bound as
+/// `$1`. The same predicate `clone_scripts` and `clone_flows` inline, whose `query!` macros cannot
+/// take a composed string, so keep the three in step.
+fn principal_resolves_sql(principal: &str) -> String {
+    format!(
+        "CASE WHEN {principal} LIKE 'u/%' THEN EXISTS (
+                SELECT 1 FROM usr u WHERE u.workspace_id = $1
+                  AND u.username = substring({principal} from 3)
+                UNION ALL
+                SELECT 1 FROM password pw WHERE pw.super_admin
+                  AND (pw.username = substring({principal} from 3)
+                       OR pw.email = substring({principal} from 3)))
+              WHEN {principal} LIKE 'g/%' THEN EXISTS (
+                SELECT 1 FROM group_ g WHERE g.workspace_id = $1
+                  AND g.name = substring({principal} from 3))
+              ELSE EXISTS (
+                SELECT 1 FROM usr u WHERE u.workspace_id = $1 AND u.username = {principal}
+                UNION ALL
+                SELECT 1 FROM password pw WHERE pw.email = {principal} AND pw.super_admin)
+         END"
+    )
+}
+
+/// Re-point the identities a fork clones verbatim at its creator when they name nobody in the fork,
+/// once its membership is final so copied members keep theirs. Unlike scripts and flows these
+/// cannot drop the identity: an app deploy rejects a preserved one that does not resolve, and
+/// publisher apps, schedules and triggers need one to run.
+async fn repoint_unresolvable_cloned_identities(
+    tx: &mut Transaction<'_, Postgres>,
+    target_workspace_id: &str,
+    authed: &ApiAuthed,
+) -> Result<()> {
+    let principal = username_to_permissioned_as(&authed.username);
+
+    sqlx::query(&format!(
+        "UPDATE app SET policy = policy
+             || jsonb_build_object('on_behalf_of', $2::text, 'on_behalf_of_email', $3::text)
+         WHERE workspace_id = $1 AND policy->>'on_behalf_of' IS NOT NULL
+           AND NOT ({})",
+        principal_resolves_sql("(policy->>'on_behalf_of')")
+    ))
+    .bind(target_workspace_id)
+    .bind(&principal)
+    .bind(&authed.email)
+    .execute(&mut **tx)
+    .await?;
+
+    // A draft holding a genuine NUL escape (the rule of `json_text_has_nul_escape`) is left as it
+    // is, since parsing it would abort the fork. The check must stay in a CASE: json `->>` raises on
+    // a NUL anywhere in the value, and Postgres reorders plain AND conditions.
+    let nul_escape = r"(^|[^\\])(\\\\)*\\u0000";
+    sqlx::query(&format!(
+        "UPDATE draft SET value = to_json(jsonb_set(jsonb_set(to_jsonb(value),
+             ARRAY['policy', 'on_behalf_of'], to_jsonb($2::text)),
+             ARRAY['policy', 'on_behalf_of_email'], to_jsonb($3::text)))
+         WHERE workspace_id = $1 AND typ IN ('app', 'raw_app')
+           AND CASE WHEN value::text ~ $4 THEN false
+                    ELSE value->'policy'->>'on_behalf_of' IS NOT NULL AND NOT ({}) END",
+        principal_resolves_sql("(value->'policy'->>'on_behalf_of')")
+    ))
+    .bind(target_workspace_id)
+    .bind(&principal)
+    .bind(&authed.email)
+    .bind(nul_escape)
+    .execute(&mut **tx)
+    .await?;
+
+    sqlx::query(&format!(
+        "UPDATE draft SET value = to_json(jsonb_set(to_jsonb(value),
+             ARRAY['permissioned_as'], to_jsonb($2::text)))
+         WHERE workspace_id = $1 AND starts_with(typ::text, 'trigger_')
+           AND CASE WHEN value::text ~ $3 THEN false
+                    ELSE value->>'permissioned_as' IS NOT NULL AND NOT ({}) END",
+        principal_resolves_sql("(value->>'permissioned_as')")
+    ))
+    .bind(target_workspace_id)
+    .bind(&principal)
+    .bind(nul_escape)
+    .execute(&mut **tx)
+    .await?;
+
+    let column_resolves = principal_resolves_sql("permissioned_as");
+
+    // SAFETY: every table name is a literal from this list, never user input.
+    for table in [
+        "http_trigger",
+        "websocket_trigger",
+        "kafka_trigger",
+        "nats_trigger",
+        "postgres_trigger",
+        "mqtt_trigger",
+        "amqp_trigger",
+        "sqs_trigger",
+        "gcp_trigger",
+        "azure_trigger",
+        "email_trigger",
+    ] {
+        sqlx::query(&format!(
+            "UPDATE {table} SET permissioned_as = $2
+             WHERE workspace_id = $1 AND NOT ({column_resolves})"
+        ))
+        .bind(target_workspace_id)
+        .bind(&principal)
+        .execute(&mut **tx)
+        .await?;
+    }
+
+    // `email` is still written for workers that predate `permissioned_as`.
+    sqlx::query(&format!(
+        "UPDATE schedule SET permissioned_as = $2, email = $3
+         WHERE workspace_id = $1 AND NOT ({column_resolves})"
+    ))
+    .bind(target_workspace_id)
+    .bind(&principal)
+    .bind(&authed.email)
+    .execute(&mut **tx)
+    .await?;
+
+    Ok(())
+}
+
 /// Carries over the recorded principal under the rule spelled out on [`clone_scripts`].
 async fn clone_flows(
     tx: &mut Transaction<'_, Postgres>,
@@ -7362,14 +8162,32 @@ async fn clone_drafts(
     // filtered like `clone_scripts`: the address the draft still carries re-derives the
     // clone's own principal at deploy time, which is the more accurate answer of the two.
     sqlx::query!(
-        "INSERT INTO draft (workspace_id, path, typ, value, created_at, email)
+        // A script hash is content-addressed and copied as-is, so a script draft's base
+        // still names a version the clone has. `clone_flows` / `clone_apps` mint new ids,
+        // so those drafts arrive with no base (staleness falls back to the timestamps),
+        // lineage field included, or the next autosave would re-derive the source id.
+        //
+        // `clean` is `strip_json_nul`'s parity rule in SQL, so a pre-sanitizer U+0000
+        // escape cannot abort the clone on `to_jsonb` or arrive with its principal
+        // unstripped: escaped backslashes park on chr(1) (lossless, a `json` value's text
+        // cannot hold a raw control byte) so only a real NUL is removed, and chr(92)
+        // spells the backslash so no escape sequence reaches this source file.
+        r#"INSERT INTO draft (workspace_id, path, typ, value, created_at, email, base)
          SELECT $2, path, typ,
-                CASE WHEN typ IN ('script', 'flow')
-                     THEN to_json(to_jsonb(value) - 'on_behalf_of')
-                     ELSE value END,
-                created_at, email
-         FROM draft
-         WHERE workspace_id = $1 AND (email = $3 OR email IS NULL)",
+                to_json(
+                    CASE WHEN typ IN ('script', 'flow') THEN clean - 'on_behalf_of' ELSE clean END
+                    - CASE WHEN typ = 'flow' THEN 'version_id'
+                           WHEN typ IN ('app', 'raw_app') THEN 'parent_version'
+                           ELSE '' END
+                ),
+                created_at, email,
+                CASE WHEN typ = 'script' THEN base END
+         FROM (
+             SELECT d.path, d.typ, d.created_at, d.email, d.base,
+                    replace(replace(replace(d.value::text, chr(92) || chr(92), chr(1)), chr(92) || 'u0000', ''), chr(1), chr(92) || chr(92))::jsonb AS clean
+             FROM draft d
+             WHERE d.workspace_id = $1 AND (d.email = $3 OR d.email IS NULL)
+         ) s"#,
         source_workspace_id,
         target_workspace_id,
         authed_email,
@@ -7513,6 +8331,7 @@ async fn create_workspace_fork_branch(
     // dangling branch on the synced repos.
     check_fork_w_id_conflict(&db, &nw.id).await?;
     purge_stale_fork_diff_state(&db, &nw.id).await?;
+    validate_forked_datatables(&db, &authed, &w_id, &nw).await?;
 
     Ok(Json(
         handle_fork_branch_creation(&authed.email, &authed.username, &db, &w_id, &nw.id).await?,
@@ -7545,12 +8364,142 @@ async fn snapshot_datatable_schema(
         .map_err(|e| Error::internal_err(format!("Failed to serialize schema: {}", e)))
 }
 
-async fn apply_forked_datatable(
-    db: &DB,
+/// Turn every data table the fork chose to keep into a pointer at the parent's entry.
+///
+/// `clone_workspace_data` copies `workspace_settings` wholesale, so a kept data table arrives as a
+/// byte-identical copy naming the parent's database — including the parent's `permissions`, which
+/// a fork admin could then edit to widen their own access to it. A pointer has nothing local to
+/// edit: the parent's entry stays the only place the decision lives.
+///
+/// The cloned data tables are skipped: they own a fresh database of their own, and
+/// `apply_forked_datatable` has already dropped their copied `permissions` — for a clone of a data
+/// table under roles, in favor of `governed_by`.
+async fn point_kept_datatables_at_parent(
     tx: &mut Transaction<'_, Postgres>,
     parent_w_id: &str,
     forked_w_id: &str,
+    cloned: &[ForkedDatatableInfo],
+) -> Result<()> {
+    let settings: Option<serde_json::Value> = sqlx::query_scalar!(
+        "SELECT datatable FROM workspace_settings WHERE workspace_id = $1",
+        forked_w_id
+    )
+    .fetch_optional(&mut **tx)
+    .await?
+    .flatten();
+
+    let Some(mut settings) = settings else {
+        return Ok(());
+    };
+    let Some(datatables) = settings
+        .get_mut("datatables")
+        .and_then(|d| d.as_object_mut())
+    else {
+        return Ok(());
+    };
+
+    let mut changed = false;
+    for (name, entry) in datatables.iter_mut() {
+        if cloned.iter().any(|c| &c.name == name) {
+            continue;
+        }
+        let dt: DataTable = match serde_json::from_value(entry.clone()) {
+            Ok(dt) => dt,
+            Err(_) => continue,
+        };
+        // Already a pointer: the parent was itself a fork, and its entry names the workspace that
+        // governs. Following it from here is the same answer, so leave it alone.
+        if dt.reference.is_some() {
+            continue;
+        }
+        // Only instance databases. A resource-backed data table names a resource, and the settings
+        // clone gave the fork its own copy of that resource in its own workspace — pointing at the
+        // parent's entry would silently move the fork onto the parent's resource instead.
+        if dt
+            .database
+            .as_ref()
+            .is_none_or(|d| d.resource_type != DataTableCatalogResourceType::Instance)
+        {
+            continue;
+        }
+        *entry = serde_json::to_value(DataTable {
+            database: None,
+            reference: Some(windmill_common::workspaces::DataTableReference {
+                workspace_id: parent_w_id.to_string(),
+                datatable: name.clone(),
+            }),
+            governed_by: None,
+            forked_from: None,
+            migrations_enabled: dt.migrations_enabled,
+            permissions: None,
+        })
+        .map_err(|e| Error::internal_err(format!("serializing data table '{name}': {e}")))?;
+        changed = true;
+    }
+
+    if changed {
+        sqlx::query!(
+            "UPDATE workspace_settings SET datatable = $1 WHERE workspace_id = $2",
+            settings,
+            forked_w_id
+        )
+        .execute(&mut **tx)
+        .await?;
+    }
+    Ok(())
+}
+
+/// Move every pointer, and every clone's `governed_by`, in any workspace that names `(w_id, from)`
+/// to `(w_id, to)`.
+///
+/// `EXISTS` rather than a `LIKE` over the whole document: the update rewrites the row, so matching
+/// every workspace that holds any pointer would rewrite rows to a byte-identical value and hold an
+/// exclusive lock on them until commit.
+async fn repoint_datatable_references(
+    tx: &mut Transaction<'_, Postgres>,
+    w_id: &str,
+    from: &str,
+    to: &str,
+) -> Result<()> {
+    sqlx::query!(
+        r#"UPDATE workspace_settings ws
+           SET datatable = (
+               SELECT jsonb_set(ws.datatable, '{datatables}', jsonb_object_agg(
+                   dt.key,
+                   (SELECT CASE WHEN r.v->'governed_by'->>'workspace_id' = $1
+                                     AND r.v->'governed_by'->>'datatable' = $2
+                               THEN jsonb_set(r.v, '{governed_by,datatable}', to_jsonb($3::text))
+                               ELSE r.v END
+                    FROM (SELECT CASE WHEN dt.value->'reference'->>'workspace_id' = $1
+                                           AND dt.value->'reference'->>'datatable' = $2
+                                     THEN jsonb_set(dt.value, '{reference,datatable}', to_jsonb($3::text))
+                                     ELSE dt.value END AS v) r)
+               ))
+               FROM jsonb_each(ws.datatable->'datatables') dt
+           )
+           WHERE EXISTS (
+               SELECT 1 FROM jsonb_each(COALESCE(ws.datatable->'datatables', '{}'::jsonb)) d,
+                    LATERAL (VALUES ('reference'), ('governed_by')) k(link)
+               WHERE d.value->k.link->>'workspace_id' = $1
+                 AND d.value->k.link->>'datatable' = $2
+           )"#,
+        w_id,
+        from,
+        to,
+    )
+    .execute(&mut **tx)
+    .await?;
+    Ok(())
+}
+
+async fn apply_forked_datatable(
+    db: &DB,
+    tx: &mut Transaction<'_, Postgres>,
+    authed: &ApiAuthed,
+    parent_w_id: &str,
+    forked_w_id: &str,
     fdt: &ForkedDatatableInfo,
+    copy: &crate::datatable_clone::MadeCopy,
 ) -> Result<()> {
     windmill_common::validate_dbname(&fdt.new_dbname)?;
     if !fdt.new_dbname.starts_with("wm_fork_") {
@@ -7559,6 +8508,52 @@ async fn apply_forked_datatable(
             fdt.new_dbname
         )));
     }
+    // Held until the fork commits, as the permissions save holds them: the source moved onto
+    // another database, or put under roles or taken off them, since its copy was made would link
+    // the copy to roles its grants were not replayed for.
+    let locked = crate::datatable_clone::lock_settings_rows(tx, parent_w_id, &fdt.name).await?;
+    let governing = ensure_datatable_is_clonable(db, parent_w_id, &fdt.name).await?;
+    let under_roles = governing.datatable.permissions.is_some();
+    let unchanged = crate::datatable_clone::same_database(
+        &governing.datatable.database,
+        &Some(copy.source_database.clone()),
+    ) && copy.replayed == under_roles
+        && crate::datatable_clone::lock_settings_rows(tx, parent_w_id, &fdt.name).await? == locked;
+    if !unchanged {
+        return Err(Error::BadRequest(format!(
+            "Data table '{}' changed while it was being copied for this fork — its database, or \
+             whether it is under roles. Create the fork again.",
+            fdt.name
+        )));
+    }
+    // The fork keeps a snapshot of the source's schema, which under roles is only for those who may
+    // connect as one of them — as the copy itself was.
+    crate::datatable_permissions::ensure_reaches_governing_datatable(
+        db,
+        parent_w_id,
+        &fdt.name,
+        &governing,
+        authed,
+    )
+    .await?;
+    // Under roles, the copy holds rows the source's roles decide who reaches, so that entry keeps
+    // deciding. Settled from the source as it resolves now: the settings clone may have handed the
+    // fork a pointer, or a clone of its own. A copy of a data table without roles is the fork's,
+    // as it was before roles existed: everyone reached all of it already.
+    let governed_by = governing
+        .datatable
+        .permissions
+        .is_some()
+        .then(|| {
+            serde_json::to_value(governing.governor.clone().unwrap_or_else(|| {
+                windmill_common::workspaces::DataTableReference {
+                    workspace_id: governing.workspace_id.clone(),
+                    datatable: governing.name.clone(),
+                }
+            }))
+        })
+        .transpose()
+        .map_err(|e| Error::internal_err(format!("serializing a clone's governor: {e}")))?;
 
     // Snapshot the schema from the source (parent) datatable
     let schema = snapshot_datatable_schema(db, parent_w_id, &fdt.name).await?;
@@ -7583,33 +8578,63 @@ async fn apply_forked_datatable(
     let dt: DataTable = serde_json::from_value(config_val)
         .map_err(|e| Error::internal_err(format!("Failed to parse datatable config: {}", e)))?;
 
-    if dt.database.resource_type == DataTableCatalogResourceType::Instance {
-        // Instance: update resource_path to the new dbname
-        sqlx::query!(
+    // A clone owns its copy, so the fork's entry has to be terminal. When the parent was itself a
+    // fork the settings clone hands down a pointer instead, and what it points at is what the copy
+    // was taken from. `ensure_datatable_is_clonable` already settled that this shape can be
+    // cloned, so there is nothing left to refuse here — by now the database exists and is filled.
+    let database = match dt.database.clone() {
+        Some(database) => database,
+        None => governing.datatable.database.clone().ok_or_else(|| {
+            Error::internal_err(format!(
+                "Data table '{}' resolves to an entry that owns no database",
+                fdt.name
+            ))
+        })?,
+    };
+
+    if database.resource_type == DataTableCatalogResourceType::Instance {
+        // The whole `database` object, not just its `resource_path`: a pointer entry has none to
+        // patch. `reference` goes with it — exactly one of the two may be set.
+        let new_database = serde_json::json!({
+            "resource_type": "instance",
+            "resource_path": &fdt.new_dbname,
+        });
+        sqlx::query(
             r#"UPDATE workspace_settings
                SET datatable = jsonb_set(
-                   jsonb_set(datatable, ARRAY['datatables', $2, 'database', 'resource_path'], to_jsonb($3::text)),
-                   ARRAY['datatables', $2, 'forked_from'], $4::jsonb
-               )
+                   datatable #- ARRAY['datatables', $2, 'reference'],
+                   ARRAY['datatables', $2, 'database'], $3::jsonb)
                WHERE workspace_id = $1"#,
-            forked_w_id,
-            &fdt.name,
-            &fdt.new_dbname,
-            forked_from,
         )
+        .bind(forked_w_id)
+        .bind(&fdt.name)
+        .bind(new_database)
         .execute(&mut **tx)
         .await?;
     } else {
-        // Resource: update the resource's dbname and mark as ws_specific
-        let resource_path = &dt.database.resource_path;
-        sqlx::query!(
+        // Resource: point it at the copy and mark it ws_specific. What the settings clone carried is
+        // the source's resource and variables as they are now, which an edit made while the copy
+        // was being made can have changed, and changed back: the clone has to be what the copy's
+        // connection was resolved from.
+        let resource_path = &database.resource_path;
+        let cloned =
+            crate::datatable_clone::connection_snapshot(db, &mut **tx, forked_w_id, resource_path)
+                .await?;
+        if copy.connection.as_ref() != Some(&cloned) {
+            return Err(Error::BadRequest(format!(
+                "The resource of data table '{}' changed while it was being copied for this \
+                 fork. Create the fork again.",
+                fdt.name
+            )));
+        }
+        sqlx::query(
             r#"UPDATE resource
                SET value = jsonb_set(value, '{dbname}', to_jsonb($3::text))
                WHERE workspace_id = $1 AND path = $2"#,
-            forked_w_id,
-            resource_path,
-            &fdt.new_dbname,
         )
+        .bind(forked_w_id)
+        .bind(resource_path)
+        .bind(&fdt.new_dbname)
         .execute(&mut **tx)
         .await?;
 
@@ -7620,20 +8645,31 @@ async fn apply_forked_datatable(
         )
         .execute(&mut **tx)
         .await?;
-
-        // Set forked_from on the datatable config
-        sqlx::query!(
-            r#"UPDATE workspace_settings
-               SET datatable = jsonb_set(datatable, ARRAY['datatables', $2, 'forked_from'], $3::jsonb)
-               WHERE workspace_id = $1"#,
-            forked_w_id,
-            &fdt.name,
-            forked_from,
-        )
-        .execute(&mut **tx)
-        .await?;
     }
 
+    // The settings clone copied the source's `permissions` along, and a clone of a clone its
+    // `governed_by`: a clone keeps no `permissions` of its own, and a link only under roles.
+    sqlx::query(
+        r#"UPDATE workspace_settings
+           SET datatable = jsonb_set(
+               CASE WHEN $3::jsonb IS NULL
+                   THEN datatable #- ARRAY['datatables', $2, 'permissions']
+                                  #- ARRAY['datatables', $2, 'governed_by']
+                   ELSE jsonb_set(
+                       datatable #- ARRAY['datatables', $2, 'permissions'],
+                       ARRAY['datatables', $2, 'governed_by'], $3::jsonb)
+               END,
+               ARRAY['datatables', $2, 'forked_from'], $4::jsonb
+           )
+           WHERE workspace_id = $1"#,
+    )
+    .bind(forked_w_id)
+    .bind(&fdt.name)
+    .bind(governed_by)
+    .bind(forked_from)
+    .execute(&mut **tx)
+    .await?;
+
     Ok(())
 }
 
@@ -7968,7 +9004,169 @@ async fn create_workspace_fork(
         ensure_no_existing_dev_workspace(&db, &parent_workspace_id).await?;
     }
 
+    // Refused here, before any database exists; `make_copies` checks again under the locks.
+    validate_forked_datatables(&db, &authed, &parent_workspace_id, &nw).await?;
+
+    // Detached from the request: a client that goes away while the copies are made must still end
+    // with the fork created or no copy left behind, and dropping the handler's future would skip
+    // that cleanup.
+    tokio::spawn(async move {
+        let fork_id = nw.id.clone();
+        let copies = crate::datatable_clone::make_copies(
+            &db,
+            &authed,
+            &parent_workspace_id,
+            &copy_requests(&nw.forked_datatables),
+        )
+        .await?;
+        let replayed: Vec<DataTableForkBehavior> = copies
+            .iter()
+            .filter(|c| c.replayed)
+            .map(|c| c.behavior)
+            .collect();
+        match write_workspace_fork(
+            db.clone(),
+            authed,
+            parent_workspace_id,
+            nw,
+            dev_workspace_label,
+            &copies,
+        )
+        .await
+        {
+            Ok(message) => {
+                for behavior in replayed {
+                    windmill_common::feature_usage::log_feature_usage(
+                        "datatable",
+                        "clone_replayed",
+                        match behavior {
+                            DataTableForkBehavior::SchemaOnly => "schema_only",
+                            _ => "schema_and_data",
+                        },
+                    );
+                }
+                Ok(message)
+            }
+            // A commit whose acknowledgement was lost can still have committed, and a concurrent
+            // request for the same id can have: once the write has settled, the cleanup keeps
+            // whichever copies a committed fork names, and drops the rest.
+            Err(e) => match wait_for_fork_write(&db, &fork_id).await {
+                Ok(()) => Err(crate::datatable_clone::drop_copies_after(&db, copies, e).await),
+                Err(settle) => {
+                    tracing::error!(
+                        "Could not tell whether fork '{fork_id}' was created, so its copies were \
+                         kept: {settle}"
+                    );
+                    Err(e)
+                }
+            },
+        }
+    })
+    .await
+    .map_err(|e| Error::internal_err(format!("Creating the fork stopped unexpectedly: {e}")))?
+}
+
+/// The database a data table of the fork or dev workspace `fork_id` is copied into, as the wizard
+/// and the CLI derive it. A dev workspace's id has no `wm-fork-` prefix, and its copies are dropped
+/// by the same `wm_fork_` rule as a fork's. Dev workspace `x` and fork `wm-fork-x` share a name, as
+/// their branches do: the second to copy a data table of that name is refused at `CREATE`.
+fn forked_datatable_dbname(fork_id: &str, datatable: &str) -> String {
+    let suffix = fork_id
+        .strip_prefix(windmill_common::workspaces::WM_FORK_PREFIX)
+        .unwrap_or(fork_id);
+    format!("wm_fork_{}__{datatable}", suffix.replace('-', "_"))
+}
+
+/// Wait until no transaction writing fork `fork_id` is still running: the lock
+/// `write_workspace_fork` holds until its transaction ends is taken and released.
+async fn wait_for_fork_write(db: &DB, fork_id: &str) -> Result<()> {
+    let mut tx = db.begin().await?;
+    sqlx::query("SELECT pg_advisory_xact_lock(hashtext('fork:' || $1))")
+        .bind(fork_id)
+        .execute(&mut *tx)
+        .await?;
+    tx.commit().await?;
+    Ok(())
+}
+
+/// Everything about a fork's data tables that can be refused before a git branch or a database is
+/// created, and that the fork request re-checks.
+///
+/// Every data table is copied by the fork request, into a database it creates: an entry naming a
+/// database that already exists could reach a copy made for another fork — one left behind by a
+/// deleted fork included — without that copy's governance.
+async fn validate_forked_datatables(
+    db: &DB,
+    authed: &ApiAuthed,
+    parent_w_id: &str,
+    nw: &CreateWorkspaceFork,
+) -> Result<()> {
+    let mut names = HashSet::new();
+    for fdt in &nw.forked_datatables {
+        if fdt.fork_behavior.is_none() {
+            return Err(Error::BadRequest(format!(
+                "Data table '{}' names no `fork_behavior`: the fork request makes the copy of each \
+                 data table itself. Update the Windmill CLI.",
+                fdt.name
+            )));
+        }
+        let expected = forked_datatable_dbname(&nw.id, &fdt.name);
+        if fdt.new_dbname != expected {
+            return Err(Error::BadRequest(format!(
+                "Data table '{}' of fork '{}' is copied into database '{expected}', not '{}'",
+                fdt.name, nw.id, fdt.new_dbname
+            )));
+        }
+        if !names.insert(fdt.name.as_str()) {
+            return Err(Error::BadRequest(format!(
+                "Data table '{}' is named more than once in this fork",
+                fdt.name
+            )));
+        }
+    }
+    crate::datatable_clone::authorize_copies(
+        db,
+        authed,
+        parent_w_id,
+        &copy_requests(&nw.forked_datatables),
+    )
+    .await
+}
+
+/// The copies a fork request asks this request to make. [`validate_forked_datatables`] refuses an
+/// entry without a `fork_behavior`.
+fn copy_requests(
+    forked_datatables: &[ForkedDatatableInfo],
+) -> Vec<crate::datatable_clone::CopyRequest<'_>> {
+    forked_datatables
+        .iter()
+        .filter_map(|fdt| {
+            fdt.fork_behavior
+                .map(|behavior| crate::datatable_clone::CopyRequest {
+                    name: &fdt.name,
+                    dbname: &fdt.new_dbname,
+                    behavior,
+                })
+        })
+        .collect()
+}
+
+/// Write the fork, with its data tables pointed at `copies`.
+async fn write_workspace_fork(
+    db: DB,
+    authed: ApiAuthed,
+    parent_workspace_id: String,
+    nw: CreateWorkspaceFork,
+    dev_workspace_label: Option<String>,
+    copies: &[crate::datatable_clone::MadeCopy],
+) -> Result<String> {
     let mut tx: Transaction<'_, Postgres> = db.begin().await?;
+    // Held until this transaction ends: after an error, the copies' cleanup waits on it, so it reads
+    // whether the fork exists only once a commit still being resolved has settled.
+    sqlx::query("SELECT pg_advisory_xact_lock(hashtext('fork:' || $1))")
+        .bind(&nw.id)
+        .execute(&mut *tx)
+        .await?;
 
     if nw.is_dev_workspace {
         // The checks above ran outside a transaction, so the parent's eligibility and the chain's
@@ -8018,8 +9216,19 @@ async fn create_workspace_fork(
     // intended. Dev creation is already admin-gated, so this is transitively admin-only too. Done before
     // the explicit creator insert below so the creator (a parent member) is copied with full metadata
     // (operator/role/is_service_account/added_via), not the bare row the insert alone would leave.
+    // Independently, the parent's admins can have every fork of it start with its admins and
+    // developers; the forker cannot opt out, since the point is that those admins can review it.
     if nw.copy_members && nw.is_dev_workspace {
-        copy_workspace_members(&mut tx, &parent_workspace_id, &forked_id).await?;
+        copy_workspace_members(&mut tx, &parent_workspace_id, &forked_id, false).await?;
+    } else if sqlx::query_scalar!(
+        "SELECT add_admins_and_developers_to_forks FROM workspace_settings WHERE workspace_id = $1",
+        parent_workspace_id
+    )
+    .fetch_optional(&mut *tx)
+    .await?
+    .unwrap_or(false)
+    {
+        copy_workspace_members(&mut tx, &parent_workspace_id, &forked_id, true).await?;
     }
 
     // Ensure the creator is a member of the fork even without copy_members (or if they aren't a parent
@@ -8038,6 +9247,14 @@ async fn create_workspace_fork(
     .execute(&mut *tx)
     .await?;
 
+    // The pointers this fork writes to the parent's data tables stay invisible until it commits, so
+    // a rename of one of them cannot carry them. Holding the parent's settings row makes such a
+    // rename wait for this commit, and makes the copy below read one that committed first.
+    sqlx::query("SELECT 1 FROM workspace_settings WHERE workspace_id = $1 FOR SHARE")
+        .bind(&parent_workspace_id)
+        .execute(&mut *tx)
+        .await?;
+
     // Clone all data from the parent workspace using Rust implementation
     if let Err(e) =
         clone_workspace_data(&mut tx, &db, &parent_workspace_id, &forked_id, &authed).await
@@ -8073,11 +9290,53 @@ async fn create_workspace_fork(
     // re-enables in the fork, with parent-conflict warnings on enable.
     clone_triggers_and_schedules(&mut tx, &parent_workspace_id, &forked_id).await?;
 
+    repoint_unresolvable_cloned_identities(&mut tx, &forked_id, &authed).await?;
+
+    // Held until the fork commits, as settings saves naming these databases hold it: an entry
+    // saved elsewhere while a copy was being made would reach it without the governance written
+    // below, and the alias check on that save saw no governed entry yet.
+    let instance_copies: Vec<&str> = copies
+        .iter()
+        .filter(|c| c.source_database.resource_type == DataTableCatalogResourceType::Instance)
+        .map(|c| c.dbname.as_str())
+        .collect();
+    windmill_common::lock_instance_databases(&mut tx, instance_copies.iter().copied()).await?;
+    for dbname in &instance_copies {
+        let users = windmill_common::instance_database_users(&mut *tx, dbname).await?;
+        if !users.is_empty() {
+            return Err(Error::BadRequest(format!(
+                "Database '{dbname}' copied for this fork is already used by workspaces {}; \
+                 fork again",
+                users.join(", ")
+            )));
+        }
+    }
+
     // Update forked datatable settings to point to new databases
     for fdt in &nw.forked_datatables {
-        apply_forked_datatable(&db, &mut tx, &parent_workspace_id, &forked_id, fdt).await?;
+        let copy = copies.iter().find(|c| c.name == fdt.name).ok_or_else(|| {
+            Error::internal_err(format!("No copy was made of data table '{}'", fdt.name))
+        })?;
+        apply_forked_datatable(
+            &db,
+            &mut tx,
+            &authed,
+            &parent_workspace_id,
+            &forked_id,
+            fdt,
+            copy,
+        )
+        .await?;
     }
 
+    point_kept_datatables_at_parent(
+        &mut tx,
+        &parent_workspace_id,
+        &forked_id,
+        &nw.forked_datatables,
+    )
+    .await?;
+
     // The settings clone copies the source's ducklake config verbatim — including a parent
     // fork's own `fork_behavior` stamps. Sharing is a per-fork-creation choice, never
     // inherited: reset any cloned stamps first, then apply this fork's requested list.
@@ -8126,6 +9385,20 @@ async fn create_workspace_fork(
         .await?;
     }
 
+    let copied = copies
+        .iter()
+        .map(|c| {
+            format!(
+                "{} ({})",
+                c.name,
+                match c.behavior {
+                    DataTableForkBehavior::SchemaOnly => "schema_only",
+                    _ => "schema_and_data",
+                }
+            )
+        })
+        .collect::<Vec<_>>()
+        .join(", ");
     audit_log(
         &mut *tx,
         &authed,
@@ -8133,7 +9406,7 @@ async fn create_workspace_fork(
         ActionKind::Create,
         &forked_id,
         Some(nw.name.as_str()),
-        None,
+        (!copied.is_empty()).then(|| [("copied_datatables", copied.as_str())].into()),
     )
     .await?;
     tx.commit().await?;
@@ -8880,13 +10153,33 @@ async fn leave_workspace(
 ) -> Result<String> {
     windmill_api_auth::forbid_job_token_account_destruction(&authed)?;
     let mut tx = db.begin().await?;
-    sqlx::query!(
+    // The membership is what made `u/<username>` mean this person. Leaving it behind in a tenant
+    // list would hand their data table access back on rejoin, or to whoever takes the name next.
+    windmill_common::workspaces::remove_datatable_tenant_in_workspace(
+        &mut tx,
+        &w_id,
+        &format!("u/{}", authed.username),
+    )
+    .await?;
+    let left = sqlx::query!(
         "DELETE FROM usr WHERE workspace_id = $1 AND email = $2",
         &w_id,
         &authed.email
     )
     .execute(&mut *tx)
-    .await?;
+    .await?
+    .rows_affected();
+    // A superadmin deploys from workspaces it is no member of; leaving none is no reason to drop
+    // its connection.
+    if left > 0 {
+        sqlx::query!(
+            "DELETE FROM remote_deploy_token WHERE email = $1 AND workspace_id = $2",
+            &authed.email,
+            &w_id
+        )
+        .execute(&mut *tx)
+        .await?;
+    }
 
     audit_log(
         &mut *tx,
diff --git a/backend/windmill-api-workspaces/src/workspaces_extra.rs b/backend/windmill-api-workspaces/src/workspaces_extra.rs
index e75f0d1ef2..9039bda2ef 100644
--- a/backend/windmill-api-workspaces/src/workspaces_extra.rs
+++ b/backend/windmill-api-workspaces/src/workspaces_extra.rs
@@ -113,7 +113,7 @@ pub(crate) async fn change_workspace_id(
     // Duplicate workspace settings (keep copy in old workspace for reference)
     info!("Duplicating workspace_settings table");
     sqlx::query!(
-        "INSERT INTO workspace_settings (workspace_id, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url) SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url FROM workspace_settings WHERE workspace_id = $2",
+        "INSERT INTO workspace_settings (workspace_id, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url, add_admins_and_developers_to_forks, remote_deploy_target, remote_deploy_target_changed_at) SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url, add_admins_and_developers_to_forks, remote_deploy_target, remote_deploy_target_changed_at FROM workspace_settings WHERE workspace_id = $2",
         &rw.new_id,
         &old_id
     )
@@ -382,6 +382,13 @@ pub(crate) async fn change_workspace_id(
     )
     .execute(&mut *tx)
     .await?;
+    sqlx::query!(
+        "UPDATE draft_move SET workspace_id = $1 WHERE workspace_id = $2",
+        &rw.new_id,
+        &old_id
+    )
+    .execute(&mut *tx)
+    .await?;
 
     info!("Updating favorite table");
     sqlx::query!(
@@ -492,6 +499,34 @@ pub(crate) async fn change_workspace_id(
     .fetch_all(&mut *tx)
     .await?;
 
+    // A fork's data table entry names the workspace that governs it by id, so the rename has to
+    // follow there too — anywhere, not just in the reparented children: a detached workspace can
+    // point at this one without being its fork. Left behind, the pointer resolves to the archived
+    // shell and every job through it stops. A clone's `governed_by` names it the same way.
+    info!("Re-pointing data table references to the new workspace id");
+    sqlx::query!(
+        r#"UPDATE workspace_settings ws
+           SET datatable = (
+               SELECT jsonb_set(ws.datatable, '{datatables}', jsonb_object_agg(
+                   dt.key,
+                   (SELECT CASE WHEN r.v->'governed_by'->>'workspace_id' = $2
+                               THEN jsonb_set(r.v, '{governed_by,workspace_id}', to_jsonb($1::text))
+                               ELSE r.v END
+                    FROM (SELECT CASE WHEN dt.value->'reference'->>'workspace_id' = $2
+                                     THEN jsonb_set(dt.value, '{reference,workspace_id}', to_jsonb($1::text))
+                                     ELSE dt.value END AS v) r)
+               ))
+               FROM jsonb_each(ws.datatable->'datatables') dt
+           )
+           WHERE jsonb_typeof(ws.datatable->'datatables') = 'object'
+             AND (ws.datatable::text LIKE '%"reference"%'
+                  OR ws.datatable::text LIKE '%"governed_by"%')"#,
+        &rw.new_id,
+        &old_id,
+    )
+    .execute(&mut *tx)
+    .await?;
+
     info!("Updating workspace_protection_rule table");
     sqlx::query!(
         "UPDATE workspace_protection_rule SET workspace_id = $1 WHERE workspace_id = $2",
@@ -806,6 +841,14 @@ pub(crate) async fn change_workspace_id(
     .execute(&mut *tx)
     .await?;
 
+    sqlx::query!(
+        "UPDATE remote_deploy_token SET workspace_id = $1 WHERE workspace_id = $2",
+        &rw.new_id,
+        &old_id
+    )
+    .execute(&mut *tx)
+    .await?;
+
     info!("Updating variable table");
     sqlx::query!(
         "UPDATE variable SET workspace_id = $1 WHERE workspace_id = $2",
@@ -971,6 +1014,24 @@ pub(crate) async fn delete_workspace(
     // but the destructive cleanup itself runs only after the commit below: a delete that
     // fails mid-way must never leave a live workspace with its fork data destroyed and no
     // registry row to retry from. Read-only: nothing is dropped here.
+    // Read before the delete: another workspace's data table entry can point at one of this
+    // workspace's, or be a clone taking its roles from one, and deleting the workspace it names
+    // leaves it resolving to nothing. Nothing sweeps them — turning them back into copies would
+    // hand each fork the database outright — so the deleter is told which data tables they just
+    // stranded.
+    let stranded_pointers = sqlx::query_as::<_, (String, String)>(
+        r#"SELECT ws.workspace_id, dt.key
+           FROM workspace_settings ws
+           CROSS JOIN LATERAL jsonb_each(COALESCE(ws.datatable->'datatables', '{}'::jsonb)) dt
+           WHERE dt.value->'reference'->>'workspace_id' = $1
+              OR dt.value->'governed_by'->>'workspace_id' = $1
+           ORDER BY ws.workspace_id, dt.key"#,
+    )
+    .bind(&w_id)
+    .fetch_all(&db)
+    .await
+    .unwrap_or_default();
+
     let fork_ducklake_cleanups = prepare_fork_ducklake_cleanups(&db, &w_id, None)
         .await
         .unwrap_or_else(|e| {
@@ -1289,7 +1350,23 @@ pub(crate) async fn delete_workspace(
         tracing::warn!("failed to broadcast fork lineage change: {e:#}");
     }
 
-    Ok(format!("Deleted workspace {}", &w_id))
+    if stranded_pointers.is_empty() {
+        Ok(format!("Deleted workspace {}", &w_id))
+    } else {
+        let stranded = stranded_pointers
+            .iter()
+            .map(|(workspace_id, datatable)| format!("{workspace_id}/{datatable}"))
+            .collect::<Vec<_>>()
+            .join(", ");
+        Ok(format!(
+            concat!(
+                "Deleted workspace {}. These data tables were governed by it and no longer ",
+                "resolve: {}. Their databases still exist; a superadmin can point them at ",
+                "another workspace's data table."
+            ),
+            &w_id, stranded
+        ))
+    }
 }
 
 #[derive(Deserialize)]
@@ -1343,15 +1420,20 @@ pub async fn drop_forked_datatable_databases(
     let mut errors: Vec<String> = Vec::new();
 
     for dt_name in &req.datatable_names {
-        let dt = match datatables.get(dt_name) {
-            Some(dt) if dt.forked_from.is_some() => dt,
+        // Only a clone is droppable, and a clone is terminal by construction: a kept data table is
+        // a pointer at the parent's database, which this fork does not own.
+        let database = match datatables.get(dt_name) {
+            Some(dt) if dt.forked_from.is_some() => match dt.database.as_ref() {
+                Some(database) => database,
+                None => continue,
+            },
             _ => continue,
         };
 
-        if dt.database.resource_type
+        if database.resource_type
             == windmill_common::workspaces::DataTableCatalogResourceType::Instance
         {
-            let db_to_drop = &dt.database.resource_path;
+            let db_to_drop = &database.resource_path;
             if !db_to_drop.starts_with("wm_fork_") {
                 errors.push(format!(
                     "Refusing to drop instance database '{}' for datatable://{}:  name does not start with 'wm_fork_'",
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 364e8ef674..21ca421af3 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.814.0
+  version: 1.817.0
   title: Windmill API
 
   contact:
@@ -1588,6 +1588,89 @@ paths:
                 additionalProperties:
                   $ref: "#/components/schemas/CustomInstanceDb"
 
+  /settings/datatable_roles:
+    get:
+      summary: list the instance's data table roles
+      operationId: listInstanceDatatableRoles
+      tags:
+        - setting
+      responses:
+        "200":
+          description: the instance role catalog
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/InstanceDatatableRole"
+    post:
+      summary: create a data table role on the instance's Postgres cluster
+      operationId: createInstanceDatatableRole
+      tags:
+        - setting
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [name]
+              properties:
+                name:
+                  type: string
+      responses:
+        "200":
+          description: the created role
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/InstanceDatatableRole"
+
+  /settings/datatable_roles/{id}:
+    post:
+      summary: rename a data table role or turn its login on and off
+      operationId: updateInstanceDatatableRole
+      tags:
+        - setting
+      parameters:
+        - in: path
+          name: id
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                name:
+                  type: string
+                enabled:
+                  type: boolean
+      responses:
+        "200":
+          description: the updated role
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/InstanceDatatableRole"
+    delete:
+      summary: drop a data table role from the cluster and from every workspace that named it
+      operationId: deleteInstanceDatatableRole
+      tags:
+        - setting
+      parameters:
+        - in: path
+          name: id
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: deleted
+
   /settings/setup_custom_instance_pg_database/{name}:
     post:
       summary: Runs CREATE DATABASE on the Windmill Postgres and grants access to the custom_instance_user
@@ -1679,6 +1762,26 @@ paths:
               schema:
                 type: string
 
+  /settings/instance_ui:
+    get:
+      summary: get the instance-wide announcement banner and accent color
+      description: |
+        Readable by any authenticated user; every page load reads it. Each value
+        is the raw stored setting, or null when unset.
+      operationId: getInstanceUi
+      tags:
+        - setting
+      responses:
+        "200":
+          description: the instance_banner and accent_color settings
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  instance_banner: {}
+                  accent_color: {}
+
   /settings_u/ruff_config:
     get:
       summary: get instance ruff config (unauthenticated)
@@ -3983,9 +4086,13 @@ paths:
                   guest_access_enabled:
                     type: boolean
                     description: Whether this workspace admits guest sessions. An app's own `guest` execution mode is inert while this is false.
+                  add_admins_and_developers_to_forks:
+                    type: boolean
+                    description: Whether every new fork of this workspace starts with its admins and developers as members, keeping their role.
                 required:
                   - workspace_id
                   - guest_access_enabled
+                  - add_admins_and_developers_to_forks
 
   /w/{workspace}/workspaces/get_settings:
     get:
@@ -4076,6 +4183,9 @@ paths:
                   guest_jwt_jwks_url:
                     type: string
                     description: JWKS URL a guest JWT (`jwt_guest_`) is verified against for this workspace. Mutually exclusive with `guest_jwt_public_key`.
+                  add_admins_and_developers_to_forks:
+                    type: boolean
+                    description: Whether every new fork of this workspace starts with its admins and developers as members, keeping their role.
 
   /w/{workspace}/workspaces/get_deploy_to:
     get:
@@ -4097,6 +4207,100 @@ paths:
                   deploy_to:
                     type: string
 
+  /w/{workspace}/remote_deploy/target:
+    get:
+      summary: get the workspace's deploy target on another instance, and the caller's connection to it
+      description: |
+        Once connected, deploy calls aimed at the target go through
+        `/w/{workspace}/remote_deploy/proxy/{proxy_key}/{route}`, which forwards any method to
+        `{base_url}/api/w/{target workspace}/{route}` with the caller's stored token.
+      operationId: getRemoteDeployTarget
+      tags:
+        - workspace
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+      responses:
+        "200":
+          description: remote deploy target and the caller's connection to it
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/RemoteDeployStatus"
+    post:
+      summary: set or clear the workspace's deploy target on another instance
+      description: Changing the target drops every token stored for the previous one.
+      operationId: setRemoteDeployTarget
+      tags:
+        - workspace
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                target:
+                  $ref: "#/components/schemas/RemoteDeployTarget"
+      responses:
+        "200":
+          description: status
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/remote_deploy/connect:
+    post:
+      summary: store the caller's own token for the remote deploy target
+      description: |
+        The token is checked against the target's whoami before it is stored. `target` names the
+        target the token was obtained for, and the request is refused if the workspace now points
+        elsewhere, so a token is never sent to an instance it was not meant for.
+      operationId: connectRemoteDeploy
+      tags:
+        - workspace
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                token:
+                  type: string
+                target:
+                  $ref: "#/components/schemas/RemoteDeployTarget"
+              required:
+                - token
+                - target
+      responses:
+        "200":
+          description: the stored connection
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/RemoteDeployConnection"
+
+  /w/{workspace}/remote_deploy/disconnect:
+    post:
+      summary: forget the caller's token for the remote deploy target
+      operationId: disconnectRemoteDeploy
+      tags:
+        - workspace
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+      responses:
+        "200":
+          description: status
+          content:
+            text/plain:
+              schema:
+                type: string
+
   /w/{workspace}/workspaces/is_premium:
     get:
       summary: get if workspace is premium
@@ -5141,7 +5345,7 @@ paths:
                 type: array
                 items:
                   type: object
-                  required: [name, resource_type, resource_path]
+                  required: [name, resource_type, resource_path, permissioned]
                   properties:
                     name:
                       type: string
@@ -5150,6 +5354,188 @@ paths:
                       enum: [postgres, instance]
                     resource_path:
                       type: string
+                    governing_workspace_id:
+                      type: string
+                    permissioned:
+                      type: boolean
+
+  /w/{workspace}/workspaces/datatable_permissions/{datatable_name}:
+    get:
+      summary: get who may connect to a data table as which role
+      operationId: getDatatablePermissions
+      tags:
+        - workspace
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: datatable_name
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: the data table's roles and their tenants
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/DatatablePermissions"
+    post:
+      summary: set who may connect to a data table as which role
+      operationId: setDatatablePermissions
+      tags:
+        - workspace
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: datatable_name
+          in: path
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [permissioned]
+              properties:
+                permissioned:
+                  type: boolean
+                default_role:
+                  type: string
+                roles:
+                  type: array
+                  items:
+                    $ref: "#/components/schemas/DatatableRoleTenants"
+      responses:
+        "200":
+          description: status
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/workspaces/datatable_acl/{datatable_name}:
+    get:
+      summary: read the owner and grants of an instance data table's database, schema or table
+      operationId: getDatatableAcl
+      tags:
+        - workspace
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: datatable_name
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: kind
+          in: query
+          required: true
+          schema:
+            type: string
+            enum: [database, schema, table]
+        - name: schema
+          in: query
+          required: false
+          schema:
+            type: string
+        - name: table
+          in: query
+          required: false
+          schema:
+            type: string
+      responses:
+        "200":
+          description: owner and grants
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/DatatableAclInfo"
+
+  /w/{workspace}/workspaces/datatable_acl/{datatable_name}/plan:
+    post:
+      summary: preview the SQL an ownership or grant change would run (data table administrators only)
+      operationId: planDatatableAcl
+      tags:
+        - workspace
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: datatable_name
+          in: path
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/AclChangeRequest"
+      responses:
+        "200":
+          description: statements that would run, in a single transaction
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AclPlan"
+
+  /w/{workspace}/workspaces/datatable_acl/{datatable_name}/apply:
+    post:
+      summary: run an ownership or grant change exactly as planned (data table administrators only)
+      operationId: applyDatatableAcl
+      tags:
+        - workspace
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: datatable_name
+          in: path
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/AclChangeRequest"
+      responses:
+        "200":
+          description: change applied
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/workspaces/datatable_usable_roles/{datatable_name}:
+    get:
+      summary: list the data table roles the caller may connect as
+      operationId: listUsableDatatableRoles
+      tags:
+        - workspace
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: datatable_name
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: usable roles
+          content:
+            application/json:
+              schema:
+                type: object
+                required: [permissioned, roles, default_role]
+                properties:
+                  permissioned:
+                    type: boolean
+                  roles:
+                    type: array
+                    items:
+                      type: string
+                  default_role:
+                    type: string
 
   /w/{workspace}/workspaces/list_datatable_schemas:
     get:
@@ -5223,6 +5609,21 @@ paths:
         - workspace
       parameters:
         - $ref: "#/components/parameters/WorkspaceId"
+        - name: datatable_name
+          in: query
+          description: list only this data table; each listed data table opens a connection to its database
+          schema:
+            type: string
+        - name: role_for
+          in: query
+          description: the data table `role` applies to; every other one is listed as its default role
+          schema:
+            type: string
+        - name: role
+          in: query
+          description: the role to list `role_for` as; refused, in that entry's `error`, if the caller may not use it
+          schema:
+            type: string
       responses:
         "200":
           description: table metadata of all datatables
@@ -5256,6 +5657,11 @@ paths:
           required: true
           schema:
             type: string
+        - name: role
+          in: query
+          description: the data table role to read the table as; defaults to the data table's default role
+          schema:
+            type: string
       responses:
         "200":
           description: schema of one datatable table
@@ -5331,7 +5737,22 @@ paths:
           description: status
           content:
             application/json:
-              schema: {}
+              schema:
+                type: object
+                properties:
+                  stranded_references:
+                    description: >-
+                      Data tables in other workspaces that were governed by one this save deleted
+                      and no longer resolve.
+                    type: array
+                    items:
+                      type: object
+                      required: [workspace_id, datatable]
+                      properties:
+                        workspace_id:
+                          type: string
+                        datatable:
+                          type: string
 
   /w/{workspace}/workspaces/run_datatable_migrations/{datatable_name}:
     post:
@@ -6100,6 +6521,39 @@ paths:
               schema:
                 type: string
 
+  /w/{workspace}/workspaces/edit_add_admins_and_developers_to_forks:
+    post:
+      summary: choose whether new forks of this workspace start with its admins and developers
+      description: >-
+        When on, every fork created from this workspace gets the workspace's admins and
+        developers as members, with the role they hold here; operators, disabled users and
+        service accounts are left out. The setting is copied into each fork, so forks of a
+        fork follow it too. Off by default. Workspace-admin gated.
+      operationId: editAddAdminsAndDevelopersToForks
+      tags:
+        - workspace
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+      requestBody:
+        description: Whether new forks start with this workspace's admins and developers
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                add_admins_and_developers_to_forks:
+                  type: boolean
+              required:
+                - add_admins_and_developers_to_forks
+      responses:
+        "200":
+          description: status
+          content:
+            text/plain:
+              schema:
+                type: string
+
   /w/{workspace}/workspaces/edit_guest_jwt_key:
     post:
       summary: set the key guest JWTs are verified against for this workspace
@@ -10133,8 +10587,49 @@ paths:
                   current_timestamp:
                     type: string
                     format: date-time
+                  path:
+                    type: string
+                    description: "`saved` only, upsert or delete: where the write landed. Differs from the URL path when the item had moved away from it; the editor follows it there. Absent when a delete found nothing to remove and the caller cannot read the path it moved to."
                 required: [status, current_timestamp]
 
+  /w/{workspace}/drafts/move/{kind}/{path}:
+    post:
+      summary: move the current user's draft-only item to another path
+      description: Relocates the authed user's own draft row, along with both path keys inside its value (the typed path and the mirror the editors keep beside it). Only for draft-only items — a deployed item must be moved through its own deploy endpoint, which carries every draft with it. Restricted to script, flow, app and raw_app; any other kind is rejected with 400, because only these keep their deploy target where this endpoint rewrites it.
+      operationId: moveDraft
+      tags:
+        - draft
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: kind
+          in: path
+          required: true
+          description: script, flow, app or raw_app only.
+          schema:
+            type: string
+            enum: [script, flow, app, raw_app]
+        - $ref: "#/components/parameters/ScriptPath"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                new_path:
+                  type: string
+                summary:
+                  type: string
+                  description: Also restate the draft's summary.
+              required: [new_path]
+      responses:
+        "200":
+          description: move result
+          content:
+            text/plain:
+              schema:
+                type: string
+
   /w/{workspace}/drafts/migrate_legacy/{kind}/{path}:
     post:
       summary: resolve a legacy (workspace-level) draft (admin only)
@@ -10190,6 +10685,9 @@ paths:
         - kind
         - tag
         - deployment_message
+        - schema
+      x-mcp-tool-opaque-fields:
+        - schema
       tags:
         - script
       parameters:
@@ -10229,6 +10727,9 @@ paths:
         - kind
         - tag
         - deployment_message
+        - schema
+      x-mcp-tool-opaque-fields:
+        - schema
       tags:
         - script
       parameters:
@@ -10645,6 +11146,8 @@ paths:
       parameters:
         - $ref: "#/components/parameters/WorkspaceId"
         - $ref: "#/components/parameters/ScriptPath"
+        - $ref: "#/components/parameters/Page"
+        - $ref: "#/components/parameters/PerPage"
       responses:
         "200":
           description: script history
@@ -12050,6 +12553,8 @@ paths:
       parameters:
         - $ref: "#/components/parameters/WorkspaceId"
         - $ref: "#/components/parameters/ScriptPath"
+        - $ref: "#/components/parameters/Page"
+        - $ref: "#/components/parameters/PerPage"
       tags:
         - flow
       responses:
@@ -13928,6 +14433,8 @@ paths:
       parameters:
         - $ref: "#/components/parameters/WorkspaceId"
         - $ref: "#/components/parameters/ScriptPath"
+        - $ref: "#/components/parameters/Page"
+        - $ref: "#/components/parameters/PerPage"
       responses:
         "200":
           description: app history
@@ -14195,9 +14702,9 @@ paths:
         "200":
           description: app updated
           content:
-            text/plain:
+            application/json:
               schema:
-                type: string
+                $ref: "#/components/schemas/AppDeployed"
 
   /w/{workspace}/apps/create_raw_source:
     post:
@@ -14337,9 +14844,9 @@ paths:
         "200":
           description: app updated
           content:
-            text/plain:
+            application/json:
               schema:
-                type: string
+                $ref: "#/components/schemas/AppDeployed"
 
   /w/{workspace}/apps/update_raw/{path}:
     post:
@@ -14393,9 +14900,9 @@ paths:
         "200":
           description: app updated
           content:
-            text/plain:
+            application/json:
               schema:
-                type: string
+                $ref: "#/components/schemas/AppDeployed"
 
   /w/{workspace}/apps/custom_path_exists/{custom_path}:
     get:
@@ -15803,6 +16310,29 @@ paths:
                 items:
                   type: string
 
+  /w/{workspace}/jobs/queue/run_now/{id}:
+    post:
+      summary: start a queued job scheduled for later now
+      description: |
+        Moves the start of a queued job that is waiting for a future time (scheduled, debounced,
+        re-scheduled by a concurrency limit, or a flow step waiting on a sleep or a retry delay)
+        to now, keeping the same job id. A job with a
+        concurrency limit is still checked against its limit when it is pulled. A schedule's
+        upcoming tick is refused, since the schedule would queue that tick again.
+      operationId: runQueuedJobNow
+      tags:
+        - job
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/JobId"
+      responses:
+        "200":
+          description: job id
+          content:
+            text/plain:
+              schema:
+                type: string
+
   /w/{workspace}/jobs/queue/cancel_selection:
     post:
       summary: cancel jobs based on the given uuids
@@ -27443,6 +27973,13 @@ components:
         draft_saved_at:
           type: string
           format: date-time
+        draft_base:
+          type: string
+          description: |
+            The deployed version the draft forked from, as text whatever the
+            kind (script hash, flow version id, app version id). Compare to the
+            deployed head to tell a draft that is behind. Absent when there is
+            no draft or it was never forked from a deploy.
         no_deployed:
           type: boolean
         draft:
@@ -28572,6 +29109,15 @@ components:
           type: object
           additionalProperties:
             $ref: "#/components/schemas/ModelPriceOverride"
+        context_window_per_model:
+          type: object
+          description: >-
+            Context window in tokens per `provider:model`, overriding the built-in
+            table the AI chat uses to decide when to compact its history.
+          additionalProperties:
+            type: integer
+            minimum: 1024
+            maximum: 10000000
         copilot_disabled:
           type: boolean
           description: >-
@@ -29225,6 +29771,15 @@ components:
           type: string
         schema:
           type: object
+          description: >-
+            JSON Schema of the arguments of `main`, which is what a run form and an
+            MCP tool offer. Omitted (or `{}`), it is inferred from `content` for
+            TypeScript, Python, Go, Bash, PowerShell, SQL, GraphQL and Ansible
+            scripts. For other languages, or code that does not parse, a new script
+            gets none. A new version of an existing script also keeps what the
+            previous version's schema says about each argument, or that whole schema
+            when nothing can be inferred. A dbt script always takes its schema from its
+            descriptor, whatever is sent.
         is_template:
           type: boolean
         lock:
@@ -29338,6 +29893,11 @@ components:
           type: string
         deployment_msg:
           type: string
+        created_at:
+          type: string
+          format: date-time
+        created_by:
+          type: string
       required:
         - script_hash
 
@@ -30640,6 +31200,7 @@ components:
             - "jobs"
             - "jobs.cancel"
             - "jobs.force_cancel"
+            - "jobs.run_now"
             - "jobs.disapproval"
             - "jobs.delete"
             - "account.delete"
@@ -33393,6 +33954,8 @@ components:
           $ref: "#/components/schemas/LoggedWizardStatus"
         replication_user_error:
           type: string
+        user_connect:
+          $ref: "#/components/schemas/LoggedWizardStatus"
 
     CustomInstanceDbTag:
       type: string
@@ -33400,6 +33963,327 @@ components:
         - ducklake
         - datatable
 
+    InstanceDatatableRole:
+      type: object
+      required: [id, name, enabled]
+      properties:
+        id:
+          type: string
+        name:
+          type: string
+        enabled:
+          type: boolean
+
+    DatatableRoleTenants:
+      type: object
+      required: [id, tenants]
+      properties:
+        id:
+          type: string
+        name:
+          type: string
+        tenants:
+          type: array
+          items:
+            type: string
+
+    DatatablePermissions:
+      type: object
+      required: [supported, permissioned, default_role, roles, editable, available_roles]
+      properties:
+        supported:
+          type: boolean
+          description: >-
+            Whether this data table can be put under roles at all. Only one backed by the
+            instance database can: a role is a login on that cluster.
+        permissioned:
+          type: boolean
+        default_role:
+          type: string
+        roles:
+          type: array
+          items:
+            $ref: "#/components/schemas/DatatableRoleTenants"
+        governing_workspace_id:
+          type: string
+        clone_of:
+          type: object
+          description: for a clone, the data table whose roles it takes
+          required: [workspace_id, datatable]
+          properties:
+            workspace_id:
+              type: string
+            datatable:
+              type: string
+        editable:
+          type: boolean
+        available_roles:
+          type: array
+          items:
+            $ref: "#/components/schemas/InstanceDatatableRole"
+        ungoverned_reachers:
+          type: array
+          items:
+            type: object
+            required: [workspace_id, datatable]
+            properties:
+              workspace_id:
+                type: string
+              datatable:
+                type: string
+
+    AclTarget:
+      description: what access is read or changed on
+      oneOf:
+        - $ref: "#/components/schemas/AclTargetDatabase"
+        - $ref: "#/components/schemas/AclTargetSchema"
+        - $ref: "#/components/schemas/AclTargetTable"
+      discriminator:
+        propertyName: kind
+        mapping:
+          database: "#/components/schemas/AclTargetDatabase"
+          schema: "#/components/schemas/AclTargetSchema"
+          table: "#/components/schemas/AclTargetTable"
+
+    AclTargetDatabase:
+      type: object
+      required: [kind]
+      properties:
+        kind:
+          type: string
+          enum: [database]
+
+    AclTargetSchema:
+      type: object
+      required: [kind, schema]
+      properties:
+        kind:
+          type: string
+          enum: [schema]
+        schema:
+          type: string
+
+    AclTargetTable:
+      type: object
+      required: [kind, schema, table]
+      properties:
+        kind:
+          type: string
+          enum: [table]
+        schema:
+          type: string
+        table:
+          type: string
+
+    AclChange:
+      description: one change to plan or apply
+      oneOf:
+        - $ref: "#/components/schemas/AclChangeSetOwner"
+        - $ref: "#/components/schemas/AclChangeGrant"
+        - $ref: "#/components/schemas/AclChangeRevoke"
+      discriminator:
+        propertyName: type
+        mapping:
+          set_owner: "#/components/schemas/AclChangeSetOwner"
+          grant: "#/components/schemas/AclChangeGrant"
+          revoke: "#/components/schemas/AclChangeRevoke"
+
+    AclChangeSetOwner:
+      type: object
+      description: >-
+        hands the target to role — for a schema, with everything already in it but an extension's
+        members, which stay with the extension
+      required: [type, role]
+      properties:
+        type:
+          type: string
+          enum: [set_owner]
+        role:
+          type: string
+          description: a data table role of the instance, or admin
+
+    AclChangeGrant:
+      type: object
+      required: [type, role, privileges, scope]
+      properties:
+        type:
+          type: string
+          enum: [grant]
+        role:
+          type: string
+          description: a data table role of the instance, or admin
+        privileges:
+          type: array
+          items:
+            type: string
+        scope:
+          $ref: "#/components/schemas/AclGrantScope"
+
+    AclChangeRevoke:
+      type: object
+      required: [type, role, privileges, scope]
+      properties:
+        type:
+          type: string
+          enum: [revoke]
+        role:
+          type: string
+          description: a data table role of the instance, other than admin
+        privileges:
+          type: array
+          items:
+            type: string
+        scope:
+          $ref: "#/components/schemas/AclGrantScope"
+        objects:
+          type: array
+          description: >-
+            objects inside the target the revoke covers, empty for the target itself. Only with the
+            target scope; a revoke on all objects of a kind is refused, since it cannot say which
+            grants it takes back.
+          items:
+            $ref: "#/components/schemas/AclObject"
+
+    AclGrantScope:
+      type: string
+      enum:
+        [
+          target,
+          all_tables,
+          all_sequences,
+          all_functions,
+          future_tables,
+          future_sequences,
+          future_functions,
+        ]
+
+    AclChangeRequest:
+      type: object
+      required: [target, change]
+      properties:
+        target:
+          $ref: "#/components/schemas/AclTarget"
+        change:
+          $ref: "#/components/schemas/AclChange"
+        statements:
+          type: array
+          description: >-
+            The statements the plan showed. Required to apply, which plans again and refuses if
+            the result differs.
+          items:
+            type: string
+
+    AclPlan:
+      type: object
+      required: [statements, warnings]
+      properties:
+        statements:
+          type: array
+          items:
+            type: string
+        warnings:
+          type: array
+          items:
+            type: string
+
+    AclObject:
+      type: object
+      required: [name, kind]
+      properties:
+        name:
+          type: string
+        kind:
+          type: string
+          description: >-
+            TABLE, SEQUENCE, FUNCTION, PROCEDURE or TYPE — what the object is. A revoke turns it
+            into the keyword it takes, ROUTINE for both routine kinds; a type's grants are read
+            only.
+        args:
+          type: string
+          description: identity arguments of a routine, which is what tells two of the same name apart
+
+    AclGrant:
+      type: object
+      required: [grantee, privileges, sources]
+      properties:
+        grantee:
+          type: string
+        privileges:
+          type: array
+          items:
+            type: string
+        object:
+          $ref: "#/components/schemas/AclObject"
+        future:
+          type: string
+          description: >-
+            set for a default privilege, naming the kind of object it covers (TABLES, SEQUENCES,
+            FUNCTIONS, TYPES, or SCHEMAS). On a schema, the defaults set in that schema; on the
+            database, the ones set database-wide, which apply in every schema and which no schema's
+            own defaults take back.
+        sources:
+          type: array
+          description: >-
+            the roles the grant comes from, each once — who granted it, or for a default privilege
+            the role whose future objects it covers. A revoke of some of the grant's privileges
+            takes them back from every source that gave them.
+          items:
+            $ref: "#/components/schemas/AclSource"
+
+    AclSource:
+      type: object
+      required: [role, privileges, reachable]
+      properties:
+        role:
+          type: string
+        privileges:
+          type: array
+          description: >-
+            what role gave of the grant's privileges. A revoke is held back only by a source out of
+            reach that gave some of what it takes back.
+          items:
+            type: string
+        reachable:
+          type: boolean
+          description: >-
+            whether the data table's connection can take back what role gave. On an object that is
+            the owner, when the connection acts for the owner, and otherwise the connection itself;
+            for a default privilege, a creating role the connection acts for. What a source out of
+            reach gave is not revocable from here; privileges only other sources gave still are.
+
+    DatatableAclInfo:
+      type: object
+      required: [owner, roles, editable, clone, supports_maintain, dbname, grants, children]
+      properties:
+        owner:
+          type: string
+        roles:
+          type: array
+          description: the roles a change may name; empty unless the caller may change anything
+          items:
+            type: string
+        editable:
+          type: boolean
+          description: whether the caller may plan and apply changes
+        clone:
+          type: boolean
+          description: whether this is a clone, whose grants stay as they were copied
+        supports_maintain:
+          type: boolean
+          description: whether the server is Postgres 17+, which added the MAINTAIN table privilege
+        dbname:
+          type: string
+          description: the database the target lives in
+        grants:
+          type: array
+          items:
+            $ref: "#/components/schemas/AclGrant"
+        children:
+          type: array
+          description: a database's schemas, or a schema's tables
+          items:
+            type: string
+
     CustomInstanceDb:
       type: object
       required:
@@ -34482,6 +35366,9 @@ components:
                 nullable: true
               disabled:
                 type: boolean
+              is_service_account:
+                type: boolean
+                description: Whether this membership is a service account.
             required:
               - id
               - name
@@ -34533,6 +35420,16 @@ components:
               new_dbname:
                 type: string
                 description: "New database name for the fork"
+              fork_behavior:
+                type: string
+                enum:
+                  - schema_only
+                  - schema_and_data
+                description: >-
+                  What the fork request copies into `new_dbname`, which it creates — with the
+                  owners and grants of a data table under roles. This server refuses an entry
+                  without it; servers predating it expect `new_dbname` created and filled
+                  beforehand.
         shared_ducklakes:
           type: array
           items:
@@ -35171,6 +36068,20 @@ components:
         - raw_app
 
 
+    AppDeployed:
+      type: object
+      description: "What a deploy of an existing app answers with. `version` is the one this call wrote, which is what an editor pins as the fork base of the draft it starts next: reading the head back afterwards cannot tell it from a deploy that landed beside it. A metadata-only update writes none and reports the head it kept."
+      properties:
+        path:
+          type: string
+          description: Where the app now lives, which differs from the request path on a rename.
+        version:
+          type: integer
+          format: int64
+      required:
+        - path
+        - version
+
     AppHistory:
       type: object
       properties:
@@ -35178,6 +36089,11 @@ components:
           type: integer
         deployment_msg:
           type: string
+        created_at:
+          type: string
+          format: date-time
+        created_by:
+          type: string
       required:
         - version
 
@@ -35247,6 +36163,8 @@ components:
           format: date-time
         deployment_msg:
           type: string
+        created_by:
+          type: string
       required:
         - id
         - created_at
@@ -35448,9 +36366,11 @@ components:
           type: object
           additionalProperties:
             type: object
-            required: [database]
             properties:
               database:
+                description: >-
+                  Set on an entry that owns its database. Absent on a fork's entry, which points at
+                  another workspace's data table instead.
                 type: object
                 properties:
                   resource_type:
@@ -35462,6 +36382,28 @@ components:
                     type: string
                 required:
                   - resource_type
+              reference:
+                description: >-
+                  The workspace and data table that govern this one. Server-owned: written by fork
+                  creation, and carried across a settings save whatever the request says.
+                type: object
+                required: [workspace_id, datatable]
+                properties:
+                  workspace_id:
+                    type: string
+                  datatable:
+                    type: string
+              governed_by:
+                description: >-
+                  On a clone, the data table it was copied from, whose roles it takes. Server-owned
+                  like `reference`.
+                type: object
+                required: [workspace_id, datatable]
+                properties:
+                  workspace_id:
+                    type: string
+                  datatable:
+                    type: string
               migrations_enabled:
                 type: boolean
                 description: Whether the SQL migrations feature is opted in for this data table
@@ -35530,7 +36472,17 @@ components:
 
     DataTableTables:
       type: object
-      required: [datatable_name, schemas]
+      required:
+        [
+          datatable_name,
+          schemas,
+          instance,
+          permissioned,
+          usable_roles,
+          default_role,
+          can_create_schema,
+          creatable_schemas,
+        ]
       properties:
         datatable_name:
           type: string
@@ -35543,6 +36495,26 @@ components:
               type: string
         error:
           type: string
+        instance:
+          type: boolean
+          description: on the instance database, the only kind that can be under roles or have its access edited
+        permissioned:
+          type: boolean
+        usable_roles:
+          type: array
+          description: the roles the caller may connect as, by name; empty when not under roles
+          items:
+            type: string
+        default_role:
+          type: string
+        can_create_schema:
+          type: boolean
+          description: whether the role the listing connected as may create schemas
+        creatable_schemas:
+          type: array
+          description: the schemas the role the listing connected as may create in
+          items:
+            type: string
 
     DataTableTableSchema:
       type: object
@@ -35713,6 +36685,44 @@ components:
           items:
             $ref: "#/components/schemas/GitSyncObjectType"
 
+    RemoteDeployTarget:
+      type: object
+      properties:
+        base_url:
+          type: string
+          description: root URL of the remote Windmill instance, without /api
+        workspace_id:
+          type: string
+          description: workspace on the remote instance that deploys land in
+      required:
+        - base_url
+        - workspace_id
+
+    RemoteDeployConnection:
+      type: object
+      properties:
+        remote_email:
+          type: string
+          description: identity the stored token has on the remote instance
+        proxy_key:
+          type: string
+          description: goes in every proxy URL, `/w/{workspace}/remote_deploy/proxy/{proxy_key}/{route}`
+        connected_at:
+          type: string
+          format: date-time
+      required:
+        - remote_email
+        - proxy_key
+        - connected_at
+
+    RemoteDeployStatus:
+      type: object
+      properties:
+        target:
+          $ref: "#/components/schemas/RemoteDeployTarget"
+        connection:
+          $ref: "#/components/schemas/RemoteDeployConnection"
+
     WorkspaceDefaultScripts:
       type: object
       properties:
diff --git a/backend/windmill-api/src/ai.rs b/backend/windmill-api/src/ai.rs
index 1710db9cec..16b4b17141 100644
--- a/backend/windmill-api/src/ai.rs
+++ b/backend/windmill-api/src/ai.rs
@@ -23,7 +23,7 @@ use windmill_ai::ai_cache::current_instance_ai_config_revision;
 use windmill_ai::ai_providers::{
     empty_string_as_none, AIPlatform, AIProvider, ProviderConfig, ProviderModel,
 };
-use windmill_ai::ai_types::MAX_MODEL_RATE;
+use windmill_ai::ai_types::{validate_token_limit, CONTEXT_WINDOWS, MAX_MODEL_RATE, OUTPUT_LIMITS};
 use windmill_ai::credentials::ProviderCredentials;
 #[cfg(feature = "bedrock")]
 use windmill_ai::providers::bedrock::{
@@ -445,6 +445,11 @@ pub struct AIConfig {
     /// Only models whose rates differ from the built-in table are stored.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub model_pricing: Option<HashMap<String, ModelPriceOverride>>,
+    /// Per-model context windows the chat budgets its history against, keyed
+    /// `provider:model` like `max_tokens_per_model`. Overrides the client's built-in
+    /// table, which a model served through a custom endpoint is usually missing from.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub context_window_per_model: Option<HashMap<String, i32>>,
     /// Hides the Windmill AI assistant (chat, sessions, generation, completion, fixes) from
     /// the workspace UI. Only the workspace's own row is consulted: the flag holds even when
     /// the providers served come from the instance config or the free tier. AI agent steps
@@ -508,6 +513,18 @@ impl AIConfig {
         Ok(())
     }
 
+    pub fn validate_token_limits(&self) -> Result<()> {
+        for (entries, bounds) in [
+            (&self.context_window_per_model, &CONTEXT_WINDOWS),
+            (&self.max_tokens_per_model, &OUTPUT_LIMITS),
+        ] {
+            for (key, tokens) in entries.iter().flatten() {
+                validate_token_limit(bounds, key, i64::from(*tokens)).map_err(Error::BadRequest)?;
+            }
+        }
+        Ok(())
+    }
+
     pub fn validate_sessions_retention(&self) -> Result<()> {
         match self.sessions_retention_days {
             Some(days) if !(1..=MAX_SESSIONS_RETENTION_DAYS).contains(&days) => {
diff --git a/backend/windmill-api/src/apps.rs b/backend/windmill-api/src/apps.rs
index 918fce53bf..54886e2568 100644
--- a/backend/windmill-api/src/apps.rs
+++ b/backend/windmill-api/src/apps.rs
@@ -69,8 +69,8 @@ use windmill_common::{
     user_drafts::{overlay_or_draft_only, DraftUserRef, UserDraftItemKind, WithDraftOverlay},
     users::username_to_permissioned_as,
     utils::{
-        http_get_from_hub, not_found_if_none, paginate, query_elems_from_hub, require_admin,
-        strip_json_nul, Pagination, RunnableKind, StripPath,
+        check_proper_path, http_get_from_hub, not_found_if_none, paginate, paginate_optional,
+        query_elems_from_hub, require_admin, strip_json_nul, Pagination, RunnableKind, StripPath,
     },
     variables::{build_crypt, build_crypt_with_key_suffix, encrypt},
     worker::{to_raw_value, CLOUD_HOSTED},
@@ -274,6 +274,12 @@ pub struct AppHistory {
     pub version: i64,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub deployment_msg: Option<String>,
+    /// Who deployed this version, and when — the diff's version picker names them so
+    /// a reader can tell their own deploys from a teammate's.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub created_by: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub created_at: Option<chrono::DateTime<chrono::Utc>>,
 }
 
 #[derive(Deserialize)]
@@ -567,6 +573,17 @@ pub struct CreateApp {
     pub skip_draft_deletion: Option<bool>,
 }
 
+/// What a deploy of an existing app answers with. `version` is the one this call wrote,
+/// which is what an editor pins as the fork base of the draft it starts next: reading the
+/// head back afterwards cannot tell it from a deploy that landed beside it. A
+/// metadata-only update writes none and reports the head it kept.
+#[derive(Serialize)]
+pub struct AppDeployed {
+    /// Where the app now lives, which differs from the request path on a rename.
+    pub path: String,
+    pub version: i64,
+}
+
 #[derive(Serialize, Deserialize)]
 pub struct EditApp {
     pub path: Option<String>,
@@ -1220,18 +1237,42 @@ async fn get_app_history(
     authed: ApiAuthed,
     Extension(user_db): Extension<UserDB>,
     Path((w_id, path)): Path<(String, StripPath)>,
+    Query(pagination): Query<Pagination>,
 ) -> JsonResult<Vec<AppHistory>> {
     let path = path.to_path();
     check_scopes(&authed, || format!("apps:read:{}", &path))?;
+    // Unasked-for, this listing stays whole: the deployment-history panel reads it
+    // without paging. The diff picker asks for a page.
+    let (per_page, offset) = paginate_optional(pagination);
     let mut tx = user_db.begin(&authed).await?;
+    // Newest first in deployed order, which is a version's position in `app.versions` and
+    // not its `created_at`: the latter is the deploying transaction's start time, so two
+    // that overlap can carry it in the opposite order from the one they landed in. A row
+    // outside the array never sat in that sequence, so it sorts after the ones that did.
+    // Paging happens before the metadata joins, so a page costs its own rows.
     let query_result = sqlx::query!(
-        "SELECT a.id as app_id, av.id as version_id, dm.deployment_msg as deployment_msg
-        FROM app a LEFT JOIN app_version av ON a.id = av.app_id LEFT JOIN deployment_metadata dm ON av.id = dm.app_version
+        "SELECT a.id as app_id, av.id as version_id, dm.deployment_msg as deployment_msg,
+                av.created_by as created_by, av.created_at as created_at
+        FROM app a
+        JOIN LATERAL (
+            SELECT av2.id, COALESCE(v.ord, 0) AS ord
+            FROM app_version av2
+            LEFT JOIN unnest(a.versions) WITH ORDINALITY AS v(id, ord) ON v.id = av2.id
+            WHERE av2.app_id = a.id
+            ORDER BY ord DESC, av2.id DESC
+            LIMIT $3 OFFSET $4
+        ) page ON TRUE
+        JOIN app_version av ON av.id = page.id
+        LEFT JOIN deployment_metadata dm ON av.id = dm.app_version
         WHERE a.workspace_id = $1 AND a.path = $2
-        ORDER BY created_at DESC",
+        ORDER BY page.ord DESC",
         w_id,
         path,
-    ).fetch_all(&mut *tx).await?;
+        per_page,
+        offset,
+    )
+    .fetch_all(&mut *tx)
+    .await?;
     tx.commit().await?;
 
     let result: Vec<AppHistory> = query_result
@@ -1240,6 +1281,8 @@ async fn get_app_history(
             app_id: row.app_id,
             version: row.version_id,
             deployment_msg: row.deployment_msg,
+            created_by: Some(row.created_by),
+            created_at: Some(row.created_at),
         })
         .collect();
     return Ok(Json(result));
@@ -1253,14 +1296,22 @@ async fn get_latest_version(
     let path = path.to_path();
     check_scopes(&authed, || format!("apps:read:{}", path))?;
     let mut tx = user_db.begin(&authed).await?;
+    // The head is the tail of `app.versions` — the version the runtime serves. Deploys
+    // append to it under the app row's lock, whereas `app_version.created_at` is the
+    // deploying transaction's start time, so two that overlap can carry it in either
+    // order and the newest timestamp is then not the one that landed last.
     let row = sqlx::query!(
-        "SELECT a.id as app_id, av.id as version_id, dm.deployment_msg as deployment_msg
-        FROM app a LEFT JOIN app_version av ON a.id = av.app_id LEFT JOIN deployment_metadata dm ON av.id = dm.app_version
-        WHERE a.workspace_id = $1 AND a.path = $2
-        ORDER BY created_at DESC",
+        "SELECT a.id as app_id, av.id as version_id, dm.deployment_msg as deployment_msg,
+                av.created_by as created_by, av.created_at as created_at
+        FROM app a JOIN app_version av
+             ON av.id = a.versions[array_upper(a.versions, 1)] AND av.app_id = a.id
+        LEFT JOIN deployment_metadata dm ON av.id = dm.app_version
+        WHERE a.workspace_id = $1 AND a.path = $2",
         w_id,
         path,
-    ).fetch_optional(&mut *tx).await?;
+    )
+    .fetch_optional(&mut *tx)
+    .await?;
     tx.commit().await?;
 
     if let Some(row) = row {
@@ -1268,6 +1319,8 @@ async fn get_latest_version(
             app_id: row.app_id,
             version: row.version_id,
             deployment_msg: row.deployment_msg,
+            created_by: Some(row.created_by),
+            created_at: Some(row.created_at),
         };
 
         return Ok(Json(Some(result)));
@@ -2453,6 +2506,7 @@ async fn create_app_internal<'a>(
     // inside process_app_multipart!, so checking after this call would leave a
     // denied app committed in the DB.
     check_scopes(&authed, || format!("apps:write:{}", &app.path))?;
+    check_proper_path(&app.path)?;
     validate_frontend_sdk_scopes(&app.policy)?;
     if raw_app {
         validate_raw_app_path_keys(&app.value.0)?;
@@ -2591,6 +2645,14 @@ async fn create_app_internal<'a>(
         .execute(&mut *tx)
         .await?;
     }
+    windmill_common::user_drafts::clear_draft_moves_from(
+        &mut tx,
+        &w_id,
+        &[UserDraftItemKind::App, UserDraftItemKind::RawApp],
+        &app.path,
+        None,
+    )
+    .await?;
     let id = sqlx::query_scalar!(
         "INSERT INTO app
             (workspace_id, path, summary, policy, versions, custom_path, labels)
@@ -2947,7 +3009,7 @@ async fn update_app(
     Extension(webhook): Extension<WebhookShared>,
     Path((w_id, path)): Path<(String, StripPath)>,
     Json(ns): Json<EditApp>,
-) -> Result<String> {
+) -> JsonResult<AppDeployed> {
     if authed.is_operator {
         return Err(Error::NotAuthorized(
             "Operators cannot update apps for security reasons".to_string(),
@@ -2986,7 +3048,7 @@ async fn update_app(
         },
     );
 
-    Ok(format!("app {} updated (npath: {:?})", opath, npath))
+    Ok(Json(AppDeployed { path: npath, version: v_id }))
 }
 
 /// Deploy a raw app from its sources, compiling them on a worker. `update_raw`
@@ -3000,7 +3062,7 @@ async fn update_app_raw_source(
     Extension(webhook): Extension<WebhookShared>,
     Path((w_id, path)): Path<(String, StripPath)>,
     Json(ns): Json<EditApp>,
-) -> Result<String> {
+) -> JsonResult<AppDeployed> {
     if authed.is_operator {
         return Err(Error::NotAuthorized(
             "Operators cannot update apps for security reasons".to_string(),
@@ -3098,7 +3160,7 @@ async fn update_app_raw_source(
         },
     );
 
-    Ok(format!("app {} updated (npath: {:?})", opath, npath))
+    Ok(Json(AppDeployed { path: npath, version: v_id }))
 }
 
 /// Whether the caller may create an app at `path` — asked of the database rather
@@ -3191,6 +3253,7 @@ async fn create_app_raw_source(
     // Before the compile, which costs a job on a worker: it must not run for a
     // path already taken, nor for one the caller can't write. `create_app_internal`
     // rejects both, but only after the sources have been built.
+    check_proper_path(&path)?;
     if app_exists(&db, &w_id, &path).await? {
         return Err(Error::BadRequest(format!("App {path} already exists")));
     }
@@ -3324,7 +3387,7 @@ async fn update_app_raw<'a>(
     Extension(webhook): Extension<WebhookShared>,
     Path((w_id, path)): Path<(String, StripPath)>,
     multipart: Multipart,
-) -> Result<String> {
+) -> JsonResult<AppDeployed> {
     if authed.is_operator {
         return Err(Error::NotAuthorized(
             "Operators cannot update apps for security reasons".to_string(),
@@ -3372,7 +3435,7 @@ async fn update_app_raw<'a>(
         },
     );
 
-    Ok(format!("app {} updated (npath: {:?})", opath, npath))
+    Ok(Json(AppDeployed { path: npath, version: v_id }))
 }
 // async fn create_app_internal<'a>(
 //     authed: ApiAuthed,
@@ -3401,6 +3464,9 @@ async fn update_app_internal<'a>(
     // the token's write scope, not just the source path.
     if let Some(npath) = ns.path.as_deref() {
         check_scopes(&authed, || format!("apps:write:{}", npath))?;
+        if npath != path {
+            check_proper_path(npath)?;
+        }
     }
 
     if raw_app {
@@ -3749,6 +3815,19 @@ async fn update_app_internal<'a>(
         .execute(&mut *tx)
         .await?;
     }
+    if npath != path {
+        // Everything left at the old path is a draft this deploy didn't consume
+        // — teammates' rows, and the deployer's own when the caller asked us to
+        // keep it. Carry them rather than strand them.
+        windmill_common::user_drafts::move_drafts_for_path(
+            &mut tx,
+            &w_id,
+            &[UserDraftItemKind::App, UserDraftItemKind::RawApp],
+            path,
+            &npath,
+        )
+        .await?;
+    }
     audit_log(
         &mut *tx,
         &authed,
@@ -4376,9 +4455,11 @@ async fn execute_component(
     // — like `/jobs/run/preview` — confine it to worker tags the caller may use
     // (a `if_jobs:filter_tags`-restricted token must not escape its filter).
     // `is_preview` implies an authed caller (the guard above returns otherwise).
+    let push_args = PushArgs { args: &args.args, extra: args.extra };
     if is_preview {
         if let Some(authed) = opt_authed.as_ref() {
-            crate::jobs::check_tag_available_for_workspace(&db, &w_id, &tag, authed).await?;
+            crate::jobs::check_tag_available_for_workspace(&db, &w_id, &tag, &push_args, authed)
+                .await?;
         }
     }
     // Identity is already resolved to the requesting user in preview mode (the
@@ -4409,7 +4490,7 @@ async fn execute_component(
         tx,
         &w_id,
         job_payload,
-        PushArgs { args: &args.args, extra: args.extra },
+        push_args,
         &username,
         email,
         permissioned_as,
diff --git a/backend/windmill-api/src/capture.rs b/backend/windmill-api/src/capture.rs
index 2e2058ea80..6255b5eb13 100644
--- a/backend/windmill-api/src/capture.rs
+++ b/backend/windmill-api/src/capture.rs
@@ -567,6 +567,9 @@ async fn set_config(
     };
 
     let mut tx = user_db.begin(&authed).await?;
+    if matches!(nc.trigger_kind, TriggerKind::Postgres) {
+        windmill_common::datatable_roles::lock_datatable_streams(&mut *tx, false).await?;
+    }
 
     sqlx::query!(
         r#"
@@ -614,6 +617,9 @@ async fn ping_config(
     )>,
 ) -> Result<()> {
     let mut tx = user_db.begin(&authed).await?;
+    if matches!(trigger_kind, TriggerKind::Postgres) {
+        windmill_common::datatable_roles::lock_datatable_streams(&mut *tx, false).await?;
+    }
 
     sqlx::query!(
         r#"
diff --git a/backend/windmill-api/src/db.rs b/backend/windmill-api/src/db.rs
index e8a6858db7..9619e96ebc 100644
--- a/backend/windmill-api/src/db.rs
+++ b/backend/windmill-api/src/db.rs
@@ -372,7 +372,10 @@ pub async fn migrate(
     }
 
     crate::live_migrations::custom_migrations(&mut custom_migrator).await?;
-    Ok(None)
+    Ok(Some(crate::live_migrations::spawn_background_migrations(
+        db.clone(),
+        killpill_rx,
+    )))
 }
 
 pub async fn wait_for_migrations(
diff --git a/backend/windmill-api/src/drafts.rs b/backend/windmill-api/src/drafts.rs
index e5928f761e..8bcbb56384 100644
--- a/backend/windmill-api/src/drafts.rs
+++ b/backend/windmill-api/src/drafts.rs
@@ -19,7 +19,7 @@ use windmill_common::{
     error::{Error, Result},
     user_drafts::{DraftUserRef, UserDraftItemKind, ENCRYPTED_DRAFT_PREFIX},
     users::resolve_username_to_email,
-    utils::strip_json_nul,
+    utils::{check_proper_path, strip_json_nul},
     variables::{build_crypt, encrypt},
 };
 
@@ -29,6 +29,7 @@ pub fn workspaced_service() -> Router {
         .route("/get/{kind}/{*path}", get(get_draft_for_user))
         .route("/get_own/{kind}/{*path}", get(get_own_draft))
         .route("/update/{kind}/{*path}", post(update_draft))
+        .route("/move/{kind}/{*path}", post(move_draft))
         .route("/migrate_legacy/{kind}/{*path}", post(migrate_legacy_draft))
 }
 
@@ -320,12 +321,71 @@ pub struct SaveDraftResponse {
     /// On `saved`: when the change was applied (client remembers it as the
     /// next `last_sync`). On `conflict`: the existing row's `created_at`.
     pub current_timestamp: chrono::DateTime<chrono::Utc>,
+    /// `saved` only: where the write landed. Differs from the URL path when the item
+    /// had moved away from it; the editor follows it there. Absent when a delete found
+    /// nothing to remove and the caller cannot read the path it moved to.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub path: Option<String>,
 }
 
-/// Apply the current user's draft at (workspace, kind, path): non-null `value`
-/// upserts, `null` (or omitted) deletes. Either way, when the existing row is
-/// newer than `last_sync` (and `force` is false) the op is skipped and the
-/// response is `status = conflict` + the server's current timestamp.
+/// The version a draft forked from, as the editors write it into `draft.value`.
+/// Each kind names it differently and only one is ever set.
+#[derive(Deserialize)]
+struct DraftBaseVersion {
+    /// Scripts: hex-encoded script hash.
+    #[serde(default)]
+    parent_hash: Option<String>,
+    /// Flows: `flow_version.id`.
+    #[serde(default)]
+    version_id: Option<i64>,
+    /// Apps / raw apps: `app_version.id`.
+    #[serde(default)]
+    parent_version: Option<i64>,
+}
+
+impl DraftBaseVersion {
+    /// The base as the `draft.base` column stores it: one opaque text id whatever
+    /// the kind, so a reader compares it to the head without knowing the kind's
+    /// own field name or type.
+    fn as_text(&self, kind: UserDraftItemKind) -> Option<String> {
+        use UserDraftItemKind::*;
+        match kind {
+            Script => self.parent_hash.clone(),
+            Flow => self.version_id.map(|v| v.to_string()),
+            _ => self.parent_version.map(|v| v.to_string()),
+        }
+    }
+}
+
+/// The version this draft forked from, or `None` when it has none — a kind
+/// that keeps no lineage, a malformed payload, or a draft that was never forked
+/// from a deploy. Pure: no queries.
+fn draft_lineage(kind: UserDraftItemKind, value: &str) -> Option<DraftBaseVersion> {
+    use UserDraftItemKind::*;
+    if !matches!(kind, Script | Flow | App | RawApp) {
+        return None;
+    }
+    let base = serde_json::from_str::<DraftBaseVersion>(value).ok()?;
+    let has_base = match kind {
+        Script => base
+            .parent_hash
+            .as_deref()
+            .and_then(|h| windmill_common::scripts::to_i64(h).ok())
+            .is_some(),
+        Flow => base.version_id.is_some(),
+        _ => base.parent_version.is_some(),
+    };
+    has_base.then_some(base)
+}
+
+/// Apply the current user's draft: non-null `value` upserts, `null` (or
+/// omitted) deletes. Either way, when the existing row is newer than
+/// `last_sync` (and `force` is false) the op is skipped and the response is
+/// `status = conflict` + the server's current timestamp.
+///
+/// A save addressed to a path its item moved away from lands where the move took
+/// the drafts (`draft_move`), unless the caller still has a draft of their own at
+/// that path. The response names where it landed.
 async fn update_draft(
     authed: ApiAuthed,
     Extension(db): Extension<DB>,
@@ -334,7 +394,7 @@ async fn update_draft(
     Json(req): Json<SaveDraftRequest>,
 ) -> Result<Json<SaveDraftResponse>> {
     let email = &authed.email;
-    let path = path.to_path();
+    let url_path = path.to_path();
     // Saving a draft requires write permission on the underlying path. Deleting
     // (discarding) one's OWN draft does not: the email-scoped row belongs to the
     // authed user, so they can always discard it even after losing write access
@@ -343,11 +403,68 @@ async fn update_draft(
     // touch the caller's own row. Legacy (NULL-email) rows aren't owned by anyone
     // — they keep the write gate.
     let is_own_discard = req.value.is_none() && !req.legacy;
+    // `legacy` targets the workspace-level row and is delete-only: an upsert writes the
+    // caller's own row whatever it says. Every read of that rule goes through this.
+    let legacy_delete = req.value.is_none() && req.legacy;
+
+    // Whose row this write is for: the caller's, or the workspace-level one on a legacy
+    // DELETE (`legacy` is delete-only, so an upsert is the caller's own row either way).
+    // It picks both the record that applies — an item's move (`email IS NULL`) covers the
+    // legacy row too, since the same rename carried it — and the draft whose presence
+    // means this path is still the write's own.
+    let owner: Option<&str> = (!legacy_delete).then_some(email.as_str());
+    // The caller's own draft-only move outranks the move of the deployed item. Only the
+    // kinds whose value carries a deploy target are ever recorded as moved, so for the
+    // rest this would be a guaranteed-empty query on the autosave hot path.
+    let moved_to = match kind.typed_path_field() {
+        None => None,
+        Some(_) => {
+            sqlx::query_scalar!(
+                r#"SELECT m.new_path FROM draft_move m
+           WHERE m.workspace_id = $1 AND m.typ = $2 AND m.old_path = $3
+             AND (m.email IS NULL OR m.email = $4)
+             AND NOT EXISTS (
+                 SELECT 1 FROM draft d
+                 WHERE d.workspace_id = $1 AND d.typ = $2 AND d.path = $3
+                   AND d.email IS NOT DISTINCT FROM $4
+             )
+           ORDER BY m.email IS NULL
+           LIMIT 1"#,
+                &w_id,
+                kind as UserDraftItemKind,
+                url_path,
+                owner,
+            )
+            .fetch_optional(&db)
+            .await?
+        }
+    };
+    let path: &str = moved_to.as_deref().unwrap_or(url_path);
+
+    // Everything past here writes, so the gate applies from here on. Answered
+    // without the path when the item moved: it may have gone somewhere the caller
+    // cannot see.
     if !is_own_discard {
-        require_can_write_path(&authed, &db, &user_db, &w_id, kind, path).await?;
+        match require_can_write_path(&authed, &db, &user_db, &w_id, kind, path).await {
+            // Naming the move is for whoever was editing the item: it tells them why a
+            // save they were already making stopped landing. Someone who cannot read the
+            // path they addressed gets the plain denial, or the wording itself would
+            // answer whether an item was moved away from a path they only guessed at.
+            Err(Error::NotAuthorized(e)) if moved_to.is_some() => {
+                return Err(Error::NotAuthorized(
+                    match require_can_read_path(&authed, &user_db, &w_id, kind, url_path).await {
+                        Ok(()) => {
+                            "this draft's item was moved to a path you cannot write".to_string()
+                        }
+                        Err(_) => e,
+                    },
+                ));
+            }
+            other => other?,
+        }
     }
 
-    let applied_at = if let Some(value) = &req.value {
+    let applied = if let Some(value) = &req.value {
         // Secret variable values must never sit in `draft.value` in plaintext
         // (see `encrypt_secret_variable_value`).
         let serialized = if kind == UserDraftItemKind::Variable {
@@ -359,19 +476,49 @@ async fn update_draft(
         // escape and later make any `->>`/`to_jsonb` extraction raise `22P05`.
         // Strip it here so a NUL never reaches the column.
         let serialized = strip_json_nul(&serialized);
+        // `base` is derived here from the value's per-kind field rather than sent
+        // by the client, so every writer (editors, chat, CLI) fills it the same way.
+        // Read from the sanitized text, which is what the value column gets: a NUL in the
+        // lineage field otherwise costs the draft its base (the hash no longer parses),
+        // leaving a draft that reads as up to date whatever the head is.
+        let base = draft_lineage(kind, serialized.as_ref()).and_then(|l| l.as_text(kind));
         // Upsert. The conflict check rides on the DO UPDATE WHERE clause —
         // when the row is newer than `last_sync`, RETURNING yields nothing.
         // `created_at` defaults to `now()` but the migration overrides it ($8)
         // so a migrated draft keeps its original age instead of jumping to top.
-        sqlx::query_scalar!(
-            r#"INSERT INTO draft (workspace_id, email, path, typ, value, created_at)
-               VALUES ($1, $2, $3, $4, $5::text::json, COALESCE($8::timestamptz, now()))
+        //
+        // A moved save ($10) carries the path keys its editor had before the move.
+        // One naming the path it addressed ($11) follows to where it landed; a draft
+        // already there keeps the keys the move gave it. A pre-sanitizer NUL escape
+        // in that draft makes `to_jsonb` raise, so it takes the incoming keys.
+        sqlx::query!(
+            r#"INSERT INTO draft (workspace_id, email, path, typ, value, created_at, base)
+               VALUES ($1, $2, $3::text, $4,
+                       CASE WHEN $10::bool
+                            THEN to_json($5::text::jsonb || jsonb_strip_nulls(jsonb_build_object(
+                                'path', CASE WHEN $5::text::jsonb -> 'path' = to_jsonb($11::text)
+                                             THEN to_jsonb($3::text) END,
+                                'draft_path', CASE WHEN $5::text::jsonb -> 'draft_path' = to_jsonb($11::text)
+                                                   THEN to_jsonb($3::text) END)))
+                            ELSE $5::text::json
+                       END,
+                       COALESCE($8::timestamptz, now()), $9)
                ON CONFLICT (workspace_id, path, typ, email) WHERE email IS NOT NULL
-               DO UPDATE SET value = EXCLUDED.value, created_at = EXCLUDED.created_at
+               DO UPDATE SET value = CASE
+                                 WHEN NOT $10::bool
+                                   OR position(chr(92) || 'u0000' in replace(draft.value::text, chr(92) || chr(92), '')) > 0
+                                     THEN EXCLUDED.value
+                                 ELSE to_json((to_jsonb(EXCLUDED.value) - 'path' - 'draft_path')
+                                     || jsonb_strip_nulls(jsonb_build_object(
+                                         'path', to_jsonb(draft.value) -> 'path',
+                                         'draft_path', to_jsonb(draft.value) -> 'draft_path')))
+                             END,
+                             created_at = EXCLUDED.created_at,
+                             base = EXCLUDED.base
                WHERE $7::bool = true
                   OR $6::timestamptz IS NULL
                   OR draft.created_at <= $6::timestamptz
-               RETURNING created_at"#,
+               RETURNING path, created_at"#,
             &w_id,
             email,
             path,
@@ -380,9 +527,13 @@ async fn update_draft(
             req.last_sync,
             req.force,
             req.created_at,
+            base.as_deref(),
+            moved_to.is_some(),
+            url_path,
         )
         .fetch_optional(&db)
         .await?
+        .map(|r| (r.created_at, Some(r.path)))
     } else {
         // Delete, same conflict rule in the WHERE clause. Returns NULL when
         // the row was too new (conflict) OR already absent (idempotent) —
@@ -403,16 +554,20 @@ async fn update_draft(
             kind as UserDraftItemKind,
             req.last_sync,
             req.force,
-            req.legacy,
+            legacy_delete,
         )
         .fetch_optional(&db)
         .await?
+        // Named for the same reason an upsert is: the editor that discarded is still on
+        // the path the item left, and reloading there would land on nothing.
+        .map(|ts| (ts, moved_to.clone()))
     };
 
-    if let Some(ts) = applied_at {
+    if let Some((ts, path)) = applied {
         return Ok(Json(SaveDraftResponse {
             status: SaveDraftStatus::Saved,
             current_timestamp: ts,
+            path,
         }));
     }
 
@@ -428,7 +583,7 @@ async fn update_draft(
         email,
         path,
         kind as UserDraftItemKind,
-        req.legacy,
+        legacy_delete,
     )
     .fetch_optional(&db)
     .await?;
@@ -437,20 +592,307 @@ async fn update_draft(
         Some(ts) => Ok(Json(SaveDraftResponse {
             status: SaveDraftStatus::Conflict,
             current_timestamp: ts,
+            path: None,
         })),
         // Delete + nothing-was-there ⇒ report success with server's NOW().
         None => {
             let now = sqlx::query_scalar!(r#"SELECT now() as "now!""#)
                 .fetch_one(&db)
                 .await?;
+            // A retry of a routed discard whose answer was lost lands here: the row is
+            // gone but the editor is still on the path the item left, so it needs the
+            // destination as much as the first attempt did. Unlike the arm above there is
+            // no deleted row proving the caller ever held that draft, and an own discard
+            // is not gated, so this names a path to someone who may have none of it: the
+            // read gate, which is what keeps a path from being disclosed elsewhere in this
+            // module. Without it, discarding at a guessed path reads `draft_move`.
+            let disclosed = match moved_to {
+                Some(dest) => {
+                    match require_can_read_path(&authed, &user_db, &w_id, kind, &dest).await {
+                        Ok(()) => Some(dest),
+                        Err(Error::NotFound(_))
+                        | Err(Error::NotAuthorized(_))
+                        | Err(Error::BadRequest(_)) => None,
+                        Err(e) => return Err(e),
+                    }
+                }
+                None => None,
+            };
             Ok(Json(SaveDraftResponse {
                 status: SaveDraftStatus::Saved,
                 current_timestamp: now,
+                path: disclosed,
             }))
         }
     }
 }
 
+#[derive(Deserialize)]
+pub struct MoveDraftRequest {
+    pub new_path: String,
+    /// Also restate the draft's summary, so the same drawer that renames a
+    /// deployed item can retitle a draft-only one.
+    #[serde(default)]
+    pub summary: Option<String>,
+}
+
+/// Relocate the authed user's own DRAFT-ONLY item. Such an item is nothing but
+/// its draft row, so moving it is a rewrite of that row's path plus both path
+/// keys inside its value — there is no deployed row, schedule or trigger to
+/// cascade to.
+///
+/// The owner's own open editor follows: its next save, still addressed to the old
+/// path, lands at the new one through the move record, and it is told where.
+///
+/// Scoped to the caller's own row on purpose: two users can each have a draft
+/// at the same never-deployed path, and those are two separate items.
+///
+/// A DEPLOYED item must move through its own deploy endpoint instead, which
+/// cascades everything that references the path and carries every draft along.
+async fn move_draft(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+    Extension(user_db): Extension<UserDB>,
+    Path((w_id, kind, path)): Path<(String, UserDraftItemKind, windmill_common::utils::StripPath)>,
+    Json(req): Json<MoveDraftRequest>,
+) -> Result<String> {
+    let path = path.to_path();
+    let new_path = req.new_path.as_str();
+    // Only the full-page editor kinds, which is exactly the set that has a typed
+    // path to rewrite. Reading the movable set off the same mapping the rewrite
+    // uses keeps them from drifting apart: a resource, a variable or a trigger
+    // keeps its deploy target in `value.path` with no editor to stage a rename,
+    // so moving one would leave the real target naming the old location and the
+    // next deploy would recreate it where it came from.
+    let (Some(typed_field), Some(mirror_field)) =
+        (kind.typed_path_field(), kind.mirror_path_field())
+    else {
+        return Err(Error::BadRequest(format!(
+            "moving a {kind:?} draft is not supported — only scripts, flows and apps"
+        )));
+    };
+    // Validate before authorizing: `require_can_write_path` is not a format check
+    // (an admin returns immediately, and a user returns early inside their own
+    // namespace), so without this a malformed path is stored as-is, and an over-long
+    // or NUL-bearing one reaches Postgres as a raw server error. The source is a URL
+    // segment and arrives decoded, so it needs the same check as the destination.
+    check_proper_path(path)?;
+    check_proper_path(new_path)?;
+    // A summary-only edit is a legitimate use of this endpoint: the drawer edits
+    // both fields, and for a draft-only script the path it posts back is the row
+    // path unchanged (`list_scripts` only reports `draft_path` when it differs).
+    // Returning early on the path alone would drop the new summary silently.
+    if new_path == path && req.summary.is_none() {
+        return Ok("unchanged".to_string());
+    }
+    require_can_write_path(&authed, &db, &user_db, &w_id, kind, path).await?;
+    if new_path != path {
+        require_can_write_path(&authed, &db, &user_db, &w_id, kind, new_path).await?;
+    }
+
+    if let Some(table) = kind.deployed_table() {
+        // `table` is from the closed `deployed_table()` enum, never user input.
+        // Archived and soft-deleted rows keep sitting at their path — a script
+        // move archives its parent in place — so an existence check that counted
+        // them would refuse a move away from, or into, a path nothing occupies.
+        // `create_script_internal` resolves its own path clashes the same way.
+        let archived_filter = if table == "script" {
+            " AND NOT archived AND NOT deleted"
+        } else {
+            ""
+        };
+        let query = format!(
+            "SELECT 1 FROM {table} WHERE path = $1 AND workspace_id = $2{archived_filter} LIMIT 1"
+        );
+        let mut tx = user_db.clone().begin(&authed).await?;
+        let deployed_at_old = sqlx::query_scalar::<_, i32>(&query)
+            .bind(path)
+            .bind(&w_id)
+            .fetch_optional(&mut *tx)
+            .await?;
+        let deployed_at_new = sqlx::query_scalar::<_, i32>(&query)
+            .bind(new_path)
+            .bind(&w_id)
+            .fetch_optional(&mut *tx)
+            .await?;
+        tx.commit().await?;
+        if deployed_at_old.is_some() {
+            return Err(Error::BadRequest(format!(
+                "'{path}' is deployed — move it from its editor so schedules and triggers follow"
+            )));
+        }
+        if deployed_at_new.is_some() {
+            return Err(Error::BadRequest(format!(
+                "'{new_path}' already has a deployed item — moving there would turn this into a draft on top of it"
+            )));
+        }
+    }
+
+    // A NUL in the summary reaches Postgres as a raw byte and fails the statement with
+    // an encoding error, so it is dropped here the way `strip_json_nul` drops one from a
+    // draft value. `json` cannot store it either.
+    let summary = req.summary.as_ref().map(|s| s.replace('\0', ""));
+
+    // A classic app and a raw app share the `app` table, so a draft of either kind
+    // occupies the destination for both: deploying there deletes the caller's drafts
+    // of both kinds, taking the item that lost the collision with it.
+    let collision_typs: Vec<&str> = match kind {
+        UserDraftItemKind::App | UserDraftItemKind::RawApp => vec![
+            UserDraftItemKind::App.as_str(),
+            UserDraftItemKind::RawApp.as_str(),
+        ],
+        _ => vec![kind.as_str()],
+    };
+
+    // One transaction with the move record, so a save addressed to the old path
+    // never sees the row gone without knowing where it went.
+    let mut tx = db.begin().await?;
+    let moved = sqlx::query_scalar!(
+        r#"UPDATE draft
+           SET path = $3,
+               -- Both path keys, not just the typed one: the editors mirror the
+               -- typed path into the other while it differs from the row's path,
+               -- and the loaders prefer the mirror — left naming the old location
+               -- it un-does this move on the next save. `create_missing = false`
+               -- on both, so a draft carrying only one keeps only one.
+               value = to_json(
+                   jsonb_set(
+                       jsonb_set(
+                           CASE WHEN $7::text IS NULL THEN to_jsonb(value)
+                                ELSE jsonb_set(to_jsonb(value), ARRAY['summary'], to_jsonb($7::text))
+                           END,
+                           ARRAY[$5::text], to_jsonb($3::text), false
+                       ),
+                       ARRAY[$8::text], to_jsonb($3::text), false
+                   )
+               )
+           WHERE workspace_id = $1
+             AND path = $2
+             AND typ = $4
+             AND email = $6
+             -- A pre-sanitizer NUL escape makes `to_jsonb` raise 22P05. Excluded
+             -- here so the statement can't 500; reported below instead. Unlike the
+             -- passive carry, rewriting the value IS this operation, so skipping it
+             -- silently would move the row and leave its typed path stale.
+             AND position(chr(92) || 'u0000' in replace(value::text, chr(92) || chr(92), '')) = 0
+             -- Skipped on a summary-only edit, where the "target" row is this
+             -- row and the guard would refuse the update against itself.
+             AND ($2 = $3 OR NOT EXISTS (
+                 SELECT 1 FROM draft o
+                 WHERE o.workspace_id = $1 AND o.path = $3 AND o.typ::text = ANY($9::text[])
+                   -- Of this kind only the caller's own row and the legacy one collide:
+                   -- teammates' drafts of one item share its path by design, but a deploy
+                   -- there wipes those two together, so a second would discard edits the
+                   -- caller never saw. The other app kind is a different item on the same
+                   -- deployed path, so it collides whoever owns it.
+                   AND (o.typ <> $4 OR o.email = $6 OR o.email IS NULL)
+             ))
+           RETURNING id"#,
+        &w_id,
+        path,
+        new_path,
+        kind as UserDraftItemKind,
+        typed_field,
+        &authed.email,
+        summary,
+        mirror_field,
+        &collision_typs as &[&str],
+    )
+    .fetch_optional(&mut *tx)
+    .await?;
+    if moved.is_some() && new_path != path {
+        windmill_common::user_drafts::record_draft_move(
+            &mut tx,
+            &w_id,
+            &[kind],
+            path,
+            new_path,
+            Some(&authed.email),
+        )
+        .await?;
+    }
+    tx.commit().await?;
+
+    if moved.is_none() {
+        let row = sqlx::query!(
+            r#"SELECT
+                 -- The guard's own predicate, ordered own row, then legacy, then another
+                 -- user's other-kind row: each needs a different remedy, and a bare
+                 -- LIMIT 1 would name an arbitrary one.
+                 (SELECT typ::text FROM draft WHERE workspace_id = $1 AND path = $3
+                  AND typ::text = ANY($6::text[])
+                  AND (typ <> $2 OR email = $4 OR email IS NULL)
+                  ORDER BY CASE WHEN email = $4 THEN 0 WHEN email IS NULL THEN 1 ELSE 2 END
+                  LIMIT 1) as "at_target",
+                 EXISTS(SELECT 1 FROM draft WHERE workspace_id = $1 AND path = $3
+                        AND typ::text = ANY($6::text[]) AND email = $4) as "at_target_own!",
+                 EXISTS(SELECT 1 FROM draft WHERE workspace_id = $1 AND path = $3
+                        AND typ::text = ANY($6::text[]) AND email IS NULL) as "at_target_legacy!",
+                 EXISTS(SELECT 1 FROM draft WHERE workspace_id = $1 AND path = $5
+                        AND typ = $2 AND email = $4
+                        AND position(chr(92) || 'u0000' in replace(value::text, chr(92) || chr(92), '')) > 0
+                       ) as "poisoned!",
+                 EXISTS(SELECT 1 FROM draft WHERE workspace_id = $1 AND path = $5
+                        AND typ = $2 AND email IS NULL) as "legacy!" "#,
+            &w_id,
+            kind as UserDraftItemKind,
+            new_path,
+            &authed.email,
+            path,
+            &collision_typs as &[&str],
+        )
+        .fetch_one(&db)
+        .await?;
+        return Err(Error::BadRequest(if row.poisoned {
+            // This endpoint also serves a summary-only edit, so name the operation
+            // the caller actually asked for rather than always saying "moved".
+            let attempted = if new_path == path { "updated" } else { "moved" };
+            format!(
+                "'{path}' contains a NUL character and predates the sanitizer, so it cannot be \
+                 {attempted}. Reopen it, re-save to rewrite it cleanly, then retry."
+            )
+        } else if row.legacy {
+            // The home list synthesizes a draft-only row for the legacy draft with the
+            // caller's own name on it, so this is reachable from the row menu. Only an
+            // admin can claim or discard that row, and only from the drafts page.
+            format!(
+                "'{path}' is a legacy workspace draft with no owner, so it cannot be moved. \
+                 A workspace admin can claim or discard it on the Review & deploy drafts page."
+            )
+        } else if let Some(occupant) = row.at_target.filter(|_| new_path != path) {
+            // Naming the kind matters for the app pair: a classic-app draft refusing a
+            // raw-app move is invisible in the raw-app list the caller is looking at.
+            let occupant = occupant.replace('_', " ");
+            if row.at_target_own {
+                format!("You already have a draft at '{new_path}' ({occupant})")
+            } else if row.at_target_legacy {
+                // An ownerless row the caller cannot clear themselves, so send them to
+                // the one place it can be resolved rather than to "discard your draft".
+                format!(
+                    "A legacy workspace draft with no owner is already at '{new_path}' \
+                     ({occupant}). A workspace admin can claim or discard it on the Review & \
+                     deploy drafts page."
+                )
+            } else {
+                // The other app kind, owned by someone else: one deployed path cannot hold
+                // both, so this is the other item's path, not a teammate's copy of this one.
+                format!(
+                    "'{new_path}' holds another user's {occupant} draft, and an app and a raw \
+                     app cannot share a path. Pick another path, or ask them to move or \
+                     discard theirs."
+                )
+            }
+        } else {
+            format!("You have no draft at '{path}'")
+        }));
+    }
+
+    if new_path == path {
+        return Ok(format!("updated draft {path}"));
+    }
+    Ok(format!("moved draft {path} to {new_path}"))
+}
+
 #[derive(Deserialize, Debug)]
 #[serde(rename_all = "snake_case")]
 pub enum MigrateLegacyDraftAction {
@@ -504,12 +946,12 @@ async fn migrate_legacy_draft(
                 r#"WITH legacy AS (
                        DELETE FROM draft
                        WHERE workspace_id = $1 AND path = $2 AND typ = $3 AND email IS NULL
-                       RETURNING value
+                       RETURNING value, base
                    )
-                   INSERT INTO draft (workspace_id, email, path, typ, value, created_at)
-                   SELECT $1, $4, $2, $3, value, now() FROM legacy
+                   INSERT INTO draft (workspace_id, email, path, typ, value, created_at, base)
+                   SELECT $1, $4, $2, $3, value, now(), base FROM legacy
                    ON CONFLICT (workspace_id, path, typ, email) WHERE email IS NOT NULL
-                   DO UPDATE SET value = EXCLUDED.value, created_at = now()
+                   DO UPDATE SET value = EXCLUDED.value, created_at = now(), base = EXCLUDED.base
                    RETURNING 1 as "one!""#,
                 &w_id,
                 path,
@@ -767,8 +1209,8 @@ async fn require_can_write_path(
 
 /// Resolves to `Ok(())` if `authed` can read at `path`. Three layers:
 ///   1. admin → always.
-///   2. Path-prefix match against own `u/{username}` or any folder in
-///      `authed.folders` (the precomputed read set, with groups + direct
+///   2. Path-prefix match against own `u/{username}`, a group in `authed.groups`, or any
+///      folder in `authed.folders` (the precomputed read set, with groups + direct
 ///      grants already factored in).
 ///   3. RLS-aware `SELECT 1` against the backing table — covers item-level
 ///      extra_perms grants that bypass folder/owner checks.
@@ -793,6 +1235,10 @@ async fn require_can_read_path(
     if parts.len() >= 2 {
         match parts[0] {
             "u" if parts[1] == authed.username => return Ok(()),
+            // As `require_can_write_path` and the `see_member` RLS policy read it: a
+            // draft-only `g/` path has no row for the probe below to fall back on, so
+            // without this a member cannot see a draft their group owns.
+            "g" if authed.groups.iter().any(|g| g == parts[1]) => return Ok(()),
             "f" => {
                 let folder = parts[1];
                 if authed.folders.iter().any(|(name, _, _)| name == folder) {
diff --git a/backend/windmill-api/src/jobs.rs b/backend/windmill-api/src/jobs.rs
index eb77cb6e36..b9e71271d4 100644
--- a/backend/windmill-api/src/jobs.rs
+++ b/backend/windmill-api/src/jobs.rs
@@ -116,7 +116,9 @@ use windmill_common::{
     query_builders,
     scripts::{ScriptHash, ScriptLang},
     users::username_to_permissioned_as,
-    utils::{not_found_if_none, now_from_db, paginate, require_admin, Pagination, StripPath},
+    utils::{
+        not_found_if_none, now_from_db, paginate, require_admin, Pagination, ScheduleType, StripPath,
+    },
 };
 
 use windmill_common::{
@@ -304,6 +306,7 @@ pub fn workspaced_service() -> Router {
         .route("/queue/position/{timestamp}", get(get_queue_position))
         .route("/queue/scheduled_for/{id}", get(get_scheduled_for))
         .route("/queue/cancel_selection", post(cancel_selection))
+        .route("/queue/run_now/{id}", post(run_queued_job_now))
         .route("/completed/count", get(count_completed_jobs))
         .route("/completed/count_jobs", get(count_completed_jobs_detail))
         .route(
@@ -835,6 +838,113 @@ async fn force_cancel(
     }
 }
 
+/// Moves a queued job's `scheduled_for` to now so the next pull picks it up, keeping its id.
+/// A job with a concurrency limit still goes through the usual check at pull time and is
+/// re-scheduled again if its key is still saturated.
+async fn run_queued_job_now(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+    Extension(user_db): Extension<UserDB>,
+    Path((w_id, id)): Path<(String, Uuid)>,
+) -> error::Result<String> {
+    require_job_update_read_access(&db, &user_db, &authed, &w_id, &id, None).await?;
+    refuse_upcoming_schedule_tick(&db, &w_id, id).await?;
+
+    let mut tx = db.begin().await?;
+    let previous = sqlx::query_scalar!(
+        "UPDATE v2_job_queue q SET scheduled_for = now()
+         FROM (SELECT id, scheduled_for FROM v2_job_queue WHERE id = $1 AND workspace_id = $2 FOR UPDATE) prev
+         WHERE q.id = prev.id AND NOT q.running AND q.suspend = 0 AND q.canceled_by IS NULL
+            AND q.scheduled_for > now()
+         RETURNING prev.scheduled_for",
+        id,
+        w_id,
+    )
+    .fetch_optional(&mut *tx)
+    .await?;
+
+    let Some(previous) = previous else {
+        tx.commit().await?;
+        return Err(
+            if sqlx::query_scalar!(
+                "SELECT EXISTS(SELECT 1 FROM v2_job_queue WHERE id = $1 AND workspace_id = $2)",
+                id,
+                w_id
+            )
+            .fetch_one(&db)
+            .await?
+            .unwrap_or(false)
+            {
+                Error::BadRequest(format!(
+                    "job {id} is not waiting for a future start: it is running, suspended, \
+                     canceled or already due"
+                ))
+            } else {
+                Error::NotFound(format!("queued job id {id} does not exist"))
+            },
+        );
+    };
+
+    audit_log(
+        &mut *tx,
+        &authed,
+        "jobs.run_now",
+        ActionKind::Update,
+        &w_id,
+        Some(&id.to_string()),
+        Some([("previous_scheduled_for", previous.to_rfc3339().as_str())].into()),
+    )
+    .await?;
+    tx.commit().await?;
+
+    windmill_queue::append_logs(
+        &id,
+        &w_id,
+        format!(
+            "\nStart moved from {previous} to now by {}\n",
+            authed.display_username()
+        ),
+        &db.clone().into(),
+    )
+    .await;
+
+    Ok(id.to_string())
+}
+
+/// A schedule queues its next tick when the current one completes, computed from the
+/// completion time. Starting a tick that is not yet due would therefore queue that same
+/// tick again and run the schedule twice. A tick pushed past its time by a concurrency
+/// limit no longer sits on a cron occurrence, so it may still be started early.
+async fn refuse_upcoming_schedule_tick(db: &DB, w_id: &str, id: Uuid) -> error::Result<()> {
+    let Some(tick) = sqlx::query!(
+        "SELECT q.scheduled_for, s.path, s.schedule, s.cron_version, s.timezone
+         FROM v2_job j
+         JOIN v2_job_queue q USING (id)
+         JOIN schedule s ON s.workspace_id = j.workspace_id AND s.path = j.trigger
+         WHERE j.id = $1 AND j.workspace_id = $2 AND j.trigger_kind = 'schedule'
+            AND j.parent_job IS NULL AND q.scheduled_for > now()",
+        id,
+        w_id,
+    )
+    .fetch_optional(db)
+    .await?
+    else {
+        return Ok(());
+    };
+    let sched = ScheduleType::from_str(&tick.schedule, tick.cron_version.as_deref(), false)?;
+    let tz =
+        chrono_tz::Tz::from_str(&tick.timezone).map_err(|e| Error::BadRequest(e.to_string()))?;
+    let just_before = (tick.scheduled_for - chrono::Duration::milliseconds(1)).with_timezone(&tz);
+    if sched.find_next(&just_before)? == tick.scheduled_for {
+        return Err(Error::BadRequest(format!(
+            "job {id} is the upcoming tick of schedule {}; run the schedule's script or flow \
+             directly instead",
+            tick.path
+        )));
+    }
+    Ok(())
+}
+
 #[derive(Serialize)]
 struct QueuePosition {
     position: Option<i64>,
@@ -7226,7 +7336,10 @@ pub async fn run_workflow_as_code(
 ) -> error::Result<(StatusCode, String)> {
     #[cfg(feature = "enterprise")]
     check_license_key_valid().await?;
-    check_tag_available_for_workspace(&db, &w_id, &run_query.tag, &authed).await?;
+    let mut extra = HashMap::new();
+    extra.insert(ENTRYPOINT_OVERRIDE.to_string(), to_raw_value(&entrypoint));
+    let args = PushArgs { args: &task.args.unwrap_or_else(HashMap::new), extra: Some(extra) };
+    check_tag_available_for_workspace(&db, &w_id, &run_query.tag, &args, &authed).await?;
     check_scopes(&authed, || format!("jobs:run"))?;
 
     if !is_valid_entrypoint_name(&entrypoint) {
@@ -7320,10 +7433,6 @@ pub async fn run_workflow_as_code(
         i += 1;
     }
 
-    let mut extra = HashMap::new();
-    extra.insert(ENTRYPOINT_OVERRIDE.to_string(), to_raw_value(&entrypoint));
-
-    let args = PushArgs { args: &task.args.unwrap_or_else(HashMap::new), extra: Some(extra) };
     let scheduled_for = run_query.get_scheduled_for(&db).await?;
 
     let tag = run_query.tag.clone().or(tag).or(Some(job.tag));
@@ -7360,7 +7469,7 @@ pub async fn run_workflow_as_code(
         tx,
         &w_id,
         job_payload,
-        PushArgs { args: &args.args, extra: args.extra },
+        args,
         authed.display_username(),
         email,
         permissioned_as,
@@ -7646,7 +7755,8 @@ pub async fn run_wait_result_job_by_path_get(
         .await?;
 
     let tag = run_query.tag.clone().or(tag);
-    check_tag_available_for_workspace(&db, &w_id, &tag, &authed).await?;
+    let push_args = PushArgs { args: &args.args, extra: args.extra };
+    check_tag_available_for_workspace(&db, &w_id, &tag, &push_args, &authed).await?;
 
     let (email, permissioned_as, push_authed, tx) =
         if let Some(on_behalf_of) = on_behalf_authed.as_ref() {
@@ -7670,7 +7780,7 @@ pub async fn run_wait_result_job_by_path_get(
         tx,
         &w_id,
         job_payload,
-        PushArgs { args: &args.args, extra: args.extra },
+        push_args,
         authed.display_username(),
         email,
         permissioned_as,
@@ -7791,7 +7901,8 @@ pub async fn run_wait_result_script_by_path_internal(
         .await?;
 
     let tag = run_query.tag.clone().or(tag);
-    check_tag_available_for_workspace(&db, &w_id, &tag, &authed).await?;
+    let push_args = PushArgs { args: &args.args, extra: args.extra };
+    check_tag_available_for_workspace(&db, &w_id, &tag, &push_args, &authed).await?;
 
     let (email, permissioned_as, push_authed, tx) =
         if let Some(on_behalf_of) = on_behalf_of.as_ref() {
@@ -7815,7 +7926,7 @@ pub async fn run_wait_result_script_by_path_internal(
         tx,
         &w_id,
         job_payload,
-        PushArgs { args: &args.args, extra: args.extra },
+        push_args,
         authed.display_username(),
         email,
         permissioned_as,
@@ -7904,7 +8015,8 @@ pub async fn run_wait_result_script_by_hash(
     check_scopes(&authed, || format!("jobs:run:scripts:{path}"))?;
 
     let tag = run_query.tag.clone().or(tag);
-    check_tag_available_for_workspace(&db, &w_id, &tag, &authed).await?;
+    let push_args = PushArgs { args: &args.args, extra: args.extra };
+    check_tag_available_for_workspace(&db, &w_id, &tag, &push_args, &authed).await?;
 
     let (email, permissioned_as, push_authed, tx) = if let Some(obo) = on_behalf_of.as_ref() {
         (
@@ -7940,7 +8052,7 @@ pub async fn run_wait_result_script_by_hash(
                 && has_preprocessor.unwrap_or(false),
             labels,
         },
-        PushArgs { args: &args.args, extra: args.extra },
+        push_args,
         authed.display_username(),
         email,
         permissioned_as,
@@ -8365,8 +8477,9 @@ pub async fn run_wait_result_flow_by_version(
 /// job lives, in particular DuckDB, which runs in-process in the worker.
 ///
 /// What it does permit is any statement against the workspace's data tables, writes and DDL
-/// included: the helper's body is an unrestricted SQL template and data tables carry no
-/// per-user ACL. Narrowing that is a separate decision from this exemption.
+/// included: the helper's body is an unrestricted SQL template. What that reaches is the
+/// operator's own data table role — the preview job is permissioned as them, so the executor
+/// resolves it under their tenancy like any other job.
 ///
 /// The database argument is only half the target: the executor honors a `-- database`
 /// directive in the SQL over it, and `-- s3` redirects the result set, so both are refused.
@@ -8464,7 +8577,6 @@ async fn run_preview_script(
     require_path_read_access_for_preview(&authed, &preview.path)?;
     let scheduled_for = run_query.get_scheduled_for(&db).await?;
     let tag = run_query.tag.clone().or(preview.tag.clone());
-    check_tag_available_for_workspace(&db, &w_id, &tag, &authed).await?;
     let tx = PushIsolationLevel::Isolated(user_db.clone(), authed.clone().into());
 
     let preview_args = preview.args.unwrap_or_default();
@@ -8483,6 +8595,7 @@ async fn run_preview_script(
     }
     let extra = if extra.is_empty() { None } else { Some(extra) };
     let push_args = PushArgs { extra, args: &preview_args };
+    check_tag_available_for_workspace(&db, &w_id, &tag, &push_args, &authed).await?;
 
     let (uuid, tx) = push(
         &db,
@@ -8598,7 +8711,7 @@ async fn run_inline_preview_script(
 #[cfg(not(feature = "run_inline"))]
 async fn run_inline_preview_script() -> error::Result<Response> {
     Err(error::Error::InternalErr(
-        "inline preview requires the worker feature".to_string(),
+        "inline preview requires the run_inline feature on the worker".to_string(),
     ))
 }
 
@@ -8722,7 +8835,12 @@ fn register_potential_assets_on_inline_execution(
             .as_ref()
             .and_then(|args| args.get("database"))
             .map(|v| v.get().trim_matches('"'))
-            .and_then(|dt| dt.strip_prefix("datatable://"));
+            .and_then(|dt| dt.strip_prefix("datatable://"))
+            // `?role=` picks the connection, not the data table. Anything else after a `?` may be
+            // part of a name stored before names were restricted, so it stays.
+            .map(|dt| {
+                windmill_common::workspaces::parse_datatable_ref(dt).map_or(dt, |(name, _)| name)
+            });
         if let Some(datatable) = datatable {
             let re = regex::Regex::new(r#"SET search_path TO "([^"]+)";"#).unwrap();
             let (schema, content) = if let Some(captures) = re.captures(&preview.content) {
@@ -8839,7 +8957,6 @@ async fn run_bundle_preview_script(
 
             let scheduled_for = run_query.get_scheduled_for(&db).await?;
             let tag = run_query.tag.clone().or(preview.tag.clone());
-            check_tag_available_for_workspace(&db, &w_id, &tag, &authed).await?;
             let ltx = PushIsolationLevel::Isolated(user_db.clone(), authed.clone().into());
 
             let args = preview.args.unwrap_or_default();
@@ -8854,6 +8971,7 @@ async fn run_bundle_preview_script(
                 m
             });
             let push_args = PushArgs { extra, args: &args };
+            check_tag_available_for_workspace(&db, &w_id, &tag, &push_args, &authed).await?;
 
             is_tar = match preview.kind {
                 Some(PreviewKind::Tarbundle) => true,
@@ -9505,7 +9623,6 @@ async fn run_preview_flow_job(
     require_path_read_access_for_preview(&authed, &raw_flow.path)?;
     let scheduled_for = run_query.get_scheduled_for(&db).await?;
     let tag = run_query.tag.clone().or(raw_flow.tag.clone());
-    check_tag_available_for_workspace(&db, &w_id, &tag, &authed).await?;
     let tx = PushIsolationLevel::Isolated(user_db.clone(), authed.clone().into());
 
     let chat_input_enabled = raw_flow.value.chat_input_enabled.unwrap_or(false);
@@ -9523,6 +9640,8 @@ async fn run_preview_flow_job(
             to_raw_value(temp_script_refs),
         );
     }
+    check_tag_available_for_workspace(&db, &w_id, &tag, &PushArgs::from(&flow_args), &authed)
+        .await?;
 
     let (uuid, mut tx) = push(
         &db,
@@ -9768,11 +9887,6 @@ async fn run_dynamic_select(
         }
     }
 
-    // Same tag-permission gate a normal run gets (run_flow / push_script_job_by_path_into_queue):
-    // a caller allowed to read the flow must still be allowed to use its worker tag. No-op for
-    // inline (tag is None); the script branch checked this inside its helper and returned above.
-    check_tag_available_for_workspace(&db, &w_id, &tag, &authed).await?;
-
     // Invoke the dyn-select entrypoint instead of `main`.
     let mut args = request.args.unwrap_or_default();
     args.insert(
@@ -9780,6 +9894,11 @@ async fn run_dynamic_select(
         serde_json::value::to_raw_value(&request.entrypoint_function)?,
     );
 
+    // Same tag-permission gate a normal run gets (run_flow / push_script_job_by_path_into_queue):
+    // a caller allowed to read the flow must still be allowed to use its worker tag. No-op for
+    // inline (tag is None); the script branch checked this inside its helper and returned above.
+    check_tag_available_for_workspace(&db, &w_id, &tag, &PushArgs::from(&args), &authed).await?;
+
     let scheduled_for = run_query.get_scheduled_for(&db).await?;
     let tx = PushIsolationLevel::Isolated(user_db.clone(), authed.clone().into());
 
@@ -9914,8 +10033,9 @@ pub async fn run_job_by_hash_inner(
     }
     let scheduled_for = run_query.get_scheduled_for(&db).await?;
     let tag = run_query.tag.clone().or(tag);
+    let push_args = PushArgs { args: &args.args, extra: args.extra };
 
-    check_tag_available_for_workspace(&db, &w_id, &tag, &authed).await?;
+    check_tag_available_for_workspace(&db, &w_id, &tag, &push_args, &authed).await?;
 
     let (email, permissioned_as, push_authed, tx) = if let Some(obo) = on_behalf_of.as_ref() {
         (
@@ -9951,7 +10071,7 @@ pub async fn run_job_by_hash_inner(
                 && has_preprocessor.unwrap_or(false),
             labels,
         },
-        PushArgs { args: &args.args, extra: args.extra },
+        push_args,
         authed.display_username(),
         email,
         permissioned_as,
diff --git a/backend/windmill-api/src/lib.rs b/backend/windmill-api/src/lib.rs
index b70d80140a..d6b29a8501 100644
--- a/backend/windmill-api/src/lib.rs
+++ b/backend/windmill-api/src/lib.rs
@@ -560,7 +560,7 @@ pub async fn run_server(
         if server_mode || mcp_mode {
             use mcp::{
                 add_www_authenticate_header, add_www_authenticate_header_gateway,
-                extract_workspace_from_token,
+                extract_workspace_from_token, reject_token_query_param,
             };
             let (mcp_router, mcp_cancellation_token) = setup_mcp_server(
                 db.clone(),
@@ -573,15 +573,17 @@ pub async fn run_server(
             let workspaced_mcp_router = mcp_router
                 .clone()
                 .route_layer(from_extractor::<ApiAuthed>())
+                .layer(axum::middleware::from_fn(reject_token_query_param))
                 .layer(axum::middleware::from_fn(add_www_authenticate_header))
                 .layer(axum::middleware::from_fn(extract_and_store_workspace_id));
             // Gateway MCP router — resolves workspace from token
             let gateway_mcp_router = mcp_router
                 .route_layer(from_extractor::<ApiAuthed>())
+                .layer(axum::middleware::from_fn(extract_workspace_from_token))
+                .layer(axum::middleware::from_fn(reject_token_query_param))
                 .layer(axum::middleware::from_fn(
                     add_www_authenticate_header_gateway,
-                ))
-                .layer(axum::middleware::from_fn(extract_workspace_from_token));
+                ));
             (
                 workspaced_mcp_router,
                 gateway_mcp_router,
@@ -729,6 +731,12 @@ pub async fn run_server(
                             path_autocomplete::workspaced_service(),
                         )
                         .nest("/raw_apps", raw_apps::workspaced_service())
+                        .nest(
+                            "/remote_deploy",
+                            windmill_api_workspaces::remote_deploy::workspaced_service(
+                                request_size_limit * 5,
+                            ),
+                        )
                         // CORS so the opaque-origin app iframe can read
                         // resources/list, resources/type/* with a scoped token.
                         .nest(
diff --git a/backend/windmill-api/src/live_migrations.rs b/backend/windmill-api/src/live_migrations.rs
index 4c6f5e245c..334ee340a8 100644
--- a/backend/windmill-api/src/live_migrations.rs
+++ b/backend/windmill-api/src/live_migrations.rs
@@ -6,8 +6,9 @@
  * LICENSE-AGPL for a copy of the license.
  */
 
-use sqlx::Postgres;
-use windmill_common::error::Error;
+use sqlx::{PgConnection, Postgres};
+use tokio::task::JoinHandle;
+use windmill_common::{db::DB, error::Error};
 
 use crate::db::CustomMigrator;
 use sqlx::migrate::Migrate;
@@ -121,3 +122,294 @@ async fn fix_flow_versioning_migration(migrator: &mut CustomMigrator) -> Result<
     }
     Ok(())
 }
+
+// Held for the whole background run so only one server does it at a time.
+const BACKGROUND_MIGRATIONS_LOCK_ID: i64 = 4_931_072_518_336_401;
+
+/// Schema changes too slow to hold server startup for, run by one server at a time after the
+/// sqlx migrations. Each step is recorded in `windmill_migrations` once done; a step interrupted
+/// by a restart or an error starts over on the next start and must resume safely.
+pub fn spawn_background_migrations(
+    db: DB,
+    mut killpill_rx: tokio::sync::broadcast::Receiver<()>,
+) -> JoinHandle<()> {
+    tokio::spawn(async move {
+        tokio::select! {
+            r = run_background_migrations(&db) => {
+                if let Err(err) = r {
+                    tracing::error!("Background migrations stopped, retrying on the next start: {err:#}");
+                }
+            }
+            _ = killpill_rx.recv() => {
+                tracing::info!("Killpill received, stopping background migrations");
+            }
+        }
+    })
+}
+
+async fn run_background_migrations(db: &DB) -> Result<(), Error> {
+    // Detached so the pool's 5min statement_timeout, lifted here for the index builds, never
+    // comes back with this connection; closing it also releases the advisory lock.
+    let mut conn = db.acquire().await?.detach();
+    conn.execute("SET statement_timeout = 0").await?;
+    let locked = sqlx::query_scalar::<_, bool>("SELECT pg_try_advisory_lock($1)")
+        .bind(BACKGROUND_MIGRATIONS_LOCK_ID)
+        .fetch_one(&mut conn)
+        .await?;
+    if !locked {
+        return Ok(());
+    }
+
+    for step in [AUDIT_OPERATION_INDEX, RETIRE_LEGACY_AUDIT] {
+        if background_migration_done(&mut conn, step).await? {
+            continue;
+        }
+        // Steps bound the lock waits that would queue audit inserts behind them with
+        // lock_timeout, and resume where they stopped, so a lock timeout is retried here.
+        let mut attempt = 1;
+        loop {
+            let run = match step {
+                AUDIT_OPERATION_INDEX => create_audit_operation_index(&mut conn).await,
+                RETIRE_LEGACY_AUDIT => retire_legacy_audit_table(&mut conn).await,
+                _ => unreachable!("background migration {step} has no step function"),
+            };
+            match run {
+                Ok(()) => break,
+                Err(err) if attempt < 10 && is_lock_timeout(&err) => {
+                    tracing::warn!(
+                        "Background migration {step} timed out on a lock, retrying in 30s: {err:#}"
+                    );
+                    attempt += 1;
+                    tokio::time::sleep(std::time::Duration::from_secs(30)).await;
+                }
+                Err(err) => return Err(err),
+            }
+        }
+        mark_background_migration_done(&mut conn, step).await?;
+    }
+    Ok(())
+}
+
+const AUDIT_OPERATION_INDEX: &str = "audit_partitioned_workspace_operation_index";
+const RETIRE_LEGACY_AUDIT: &str = "retire_legacy_audit_table";
+
+// Short on purpose: a statement waiting for its lock is also a wait for every audit insert
+// queued behind it.
+const STEP_LOCK_TIMEOUT: &str = "SET lock_timeout = '1s'";
+
+fn is_lock_timeout(err: &Error) -> bool {
+    matches!(err, Error::SqlErr { error: sqlx::Error::Database(db_err), .. }
+        if db_err.code().as_deref() == Some("55P03"))
+}
+
+async fn background_migration_done(conn: &mut PgConnection, name: &str) -> Result<bool, Error> {
+    Ok(sqlx::query_scalar::<_, bool>(
+        "SELECT EXISTS(SELECT 1 FROM windmill_migrations WHERE name = $1)",
+    )
+    .bind(name)
+    .fetch_one(conn)
+    .await?)
+}
+
+async fn mark_background_migration_done(conn: &mut PgConnection, name: &str) -> Result<(), Error> {
+    sqlx::query("INSERT INTO windmill_migrations (name) VALUES ($1) ON CONFLICT DO NOTHING")
+        .bind(name)
+        .execute(conn)
+        .await?;
+    tracing::info!("Background migration {name} done");
+    Ok(())
+}
+
+const AUDIT_OPERATION_INDEX_KEY: &str = r#"(workspace_id, operation, id DESC, "timestamp")"#;
+
+/// A plain `CREATE INDEX` on the partitioned table holds a SHARE lock on every partition until the
+/// whole build ends, blocking the audit insert each job push makes in its own transaction. Each
+/// partition is built CONCURRENTLY instead and attached to a parent created `ON ONLY`, which turns
+/// valid once all partitions are attached. Partitions created later get the index from the parent.
+async fn create_audit_operation_index(conn: &mut PgConnection) -> Result<(), Error> {
+    // Metadata only, but it waits for every open transaction that wrote an audit row, and every
+    // audit insert (so every job push) queues behind it meanwhile. Give up early instead.
+    conn.execute(STEP_LOCK_TIMEOUT).await?;
+    let created = conn
+        .execute(
+            format!(
+                "CREATE INDEX IF NOT EXISTS ix_audit_partitioned_workspace_operation \
+                 ON ONLY audit_partitioned {AUDIT_OPERATION_INDEX_KEY}"
+            )
+            .as_str(),
+        )
+        .await;
+    conn.execute("RESET lock_timeout").await?;
+    created?;
+    let partitions: Vec<String> = sqlx::query_scalar(
+        "SELECT c.relname::text FROM pg_inherits p JOIN pg_class c ON c.oid = p.inhrelid
+         WHERE p.inhparent = 'audit_partitioned'::regclass
+           AND NOT EXISTS (
+               SELECT 1 FROM pg_inherits ip JOIN pg_index i ON i.indexrelid = ip.inhrelid
+               WHERE ip.inhparent = 'ix_audit_partitioned_workspace_operation'::regclass
+                 AND i.indrelid = c.oid)
+         ORDER BY c.relname DESC",
+    )
+    .fetch_all(&mut *conn)
+    .await?;
+    let quote = |name: &str| format!("\"{}\"", name.replace('"', "\"\""));
+    for partition in partitions {
+        let index = quote(&format!(
+            "{partition}_workspace_id_operation_id_timestamp_idx"
+        ));
+        tracing::info!("Building ix_audit_partitioned_workspace_operation on {partition}");
+        // An interrupted CONCURRENTLY build leaves an invalid index under this name.
+        conn.execute(format!("DROP INDEX CONCURRENTLY IF EXISTS {index}").as_str())
+            .await?;
+        conn.execute(
+            format!(
+                "CREATE INDEX CONCURRENTLY {index} ON {} {AUDIT_OPERATION_INDEX_KEY}",
+                quote(&partition)
+            )
+            .as_str(),
+        )
+        .await?;
+        conn.execute(
+            format!(
+                "ALTER INDEX ix_audit_partitioned_workspace_operation ATTACH PARTITION {index}"
+            )
+            .as_str(),
+        )
+        .await?;
+    }
+    Ok(())
+}
+
+const AUDIT_COLUMNS: &str =
+    "workspace_id, id, timestamp, username, operation, action_kind, resource, parameters, email, span";
+
+/// Moves the last 30 days of the pre-partitioning `audit` table into daily partitions and drops
+/// it with anything older. An empty `audit` view takes its place for servers still running an
+/// older version, which read it in a `UNION ALL` with `audit_partitioned`.
+async fn retire_legacy_audit_table(conn: &mut PgConnection) -> Result<(), Error> {
+    let is_table = sqlx::query_scalar::<_, bool>(
+        "SELECT EXISTS(SELECT 1 FROM pg_class WHERE oid = to_regclass('audit') AND relkind = 'r')",
+    )
+    .fetch_one(&mut *conn)
+    .await?;
+    if !is_table {
+        return Ok(());
+    }
+    // Creating a partition and re-owning the sequence queue every audit insert (so every job
+    // push) behind them while they wait for their own lock, e.g. on a long-running reader, and
+    // the DROP queues older servers' reads the same way. Give up early and retry instead.
+    conn.execute(STEP_LOCK_TIMEOUT).await?;
+
+    let days: Vec<chrono::NaiveDate> = sqlx::query_scalar(
+        "SELECT DISTINCT timestamp::date FROM audit
+         WHERE timestamp > now() - interval '30 days' ORDER BY 1",
+    )
+    .fetch_all(&mut *conn)
+    .await?;
+    for day in days {
+        let next = day + chrono::Duration::days(1);
+        // Created outside any transaction: a partition created inside one keeps a lock on
+        // audit_partitioned that blocks every job push's audit insert until it commits.
+        conn.execute(
+            format!(
+                "CREATE TABLE IF NOT EXISTS \"audit_{}\" PARTITION OF audit_partitioned \
+                 FOR VALUES FROM ('{day}') TO ('{next}')",
+                day.format("%Y%m%d")
+            )
+            .as_str(),
+        )
+        .await?;
+        // One statement per day, so a row is always in exactly one of the two tables.
+        let moved = sqlx::query(&format!(
+            "WITH moved AS (
+                 DELETE FROM audit WHERE timestamp >= $1::date AND timestamp < $1::date + 1
+                 RETURNING {AUDIT_COLUMNS}
+             )
+             INSERT INTO audit_partitioned ({AUDIT_COLUMNS}) SELECT {AUDIT_COLUMNS} FROM moved"
+        ))
+        .bind(day)
+        .execute(&mut *conn)
+        .await?;
+        tracing::info!(
+            "Moved {} legacy audit rows of {day} into audit_partitioned",
+            moved.rows_affected()
+        );
+    }
+
+    // audit_partitioned draws its ids from this sequence, which dropping its owner would drop.
+    // Not in the transaction below: its lock stops every insert's nextval until commit, and the
+    // DROP can wait there on readers of the old table.
+    conn.execute("ALTER SEQUENCE audit_id_seq OWNED BY audit_partitioned.id")
+        .await?;
+    let mut tx = conn.begin().await?;
+    // Servers older than audit partitioning still write to the table during a rolling upgrade:
+    // rows they added after their day was moved above are swept up under the lock.
+    tx.execute("LOCK TABLE audit IN ACCESS EXCLUSIVE MODE")
+        .await?;
+    tx.execute(
+        format!(
+            "WITH moved AS (
+                 DELETE FROM audit WHERE timestamp > now() - interval '30 days'
+                 RETURNING {AUDIT_COLUMNS}
+             )
+             INSERT INTO audit_partitioned ({AUDIT_COLUMNS}) SELECT {AUDIT_COLUMNS} FROM moved"
+        )
+        .as_str(),
+    )
+    .await?;
+    tx.execute("DROP TABLE audit").await?;
+    tx.execute(
+        format!("CREATE VIEW audit AS SELECT {AUDIT_COLUMNS} FROM audit_partitioned WHERE false")
+            .as_str(),
+    )
+    .await?;
+    tx.execute("GRANT ALL ON audit TO windmill_user, windmill_admin")
+        .await?;
+    tx.commit().await?;
+    conn.execute("RESET lock_timeout").await?;
+    tracing::info!("Retired the legacy audit table");
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[sqlx::test(migrations = "../migrations")]
+    async fn retire_legacy_audit_table_keeps_the_last_30_days(db: DB) -> anyhow::Result<()> {
+        sqlx::query(
+            "INSERT INTO audit (workspace_id, id, timestamp, username, operation, action_kind)
+             VALUES ('w', -2, now() - interval '3 days', 'u', 'recent', 'execute'),
+                    ('w', -1, now() - interval '60 days', 'u', 'old', 'execute')",
+        )
+        .execute(&db)
+        .await?;
+
+        retire_legacy_audit_table(&mut *db.acquire().await?).await?;
+
+        let moved: Vec<(i64, String)> = sqlx::query_as(
+            "SELECT id, operation::text FROM audit_partitioned WHERE workspace_id = 'w'",
+        )
+        .fetch_all(&db)
+        .await?;
+        assert_eq!(moved, vec![(-2, "recent".to_string())]);
+
+        // The id sequence outlives the table that owned it.
+        sqlx::query(
+            "INSERT INTO audit_partitioned (workspace_id, username, operation, action_kind)
+             VALUES ('w', 'u', 'after', 'execute')",
+        )
+        .execute(&db)
+        .await?;
+
+        // Servers on an older version still read `audit` in a UNION with audit_partitioned.
+        let seen: i64 = sqlx::query_scalar(
+            "SELECT count(*) FROM (SELECT * FROM audit_partitioned UNION ALL SELECT * FROM audit) a
+             WHERE workspace_id = 'w'",
+        )
+        .fetch_one(&db)
+        .await?;
+        assert_eq!(seen, 2);
+        Ok(())
+    }
+}
diff --git a/backend/windmill-api/src/mcp/auto_generated_endpoints.rs b/backend/windmill-api/src/mcp/auto_generated_endpoints.rs
index ffefaba2dd..1962710578 100644
--- a/backend/windmill-api/src/mcp/auto_generated_endpoints.rs
+++ b/backend/windmill-api/src/mcp/auto_generated_endpoints.rs
@@ -699,6 +699,10 @@ pub fn all_tools() -> Vec<EndpointTool> {
                 "content": {
                         "type": "string"
                 },
+                "schema": {
+                        "type": "object",
+                        "description": "JSON Schema of the arguments of `main`, which is what a run form and an MCP tool offer. Omitted (or `{}`), it is inferred from `content` for TypeScript, Python, Go, Bash, PowerShell, SQL, GraphQL and Ansible scripts. For other languages, or code that does not parse, a new script gets none. A new version of an existing script also keeps what the previous version's schema says about each argument, or that whole schema when nothing can be inferred. A dbt script always takes its schema from its descriptor, whatever is sent."
+                },
                 "language": {
                         "type": "string",
                         "description": "Possible values: python3, deno, go, bash, powershell, postgresql, mysql, bigquery, snowflake, mssql, oracledb, graphql, nativets, bun, php, rust, ansible, csharp, nu, java, ruby, rlang, duckdb, bunnative, dbt"
@@ -757,6 +761,10 @@ is, a different one moves it there and archives the old path"),
                 "content": {
                         "type": "string"
                 },
+                "schema": {
+                        "type": "object",
+                        "description": "JSON Schema of the arguments of `main`, which is what a run form and an MCP tool offer. Omitted (or `{}`), it is inferred from `content` for TypeScript, Python, Go, Bash, PowerShell, SQL, GraphQL and Ansible scripts. For other languages, or code that does not parse, a new script gets none. A new version of an existing script also keeps what the previous version's schema says about each argument, or that whole schema when nothing can be inferred. A dbt script always takes its schema from its descriptor, whatever is sent."
+                },
                 "language": {
                         "type": "string",
                         "description": "Possible values: python3, deno, go, bash, powershell, postgresql, mysql, bigquery, snowflake, mssql, oracledb, graphql, nativets, bun, php, rust, ansible, csharp, nu, java, ruby, rlang, duckdb, bunnative, dbt"
@@ -1024,10 +1032,12 @@ is, a different one moves it there and archives the old path"),
                         "description": "Detailed documentation for this flow"
                 },
                 "value": {
-                        "type": "object"
+                        "type": "object",
+                        "description": "The flow structure containing modules and optional preprocessor/failure handlers"
                 },
                 "schema": {
-                        "type": "object"
+                        "type": "object",
+                        "description": "JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"
                 },
                 "path": {
                         "type": "string"
@@ -1080,10 +1090,12 @@ is, a different one moves it there and archives the old path"),
                         "description": "Detailed documentation for this flow"
                 },
                 "value": {
-                        "type": "object"
+                        "type": "object",
+                        "description": "The flow structure containing modules and optional preprocessor/failure handlers"
                 },
                 "schema": {
-                        "type": "object"
+                        "type": "object",
+                        "description": "JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"
                 },
                 "tag": {
                         "type": "string"
diff --git a/backend/windmill-api/src/mcp/core.rs b/backend/windmill-api/src/mcp/core.rs
index 480e3c0841..472c7bbec9 100644
--- a/backend/windmill-api/src/mcp/core.rs
+++ b/backend/windmill-api/src/mcp/core.rs
@@ -43,11 +43,14 @@ use axum::{
     extract::{Extension, Path},
     http::Request,
     middleware::Next,
-    response::Response,
+    response::{IntoResponse, Response},
     routing::get,
     Json, Router,
 };
-use windmill_common::{auth::hash_token, db::GatewayWorkspaceId, error::JsonResult};
+use windmill_common::{
+    auth::hash_token, db::GatewayWorkspaceId, error::JsonResult,
+    global_settings::MCP_DISABLE_TOKEN_QUERY_PARAM,
+};
 
 // McpAuth impl for ApiAuthed is in windmill-api-auth (same crate as the type)
 
@@ -383,6 +386,12 @@ impl McpBackend for WindmillBackend {
             })
     }
 
+    async fn runnable_list_fingerprint(&self, workspace_id: &str) -> BackendResult<String> {
+        windmill_common::runnables::runnable_list_fingerprint(&self.db, workspace_id)
+            .await
+            .map_err(|e| ErrorData::internal_error(e.to_string(), None))
+    }
+
     fn all_endpoint_tools(&self) -> Vec<EndpointTool> {
         all_tools()
     }
@@ -446,6 +455,29 @@ pub async fn add_www_authenticate_header(
     }
 }
 
+/// Middleware refusing a credential carried in the MCP URL once the instance sets
+/// `mcp_disable_token_query_param`. Sits outside everything that reads the token, so neither
+/// the gateway lookup nor `ApiAuthed` ever sees it, and inside the `WWW-Authenticate` layer,
+/// whose header is what sends the client into the OAuth flow instead. Refused rather than
+/// ignored: the URL leaked the token whether or not the request used it.
+pub async fn reject_token_query_param(request: Request<axum::body::Body>, next: Next) -> Response {
+    let carries_token = MCP_DISABLE_TOKEN_QUERY_PARAM.load(std::sync::atomic::Ordering::Relaxed)
+        && request
+            .uri()
+            .query()
+            .is_some_and(|q| url::form_urlencoded::parse(q.as_bytes()).any(|(k, _)| k == "token"));
+    if carries_token {
+        return (
+            axum::http::StatusCode::UNAUTHORIZED,
+            "This instance does not accept a token in the MCP URL. Remove the token query \
+             parameter and let your client sign in through OAuth, or send the token in an \
+             Authorization header.",
+        )
+            .into_response();
+    }
+    next.run(request).await
+}
+
 /// Extract the bearer token from either the `Authorization` header or the
 /// `?token=` query parameter (MCP clients commonly pass it in the URL).
 fn extract_gateway_token(request: &Request<axum::body::Body>) -> Option<String> {
diff --git a/backend/windmill-api/src/mcp/mod.rs b/backend/windmill-api/src/mcp/mod.rs
index 5f6bd5edb5..5545d59a9f 100644
--- a/backend/windmill-api/src/mcp/mod.rs
+++ b/backend/windmill-api/src/mcp/mod.rs
@@ -12,5 +12,5 @@ pub mod oauth_server;
 pub use core::{
     add_www_authenticate_header, add_www_authenticate_header_gateway,
     extract_and_store_workspace_id, extract_workspace_from_token, list_tools_service,
-    setup_mcp_server,
+    reject_token_query_param, setup_mcp_server,
 };
diff --git a/backend/windmill-api/src/raw_apps.rs b/backend/windmill-api/src/raw_apps.rs
index d7bc3bc6c0..35e4f693a4 100644
--- a/backend/windmill-api/src/raw_apps.rs
+++ b/backend/windmill-api/src/raw_apps.rs
@@ -5,7 +5,10 @@
  * Please see the included NOTICE for copyright information and
  * LICENSE-AGPL for a copy of the license.
  */
-use crate::{db::ApiAuthed, utils::check_scopes};
+use crate::{
+    db::ApiAuthed,
+    utils::{build_scope_path_filter, check_scopes, ScopePathFilter},
+};
 use axum::{
     body::Body,
     extract::{Extension, Json, Path, Query},
@@ -103,6 +106,31 @@ async fn list_apps(
         }
     }
 
+    // In the WHERE, not a retain after the fetch: the result is paginated, and a
+    // post-fetch filter would return short pages and let a page's size report how
+    // many raw apps the token may not read. One `?` per term, since a chained `.bind`
+    // substitutes into a `?` inside the value an earlier one inserted; `starts_with`,
+    // since LIKE reads a `_` in the path as a wildcard.
+    if let ScopePathFilter::Restricted { exact, prefix } =
+        build_scope_path_filter(&authed, "raw_apps", "read")
+    {
+        let terms: Vec<String> = exact
+            .iter()
+            .chain(&prefix)
+            .map(|p| "app.path = ?".bind(p))
+            .chain(
+                prefix
+                    .iter()
+                    .map(|p| "starts_with(app.path, ?)".bind(&format!("{p}/"))),
+            )
+            .collect();
+        sqlb.and_where(if terms.is_empty() {
+            "false".to_string()
+        } else {
+            format!("({})", terms.join(" OR "))
+        });
+    }
+
     let sql = sqlb.sql().map_err(|e| Error::internal_err(e.to_string()))?;
     let mut tx = user_db.begin(&authed).await?;
     let rows = sqlx::query_as::<_, ListableApp>(&sql)
diff --git a/backend/windmill-api/src/tracing_init.rs b/backend/windmill-api/src/tracing_init.rs
index 56adeee184..d99a7e5907 100644
--- a/backend/windmill-api/src/tracing_init.rs
+++ b/backend/windmill-api/src/tracing_init.rs
@@ -14,6 +14,7 @@ use axum::response::Response as AxumResponse;
 use hyper::Response;
 use tower_http::trace::{MakeSpan, OnFailure, OnResponse};
 use uuid::Uuid;
+use windmill_api_workspaces::remote_deploy::RedactedUri;
 use windmill_common::log_context::{with_log_context, LogContext};
 
 lazy_static::lazy_static! {
@@ -86,7 +87,7 @@ impl<B> MakeSpan<B> for MyMakeSpan {
         tracing::error_span!(
             "request",
             method = %request.method(),
-            uri = %request.uri(),
+            uri = %RedactedUri(request.uri()),
             username = field::Empty,
             workspace_id = field::Empty,
             traceId = tracing_id,
@@ -113,7 +114,7 @@ pub async fn log_context_middleware(request: Request, next: Next) -> AxumRespons
 
     let ctx = LogContext {
         method: Some(request.method().to_string()),
-        uri: Some(request.uri().to_string()),
+        uri: Some(RedactedUri(request.uri()).to_string()),
         trace_id,
         ..Default::default()
     };
diff --git a/backend/windmill-api/src/users.rs b/backend/windmill-api/src/users.rs
index 4dd073b3af..a7f9aeda89 100644
--- a/backend/windmill-api/src/users.rs
+++ b/backend/windmill-api/src/users.rs
@@ -352,6 +352,17 @@ async fn update_username_in_workpsace<'c>(
     new_username: &str,
     w_id: &str,
 ) -> error::Result<()> {
+    // ---- data table tenants ----
+    // Tenants name the user, so the rename has to follow here too; a list left naming the old
+    // username silently drops the access instead of moving it.
+    windmill_common::workspaces::rename_datatable_tenant_in_workspace(
+        tx,
+        w_id,
+        &format!("u/{old_username}"),
+        &format!("u/{new_username}"),
+    )
+    .await?;
+
     // ---- instance and workspace users ----
     sqlx::query!(
         "UPDATE usr SET username = $1 WHERE email = $2",
diff --git a/backend/windmill-api/src/workspaces.rs b/backend/windmill-api/src/workspaces.rs
index a0a27eab4c..186cfbc291 100644
--- a/backend/windmill-api/src/workspaces.rs
+++ b/backend/windmill-api/src/workspaces.rs
@@ -108,6 +108,7 @@ async fn edit_copilot_config(
     }
 
     ai_config.validate_model_pricing()?;
+    ai_config.validate_token_limits()?;
     ai_config.validate_sessions_retention()?;
 
     let mut tx = db.begin().await?;
diff --git a/backend/windmill-api/src/workspaces_export.rs b/backend/windmill-api/src/workspaces_export.rs
index 69565ffcbd..ea79aaa572 100644
--- a/backend/windmill-api/src/workspaces_export.rs
+++ b/backend/windmill-api/src/workspaces_export.rs
@@ -281,8 +281,29 @@ enum ArchiveImpl {
     Tar(tokio_tar::Builder<File>),
 }
 
+/// Entry paths come from item paths stored in the workspace; an absolute or
+/// drive-prefixed path, or a parent segment, would make extraction write outside
+/// the target directory. Win32 strips trailing dots and spaces from a segment,
+/// so `.. ` resolves to `..` there: any segment made only of those is refused.
+/// A colon matters only in the first segment (a drive prefix); later segments,
+/// such as a data table name, may carry one.
+fn check_archive_entry_path(path: &str) -> Result<()> {
+    let is_dot_segment = |seg: &str| !seg.is_empty() && seg.chars().all(|c| c == '.' || c == ' ');
+    let first = path.split(['/', '\\']).next().unwrap_or_default();
+    if path.starts_with(['/', '\\'])
+        || first.contains(':')
+        || path.split(['/', '\\']).any(is_dot_segment)
+    {
+        return Err(Error::internal_err(format!(
+            "refusing to write archive entry with path traversal: {path}"
+        )));
+    }
+    Ok(())
+}
+
 impl ArchiveImpl {
     async fn write_to_archive(&mut self, content: &str, path: &str) -> Result<()> {
+        check_archive_entry_path(path)?;
         match self {
             ArchiveImpl::Tar(t) => {
                 let bytes = content.as_bytes();
@@ -1425,9 +1446,17 @@ pub(crate) async fn tarball_workspace(
             use strum::IntoEnumIterator;
 
             for service_name in ServiceName::iter() {
-                let native_triggers =
-                    list_native_triggers(&mut *tx, &w_id, service_name, None, None, None, None)
-                        .await?;
+                let native_triggers = list_native_triggers(
+                    &mut *tx,
+                    &w_id,
+                    service_name,
+                    None,
+                    None,
+                    None,
+                    None,
+                    windmill_api_auth::ScopePathFilter::AllowAll,
+                )
+                .await?;
 
                 // Native triggers (Nextcloud, Google Drive, GitHub) are never
                 // cloned into a fork — a fork only has one if its owner created
@@ -1639,7 +1668,9 @@ pub(crate) async fn tarball_workspace(
                 mute_critical_alerts: row.mute_critical_alerts,
                 color: row.color.clone(),
                 operator_settings: row.operator_settings.clone(),
-                datatable: row.datatable.clone(),
+                datatable: windmill_common::workspaces::strip_datatable_permissions(
+                    row.datatable.clone(),
+                ),
                 slack_team_id: row.slack_team_id.clone(),
                 slack_name: row.slack_name.clone(),
                 slack_command_script: row.slack_command_script.clone(),
@@ -1703,7 +1734,7 @@ pub(crate) async fn tarball_workspace(
                 mute_critical_alerts: row.mute_critical_alerts,
                 color: row.color,
                 operator_settings: row.operator_settings,
-                datatable: row.datatable,
+                datatable: windmill_common::workspaces::strip_datatable_permissions(row.datatable),
                 slack_team_id: row.slack_team_id,
                 slack_name: row.slack_name,
                 slack_command_script: row.slack_command_script,
@@ -1784,6 +1815,41 @@ pub(crate) async fn tarball_workspace(
     Ok((headers, body))
 }
 
+#[cfg(test)]
+mod archive_entry_path_tests {
+    use super::check_archive_entry_path;
+
+    #[test]
+    fn rejects_traversal_and_absolute_paths() {
+        for ok in [
+            "u/admin/app.app.json",
+            "f/x/a..b.script.json",
+            "settings.yaml",
+            "migrations/datatable/foo:bar/20260617120000_name.up.sql",
+        ] {
+            assert!(
+                check_archive_entry_path(ok).is_ok(),
+                "{ok} should be accepted"
+            );
+        }
+        for bad in [
+            "f/x/../../evil.app.json",
+            "../evil",
+            "/etc/evil",
+            "f\\..\\evil",
+            "f/x/.. /.. /evil.app.json",
+            "f/x/.../evil",
+            "C:/evil",
+            "\\evil",
+        ] {
+            assert!(
+                check_archive_entry_path(bad).is_err(),
+                "{bad} should be rejected"
+            );
+        }
+    }
+}
+
 #[cfg(test)]
 mod fork_export_tests {
     use super::*;
diff --git a/backend/windmill-common/Cargo.toml b/backend/windmill-common/Cargo.toml
index 06de7cc4aa..e95fadfe66 100644
--- a/backend/windmill-common/Cargo.toml
+++ b/backend/windmill-common/Cargo.toml
@@ -18,7 +18,7 @@ parquet = []
 aws_auth = ["dep:aws-sdk-sts", "dep:aws-config"]
 otel = ["dep:opentelemetry-semantic-conventions", "dep:opentelemetry-otlp", "dep:opentelemetry_sdk",
     "dep:tracing-opentelemetry", "dep:opentelemetry-appender-tracing", "dep:tonic", "dep:opentelemetry"]
-smtp = ["dep:mail-send"]
+smtp = ["dep:mail-send", "dep:rustls", "dep:tokio-rustls", "dep:rustls-native-certs", "dep:webpki-roots"]
 scoped_cache = []
 cloud = []
 dev_override = []
@@ -85,6 +85,10 @@ aws-sdk-rds = { workspace = true, optional = true }
 indexmap.workspace = true
 bytes.workspace = true
 mail-send = { workspace = true, optional = true }
+rustls = { workspace = true, optional = true }
+tokio-rustls = { workspace = true, optional = true }
+rustls-native-certs = { workspace = true, optional = true }
+webpki-roots = { workspace = true, optional = true }
 futures-core.workspace = true
 async-stream.workspace = true
 const_format.workspace = true
@@ -136,6 +140,7 @@ equivalent = "1.0.2"
 [dev-dependencies]
 # `test-util` is not part of tokio's `full`; it is what lets tests pause the clock.
 tokio = { workspace = true, features = ["test-util"] }
+rcgen.workspace = true
 
 [target.'cfg(not(target_env = "msvc"))'.dependencies]
 tikv-jemalloc-ctl = { optional = true, workspace = true }
diff --git a/backend/windmill-common/src/auth.rs b/backend/windmill-common/src/auth.rs
index 3e8eb58a14..86b7f173ac 100644
--- a/backend/windmill-common/src/auth.rs
+++ b/backend/windmill-common/src/auth.rs
@@ -20,7 +20,8 @@ use crate::{
 
 /// Whether `label` denotes a user-created token rather than a system token
 /// (`session`, `guest_session`, `ephemeral*`, `debugger-token`, `mcp-oauth-*`,
-/// `embed_app:*`, `sdk_app:*`, `impersonation:*`). System-token labels are load-bearing —
+/// `embed_app:*`, `sdk_app:*`, `impersonation:*`, `cli-login:*`, `remote-deploy:*`).
+/// System-token labels are load-bearing —
 /// session cleanup, super_admin propagation, expiry notifications and username overrides
 /// all key off them — so they must not be user-editable. `None` (no label) is treated as
 /// a user token.
@@ -47,10 +48,18 @@ pub fn is_user_token(label: Option<&str>) -> bool {
                 && !l.starts_with(APP_EMBED_TOKEN_LABEL_PREFIX)
                 && !l.starts_with(RAW_APP_SDK_TOKEN_LABEL_PREFIX)
                 && !l.starts_with("impersonation:")
+                && !l.starts_with(CLI_LOGIN_TOKEN_LABEL_PREFIX)
+                && !l.starts_with(REMOTE_DEPLOY_TOKEN_LABEL_PREFIX)
         }
     }
 }
 
+/// How far ahead of a user token's expiration its owner is warned (`check_expiring_tokens` in
+/// the monitor). A token whose whole lifetime fits in this window gets no warning at all: it
+/// would arrive minutes after creation, about a lifetime its creator just picked. Its
+/// "expired and deleted" notice still goes out.
+pub const TOKEN_EXPIRY_WARNING_DAYS: i32 = 7;
+
 /// Label prefix, followed by the app path, of the token an app viewer's sandboxed iframe
 /// runs with. Reserved in [`is_user_token`], whose SQL and frontend mirrors spell it out.
 pub const APP_EMBED_TOKEN_LABEL_PREFIX: &str = "embed_app:";
@@ -59,6 +68,21 @@ pub const APP_EMBED_TOKEN_LABEL_PREFIX: &str = "embed_app:";
 /// frontend SDK. Reserved in [`is_user_token`], whose SQL and frontend mirrors spell it out.
 pub const RAW_APP_SDK_TOKEN_LABEL_PREFIX: &str = "sdk_app:";
 
+/// Label prefix, followed by the username, of the token the CLI authorization page mints for
+/// `wmill` logins. Reserved in [`is_user_token`], whose SQL and frontend mirrors spell it out:
+/// the CLI signs in again on its own once that token expires, so an expiry email for it asks
+/// the user to do nothing. Not in [`is_server_minted_label`], since the page mints it through
+/// `/users/tokens/create`.
+pub const CLI_LOGIN_TOKEN_LABEL_PREFIX: &str = "cli-login:";
+
+/// Label prefix, followed by the host of the instance deploying with it, of the token the
+/// `/user/remote_deploy_authorize` page mints for another Windmill instance. Reserved in
+/// [`is_user_token`], whose SQL and frontend mirrors spell it out: it is renewed by connecting
+/// again from the deploying instance, which reports this one rejecting it, so an expiry email or
+/// alert here points at the wrong place. Not in [`is_server_minted_label`], since the page mints it
+/// through `/users/tokens/create`.
+pub const REMOTE_DEPLOY_TOKEN_LABEL_PREFIX: &str = "remote-deploy:";
+
 /// Whether `label` belongs to a namespace only the server mints, and which therefore must be
 /// rejected by `create_token`. Narrower than [`is_user_token`], which also drives label
 /// editability and expiry notifications and can afford to reserve more: `Ephemeral lsp token`,
@@ -475,14 +499,16 @@ async fn fetch_authed_from_permissioned_as_inner(
     // principal — a username freed and reassigned while its previous holder keeps a privileged
     // account — would mix one account's role with another's instance privileges.
     let member = match permissioned_as.split_once('/') {
-        Some(("u", name)) => sqlx::query!(
-            "SELECT is_admin, operator, email FROM usr where username = $1 AND \
+        Some(("u", name)) => {
+            sqlx::query!(
+                "SELECT is_admin, operator, email FROM usr where username = $1 AND \
                                          workspace_id = $2 AND disabled = false",
-            name,
-            &w_id
-        )
-        .fetch_optional(&mut *conn)
-        .await?,
+                name,
+                &w_id
+            )
+            .fetch_optional(&mut *conn)
+            .await?
+        }
         _ => None,
     };
     let resolved_email;
@@ -980,6 +1006,8 @@ mod tests {
         assert!(!is_user_token(Some("embed_app:f/team/dashboard")));
         assert!(!is_user_token(Some("sdk_app:u/admin/raw app")));
         assert!(!is_user_token(Some("impersonation:admin@windmill.dev")));
+        assert!(!is_user_token(Some("cli-login:admin")));
+        assert!(!is_user_token(Some("remote-deploy:windmill.example.com")));
     }
 
     #[test]
diff --git a/backend/windmill-common/src/datatable_roles.rs b/backend/windmill-common/src/datatable_roles.rs
new file mode 100644
index 0000000000..a9195055ac
--- /dev/null
+++ b/backend/windmill-common/src/datatable_roles.rs
@@ -0,0 +1,362 @@
+/*
+ * Author: Ruben Fiszel
+ * Copyright: Windmill Labs, Inc 2022
+ * This file and its contents are licensed under the AGPLv3 License.
+ * Please see the included NOTICE for copyright information and
+ * LICENSE-AGPL for a copy of the license.
+ */
+
+//! The instance's data table role catalog.
+//!
+//! A data table role is a real Postgres login role on the Windmill cluster, named exactly as the
+//! user named it, shared by every instance database. Windmill decides who may ask for a role (the
+//! per-data-table tenant lists in [`crate::workspaces`]); Postgres decides what the role may then
+//! touch. The catalog here is only the first half's vocabulary plus the cluster provisioning.
+//!
+//! Entries are keyed by a generated id so a rename moves nothing else: tenants name the id.
+
+use std::collections::BTreeMap;
+
+use crate::{
+    error::{Error, Result},
+    DB,
+};
+
+/// The connection every data table resolved to before roles existed (`custom_instance_user`). It
+/// owns every pre-existing object, so it is a reserved name rather than a catalog entry: never
+/// created, renamed or dropped.
+pub const ADMIN_DATATABLE_ROLE: &str = "admin";
+
+/// The login the admin connection uses, and the role every created role is granted to — that
+/// membership is what later lets it `ALTER ... OWNER TO` a role and drop it.
+pub const CUSTOM_INSTANCE_USER: &str = "custom_instance_user";
+
+/// One catalog entry, as stored in `datatable_role`. The password is per role and instance-wide;
+/// it belongs to the instance, not to any workspace's settings.
+/// No `Serialize`/`Deserialize`: the catalog is rows now, and a derived `Serialize` would emit
+/// `pwd` — the same way out for a credential that the hand-written `Debug` below closes on the log
+/// side.
+#[derive(Clone)]
+pub struct InstanceDatatableRole {
+    /// The Postgres role name, verbatim.
+    pub name: String,
+    pub enabled: bool,
+    /// Absent only for a role whose provisioning did not finish; resolving as it then errors
+    /// rather than falling back to admin.
+    ///
+    /// A plain string rather than a `StringOrSecretRef` like the instance user's password: that
+    /// one is a secret ref because an operator supplies it and may want it to come from their own
+    /// backend, while this one is minted here and never entered by anyone, so there is nothing for
+    /// a ref to point at. Encrypting generated secrets at rest is a separate change that would
+    /// take the replication password with it.
+    pub pwd: Option<String>,
+}
+
+/// Hand-written so `{:?}` on a catalog cannot put a live Postgres password in a log line or an
+/// audit record. Everything else about the entry is safe to print.
+impl std::fmt::Debug for InstanceDatatableRole {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("InstanceDatatableRole")
+            .field("name", &self.name)
+            .field("enabled", &self.enabled)
+            .field("pwd", &self.pwd.as_ref().map(|_| "<redacted>"))
+            .finish()
+    }
+}
+
+pub type DatatableRoleCatalog = BTreeMap<String, InstanceDatatableRole>;
+
+/// Names Postgres or Windmill already owns. `admin` is excluded because it never reaches the
+/// cluster as a role name at all — it resolves to `custom_instance_user`.
+fn is_reserved_role_name(name: &str) -> bool {
+    let lower = name.to_ascii_lowercase();
+    lower == ADMIN_DATATABLE_ROLE
+        || lower == "postgres"
+        || lower == "public"
+        || lower.starts_with("pg_")
+        || lower.starts_with("windmill_")
+        || lower.starts_with("custom_instance_")
+}
+
+/// The charset is what makes every downstream interpolation safe: the name reaches Postgres as a
+/// quoted identifier, a `-- role <name>` annotation, and a `?role=` query parameter.
+pub fn validate_role_name(name: &str) -> Result<()> {
+    if name.is_empty() || name.len() > 63 {
+        return Err(Error::BadRequest(format!(
+            "Invalid data table role name '{name}': it must be between 1 and 63 characters"
+        )));
+    }
+    if !name
+        .chars()
+        .all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-')
+    {
+        return Err(Error::BadRequest(format!(
+            "Invalid data table role name '{name}': only letters, digits, '_' and '-' are allowed"
+        )));
+    }
+    if is_reserved_role_name(name) {
+        return Err(Error::BadRequest(format!(
+            "'{name}' is reserved and cannot be used as a data table role name"
+        )));
+    }
+    Ok(())
+}
+
+/// A double-quoted Postgres identifier. Doubling `"` is Postgres's own escaping inside one, so this
+/// quotes any name — schema, table or role. Role names are validated as well
+/// ([`validate_role_name`]) because they also travel unquoted, in `-- role <name>` and `?role=`.
+pub fn quote_ident(name: &str) -> String {
+    format!("\"{}\"", name.replace('"', "\"\""))
+}
+
+/// Serialize the mutations that are not already serialized by the row itself.
+///
+/// A create is an insert and a delete is a delete, which Postgres orders for us — the unique index
+/// on `name` is what makes two concurrent creates of the same name one winner and one error. What
+/// still needs it is the window between the cluster DDL and the row: `CREATE ROLE` is not visible
+/// to another transaction's `pg_roles` check until commit, so without this two creates of the same
+/// name both pass their existence check and one fails on the index having already made the login.
+/// Held for the transaction, so the DDL has to run on that same transaction to be covered.
+pub async fn lock_role_catalog(tx: &mut sqlx::Transaction<'_, sqlx::Postgres>) -> Result<()> {
+    sqlx::query!("SELECT pg_advisory_xact_lock(hashtext('datatable_role_catalog'))")
+        .execute(&mut **tx)
+        .await?;
+    Ok(())
+}
+
+/// A replication stream reads every row whatever a data table's roles grant. Turning roles on looks
+/// for streams holding this exclusive; whatever can start a Postgres trigger or capture streaming
+/// holds it shared on the transaction that commits it. So either the look sees the stream, or the
+/// stream's listener connects after roles are committed and refuses. Held for the transaction.
+pub async fn lock_datatable_streams(conn: &mut sqlx::PgConnection, exclusive: bool) -> Result<()> {
+    let lock = if exclusive {
+        "pg_advisory_xact_lock"
+    } else {
+        "pg_advisory_xact_lock_shared"
+    };
+    sqlx::query(&format!("SELECT {lock}(hashtext('datatable_streams'))"))
+        .execute(conn)
+        .await?;
+    Ok(())
+}
+
+/// Whether an instance database is reached only through entries under roles is decided by two
+/// writes that lock different workspaces' settings rows: turning roles on for one entry, and a
+/// settings save pointing an entry without roles at the database. Each holds this for every
+/// database it decides on, so neither reads past the other's uncommitted write. Held for the
+/// transaction; the names are locked in sorted order so two holders cannot deadlock.
+pub async fn lock_instance_databases_governance<'a>(
+    conn: &mut sqlx::PgConnection,
+    dbnames: impl IntoIterator<Item = &'a str>,
+) -> Result<()> {
+    let dbnames: std::collections::BTreeSet<&str> = dbnames.into_iter().collect();
+    for dbname in dbnames {
+        sqlx::query("SELECT pg_advisory_xact_lock(hashtext('datatable_instance_database:' || $1))")
+            .bind(dbname)
+            .execute(&mut *conn)
+            .await?;
+    }
+    Ok(())
+}
+
+/// Disclosure: returns every role's stored Postgres password in plaintext. Any server path that
+/// has to resolve or name a role may call it — including handlers open to a workspace member, who
+/// need the names — but callers MUST NOT let `pwd` reach a response, a log line, an audit record
+/// or an export. Nothing about who may call it: the credential is the whole risk, and `Debug` is
+/// hand-written to redact it for the same reason.
+pub async fn read_role_catalog(db: &DB) -> Result<DatatableRoleCatalog> {
+    crate::datatable_roles_oss::read_role_catalog(db).await
+}
+
+/// As [`read_role_catalog`], reading inside the caller's transaction so the value is the one
+/// [`lock_role_catalog`] is protecting. Same disclosure contract.
+pub async fn read_role_catalog_tx(
+    tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
+) -> Result<DatatableRoleCatalog> {
+    crate::datatable_roles_oss::read_role_catalog_tx(tx).await
+}
+
+/// Record a role, in the caller's transaction so it commits with the `CREATE ROLE` it describes.
+///
+/// Authorization: writes a generated Postgres credential. Callers MUST restrict this to superadmin
+/// paths and MUST hold [`lock_role_catalog`] on `tx`.
+pub async fn insert_role_catalog_entry(
+    tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
+    id: &str,
+    role: &InstanceDatatableRole,
+) -> Result<()> {
+    crate::datatable_roles_oss::insert_role_catalog_entry(tx, id, role).await
+}
+
+/// Update a role's recorded name, login flag and password. Same contract as
+/// [`insert_role_catalog_entry`].
+pub async fn update_role_catalog_entry(
+    tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
+    id: &str,
+    role: &InstanceDatatableRole,
+) -> Result<()> {
+    crate::datatable_roles_oss::update_role_catalog_entry(tx, id, role).await
+}
+
+/// Forget a role. Same contract as [`insert_role_catalog_entry`]; run it in the transaction that
+/// drops the cluster login, so the two cannot disagree.
+pub async fn delete_role_catalog_entry(
+    tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
+    id: &str,
+) -> Result<()> {
+    crate::datatable_roles_oss::delete_role_catalog_entry(tx, id).await
+}
+
+/// Resolve the role a caller named to its catalog id. A disabled role is an error rather than a
+/// silent fallback: the caller asked for something the instance deliberately turned off.
+pub fn role_id_by_name<'a>(catalog: &'a DatatableRoleCatalog, name: &str) -> Result<&'a str> {
+    let entry = catalog
+        .iter()
+        .find(|(_, role)| role.name == name)
+        .ok_or_else(|| {
+            Error::NotFound(format!(
+                "'{name}' is not a data table role of this instance. Defined roles: {}.",
+                catalog
+                    .values()
+                    .map(|r| r.name.as_str())
+                    .collect::<Vec<_>>()
+                    .join(", ")
+            ))
+        })?;
+    if !entry.1.enabled {
+        return Err(Error::BadRequest(format!(
+            "Data table role '{name}' is disabled on this instance"
+        )));
+    }
+    Ok(entry.0.as_str())
+}
+
+/// Every instance database the registry knows about. Role provisioning has to reach all of them:
+/// a role that cannot `CONNECT` to a database is refused by Postgres before any grant matters.
+///
+/// Authorization: checks nothing, and names every instance database across all workspaces. Callers
+/// MUST be superadmin-gated or keep the names server-side; never return them to a workspace caller.
+pub async fn registered_instance_databases(db: &DB) -> Result<Vec<String>> {
+    crate::datatable_roles_oss::registered_instance_databases(db).await
+}
+
+/// `CONNECT` on `dbname` for every enabled role, and none for `PUBLIC`. Run at role creation, at
+/// database creation, and lazily whenever an instance data table is administered, so a database
+/// provisioned before a role existed is repaired rather than left silently unreachable.
+///
+/// Authorization: rewrites a database's ACL with the server's own credentials and checks nothing.
+/// Callers MUST have authorized administration of `dbname` — superadmin, or an admin of the
+/// workspace governing a data table on it.
+pub async fn converge_connect_grants(db: &DB, dbname: &str) -> Result<()> {
+    crate::datatable_roles_oss::converge_connect_grants(db, dbname).await
+}
+
+/// As [`converge_connect_grants`], with a catalog the caller already read. Same contract.
+pub async fn converge_connect_grants_with(
+    db: &DB,
+    dbname: &str,
+    catalog: &DatatableRoleCatalog,
+) -> Result<()> {
+    crate::datatable_roles_oss::converge_connect_grants_with(db, dbname, catalog).await
+}
+
+/// `CREATE ROLE <name> LOGIN PASSWORD ...; GRANT <name> TO custom_instance_user`, and `CONNECT` on
+/// every registered database. No privileges beyond that — an admin grants them through SQL or the
+/// ACL editor.
+///
+/// Authorization: creates a cluster-wide Postgres login. Callers MUST restrict this to superadmin
+/// paths, and MUST hold [`lock_role_catalog`] on the same transaction.
+pub async fn create_instance_role(
+    tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
+    name: &str,
+    password: &str,
+) -> Result<()> {
+    crate::datatable_roles_oss::create_instance_role(tx, name, password).await
+}
+
+/// Authorization: alters a cluster-wide Postgres login. Callers MUST restrict this to superadmin
+/// paths, and MUST hold [`lock_role_catalog`] on the same transaction.
+pub async fn set_instance_role_login(
+    tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
+    name: &str,
+    enabled: bool,
+) -> Result<()> {
+    crate::datatable_roles_oss::set_instance_role_login(tx, name, enabled).await
+}
+
+/// A rename discards an md5-hashed password, so the caller has to hand over a fresh one.
+///
+/// Authorization: renames a cluster-wide Postgres login. Callers MUST restrict this to superadmin
+/// paths, and MUST hold [`lock_role_catalog`] on the same transaction.
+pub async fn rename_instance_role(
+    tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
+    from: &str,
+    to: &str,
+    password: &str,
+) -> Result<()> {
+    crate::datatable_roles_oss::rename_instance_role(tx, from, to, password).await
+}
+
+/// A role owning anything in any database blocks its own `DROP ROLE`, and both its objects and the
+/// privileges granted to it are only visible from inside each database — hence the pass over the
+/// registry. An unreachable database aborts the whole delete: dropping the role while one database
+/// still holds objects owned by it leaves those objects owned by a numeric OID nobody can name.
+///
+/// Each pass runs as the instance's own Postgres user rather than `custom_instance_user`, which
+/// owns the databases and can therefore revoke a grant whoever made it. `custom_instance_user`
+/// could only undo what it granted itself, so a privilege planted by an operator in psql — the
+/// ordinary way privileges reach a role — would survive and block the drop.
+///
+/// Authorization: drops a cluster-wide Postgres login and reassigns everything it owns. Callers
+/// MUST restrict this to superadmin paths, and MUST hold [`lock_role_catalog`] on `tx`.
+///
+/// The per-database passes open their own connections and cannot join `tx`; the lock is what keeps
+/// a concurrent mutation out while they run. Only the final `DROP ROLE` is on `tx`, so it commits
+/// or rolls back with the catalog write that forgets the role. Those passes commit as they go, so
+/// callers MUST have disabled the role in an earlier committed transaction: a failure part-way
+/// then leaves a disabled role to retry, not an enabled one already stripped in some databases.
+pub async fn drop_instance_role(
+    db: &DB,
+    tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
+    name: &str,
+) -> Result<()> {
+    crate::datatable_roles_oss::drop_instance_role(db, tx, name).await
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn role_names_are_validated() {
+        assert!(validate_role_name("analytics").is_ok());
+        assert!(validate_role_name("read-only_2").is_ok());
+        assert!(validate_role_name("").is_err());
+        assert!(validate_role_name(&"a".repeat(64)).is_err());
+        assert!(validate_role_name("has space").is_err());
+        assert!(validate_role_name("quote\"injection").is_err());
+        // Reserved, case-insensitively.
+        assert!(validate_role_name("admin").is_err());
+        assert!(validate_role_name("Postgres").is_err());
+        assert!(validate_role_name("pg_read_all_data").is_err());
+        assert!(validate_role_name("windmill_user").is_err());
+        assert!(validate_role_name("custom_instance_user").is_err());
+    }
+
+    #[test]
+    fn a_disabled_role_is_an_error_not_a_fallback() {
+        let mut catalog = DatatableRoleCatalog::new();
+        catalog.insert(
+            "id1".to_string(),
+            InstanceDatatableRole {
+                name: "analytics".to_string(),
+                enabled: false,
+                pwd: Some("x".to_string()),
+            },
+        );
+        assert!(role_id_by_name(&catalog, "analytics").is_err());
+        assert!(role_id_by_name(&catalog, "nope").is_err());
+        catalog.get_mut("id1").unwrap().enabled = true;
+        assert_eq!(role_id_by_name(&catalog, "analytics").unwrap(), "id1");
+    }
+}
diff --git a/backend/windmill-common/src/datatable_roles_oss.rs b/backend/windmill-common/src/datatable_roles_oss.rs
new file mode 100644
index 0000000000..2a3f9dda48
--- /dev/null
+++ b/backend/windmill-common/src/datatable_roles_oss.rs
@@ -0,0 +1,209 @@
+/*
+ * Author: Ruben Fiszel
+ * Copyright: Windmill Labs, Inc 2022
+ * This file and its contents are licensed under the AGPLv3 License.
+ * Please see the included NOTICE for copyright information and
+ * LICENSE-AGPL for a copy of the license.
+ */
+
+//! Where data table roles come from: the enterprise implementation, or a refusal.
+//!
+//! Roles are an Enterprise Edition feature. An edition without them creates, grants and connects
+//! as none, and a data table saved under roles — by an enterprise build, before a downgrade — is
+//! refused rather than resolved as `admin`. A data table not under roles, asked for no role,
+//! resolves as it always has. `private` alone is not that edition: community builds carry it.
+
+use crate::error::Error;
+
+/// What every roles path answers without the Enterprise Edition. The frontend matches this exact
+/// sentence (`datatableUsableRoles.ts`) to read the refusal as "not under roles": reword both.
+pub fn datatable_roles_unavailable() -> Error {
+    Error::BadRequest("Data table roles are a Windmill Enterprise Edition feature".to_string())
+}
+
+#[cfg(all(feature = "private", feature = "enterprise"))]
+pub(crate) use crate::datatable_roles_ee::{
+    can_use_datatable_role, can_use_datatable_role_in_governing_workspace, converge_connect_grants,
+    converge_connect_grants_with, create_instance_role, delete_role_catalog_entry,
+    drop_instance_role, ensure_can_use_datatable_role, ensure_datatable_admin_access,
+    ensure_instance_db_grant_options_unchecked, forget_datatable_role_everywhere,
+    insert_role_catalog_entry, read_role_catalog, read_role_catalog_tx,
+    registered_instance_databases, rename_instance_role, resolve_datatable_role_connection,
+    set_instance_role_login, update_role_catalog_entry,
+};
+
+#[cfg(not(all(feature = "private", feature = "enterprise")))]
+pub(crate) use ce::*;
+
+#[cfg(not(all(feature = "private", feature = "enterprise")))]
+mod ce {
+    use super::datatable_roles_unavailable as unavailable;
+    use crate::{
+        datatable_roles::{DatatableRoleCatalog, InstanceDatatableRole},
+        db::AuthedRef,
+        error::Result,
+        workspaces::{
+            resolve_governing_datatable, DataTableRoleTenants, DatatableAccess, GoverningDatatable,
+        },
+        DB,
+    };
+
+    type Tx<'a> = sqlx::Transaction<'a, sqlx::Postgres>;
+
+    pub(crate) async fn read_role_catalog(_db: &DB) -> Result<DatatableRoleCatalog> {
+        Err(unavailable())
+    }
+
+    pub(crate) async fn read_role_catalog_tx(_tx: &mut Tx<'_>) -> Result<DatatableRoleCatalog> {
+        Err(unavailable())
+    }
+
+    pub(crate) async fn insert_role_catalog_entry(
+        _tx: &mut Tx<'_>,
+        _id: &str,
+        _role: &InstanceDatatableRole,
+    ) -> Result<()> {
+        Err(unavailable())
+    }
+
+    pub(crate) async fn update_role_catalog_entry(
+        _tx: &mut Tx<'_>,
+        _id: &str,
+        _role: &InstanceDatatableRole,
+    ) -> Result<()> {
+        Err(unavailable())
+    }
+
+    pub(crate) async fn delete_role_catalog_entry(_tx: &mut Tx<'_>, _id: &str) -> Result<()> {
+        Err(unavailable())
+    }
+
+    pub(crate) async fn registered_instance_databases(_db: &DB) -> Result<Vec<String>> {
+        Err(unavailable())
+    }
+
+    /// Nothing to converge: with no roles to admit, an instance database keeps the `CONNECT`
+    /// grants it was created with, `PUBLIC`'s included, as it did before roles existed.
+    pub(crate) async fn converge_connect_grants(_db: &DB, _dbname: &str) -> Result<()> {
+        Ok(())
+    }
+
+    /// As [`converge_connect_grants`].
+    pub(crate) async fn converge_connect_grants_with(
+        _db: &DB,
+        _dbname: &str,
+        _catalog: &DatatableRoleCatalog,
+    ) -> Result<()> {
+        Ok(())
+    }
+
+    pub(crate) async fn create_instance_role(
+        _tx: &mut Tx<'_>,
+        _name: &str,
+        _password: &str,
+    ) -> Result<()> {
+        Err(unavailable())
+    }
+
+    pub(crate) async fn set_instance_role_login(
+        _tx: &mut Tx<'_>,
+        _name: &str,
+        _enabled: bool,
+    ) -> Result<()> {
+        Err(unavailable())
+    }
+
+    pub(crate) async fn rename_instance_role(
+        _tx: &mut Tx<'_>,
+        _from: &str,
+        _to: &str,
+        _password: &str,
+    ) -> Result<()> {
+        Err(unavailable())
+    }
+
+    pub(crate) async fn drop_instance_role(_db: &DB, _tx: &mut Tx<'_>, _name: &str) -> Result<()> {
+        Err(unavailable())
+    }
+
+    pub(crate) async fn ensure_instance_db_grant_options_unchecked(
+        _db: &DB,
+        _dbname: &str,
+    ) -> Result<()> {
+        Err(unavailable())
+    }
+
+    /// No tenant list covers anyone: there is no role to connect as.
+    pub(crate) fn can_use_datatable_role(
+        _tenants: &DataTableRoleTenants,
+        _authed: &AuthedRef<'_>,
+    ) -> bool {
+        false
+    }
+
+    pub(crate) async fn can_use_datatable_role_in_governing_workspace(
+        _db: &DB,
+        _governing_w_id: &str,
+        _w_id: &str,
+        _tenants: &DataTableRoleTenants,
+        _access: &DatatableAccess<'_>,
+    ) -> Result<bool> {
+        Err(unavailable())
+    }
+
+    /// Reached only for a data table under roles or a caller naming a role: both are refused.
+    pub(crate) async fn resolve_datatable_role_connection(
+        _db: &DB,
+        _w_id: &str,
+        _name: &str,
+        _governing: &GoverningDatatable,
+        _db_resource: serde_json::Value,
+        _role: Option<&str>,
+        _access: DatatableAccess<'_>,
+    ) -> Result<serde_json::Value> {
+        Err(unavailable())
+    }
+
+    /// A data table not under roles, asked for no role or for `admin`, is not a role decision and
+    /// passes, as it did before roles existed. Anything else is refused.
+    pub(crate) async fn ensure_can_use_datatable_role(
+        db: &DB,
+        w_id: &str,
+        name: &str,
+        role: Option<&str>,
+        _access: &DatatableAccess<'_>,
+        _context: &str,
+    ) -> Result<()> {
+        let governing = resolve_governing_datatable(db, w_id, name).await?;
+        if governing.datatable.permissions.is_none()
+            && role.is_none_or(|r| r == crate::datatable_roles::ADMIN_DATATABLE_ROLE)
+        {
+            Ok(())
+        } else {
+            Err(unavailable())
+        }
+    }
+
+    /// A data table not under roles is the `admin` connection for anyone who reaches it, as before
+    /// roles existed. One under roles is refused.
+    pub(crate) async fn ensure_datatable_admin_access(
+        db: &DB,
+        w_id: &str,
+        name: &str,
+        _access: &DatatableAccess<'_>,
+    ) -> Result<()> {
+        let governing = resolve_governing_datatable(db, w_id, name).await?;
+        if governing.datatable.permissions.is_none() {
+            Ok(())
+        } else {
+            Err(unavailable())
+        }
+    }
+
+    pub(crate) async fn forget_datatable_role_everywhere(
+        _tx: &mut Tx<'_>,
+        _role_id: &str,
+    ) -> Result<()> {
+        Err(unavailable())
+    }
+}
diff --git a/backend/windmill-common/src/global_settings.rs b/backend/windmill-common/src/global_settings.rs
index ef63fc2347..e72a2bb4e2 100644
--- a/backend/windmill-common/src/global_settings.rs
+++ b/backend/windmill-common/src/global_settings.rs
@@ -102,6 +102,49 @@ pub const HUB_API_SECRET_SETTING: &str = "hub_api_secret";
 pub const AUTOMATE_USERNAME_CREATION_SETTING: &str = "automate_username_creation";
 pub const DISABLE_WORKSPACE_INVITE_EMAILS_SETTING: &str = "disable_workspace_invite_emails";
 pub const DISABLE_PASSWORD_LOGIN_SETTING: &str = "disable_password_login";
+/// Refuse `?token=` on the MCP endpoints, leaving the `Authorization` header as the only way
+/// in. A URL-borne credential ends up in browser history, proxy logs and referrers, so an
+/// instance that cares sends MCP clients through the OAuth flow instead.
+pub const MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING: &str = "mcp_disable_token_query_param";
+/// Ceiling, in days, on how far ahead a token minted through `POST /users/tokens/create` or
+/// `POST /users/tokens/impersonate` may expire; a request asking for more, or for no
+/// expiration at all, is shortened to it rather than refused. On those routes only: server-side
+/// mints (webhook tokens, app embed tokens, sessions) choose a lifetime the caller never picks
+/// and go straight to `create_token_internal`. Read and validated by
+/// [`parse_max_token_expiration_days`].
+pub const MAX_TOKEN_EXPIRATION_DAYS_SETTING: &str = "max_token_expiration_days";
+/// Largest `max_token_expiration_days` read as a ceiling, about 2,700 years. The token form
+/// applies the same bound (`frontend/src/lib/tokenExpiration.ts`) so that it and the server
+/// agree on whether a ceiling exists.
+pub const MAX_TOKEN_EXPIRATION_DAYS_BOUND: i64 = 1_000_000;
+
+/// Reads a stored `max_token_expiration_days`: `Ok(None)` when unset or cleared (null or an
+/// empty string), the ceiling for a whole number of days within
+/// `1..=MAX_TOKEN_EXPIRATION_DAYS_BOUND` stored as an integer, an integral float or a string of
+/// digits, and an error for anything else.
+///
+/// The settings API and config sync both reject the error at write time: the token routes can
+/// only read an unparseable value as no ceiling, so accepting a typo would silently turn the
+/// policy off. `parseMaxTokenExpirationDays` in the frontend must accept exactly the same values.
+pub fn parse_max_token_expiration_days(
+    value: Option<&serde_json::Value>,
+) -> Result<Option<i64>, String> {
+    let days = match value {
+        None | Some(serde_json::Value::Null) => return Ok(None),
+        Some(serde_json::Value::String(s)) if s.trim().is_empty() => return Ok(None),
+        Some(serde_json::Value::Number(n)) => n
+            .as_i64()
+            .or_else(|| n.as_f64().filter(|f| f.fract() == 0.0).map(|f| f as i64)),
+        Some(serde_json::Value::String(s)) => s.trim().parse::<i64>().ok(),
+        Some(_) => None,
+    };
+    match days {
+        Some(days) if (1..=MAX_TOKEN_EXPIRATION_DAYS_BOUND).contains(&days) => Ok(Some(days)),
+        _ => Err(format!(
+            "must be a whole number of days from 1 to {MAX_TOKEN_EXPIRATION_DAYS_BOUND}, or empty for no limit"
+        )),
+    }
+}
 pub const AUTO_LOGIN_PROVIDER_SETTING: &str = "auto_login_provider";
 /// Name of the SAML attribute or OIDC userinfo claim carrying the user's IdP groups. Unset or
 /// empty leaves instance-group membership entirely to SCIM.
@@ -238,6 +281,51 @@ pub fn validate_instance_banner(value: &serde_json::Value) -> Result<(), String>
     Ok(())
 }
 
+/// Instance-wide accent color (`#rrggbb`) that recolors the UI's accent tokens and
+/// tints the sidebar, so each environment of a deployment is recognizable at a glance.
+/// Readable by any authenticated user, like [`INSTANCE_BANNER_SETTING`].
+pub const ACCENT_COLOR_SETTING: &str = "accent_color";
+
+/// Validate an [`ACCENT_COLOR_SETTING`] value.
+///
+/// Only `#rrggbb` is accepted: the value is interpolated into a stylesheet every user
+/// loads, so anything looser is CSS injection into every session of the instance.
+pub fn validate_accent_color(value: &serde_json::Value) -> Result<(), String> {
+    let s = value
+        .as_str()
+        .ok_or_else(|| "must be a string".to_string())?;
+    let hex = s.strip_prefix('#').unwrap_or("");
+    if hex.len() != 6 || !hex.chars().all(|c| c.is_ascii_hexdigit()) {
+        return Err("must be a hex color of the form #rrggbb".to_string());
+    }
+    Ok(())
+}
+
+/// The settings every signed-in browser reads on each full page load.
+#[derive(serde::Serialize, Clone, Debug, Default, PartialEq)]
+pub struct InstanceUi {
+    pub instance_banner: Option<serde_json::Value>,
+    pub accent_color: Option<serde_json::Value>,
+}
+
+pub async fn get_instance_ui(db: &Pool<Postgres>) -> error::Result<InstanceUi> {
+    let rows = sqlx::query!(
+        "SELECT name, value FROM global_settings WHERE name = ANY($1)",
+        &[INSTANCE_BANNER_SETTING, ACCENT_COLOR_SETTING] as &[&str]
+    )
+    .fetch_all(db)
+    .await?;
+    let mut ui = InstanceUi::default();
+    for row in rows {
+        match row.name.as_str() {
+            INSTANCE_BANNER_SETTING => ui.instance_banner = Some(row.value),
+            ACCENT_COLOR_SETTING => ui.accent_color = Some(row.value),
+            _ => {}
+        }
+    }
+    Ok(ui)
+}
+
 /// Validate a [`GITHUB_APP_WEBHOOK_BASE_URL_SETTING`] value.
 ///
 /// The receiver path is appended to it verbatim, so anything that doesn't
@@ -368,6 +456,7 @@ use std::sync::atomic::AtomicBool;
 lazy_static::lazy_static! {
     pub static ref HTTP_ROUTE_WORKSPACED_ROUTE: AtomicBool = AtomicBool::new(false);
     pub static ref DISABLE_PASSWORD_LOGIN: AtomicBool = AtomicBool::new(false);
+    pub static ref MCP_DISABLE_TOKEN_QUERY_PARAM: AtomicBool = AtomicBool::new(false);
     /// Origins HTTP routes allow cross-origin when they configure none of their
     /// own. Empty means unset, which keeps the historical `*`.
     pub static ref HTTP_ROUTE_DEFAULT_ALLOWED_ORIGINS: arc_swap::ArcSwap<Vec<String>> =
@@ -811,6 +900,55 @@ pub fn workspace_integration_auth_endpoint(client_name: &str, base_url: &str) ->
 mod tests {
     use super::*;
 
+    // `frontend/src/lib/tokenExpiration.test.ts` holds the same table for the token form's
+    // parser; the two must stay in step.
+    #[test]
+    fn max_token_expiration_days_accepts_only_whole_days_within_the_bound() {
+        use serde_json::json;
+        for (stored, days) in [
+            (json!(7), 7),
+            (json!(7.0), 7),
+            (json!("7"), 7),
+            (json!(" 30 "), 30),
+            (json!("+7"), 7),
+            (
+                json!(MAX_TOKEN_EXPIRATION_DAYS_BOUND),
+                MAX_TOKEN_EXPIRATION_DAYS_BOUND,
+            ),
+        ] {
+            assert_eq!(
+                parse_max_token_expiration_days(Some(&stored)),
+                Ok(Some(days)),
+                "{stored}"
+            );
+        }
+        for cleared in [json!(null), json!(""), json!("  ")] {
+            assert_eq!(
+                parse_max_token_expiration_days(Some(&cleared)),
+                Ok(None),
+                "{cleared}"
+            );
+        }
+        assert_eq!(parse_max_token_expiration_days(None), Ok(None));
+        for bad in [
+            json!(7.5),
+            json!(0),
+            json!(-3),
+            json!("7.0"),
+            json!("1e1"),
+            json!("0x7"),
+            json!(MAX_TOKEN_EXPIRATION_DAYS_BOUND + 1),
+            json!("99999999999999999999"),
+            json!(true),
+            json!([7]),
+        ] {
+            assert!(
+                parse_max_token_expiration_days(Some(&bad)).is_err(),
+                "{bad} must be rejected"
+            );
+        }
+    }
+
     #[test]
     fn webhook_base_url_errors_never_echo_credentials() {
         // These strings reach sync-config output and operator logs, so no branch may
@@ -846,6 +984,26 @@ mod tests {
         }
     }
 
+    #[test]
+    fn accent_color_accepts_only_hex_rgb() {
+        for ok in ["#1f9d55", "#ABCDEF"] {
+            assert!(
+                validate_accent_color(&serde_json::json!(ok)).is_ok(),
+                "{ok}"
+            );
+        }
+        for bad in [
+            serde_json::json!("1f9d55"),
+            serde_json::json!("#fff"),
+            serde_json::json!("red"),
+            serde_json::json!("#000000;} body{display:none"),
+            serde_json::json!("#12345g"),
+            serde_json::json!(123),
+        ] {
+            assert!(validate_accent_color(&bad).is_err(), "{bad}");
+        }
+    }
+
     #[test]
     fn instance_banner_rejects_unsafe_and_malformed_values() {
         // The link becomes the href of an anchor shown to every user of the instance,
diff --git a/backend/windmill-common/src/guest_jwt.rs b/backend/windmill-common/src/guest_jwt.rs
index 9f3e47d708..dc0407163d 100644
--- a/backend/windmill-common/src/guest_jwt.rs
+++ b/backend/windmill-common/src/guest_jwt.rs
@@ -167,7 +167,13 @@ pub fn jwk_algorithms(jwk: &Jwk) -> Option<Vec<Algorithm>> {
     {
         return None;
     }
-    match (&jwk.algorithm, jwk.common.algorithm) {
+    let alg = crate::jwt::jwk_algorithm(jwk);
+    // A key that names an `alg` we cannot verify with (RSA-OAEP, ...) is not an alg-less
+    // key to be tried against the whole family: it is published for something else.
+    if alg.is_none() && jwk.common.key_algorithm.is_some() {
+        return None;
+    }
+    match (&jwk.algorithm, alg) {
         (AlgorithmParameters::RSA(_), Some(alg)) if RSA_ALGORITHMS.contains(&alg) => {
             Some(vec![alg])
         }
@@ -197,6 +203,9 @@ pub fn verify(
     let mut validation = Validation::new(algorithms[0]);
     validation.algorithms = algorithms.to_vec();
     validation.validate_nbf = true;
+    // Audience is not part of the guest contract: issuers commonly stamp their own `aud`,
+    // and no accepted audience is configured, so an `aud` claim must not fail the token.
+    validation.validate_aud = false;
     let claims = jsonwebtoken::decode::<GuestJwtClaims>(token, key, &validation)
         .map_err(|e| Error::NotAuthorized(format!("guest JWT refused: {e}")))?
         .claims;
@@ -648,6 +657,12 @@ mod tests {
         assert_eq!(jwk_algorithms(&k), None);
     }
 
+    #[test]
+    fn a_key_naming_an_encryption_alg_is_refused() {
+        let k = jwk(serde_json::json!({"kty":"RSA","alg":"RSA-OAEP","n":"aa","e":"AQAB"}));
+        assert_eq!(jwk_algorithms(&k), None);
+    }
+
     #[test]
     fn a_key_marked_for_encryption_is_refused() {
         let k = jwk(serde_json::json!({"kty":"RSA","use":"enc","n":"aa","e":"AQAB"}));
@@ -789,6 +804,50 @@ mod tests {
         .is_err());
     }
 
+    #[test]
+    fn a_token_carrying_an_audience_still_verifies() {
+        // jsonwebtoken validates `aud` by default when the token has one, which would refuse
+        // every issuer that stamps its own audience.
+        let key = jsonwebtoken::DecodingKey::from_jwk(&jwk(serde_json::json!({
+            "kty": "EC", "crv": "P-256", "kid": "k1", "x": PUB1_X, "y": PUB1_Y
+        })))
+        .unwrap();
+        let token = jsonwebtoken::encode(
+            &jsonwebtoken::Header::new(Algorithm::ES256),
+            &serde_json::json!({
+                "email": "g@example.com",
+                "workspace_id": "ws",
+                "app_path": "u/a/app",
+                "aud": "https://issuer.example/api",
+                "exp": jsonwebtoken::get_current_timestamp() + 600,
+            }),
+            &jsonwebtoken::EncodingKey::from_ec_pem(PRIV1.as_bytes()).unwrap(),
+        )
+        .unwrap();
+        verify(&token, &key, &[Algorithm::ES256], "ws").expect("aud is not validated");
+    }
+
+    #[test]
+    fn an_8192_bit_rsa_key_verifies() {
+        // The largest modulus real issuers use; a crypto backend capped at 4096 bits rejects
+        // every token signed with it while the key itself still loads.
+        const PRIVATE: &str = include_str!("../tests/fixtures/guest_jwt_rsa8192_private.pem");
+        const PUBLIC: &str = include_str!("../tests/fixtures/guest_jwt_rsa8192_public.pem");
+        let (key, algs) = decoding_key_from_pem(PUBLIC).expect("8192-bit SPKI loads");
+        let token = jsonwebtoken::encode(
+            &jsonwebtoken::Header::new(Algorithm::RS256),
+            &serde_json::json!({
+                "email": "g@example.com",
+                "workspace_id": "ws",
+                "app_path": "u/a/app",
+                "exp": jsonwebtoken::get_current_timestamp() + 600,
+            }),
+            &jsonwebtoken::EncodingKey::from_rsa_pem(PRIVATE.as_bytes()).unwrap(),
+        )
+        .unwrap();
+        verify(&token, &key, algs, "ws").expect("8192-bit RSA signature verifies");
+    }
+
     // A real RSA public key (SPKI). Its private counterpart is RSA_PKCS1_PRIVATE below.
     const RSA_PUBLIC: &str = "-----BEGIN PUBLIC KEY-----\n\
 MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx3J0fQcHp2ZlMI4rCVsY\n\
diff --git a/backend/windmill-common/src/instance_config.rs b/backend/windmill-common/src/instance_config.rs
index de3fd7684a..508379c3a4 100644
--- a/backend/windmill-common/src/instance_config.rs
+++ b/backend/windmill-common/src/instance_config.rs
@@ -831,6 +831,8 @@ pub struct CustomInstanceDbLogs {
     pub replication_user: String,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub replication_user_error: Option<String>,
+    #[serde(skip_serializing_if = "String::is_empty")]
+    pub user_connect: String,
 }
 
 // ---------------------------------------------------------------------------
@@ -1027,9 +1029,10 @@ const NESTED_SENSITIVE_FIELDS: &[(&str, &[&str])] = &[
     ),
     (
         "object_store_cache_config",
-        &["secret_key", "serviceAccountKey"],
+        &["secret_key", "serviceAccountKey", "accessKey"],
     ),
     ("custom_instance_pg_databases", &["user_pwd"]),
+    ("github_enterprise_app", &["private_key"]),
 ];
 
 fn redact_json_value(value: &serde_json::Value) -> serde_json::Value {
@@ -1351,6 +1354,14 @@ pub async fn sync_global_settings_declarative(
             .map_err(|e| anyhow::anyhow!("{banner_key}: {e}"))?,
     }
 
+    let accent_key = crate::global_settings::ACCENT_COLOR_SETTING;
+    match desired.get(accent_key) {
+        None | Some(serde_json::Value::Null) => {}
+        Some(serde_json::Value::String(s)) if s.trim().is_empty() => {}
+        Some(color) => crate::global_settings::validate_accent_color(color)
+            .map_err(|e| anyhow::anyhow!("{accent_key}: {e}"))?,
+    }
+
     // An origin list that cannot be parsed is dropped at boot, leaving the
     // empty default — which is no restriction at all. Rejecting it here is what
     // keeps a typo in a ConfigMap from silently widening CORS instance-wide.
@@ -1358,6 +1369,10 @@ pub async fn sync_global_settings_declarative(
     crate::global_settings::parse_allowed_origins_setting(desired.get(origins_key))
         .map_err(|e| anyhow::anyhow!("{origins_key}: {e}"))?;
 
+    let max_expiration_key = crate::global_settings::MAX_TOKEN_EXPIRATION_DAYS_SETTING;
+    crate::global_settings::parse_max_token_expiration_days(desired.get(max_expiration_key))
+        .map_err(|e| anyhow::anyhow!("{max_expiration_key}: {e}"))?;
+
     let diff = diff_global_settings(current, desired, ApplyMode::Replace);
     apply_settings_diff(db, &diff).await?;
 
@@ -2641,6 +2656,26 @@ mod tests {
         assert!(formatted.contains("****"));
     }
 
+    #[test]
+    fn format_setting_value_redacts_nested_credentials() {
+        let val = serde_json::json!({
+            "type": "Azure",
+            "accountName": "acct",
+            "containerName": "c",
+            "accessKey": "azure-storage-account-key-12345"
+        });
+        let formatted = format_setting_value("object_store_cache_config", &val);
+        assert!(!formatted.contains("azure-storage-account-key-12345"));
+        assert!(formatted.contains("acct"));
+
+        let val = serde_json::json!({
+            "app_id": 1,
+            "private_key": "-----BEGIN RSA PRIVATE KEY-----\nMIIEsecretbody\n-----END RSA PRIVATE KEY-----"
+        });
+        let formatted = format_setting_value("github_enterprise_app", &val);
+        assert!(!formatted.contains("MIIEsecretbody"));
+    }
+
     #[test]
     #[should_panic(expected = "literal_value() called on unresolved secret ref")]
     fn string_or_secret_ref_literal_value_panics_on_ref() {
diff --git a/backend/windmill-common/src/jobs.rs b/backend/windmill-common/src/jobs.rs
index 6f3248f3fb..796d1c999a 100644
--- a/backend/windmill-common/src/jobs.rs
+++ b/backend/windmill-common/src/jobs.rs
@@ -17,7 +17,7 @@ use crate::{
     get_latest_deployed_hash_for_path, get_latest_flow_version_info_for_path,
     scripts::{get_full_hub_script_by_path, ScriptHash, ScriptLang},
     utils::{StripPath, HTTP_CLIENT},
-    worker::{to_raw_value, CUSTOM_TAGS_PER_WORKSPACE, WINDMILL_DIR},
+    worker::{custom_tag_matches, to_raw_value, CUSTOM_TAGS_PER_WORKSPACE, WINDMILL_DIR},
     workspaces::workspace_with_fork_ancestors,
     FlowVersionInfo, ScriptHashInfo, Tag,
 };
@@ -337,33 +337,70 @@ lazy_static::lazy_static! {
 // `is_super_admin` is passed in (not derived from an email here) so callers can
 // make it job-token-aware: a job's WM_TOKEN must never count as superadmin
 // (GHSA-hfh4-cx4h-3fcr). See `is_super_admin_authed` at the request wrapper.
+//
+// Custom tags judge `resolved_tag`, the queue the job actually lands on, and `tag` only as the
+// job's author wrote it: a dynamic tag names any queue its values do. Callers go through
+// `windmill_queue::check_tag_available_for_push`, which resolves it the way `push` does.
+// `resolved_tag` is `None` when the values are not known yet: only an entry spelled like `tag`
+// admits it then. `tag_workspace` resolves to what the job's `$workspace` stands for.
 pub async fn check_tag_available_for_workspace_internal(
     db: &DB,
     w_id: &str,
     tag: &str,
+    resolved_tag: Option<&str>,
+    tag_workspace: impl Future<Output = String>,
     is_super_admin: bool,
     scope_tags: Option<Vec<&str>>,
 ) -> error::Result<()> {
-    let mut is_tag_in_scope_tags = None;
-    let mut is_tag_in_workspace_custom_tags = false;
-
-    if let Some(scope_tags) = scope_tags.as_ref() {
-        is_tag_in_scope_tags = Some(scope_tags.contains(&tag));
-    }
+    let is_tag_in_scope_tags = scope_tags.as_ref().map(|scope_tags| {
+        scope_tags.contains(&tag) || resolved_tag.is_some_and(|r| scope_tags.contains(&r))
+    });
 
     let custom_tags_per_w = CUSTOM_TAGS_PER_WORKSPACE.load();
-    if custom_tags_per_w.global.contains(&tag.to_string()) {
-        is_tag_in_workspace_custom_tags = true;
-    } else if let Some(specific_tag) = custom_tags_per_w.specific.get(tag) {
-        // Only a fork-scoped tag can match through the lineage, so every other tag keeps the
-        // ancestor lookup off the push path entirely.
-        let chain = if specific_tag.is_fork_scoped() {
-            workspace_with_fork_ancestors(db, w_id).await?
-        } else {
-            vec![w_id.to_string()]
-        };
-        is_tag_in_workspace_custom_tags = specific_tag.applies_to_workspace(&chain);
-    }
+    // Only an entry reading `$workspace` needs it, so every other tag keeps its lookup off the
+    // push path.
+    let tag_workspace = if resolved_tag.is_some()
+        && custom_tags_per_w
+            .global
+            .iter()
+            .chain(custom_tags_per_w.specific.keys())
+            .any(|t| t.contains("$workspace"))
+    {
+        tag_workspace.await
+    } else {
+        w_id.to_string()
+    };
+    // A job whose tag is written exactly as an entry resolves inside what that entry admits, which
+    // is the only way in for an entry `custom_tag_matches` cannot turn into a pattern.
+    let admits = |entry: &str| {
+        entry == tag || resolved_tag.is_some_and(|r| custom_tag_matches(entry, r, &tag_workspace))
+    };
+    let scoped = custom_tags_per_w
+        .specific
+        .iter()
+        .filter(|(name, _)| admits(name))
+        .collect::<Vec<_>>();
+    // Only a fork-scoped tag can match through the lineage, so every other tag keeps the
+    // ancestor lookup off the push path entirely.
+    let chain = if scoped.iter().any(|(_, t)| t.is_fork_scoped()) {
+        workspace_with_fork_ancestors(db, w_id).await?
+    } else {
+        vec![w_id.to_string()]
+    };
+    // A tag listed by its own name with a scope stays inside that scope: a pattern it fits does
+    // not open it to other workspaces. Only listing it by name without a scope does.
+    let lands_on = resolved_tag.unwrap_or(tag);
+    let confined_by = custom_tags_per_w
+        .specific
+        .get_key_value(lands_on)
+        .filter(|(name, t)| {
+            !name.contains('$')
+                && !t.applies_to_workspace(&chain)
+                && !custom_tags_per_w.global.iter().any(|e| e == lands_on)
+        });
+    let is_tag_in_workspace_custom_tags = confined_by.is_none()
+        && (custom_tags_per_w.global.iter().any(|entry| admits(entry))
+            || scoped.iter().any(|(_, t)| t.applies_to_workspace(&chain)));
 
     match is_tag_in_scope_tags {
         Some(true) | None => {
@@ -375,6 +412,12 @@ pub async fn check_tag_available_for_workspace_internal(
     }
 
     if !is_super_admin {
+        let tag = match resolved_tag {
+            Some(resolved_tag) if resolved_tag != tag => {
+                format!("{tag} (resolved to {resolved_tag})")
+            }
+            _ => tag.to_string(),
+        };
         if scope_tags.is_some() && is_tag_in_scope_tags.is_some() {
             return Err(Error::BadRequest(format!(
                 "Tag {tag} is not available in your scope"
@@ -383,9 +426,35 @@ pub async fn check_tag_available_for_workspace_internal(
 
         if *TAGS_ARE_SENSITIVE {
             return Err(Error::BadRequest(format!("{tag} is not available to you")));
+        } else if let Some((name, confining)) = confined_by {
+            let overridden = custom_tags_per_w
+                .global
+                .iter()
+                .filter(|entry| admits(entry))
+                .cloned()
+                .chain(
+                    scoped
+                        .iter()
+                        .filter(|(_, t)| t.applies_to_workspace(&chain))
+                        .map(|(n, t)| t.authored(n)),
+                )
+                .collect::<Vec<_>>();
+            let overridden = if overridden.is_empty() {
+                String::new()
+            } else {
+                format!(
+                    ", which takes precedence over the custom tags it also fits: {}",
+                    overridden.join(", ")
+                )
+            };
+            return Err(Error::BadRequest(format!(
+                "Tag {tag} is not available in workspace {w_id}: the custom tag {} restricts it \
+                 to other workspaces{overridden}",
+                confining.authored(name)
+            )));
         } else {
             return Err(error::Error::BadRequest(format!(
-            "Only super admins are allowed to use tags that are not included in the allowed CUSTOM_TAGS: {:?}",
+            "Tag {tag} is not included in the allowed CUSTOM_TAGS, which only super admins can go beyond: {:?}",
             custom_tags_per_w
         )));
         }
diff --git a/backend/windmill-common/src/jwt.rs b/backend/windmill-common/src/jwt.rs
index cc2f1102bf..76df13b518 100644
--- a/backend/windmill-common/src/jwt.rs
+++ b/backend/windmill-common/src/jwt.rs
@@ -3,7 +3,6 @@ use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
 use hmac::{Hmac, Mac};
 use serde::{de::DeserializeOwned, Serialize};
 use sha2::Sha256;
-use std::collections::HashSet;
 
 lazy_static::lazy_static! {
     pub static ref JWT_SECRET: arc_swap::ArcSwap<String> = arc_swap::ArcSwap::from_pointee("".to_string());
@@ -44,18 +43,8 @@ pub async fn decode_with_internal_secret<T: DeserializeOwned>(token: &str) -> er
 }
 
 pub fn decode_without_verify<T: DeserializeOwned>(token: &str) -> anyhow::Result<T> {
-    // Create a validation that skips all checks
-    let mut validation = jsonwebtoken::Validation::default();
-    validation.insecure_disable_signature_validation();
-    validation.validate_exp = false;
-    validation.validate_nbf = false;
-    validation.required_spec_claims = HashSet::new();
-
-    // Use an empty key since we're not verifying
-    let key = jsonwebtoken::DecodingKey::from_secret(&[]);
-
-    // Decode the token
-    let token_data = jsonwebtoken::decode::<T>(token, &key, &validation)?;
+    // No signature, expiry, nbf or required-claim checks: the caller wants the raw claims.
+    let token_data = jsonwebtoken::dangerous::insecure_decode::<T>(token)?;
 
     Ok(token_data.claims)
 }
@@ -74,3 +63,36 @@ pub async fn generate_signature(header_and_payload: &str) -> anyhow::Result<Stri
     let result = mac.finalize().into_bytes();
     Ok(URL_SAFE_NO_PAD.encode(result))
 }
+
+/// The signing algorithm a JWK names in its `alg`, or `None` when it names none (or one
+/// that is not a signing algorithm, e.g. `RSA-OAEP`). The only place that reads the
+/// field, so callers, including EE ones, stay agnostic of how `jsonwebtoken` models it.
+pub fn jwk_algorithm(jwk: &jsonwebtoken::jwk::Jwk) -> Option<jsonwebtoken::Algorithm> {
+    // `alg` is a `KeyAlgorithm` (signing and encryption algorithms alike); only the
+    // signing subset maps onto `Algorithm`.
+    jwk.common
+        .key_algorithm
+        .and_then(|alg| alg.to_string().parse::<jsonwebtoken::Algorithm>().ok())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::jwk_algorithm;
+    use jsonwebtoken::{jwk::Jwk, Algorithm};
+
+    #[test]
+    fn jwk_algorithm_reads_alg_when_present() {
+        let with: Jwk =
+            serde_json::from_value(serde_json::json!({"kty":"RSA","alg":"RS256","n":"aa","e":"AQAB"}))
+                .unwrap();
+        assert_eq!(jwk_algorithm(&with), Some(Algorithm::RS256));
+        let without: Jwk =
+            serde_json::from_value(serde_json::json!({"kty":"RSA","n":"aa","e":"AQAB"})).unwrap();
+        assert_eq!(jwk_algorithm(&without), None);
+        let encryption: Jwk = serde_json::from_value(
+            serde_json::json!({"kty":"RSA","alg":"RSA-OAEP","n":"aa","e":"AQAB"}),
+        )
+        .unwrap();
+        assert_eq!(jwk_algorithm(&encryption), None);
+    }
+}
diff --git a/backend/windmill-common/src/lib.rs b/backend/windmill-common/src/lib.rs
index 8e17ec676e..1015948882 100644
--- a/backend/windmill-common/src/lib.rs
+++ b/backend/windmill-common/src/lib.rs
@@ -37,6 +37,10 @@ pub mod bench;
 pub mod cache;
 pub mod client;
 pub mod data_metrics;
+pub mod datatable_roles;
+#[cfg(all(feature = "private", feature = "enterprise"))]
+mod datatable_roles_ee;
+pub mod datatable_roles_oss;
 pub mod db;
 #[cfg(all(feature = "enterprise", feature = "private"))]
 mod db_entra_ee;
@@ -114,6 +118,7 @@ pub mod queue;
 pub mod queue_metrics;
 pub mod result_stream;
 pub mod runnable_settings;
+pub mod runnables;
 pub mod schedule;
 pub mod schema;
 pub mod scripts;
@@ -1020,6 +1025,20 @@ impl Future for TokioPgConnection {
     }
 }
 
+impl TokioPgConnection {
+    /// Drive the connection and hand back what the server sends outside of a query's response —
+    /// notices above all, which driving it as a future silently discards.
+    pub fn poll_message(
+        &mut self,
+        cx: &mut core::task::Context<'_>,
+    ) -> core::task::Poll<Option<Result<tokio_postgres::AsyncMessage, tokio_postgres::Error>>> {
+        match self {
+            TokioPgConnection::Tls(conn) => conn.poll_message(cx),
+            TokioPgConnection::NoTls(conn) => conn.poll_message(cx),
+        }
+    }
+}
+
 impl PgDatabase {
     /// The role the connection logs in as, whichever way it authenticates.
     pub fn login_name(&self) -> &str {
@@ -1456,8 +1475,163 @@ pub fn validate_dbname(dbname: &str) -> error::Result<()> {
     Ok(())
 }
 
+/// Lock the instance databases among `names` until `tx` ends, in a stable order. Taken by every
+/// settings save naming an instance database, and by [`drop_unused_instance_database`]: a save
+/// cannot start using a database between that drop's check that nothing does and the drop.
+pub async fn lock_instance_databases<'a>(
+    tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
+    names: impl IntoIterator<Item = &'a str>,
+) -> error::Result<()> {
+    let names: std::collections::BTreeSet<&str> = names.into_iter().collect();
+    for name in names {
+        sqlx::query("SELECT pg_advisory_xact_lock(hashtext('instance_database:' || $1))")
+            .bind(name)
+            .execute(&mut **tx)
+            .await?;
+    }
+    Ok(())
+}
+
+/// Drop instance database `dbname`, which a request just created, unless a workspace names it as a
+/// data table or a ducklake catalog — then it is kept, and who keeps it is what comes back. A
+/// database is registered on the instance as soon as it is created, so a superadmin can point a
+/// workspace at it before the request that created it gives up on it.
+///
+/// Authorization: none. Callers MUST pass only a database the same request created and has not
+/// handed to anything yet.
+///
+/// The lock, the check and the drop share one connection: a second one taken from the pool while
+/// the first is held could wait forever on a small pool. That connection is closed rather than
+/// returned, since a session lock outlives the future holding it: a cancellation between taking
+/// the lock and releasing it would otherwise hand a locked session back to the pool, where every
+/// later settings save waits on it. Closing on drop covers the cancellation and still counts the
+/// connection against the pool, which detaching it would not.
+pub async fn drop_unused_instance_database(db: &DB, dbname: &str) -> error::Result<Cleanup> {
+    let mut conn = db.acquire().await?;
+    conn.close_on_drop();
+    let key = format!("instance_database:{dbname}");
+    // A save blocked on this lock is about to name the database, but it may also roll back — a
+    // later validation of its own, a superadmin check, a cancelled request. So it is let through
+    // and what it committed is read, rather than taken as a user: trusting it would strand the
+    // database, whose name then blocks every retry. A fresh waiter can always arrive, so after a
+    // few rounds the database is kept instead; the name is then a superadmin's to drop from
+    // instance settings, since a retry fails on the name before reaching this cleanup.
+    let mut rounds = 0;
+    let dropped = loop {
+        if let Err(e) = sqlx::query("SELECT pg_advisory_lock(hashtext($1))")
+            .bind(&key)
+            .execute(&mut *conn)
+            .await
+        {
+            break Err(e.into());
+        }
+        match drop_if_unused_on(&mut conn, dbname).await {
+            Ok(Cleanup::Waiter(_)) if rounds < 2 => {
+                rounds += 1;
+                // Releasing hands the lock to the waiter; re-taking it above then waits for that
+                // transaction to end, so the next round reads what it actually committed.
+                if let Err(e) = unlock_instance_database(&mut conn, &key).await {
+                    break Err(e);
+                }
+            }
+            Ok(outcome) => break Ok(outcome),
+            Err(e) => break Err(e),
+        }
+    };
+    // Dropping closes the connection, and the server releases the lock with the session, so
+    // nothing here depends on an unlock landing.
+    dropped
+}
+
+async fn unlock_instance_database(conn: &mut sqlx::PgConnection, key: &str) -> error::Result<()> {
+    sqlx::query("SELECT pg_advisory_unlock(hashtext($1))")
+        .bind(key)
+        .execute(&mut *conn)
+        .await?;
+    Ok(())
+}
+
+/// What [`drop_unused_instance_database`] did, and for whom when it kept the database.
+pub enum Cleanup {
+    Dropped,
+    /// Workspaces that name the database, as [`instance_database_users`] reports them.
+    InUse(Vec<String>),
+    /// A transaction still blocked on the lock after the rounds above, so what it will commit
+    /// stays unknown, named as its `pid`.
+    Waiter(i32),
+}
+
+async fn drop_if_unused_on(conn: &mut sqlx::PgConnection, dbname: &str) -> error::Result<Cleanup> {
+    let users = instance_database_users(conn, dbname).await?;
+    if !users.is_empty() {
+        return Ok(Cleanup::InUse(users));
+    }
+    // A settings save naming this database takes the same lock, so one waiting on it would read
+    // its own users after the drop and commit a reference to nothing.
+    if let Some(waiter) = waiting_for_instance_database(conn, dbname).await? {
+        return Ok(Cleanup::Waiter(waiter));
+    }
+    drop_custom_instance_database_on(conn, dbname).await?;
+    Ok(Cleanup::Dropped)
+}
+
+/// The `pid` of a transaction blocked on `dbname`'s instance-database lock. The lock is
+/// taken by key, so `pg_locks` reports it split across `classid` and `objid`, and it lists every
+/// database on the cluster — another Windmill on the same one holds its own locks under the same
+/// key.
+async fn waiting_for_instance_database(
+    conn: &mut sqlx::PgConnection,
+    dbname: &str,
+) -> error::Result<Option<i32>> {
+    let pid: Option<i32> = sqlx::query_scalar(
+        "SELECT l.pid FROM pg_locks l
+         WHERE l.locktype = 'advisory' AND NOT l.granted
+           AND l.database = (SELECT oid FROM pg_database WHERE datname = current_database())
+           AND l.classid = ((hashtext('instance_database:' || $1)::bigint >> 32) & 4294967295)::oid
+           AND l.objid = (hashtext('instance_database:' || $1)::bigint & 4294967295)::oid
+         LIMIT 1",
+    )
+    .bind(dbname)
+    .fetch_optional(&mut *conn)
+    .await?;
+    Ok(pid)
+}
+
+/// The workspaces naming instance database `dbname` as a data table or a ducklake catalog. Taken
+/// under [`lock_instance_databases`] for `dbname`, the answer holds until that lock is released.
+///
+/// Authorization: none, and it reads every workspace's settings. Callers MUST pass only a database
+/// their own request created, and may name the workspaces returned only to a caller allowed to
+/// create or drop instance databases.
+pub async fn instance_database_users(
+    conn: &mut sqlx::PgConnection,
+    dbname: &str,
+) -> error::Result<Vec<String>> {
+    Ok(sqlx::query_scalar(
+        "SELECT DISTINCT ws.workspace_id FROM workspace_settings ws
+         WHERE EXISTS (SELECT 1 FROM jsonb_each(CASE WHEN jsonb_typeof(ws.datatable->'datatables') = 'object'
+                                                THEN ws.datatable->'datatables' ELSE '{}'::jsonb END) dt
+                       WHERE dt.value->'database'->>'resource_type' = 'instance'
+                         AND dt.value->'database'->>'resource_path' = $1)
+            OR EXISTS (SELECT 1 FROM jsonb_each(CASE WHEN jsonb_typeof(ws.ducklake->'ducklakes') = 'object'
+                                                THEN ws.ducklake->'ducklakes' ELSE '{}'::jsonb END) dl
+                       WHERE dl.value->'catalog'->>'resource_type' = 'instance'
+                         AND dl.value->'catalog'->>'resource_path' = $1)",
+    )
+    .bind(dbname)
+    .fetch_all(conn)
+    .await?)
+}
+
 /// Drop a custom instance database: validate, terminate connections, DROP DATABASE, remove from global_settings.
 pub async fn drop_custom_instance_database(db: &DB, dbname: &str) -> error::Result<()> {
+    drop_custom_instance_database_on(&mut *db.acquire().await?, dbname).await
+}
+
+async fn drop_custom_instance_database_on(
+    conn: &mut sqlx::PgConnection,
+    dbname: &str,
+) -> error::Result<()> {
     let dbname = dbname.trim();
     validate_dbname(dbname)?;
 
@@ -1472,7 +1646,7 @@ pub async fn drop_custom_instance_database(db: &DB, dbname: &str) -> error::Resu
         "SELECT EXISTS (SELECT 1 FROM pg_catalog.pg_database WHERE datname = $1)",
         dbname
     )
-    .fetch_one(db)
+    .fetch_one(&mut *conn)
     .await?
     .unwrap_or(false);
 
@@ -1483,7 +1657,7 @@ pub async fn drop_custom_instance_database(db: &DB, dbname: &str) -> error::Resu
             "SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname = '{}' AND pid <> pg_backend_pid()",
             dbname.replace('\'', "''")
         ))
-        .execute(db)
+        .execute(&mut *conn)
         .await
         {
             tracing::warn!("Failed to terminate connections to '{}': {}", dbname, e);
@@ -1492,7 +1666,7 @@ pub async fn drop_custom_instance_database(db: &DB, dbname: &str) -> error::Resu
         // Drop the database
         // SAFETY: `dbname` has been validated via validate_dbname() before reaching this point.
         sqlx::query(&format!("DROP DATABASE IF EXISTS \"{}\"", dbname))
-            .execute(db)
+            .execute(&mut *conn)
             .await
             .map_err(|e| {
                 error::Error::internal_err(format!("Failed to drop database '{}': {}", dbname, e))
@@ -1508,12 +1682,47 @@ pub async fn drop_custom_instance_database(db: &DB, dbname: &str) -> error::Resu
         r#"UPDATE global_settings SET value = value #- ARRAY['databases', $1] WHERE name = 'custom_instance_pg_databases'"#,
         dbname
     )
-    .execute(db)
+    .execute(&mut *conn)
     .await?;
 
     Ok(())
 }
 
+/// What `custom_instance_user` holds on an instance database.
+///
+/// `WITH GRANT OPTION` throughout: this is the connection every data table resolves to as `admin`,
+/// and it is the one that hands privileges to data table roles. Postgres refuses to let a role pass
+/// on a privilege it does not itself hold with grant option, so without these an admin could own
+/// the database and still be unable to grant `SELECT` on it to `analytics`.
+pub(crate) fn instance_db_grants(dbname: &str) -> String {
+    format!(
+        "GRANT CONNECT ON DATABASE \"{dbname}\" TO custom_instance_user WITH GRANT OPTION;
+         GRANT CREATE ON DATABASE \"{dbname}\" TO custom_instance_user WITH GRANT OPTION;
+         DO $$ BEGIN
+           IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'public') THEN
+             GRANT USAGE ON SCHEMA public TO custom_instance_user WITH GRANT OPTION;
+             GRANT CREATE ON SCHEMA public TO custom_instance_user WITH GRANT OPTION;
+             ALTER DEFAULT PRIVILEGES IN SCHEMA public
+                 GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO custom_instance_user;
+           END IF;
+         END $$;"
+    )
+}
+
+/// Re-apply [`instance_db_grants`] to an instance database provisioned before data table roles
+/// existed, whose grants carry no grant option. Connects as the instance's own Postgres user —
+/// the database and `public` schema owner — since only it can hand out an option it holds.
+///
+/// Authorization: reaches an instance database with the server's own credentials and checks
+/// nothing. Callers MUST have authorized administration of `dbname` — superadmin, or an admin of
+/// the workspace governing a data table on it.
+pub async fn ensure_instance_db_grant_options_unchecked(
+    db: &DB,
+    dbname: &str,
+) -> error::Result<()> {
+    crate::datatable_roles_oss::ensure_instance_db_grant_options_unchecked(db, dbname).await
+}
+
 /// Create a custom instance database: CREATE DATABASE, grant permissions, register in global_settings.
 /// The `tag` is stored in global_settings metadata (e.g. "datatable" or "ducklake").
 pub async fn create_custom_instance_database(
@@ -1547,23 +1756,46 @@ pub async fn create_custom_instance_database(
             error::Error::internal_err(format!("Failed to create database '{}': {}", dbname, e))
         })?;
 
+    // Nothing names a database that failed past this point, and its name blocks the retry: drop it
+    // rather than leave it behind.
+    if let Err(e) = finish_custom_instance_database(db, dbname, tag).await {
+        match drop_unused_instance_database(db, dbname).await {
+            Ok(Cleanup::InUse(users)) => tracing::warn!(
+                "Kept '{dbname}' after failing to set it up: workspaces {} use it",
+                users.join(", ")
+            ),
+            Ok(Cleanup::Waiter(pid)) => tracing::warn!(
+                "Kept '{dbname}' after failing to set it up: a request (pid {pid}) is still \
+                 waiting to name it. Drop it from instance settings once it is unused."
+            ),
+            Ok(Cleanup::Dropped) => {}
+            Err(drop_err) => {
+                tracing::error!("Could not drop '{dbname}' after failing to set it up: {drop_err}")
+            }
+        }
+        return Err(e);
+    }
+
+    // A data table role can only reach a database it may CONNECT to, and PUBLIC's default CONNECT
+    // would otherwise let every role in regardless of what this instance defines. Best-effort: a
+    // failure here leaves the database usable as `admin`, and the next role change repairs it.
+    if let Err(e) = crate::datatable_roles::converge_connect_grants(db, dbname).await {
+        tracing::warn!("Could not set CONNECT grants on instance database '{dbname}': {e}");
+    }
+
+    tracing::info!("Created custom instance database '{}'", dbname);
+    Ok(())
+}
+
+/// Grant `custom_instance_user` its privileges on a database just created, and register it.
+async fn finish_custom_instance_database(db: &DB, dbname: &str, tag: &str) -> error::Result<()> {
     // Grant permissions to custom_instance_user
     let wmill_pg_creds = PgDatabase::parse_uri(&get_database_url().await?.as_str().await)?;
     let new_pg_creds = PgDatabase { dbname: dbname.to_string(), ..wmill_pg_creds };
     let (client, connection) = new_pg_creds.connect(Some(db)).await?;
     let join_handle = tokio::spawn(async move { connection.await });
 
-    if let Err(e) = client
-        .batch_execute(&format!(
-            "GRANT CONNECT ON DATABASE \"{dbname}\" TO custom_instance_user;
-             GRANT USAGE ON SCHEMA public TO custom_instance_user;
-             GRANT CREATE ON SCHEMA public TO custom_instance_user;
-             GRANT CREATE ON DATABASE \"{dbname}\" TO custom_instance_user;
-             ALTER DEFAULT PRIVILEGES IN SCHEMA public
-                 GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO custom_instance_user;"
-        ))
-        .await
-    {
+    if let Err(e) = client.batch_execute(&instance_db_grants(dbname)).await {
         tracing::warn!(
             "Failed to grant permissions on '{}': {}. Continuing.",
             dbname,
@@ -1591,8 +1823,6 @@ pub async fn create_custom_instance_database(
     )
     .execute(db)
     .await?;
-
-    tracing::info!("Created custom instance database '{}'", dbname);
     Ok(())
 }
 
diff --git a/backend/windmill-common/src/query_builders.rs b/backend/windmill-common/src/query_builders.rs
index 60d74f189d..546d2d454b 100644
--- a/backend/windmill-common/src/query_builders.rs
+++ b/backend/windmill-common/src/query_builders.rs
@@ -329,9 +329,11 @@ pub fn try_expand_internal_db_query(
         "ALTER_TABLE" => expand_alter_table(json_str, db_type).map(ExpandedQuery::sql),
         "CREATE_SCHEMA" => expand_create_schema(json_str, db_type).map(ExpandedQuery::sql),
         "DROP_SCHEMA" => expand_drop_schema(json_str, db_type).map(ExpandedQuery::sql),
+        "RENAME_SCHEMA" => expand_rename_schema(json_str, db_type).map(ExpandedQuery::sql),
         // Metadata queries
         "LOAD_TABLE_METADATA" => expand_load_table_metadata(json_str, db_type),
         "FOREIGN_KEYS" => expand_foreign_keys(json_str, db_type).map(ExpandedQuery::sql),
+        "ALL_FOREIGN_KEYS" => expand_all_foreign_keys(db_type).map(ExpandedQuery::sql),
         "PRIMARY_KEY_CONSTRAINT" => {
             expand_primary_key_constraint(json_str, db_type).map(ExpandedQuery::sql)
         }
@@ -1716,6 +1718,13 @@ struct DropSchemaPayload {
     ducklake: Option<String>,
 }
 
+#[derive(Deserialize)]
+struct RenameSchemaPayload {
+    schema: String,
+    new_schema: String,
+    ducklake: Option<String>,
+}
+
 #[derive(Debug, Clone, Deserialize)]
 struct TableEditorColumn {
     name: String,
@@ -2004,6 +2013,23 @@ fn expand_drop_schema(json_str: &str, db_type: DbType) -> Result<String, String>
     Ok(maybe_wrap_ducklake(query, p.ducklake.as_deref()))
 }
 
+fn expand_rename_schema(json_str: &str, db_type: DbType) -> Result<String, String> {
+    let p: RenameSchemaPayload = serde_json::from_str(json_str)
+        .map_err(|e| format!("Invalid RENAME_SCHEMA payload: {}", e))?;
+    if !matches!(db_type, DbType::Postgresql | DbType::Snowflake) || p.ducklake.is_some() {
+        return Err(format!(
+            "Renaming a schema is not supported on {:?}",
+            db_type
+        ));
+    }
+    let query = format!(
+        "ALTER SCHEMA {} RENAME TO {};",
+        qi(&p.schema, db_type),
+        qi(&p.new_schema, db_type)
+    );
+    Ok(query)
+}
+
 fn expand_create_table(json_str: &str, db_type: DbType) -> Result<String, String> {
     let p: CreateTablePayload = serde_json::from_str(json_str)
         .map_err(|e| format!("Invalid CREATE_TABLE payload: {}", e))?;
@@ -2598,7 +2624,9 @@ WHERE table_catalog = current_database()",
                 )
             } else {
                 (
-                    "\nWHERE c.relkind = 'r' AND a.attnum > 0 AND NOT a.attisdropped\n    AND ns.nspname != 'pg_catalog' AND ns.nspname != 'information_schema'".to_string(),
+                    // pg_catalog is readable by everyone: without the privilege check this lists
+                    // tables of schemas the connection's role cannot even enter.
+                    "\nWHERE c.relkind = 'r' AND a.attnum > 0 AND NOT a.attisdropped\n    AND ns.nspname != 'pg_catalog' AND ns.nspname != 'information_schema'\n    AND has_schema_privilege(ns.oid, 'USAGE')".to_string(),
                     ",\n    ns.nspname AS schema_name,\n    c.relname AS table_name".to_string(),
                     "\nJOIN pg_catalog.pg_class c ON a.attrelid = c.oid\nJOIN pg_catalog.pg_namespace ns ON c.relnamespace = ns.oid".to_string(),
                     "ns.nspname, c.relname, a.attnum".to_string(),
@@ -2710,6 +2738,47 @@ fn expand_foreign_keys(json_str: &str, db_type: DbType) -> Result<String, String
     Ok(maybe_wrap_ducklake(query, p.ducklake.as_deref()))
 }
 
+fn expand_all_foreign_keys(db_type: DbType) -> Result<String, String> {
+    make_all_foreign_keys_query(db_type)
+}
+
+/// Every foreign key of the database, one row per referencing column.
+///
+/// Read from `pg_constraint` rather than `information_schema`: the latter's
+/// `constraint_column_usage` loses the pairing of a composite key's columns,
+/// which the diagram needs to line a source column up with the column it points
+/// at. `unnest(conkey, confkey)` keeps them zipped in declaration order.
+fn make_all_foreign_keys_query(db_type: DbType) -> Result<String, String> {
+    if db_type != DbType::Postgresql {
+        return Err(format!(
+            "The schema diagram is only supported for PostgreSQL, not {:?}",
+            db_type
+        ));
+    }
+    Ok(String::from(
+        "SELECT
+    con.conname as fk_constraint_name,
+    src_ns.nspname as source_schema,
+    src.relname as source_table,
+    src_att.attname as source_column,
+    tgt_ns.nspname as target_schema,
+    tgt.relname as target_table,
+    tgt_att.attname as target_column,
+    k.ord as ordinal
+FROM pg_catalog.pg_constraint con
+    JOIN pg_catalog.pg_class src ON src.oid = con.conrelid
+    JOIN pg_catalog.pg_namespace src_ns ON src_ns.oid = src.relnamespace
+    JOIN pg_catalog.pg_class tgt ON tgt.oid = con.confrelid
+    JOIN pg_catalog.pg_namespace tgt_ns ON tgt_ns.oid = tgt.relnamespace
+    JOIN LATERAL unnest(con.conkey, con.confkey) WITH ORDINALITY AS k(src_attnum, tgt_attnum, ord) ON true
+    JOIN pg_catalog.pg_attribute src_att ON src_att.attrelid = src.oid AND src_att.attnum = k.src_attnum
+    JOIN pg_catalog.pg_attribute tgt_att ON tgt_att.attrelid = tgt.oid AND tgt_att.attnum = k.tgt_attnum
+WHERE con.contype = 'f'
+    AND src_ns.nspname NOT IN ('pg_catalog', 'information_schema')
+ORDER BY src_ns.nspname, src.relname, con.conname, k.ord;",
+    ))
+}
+
 fn expand_primary_key_constraint(json_str: &str, db_type: DbType) -> Result<String, String> {
     let p: PrimaryKeyConstraintPayload = serde_json::from_str(json_str)
         .map_err(|e| format!("Invalid PRIMARY_KEY_CONSTRAINT payload: {}", e))?;
@@ -4101,6 +4170,13 @@ mod tests {
         assert_eq!(sql, "DROP SCHEMA \"old_schema\" CASCADE;");
     }
 
+    #[test]
+    fn test_expand_rename_schema() {
+        let marker = r#"-- WM_INTERNAL_DB_RENAME_SCHEMA {"schema":"old","new_schema":"new"}"#;
+        let sql = expand_code(marker, &ScriptLang::Postgresql);
+        assert_eq!(sql, "ALTER SCHEMA \"old\" RENAME TO \"new\";");
+    }
+
     #[test]
     fn test_expand_create_schema_with_ducklake() {
         let marker = r#"-- WM_INTERNAL_DB_CREATE_SCHEMA {"schema":"s","ducklake":"lake"}"#;
@@ -4468,6 +4544,7 @@ mod tests {
         assert!(sql.contains("schema_name"));
         assert!(sql.contains("table_name"));
         assert!(sql.contains("c.relkind = 'r'"));
+        assert!(sql.contains("has_schema_privilege(ns.oid, 'USAGE')"));
     }
 
     #[test]
@@ -4686,6 +4763,26 @@ mod tests {
         assert!(sql.starts_with("ATTACH 'ducklake://lake' AS dl;USE dl;\n"));
     }
 
+    // -----------------------------------------------------------------------
+    // ALL_FOREIGN_KEYS
+    // -----------------------------------------------------------------------
+
+    #[test]
+    fn test_expand_all_foreign_keys_postgresql() {
+        let marker = r#"-- WM_INTERNAL_DB_ALL_FOREIGN_KEYS {}"#;
+        let sql = expand_code(marker, &ScriptLang::Postgresql);
+        assert!(sql.contains("con.contype = 'f'"));
+        // Columns of a composite key must stay zipped with the ones they point at.
+        assert!(sql.contains("unnest(con.conkey, con.confkey) WITH ORDINALITY"));
+    }
+
+    #[test]
+    fn test_expand_all_foreign_keys_rejects_non_postgres() {
+        let marker = r#"-- WM_INTERNAL_DB_ALL_FOREIGN_KEYS {}"#;
+        let result = try_expand_internal_db_query(marker, &ScriptLang::Mysql);
+        assert!(result.unwrap().is_err());
+    }
+
     // -----------------------------------------------------------------------
     // PRIMARY_KEY_CONSTRAINT
     // -----------------------------------------------------------------------
diff --git a/backend/windmill-common/src/runnables.rs b/backend/windmill-common/src/runnables.rs
new file mode 100644
index 0000000000..579e5e248e
--- /dev/null
+++ b/backend/windmill-common/src/runnables.rs
@@ -0,0 +1,22 @@
+//! Queries spanning both scripts and flows.
+
+use crate::{error::Error, DB};
+
+/// An opaque value that changes whenever a workspace's live scripts or flows are added,
+/// removed, moved or redeployed: a redeploy is a new script hash or a new last flow
+/// version, so schema and description changes register too. Not filtered by caller,
+/// so it reveals nothing beyond whether it changed.
+pub async fn runnable_list_fingerprint(db: &DB, workspace_id: &str) -> Result<String, Error> {
+    Ok(sqlx::query_scalar::<_, String>(
+        "SELECT COALESCE(md5(string_agg(k, ',' ORDER BY k)), '') FROM (
+            SELECT 's' || path || ':' || hash FROM script
+            WHERE workspace_id = $1 AND archived = false
+            UNION ALL
+            SELECT 'f' || path || ':' || COALESCE(versions[array_upper(versions, 1)], 0) FROM flow
+            WHERE workspace_id = $1 AND archived = false
+        ) t(k)",
+    )
+    .bind(workspace_id)
+    .fetch_one(db)
+    .await?)
+}
diff --git a/backend/windmill-common/src/sensitive_log_masks.rs b/backend/windmill-common/src/sensitive_log_masks.rs
index b6f6262b77..c999297ec0 100644
--- a/backend/windmill-common/src/sensitive_log_masks.rs
+++ b/backend/windmill-common/src/sensitive_log_masks.rs
@@ -10,7 +10,7 @@
 
 use std::borrow::Cow;
 use std::collections::{HashMap, HashSet};
-use std::sync::RwLock;
+use std::sync::{Arc, RwLock};
 use uuid::Uuid;
 
 /// Minimum length for a secret to be registered for masking.
@@ -20,9 +20,27 @@ const MIN_SECRET_LENGTH: usize = 8;
 const MASKED_NOTICE: &str =
     "[windmill] secret value was masked for security reasons, use string transformations to display full value";
 
+/// The secrets registered for one job, plus the automaton compiled from them.
+#[derive(Default)]
+struct JobMasks {
+    secrets: HashSet<String>,
+    /// Built on the first `snapshot` after a change and shared by every later
+    /// snapshot. Every job registers at least its own token, so without this
+    /// cache each log batch of each job would rebuild the automaton.
+    compiled: Option<Arc<CompiledMasks>>,
+}
+
+/// Aho-Corasick automaton for O(m) multi-pattern matching in a single pass,
+/// regardless of the number of secrets registered, with the replacement
+/// strings indexed to match the automaton's pattern order.
+struct CompiledMasks {
+    ac: aho_corasick::AhoCorasick,
+    replacements: Vec<String>,
+}
+
 lazy_static::lazy_static! {
-    /// Map of job_id -> set of secret values that should be masked in that job's logs.
-    static ref SENSITIVE_MASKS: RwLock<HashMap<Uuid, HashSet<String>>> =
+    /// Map of job_id -> secret values that should be masked in that job's logs.
+    static ref SENSITIVE_MASKS: RwLock<HashMap<Uuid, JobMasks>> =
         RwLock::new(HashMap::new());
 
     /// Set of currently running job IDs on this worker process.
@@ -32,13 +50,8 @@ lazy_static::lazy_static! {
 }
 
 /// A lock-free snapshot of secrets for a job, taken once per log batch.
-/// Uses Aho-Corasick for O(m) multi-pattern matching in a single pass,
-/// regardless of the number of secrets registered.
 pub struct MaskSnapshot {
-    /// Aho-Corasick automaton for fast matching.
-    ac: aho_corasick::AhoCorasick,
-    /// Replacement strings, indexed to match the automaton's pattern order.
-    replacements: Vec<String>,
+    compiled: Arc<CompiledMasks>,
     /// Whether the security notice has already been appended for this snapshot.
     /// Tracked locally to avoid a global write lock on every masked line.
     notice_shown: std::cell::Cell<bool>,
@@ -53,34 +66,104 @@ impl MaskSnapshot {
         }
 
         // Single-pass check + replace using the pre-built automaton
-        if !self.ac.is_match(text) {
+        if !self.compiled.ac.is_match(text) {
             return Cow::Borrowed(text);
         }
 
-        let mut result = self.ac.replace_all(text, &self.replacements);
+        let mut result = self
+            .compiled
+            .ac
+            .replace_all(text, &self.compiled.replacements);
 
-        // Append the notice only once per snapshot (i.e. per batch)
+        // Append the notice only once per snapshot (i.e. per batch), as its own line.
+        // Callers pass either a bare line (`handle_child`) or a chunk that already ends
+        // in a newline (nativets), and the sinks concatenate what they get verbatim:
+        // assuming either shape welds the notice onto a neighbouring line.
         if !self.notice_shown.get() {
             self.notice_shown.set(true);
-            result.push('\n');
-            result.push_str(MASKED_NOTICE);
+            if result.ends_with('\n') {
+                result.push_str(MASKED_NOTICE);
+                result.push('\n');
+            } else {
+                result.push('\n');
+                result.push_str(MASKED_NOTICE);
+            }
         }
 
         Cow::Owned(result)
     }
 }
 
+/// A masker for sinks that mask line by line rather than in batches, like nativets
+/// masking each `console.log` chunk as V8 produces it. `snapshot` per line would
+/// re-arm the security notice on every one; this keeps it to once per distinct set
+/// of secrets while still picking up secrets registered mid-run.
+///
+/// Masks by job id alone — the caller is the one that knows the text it passes
+/// belongs to that job.
+pub struct JobMasker {
+    job_id: Uuid,
+    snapshot: Option<MaskSnapshot>,
+}
+
+impl JobMasker {
+    pub fn new(job_id: Uuid) -> Self {
+        JobMasker { job_id, snapshot: snapshot(&job_id) }
+    }
+
+    /// Mask every secret registered for the job. Returns `Cow::Borrowed` when no match.
+    /// Falls back to the masks it last saw once the job is unregistered, so a sink
+    /// still draining past the end of a run does not start emitting secrets.
+    pub fn mask<'a>(&mut self, text: &'a str) -> Cow<'a, str> {
+        if let Some(fresh) = snapshot(&self.job_id) {
+            // Replacing an equivalent snapshot would re-arm the notice, so only take
+            // one built from a secret set we have not seen.
+            let unchanged = self
+                .snapshot
+                .as_ref()
+                .is_some_and(|cur| Arc::ptr_eq(&cur.compiled, &fresh.compiled));
+            if !unchanged {
+                self.snapshot = Some(fresh);
+            }
+        }
+        match self.snapshot.as_ref() {
+            Some(snapshot) => snapshot.mask(text),
+            None => Cow::Borrowed(text),
+        }
+    }
+}
+
 /// Take a snapshot of the current secrets for a job. Returns `None` if no secrets
 /// are registered (the caller can then skip masking entirely for the whole batch).
 ///
 /// Call this once per log batch in `write_lines`, not per line.
 pub fn snapshot(job_id: &Uuid) -> Option<MaskSnapshot> {
-    let masks = SENSITIVE_MASKS.read().unwrap_or_else(|e| e.into_inner());
-    let secrets = masks.get(job_id)?;
-    if secrets.is_empty() {
-        return None;
+    {
+        let masks = SENSITIVE_MASKS.read().unwrap_or_else(|e| e.into_inner());
+        let job = masks.get(job_id)?;
+        if job.secrets.is_empty() {
+            return None;
+        }
+        if let Some(compiled) = job.compiled.as_ref() {
+            return Some(MaskSnapshot {
+                compiled: compiled.clone(),
+                notice_shown: std::cell::Cell::new(false),
+            });
+        }
     }
 
+    let mut masks = SENSITIVE_MASKS.write().unwrap_or_else(|e| e.into_inner());
+    let job = masks.get_mut(job_id)?;
+    if job.secrets.is_empty() {
+        return None;
+    }
+    let compiled = job
+        .compiled
+        .get_or_insert_with(|| Arc::new(compile(&job.secrets)));
+    Some(MaskSnapshot { compiled: compiled.clone(), notice_shown: std::cell::Cell::new(false) })
+}
+
+fn compile(secrets: &HashSet<String>) -> CompiledMasks {
     // Sort longest-first so longer secrets are matched before shorter substrings
     let mut sorted: Vec<&String> = secrets.iter().collect();
     sorted.sort_by(|a, b| b.len().cmp(&a.len()));
@@ -106,7 +189,7 @@ pub fn snapshot(job_id: &Uuid) -> Option<MaskSnapshot> {
         .build(sorted.iter().map(|s| s.as_str()))
         .expect("failed to build aho-corasick automaton");
 
-    Some(MaskSnapshot { ac, replacements, notice_shown: std::cell::Cell::new(false) })
+    CompiledMasks { ac, replacements }
 }
 
 /// Register a job as currently running. Call this before `handle_queued_job`.
@@ -148,20 +231,110 @@ pub fn register_secret_for_all_running_jobs(secret: &str) {
 
     let mut masks = SENSITIVE_MASKS.write().unwrap_or_else(|e| e.into_inner());
     for job_id in job_ids {
-        if let Some(set) = masks.get_mut(&job_id) {
-            set.insert(secret.to_string());
+        if let Some(job) = masks.get_mut(&job_id) {
+            if job.secrets.insert(secret.to_string()) {
+                job.compiled = None;
+            }
         }
     }
 }
 
 /// Register a secret value for a specific job.
-/// Used for `$encrypted:` args where we know the job ID.
+/// Used for the job's own token and for `$encrypted:` args, where we know the job ID.
 pub fn register_secret_for_job(job_id: Uuid, secret: &str) {
     if secret.len() < MIN_SECRET_LENGTH {
         return;
     }
     let mut masks = SENSITIVE_MASKS.write().unwrap_or_else(|e| e.into_inner());
-    if let Some(set) = masks.get_mut(&job_id) {
-        set.insert(secret.to_string());
+    if let Some(job) = masks.get_mut(&job_id) {
+        if job.secrets.insert(secret.to_string()) {
+            job.compiled = None;
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The compiled automaton is cached per job, so a secret registered after the
+    /// first snapshot only gets masked if the cache is invalidated.
+    #[test]
+    fn snapshot_rebuilds_after_a_new_secret_is_registered() {
+        let job_id = Uuid::new_v4();
+        register_running_job(job_id);
+        register_secret_for_job(job_id, "firstsecretvalue");
+        let _ = snapshot(&job_id)
+            .expect("secret registered")
+            .mask("firstsecretvalue");
+
+        register_secret_for_job(job_id, "secondsecretvalue");
+
+        let snap = snapshot(&job_id).expect("secrets registered");
+        let masked = snap.mask("firstsecretvalue then secondsecretvalue");
+        assert!(!masked.contains("firstsecretvalue"), "{masked}");
+        assert!(!masked.contains("secondsecretvalue"), "{masked}");
+        unregister_running_job(job_id);
+    }
+
+    /// A line-by-line sink must not repeat the notice on every line, and must still
+    /// pick up a secret registered after the masker was built.
+    #[test]
+    fn job_masker_notices_once_per_secret_set() {
+        let job_id = Uuid::new_v4();
+        register_running_job(job_id);
+        register_secret_for_job(job_id, "firstsecretvalue");
+        let mut masker = JobMasker::new(job_id);
+
+        let first = masker.mask("saw firstsecretvalue").into_owned();
+        assert!(!first.contains("firstsecretvalue"), "{first}");
+        assert!(first.contains(MASKED_NOTICE), "{first}");
+
+        let second = masker.mask("saw firstsecretvalue again").into_owned();
+        assert!(!second.contains("firstsecretvalue"), "{second}");
+        assert!(!second.contains(MASKED_NOTICE), "{second}");
+
+        register_secret_for_job(job_id, "secondsecretvalue");
+        let third = masker.mask("saw secondsecretvalue").into_owned();
+        assert!(!third.contains("secondsecretvalue"), "{third}");
+        unregister_running_job(job_id);
+    }
+
+    /// Unregistration must not turn masking off under a sink that is still emitting:
+    /// the masker keeps working off the masks it last saw rather than going quiet.
+    #[test]
+    fn job_masker_masks_after_the_job_is_unregistered() {
+        let job_id = Uuid::new_v4();
+        register_running_job(job_id);
+        register_secret_for_job(job_id, "supersecretvalue");
+        let mut masker = JobMasker::new(job_id);
+
+        unregister_running_job(job_id);
+
+        let masked = masker.mask("logged supersecretvalue here");
+        assert!(!masked.contains("supersecretvalue"), "{masked}");
+    }
+
+    /// The notice has to end up on a line of its own for both shapes callers pass:
+    /// a bare line (`handle_child`) and a newline-terminated chunk (nativets). The
+    /// sinks concatenate what they are given verbatim, so getting this wrong welds
+    /// the notice onto whichever line follows it.
+    #[test]
+    fn notice_lands_on_its_own_line_for_both_caller_shapes() {
+        let job_id = Uuid::new_v4();
+        register_running_job(job_id);
+        register_secret_for_job(job_id, "supersecretvalue");
+
+        let line = snapshot(&job_id)
+            .expect("secret registered")
+            .mask("tok supersecretvalue");
+        assert_eq!(line, format!("tok s*****e\n{MASKED_NOTICE}"));
+
+        let chunk = snapshot(&job_id)
+            .expect("secret registered")
+            .mask("tok supersecretvalue\n");
+        assert_eq!(chunk, format!("tok s*****e\n{MASKED_NOTICE}\n"));
+
+        unregister_running_job(job_id);
     }
 }
diff --git a/backend/windmill-common/src/ssrf.rs b/backend/windmill-common/src/ssrf.rs
index 31dee749e6..0cdf7ffa4f 100644
--- a/backend/windmill-common/src/ssrf.rs
+++ b/backend/windmill-common/src/ssrf.rs
@@ -8,6 +8,8 @@ pub const ALLOW_PRIVATE_SAML_METADATA_URLS_ENV: &str = "ALLOW_PRIVATE_SAML_METAD
 
 pub const ALLOW_PRIVATE_GUEST_JWKS_URLS_ENV: &str = "ALLOW_PRIVATE_GUEST_JWKS_URLS";
 
+pub const ALLOW_PRIVATE_WEBHOOK_URLS_ENV: &str = "ALLOW_PRIVATE_WEBHOOK_URLS";
+
 /// Lets every git call reach hosts on a private network, whoever it is made for.
 /// Without it, [`private_git_host_allowed`] decides.
 pub const ALLOW_LOCAL_GIT_REMOTES_ENV: &str = "ALLOW_LOCAL_GIT_REMOTES";
@@ -207,6 +209,12 @@ pub fn allow_private_saml_metadata_urls() -> bool {
         .is_some_and(|v| v == "true" || v == "1")
 }
 
+fn allow_private_webhook_urls() -> bool {
+    std::env::var(ALLOW_PRIVATE_WEBHOOK_URLS_ENV)
+        .ok()
+        .is_some_and(|v| v == "true" || v == "1")
+}
+
 fn allow_local_git_remotes() -> bool {
     std::env::var(ALLOW_LOCAL_GIT_REMOTES_ENV)
         .ok()
@@ -321,6 +329,26 @@ pub async fn validate_mcp_server_url(url: &str) -> Result<ValidatedTarget, SsrfV
     validate_url_for_ssrf(url).await
 }
 
+/// Save-time check only: the webhook is sent later from another task that resolves
+/// the host again, so the returned target cannot be pinned onto that connect.
+pub async fn validate_webhook_url(url: &str) -> Result<ValidatedTarget, SsrfValidationError> {
+    let parsed =
+        url::Url::parse(url).map_err(|e| SsrfValidationError::InvalidUrl(e.to_string()))?;
+
+    match parsed.scheme() {
+        "http" | "https" => {}
+        scheme => return Err(SsrfValidationError::DisallowedScheme(scheme.to_string())),
+    }
+
+    let host = parsed.host_str().ok_or(SsrfValidationError::MissingHost)?;
+
+    if allow_private_webhook_urls() {
+        return Ok(ValidatedTarget::unpinned(host));
+    }
+
+    validate_url_for_ssrf(url).await
+}
+
 /// Validate an MCP-related URL and return the [`ValidatedTarget`] so the caller
 /// can pin the connect: the OAuth registration/discovery/token requests carry
 /// secrets, so they must target the validated address (see
@@ -358,6 +386,16 @@ pub fn saml_ssrf_error_message(e: &SsrfValidationError) -> String {
     }
 }
 
+pub fn webhook_ssrf_error_message(e: &SsrfValidationError) -> String {
+    match e {
+        SsrfValidationError::Private { .. } => format!(
+            "{e}. If you need to use private/internal webhook URLs, \
+             set the {ALLOW_PRIVATE_WEBHOOK_URLS_ENV}=true environment variable"
+        ),
+        _ => e.to_string(),
+    }
+}
+
 fn is_private_ip(ip: &IpAddr) -> bool {
     match ip {
         IpAddr::V4(ipv4) => is_private_ipv4(ipv4),
@@ -684,6 +722,71 @@ mod tests {
         ));
     }
 
+    struct PrivateWebhookUrlsEnvGuard {
+        previous: Option<String>,
+    }
+
+    impl PrivateWebhookUrlsEnvGuard {
+        fn set(value: Option<&str>) -> Self {
+            let previous = std::env::var(ALLOW_PRIVATE_WEBHOOK_URLS_ENV).ok();
+            match value {
+                Some(value) => std::env::set_var(ALLOW_PRIVATE_WEBHOOK_URLS_ENV, value),
+                None => std::env::remove_var(ALLOW_PRIVATE_WEBHOOK_URLS_ENV),
+            }
+            Self { previous }
+        }
+    }
+
+    impl Drop for PrivateWebhookUrlsEnvGuard {
+        fn drop(&mut self) {
+            match &self.previous {
+                Some(value) => std::env::set_var(ALLOW_PRIVATE_WEBHOOK_URLS_ENV, value),
+                None => std::env::remove_var(ALLOW_PRIVATE_WEBHOOK_URLS_ENV),
+            }
+        }
+    }
+
+    #[tokio::test]
+    async fn validate_webhook_url_blocks_private_by_default_with_env_hint() {
+        let _lock = TEST_ENV_LOCK.lock().await;
+        let _guard = PrivateWebhookUrlsEnvGuard::set(None);
+
+        let private_error = validate_webhook_url("http://127.0.0.1/hook")
+            .await
+            .unwrap_err();
+        assert!(matches!(
+            private_error,
+            SsrfValidationError::Private { resolved: false }
+        ));
+        assert!(
+            webhook_ssrf_error_message(&private_error).contains("ALLOW_PRIVATE_WEBHOOK_URLS=true")
+        );
+
+        let invalid_error = validate_webhook_url("ftp://example.com/hook")
+            .await
+            .unwrap_err();
+        assert!(
+            !webhook_ssrf_error_message(&invalid_error).contains(ALLOW_PRIVATE_WEBHOOK_URLS_ENV)
+        );
+    }
+
+    #[tokio::test]
+    async fn validate_webhook_url_allows_private_when_env_is_set_but_keeps_syntax_guards() {
+        let _lock = TEST_ENV_LOCK.lock().await;
+        let _guard = PrivateWebhookUrlsEnvGuard::set(Some("true"));
+
+        assert!(validate_webhook_url("http://127.0.0.1/hook").await.is_ok());
+        assert!(validate_webhook_url("http://10.0.0.1/hook").await.is_ok());
+        assert!(matches!(
+            validate_webhook_url("file:///etc/passwd").await,
+            Err(SsrfValidationError::DisallowedScheme(_))
+        ));
+        assert!(matches!(
+            validate_webhook_url("not-a-url").await,
+            Err(SsrfValidationError::InvalidUrl(_))
+        ));
+    }
+
     #[test]
     fn private_git_hosts_are_refused_to_non_admins_and_on_cloud() {
         use GitRemoteCaller::{AdminOrSystem, NonAdmin};
diff --git a/backend/windmill-common/src/user_drafts.rs b/backend/windmill-common/src/user_drafts.rs
index aed9b5c5de..ebd0ce363f 100644
--- a/backend/windmill-common/src/user_drafts.rs
+++ b/backend/windmill-common/src/user_drafts.rs
@@ -160,6 +160,34 @@ impl UserDraftItemKind {
         }
     }
 
+    /// The `draft.value` key holding the user-typed target path — where a
+    /// deploy of this draft would land when the user staged a rename. A script
+    /// draft round-trips its own `path`; flows and apps write a separate
+    /// `draft_path`, and only when it differs from the row's path.
+    ///
+    /// `None` for every kind with no editor to stage a rename in — a resource,
+    /// a variable, a trigger. Their drafts carry no such key, so `Some` is also
+    /// the test for whether a kind can be moved at all.
+    pub fn typed_path_field(&self) -> Option<&'static str> {
+        use UserDraftItemKind::*;
+        match self {
+            Script => Some("path"),
+            Flow | App | RawApp => Some("draft_path"),
+            _ => None,
+        }
+    }
+
+    /// The other of the two path keys a draft value can carry. The editors mirror
+    /// the typed path into it while it differs from the row's path, so a move that
+    /// rewrote only `typed_path_field` would leave the mirror naming the old
+    /// location — and the loaders prefer the mirror, which un-does the move.
+    pub fn mirror_path_field(&self) -> Option<&'static str> {
+        match self.typed_path_field()? {
+            "path" => Some("draft_path"),
+            _ => Some("path"),
+        }
+    }
+
     /// Whether OTHER users' drafts at a path are visible to a viewer (the
     /// "others are editing" list, owner circles, and the `get_draft_for_user`
     /// View JSON / Fork endpoint). Enabled only for the full-page editor items
@@ -212,6 +240,12 @@ pub struct WithDraftOverlay {
     pub is_draft: bool,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub draft_saved_at: Option<DateTime<Utc>>,
+    /// The deployed version the draft forked from (`draft.base`), as text
+    /// whatever the kind. The editor compares it to the head it loaded to tell
+    /// a draft that is behind. Absent when there is no draft or it was never
+    /// forked from a deploy.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub draft_base: Option<String>,
     /// True when no deployed row exists at this path: `inner` is only a
     /// best-effort stand-in synthesized from the draft and only `draft` is
     /// canonical. Frontend uses this to disable "diff/reset vs deployed" and
@@ -297,6 +331,7 @@ where
             inner: Box::new(deployed),
             is_draft: false,
             draft_saved_at: None,
+            draft_base: None,
             no_deployed: false,
             draft: None,
             other_drafts_users: Vec::new(),
@@ -317,7 +352,7 @@ where
     // row when an owned one exists.
     let row = sqlx::query!(
         r#"SELECT value as "value!: sqlx::types::Json<Box<serde_json::value::RawValue>>",
-                  created_at
+                  created_at, base
            FROM draft
            WHERE workspace_id = $1
              AND (email = $2 OR email IS NULL)
@@ -338,6 +373,7 @@ where
             inner: Box::new(deployed),
             is_draft: false,
             draft_saved_at: None,
+            draft_base: None,
             no_deployed: false,
             draft: None,
             other_drafts_users,
@@ -350,6 +386,7 @@ where
         inner: Box::new(deployed),
         is_draft: true,
         draft_saved_at: Some(row.created_at),
+        draft_base: row.base,
         no_deployed: false,
         draft: Some(draft_json),
         other_drafts_users,
@@ -468,7 +505,8 @@ pub async fn overlay_or_draft_only<T: serde::Serialize + Send + 'static>(
     }
 }
 
-/// Delete the drafts an address owns, across every workspace.
+/// Delete the drafts an address owns, and the move records routing saves to them,
+/// across every workspace.
 ///
 /// `draft.email` carries no foreign key to `password`: a draft's owner is any principal the
 /// instance authenticates, and an external JWT's subject never has a `password` row. Deleting an
@@ -479,12 +517,14 @@ pub async fn overlay_or_draft_only<T: serde::Serialize + Send + 'static>(
 /// No authorization of its own: it acts instance-wide on whatever address it is handed, so the
 /// caller must already have authorized removing that account (superadmin, the account's own
 /// holder, or SCIM).
-pub async fn delete_drafts_of_email<'c>(
-    executor: impl sqlx::PgExecutor<'c>,
-    email: &str,
-) -> Result<()> {
+pub async fn delete_drafts_of_email(conn: &mut sqlx::PgConnection, email: &str) -> Result<()> {
     sqlx::query!("DELETE FROM draft WHERE email = $1", email)
-        .execute(executor)
+        .execute(&mut *conn)
+        .await?;
+    // The records routing saves to those drafts go with them: one left behind would send
+    // a later holder of the address to a draft that no longer exists.
+    sqlx::query!("DELETE FROM draft_move WHERE email = $1", email)
+        .execute(&mut *conn)
         .await?;
     Ok(())
 }
@@ -526,6 +566,29 @@ pub async fn rename_drafts_of_email(
     )
     .execute(&mut *conn)
     .await?;
+    // The records that route saves to those drafts follow the same address, or a save
+    // still addressed to a path the account moved away from would start a second draft
+    // there. The moving account's record for a path wins, as its draft just did.
+    sqlx::query!(
+        "DELETE FROM draft_move dest
+         WHERE dest.email = $1
+           AND EXISTS (SELECT 1 FROM draft_move src
+                       WHERE src.email = $2
+                         AND src.workspace_id = dest.workspace_id
+                         AND src.old_path = dest.old_path
+                         AND src.typ = dest.typ)",
+        new_email,
+        old_email
+    )
+    .execute(&mut *conn)
+    .await?;
+    sqlx::query!(
+        "UPDATE draft_move SET email = $1 WHERE email = $2",
+        new_email,
+        old_email
+    )
+    .execute(&mut *conn)
+    .await?;
     Ok(())
 }
 
@@ -582,6 +645,247 @@ pub async fn delete_own_draft_for_path(
     Ok(())
 }
 
+/// Carry every draft at `old_path` over to `new_path` when an item MOVES
+/// (rename or relocation). A draft is bound to its item by nothing but the path
+/// string, so without this a move detaches every draft on the item. No owner
+/// filter: teammates' rows and the legacy NULL-email row follow too.
+///
+/// **The caller must have authorized the underlying item move first.** This rewrites
+/// rows the caller has no permission on and enforces nothing itself, taking both paths
+/// on trust: it is safe only inside a deploy that has already cleared them, and is a
+/// cross-user write with no gate anywhere else.
+///
+/// The value keeps its base version, so every carried draft reads as behind the head the
+/// move minted. Of its two path keys, one still naming `old_path` follows the row (the
+/// editors write the item's own path there on every save, so it is the item's path and
+/// not a staged rename); any other value is a rename the user staged, and is kept.
+///
+/// A draft already at `new_path` occupies it the way a deployed item does, so the move is
+/// refused with `BadRequest` inside the deploy's transaction, refusing the rename itself:
+/// moving onto it would merge two items or strand the row that lost. A row a `draft_move`
+/// record already brought there from `old_path` is this rename's own draft and does not
+/// count: deploying it would otherwise be refused against itself, with no way out.
+pub async fn move_drafts_for_path(
+    tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
+    w_id: &str,
+    kinds: &[UserDraftItemKind],
+    old_path: &str,
+    new_path: &str,
+) -> Result<()> {
+    let typs = kinds.iter().map(|k| k.as_str()).collect::<Vec<_>>();
+    // Named by workspace username, as the editors name other users' drafts: the
+    // caller is often not the owner, and cannot clear a draft they cannot find.
+    let owners = sqlx::query!(
+        r#"SELECT d.email IS NULL as "legacy!", COALESCE(u.username, p.username) as username
+           FROM draft d
+           LEFT JOIN usr u ON u.workspace_id = d.workspace_id AND u.email = d.email
+           LEFT JOIN password p ON p.email = d.email AND p.super_admin = true
+           WHERE d.workspace_id = $1 AND d.path = $2 AND d.typ::text = ANY($3::text[])
+             -- A row a move already brought here from the very path being renamed is this
+             -- rename's own draft, not an item in its way: the record says which owners
+             -- it moved (all of them for an item move, one for a draft-only move). Any
+             -- other row is a second item and still collides.
+             AND NOT EXISTS (
+                 SELECT 1 FROM draft_move m
+                 WHERE m.workspace_id = $1 AND m.typ::text = ANY($3::text[])
+                   AND m.old_path = $4 AND m.new_path = $2
+                   AND (m.email IS NULL OR m.email IS NOT DISTINCT FROM d.email)
+             )
+           ORDER BY 2"#,
+        w_id,
+        new_path,
+        &typs as &[&str],
+        old_path,
+    )
+    .fetch_all(&mut **tx)
+    .await?;
+    if !owners.is_empty() {
+        let names = owners
+            .into_iter()
+            .map(|o| match (o.username, o.legacy) {
+                (Some(name), _) => name,
+                (None, true) => "a legacy workspace draft".to_string(),
+                (None, false) => "another user".to_string(),
+            })
+            .collect::<Vec<_>>()
+            .join(", ");
+        return Err(crate::error::Error::BadRequest(format!(
+            "'{new_path}' already has a draft on it ({names}) — it must be moved or discarded first"
+        )));
+    }
+    // `draft.value` is `json`, so a NUL escape left by a pre-sanitizer write makes
+    // `to_jsonb` raise 22P05. `clean` is `strip_json_nul`'s parity rule in SQL (escaped
+    // backslashes parked on chr(1), which a `json` value's text cannot hold, so nothing
+    // collides with it; chr(92) spells the backslash so no escape sequence reaches this
+    // file). A row whose keys need re-pointing is therefore rewritten clean rather than
+    // left naming the old path, and one that needs nothing keeps its value byte for byte.
+    sqlx::query!(
+        r#"UPDATE draft AS d
+           SET path = $3::text,
+               value = (
+                   SELECT CASE
+                       WHEN s.clean -> 'path' = to_jsonb($2::text)
+                         OR s.clean -> 'draft_path' = to_jsonb($2::text)
+                           THEN to_json(
+                               s.clean
+                               || CASE WHEN s.clean -> 'path' = to_jsonb($2::text)
+                                       THEN jsonb_build_object('path', $3::text)
+                                       ELSE '{}'::jsonb END
+                               || CASE WHEN s.clean -> 'draft_path' = to_jsonb($2::text)
+                                       THEN jsonb_build_object('draft_path', $3::text)
+                                       ELSE '{}'::jsonb END
+                           )
+                       ELSE d.value
+                   END
+                   FROM (SELECT replace(replace(replace(d.value::text, chr(92) || chr(92), chr(1)),
+                                                chr(92) || 'u0000', ''), chr(1), chr(92) || chr(92))::jsonb AS clean) s
+               )
+           WHERE d.workspace_id = $1
+             AND d.path = $2::text
+             AND d.typ::text = ANY($4::text[])"#,
+        w_id,
+        old_path,
+        new_path,
+        &typs as &[&str],
+    )
+    .execute(&mut **tx)
+    .await?;
+    record_draft_move(tx, w_id, kinds, old_path, new_path, None).await
+}
+
+/// Record that the drafts at `old_path` now live at `new_path`, so a draft save still
+/// addressed to `old_path` lands on them (see `update_draft`). `email` scopes the
+/// record to one user's draft-only move; `None` is a deployed item's move, for everyone.
+///
+/// Kept to one hop: records pointing at `old_path` are re-pointed (an owner's move
+/// leaves the item's own record alone and copies it into its own scope instead), and
+/// records leaving either path are replaced, since `new_path` now holds the item.
+///
+/// **The caller must have authorized the move first.** A record routes every later
+/// draft write at `old_path` (any owner's, for an item move), and enforces nothing
+/// itself.
+///
+/// A record outlives the editors that need it: it ends when a later move touches either
+/// path or an item is deployed at `old_path`, so a save meaning to start a NEW draft at a
+/// vacated path would be routed instead. Nothing does that today: every surface parks a
+/// new item at a minted `u/<user>/draft_<uuid>` key (`mintDraftPath.ts`).
+pub async fn record_draft_move(
+    tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
+    w_id: &str,
+    kinds: &[UserDraftItemKind],
+    old_path: &str,
+    new_path: &str,
+    email: Option<&str>,
+) -> Result<()> {
+    let typs = kinds.iter().map(|k| k.as_str()).collect::<Vec<_>>();
+    sqlx::query!(
+        "DELETE FROM draft_move
+         WHERE workspace_id = $1 AND typ::text = ANY($2::text[])
+           AND old_path IN ($3, $4) AND ($5::text IS NULL OR email = $5)",
+        w_id,
+        &typs as &[&str],
+        old_path,
+        new_path,
+        email,
+    )
+    .execute(&mut **tx)
+    .await?;
+    // Routes that ended at the destination before this move describe drafts that were
+    // carried there for an item this one is replacing: left alive, a save addressed to
+    // the start of that chain would land on this move's draft instead.
+    sqlx::query!(
+        "DELETE FROM draft_move
+         WHERE workspace_id = $1 AND typ::text = ANY($2::text[])
+           AND new_path = $4 AND old_path <> $3 AND ($5::text IS NULL OR email = $5)",
+        w_id,
+        &typs as &[&str],
+        old_path,
+        new_path,
+        email,
+    )
+    .execute(&mut **tx)
+    .await?;
+    sqlx::query!(
+        "UPDATE draft_move SET new_path = $4
+         WHERE workspace_id = $1 AND typ::text = ANY($2::text[])
+           AND new_path = $3 AND ($5::text IS NULL OR email = $5)",
+        w_id,
+        &typs as &[&str],
+        old_path,
+        new_path,
+        email,
+    )
+    .execute(&mut **tx)
+    .await?;
+    // An owner's move must not re-point what everyone else follows, so the item's own
+    // records ending at `old_path` are copied into this scope: a save addressed to the
+    // start of that chain still reaches this destination in one hop. Only those: another
+    // user's owner-scoped record routes their own draft-only item, which this move has
+    // nothing to do with.
+    if email.is_some() {
+        sqlx::query!(
+            "INSERT INTO draft_move (workspace_id, typ, old_path, new_path, email)
+             SELECT m.workspace_id, m.typ, m.old_path, $4, $5::text
+             FROM draft_move m
+             WHERE m.workspace_id = $1 AND m.typ::text = ANY($2::text[])
+               AND m.new_path = $3 AND m.email IS NULL
+               AND NOT EXISTS (
+                   SELECT 1 FROM draft_move o
+                   WHERE o.workspace_id = m.workspace_id AND o.typ = m.typ
+                     AND o.old_path = m.old_path AND o.email = $5::text
+               )",
+            w_id,
+            &typs as &[&str],
+            old_path,
+            new_path,
+            email,
+        )
+        .execute(&mut **tx)
+        .await?;
+    }
+    sqlx::query!(
+        "INSERT INTO draft_move (workspace_id, typ, old_path, new_path, email)
+         SELECT $1, t::draft_kind, $3, $4, $5 FROM unnest($2::text[]) t",
+        w_id,
+        &typs as &[&str],
+        old_path,
+        new_path,
+        email,
+    )
+    .execute(&mut **tx)
+    .await?;
+    Ok(())
+}
+
+/// Drop the move records at `path`: an item was just created there, so saves addressed to
+/// it are its own (records leaving `path`). A deploy that is not a rename also drops the
+/// records arriving, which point at an item that no longer owns the path; `keep_from`,
+/// the path a rename came from, suppresses that, since the chain ending here is the one
+/// this very deploy just wrote.
+///
+/// **The caller must have authorized the deploy that created the item first.**
+/// Dropping a record sends later draft writes at `path` back to `path`.
+pub async fn clear_draft_moves_from(
+    tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
+    w_id: &str,
+    kinds: &[UserDraftItemKind],
+    path: &str,
+    keep_from: Option<&str>,
+) -> Result<()> {
+    let typs = kinds.iter().map(|k| k.as_str()).collect::<Vec<_>>();
+    sqlx::query!(
+        "DELETE FROM draft_move WHERE workspace_id = $1 AND typ::text = ANY($2::text[])
+           AND (old_path = $3 OR (new_path = $3 AND $4::text IS NULL))",
+        w_id,
+        &typs as &[&str],
+        path,
+        keep_from,
+    )
+    .execute(&mut **tx)
+    .await?;
+    Ok(())
+}
+
 /// Fetch the authed user's draft as a standalone payload, for "get by path"
 /// routes when no deployed row exists but a draft might. Returns it as a
 /// `WithDraftOverlay` with `inner` and `draft` both set to the same JSON and
@@ -600,7 +904,7 @@ pub async fn fetch_draft_only(
     // Own draft first, legacy NULL-email row as fallback (see `maybe_overlay_draft`).
     let row = sqlx::query!(
         r#"SELECT value as "value!: sqlx::types::Json<Box<serde_json::value::RawValue>>",
-                  created_at
+                  created_at, base
            FROM draft
            WHERE workspace_id = $1
              AND (email = $2 OR email IS NULL)
@@ -631,6 +935,7 @@ pub async fn fetch_draft_only(
         inner: Box::new(draft_json.clone()),
         is_draft: true,
         draft_saved_at: Some(row.created_at),
+        draft_base: row.base,
         no_deployed: true,
         draft: Some(draft_json),
         other_drafts_users,
diff --git a/backend/windmill-common/src/utils.rs b/backend/windmill-common/src/utils.rs
index fd0bd634ea..b247c66532 100644
--- a/backend/windmill-common/src/utils.rs
+++ b/backend/windmill-common/src/utils.rs
@@ -245,6 +245,9 @@ lazy_static::lazy_static! {
 /// Reject a path the `proper_id` constraint would reject anyway, so the caller
 /// gets a plain 400 instead of the raw Postgres constraint-violation string,
 /// which names the table and constraint and echoes the input back.
+///
+/// `app` and the trigger tables have no such constraint: for them this check is
+/// the only authority, so loosening it lets malformed paths be stored.
 pub fn check_proper_path(path: &str) -> Result<()> {
     // The column is varchar(255); without this an over-long but well-formed path
     // still reaches Postgres and leaks the same kind of message back.
@@ -479,6 +482,28 @@ pub fn paginate(pagination: Pagination) -> (usize, usize) {
     (per_page, offset)
 }
 
+/// [`paginate`] for a listing that answers whole unless a size is asked for: the deploy
+/// histories, which the history panels and the CLI read unpaged while the diff picker takes
+/// a page at a time. An asked-for size is still clamped, and the offset saturates rather
+/// than wrapping, so no caller can turn this into an unbounded scan or a negative bind.
+pub fn paginate_optional(pagination: Pagination) -> (i64, i64) {
+    // Naming neither parameter asks for the whole listing, the contract these endpoints
+    // have always answered on. Naming either makes it a page like any other listing's.
+    if pagination.page.is_none() && pagination.per_page.is_none() {
+        return (i64::MAX, 0);
+    }
+    let per_page = pagination
+        .per_page
+        .unwrap_or(DEFAULT_PER_PAGE)
+        .clamp(1, MAX_PER_PAGE) as i64;
+    // Bound before Postgres sees it: an unchecked cast of a caller-controlled page becomes
+    // a negative OFFSET, which is an error rather than an empty page.
+    let offset = i64::try_from(pagination.page.unwrap_or(1).max(1) - 1)
+        .unwrap_or(i64::MAX)
+        .saturating_mul(per_page);
+    (per_page, offset)
+}
+
 pub fn paginate_without_limits(pagination: Pagination) -> (usize, usize) {
     let per_page = pagination.per_page.unwrap_or(MAX_PER_PAGE);
     let offset = (pagination.page.unwrap_or(1).max(1) - 1) * per_page;
@@ -1672,6 +1697,31 @@ pub fn truncate_with_ellipsis(s: &str, max_chars: usize) -> String {
 mod tests {
     use super::*;
 
+    #[test]
+    fn test_paginate_optional_answers_whole_but_bounds_what_is_asked_for() {
+        // Nothing asked for: every row there can be, which is what the history panels and
+        // the CLI read.
+        assert_eq!(
+            paginate_optional(Pagination { page: None, per_page: None }),
+            (i64::MAX, 0)
+        );
+        assert_eq!(
+            paginate_optional(Pagination { page: Some(3), per_page: Some(20) }),
+            (20, 40)
+        );
+        // An asked-for size is still capped, so no caller turns this into an unbounded scan.
+        assert_eq!(
+            paginate_optional(Pagination { page: None, per_page: Some(usize::MAX) }),
+            (MAX_PER_PAGE as i64, 0)
+        );
+        // A page nobody could mean lands past the end rather than going negative, which
+        // Postgres would reject outright.
+        let (per_page, offset) =
+            paginate_optional(Pagination { page: Some(usize::MAX), per_page: Some(20) });
+        assert_eq!(per_page, 20);
+        assert_eq!(offset, i64::MAX);
+    }
+
     /// A 5-field crontab line is the most common way to get a schedule rejected, and both
     /// parsers report it in terms a crontab user cannot act on, so the seconds field and the
     /// equivalent expression must reach the caller for v1 and v2 alike.
diff --git a/backend/windmill-common/src/webhook.rs b/backend/windmill-common/src/webhook.rs
index 02d6f7ddc5..2f0d83f7e2 100644
--- a/backend/windmill-common/src/webhook.rs
+++ b/backend/windmill-common/src/webhook.rs
@@ -164,7 +164,10 @@ impl WebhookShared {
                 reqwest::Client::builder()
                     .connect_timeout(Duration::from_secs(5))
                     // TODO: investigate pool timeouts and such if TCP load is high
-                    .timeout(Duration::from_secs(5)),
+                    .timeout(Duration::from_secs(5))
+                    // The workspace webhook URL is SSRF-checked when saved; a redirect
+                    // would send the POST past that check.
+                    .redirect(reqwest::redirect::Policy::none()),
             )
             .build()
             .unwrap();
diff --git a/backend/windmill-common/src/worker.rs b/backend/windmill-common/src/worker.rs
index ee8a389bb7..ad0a5068e8 100644
--- a/backend/windmill-common/src/worker.rs
+++ b/backend/windmill-common/src/worker.rs
@@ -41,6 +41,8 @@ use crate::{
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Default)]
 pub struct CustomTags {
     pub global: Vec<String>,
+    /// Keyed by the entry's name, which may hold placeholders like a global entry: only a name
+    /// without any can be looked up by the tag it admits, the others through [`custom_tag_matches`].
     pub specific: HashMap<String, SpecificTagData>,
 }
 
@@ -83,20 +85,7 @@ impl CustomTags {
         } else {
             self.specific
                 .iter()
-                .map(|(tag, tag_data)| {
-                    let separator = tag_data.tag_type.corresponding_separator();
-                    let mut workspaces = tag_data
-                        .workspaces
-                        .iter()
-                        .map(|w| w.to_string())
-                        .collect::<Vec<_>>()
-                        .join(&*separator.to_string());
-                    if tag_data.tag_type == SpecificTagType::AllExcluding {
-                        // the AllExcluding tag syntax has a leading separator
-                        workspaces.insert(0, separator);
-                    }
-                    format!("{}({})", tag, workspaces)
-                })
+                .map(|(tag, tag_data)| tag_data.authored(tag))
                 .collect::<Vec<String>>()
         };
         let all_tags = self.global.clone();
@@ -104,6 +93,84 @@ impl CustomTags {
     }
 }
 
+/// Whether a job whose tag resolved to `tag` falls under the custom tag `entry`. An entry holding
+/// placeholders is a pattern over resolved tags: `$args[...]` and `$flow_expr[...]` match any
+/// text, since whoever pushes the job picks their values, and `$workspace` matches
+/// `tag_workspace`, what the job's own `$workspace` resolves to. The text around them must match
+/// as written: it is what confines `gpu-$args[size]` to the `gpu-` tags.
+///
+/// Placeholders whose values are tied, a repeat or one reading inside another, make an entry no
+/// wildcard pattern describes (`t-$args[id]-$args[id]` never resolves to `t-a-b`). Such an entry
+/// matches nothing here: it admits only a job whose tag is written exactly as the entry is.
+pub fn custom_tag_matches(entry: &str, tag: &str, tag_workspace: &str) -> bool {
+    if !entry.contains('$') {
+        return entry == tag;
+    }
+    let dynamic: Vec<&str> = CUSTOM_TAG_PLACEHOLDER
+        .find_iter(entry)
+        .map(|m| m.as_str())
+        .filter(|p| *p != "$workspace")
+        .collect();
+    let tied = dynamic
+        .iter()
+        .enumerate()
+        .any(|(i, a)| dynamic[i + 1..].iter().any(|b| placeholders_tied(a, b)));
+    if tied {
+        return false;
+    }
+    // The literal runs between wildcards, with `$workspace` substituted.
+    let mut pieces = vec![];
+    let mut current = String::new();
+    let mut last_end = 0;
+    for m in CUSTOM_TAG_PLACEHOLDER.find_iter(entry) {
+        current.push_str(&entry[last_end..m.start()]);
+        if m.as_str() == "$workspace" {
+            current.push_str(tag_workspace);
+        } else {
+            pieces.push(std::mem::take(&mut current));
+        }
+        last_end = m.end();
+    }
+    current.push_str(&entry[last_end..]);
+    pieces.push(current);
+
+    let [first, rest @ ..] = pieces.as_slice() else {
+        return false;
+    };
+    let Some((last, middle)) = rest.split_last() else {
+        return tag == first;
+    };
+    let Some(mut inner) = tag
+        .strip_prefix(first.as_str())
+        .and_then(|t| t.strip_suffix(last.as_str()))
+    else {
+        return false;
+    };
+    for piece in middle {
+        match inner.find(piece.as_str()) {
+            Some(i) => inner = &inner[i + piece.len()..],
+            None => return false,
+        }
+    }
+    true
+}
+
+/// Whether two `$args[...]` / `$flow_expr[...]` placeholders read the same value, or one reads a
+/// value inside the other's.
+fn placeholders_tied(a: &str, b: &str) -> bool {
+    let (Some((kind_a, path_a)), Some((kind_b, path_b))) = (a.split_once('['), b.split_once('['))
+    else {
+        return false;
+    };
+    let (path_a, path_b) = (path_a.trim_end_matches(']'), path_b.trim_end_matches(']'));
+    let inside = |outer: &str, inner: &str| {
+        inner
+            .strip_prefix(outer)
+            .is_some_and(|rest| rest.starts_with('.'))
+    };
+    kind_a == kind_b && (path_a == path_b || inside(path_a, path_b) || inside(path_b, path_a))
+}
+
 /// Marker suffixed to a workspace id inside a custom tag's scope (`mytag(prod*)`) to extend the
 /// entry to that workspace's forks. `*` cannot appear in a workspace id (the `proper_id` check
 /// constraint restricts them to `^\w+(-\w+)*$`), so it can never collide with a real id.
@@ -183,6 +250,22 @@ impl SpecificTagData {
     pub fn is_fork_scoped(&self) -> bool {
         self.workspaces.iter().any(|w| w.include_forks)
     }
+
+    /// The entry named `name` with this scope, as written in the custom tags: `tag(ws1+ws2)`.
+    pub fn authored(&self, name: &str) -> String {
+        let separator = self.tag_type.corresponding_separator();
+        let mut workspaces = self
+            .workspaces
+            .iter()
+            .map(|w| w.to_string())
+            .collect::<Vec<_>>()
+            .join(&*separator.to_string());
+        if self.tag_type == SpecificTagType::AllExcluding {
+            // the AllExcluding tag syntax has a leading separator
+            workspaces.insert(0, separator);
+        }
+        format!("{}({})", name, workspaces)
+    }
 }
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
 pub enum SpecificTagType {
@@ -464,7 +547,9 @@ lazy_static::lazy_static! {
 
 
 
-    //    ^([\w-]+)         # Group 1: tag name
+    //    ^(                # Group 1: tag name, a pattern when it holds placeholders
+    //      (?:[\w-]|\$workspace|\$(?:args|flow_expr)\[(?:\w+\.)*\w+\])+
+    //    )
     //    \(                # Literal '('
     //    (                 # Group 2: the full workspace list
     //      (?:[\w-]+\*?\+)*[\w-]+\*?   # NoneExcept pattern: ws1+ws2*
@@ -473,8 +558,12 @@ lazy_static::lazy_static! {
     //    )
     //    \)$               # Closing ')'
     //
-    // The optional `*` after each workspace id is the fork marker, see [`WorkspaceMatcher`].
-    static ref CUSTOM_TAG_REGEX: Regex = Regex::new(r"^([\w-]+)\(((?:[\w-]+\*?\+)*[\w-]+\*?|(?:\^[\w-]+\*?)+)\)$").unwrap();
+    // The placeholders are CUSTOM_TAG_PLACEHOLDER's. The optional `*` after each workspace id is
+    // the fork marker, see [`WorkspaceMatcher`].
+    static ref CUSTOM_TAG_REGEX: Regex = Regex::new(r"^((?:[\w-]|\$workspace|\$(?:args|flow_expr)\[(?:\w+\.)*\w+\])+)\(((?:[\w-]+\*?\+)*[\w-]+\*?|(?:\^[\w-]+\*?)+)\)$").unwrap();
+
+    // The placeholders a job's tag is resolved from when it is pushed, see [`custom_tag_matches`].
+    static ref CUSTOM_TAG_PLACEHOLDER: Regex = Regex::new(r"\$workspace|\$(?:args|flow_expr)\[(?:\w+\.)*\w+\]").unwrap();
 
     pub static ref DISABLE_BUNDLING: bool = std::env::var("DISABLE_BUNDLING")
     .ok()
@@ -1082,6 +1171,83 @@ pub struct SqlAnnotations {
     pub raw_output: bool,
 }
 
+impl SqlAnnotations {
+    /// The data table role a query declares as `-- role <name>`, if any. Only meaningful against a
+    /// `datatable://` database that is under roles; absent means the data table's default role.
+    ///
+    /// Hand-written rather than derived because the value matters, not just the presence, and
+    /// because the executor needs it before it knows the connection is a data table at all. Like
+    /// every annotation it lives in the leading comment block.
+    ///
+    /// A leading comment whose first word is `role` is an annotation *attempt*, and a malformed
+    /// one is an error. The alternative — ignoring what does not parse — resolves the query to the
+    /// data table's default role instead, so a typo silently runs it under a login the author did
+    /// not choose, which is the opposite of what naming a role is for. Only callers that already
+    /// know the target is a `datatable://` reference ever run this, so ordinary SQL keeps its
+    /// comments.
+    pub fn datatable_role(code: &str) -> error::Result<Option<String>> {
+        for line in code.lines() {
+            let line = line.trim();
+            if line.is_empty() {
+                continue;
+            }
+            if !line.starts_with("--") {
+                break;
+            }
+            // The keyword may be followed by whitespace, `:` or `=` — `role x`, `role: x`,
+            // `role=x`, `Role = x` all open an attempt, while `rolexyz` does not. Each accepted
+            // separator is one spelling that would otherwise take the `continue` below and run the
+            // query as the data table's default role, which is the silence this exists to remove.
+            let body = line[2..].trim_start();
+            let Some(after) = body
+                .get(..4)
+                .filter(|kw| kw.eq_ignore_ascii_case("role"))
+                .map(|_| &body[4..])
+            else {
+                continue;
+            };
+            if !after.is_empty()
+                && !after.starts_with(char::is_whitespace)
+                && !after.starts_with([':', '='])
+            {
+                continue;
+            }
+
+            // Past this point the line is an attempt to name a role, so a malformed one is an
+            // error rather than a miss. Falling through would run the query as the data table's
+            // default role — quietly, and under a login the author did not choose.
+            let after = after.trim_start();
+            let after = after.strip_prefix([':', '=']).unwrap_or(after);
+            let mut tokens = after.split_whitespace();
+            let role = tokens
+                .next()
+                .map(|role| role.strip_suffix(';').unwrap_or(role));
+            let rest = tokens.next();
+            match (role, rest) {
+                (Some(role), None)
+                    if !role.is_empty()
+                        && role.len() <= 63
+                        && role
+                            .chars()
+                            .all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-') =>
+                {
+                    return Ok(Some(role.to_string()));
+                }
+                _ => {
+                    return Err(error::Error::BadRequest(format!(
+                        "Malformed data table role annotation: `{line}`. Write it as \
+                         `-- role <name>` on a line of its own, where <name> is letters, digits, \
+                         '_' or '-'. A comment in the leading block that starts with the word \
+                         'role' is read as this annotation; move it below the first statement if \
+                         it is prose."
+                    )));
+                }
+            }
+        }
+        Ok(None)
+    }
+}
+
 #[annotations("#")]
 pub struct BashAnnotations {
     pub docker: bool,
@@ -2653,6 +2819,56 @@ mod tests {
     use super::*;
     use std::collections::HashMap;
 
+    #[test]
+    fn datatable_role_is_read_from_the_leading_comment_block() {
+        let role = |code| SqlAnnotations::datatable_role(code);
+        assert_eq!(
+            role("-- role analytics\nSELECT 1").unwrap(),
+            Some("analytics".to_string())
+        );
+        // Blank lines and other annotations before it are fine.
+        assert_eq!(
+            role("\n-- prepare\n-- role read_only\nSELECT 1").unwrap(),
+            Some("read_only".to_string())
+        );
+        // Past the first statement it is an ordinary comment, not an annotation.
+        assert_eq!(role("SELECT 1;\n-- role analytics").unwrap(), None);
+        assert_eq!(role("SELECT 1").unwrap(), None);
+
+        // Unambiguous intent is honoured: the keyword matches case-insensitively, a trailing
+        // semicolon is a habit carried over from SQL rather than a different role, and the colon
+        // spelling is the one most likely to be typed.
+        for accepted in [
+            "-- Role operator\nSELECT 1",
+            "-- role operator;\nSELECT 1",
+            "-- role: operator\nSELECT 1",
+            "-- role:operator\nSELECT 1",
+            "-- role=operator\nSELECT 1",
+            "-- Role = operator\nSELECT 1",
+        ] {
+            assert_eq!(
+                role(accepted).unwrap(),
+                Some("operator".to_string()),
+                "not honoured: {accepted}"
+            );
+        }
+
+        // Anything else opening with the word is refused rather than resolved to the default role:
+        // the whole point of naming one is to not run as something else.
+        for near_miss in [
+            "-- role operator -- why\nSELECT 1",
+            "-- role an;alytics\nSELECT 1",
+            "-- role\nSELECT 1",
+            "-- role:\nSELECT 1",
+            "-- role based access is handled below\nSELECT 1",
+        ] {
+            assert!(role(near_miss).is_err(), "silently ignored: {near_miss}");
+        }
+
+        // A word that merely starts with the keyword is not an attempt.
+        assert_eq!(role("-- rolebased notes\nSELECT 1").unwrap(), None);
+    }
+
     fn matcher(id: &str) -> WorkspaceMatcher {
         WorkspaceMatcher { id: id.to_string(), include_forks: false }
     }
@@ -2943,6 +3159,92 @@ mod tests {
         assert_eq!(result, vec!["foo", "legacy(^ws1^ws2)", "urgent(ws1+ws2)"]);
     }
 
+    #[test]
+    fn test_custom_tag_matches_resolved_tags() {
+        let matches = |entry, tag| custom_tag_matches(entry, tag, "ws1");
+
+        assert!(matches("gpu", "gpu"));
+        assert!(!matches("gpu", "gpu-large"));
+
+        // The text around a placeholder fences what its value can make of the tag.
+        assert!(matches("gpu-$args[size]", "gpu-large"));
+        assert!(matches("gpu-$flow_expr[results.a.size]", "gpu-"));
+        assert!(!matches("gpu-$args[size]", "prod"));
+        assert!(!matches("gpu-$args[size]", "xgpu-large"));
+        assert!(matches("$args[region]-gpu", "eu-gpu"));
+        assert!(!matches("$args[region]-gpu", "eu-gpu-x"));
+        assert!(matches("a-$args[x]-b-$args[y]-c", "a-1-b-2-c"));
+        assert!(!matches("a-$args[x]-b-$args[y]-c", "a-1-c"));
+        assert!(!matches("ab$args[x]ba", "aba"));
+
+        // A bare placeholder admits every tag.
+        assert!(matches("$flow_expr[results.a.tag]", "anything"));
+
+        // Tied placeholders are no pattern: their entry admits only its own text.
+        assert!(!matches("t-$args[id]-$args[id]", "t-a-a"));
+        assert!(!matches("t-$args[a]-$args[a.b]", "t-x-y"));
+        assert!(matches("t-$args[a.x]-$args[a.y]", "t-x-y"));
+        assert!(matches("t-$args[id]-$flow_expr[flow_input.id]", "t-x-y"));
+
+        // `$workspace` stands for the job's own workspace only.
+        assert!(matches("tag-$workspace", "tag-ws1"));
+        assert!(!matches("tag-$workspace", "tag-ws2"));
+        assert!(matches("$workspace-$args[size]", "ws1-large"));
+        assert!(!matches("$workspace-$args[size]", "ws2-large"));
+    }
+
+    #[test]
+    fn test_scoped_custom_tag_patterns_parse_and_round_trip() {
+        let input = vec![
+            "gpu-$args[size](ws1+ws2)".to_string(),
+            "cpu-$flow_expr[results.a.size](^ws1)".to_string(),
+            "$workspace-$args[x](prod*)".to_string(),
+            "t-$args[id]-$args[id](ws1)".to_string(),
+        ];
+        let tags = CustomTags::from(input.clone());
+
+        assert!(tags.global.is_empty());
+        assert_eq!(
+            tags.specific["gpu-$args[size]"],
+            SpecificTagData {
+                tag_type: SpecificTagType::NoneExcept,
+                workspaces: vec![matcher("ws1"), matcher("ws2")],
+            }
+        );
+        assert_eq!(
+            tags.specific["cpu-$flow_expr[results.a.size]"],
+            SpecificTagData {
+                tag_type: SpecificTagType::AllExcluding,
+                workspaces: vec![matcher("ws1")],
+            }
+        );
+        assert!(tags.specific["$workspace-$args[x]"].is_fork_scoped());
+        assert!(tags.specific.contains_key("t-$args[id]-$args[id]"));
+
+        let mut result = tags.to_string_vec(None);
+        result.sort();
+        let mut expected = input;
+        expected.sort();
+        assert_eq!(result, expected);
+
+        let mut for_ws1 = tags.to_string_vec(Some(&chain(&["ws1"])));
+        for_ws1.sort();
+        assert_eq!(for_ws1, vec!["gpu-$args[size]", "t-$args[id]-$args[id]"]);
+
+        // Only the placeholders a tag resolves from make a name a pattern: anything else is no
+        // scoped entry at all.
+        for literal in [
+            "gpu-$foo(ws1)",
+            "gpu-$args[](ws1)",
+            "gpu-$args[a.](ws1)",
+            "gpu.x(ws1)",
+        ] {
+            let tags = CustomTags::from(vec![literal.to_string()]);
+            assert_eq!(tags.global, vec![literal]);
+            assert!(tags.specific.is_empty());
+        }
+    }
+
     #[test]
     fn test_fork_marker_parses_and_round_trips() {
         let tags = CustomTags::from(vec![
diff --git a/backend/windmill-common/src/workspaces.rs b/backend/windmill-common/src/workspaces.rs
index 7cf910ef84..6f82e3a261 100644
--- a/backend/windmill-common/src/workspaces.rs
+++ b/backend/windmill-common/src/workspaces.rs
@@ -6,6 +6,7 @@ use serde::{Deserialize, Serialize};
 use strum::AsRefStr;
 
 use crate::{
+    datatable_roles::{ADMIN_DATATABLE_ROLE, CUSTOM_INSTANCE_USER},
     error::{self, to_anyhow, Error, Result},
     get_database_url,
     secret_backend::{get_secret_value, is_external_stored_value},
@@ -183,7 +184,7 @@ pub enum ObjectType {
     DatatableMigration,
 }
 
-pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28969/sync-script-to-git-repo-windmill";
+pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28971/sync-script-to-git-repo-windmill";
 
 /// Hub script that applies a repository's state back into a workspace
 /// (the repo → Windmill / "pull" direction). Same script the UI runs from
@@ -191,7 +192,7 @@ pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28969/sync-script-to-git-repo
 /// ignores the slug, so the slug is kept free of characters that would be
 /// percent-encoded into the run URL (a `:` becomes `%3A`, which some hardened
 /// reverse proxies reject as double-encoding when the client re-encodes it).
-pub const GIT_SYNC_PULL_SCRIPT_PATH: &str = "hub/28957/git-sync-init-repository-windmill";
+pub const GIT_SYNC_PULL_SCRIPT_PATH: &str = "hub/28970/git-sync-init-repository-windmill";
 
 /// Prefix used to identify fork workspaces. A workspace whose id starts with this string is a
 /// fork of another workspace.
@@ -1292,9 +1293,23 @@ impl Default for DataTableForkBehavior {
     }
 }
 
-#[derive(Deserialize, Serialize, Debug)]
+#[derive(Deserialize, Serialize, Debug, Clone)]
 pub struct DataTable {
-    pub database: DataTableDatabase,
+    /// Set on a *terminal* entry — one that owns its database. Mutually exclusive with
+    /// [`DataTable::reference`]; [`validate_datatable_shape`] is the one place that enforces it.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub database: Option<DataTableDatabase>,
+    /// Set on a *pointer* entry — one that names another workspace's entry and owns nothing.
+    /// A keep-original fork gets one of these instead of a copy of the parent's entry, so there is
+    /// nothing local for a fork admin to widen.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub reference: Option<DataTableReference>,
+    /// Set on a *clone* — a terminal entry whose database was copied from the entry this names. The
+    /// copy holds that entry's rows, so who may connect as which role stays that entry's decision:
+    /// the clone carries no `permissions` of its own and is governed like a pointer, while
+    /// connecting to its own database.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub governed_by: Option<DataTableReference>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub forked_from: Option<DataTableForkedFrom>,
     /// Whether the SQL-migrations feature is opted in for this data table.
@@ -1302,22 +1317,92 @@ pub struct DataTable {
     /// when migrations already exist (see `datatable_migrations_enabled`).
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub migrations_enabled: Option<bool>,
+    /// Who may connect as which role. Absent = unpermissioned: every caller connects as `admin`,
+    /// which is how data tables behaved before roles existed. Only meaningful on a terminal entry;
+    /// a pointer is governed by what it points at.
+    ///
+    /// Never leaves the instance: stripped from the workspace export and ignored on import, since
+    /// tenants are workspace-scoped names and syncing them would make repo write access a second
+    /// door onto the access decision.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub permissions: Option<DataTablePermissions>,
 }
 
-#[derive(Deserialize, Serialize, Debug)]
+/// A pointer at another workspace's data table entry.
+#[derive(Deserialize, Serialize, Debug, Clone, PartialEq)]
+pub struct DataTableReference {
+    pub workspace_id: String,
+    pub datatable: String,
+}
+
+/// The access decision for one data table: which role a caller gets, and who may ask for each.
+#[derive(Deserialize, Serialize, Debug, Clone, Default)]
+pub struct DataTablePermissions {
+    /// A role id from the instance catalog, or `admin`. Absent = `admin`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub default_role: Option<String>,
+    /// Keyed by instance role id, plus the reserved `admin` key. A role absent from this map
+    /// cannot be used on this data table at all, whatever the instance catalog says.
+    #[serde(default)]
+    pub roles: std::collections::BTreeMap<String, DataTableRoleTenants>,
+}
+
+impl DataTablePermissions {
+    pub fn default_role(&self) -> &str {
+        self.default_role.as_deref().unwrap_or(ADMIN_DATATABLE_ROLE)
+    }
+}
+
+#[derive(Deserialize, Serialize, Debug, Clone, Default)]
+pub struct DataTableRoleTenants {
+    /// `u/<user>`, `g/<group>`, `f/<folder>`, or `*` for every member.
+    #[serde(default)]
+    pub tenants: Vec<String>,
+}
+
+/// Every member of the governing workspace.
+pub const DATATABLE_TENANT_WILDCARD: &str = "*";
+
+/// How deep a chain of pointer entries may go before it is called a loop. Data tables are not
+/// expected to chain at all — a fork points at its parent — so this only has to be generous
+/// enough to survive a fork of a fork.
+const DATATABLE_REFERENCE_MAX_DEPTH: usize = 20;
+
+/// Exactly one of `database` and `reference` must be set, and a clone's `governed_by` leaves no
+/// `permissions` beside it. Called wherever an entry is persisted, so nothing downstream has to
+/// handle an entry that is both or neither, or a clone with a decision of its own.
+pub fn validate_datatable_shape(name: &str, dt: &DataTable) -> Result<()> {
+    if dt.governed_by.is_some() && (dt.database.is_none() || dt.permissions.is_some()) {
+        return Err(Error::BadRequest(format!(
+            "Data table '{name}' is a clone, which owns a database and takes its roles from the \
+             data table it was cloned from"
+        )));
+    }
+    match (&dt.database, &dt.reference) {
+        (Some(_), None) | (None, Some(_)) => Ok(()),
+        (Some(_), Some(_)) => Err(Error::BadRequest(format!(
+            "Data table '{name}' both owns a database and points at another one"
+        ))),
+        (None, None) => Err(Error::BadRequest(format!(
+            "Data table '{name}' names neither a database nor another data table"
+        ))),
+    }
+}
+
+#[derive(Deserialize, Serialize, Debug, Clone)]
 pub struct DataTableForkedFrom {
     /// Schema snapshot at fork time
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub schema: Option<serde_json::Value>,
 }
 
-#[derive(Deserialize, Serialize, Debug)]
+#[derive(Deserialize, Serialize, Debug, Clone)]
 pub struct DataTableDatabase {
     pub resource_type: DataTableCatalogResourceType,
     pub resource_path: String,
 }
 
-#[derive(Deserialize, Serialize, Debug, PartialEq)]
+#[derive(Deserialize, Serialize, Debug, PartialEq, Clone, Copy)]
 #[serde(rename_all = "lowercase")]
 #[derive(AsRefStr)]
 #[strum(serialize_all = "lowercase")]
@@ -1353,37 +1438,13 @@ fn datatable_not_found_error(name: &str, datatables: Option<&serde_json::Value>)
     ))
 }
 
-pub async fn get_datatable_resource_from_db_unchecked(
-    db: &DB,
-    w_id: &str,
-    name: &str,
-) -> Result<serde_json::Value> {
-    get_datatable_resource_inner(db, w_id, name, false).await
-}
-
-/// Same as [`get_datatable_resource_from_db_unchecked`] but for postgres trigger
-/// connections: custom-instance datatables resolve to
-/// `custom_instance_replication_user` rather than `custom_instance_user`. BYO-postgres
-/// datatables resolve to the user's own resource unchanged; configuring it for
-/// replication there is the user's responsibility.
+/// Read one workspace's data table entry, without following a pointer.
 ///
-/// Authorization: like its `_unchecked` sibling, returns resolved connection
-/// credentials and performs no authorization — callers MUST have already authorized
-/// access to the datatable (e.g. the trigger's own create-time check).
-pub async fn get_datatable_replication_resource_from_db_unchecked(
-    db: &DB,
-    w_id: &str,
-    name: &str,
-) -> Result<serde_json::Value> {
-    get_datatable_resource_inner(db, w_id, name, true).await
-}
-
-async fn get_datatable_resource_inner(
-    db: &DB,
-    w_id: &str,
-    name: &str,
-    replication: bool,
-) -> Result<serde_json::Value> {
+/// Disclosure: this is the primitive [`resolve_governing_datatable`] calls on every path, so it is
+/// deliberately open to anything that has to resolve a data table, including for a workspace the
+/// caller does not belong to. What it returns is not: callers MUST NOT put `permissions` into a
+/// response, an export or a log — it names the governing workspace's users, groups and folders.
+pub async fn read_datatable_entry(db: &DB, w_id: &str, name: &str) -> Result<DataTable> {
     let datatables = sqlx::query_scalar!(
         r#"
             SELECT ws.datatable->'datatables' AS datatables
@@ -1401,37 +1462,674 @@ async fn get_datatable_resource_inner(
         .and_then(|d| d.get(name))
         .filter(|v| !v.is_null())
         .ok_or_else(|| datatable_not_found_error(name, datatables.as_ref()))?;
-    let datatable = serde_json::from_value::<DataTable>(datatable.clone())?;
+    Ok(serde_json::from_value::<DataTable>(datatable.clone())?)
+}
 
-    let db_resource = if datatable.database.resource_type == DataTableCatalogResourceType::Instance
-    {
+/// The terminal entry a reference chain lands on, and what governs it: the workspace and name of
+/// the entry that owns the database, the entry itself, and — for a clone — the entry its
+/// `governed_by` chain lands on. A terminal entry that is not a clone resolves to itself and
+/// governs itself.
+///
+/// Every decision downstream is taken on this, never on the entry the caller named. Which database
+/// to connect to comes from `workspace_id` / `name` / `datatable.database`; whose `permissions`
+/// apply (already in `datatable.permissions`), whose members tenants are evaluated against and who
+/// may administer it come from [`GoverningDatatable::governing_workspace_id`].
+///
+/// Authorization: resolving deliberately crosses into the governing workspace, so it answers for a
+/// workspace the caller may not belong to and checks nothing itself. It is the input to the
+/// checks, not one of them: callers MUST pass what it returns to
+/// [`can_use_datatable_role_in_governing_workspace`] or [`ensure_datatable_admin_access`] before
+/// acting on it, and MUST NOT return its `permissions` or workspace ids to a caller from
+/// elsewhere without gating on the answer.
+pub struct GoverningDatatable {
+    pub workspace_id: String,
+    pub name: String,
+    pub datatable: DataTable,
+    /// For a clone, the entry whose `permissions` govern it. `None` when the entry governs itself.
+    pub governor: Option<DataTableReference>,
+}
+
+impl GoverningDatatable {
+    /// Backed by the Windmill instance's own Postgres, which is the only substrate data table
+    /// roles apply to.
+    pub fn is_instance(&self) -> bool {
+        self.datatable
+            .database
+            .as_ref()
+            .is_some_and(|d| d.resource_type == DataTableCatalogResourceType::Instance)
+    }
+
+    /// The workspace whose admins administer the data table and whose members its tenants are.
+    pub fn governing_workspace_id(&self) -> &str {
+        self.governor
+            .as_ref()
+            .map_or(&self.workspace_id, |g| &g.workspace_id)
+    }
+}
+
+pub async fn resolve_governing_datatable(
+    db: &DB,
+    w_id: &str,
+    name: &str,
+) -> Result<GoverningDatatable> {
+    let mut workspace_id = w_id.to_string();
+    let mut name = name.to_string();
+    let mut hops = 0;
+    // The clone a `governed_by` chain started from: it keeps its database, and takes the
+    // `permissions` of wherever the chain lands.
+    let mut clone: Option<(String, String, DataTable)> = None;
+    for _ in 0..DATATABLE_REFERENCE_MAX_DEPTH {
+        let datatable = read_datatable_entry(db, &workspace_id, &name)
+            .await
+            .map_err(|e| {
+                if hops == 0 {
+                    e
+                } else {
+                    // A pointer outlives the workspace it names: deleting one only nulls the fork
+                    // lineage, it does not sweep the entries that pointed at it. Say which one is
+                    // gone rather than reporting a data table this workspace never had.
+                    if clone.is_some() {
+                        Error::NotFound(format!(
+                            "Data table '{name}' of workspace '{workspace_id}', which this clone \
+                             takes its roles from, no longer exists, so nobody is let into the copy."
+                        ))
+                    } else {
+                        Error::NotFound(format!(
+                            "Data table '{name}' of workspace '{workspace_id}' governs this one and \
+                             no longer exists. A superadmin can point this data table somewhere \
+                             else."
+                        ))
+                    }
+                }
+            })?;
+        hops += 1;
+        validate_datatable_shape(&name, &datatable)?;
+        let next = match (&datatable.reference, &datatable.governed_by) {
+            (Some(reference), _) => reference.clone(),
+            (None, Some(governed_by)) => {
+                let governed_by = governed_by.clone();
+                if clone.is_none() {
+                    clone = Some((workspace_id.clone(), name.clone(), datatable));
+                }
+                governed_by
+            }
+            (None, None) => {
+                return Ok(match clone {
+                    None => GoverningDatatable { workspace_id, name, datatable, governor: None },
+                    Some((clone_w_id, clone_name, mut clone_datatable)) => {
+                        clone_datatable.permissions = datatable.permissions;
+                        GoverningDatatable {
+                            workspace_id: clone_w_id,
+                            name: clone_name,
+                            datatable: clone_datatable,
+                            governor: Some(DataTableReference { workspace_id, datatable: name }),
+                        }
+                    }
+                });
+            }
+        };
+        workspace_id = next.workspace_id;
+        name = next.datatable;
+    }
+    Err(Error::BadRequest(format!(
+        "Data table '{name}' points at another data table through more than \
+         {DATATABLE_REFERENCE_MAX_DEPTH} hops; the chain is likely a loop"
+    )))
+}
+
+/// Every entry of a workspace resolved as [`resolve_governing_datatable`] resolves one, in stored
+/// order, reading the settings rows one pointer hop at a time rather than once per entry. An entry
+/// that does not resolve — malformed, a dangling pointer, a loop — is left out. Same authorization
+/// contract as the single resolution: it checks nothing.
+pub async fn resolve_workspace_governing_datatables(
+    db: &DB,
+    w_id: &str,
+) -> Result<Vec<(String, GoverningDatatable)>> {
+    type Entries =
+        std::collections::HashMap<String, std::collections::HashMap<String, serde_json::Value>>;
+    async fn load(db: &DB, workspaces: &[String], entries: &mut Entries) -> Result<Vec<String>> {
+        let rows: Vec<(String, String, serde_json::Value)> = sqlx::query_as(
+            "SELECT ws.workspace_id, dt.key, dt.value FROM workspace_settings ws
+             CROSS JOIN LATERAL jsonb_each(COALESCE(ws.datatable->'datatables', '{}'::jsonb)) dt
+             WHERE ws.workspace_id = ANY($1)",
+        )
+        .bind(workspaces)
+        .fetch_all(db)
+        .await?;
+        for ws in workspaces {
+            entries.entry(ws.clone()).or_default();
+        }
+        let mut keys = Vec::with_capacity(rows.len());
+        for (ws, key, value) in rows {
+            keys.push(key.clone());
+            entries.entry(ws).or_default().insert(key, value);
+        }
+        Ok(keys)
+    }
+
+    let mut entries = Entries::new();
+    let listed = load(db, &[w_id.to_string()], &mut entries).await?;
+    // (index into `listed`, workspace, entry name, the clone the chain started from) still to be
+    // followed. A clone keeps its own database and takes the `permissions` of wherever its
+    // `governed_by` chain lands, as the single resolution does.
+    type Clone = Option<(String, String, DataTable)>;
+    let mut cursors: Vec<(usize, String, String, Clone)> = listed
+        .iter()
+        .enumerate()
+        .map(|(i, name)| (i, w_id.to_string(), name.clone(), None))
+        .collect();
+    let mut resolved: Vec<(usize, GoverningDatatable)> = vec![];
+
+    for _ in 0..DATATABLE_REFERENCE_MAX_DEPTH {
+        let mut next = vec![];
+        for (i, ws, name, clone) in cursors.drain(..) {
+            let Some(value) = entries
+                .get(&ws)
+                .and_then(|m| m.get(&name))
+                .filter(|v| !v.is_null())
+            else {
+                continue;
+            };
+            let Ok(datatable) = serde_json::from_value::<DataTable>(value.clone()) else {
+                continue;
+            };
+            if validate_datatable_shape(&name, &datatable).is_err() {
+                continue;
+            }
+            match (&datatable.reference, &datatable.governed_by) {
+                (Some(reference), _) => next.push((
+                    i,
+                    reference.workspace_id.clone(),
+                    reference.datatable.clone(),
+                    clone,
+                )),
+                (None, Some(governed_by)) => {
+                    let (governor_ws, governor_name) =
+                        (governed_by.workspace_id.clone(), governed_by.datatable.clone());
+                    let clone = clone.or(Some((ws, name, datatable)));
+                    next.push((i, governor_ws, governor_name, clone));
+                }
+                (None, None) => resolved.push((
+                    i,
+                    match clone {
+                        None => GoverningDatatable {
+                            workspace_id: ws,
+                            name,
+                            datatable,
+                            governor: None,
+                        },
+                        Some((clone_ws, clone_name, mut clone_datatable)) => {
+                            clone_datatable.permissions = datatable.permissions;
+                            GoverningDatatable {
+                                workspace_id: clone_ws,
+                                name: clone_name,
+                                datatable: clone_datatable,
+                                governor: Some(DataTableReference {
+                                    workspace_id: ws,
+                                    datatable: name,
+                                }),
+                            }
+                        }
+                    },
+                )),
+            }
+        }
+        if next.is_empty() {
+            break;
+        }
+        let to_load: Vec<String> = next
+            .iter()
+            .map(|(_, ws, _, _)| ws.clone())
+            .filter(|ws| !entries.contains_key(ws))
+            .collect::<std::collections::BTreeSet<_>>()
+            .into_iter()
+            .collect();
+        if !to_load.is_empty() {
+            load(db, &to_load, &mut entries).await?;
+        }
+        cursors = next;
+    }
+
+    resolved.sort_by_key(|(i, _)| *i);
+    Ok(resolved
+        .into_iter()
+        .map(|(i, governing)| (listed[i].clone(), governing))
+        .collect())
+}
+
+/// Build the `admin` connection for a governing entry: `custom_instance_user` for an instance
+/// database, the user's own resource for a BYO-postgres one.
+async fn resolve_datatable_connection_unchecked(
+    db: &DB,
+    governing: &GoverningDatatable,
+    replication: bool,
+) -> Result<serde_json::Value> {
+    let database = governing
+        .datatable
+        .database
+        .as_ref()
+        .expect("a governing entry owns a database");
+    if database.resource_type == DataTableCatalogResourceType::Instance {
         let mut pg_creds = PgDatabase::parse_uri(&get_database_url().await?.as_str().await)?;
-        pg_creds.dbname = datatable.database.resource_path.clone();
+        pg_creds.dbname = database.resource_path.clone();
         if replication {
             pg_creds.user = Some("custom_instance_replication_user".to_string());
             pg_creds.password = Some(get_custom_pg_instance_replication_password(&db).await?);
         } else {
-            pg_creds.user = Some("custom_instance_user".to_string());
+            pg_creds.user = Some(CUSTOM_INSTANCE_USER.to_string());
             pg_creds.password = Some(get_custom_pg_instance_password(&db).await?);
         }
         serde_json::to_value(&pg_creds)
-            .map_err(|e| Error::internal_err(format!("Error serializing pg creds: {}", e)))?
+            .map_err(|e| Error::internal_err(format!("Error serializing pg creds: {}", e)))
     } else {
         // Name the data table too: the caller asked for one by name, and a bare
         // "resource f/x/y does not exist" leaves them to work out which one points at it.
         transform_json_unchecked(
-            &serde_json::Value::String(format!("$res:{}", datatable.database.resource_path)),
-            w_id,
+            &serde_json::Value::String(format!("$res:{}", database.resource_path)),
+            &governing.workspace_id,
             db,
         )
         .await
         .map_err(|e| match e {
-            Error::NotFound(m) => Error::NotFound(format!("data table {name}: {m}")),
+            Error::NotFound(m) => Error::NotFound(format!("data table {}: {m}", governing.name)),
             e => e,
-        })?
+        })
+    }
+}
+
+/// Resolve a data table to connection credentials **without authorizing anything**: always the
+/// `admin` connection.
+///
+/// Authorization: callers MUST have authorized access already. Anything that acts for a user or a
+/// job wants [`get_datatable_resource_from_db`] instead.
+pub async fn get_datatable_resource_from_db_unchecked(
+    db: &DB,
+    w_id: &str,
+    name: &str,
+) -> Result<serde_json::Value> {
+    let governing = resolve_governing_datatable(db, w_id, name).await?;
+    resolve_datatable_connection_unchecked(db, &governing, false).await
+}
+
+/// Same as [`get_datatable_resource_from_db_unchecked`] but for postgres trigger
+/// connections: custom-instance datatables resolve to
+/// `custom_instance_replication_user` rather than `custom_instance_user`. BYO-postgres
+/// datatables resolve to the user's own resource unchanged; configuring it for
+/// replication there is the user's responsibility.
+///
+/// Authorization: a replication connection reads every row whatever the roles grant, so no role or
+/// admin check makes it safe. Callers MUST refuse a data table under roles outright — the Postgres
+/// trigger crate's `ensure_not_under_roles` — and turning roles on is refused while one streams.
+pub async fn get_datatable_replication_resource_from_db_unchecked(
+    db: &DB,
+    w_id: &str,
+    name: &str,
+) -> Result<serde_json::Value> {
+    let governing = resolve_governing_datatable(db, w_id, name).await?;
+    resolve_datatable_connection_unchecked(db, &governing, true).await
+}
+
+/// The identity a resolution is made for. `Unchecked` is for callers that authorized already;
+/// everything else is checked against the governing entry's tenants.
+pub enum DatatableAccess<'a> {
+    /// Reaches every role. For callers that already authorized, or that have no user at all.
+    Unchecked,
+    Authed(crate::db::AuthedRef<'a>),
+    /// A job's owner, without reading the job row — only fetched if the data table turns out to
+    /// be permissioned.
+    PermissionedAs {
+        permissioned_as: &'a str,
+        email: &'a str,
+    },
+    /// A job identified by id; its owner is read from `v2_job`. For agent workers and anything
+    /// else that authenticates as infrastructure rather than as the job's user.
+    Job(uuid::Uuid),
+    /// No identity established. Unpermissioned data tables resolve as before; permissioned ones
+    /// are refused, so a caller predating this feature fails closed.
+    NoIdentity,
+}
+
+/// Does one tenant list cover this identity? Admins of the governing workspace pass everything —
+/// they can edit the tenant lists anyway, so refusing them would only be theatre.
+pub fn can_use_datatable_role(
+    tenants: &DataTableRoleTenants,
+    authed: &crate::db::AuthedRef<'_>,
+) -> bool {
+    crate::datatable_roles_oss::can_use_datatable_role(tenants, authed)
+}
+
+/// Evaluate a tenant list **as a member of the governing workspace**, whoever is calling.
+///
+/// A caller reaching a data table through a pointer is a member of some other workspace, and being
+/// its admin means nothing here — that is the whole point of the pointer. They are looked up in
+/// the governing workspace by email and evaluated there, or refused when they are not a member.
+/// A `g/` or `f/` permissioned-as from a foreign workspace is refused outright: those names are
+/// defined per workspace and mean nothing outside the one that defined them.
+pub async fn can_use_datatable_role_in_governing_workspace(
+    db: &DB,
+    governing_w_id: &str,
+    w_id: &str,
+    tenants: &DataTableRoleTenants,
+    access: &DatatableAccess<'_>,
+) -> Result<bool> {
+    crate::datatable_roles_oss::can_use_datatable_role_in_governing_workspace(
+        db,
+        governing_w_id,
+        w_id,
+        tenants,
+        access,
+    )
+    .await
+}
+
+/// Resolve a data table to connection credentials for one identity.
+///
+/// This is the chokepoint: everything that opens a connection to a data table on someone's behalf
+/// goes through it. `role` is the role name the caller asked for — the `-- role` annotation, the
+/// `?role=` on a `datatable://` reference, or `None` for the data table's default.
+///
+/// The resolved role **logs in as itself**. Never `SET ROLE`: a script could `RESET ROLE` its way
+/// back to admin.
+pub async fn get_datatable_resource_from_db(
+    db: &DB,
+    w_id: &str,
+    name: &str,
+    role: Option<&str>,
+    access: DatatableAccess<'_>,
+) -> Result<serde_json::Value> {
+    let governing = resolve_governing_datatable(db, w_id, name).await?;
+    let db_resource = resolve_datatable_connection_unchecked(db, &governing, false).await?;
+    // Not under roles and asked for none, or for `admin` by name: the `admin` connection, as before
+    // roles existed, in every edition. Anything else is a role decision. Every migration names
+    // `admin` explicitly, so an edition without roles must not treat that as one.
+    if governing.datatable.permissions.is_none() && role.is_none_or(|r| r == ADMIN_DATATABLE_ROLE) {
+        return Ok(db_resource);
+    }
+    crate::datatable_roles_oss::resolve_datatable_role_connection(
+        db,
+        w_id,
+        name,
+        &governing,
+        db_resource,
+        role,
+        access,
+    )
+    .await
+}
+
+/// Would the chokepoint accept this identity connecting as this role? Answers without resolving
+/// credentials, for callers that want to refuse early and say which thing was refused.
+///
+/// Not the security boundary — [`get_datatable_resource_from_db`] re-checks when it actually opens
+/// the connection. This is what turns "permission denied for table x" into a message naming the
+/// migration and the role.
+pub async fn ensure_can_use_datatable_role(
+    db: &DB,
+    w_id: &str,
+    name: &str,
+    role: Option<&str>,
+    access: &DatatableAccess<'_>,
+    context: &str,
+) -> Result<()> {
+    crate::datatable_roles_oss::ensure_can_use_datatable_role(db, w_id, name, role, access, context)
+        .await
+}
+
+/// Gate the operations that see the whole database whatever the roles grant: a migration that
+/// declares no role, exports, and editing the permissions themselves. Not replication, which a
+/// data table under roles refuses whoever asks (see `ensure_not_under_roles`). Passing
+/// means the caller could have connected as `admin` anyway.
+pub async fn ensure_datatable_admin_access(
+    db: &DB,
+    w_id: &str,
+    name: &str,
+    access: &DatatableAccess<'_>,
+) -> Result<()> {
+    crate::datatable_roles_oss::ensure_datatable_admin_access(db, w_id, name, access).await
+}
+
+/// Rewrite the `permissions` of every data table entry of one workspace, in the caller's
+/// transaction. `change` reports whether it touched anything; the row is only written when
+/// something did.
+///
+/// Authorization: writes an access decision for any workspace named, with an arbitrary mutation,
+/// and checks nothing. It exists for the cascades below — the transaction that frees or renames a
+/// principal — so callers MUST be the operation that made the principal change, and MUST run in
+/// its transaction. Anything editing a decision on purpose belongs in the permissions endpoint,
+/// which is gated on the workspace that governs the data table.
+///
+/// The tenant lists name principals of this workspace, so anything that frees or renames one has
+/// to come through here in the same transaction that frees it — otherwise a `u/alice` reused by a
+/// later account silently inherits her access.
+pub async fn update_datatable_permissions_in_workspace<F>(
+    tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
+    w_id: &str,
+    change: F,
+) -> Result<()>
+where
+    F: Fn(&mut DataTablePermissions) -> bool,
+{
+    let Some(mut settings) = sqlx::query_scalar!(
+        "SELECT datatable FROM workspace_settings WHERE workspace_id = $1 FOR UPDATE",
+        w_id
+    )
+    .fetch_optional(&mut **tx)
+    .await?
+    .flatten() else {
+        return Ok(());
     };
 
-    Ok(db_resource)
+    let Some(datatables) = settings
+        .get_mut("datatables")
+        .and_then(|d| d.as_object_mut())
+    else {
+        return Ok(());
+    };
+
+    let mut touched = false;
+    for entry in datatables.values_mut() {
+        let Some(permissions) = entry.get("permissions").filter(|p| !p.is_null()) else {
+            continue;
+        };
+        let Ok(mut permissions) =
+            serde_json::from_value::<DataTablePermissions>(permissions.clone())
+        else {
+            continue;
+        };
+        if change(&mut permissions) {
+            entry["permissions"] = serde_json::to_value(&permissions)
+                .map_err(|e| Error::internal_err(format!("serializing permissions: {e}")))?;
+            touched = true;
+        }
+    }
+
+    if touched {
+        sqlx::query!(
+            "UPDATE workspace_settings SET datatable = $1 WHERE workspace_id = $2",
+            settings,
+            w_id
+        )
+        .execute(&mut **tx)
+        .await?;
+    }
+    Ok(())
+}
+
+/// Drop a freed principal (`u/alice`, `g/analysts`, `f/finance`) from every tenant list of one
+/// workspace. Same contract as [`update_datatable_permissions_in_workspace`]: for the transaction
+/// that frees the principal, not for editing a decision.
+pub async fn remove_datatable_tenant_in_workspace(
+    tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
+    w_id: &str,
+    tenant: &str,
+) -> Result<()> {
+    update_datatable_permissions_in_workspace(tx, w_id, |permissions| {
+        let mut touched = false;
+        for role in permissions.roles.values_mut() {
+            let before = role.tenants.len();
+            role.tenants.retain(|t| t != tenant);
+            touched |= role.tenants.len() != before;
+        }
+        touched
+    })
+    .await
+}
+
+/// Follow a renamed principal through every tenant list of one workspace. Same contract as
+/// [`update_datatable_permissions_in_workspace`].
+pub async fn rename_datatable_tenant_in_workspace(
+    tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
+    w_id: &str,
+    old: &str,
+    new: &str,
+) -> Result<()> {
+    update_datatable_permissions_in_workspace(tx, w_id, |permissions| {
+        let mut touched = false;
+        for role in permissions.roles.values_mut() {
+            let mut role_touched = false;
+            for tenant in role.tenants.iter_mut() {
+                if tenant == old {
+                    *tenant = new.to_string();
+                    role_touched = true;
+                }
+            }
+            if role_touched {
+                // The rename can collide with a name already in the list, and the two need not be
+                // adjacent — `Vec::dedup` only collapses neighbours, so it would leave the pair.
+                let mut seen = std::collections::HashSet::new();
+                role.tenants.retain(|t| seen.insert(t.clone()));
+                touched = true;
+            }
+        }
+        touched
+    })
+    .await
+}
+
+/// Strip a deleted instance role from every workspace that had tenanted it, so nothing is left
+/// naming a role that no longer exists.
+///
+/// Authorization: reaches every workspace on the instance. Callers MUST be the superadmin path
+/// dropping the role from the cluster — it exists to follow that, not to edit tenants.
+///
+/// Takes that path's transaction rather than opening its own: run afterwards, a failure part-way
+/// leaves the catalog row already gone, so the retry answers `NotFound` while some workspaces
+/// still name a role nothing can connect as. In the transaction, the cluster drop, the catalog row
+/// and every tenant list commit together or not at all. A data table whose default role was the deleted one falls
+/// back to `admin` — the one role that is always present.
+pub async fn forget_datatable_role_everywhere(
+    tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
+    role_id: &str,
+) -> Result<()> {
+    crate::datatable_roles_oss::forget_datatable_role_everywhere(tx, role_id).await
+}
+
+/// Drop the `permissions` block from a `workspace_settings.datatable` value before it leaves the
+/// server.
+///
+/// Who may connect as which role is an access decision, not configuration, and its tenants name
+/// principals of one workspace — `g/analysts` in dev is a different group from `g/analysts` in
+/// prod. Shipping it would both mean nothing at the far end and turn a settings push into a way to
+/// widen access, so the decision stays where it was made. [`DataTable`] deserializes fine without
+/// it, and the settings-editing endpoint carries the stored block across untouched.
+pub fn strip_datatable_permissions(
+    datatable: Option<serde_json::Value>,
+) -> Option<serde_json::Value> {
+    let mut datatable = datatable?;
+    if let Some(entries) = datatable
+        .get_mut("datatables")
+        .and_then(|d| d.as_object_mut())
+    {
+        for entry in entries.values_mut() {
+            if let Some(entry) = entry.as_object_mut() {
+                entry.remove("permissions");
+            }
+        }
+    }
+    Some(datatable)
+}
+
+/// As [`parse_datatable_ref`], except that an entry whose stored name itself contains `?` — which
+/// names could before they were restricted — resolves by that exact name, without a role. It is
+/// looked up first, so `sales?role=x` never reaches a different entry than the one stored so.
+/// When `sales` is stored too, the reference means either one, and is refused rather than
+/// resolved to whichever is looked up first.
+///
+/// Authorization: checks nothing, and its answer reveals whether `w_id` stores that exact name.
+/// Callers MUST already act for `w_id` — a job of it, or a caller authenticated into it — and
+/// MUST still pass the name to [`get_datatable_resource_from_db`] or an admin-access check.
+pub async fn parse_datatable_ref_for(
+    db: &DB,
+    w_id: &str,
+    reference: &str,
+) -> Result<(String, Option<String>)> {
+    if reference.contains('?') {
+        let role_target = parse_datatable_ref(reference)
+            .ok()
+            .and_then(|(name, role)| role.map(|_| name));
+        let (exists, target_exists) = sqlx::query_as::<_, (Option<bool>, Option<bool>)>(
+            "SELECT (datatable->'datatables') ? $2, (datatable->'datatables') ? $3
+             FROM workspace_settings WHERE workspace_id = $1",
+        )
+        .bind(w_id)
+        .bind(reference)
+        .bind(role_target)
+        .fetch_optional(db)
+        .await?
+        .unwrap_or((None, None));
+        if exists.unwrap_or(false) {
+            if let (Some(name), Some(true)) = (role_target, target_exists) {
+                return Err(Error::BadRequest(format!(
+                    "Data table reference '{reference}' names both the data table '{reference}' \
+                     and a role on the data table '{name}'. Rename '{reference}' to use either."
+                )));
+            }
+            return Ok((reference.to_string(), None));
+        }
+    }
+    let (name, role) = parse_datatable_ref(reference)?;
+    Ok((name.to_string(), role.map(str::to_string)))
+}
+
+/// Split a `datatable://` reference into its name and the role its query string names.
+///
+/// A query string that does not parse is an error rather than an absent role. Falling back would
+/// resolve the reference to the data table's default role, so `?Role=analytics` or a mistyped
+/// `?role=` would quietly connect as something the caller did not ask for — the same trap as a
+/// malformed `-- role` annotation, and `role` is the only parameter a reference takes.
+pub fn parse_datatable_ref(reference: &str) -> Result<(&str, Option<&str>)> {
+    let (name, query) = reference.split_once('?').unwrap_or((reference, ""));
+    let mut role = None;
+    for param in query.split('&').filter(|p| !p.is_empty()) {
+        let (key, value) = param.split_once('=').unwrap_or((param, ""));
+        if !key.eq_ignore_ascii_case("role") {
+            return Err(Error::BadRequest(format!(
+                "Data table reference '{name}' carries an unknown parameter '{key}'. \
+                 The only one it takes is `?role=<name>`."
+            )));
+        }
+        if role.is_some() {
+            return Err(Error::BadRequest(format!(
+                "Data table reference '{name}' names a role more than once."
+            )));
+        }
+        if value.is_empty() || !is_datatable_role_name(value) {
+            return Err(Error::BadRequest(format!(
+                "Data table reference '{name}' has a malformed role '{value}'. Write it as \
+                 `?role=<name>`, where <name> is letters, digits, '_' or '-'."
+            )));
+        }
+        role = Some(value);
+    }
+    Ok((name, role))
+}
+
+fn is_datatable_role_name(role: &str) -> bool {
+    !role.is_empty()
+        && role.len() <= 63
+        && role
+            .chars()
+            .all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-')
 }
 
 #[derive(Deserialize, Serialize, Debug)]
@@ -2642,6 +3340,131 @@ async fn transform_json_unchecked(
 mod tests {
     use super::*;
 
+    fn tenants(list: &[&str]) -> DataTableRoleTenants {
+        DataTableRoleTenants { tenants: list.iter().map(|t| t.to_string()).collect() }
+    }
+
+    #[cfg(all(feature = "private", feature = "enterprise"))]
+    #[test]
+    fn a_tenant_list_covers_users_groups_folders_and_the_wildcard() {
+        let groups = vec!["analysts".to_string()];
+        let folders = vec![("finance".to_string(), true, false)];
+        let scopes = None;
+        let token_prefix = None;
+        let is_admin = false;
+        let is_operator = false;
+        let authed = crate::db::AuthedRef {
+            email: "alice@windmill.dev",
+            username: "alice",
+            is_admin: &is_admin,
+            is_operator: &is_operator,
+            groups: &groups,
+            folders: &folders,
+            scopes: &scopes,
+            token_prefix: &token_prefix,
+        };
+
+        assert!(can_use_datatable_role(&tenants(&["u/alice"]), &authed));
+        assert!(can_use_datatable_role(&tenants(&["g/analysts"]), &authed));
+        assert!(can_use_datatable_role(&tenants(&["f/finance"]), &authed));
+        assert!(can_use_datatable_role(&tenants(&["*"]), &authed));
+        assert!(!can_use_datatable_role(&tenants(&[]), &authed));
+        assert!(!can_use_datatable_role(
+            &tenants(&["u/bob", "g/ops"]),
+            &authed
+        ));
+        // A bare name is not a principal: only the three prefixes and the wildcard match.
+        assert!(!can_use_datatable_role(&tenants(&["alice"]), &authed));
+
+        // An admin of the governing workspace reaches every role: they can edit the lists anyway.
+        let is_admin = true;
+        let admin = crate::db::AuthedRef { is_admin: &is_admin, ..authed };
+        assert!(can_use_datatable_role(&tenants(&[]), &admin));
+    }
+
+    #[cfg(not(all(feature = "private", feature = "enterprise")))]
+    #[test]
+    fn without_the_enterprise_edition_no_tenant_list_covers_anyone() {
+        let groups = vec![];
+        let folders = vec![];
+        let scopes = None;
+        let token_prefix = None;
+        let is_admin = true;
+        let is_operator = false;
+        let admin = crate::db::AuthedRef {
+            email: "alice@windmill.dev",
+            username: "alice",
+            is_admin: &is_admin,
+            is_operator: &is_operator,
+            groups: &groups,
+            folders: &folders,
+            scopes: &scopes,
+            token_prefix: &token_prefix,
+        };
+        assert!(!can_use_datatable_role(&tenants(&["*"]), &admin));
+        assert!(!can_use_datatable_role(&tenants(&["u/alice"]), &admin));
+    }
+
+    #[test]
+    fn a_datatable_ref_splits_off_its_role() {
+        assert_eq!(parse_datatable_ref("sales").unwrap(), ("sales", None));
+        assert_eq!(
+            parse_datatable_ref("sales?role=analytics").unwrap(),
+            ("sales", Some("analytics"))
+        );
+        // The key matches case-insensitively, the way the `-- role` annotation does.
+        assert_eq!(
+            parse_datatable_ref("sales?Role=analytics").unwrap(),
+            ("sales", Some("analytics"))
+        );
+
+        // A query string that does not parse is refused rather than read as "no role": resolving
+        // it to the data table's default would connect as a login the caller never asked for.
+        for malformed in [
+            "sales?role=",
+            "sales?role=an;alytics",
+            "sales?x=1&role=analytics",
+            "sales?role=a&role=b",
+        ] {
+            assert!(
+                parse_datatable_ref(malformed).is_err(),
+                "silently ignored: {malformed}"
+            );
+        }
+    }
+
+    #[test]
+    fn an_entry_owns_a_database_or_points_at_one_but_never_both() {
+        let terminal = DataTable {
+            database: Some(DataTableDatabase {
+                resource_type: DataTableCatalogResourceType::Instance,
+                resource_path: "dt_main".to_string(),
+            }),
+            reference: None,
+            governed_by: None,
+            forked_from: None,
+            migrations_enabled: None,
+            permissions: None,
+        };
+        assert!(validate_datatable_shape("main", &terminal).is_ok());
+
+        let pointer = DataTable {
+            database: None,
+            reference: Some(DataTableReference {
+                workspace_id: "prod".to_string(),
+                datatable: "main".to_string(),
+            }),
+            ..terminal.clone()
+        };
+        assert!(validate_datatable_shape("main", &pointer).is_ok());
+
+        let both = DataTable { database: terminal.database.clone(), ..pointer.clone() };
+        assert!(validate_datatable_shape("main", &both).is_err());
+
+        let neither = DataTable { database: None, reference: None, ..terminal.clone() };
+        assert!(validate_datatable_shape("main", &neither).is_err());
+    }
+
     #[test]
     fn test_parse_fork_branch() {
         // Generated fork (`wm-fork-abc`) and dev workspace (`staging`) forms.
diff --git a/backend/windmill-common/tests/fixtures/guest_jwt_rsa8192_private.pem b/backend/windmill-common/tests/fixtures/guest_jwt_rsa8192_private.pem
new file mode 100644
index 0000000000..bb443cf6bf
--- /dev/null
+++ b/backend/windmill-common/tests/fixtures/guest_jwt_rsa8192_private.pem
@@ -0,0 +1,100 @@
+-----BEGIN PRIVATE KEY-----
+MIISQgIBADANBgkqhkiG9w0BAQEFAASCEiwwghIoAgEAAoIEAQC6deMC6KWwkWV2
+9xb4bXLt6ceNGQD3gJH3sYqpulWsZB0L3TdqXwnzL3C/8Uf3K8hLZ4Tw+llHCxaS
+Z7aTEYyeLDJuYuJPVS8DAgVnXDluoDg7B1UtvoUa1/MjLQm4f/Qp322i7l0SH9kx
+NRb7UZp/xx1tL/kiq9NIv1inK4ZC0DbleybBOoLlwP9Zqhazw3MJdZAyey4FAXTx
+bZcjG3UtiZ2COXVP1qdtqhLrQQQsicoLqZuxAfXdIU6xgcYgGapVQNTVbo7w8pHn
++6RzlPb9rqyBs2IiKLFSb467mtZeM9dfbyD4DICy42O/JKAbTZw/f3trbs+tu+sK
+rj7ysk+lGzuXj2/irOuvOSbzpxERdZuDyLOhlMej5+aJXkrmVhVPf/3wt/6oKCzo
+7Ta24OvGaz6pxK1iDOQvzkCqJpaTjSfpcscHyU3ztXCUINtsq7s78XoOxJZkerfq
+LDxuutYviFiB9pQDzYdErL8XMUkRXXY22hpnLHt8GV+lNCJs2KxcECzkgwfjIn9X
+Y66U4iO+k9EvY/FHyI25ur0eKWDnJAPL6PypVhx9NOuBkot6nwUugzWzM/MKJ9Hf
+1n9pwVNlMam8zgMQ5Ivu3+RiOV3P0iuAaw7d1sZRSSX11l/EyjGFDpwmnFNjleEK
+vnop6rCftWAsd2XJHXiD1/80QIgKJHdflpHOcy6Su5w/CRYc/jC2rJjUr9W+hBwg
+fnayip8MTMa4cAXzbFmSc5NCzSsqHkVq/4RdfdMephubGmWcPDQnkUf/n/RvoZNi
+VktW34lX3YIe97600vSWPfWahj/EUnfI8m+4Qzuz2o6N9basCNftKPDIc5ej3PMS
+RVIgBhEXUh1wVFdEUs8RKHg/QV0xrN2qbKcS8XvV3fFfLuFZo4a66nZ5zgGGJUgL
+ED41cEqf/sQObfhGgIw25v/315ARiv9thRF3tUMLGQZNQ8tSs2VMuU6szBQciplx
+y2y4JzXdv+G0PvheE7tVdsGsMipSHTZDdNZo51MOBSgsNTyNmWMZlsfoZTTZ2o2y
+XtKv8xUP01KnlwR6Z8hY1CAPxM1QKDU5nKp9T/df6GEhohps9gSt6cs6SHlH8piq
+pyR0xiDvS+vcPN/IbOaRgE9WmfM5py72SNZbetiUHdUTmAC1dd0IH3opte1uVpQQ
+sauKVWZuzV8Bcd2O06QFOVJDwoxm00YaF0rqhaisppah5eQMN/ctlqWVDHXR8laV
+CNkzWYE/jxAU9dGuCMCIZ7BSs5U9mZ7pWstagXWEFTI9IugjvNnaZDijZQJSPmAZ
+gQtAxH/z8R9e/PihW9dDQc/nKBC9Lpta3oFGq74fc7Y+Wu/Uskjf8qtFOOVrvfZx
+kwlRR0s5AgMBAAECggQAEEeerHBXlxT6wOpN7R7RPAh/TchzFyj4laHAs5T7SfPr
+vU9xOS5XFg58T6XnXKNL95lwOAIDrXpAXEQF4s1Tc7P0K0Mi8z5CvoZ8pkudEBWZ
+Ez5Op5HM2U0lg1q5UIyLauSBFAqvwZdaRTuXaBX14VYnMZNQs0BBUEa0nNPmAwte
+36Zi+df7+cdiBBgfp05XSuoizuWGXRWFelbRLVWGY5VyVR5jKbdaIu8Ie9XPYXwe
+UepbF5dOOiJgVos4GzFid9MTQhdHD65+Ir0L3LOS5Q9NLH3XAZh/8uyej66zLMJl
++YUgYcflrLjByryN5hReogSlZ/ni1A5mNSaFhHchEQ9Roqf5YtcqNMBOsFNT4Cxe
+iaEKXf85dwwWSsQa0gWOEsTgDRZje5cWZLfhYRI+Q7K1Y+kyIi9x9OKTLsfzuapH
+Y9CLpBhlX/Plgmlj/xb3YAJzX7q2TsuQJzf5hsl1Te0fnSlEPxjAyLQ0cvfwoz1/
+xsZAK+XsWid0/F2S6+H3GoqnAMSX+bLXX2/qnEEqUcdiKjsVo+jUxvSQ8oM2XLf+
+RN1wwfAsyJnIPiXnW6tqrmbyV1Uf0TEs19hIg5lHiLxPT5bFGcJ6nT6bGCBeGnkF
+J08xmxjXc91pHQ+8iNgGftGJvK1FcppxbZi33dUJ2sfhP8Ck+GxES26eb5d6yTfD
+oZRQmESvikHPU5shm+YbjPrYhEbEgLZKO3wUhCAvoFLN2TG0i2v//aaCSI/XfNWt
+1XyE+uN/o6kQEPvaUy/0uHBuzoC4pZ8or22ywmeftCOHuT9YE9LIJuU81qMJvjP7
+BJ6YkcTO6G89iD0g6HHYRiD9I+pgih8B1NPq4VmFuJrvaqgAX9srmmMt7FXBrcqa
+JSyLS+WeHTLlOiHN1DqOgpgq0gq6vC1i53xPqSUkFzAKpDOWgGNMVAABFN9EOVmM
+zvPnJThz5PHDAuud9eaLjZ0V76IVXmRTz22warkdKhBW5BzDzy+zNp8mF5SMH9mZ
++JQvCGTc2itiKGKMDzvY99pBzHRlrlFL7n5SHLqxclBfnEJcU9wPvFyZ+6k8MGim
+0kFrK63NqiceNWp5vdU/6V+boCYoFG8PDbABUxCbb+lhtnYx5AUcKfKX74Uv4gpX
+AM0gsaY8U+4ATJbgoCTqplTKvXtyw4zcpJAXCMnhygKyDKNOk+Lckfquwx9r/TQN
+hbbjjvwgBkzJtAlylCVYYEJ/03lazRpGR5osCksECxNU4TMDRD2Hd+zwUxdeRunm
+7EusRSrKq8swi8LFyV7E8ISwwXegqVarHqXjCHhcn/5Ozw6PkVk39Ug2UE4ibesC
+MzVP3lfP67gXgGCzYrImIUuqHGTyLFs8/B8+2OmdyQKCAgEA6PCozdeeQS0P/+ah
+E015KECxB0aGbrvdpczXX5szHYb8KhejvHmVV2OLFisL7GyMeBhEZXAeKtMZwd66
+FMORgdFACpckR/a/aVEnebHx5fOKtAQfhLLH/3YE5dFIWxu9SKNZBrX0lIBFXfoK
+lZYM7cGm7vN55AK99bYfCAqFs+HI9sDQLjbaxR41UOfZwPjA9VjBQ1vBr0N3UoOT
+xf8Rw6hlAd+ED7iJavn6KUb64D5eB4eGSZNXM5HCp2ZtUFN/4bU5lbHPCSK29+Wd
+mM5flZtIKQ7PzGyXqv4Kbtz9o1hPOQPeH0faDEcYJLHV/LAxHc1AkqJDXU8HANhI
+m/XI44RlJesNntOdJuCumHtTAsreWAYoydXurOWHkDIpx6OLi0F3eJrOV6dhwCCG
+v3bX4PIBjYZKyfHukcoCzGetXpu5bDKC1uwwZLJmF/QTO3AeVpWNrbWkBfj/PCio
+8RodjVlPkDaoCrDmpca22fNo+93IM2m1SWdSnTlXvgg58cLUrlMUbg24Lo1cyySF
+1AnRw0uvaFLdH8iMtKZIA3zgCZyUKV1DcGUKsdcL/9IYD6EO5bCcA6p5gcxxBOan
+6MEHIuJKycmZMGutN5rm3uDHQgmNCs25ma3fWQF0s/dRJ2lg947qKUKevqBkd4gt
+BuB8VXUGsHXGDWHfz/eLjWYA3k8CggIBAMzrTqnmT27U1SXPwEXI0kc6A44D8skD
+a4rqxOMBTGvu+HeVdEBMcxYnGeJV2QtZY96KXwadiWuqdEr4Pc7JWnAa2f9yWNCb
+QI0YJSWSNcDuPsSV1K15MM7uxKk/oNcXdbjrAfVLzCmEYDg085QV80rl7Q6WRaYv
+acvipeZY82LuGhtAJAN6S8VWmDqZ5vBDd61F09AlBrpIFoSBRnYVkEwaXXwFJauz
+S+kEmCIb97tBf7nr08ldoNvDdecRtm+s9odfUhm+ONroZf7OEyTCOXB666oDogpI
+hktuliNUVpXeZ5QtkzpxP2SBbHNWZ9LiAGpTv2wa7z7k1PqCVR6ABGMkTkge41iy
++v82KYi4qRnUfVlFcn9xLyBDaaCWJYrsux8OmAW48cVN1Og0tKu/T+bFUvHs0etZ
+oijYoYZaf9ERO0X0tuMXKIuT0QcPnkcT+KXFY6uzOC1UmF5ITCeKogGwzkFbvInA
+w8OiFYBkgXZ41tE/oOARm1AhuaNc/ZfWujLECjuJgvw0uhdUyihGw8ZJv91WiIjX
+Jqq1BNrhvDQqTPSnDvhcBBDGdQA6HJRGAerIx7PgCKzS2WbrfmsFzjfZ3zbrUSNf
+e8CM37aDzte25g7HmvFuwOLmE9DXNnE+cWGpb/S1l4ACahnqKF9zj3uKVpN1kG+l
+xFH+ADFgNCP3AoICAQDW+fuf9QVdezwP3IX9bXuKVaHLaB/7JDBbqt99oZsb/g7M
+vgJjmAXmn7ymGdYoPMmqsCK3RzDgLvDPhkFPlmm8WCR1YaWfMK7YgIgg/MOViB0T
+I9b+vYxsTDwa6PmQ89nNpssrsVNmlbbvEysfgFqwNg9c6aEteAZeNNUQs71PFOpG
+KA45CHEAiG+GGmNRf4F9LIs4If9vQ6Fkqn//s/ZuDwQhJWoYpCNWchuYaqRvvb9D
+zaR2VJ+evT/bBGGQR293G6xoZa//62TXBbdbZeK7DJMdKUlHjVSv/0IbrKH8VSzQ
+HqypS8OFnzs96k3lpam+qkWUzmHDRILfGbxxCvV6XB6JTxPD5+JaFfOsT+x9YEKx
+FAYit+hM8owY3OLIFzxaqXGcAaq7JIPHL32MSB7VwCMEvNJa64dUTw4kHO7YqHkI
+zNkJhvLmi+pC4wO40DF/kQgvL7qPtIvBtnisAoERiUIvgvG05CwJBIqOPOE/yR/R
+qxYfB1csONasT6VCZJ+pvozVQJ4hgF8KL8u+s80+IqRgcFEY2xpYQjml1mJhHHt0
+bVkm6mljVWcCkp+YFPjNrB9gFr2Kt+X6MvD1kueGHzgMYJybHlS/Q5scSHA8ltnv
+BYvrs5az6u8MhAwGhm9yKRgcOhqNLTNrSWbcuOKmb5lb02WTxicrJHdLaL8WawKC
+AgAvXHdK51MWj5RP7+tFdbu8AJmPujPj56l0avxkZwltrMa6hM1giwrSZOkjmanX
+aKqfZaW+1qxLORM1vJg0ce84F8yosJn8ZNWPhrQXMerAk4/oSaTlDyyLtz22zGD1
+NZPc0FwcgI9ITTMb6okdgdFAT1Hx3CNu3Gh8Wf7z9T0TcWqRP8rTDvHyQyhd6vIo
+N7+ySYBCDDy40y55I5PQeP1nyXQv1NS3EXKLAafTwlkIa4QEyY+ia8Rg5pUaecqL
+lxNHiG1mS8PCPJJOSPy9szIpYA+VtM8/xzFav81tjvGQI94Wrk3n5QK8zPju01qd
+r+RersqARt1i0Oq0l2jq6rWY4GxDWPg8qOlAERmaYuuab7Uk69shv1wf/dSs6+bz
+a/F3pRzXvb4LVwjNPlk/lLD36kVYat69oXLMM/1pGwONo4jqizu10sVpNRnLov12
++hOu5Kc7qOlj+LhamiUXwn/dGishif1SbT4RuiV0DkapxhYIOMeK4ibeZ10Ld9OY
+w2U3lH208vxWJC2adNtgYbKf4q24j2ZxEiD6tWnQ2PlxqREuPmpEVqgN5IBoNAYk
+8uVAiXU2iqIWp4jds7H9NFNML0va2ppfLZNhlm2iNmaZDsmvQsz53howlvKfgw4v
+MDpuUwXwLgQ87tHs+WSpYwEXkYqe/D4Mv+hW9vi+cLi8UwKCAgAsehP6DOrt9bA3
+pVdtHJG1a9fm/rXC9TQS2oSE2paXRZpxhbk917Gdl2njo7tnoGXXBpQOb51/HUXX
+QTARdp2LP1VFn9RJP3CwaK+Sxs1IBa9r1/p2ePDR85QR1HxN+Gj98EcEfKl1RSe6
+RmLOkLIg4pkNrDhwWyYJ1H5//d/yUQlZ015fQAKaHCdaoz7L3+0jOyFXDGrDr+Gc
+680SyVqPfRx5dAm8TrfyXW6Q2uZEhIqxbcxTdG98Pxi0qLLAS/nD16IHC1iljHsI
+QrfUvFvGg5v7kxeXrP0VPMRM0/Y8vno3Bbi04I0Pk3Wko8UhWuiUMjs+TVbEPKox
+8zG/G+R5EpHKDxNyfUUwZ9+lyjFmBZOcVd3dze23VQYCzV/W04yiQdEl2C/sED2m
+NycJ3GN/ByqpJJZY3u+B/WAiHPLe1ivIEeIjwdBt2w/3L/rKoRBR/P8LSRXLIIh4
+Xk1BMNygJxHTwsvFGhflx89+1BO/n8HrR0s/2G1QanxGdgso9bwmXMDrmJ+XxrUY
+qBmDCU8RkBdUHKOuJlWWn2JaIswsEE5kAk7MgNNaBTv91VBYCDs50NW8VBaKnJjN
+j+hXI80qKi7WqeoonFKFLDgUYbKnmzKsX+T0x/H99v+7Or5PmAPN+hRwj54/LEVR
+MsjrTlnoCGXKgPQQ5ItWviGjqoCTiQ==
+-----END PRIVATE KEY-----
diff --git a/backend/windmill-common/tests/fixtures/guest_jwt_rsa8192_public.pem b/backend/windmill-common/tests/fixtures/guest_jwt_rsa8192_public.pem
new file mode 100644
index 0000000000..44645f5af2
--- /dev/null
+++ b/backend/windmill-common/tests/fixtures/guest_jwt_rsa8192_public.pem
@@ -0,0 +1,25 @@
+-----BEGIN PUBLIC KEY-----
+MIIEIjANBgkqhkiG9w0BAQEFAAOCBA8AMIIECgKCBAEAunXjAuilsJFldvcW+G1y
+7enHjRkA94CR97GKqbpVrGQdC903al8J8y9wv/FH9yvIS2eE8PpZRwsWkme2kxGM
+niwybmLiT1UvAwIFZ1w5bqA4OwdVLb6FGtfzIy0JuH/0Kd9tou5dEh/ZMTUW+1Ga
+f8cdbS/5IqvTSL9YpyuGQtA25XsmwTqC5cD/WaoWs8NzCXWQMnsuBQF08W2XIxt1
+LYmdgjl1T9anbaoS60EELInKC6mbsQH13SFOsYHGIBmqVUDU1W6O8PKR5/ukc5T2
+/a6sgbNiIiixUm+Ou5rWXjPXX28g+AyAsuNjvySgG02cP397a27PrbvrCq4+8rJP
+pRs7l49v4qzrrzkm86cREXWbg8izoZTHo+fmiV5K5lYVT3/98Lf+qCgs6O02tuDr
+xms+qcStYgzkL85AqiaWk40n6XLHB8lN87VwlCDbbKu7O/F6DsSWZHq36iw8brrW
+L4hYgfaUA82HRKy/FzFJEV12NtoaZyx7fBlfpTQibNisXBAs5IMH4yJ/V2OulOIj
+vpPRL2PxR8iNubq9Hilg5yQDy+j8qVYcfTTrgZKLep8FLoM1szPzCifR39Z/acFT
+ZTGpvM4DEOSL7t/kYjldz9IrgGsO3dbGUUkl9dZfxMoxhQ6cJpxTY5XhCr56Keqw
+n7VgLHdlyR14g9f/NECICiR3X5aRznMukrucPwkWHP4wtqyY1K/VvoQcIH52soqf
+DEzGuHAF82xZknOTQs0rKh5Fav+EXX3THqYbmxplnDw0J5FH/5/0b6GTYlZLVt+J
+V92CHve+tNL0lj31moY/xFJ3yPJvuEM7s9qOjfW2rAjX7SjwyHOXo9zzEkVSIAYR
+F1IdcFRXRFLPESh4P0FdMazdqmynEvF71d3xXy7hWaOGuup2ec4BhiVICxA+NXBK
+n/7EDm34RoCMNub/99eQEYr/bYURd7VDCxkGTUPLUrNlTLlOrMwUHIqZcctsuCc1
+3b/htD74XhO7VXbBrDIqUh02Q3TWaOdTDgUoLDU8jZljGZbH6GU02dqNsl7Sr/MV
+D9NSp5cEemfIWNQgD8TNUCg1OZyqfU/3X+hhIaIabPYErenLOkh5R/KYqqckdMYg
+70vr3DzfyGzmkYBPVpnzOacu9kjWW3rYlB3VE5gAtXXdCB96KbXtblaUELGrilVm
+bs1fAXHdjtOkBTlSQ8KMZtNGGhdK6oWorKaWoeXkDDf3LZallQx10fJWlQjZM1mB
+P48QFPXRrgjAiGewUrOVPZme6VrLWoF1hBUyPSLoI7zZ2mQ4o2UCUj5gGYELQMR/
+8/EfXvz4oVvXQ0HP5ygQvS6bWt6BRqu+H3O2Plrv1LJI3/KrRTjla732cZMJUUdL
+OQIDAQAB
+-----END PUBLIC KEY-----
diff --git a/backend/windmill-common/tests/runnable_list_fingerprint.rs b/backend/windmill-common/tests/runnable_list_fingerprint.rs
new file mode 100644
index 0000000000..d7438f0008
--- /dev/null
+++ b/backend/windmill-common/tests/runnable_list_fingerprint.rs
@@ -0,0 +1,54 @@
+use sqlx::{Pool, Postgres};
+use windmill_common::runnables::runnable_list_fingerprint;
+
+/// MCP clients refresh their tool list when this fingerprint moves, so it must move on every
+/// change to what the listing shows and stay put on writes it does not show.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn fingerprint_tracks_the_live_runnable_list(db: Pool<Postgres>) {
+    let fp = || async {
+        runnable_list_fingerprint(&db, "test-workspace")
+            .await
+            .unwrap()
+    };
+    let exec = |sql: &'static str| {
+        let db = db.clone();
+        async move { sqlx::query(sql).execute(&db).await.unwrap() }
+    };
+
+    let mut last = fp().await;
+    let mut assert_moved = async |what: &str, moved: bool| {
+        let now = fp().await;
+        assert_eq!(now != last, moved, "{what}");
+        last = now;
+    };
+
+    exec(
+        "INSERT INTO script (workspace_id, hash, path, summary, description, content, created_by, language, kind)
+         VALUES ('test-workspace', 1, 'f/test/a', '', '', 'def main(): pass', 'test-user', 'python3', 'script')",
+    )
+    .await;
+    assert_moved("deploy", true).await;
+
+    exec("UPDATE script SET lock = '' WHERE hash = 1").await;
+    assert_moved("lock update", false).await;
+
+    exec("UPDATE script SET path = 'f/test/b' WHERE hash = 1").await;
+    assert_moved("path move", true).await;
+
+    exec("UPDATE script SET archived = true WHERE hash = 1").await;
+    assert_moved("archive", true).await;
+
+    exec(
+        "INSERT INTO flow (workspace_id, path, summary, description, value, edited_by, schema, versions)
+         VALUES ('test-workspace', 'f/test/flow', '', '', '{}'::jsonb, 'test-user', '{}'::json, ARRAY[1]::bigint[])",
+    )
+    .await;
+    assert_moved("flow create", true).await;
+
+    exec("UPDATE flow SET versions = array_append(versions, 2::bigint) WHERE path = 'f/test/flow'")
+        .await;
+    assert_moved("flow redeploy", true).await;
+
+    exec("DELETE FROM flow WHERE path = 'f/test/flow'").await;
+    assert_moved("flow delete", true).await;
+}
diff --git a/backend/windmill-mcp/src/server/backend.rs b/backend/windmill-mcp/src/server/backend.rs
index 7ca1eb08a1..4801bfaa99 100644
--- a/backend/windmill-mcp/src/server/backend.rs
+++ b/backend/windmill-mcp/src/server/backend.rs
@@ -208,6 +208,11 @@ pub trait McpBackend: Send + Sync + Clone + 'static {
         workspace_id: &str,
     ) -> BackendResult<Self::Auth>;
 
+    /// An opaque value that changes whenever the workspace's live scripts or flows are
+    /// added, removed, moved or redeployed, compared across polls to detect tool-list
+    /// changes.
+    async fn runnable_list_fingerprint(&self, workspace_id: &str) -> BackendResult<String>;
+
     // ─────────────────────────────────────────────────────────────────
     // Endpoint Tools
     // ─────────────────────────────────────────────────────────────────
diff --git a/backend/windmill-mcp/src/server/list_changes.rs b/backend/windmill-mcp/src/server/list_changes.rs
new file mode 100644
index 0000000000..8470cff630
--- /dev/null
+++ b/backend/windmill-mcp/src/server/list_changes.rs
@@ -0,0 +1,104 @@
+//! Detects changes to a workspace's scripts and flows for `subscriptions/listen`.
+//!
+//! Each process polls a fingerprint of every workspace one of its listeners watches,
+//! so a change made on any replica, through any path (UI, CLI, git sync, a user
+//! rename), reaches every listener within one poll interval with no cross-replica
+//! signalling.
+
+use crate::server::backend::McpBackend;
+use std::collections::HashMap;
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+use tokio::sync::{broadcast, Notify};
+
+const POLL_INTERVAL: Duration = Duration::from_secs(30);
+
+struct Watcher {
+    changes: broadcast::Sender<()>,
+    poll_now: Arc<Notify>,
+}
+
+#[derive(Default)]
+pub(crate) struct ListChanges {
+    watchers: Mutex<HashMap<String, Watcher>>,
+}
+
+impl ListChanges {
+    /// Subscribe to `workspace_id`'s changes, starting its poller if this is the
+    /// first listener for it in this process.
+    pub(crate) fn subscribe<B: McpBackend>(
+        self: &Arc<Self>,
+        backend: &Arc<B>,
+        workspace_id: &str,
+    ) -> broadcast::Receiver<()> {
+        let mut watchers = self.watchers.lock().unwrap();
+        if let Some(watcher) = watchers.get(workspace_id) {
+            return watcher.changes.subscribe();
+        }
+        let (changes, rx) = broadcast::channel(16);
+        let poll_now = Arc::new(Notify::new());
+        watchers.insert(
+            workspace_id.to_string(),
+            Watcher { changes: changes.clone(), poll_now: poll_now.clone() },
+        );
+        tokio::spawn(self.clone().poll(
+            backend.clone(),
+            workspace_id.to_string(),
+            changes,
+            poll_now,
+        ));
+        rx
+    }
+
+    /// Poll `workspace_id` now rather than at its next interval, after this process
+    /// changed it: the client that made the change is the one waiting on it. Polling
+    /// rather than signalling directly keeps the poller's baseline current, so the
+    /// same change is not reported again on the next tick.
+    pub(crate) fn poll_now(&self, workspace_id: &str) {
+        if let Some(watcher) = self.watchers.lock().unwrap().get(workspace_id) {
+            watcher.poll_now.notify_one();
+        }
+    }
+
+    async fn poll<B: McpBackend>(
+        self: Arc<Self>,
+        backend: Arc<B>,
+        workspace_id: String,
+        changes: broadcast::Sender<()>,
+        poll_now: Arc<Notify>,
+    ) {
+        let mut interval = tokio::time::interval(POLL_INTERVAL);
+        interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
+        let mut last = None;
+        loop {
+            tokio::select! {
+                _ = interval.tick() => {}
+                _ = poll_now.notified() => {}
+            }
+            {
+                // Checked under the lock `subscribe` takes, so a listener cannot join a
+                // watcher that is about to stop.
+                let mut watchers = self.watchers.lock().unwrap();
+                if changes.receiver_count() == 0 {
+                    watchers.remove(&workspace_id);
+                    return;
+                }
+            }
+            match backend.runnable_list_fingerprint(&workspace_id).await {
+                Ok(fingerprint) => {
+                    // The first fingerprint also notifies: the listener that started this
+                    // watcher has already sent its opening notification, and a change landing
+                    // before this baseline would otherwise never be announced.
+                    if last.as_ref() != Some(&fingerprint) {
+                        let _ = changes.send(());
+                    }
+                    last = Some(fingerprint);
+                }
+                Err(e) => tracing::warn!(
+                    "MCP tool-list poll failed for workspace {workspace_id}: {}",
+                    e.message
+                ),
+            }
+        }
+    }
+}
diff --git a/backend/windmill-mcp/src/server/mod.rs b/backend/windmill-mcp/src/server/mod.rs
index b97e374e98..ad7c14d320 100644
--- a/backend/windmill-mcp/src/server/mod.rs
+++ b/backend/windmill-mcp/src/server/mod.rs
@@ -7,6 +7,7 @@
 
 pub mod backend;
 pub mod endpoints;
+mod list_changes;
 pub mod runner;
 pub mod tools;
 
diff --git a/backend/windmill-mcp/src/server/runner.rs b/backend/windmill-mcp/src/server/runner.rs
index e27eaa8470..177989a82e 100644
--- a/backend/windmill-mcp/src/server/runner.rs
+++ b/backend/windmill-mcp/src/server/runner.rs
@@ -16,20 +16,22 @@ use crate::server::backend::{McpAuth, McpBackend, McpRequest, PathFilter};
 use crate::server::endpoints::{
     endpoint_tool_to_mcp_tool, endpoint_tool_to_mcp_tool_multi, list_workspaces_tool, EndpointTool,
 };
+use crate::server::list_changes::ListChanges;
 use crate::server::tools::create_tool_from_item;
 use rmcp::handler::server::ServerHandler;
 use rmcp::model::{
     CacheScope, CallToolRequestParams, CallToolResponse, CallToolResult, ContentBlock,
-    Implementation, InitializeResult, ListPromptsResult, ListResourceTemplatesResult,
-    ListResourcesResult, ListToolsResult, PaginatedRequestParams, ProtocolVersion,
-    ServerCapabilities, ServerInfo,
+    Implementation, InitializeRequestParams, InitializeResult, ListPromptsResult,
+    ListResourceTemplatesResult, ListResourcesResult, ListToolsResult, PaginatedRequestParams,
+    ProtocolVersion, ServerCapabilities, ServerInfo, SubscriptionFilter,
 };
-use rmcp::service::{RequestContext, RoleServer};
+use rmcp::service::{RequestContext, RoleServer, SubscriptionContext};
 use rmcp::ErrorData;
 use serde_json::Value;
 use std::borrow::Cow;
 use std::collections::{HashMap, HashSet};
 use std::sync::Arc;
+use tokio::sync::broadcast;
 
 /// Protocol revisions this server is willing to speak. `2026-07-28` is served
 /// statelessly with per-request metadata; the older revisions keep the
@@ -46,15 +48,21 @@ const SUPPORTED_PROTOCOL_VERSIONS: &[ProtocolVersion] = &[
 /// leaves them unset, and a strict client rejects the response without them.
 ///
 /// Zero because nothing here is cacheable: the listing is rebuilt from the
-/// workspace's scripts and flows, which change at any time, and this server
-/// advertises no `listChanged` capability, so a client that cached a stale list
-/// would have no way to learn it had gone stale.
+/// workspace's scripts and flows, which change at any time, and `listChanged`
+/// covers only some of what the listing depends on (not resources, favorites or
+/// permissions), lags by up to a poll interval, and reaches only clients that hold a
+/// `subscriptions/listen` stream.
 const LIST_TTL_MS: u64 = 0;
+
 /// Every listing is filtered by the caller's token scopes and workspace
 /// membership, so no two callers necessarily see the same tools — a shared
 /// cache entry would leak one token's view to another.
 const LIST_CACHE_SCOPE: CacheScope = CacheScope::Private;
 
+/// How long a `subscriptions/listen` stream waits after a change before notifying,
+/// collecting the rest of the burst into the same notification.
+const LIST_CHANGE_COALESCE: std::time::Duration = std::time::Duration::from_millis(500);
+
 // Re-export from http crate for extracting request parts
 use http::request::Parts as HttpParts;
 
@@ -83,11 +91,12 @@ fn truncate_tool_result(text: String) -> String {
 /// to perform the actual operations (database queries, job execution, etc.)
 pub struct Runner<B: McpBackend> {
     backend: Arc<B>,
+    list_changes: Arc<ListChanges>,
 }
 
 impl<B: McpBackend> Clone for Runner<B> {
     fn clone(&self) -> Self {
-        Self { backend: self.backend.clone() }
+        Self { backend: self.backend.clone(), list_changes: self.list_changes.clone() }
     }
 }
 
@@ -113,7 +122,7 @@ struct McpContext<A> {
 impl<B: McpBackend> Runner<B> {
     /// Create a new Runner with the given backend
     pub fn new(backend: B) -> Self {
-        Self { backend: Arc::new(backend) }
+        Self { backend: Arc::new(backend), list_changes: Arc::default() }
     }
 
     /// Extract authentication, the workspace mode and the HTTP request itself
@@ -232,6 +241,22 @@ fn endpoint_path_policy(endpoint_name: &str) -> Option<EndpointPathPolicy> {
     }
 }
 
+/// Endpoint tools that change which scripts/flows a workspace exposes, or their
+/// schemas. The process serving the call polls the workspace right away rather than
+/// at its next interval, so a client that just deployed a script can call it.
+fn changes_runnable_list(endpoint_name: &str) -> bool {
+    matches!(
+        endpoint_name,
+        "createScript"
+            | "updateScript"
+            | "deleteScriptByPath"
+            | "deleteScriptByHash"
+            | "createFlow"
+            | "updateFlow"
+            | "deleteFlowByPath"
+    )
+}
+
 /// Whether the token restricts `kind` ("script"/"flow") to specific paths. A
 /// `*` pattern grants every path (see `is_resource_allowed`), so it does not
 /// count as confinement.
@@ -428,12 +453,17 @@ impl<B: McpBackend> ServerHandler for Runner<B> {
             .with_title("Windmill")
             .with_website_url("https://windmill.dev");
 
-        InitializeResult::new(ServerCapabilities::builder().enable_tools().build())
-            .with_server_info(server_info)
-            .with_instructions(
-                "This server provides a list of scripts and flows the user can run on Windmill. \
+        InitializeResult::new(
+            ServerCapabilities::builder()
+                .enable_tools()
+                .enable_tool_list_changed()
+                .build(),
+        )
+        .with_server_info(server_info)
+        .with_instructions(
+            "This server provides a list of scripts and flows the user can run on Windmill. \
                  Each flow and script is a tool callable with their respective arguments.",
-            )
+        )
     }
 
     /// Pinned rather than left to rmcp's default (every version the SDK knows), so a
@@ -444,6 +474,84 @@ impl<B: McpBackend> ServerHandler for Runner<B> {
         Cow::Borrowed(SUPPORTED_PROTOCOL_VERSIONS)
     }
 
+    /// Only clients below `2026-07-28` send `initialize`, and those receive server
+    /// notifications on a session's standalone stream. The transport is sessionless, so
+    /// there is none: `listChanged` is withheld from them rather than promised and
+    /// never delivered. `2026-07-28` clients learn it from `server/discover` and
+    /// receive it on `subscriptions/listen` (see `listen`).
+    async fn initialize(
+        &self,
+        request: InitializeRequestParams,
+        context: RequestContext<RoleServer>,
+    ) -> Result<InitializeResult, ErrorData> {
+        context.peer.set_peer_info(request.clone());
+        let mut info = self.get_info();
+        if let Some(tools) = info.capabilities.tools.as_mut() {
+            tools.list_changed = None;
+        }
+        if SUPPORTED_PROTOCOL_VERSIONS.contains(&request.protocol_version) {
+            info.protocol_version = request.protocol_version;
+        }
+        Ok(info)
+    }
+
+    /// `None` for a request that asks for nothing this server sends, so the client is
+    /// told the subscription is unsupported rather than acked with an empty filter.
+    fn accepted_subscription_filter(
+        &self,
+        requested: &SubscriptionFilter,
+    ) -> Option<SubscriptionFilter> {
+        (requested.tools_list_changed == Some(true))
+            .then(|| SubscriptionFilter::builder().tools_list_changed().build())
+    }
+
+    async fn listen(&self, subscription: SubscriptionContext) -> Result<(), ErrorData> {
+        let McpContext { auth, mode, .. } = Self::extract_context(subscription.request_context())?;
+        // Multi-workspace mode and read-only tokens list no scripts or flows, so their
+        // tool list never changes.
+        let workspace_id = match mode {
+            McpMode::Single(workspace_id) if !auth.read_only() => workspace_id,
+            _ => {
+                subscription.cancelled().await;
+                return Ok(());
+            }
+        };
+
+        let mut changes = self.list_changes.subscribe(&self.backend, &workspace_id);
+        // Every stream opens with one notification: a change the watcher recorded between
+        // this client's `tools/list` and this subscription is never broadcast again.
+        let mut opening = true;
+        loop {
+            if !std::mem::take(&mut opening) {
+                tokio::select! {
+                    _ = subscription.cancelled() => return Ok(()),
+                    change = changes.recv() => match change {
+                        Ok(()) | Err(broadcast::error::RecvError::Lagged(_)) => {}
+                        Err(broadcast::error::RecvError::Closed) => return Ok(()),
+                    },
+                }
+            }
+            // A client creating several scripts in a row: collapse the burst into one
+            // notification, so it re-lists once.
+            tokio::select! {
+                _ = subscription.cancelled() => return Ok(()),
+                _ = tokio::time::sleep(LIST_CHANGE_COALESCE) => {}
+            }
+            while !matches!(
+                changes.try_recv(),
+                Err(broadcast::error::TryRecvError::Empty | broadcast::error::TryRecvError::Closed)
+            ) {}
+            if subscription
+                .sink()
+                .notify_tool_list_changed()
+                .await
+                .is_err()
+            {
+                return Ok(());
+            }
+        }
+    }
+
     async fn list_tools(
         &self,
         _request: Option<PaginatedRequestParams>,
@@ -714,6 +822,9 @@ impl<B: McpBackend> Runner<B> {
                     .backend
                     .call_endpoint(auth, workspace_id, endpoint_tool, args)
                     .await?;
+                if changes_runnable_list(&endpoint_tool.name) {
+                    self.list_changes.poll_now(workspace_id);
+                }
 
                 return Ok(CallToolResult::success(vec![ContentBlock::text(
                     truncate_tool_result(
@@ -969,6 +1080,9 @@ impl<B: McpBackend> Runner<B> {
             .backend
             .call_endpoint(&resolved_auth, &workspace_id, endpoint_tool, args)
             .await?;
+        if changes_runnable_list(&endpoint_tool.name) {
+            self.list_changes.poll_now(&workspace_id);
+        }
 
         Ok(CallToolResult::success(vec![ContentBlock::text(
             truncate_tool_result(
diff --git a/backend/windmill-native-triggers/src/handler.rs b/backend/windmill-native-triggers/src/handler.rs
index 27a50ba07a..2c785a4e26 100644
--- a/backend/windmill-native-triggers/src/handler.rs
+++ b/backend/windmill-native-triggers/src/handler.rs
@@ -16,7 +16,8 @@ use serde::{Deserialize, Serialize};
 use sqlx::PgConnection;
 use std::sync::Arc;
 use windmill_api_auth::{
-    check_scopes, create_token_internal, require_is_writer, ApiAuthed, NewToken,
+    build_scope_path_filter, check_scopes, create_token_internal, require_is_writer, ApiAuthed,
+    NewToken,
 };
 use windmill_audit::{audit_oss::audit_log, ActionKind};
 use windmill_common::{
@@ -701,6 +702,7 @@ async fn list_native_triggers_handler<T: External>(
         query.per_page,
         query.path.as_deref(),
         query.is_flow,
+        build_scope_path_filter(&authed, "native_triggers", "read"),
     )
     .await?;
     tx.commit().await?;
diff --git a/backend/windmill-native-triggers/src/lib.rs b/backend/windmill-native-triggers/src/lib.rs
index 570319ee0e..6398e8a6d9 100644
--- a/backend/windmill-native-triggers/src/lib.rs
+++ b/backend/windmill-native-triggers/src/lib.rs
@@ -56,7 +56,7 @@ use windmill_queue::PushArgsOwned;
 #[cfg(feature = "native_trigger")]
 use windmill_oauth::{ErrorField, ExecuteError, OClient, RefreshToken, Url, OAUTH_HTTP_CLIENT};
 
-use windmill_api_auth::ApiAuthed;
+use windmill_api_auth::{ApiAuthed, ScopePathFilter};
 pub mod handler;
 pub(crate) mod lock;
 pub mod sync;
@@ -1493,9 +1493,17 @@ pub async fn list_native_triggers<'c, E: sqlx::Executor<'c, Database = Postgres>
     per_page: Option<usize>,
     path: Option<&str>,
     is_flow: Option<bool>,
+    scope: ScopePathFilter,
 ) -> Result<Vec<NativeTrigger>> {
     let offset = (page.unwrap_or(0) * per_page.unwrap_or(100)) as i64;
     let limit = per_page.unwrap_or(100) as i64;
+    // In the WHERE, not a retain after the fetch: the result is paginated, and a
+    // post-fetch filter would let a page's size report how many rows the token
+    // may not read.
+    let (scope_all, scope_exact, scope_prefix) = match scope {
+        ScopePathFilter::AllowAll => (true, Vec::new(), Vec::new()),
+        ScopePathFilter::Restricted { exact, prefix } => (false, exact, prefix),
+    };
 
     let triggers = sqlx::query_as!(
         NativeTrigger,
@@ -1532,7 +1540,12 @@ pub async fn list_native_triggers<'c, E: sqlx::Executor<'c, Database = Postgres>
                     WHERE f.workspace_id = nt.workspace_id
                     AND f.path = nt.script_path
                 ))
-            )
+            ) AND
+            ( $7
+              OR nt.script_path = ANY($8)
+              OR EXISTS ( SELECT 1 FROM unnest($9::text[]) AS pfx
+                          WHERE nt.script_path = pfx
+                             OR left(nt.script_path, length(pfx) + 1) = pfx || '/' ) )
         LIMIT $3
         OFFSET $4
         "#,
@@ -1541,7 +1554,10 @@ pub async fn list_native_triggers<'c, E: sqlx::Executor<'c, Database = Postgres>
         limit,
         offset,
         path,
-        is_flow
+        is_flow,
+        scope_all,
+        &scope_exact[..],
+        &scope_prefix[..],
     )
     .fetch_all(db)
     .await?;
diff --git a/backend/windmill-native-triggers/src/sync.rs b/backend/windmill-native-triggers/src/sync.rs
index bc259f048e..4f75845429 100644
--- a/backend/windmill-native-triggers/src/sync.rs
+++ b/backend/windmill-native-triggers/src/sync.rs
@@ -214,8 +214,17 @@ pub async fn sync_workspace_triggers<T: External>(
         workspace_id
     );
 
-    let windmill_triggers =
-        list_native_triggers(db, workspace_id, T::SERVICE_NAME, None, None, None, None).await?;
+    let windmill_triggers = list_native_triggers(
+        db,
+        workspace_id,
+        T::SERVICE_NAME,
+        None,
+        None,
+        None,
+        None,
+        windmill_api_auth::ScopePathFilter::AllowAll,
+    )
+    .await?;
 
     if windmill_triggers.is_empty() {
         tracing::info!(
diff --git a/backend/windmill-queue/src/flow_status.rs b/backend/windmill-queue/src/flow_status.rs
index e6b64c659d..55d2f6ec90 100644
--- a/backend/windmill-queue/src/flow_status.rs
+++ b/backend/windmill-queue/src/flow_status.rs
@@ -15,6 +15,9 @@ pub async fn update_flow_status_in_progress(
     let step = get_step_of_flow_status(db, flow).await?;
     match step {
         Step::Step { idx: step, .. } => {
+            // Children of a parallel module start concurrently and are tracked in `flow_jobs`, so its
+            // `job` would only hold whichever child started last. Writing it rewrites the parent's
+            // whole flow_status under its row lock once per child, serializing large parallel loops.
             sqlx::query!(
                 "UPDATE v2_job_status SET
                     flow_status = jsonb_set(
@@ -22,7 +25,11 @@ pub async fn update_flow_status_in_progress(
                         ARRAY['modules', $3::INTEGER::TEXT, 'type'],
                         to_jsonb('InProgress'::text)
                     )
-                WHERE id = $2",
+                WHERE id = $2
+                  AND NOT COALESCE(
+                      flow_status->'modules'->$3::INTEGER @> '{\"type\": \"InProgress\", \"parallel\": true}',
+                      false
+                  )",
                 job_in_progress,
                 flow,
                 step as i32
diff --git a/backend/windmill-queue/src/jobs.rs b/backend/windmill-queue/src/jobs.rs
index ab91d54287..75733f2454 100644
--- a/backend/windmill-queue/src/jobs.rs
+++ b/backend/windmill-queue/src/jobs.rs
@@ -1007,7 +1007,7 @@ pub async fn add_completed_job<T: Serialize + Send + Sync + ValidableJson>(
         ));
     }
 
-    // Native script retry: a failed `Script` job that carries a retry policy and
+    // Native script retry: a failed `Script` or `Script_Hub` job that carries a retry policy and
     // has attempts left gets its next attempt enqueued here — before the queue
     // row (which holds the attempt counter) is removed by commit. The failed
     // attempt is still recorded as a completed job below. `maybe_enqueue_…`
@@ -1077,9 +1077,9 @@ pub async fn add_completed_job<T: Serialize + Send + Sync + ValidableJson>(
     // Auto-resolve a retry chain that ultimately worked, from whichever of the two
     // completions lands last (see resolve_retry_chain_if_succeeded): a success that has a
     // parent (so is a possible retry attempt), or a failure that just enqueued a retry.
-    // `retry_pending` already implies a non-flow-step `Script`.
+    // `retry_pending` already implies a non-flow-step `Script` or `Script_Hub`.
     let resolve_root = if success && !skipped && !completed_job.is_flow_step() {
-        matches!(completed_job.kind, JobKind::Script)
+        matches!(completed_job.kind, JobKind::Script | JobKind::Script_Hub)
             .then(|| completed_job.parent_job)
             .flatten()
     } else if !success && !skipped && retry_pending {
@@ -1285,7 +1285,25 @@ async fn commit_completed_job<T: Serialize + Send + Sync + ValidableJson>(
     }
 
     let mut _skip_downstream_error_handlers = false;
-    tx = delete_job(tx, &job_id).warn_after_seconds(10).await?;
+    let (ntx, canceled_at_delete) = delete_job(tx, &job_id).warn_after_seconds(10).await?;
+    tx = ntx;
+    // `canceled_by` is only what the worker last read from the queue row. Deleting the row waits
+    // for a cancel still being written, so the row it removed is the final word on whether this
+    // job was canceled.
+    if canceled_by.is_none() {
+        if let Some(canceled) = canceled_at_delete {
+            sqlx::query!(
+                "UPDATE v2_job_completed SET status = 'canceled'::job_status, canceled_by = $2, \
+                 canceled_reason = $3 WHERE id = $1",
+                job_id,
+                canceled.username,
+                canceled.reason,
+            )
+            .execute(&mut *tx)
+            .warn_after_seconds(10)
+            .await?;
+        }
+    }
     // tracing::error!("3 {:?}", start.elapsed());
 
     if completed_job.is_flow_step() {
@@ -1611,6 +1629,22 @@ async fn restart_job_if_perpetual_inner(
     };
 
     if restart {
+        // Not `canceled_by`: a worker reads the queue row on a widening interval, up to every 5s
+        // once a job has run for a minute, so a cancel landing after its last read reaches a
+        // completion carrying none. `commit_completed_job` records it from the queue row it
+        // deletes, so the completed row is what says whether this loop was stopped.
+        let canceled = sqlx::query_scalar!(
+            "SELECT canceled_by IS NOT NULL AS \"canceled!\" FROM v2_job_completed \
+             WHERE id = $1 AND workspace_id = $2",
+            queued_job.id,
+            &queued_job.workspace_id
+        )
+        .fetch_optional(db)
+        .await?
+        .unwrap_or(false);
+        if canceled {
+            return Ok(());
+        }
         let tx = PushIsolationLevel::IsolatedRoot(db.clone());
 
         // perpetual jobs can run one job per 10s max. If the job was faster than 10s, schedule the next one with the appropriate delay
@@ -1809,10 +1843,10 @@ async fn eval_retry_if(
     false
 }
 
-/// Native script retry. When a failed `Script` job carries a retry policy (via
-/// `runnable_settings_handle`) and has attempts left, enqueue a fresh attempt of
-/// the same script after the policy's backoff delay — instead of having wrapped
-/// it in a one-step flow. Each attempt is a real `Script` job; the attempt
+/// Native script retry. When a failed `Script` or `Script_Hub` job carries a retry
+/// policy (via `runnable_settings_handle`) and has attempts left, enqueue a fresh
+/// attempt of the same script after the policy's backoff delay — instead of having
+/// wrapped it in a one-step flow. Each attempt is a job of the same kind; the attempt
 /// counter lives in the `native_retry_attempt` marker, written here and read only
 /// on the next failure (never on the hot job-pull path).
 ///
@@ -1833,7 +1867,10 @@ pub async fn maybe_enqueue_native_script_retry(
     result_fn: &(dyn Fn() -> Option<Box<serde_json::value::RawValue>> + Sync),
 ) -> Result<bool, Error> {
     // Only plain top-level scripts retry natively; cancellation always wins.
-    if canceled_by.is_some() || !matches!(job.kind, JobKind::Script) || job.is_flow_step() {
+    if canceled_by.is_some()
+        || !matches!(job.kind, JobKind::Script | JobKind::Script_Hub)
+        || job.is_flow_step()
+    {
         return Ok(false);
     }
 
@@ -4650,6 +4687,30 @@ pub fn tag_reads_args(tag: &str) -> bool {
     RE_ARG_TAG.is_match(tag)
 }
 
+/// Whether the tag reads the flow's state (`$flow_expr[results.a.foo]`), which only the flow
+/// runtime can resolve, right before pushing the step. A malformed placeholder counts too, so it
+/// is rejected or dropped instead of queueing the job on its literal text.
+pub fn tag_reads_flow_expr(tag: &str) -> bool {
+    tag.contains("$flow_expr[")
+}
+
+/// Renders the value at the dotted `path` below `root` as a dynamic tag component, shared by
+/// `$args[...]` and `$flow_expr[...]`: its JSON text with surrounding quotes trimmed, and empty
+/// once a segment is missing. Only object keys are followed, never array indexes.
+pub fn render_tag_path(root: Option<&RawValue>, path: &str) -> String {
+    let mut value = root.map(|x| x.get()).unwrap_or_default().to_string();
+    for part in path.split('.').filter(|p| !p.is_empty()) {
+        match serde_json::from_str::<serde_json::Value>(&value) {
+            Ok(obj) => value = obj.get(part).map(|v| v.to_string()).unwrap_or_default(),
+            Err(_) => {
+                value = String::new();
+                break;
+            }
+        }
+    }
+    value.trim_matches('"').to_string()
+}
+
 pub fn interpolate_args(x: String, args: &PushArgs, workspace_id: &str) -> String {
     // Save this value to avoid parsing twice
     let workspaced = x.as_str().replace("$workspace", workspace_id).to_string();
@@ -4657,40 +4718,12 @@ pub fn interpolate_args(x: String, args: &PushArgs, workspace_id: &str) -> Strin
         let mut interpolated = workspaced.clone();
         for cap in RE_ARG_TAG.captures_iter(&workspaced) {
             let arg_name = cap.get(1).unwrap().as_str();
-            let arg_value = if arg_name.contains('.') {
-                let parts: Vec<&str> = arg_name.split('.').collect();
-                let root = parts[0];
-                let mut value = args
-                    .args
-                    .get(root)
-                    .or(args.extra.as_ref().and_then(|x| x.get(root)))
-                    .map(|x| x.get())
-                    .unwrap_or_default()
-                    .to_string();
-
-                for part in parts.iter().skip(1) {
-                    if let Ok(obj) = serde_json::from_str::<serde_json::Value>(&value) {
-                        value = obj
-                            .get(part)
-                            .and_then(|v| Some(v.to_string()))
-                            .unwrap_or_default()
-                            .as_str()
-                            .to_string();
-                    } else {
-                        value = "".to_string(); // Invalid JSON or missing field
-                        break;
-                    }
-                }
-                value.trim_matches('"').to_string()
-            } else {
-                args.args
-                    .get(arg_name)
-                    .or(args.extra.as_ref().and_then(|x| x.get(arg_name)))
-                    .map(|x| x.get())
-                    .unwrap_or_default()
-                    .trim_matches('"')
-                    .to_string()
-            };
+            let (root, rest) = arg_name.split_once('.').unwrap_or((arg_name, ""));
+            let root_value = args
+                .args
+                .get(root)
+                .or(args.extra.as_ref().and_then(|x| x.get(root)));
+            let arg_value = render_tag_path(root_value.map(|x| &**x), rest);
             interpolated =
                 interpolated.replace(format!("$args[{}]", arg_name).as_str(), &arg_value);
         }
@@ -4700,6 +4733,72 @@ pub fn interpolate_args(x: String, args: &PushArgs, workspace_id: &str) -> Strin
     }
 }
 
+/// The queue an explicit `tag` sends a job pushed with `args` to, or `None` when `push` drops the
+/// tag and the job runs on its default one.
+pub async fn resolve_push_tag(
+    tag: &str,
+    args: &PushArgs<'_>,
+    workspace_id: &str,
+    db: &DB,
+) -> Option<String> {
+    // The flow runtime resolves a step's `$flow_expr[...]` before pushing it, so one still here
+    // was pushed with no flow state to read (a step test, a dependency job) and would name a
+    // queue no worker serves: the job runs on its default tag instead.
+    if tag.is_empty() || tag_reads_flow_expr(tag) {
+        return None;
+    }
+    // `$workspace` must resolve the same way the default tags do, or an explicit tag and a default
+    // tag from the same workspace address two different worker pools. Resolving costs a lookup,
+    // so pay it only for tags that actually interpolate `$workspace`.
+    let tag_ws = if tag.contains("$workspace") {
+        crate::tags::tag_workspace_id(workspace_id, db).await
+    } else {
+        workspace_id.to_string()
+    };
+    Some(interpolate_args(tag.to_string(), args, &tag_ws))
+}
+
+/// Refuses a `tag` the caller chose that the instance's custom tags do not let `w_id` use,
+/// judging the queue it resolves to. `args` must be the ones the job is pushed with: resolving
+/// with any others checks a queue the job does not land on.
+pub async fn check_tag_available_for_push(
+    db: &DB,
+    w_id: &str,
+    tag: &str,
+    args: &PushArgs<'_>,
+    is_super_admin: bool,
+    scope_tags: Option<Vec<&str>>,
+) -> Result<(), Error> {
+    check_tag_written_as_available_for_push(db, w_id, tag, tag, args, is_super_admin, scope_tags)
+        .await
+}
+
+/// [`check_tag_available_for_push`] for a `tag` the flow runtime already partly resolved from
+/// `written_tag`, the step's tag as its author wrote it.
+pub async fn check_tag_written_as_available_for_push(
+    db: &DB,
+    w_id: &str,
+    written_tag: &str,
+    tag: &str,
+    args: &PushArgs<'_>,
+    is_super_admin: bool,
+    scope_tags: Option<Vec<&str>>,
+) -> Result<(), Error> {
+    let Some(resolved_tag) = resolve_push_tag(tag, args, w_id, db).await else {
+        return Ok(());
+    };
+    windmill_common::jobs::check_tag_available_for_workspace_internal(
+        db,
+        w_id,
+        written_tag,
+        Some(&resolved_tag),
+        crate::tags::tag_workspace_id(w_id, db),
+        is_super_admin,
+        scope_tags,
+    )
+    .await
+}
+
 pub fn fullpath_with_workspace(
     workspace_id: &str,
     script_path: Option<&String>,
@@ -5091,34 +5190,44 @@ async fn extract_result_from_job_result(
     }
 }
 
+/// Also reports the cancellation the deleted row carried, if any. Unlike a plain read of the queue
+/// row, this waits for a cancel that is still being written, so it is the last word on one.
 pub async fn delete_job<'c>(
     mut tx: Transaction<'c, Postgres>,
     job_id: &Uuid,
-) -> windmill_common::error::Result<Transaction<'c, Postgres>> {
+) -> windmill_common::error::Result<(Transaction<'c, Postgres>, Option<CanceledBy>)> {
     #[cfg(feature = "prometheus")]
     if METRICS_ENABLED.load(std::sync::atomic::Ordering::Relaxed) {
         QUEUE_DELETE_COUNT.inc();
     }
     otel_incr_queue_delete_count();
 
-    let job_removed =
-        sqlx::query_scalar!("DELETE FROM v2_job_queue WHERE id = $1 RETURNING 1", job_id,)
-            .fetch_optional(&mut *tx)
-            .await;
+    let job_removed = sqlx::query!(
+        "DELETE FROM v2_job_queue WHERE id = $1 RETURNING canceled_by, canceled_reason",
+        job_id,
+    )
+    .fetch_optional(&mut *tx)
+    .await;
 
-    if let Err(job_removed) = job_removed {
-        tracing::error!(
-            "Job {job_id} could not be deleted: {job_removed}. This is not necessarily an error, as the job might have been deleted by another process such as in the case of cancelling"
-        );
-    } else {
-        let job_removed = job_removed.unwrap().flatten().unwrap_or(0);
-        if job_removed != 1 {
-            tracing::error!("Job {job_id} could not be deleted, returned not 1: {job_removed}. This is not necessarily an error, as the job might have been deleted by another process such as in the case of cancelling");
+    let canceled = match &job_removed {
+        Err(job_removed) => {
+            tracing::error!(
+                "Job {job_id} could not be deleted: {job_removed}. This is not necessarily an error, as the job might have been deleted by another process such as in the case of cancelling"
+            );
+            None
         }
-    }
+        Ok(None) => {
+            tracing::error!("Job {job_id} could not be deleted, no row was removed. This is not necessarily an error, as the job might have been deleted by another process such as in the case of cancelling");
+            None
+        }
+        Ok(Some(row)) => row.canceled_by.as_ref().map(|username| CanceledBy {
+            username: Some(username.clone()),
+            reason: row.canceled_reason.clone(),
+        }),
+    };
 
     tracing::debug!("Job {job_id} deleted");
-    Ok(tx)
+    Ok((tx, canceled))
 }
 
 pub async fn job_is_complete(db: &DB, id: Uuid, w_id: &str) -> error::Result<bool> {
@@ -5269,6 +5378,8 @@ pub fn empty_result() -> Box<RawValue> {
 
 lazy_static::lazy_static! {
     pub static ref RE_ARG_TAG: Regex = Regex::new(r#"\$args\[((?:\w+\.)*\w+)\]"#).unwrap();
+    pub static ref RE_FLOW_EXPR_TAG: Regex =
+        Regex::new(r#"\$flow_expr\[((?:\w+\.)*\w+)\]"#).unwrap();
 }
 
 #[cfg(feature = "cloud")]
@@ -5746,10 +5857,10 @@ async fn push_inner<'c, 'd>(
             dedicated_worker,
             ..Default::default()
         },
-        JobPayload::FlowNode { id, path } => {
+        JobPayload::FlowNode { id, path, no_inherited_flow_env } => {
             let data = cache::flow::fetch_flow(db, id).await?;
             let value = data.value();
-            let status = Some(FlowStatus::new(value));
+            let status = Some(FlowStatus { no_inherited_flow_env, ..FlowStatus::new(value) });
             // Keep inserting `value` if not all workers are updated.
             // Starting at `v1.440`, the value is fetched on pull from the flow node id.
             let value_o = if !MIN_VERSION_IS_AT_LEAST_1_440.met().await {
@@ -5986,6 +6097,7 @@ async fn push_inner<'c, 'd>(
                         stream_job: None,
                         chat_input_enabled: None,
                         memory_id: None,
+                        no_inherited_flow_env: false,
                     }
                 }
                 _ => {
@@ -6045,10 +6157,12 @@ async fn push_inner<'c, 'd>(
             // `quickjs` feature it cannot be evaluated and fails closed (no retry);
             // the flow path is not a fallback, since the flow runtime needs quickjs
             // too.
+            // A hub script has no hash and runs as a `Script_Hub` job.
+            let is_hub = hash.is_none() && path.starts_with("hub/");
             let native_retry = !is_flow
                 && skip_handler.is_none()
                 && error_handler_path.is_none()
-                && hash.is_some()
+                && (hash.is_some() || is_hub)
                 && language.is_some()
                 && windmill_common::runnable_settings::min_version_supports_runnable_settings_v0()
                     .await;
@@ -6078,7 +6192,11 @@ async fn push_inner<'c, 'd>(
                 break 'ssf JobPayloadUntagged {
                     runnable_id: hash.map(|h| h.0),
                     runnable_path: Some(path),
-                    job_kind: JobKind::Script,
+                    job_kind: if is_hub {
+                        JobKind::Script_Hub
+                    } else {
+                        JobKind::Script
+                    },
                     language,
                     dedicated_worker,
                     concurrency_settings,
@@ -6380,6 +6498,7 @@ async fn push_inner<'c, 'd>(
                 stream_job: None,
                 chat_input_enabled: None,
                 memory_id: None,
+                no_inherited_flow_env: false,
             };
             let value = flow_data.value();
             let priority = value.priority;
@@ -6537,20 +6656,9 @@ async fn push_inner<'c, 'd>(
         );
         windmill_common::worker::dedicated_worker_tag(workspace_id, &full_path)
     } else {
-        if tag == Some("".to_string()) {
-            tag = None;
-        }
-
-        // `$workspace` must resolve the same way the default tags below do, or an explicit tag and
-        // a default tag from the same workspace address two different worker pools. Resolving costs
-        // a lookup, so pay it only for tags that actually interpolate `$workspace`.
         let interpolated_tag = match tag {
+            Some(x) => resolve_push_tag(&x, &args, workspace_id, db).await,
             None => None,
-            Some(x) if x.contains("$workspace") => {
-                let tag_ws = crate::tags::tag_workspace_id(&workspace_id, db).await;
-                Some(interpolate_args(x, &args, &tag_ws))
-            }
-            Some(x) => Some(interpolate_args(x, &args, workspace_id)),
         };
         let effective_ws = per_workspace_tag(&workspace_id, db).await;
 
@@ -7922,3 +8030,43 @@ mod result_metadata_tests {
         assert_eq!(meta.wm_failure.as_deref(), Some("boom"));
     }
 }
+
+#[cfg(test)]
+mod render_tag_path_tests {
+    use super::{interpolate_args, render_tag_path, PushArgs};
+    use serde_json::value::RawValue;
+    use std::collections::HashMap;
+
+    fn render(root: &str, path: &str) -> String {
+        render_tag_path(
+            Some(&RawValue::from_string(root.to_string()).unwrap()),
+            path,
+        )
+    }
+
+    // Existing `$args[...]` tags route on exactly these renderings.
+    #[test]
+    fn renders_like_args_tags() {
+        assert_eq!(render(r#""eu""#, ""), "eu");
+        assert_eq!(render(r#"{"a": {"b": "eu"}}"#, "a.b"), "eu");
+        assert_eq!(render(r#"{"n": 4}"#, "n"), "4");
+        assert_eq!(render("null", ""), "null");
+        assert_eq!(render(r#"{"a": 1}"#, "b.c"), "");
+        assert_eq!(render(r#"{"a": ["eu"]}"#, "a.0"), "");
+        assert_eq!(render_tag_path(None, "a"), "");
+
+        let args = HashMap::from([("cfg".to_string(), raw(r#"{"lang": "eu"}"#))]);
+        let push_args = PushArgs {
+            args: &args,
+            extra: Some(HashMap::from([("e".to_string(), raw(r#""x""#))])),
+        };
+        assert_eq!(
+            interpolate_args("w-$args[cfg.lang]-$args[e]".to_string(), &push_args, "ws"),
+            "w-eu-x"
+        );
+    }
+
+    fn raw(json: &str) -> Box<RawValue> {
+        RawValue::from_string(json.to_string()).unwrap()
+    }
+}
diff --git a/backend/windmill-queue/src/schedule.rs b/backend/windmill-queue/src/schedule.rs
index 5d5cf005fc..40c1292b74 100644
--- a/backend/windmill-queue/src/schedule.rs
+++ b/backend/windmill-queue/src/schedule.rs
@@ -6,6 +6,7 @@
  * LICENSE-AGPL for a copy of the license.
  */
 
+use crate::jobs::HTTP_CLIENT;
 use crate::push;
 use crate::PushIsolationLevel;
 use anyhow::Context;
@@ -19,13 +20,13 @@ use windmill_common::ee_oss::LICENSE_KEY_VALID;
 use windmill_common::flows::Retry;
 use windmill_common::get_flow_version_info_from_version;
 use windmill_common::get_latest_flow_version_id_for_path;
-use windmill_common::jobs::check_tag_available_for_workspace_internal;
 use windmill_common::jobs::JobPayload;
 use windmill_common::jobs::JobTriggerKind;
 use windmill_common::jobs::OnBehalfOf;
 use windmill_common::runnable_settings::ConcurrencySettings;
 use windmill_common::runnable_settings::DebouncingSettings;
 use windmill_common::schedule::schedule_to_user;
+use windmill_common::scripts::get_full_hub_script_by_path;
 use windmill_common::scripts::ScriptHash;
 use windmill_common::triggers::TriggerMetadata;
 use windmill_common::utils::WarnAfterExt;
@@ -82,6 +83,8 @@ async fn get_schedule_metadata<'c>(
             Some(version),
             parsed_retry,
         ))
+    } else if schedule.script_path.starts_with("hub/") {
+        Ok((None, None, None, None, None, parsed_retry))
     } else {
         let (
             hash,
@@ -323,6 +326,48 @@ pub async fn push_scheduled_job<'c>(
             None,
             on_behalf_of,
         )
+    } else if schedule.script_path.starts_with("hub/") {
+        let tag = schedule.tag.clone().filter(|t| !t.is_empty());
+        let payload = match &schedule.retry {
+            // The language is what lets `push` materialize this as a native retry
+            // instead of a flow wrapper, which would queue the next tick at start.
+            Some(retry) => JobPayload::SingleStepFlow {
+                path: schedule.script_path.clone(),
+                hash: None,
+                flow_version: None,
+                language: Some(
+                    get_full_hub_script_by_path(
+                        StripPath(schedule.script_path.clone()),
+                        &HTTP_CLIENT,
+                        Some(db),
+                    )
+                    .await?
+                    .language,
+                ),
+                retry: Some(serde_json::from_value::<Retry>(retry.clone()).map_err(|e| {
+                    error::Error::internal_err(format!(
+                        "Unable to parse retry information from schedule: {e}"
+                    ))
+                })?),
+                error_handler_path: None,
+                error_handler_args: None,
+                skip_handler: None,
+                args: args.clone(),
+                cache_ttl: None,
+                cache_ignore_s3_path: None,
+                priority: None,
+                tag_override: tag.clone(),
+                trigger_path: None,
+                apply_preprocessor: false,
+                concurrency_settings: ConcurrencySettings::default(),
+                debouncing_settings: DebouncingSettings::default(),
+            },
+            None => JobPayload::ScriptHub {
+                path: schedule.script_path.clone(),
+                apply_preprocessor: false,
+            },
+        };
+        (payload, tag, None, None)
     } else {
         let (
             hash,
@@ -511,14 +556,15 @@ pub async fn push_scheduled_job<'c>(
 
     if let Some(tag) = tag.as_deref().filter(|t| !t.is_empty()) {
         let is_super_admin = windmill_common::auth::is_super_admin_email(db, &email).await?;
-        check_tag_available_for_workspace_internal(
+        crate::check_tag_available_for_push(
             db,
             &schedule.workspace_id,
             &tag,
+            &crate::PushArgs::from(&args),
             is_super_admin,
             None, // no token for schedules so no scopes so no scope_tags
         )
-        .warn_after_seconds_with_sql(1, "check_tag_available_for_workspace_internal".to_string())
+        .warn_after_seconds_with_sql(1, "check_tag_available_for_push".to_string())
         .await?;
     }
 
diff --git a/backend/windmill-queue/tests/schedule_push.rs b/backend/windmill-queue/tests/schedule_push.rs
index 333d211765..f3ae34251e 100644
--- a/backend/windmill-queue/tests/schedule_push.rs
+++ b/backend/windmill-queue/tests/schedule_push.rs
@@ -1757,4 +1757,59 @@ mod schedule_push {
         assert_eq!(count_queued_jobs(&db).await, 1);
         Ok(())
     }
+
+    #[sqlx::test(migrations = "../migrations", fixtures("base", "schedule_push"))]
+    async fn test_push_hub_script_schedule(db: Pool<Postgres>) -> anyhow::Result<()> {
+        // Seed the hub cache so the push resolves the script without the network.
+        let version = "990000001";
+        let hub_dir = &*windmill_common::worker::HUB_CACHE_DIR;
+        tokio::fs::create_dir_all(hub_dir).await?;
+        tokio::fs::write(
+            format!("{hub_dir}/{version}"),
+            r#"{"content":"echo hi","lockfile":null,"language":"bash","schema":{},"summary":null}"#,
+        )
+        .await?;
+        let hub_path = format!("hub/{version}/test/echo");
+
+        // A retry must stay a native `script_hub` job: a flow wrapper would queue the
+        // next tick at start and let slow runs overlap.
+        let retry = serde_json::json!({ "constant": { "attempts": 2, "seconds": 1 } });
+        for (path, retry, dynamic_skip) in [
+            ("f/system/hub_plain", None, None),
+            ("f/system/hub_retry", Some(retry), None),
+            // A skip handler needs a flow wrapper, so its metadata lookup must not
+            // go through the `script` table.
+            ("f/system/hub_skip", None, Some("f/system/skip".to_string())),
+        ] {
+            let has_retry = retry.is_some();
+            let has_skip = dynamic_skip.is_some();
+            let schedule = make_schedule(|s| {
+                s.path = path.to_string();
+                s.script_path = hub_path.clone();
+                s.retry = retry;
+                s.dynamic_skip = dynamic_skip;
+            });
+            let tx = db.begin().await?;
+            let tx = push_scheduled_job(&db, tx, &schedule, Some(&make_authed()), None).await?;
+            tx.commit().await?;
+
+            let (job_kind, runnable_path, language, handle) =
+                sqlx::query_as::<_, (String, Option<String>, Option<String>, Option<i64>)>(
+                    "SELECT j.kind::text, j.runnable_path, j.script_lang::text, q.runnable_settings_handle
+                     FROM v2_job j JOIN v2_job_queue q ON j.id = q.id WHERE j.trigger = $1",
+                )
+                .bind(path)
+                .fetch_one(&db)
+                .await?;
+            assert_eq!(runnable_path.as_deref(), Some(hub_path.as_str()));
+            if has_skip {
+                assert_eq!(job_kind, "singlestepflow");
+            } else {
+                assert_eq!(job_kind, "script_hub");
+                assert_eq!(language.as_deref(), Some("bash"));
+                assert_eq!(handle.is_some(), has_retry);
+            }
+        }
+        Ok(())
+    }
 }
diff --git a/backend/windmill-runtime-nativets/src/lib.rs b/backend/windmill-runtime-nativets/src/lib.rs
index d44213d3bc..750bf7ebac 100644
--- a/backend/windmill-runtime-nativets/src/lib.rs
+++ b/backend/windmill-runtime-nativets/src/lib.rs
@@ -838,6 +838,11 @@ pub async fn eval_fetch_timeout(
                 }
             }
             let w_id_for_tracing = w_id_for_tracing;
+            // nativets delivers logs in-process, so they never reach the masking in
+            // `handle_child::write_lines` and a `console.log` of `$WM_TOKEN` would be
+            // persisted verbatim. Mask here rather than in the detached task draining into
+            // `append_logs`: this loop normally runs while the job is still registered.
+            let mut masker = windmill_common::sensitive_log_masks::JobMasker::new(job_id);
             let handle = tokio::spawn(async move {
                 let mut result_stream = String::new();
                 let mut is_stream = false;
@@ -845,10 +850,20 @@ pub async fn eval_fetch_timeout(
                     use windmill_common::result_stream::extract_stream_from_logs;
                     use windmill_common::tracing_init::{OTEL_JOB_LOGS, OTEL_PREFIX};
 
+                    let stream = extract_stream_from_logs(&log.trim_end_matches("\n"));
+
+                    // A stream chunk is result data, not a log line — it never reaches
+                    // `job_logs`, and `merge_result_stream` can make it the job's result —
+                    // so it stays raw wherever it goes, here and in the mirror below.
+                    // Deliberately unlike `handle_child`, which streams the masked text.
+                    // Routed before masking because the notice is one-shot: spent on a chunk
+                    // no sink persists, a later redaction in `job_logs` would go unexplained.
+                    let logged = stream.is_none().then(|| masker.mask(&log).into_owned());
+
                     // Mirror `process_streaming_log_lines` (EE) + the OTEL_JOB_LOGS
                     // hook from handle_child.rs, neither of which runs for nativets
                     // since nativets delivers logs in-process via the log channel.
-                    for line in log.lines() {
+                    for line in logged.as_deref().unwrap_or(&log).lines() {
                         tracing::info!(
                             target: "windmill:job_log",
                             job_id = ?job_id,
@@ -862,7 +877,7 @@ pub async fn eval_fetch_timeout(
                         }
                     }
 
-                    if let Some(stream) = extract_stream_from_logs(&log.trim_end_matches("\n")) {
+                    if let Some(stream) = stream {
                         if !is_stream {
                             is_stream = true;
                             if let Some(ref f) = stream_notifier_update {
@@ -874,8 +889,8 @@ pub async fn eval_fetch_timeout(
                         if let Err(e) = result_stream_sender.send(stream) {
                             tracing::error!("failed to send result stream: {e}");
                         }
-                    } else {
-                        if let Err(e) = append_logs_sender.send(log) {
+                    } else if let Some(logged) = logged {
+                        if let Err(e) = append_logs_sender.send(logged) {
                             tracing::error!("failed to send log: {e}");
                         }
                     }
diff --git a/backend/windmill-runtime-nativets/src/windmill-client.js b/backend/windmill-runtime-nativets/src/windmill-client.js
index 7c7d649042..c2dbd1fef1 100644
--- a/backend/windmill-runtime-nativets/src/windmill-client.js
+++ b/backend/windmill-runtime-nativets/src/windmill-client.js
@@ -6457,7 +6457,7 @@ var AppService = class {
    * @param data.workspace
    * @param data.path
    * @param data.requestBody update app
-   * @returns string app updated
+   * @returns AppDeployed the path the app now lives at and the version this deploy wrote
    * @throws ApiError
    */
   static updateApp(data) {
diff --git a/backend/windmill-trigger-http/src/handler.rs b/backend/windmill-trigger-http/src/handler.rs
index 01ddfd4a81..539c8e43d2 100644
--- a/backend/windmill-trigger-http/src/handler.rs
+++ b/backend/windmill-trigger-http/src/handler.rs
@@ -13,6 +13,7 @@ use windmill_common::global_settings::{validate_allowed_origins, HTTP_ROUTE_WORK
 use windmill_common::{
     db::UserDB,
     error::{Error, Result},
+    utils::check_proper_path,
     worker::CLOUD_HOSTED,
     DB,
 };
@@ -269,6 +270,7 @@ pub async fn create_many_http_triggers(
         check_scopes(&authed, || {
             format!("http_triggers:write:{}", &new_http_trigger.base.path)
         })?;
+        check_proper_path(&new_http_trigger.base.path)?;
 
         // This route inserts directly, bypassing the shared create handler.
         // `error_wrapper` would turn the rejection into a 500.
diff --git a/backend/windmill-trigger-postgres/src/handler.rs b/backend/windmill-trigger-postgres/src/handler.rs
index 92dd2e1e19..4294645b89 100644
--- a/backend/windmill-trigger-postgres/src/handler.rs
+++ b/backend/windmill-trigger-postgres/src/handler.rs
@@ -21,11 +21,12 @@ use windmill_common::{
 use windmill_git_sync::DeployedObject;
 
 use windmill_api_auth::{check_scopes, ApiAuthed};
-use windmill_trigger::{Trigger, TriggerCrud, TriggerData};
+use windmill_trigger::{Trigger, TriggerCrud, TriggerData, TriggerMode};
 
 use super::{
     check_if_valid_publication_for_postgres_version, create_logical_replication_slot,
-    create_pg_publication, drop_publication, generate_random_string, get_default_pg_connection,
+    create_pg_publication, drop_publication, ensure_not_under_roles, generate_random_string,
+    get_default_pg_connection,
     mapper::{Mapper, MappingInfo},
     PostgresConfig, PostgresConfigRequest, PostgresPublicationReplication, PostgresTrigger,
     PublicationData, Relations, Slot, SlotList, TableToTrack, TemplateScript, TestPostgresConfig,
@@ -64,6 +65,29 @@ impl TriggerCrud for PostgresTrigger {
         DeployedObject::PostgresTrigger { path, parent_path }
     }
 
+    async fn validate_config(
+        &self,
+        db: &DB,
+        config: &Self::TriggerConfigRequest,
+        workspace_id: &str,
+    ) -> Result<()> {
+        ensure_not_under_roles(db, workspace_id, &config.postgres_resource_path).await
+    }
+
+    async fn authorize_set_trigger_mode(
+        &self,
+        _authed: &ApiAuthed,
+        tx: &mut PgConnection,
+        _workspace_id: &str,
+        _path: &str,
+        mode: &TriggerMode,
+    ) -> Result<()> {
+        if *mode != TriggerMode::Disabled {
+            windmill_common::datatable_roles::lock_datatable_streams(tx, false).await?;
+        }
+        Ok(())
+    }
+
     async fn create_trigger(
         &self,
         db: &DB,
@@ -72,6 +96,7 @@ impl TriggerCrud for PostgresTrigger {
         w_id: &str,
         trigger: TriggerData<Self::TriggerConfigRequest>,
     ) -> Result<()> {
+        windmill_common::datatable_roles::lock_datatable_streams(&mut *tx, false).await?;
         let resolved_edited_by = trigger.base.resolve_edited_by(authed);
         let resolved_permissioned_as = trigger.base.resolve_permissioned_as(authed);
         let Self::TriggerConfigRequest {
@@ -161,6 +186,7 @@ impl TriggerCrud for PostgresTrigger {
         path: &str,
         trigger: TriggerData<Self::TriggerConfigRequest>,
     ) -> Result<()> {
+        windmill_common::datatable_roles::lock_datatable_streams(&mut *tx, false).await?;
         let resolved_edited_by = trigger.base.resolve_edited_by(authed);
         let resolved_permissioned_as = trigger.base.resolve_permissioned_as(authed);
         let Self::TriggerConfigRequest {
diff --git a/backend/windmill-trigger-postgres/src/lib.rs b/backend/windmill-trigger-postgres/src/lib.rs
index 571aac0a66..b92860662d 100644
--- a/backend/windmill-trigger-postgres/src/lib.rs
+++ b/backend/windmill-trigger-postgres/src/lib.rs
@@ -374,6 +374,35 @@ pub async fn get_raw_postgres_connection(
     Ok(client)
 }
 
+/// A replication stream reads every row of every table whatever the data table's roles grant, so
+/// the two don't mix: a data table under roles takes no triggers or captures, and roles cannot be
+/// turned on while one is enabled on it.
+///
+/// Authorization: checks nothing, and its refusal says whether `w_id`'s data table is under roles.
+/// Callers MUST have established that the caller may manage triggers in `w_id` first.
+pub(crate) async fn ensure_not_under_roles(
+    db: &DB,
+    w_id: &str,
+    postgres_resource_path: &str,
+) -> Result<()> {
+    let Some(datatable_name) = postgres_resource_path.strip_prefix("datatable://") else {
+        return Ok(());
+    };
+    if windmill_common::workspaces::resolve_governing_datatable(db, w_id, datatable_name)
+        .await?
+        .datatable
+        .permissions
+        .is_some()
+    {
+        return Err(Error::BadRequest(format!(
+            "Data table '{datatable_name}' is under roles, and a Postgres trigger or capture \
+             cannot read one: a replication stream sees every row whatever the roles grant. \
+             Turn its roles off to stream it."
+        )));
+    }
+    Ok(())
+}
+
 pub async fn resolve_postgres_resource(
     authed: &ApiAuthed,
     user_db: Option<UserDB>,
@@ -382,6 +411,7 @@ pub async fn resolve_postgres_resource(
     w_id: &str,
 ) -> Result<Postgres> {
     if let Some(datatable_name) = postgres_resource_path.strip_prefix("datatable://") {
+        ensure_not_under_roles(db, w_id, postgres_resource_path).await?;
         // Trigger connections (publication/slot management + logical replication) run
         // as the dedicated replication user on custom-instance databases.
         let resource_value =
diff --git a/backend/windmill-trigger-postgres/src/listener.rs b/backend/windmill-trigger-postgres/src/listener.rs
index 14d348b5f2..876b75661e 100644
--- a/backend/windmill-trigger-postgres/src/listener.rs
+++ b/backend/windmill-trigger-postgres/src/listener.rs
@@ -20,7 +20,8 @@ use windmill_common::{
 use windmill_trigger::{listener::ListeningTrigger, trigger_helpers::TriggerJobArgs, Listener};
 
 use super::{
-    drop_publication, get_default_pg_connection, get_raw_postgres_connection,
+    drop_publication, ensure_not_under_roles, get_default_pg_connection,
+    get_raw_postgres_connection,
     handler::drop_logical_replication_slot,
     relation::RelationConverter,
     replication_message::{
@@ -135,8 +136,8 @@ impl PostgresSimpleClient {
 /// Resolves the Postgres resource, validates that the configured publication and
 /// replication slot still exist, and opens a fresh logical replication stream.
 ///
-/// Returns `Error::BadConfig` when the publication or slot is missing (an
-/// unrecoverable misconfiguration). Any other error is treated as transient
+/// Returns `Error::BadConfig` when the publication or slot is missing, or the
+/// data table is under roles (unrecoverable misconfigurations). Any other error is treated as transient
 /// (connection refused, network interruption, ...) and is retried by the caller.
 /// The resource is re-resolved on every call so credential rotations are picked
 /// up across reconnections.
@@ -149,6 +150,14 @@ async fn connect_logical_replication_stream(
     let PostgresConfig { postgres_resource_path, publication_name, replication_slot_name, .. } =
         trigger_config;
 
+    // Retrying cannot lift roles, so this disables the trigger like a missing slot does.
+    ensure_not_under_roles(db, workspace_id, postgres_resource_path)
+        .await
+        .map_err(|e| match e {
+            Error::BadRequest(msg) => Error::BadConfig(msg),
+            e => e,
+        })?;
+
     let database = resolve_postgres_resource(
         authed,
         Some(UserDB::new(db.clone())),
diff --git a/backend/windmill-trigger/src/handler.rs b/backend/windmill-trigger/src/handler.rs
index 66d6770354..ba40ed2c48 100644
--- a/backend/windmill-trigger/src/handler.rs
+++ b/backend/windmill-trigger/src/handler.rs
@@ -22,7 +22,7 @@ use windmill_common::{
         fetch_draft_only_list_rows, overlay_or_draft_only, UserDraftItemKind, WithDraftOverlay,
         WithDraftQuery,
     },
-    utils::{paginate, Pagination, StripPath},
+    utils::{check_proper_path, paginate, Pagination, StripPath},
     worker::CLOUD_HOSTED,
     DB,
 };
@@ -547,6 +547,7 @@ async fn create_trigger<T: TriggerCrud>(
             &new_trigger.base.path
         )
     })?;
+    check_proper_path(&new_trigger.base.path)?;
 
     if *CLOUD_HOSTED && !T::IS_ALLOWED_ON_CLOUD {
         return Err(Error::BadRequest(format!(
@@ -817,6 +818,9 @@ async fn update_trigger<T: TriggerCrud>(
             &edit_trigger.base.path
         )
     })?;
+    if edit_trigger.base.path != path {
+        check_proper_path(&edit_trigger.base.path)?;
+    }
 
     edit_trigger.error_handling.validate()?;
 
diff --git a/backend/windmill-trigger/src/trigger_helpers.rs b/backend/windmill-trigger/src/trigger_helpers.rs
index 6a37bd0da1..7e47613d1a 100644
--- a/backend/windmill-trigger/src/trigger_helpers.rs
+++ b/backend/windmill-trigger/src/trigger_helpers.rs
@@ -880,7 +880,8 @@ async fn trigger_script_with_retry_and_error_handler<'c>(
         delete_after_secs,
     );
 
-    check_tag_available_for_workspace(&db, &workspace_id, &tag, &authed).await?;
+    let push_args = PushArgs { args: &args.args, extra: args.extra };
+    check_tag_available_for_workspace(&db, &workspace_id, &tag, &push_args, &authed).await?;
 
     let return_tx = tx_o.is_some();
 
@@ -907,8 +908,6 @@ async fn trigger_script_with_retry_and_error_handler<'c>(
         )
     };
 
-    let push_args = PushArgs { args: &args.args, extra: args.extra };
-
     let retryable_job_payload = match job_payload {
         JobPayload::ScriptHash {
             hash,
diff --git a/backend/windmill-types/src/flow_status.rs b/backend/windmill-types/src/flow_status.rs
index 79890e3c6e..6dff8430b7 100644
--- a/backend/windmill-types/src/flow_status.rs
+++ b/backend/windmill-types/src/flow_status.rs
@@ -41,6 +41,11 @@ pub struct FlowStatus {
     pub chat_input_enabled: Option<bool>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub memory_id: Option<Uuid>,
+    /// Set at push on a branch/loop sub-flow whose enclosing flow had no `flow_env`, own or
+    /// inherited, so the worker can skip the ancestor walk for it. `false` only means unknown:
+    /// the worker then walks the ancestors as usual.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub no_inherited_flow_env: bool,
 }
 
 #[derive(Serialize, Deserialize, Debug, Clone, Default)]
@@ -568,6 +573,7 @@ impl FlowStatus {
             stream_job: None,
             chat_input_enabled: f.chat_input_enabled,
             memory_id: None,
+            no_inherited_flow_env: false,
         }
     }
 
diff --git a/backend/windmill-types/src/jobs.rs b/backend/windmill-types/src/jobs.rs
index 5190efe380..4e0c5340f5 100644
--- a/backend/windmill-types/src/jobs.rs
+++ b/backend/windmill-types/src/jobs.rs
@@ -519,6 +519,8 @@ pub enum JobPayload {
     FlowNode {
         id: FlowNodeId,
         path: String,
+        /// See [`crate::flow_status::FlowStatus::no_inherited_flow_env`].
+        no_inherited_flow_env: bool,
     },
     FlowScript {
         id: FlowNodeId,
diff --git a/backend/windmill-types/src/scripts.rs b/backend/windmill-types/src/scripts.rs
index 9a059da6e8..9e29731505 100644
--- a/backend/windmill-types/src/scripts.rs
+++ b/backend/windmill-types/src/scripts.rs
@@ -507,6 +507,10 @@ pub struct ScriptHistory {
     pub deployment_msg: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub created_at: Option<chrono::DateTime<chrono::Utc>>,
+    /// Who deployed this version — the version picker names it, so a reader can
+    /// tell their own deploys from a teammate's.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub created_by: Option<String>,
 }
 
 #[derive(Deserialize)]
diff --git a/backend/windmill-worker/src/agent_workers.rs b/backend/windmill-worker/src/agent_workers.rs
index 8dccf691fa..e0971c08ce 100644
--- a/backend/windmill-worker/src/agent_workers.rs
+++ b/backend/windmill-worker/src/agent_workers.rs
@@ -64,16 +64,25 @@ pub async fn get_ducklake_from_agent_http(
         .await
 }
 
+/// An agent worker authenticates as infrastructure, not as the job's user, so the job id travels
+/// with the request: the server reads the job's owner from it and evaluates the data table's
+/// tenants against them. A worker predating this sends neither, and the server fails it closed on
+/// a data table under roles.
 #[allow(dead_code)]
 pub async fn get_datatable_resource_from_agent_http(
     client: &HttpClient,
     name: &str,
     w_id: &str,
+    role: Option<&str>,
+    job_id: &uuid::Uuid,
 ) -> anyhow::Result<serde_json::Value> {
+    let role_query = role
+        .map(|r| format!("&role={}", urlencoding::encode(r)))
+        .unwrap_or_default();
     client
         .get(&format!(
-            "/api/w/{}/agent_workers/get_datatable_resource/{}",
-            w_id, &name
+            "/api/w/{}/agent_workers/get_datatable_resource/{}?job_id={}{}",
+            w_id, &name, job_id, role_query
         ))
         .await
 }
diff --git a/backend/windmill-worker/src/ai_executor.rs b/backend/windmill-worker/src/ai_executor.rs
index efc7ffa1b3..3c3a26875b 100644
--- a/backend/windmill-worker/src/ai_executor.rs
+++ b/backend/windmill-worker/src/ai_executor.rs
@@ -79,6 +79,15 @@ lazy_static::lazy_static! {
 const DEFAULT_MAX_AGENT_ITERATIONS: usize = 10;
 const HARD_MAX_AGENT_ITERATIONS: usize = 1000;
 
+/// What a run stopped by `max_iterations` reports back. `Message` rather than
+/// `OpenAIMessage` is load-bearing: `agent_action` is `skip_serializing` on the
+/// latter and reaches JSON only through this wrapper, so serializing these raw
+/// drops every tool name and job id and leaves the partial run unreadable.
+#[derive(serde::Serialize)]
+struct MaxIterPartialResult<'a> {
+    messages: Vec<Message<'a>>,
+}
+
 fn strip_system_messages(messages: &[OpenAIMessage]) -> Vec<OpenAIMessage> {
     messages
         .iter()
@@ -1785,10 +1794,6 @@ pub async fn run_agent(
                         step_id: Option<&'a str>,
                         result: MaxIterPartialResult<'a>,
                     }
-                    #[derive(serde::Serialize)]
-                    struct MaxIterPartialResult<'a> {
-                        messages: &'a [OpenAIMessage],
-                    }
                     return Err(Error::ExecutionRawError(
                         serde_json::value::to_raw_value(&MaxIterError {
                             message: format!(
@@ -1797,7 +1802,15 @@ pub async fn run_agent(
                             ),
                             name: "ExecutionErr",
                             step_id: effective_flow_step_id,
-                            result: MaxIterPartialResult { messages: &messages },
+                            result: MaxIterPartialResult {
+                                messages: messages
+                                    .iter()
+                                    .map(|m| Message {
+                                        message: m,
+                                        agent_action: m.agent_action.as_ref(),
+                                    })
+                                    .collect(),
+                            },
                         })?,
                     ));
                 }
@@ -2322,6 +2335,33 @@ mod tests {
         assert!(!streaming_requested(Some(false)));
     }
 
+    #[test]
+    fn max_iterations_partial_result_keeps_the_action_tags() {
+        let messages = vec![OpenAIMessage {
+            role: "tool".to_string(),
+            content: Some(OpenAIContent::Text("{\"rows\":2}".to_string())),
+            tool_call_id: Some("call_1".to_string()),
+            agent_action: Some(AgentAction::ToolCall {
+                job_id: uuid::Uuid::nil(),
+                function_name: "list_payouts".to_string(),
+                module_id: "b".to_string(),
+            }),
+            ..Default::default()
+        }];
+
+        let partial = MaxIterPartialResult {
+            messages: messages
+                .iter()
+                .map(|m| Message { message: m, agent_action: m.agent_action.as_ref() })
+                .collect(),
+        };
+        let json = serde_json::to_value(&partial).unwrap();
+
+        let action = &json["messages"][0]["agent_action"];
+        assert_eq!(action["type"], "tool_call");
+        assert_eq!(action["function_name"], "list_payouts");
+    }
+
     /// Over 64 characters OpenAI rejects the key outright, which costs a wasted round
     /// trip per run and silently leaves that step with no prompt caching at all.
     #[test]
diff --git a/backend/windmill-worker/src/bun_executor.rs b/backend/windmill-worker/src/bun_executor.rs
index 117fbda086..841ea8861a 100644
--- a/backend/windmill-worker/src/bun_executor.rs
+++ b/backend/windmill-worker/src/bun_executor.rs
@@ -2689,13 +2689,13 @@ try {{
 /// Resolve a module file from the parent script's modules map.
 /// For Script jobs, fetches from the `script` table by hash.
 /// For Preview jobs, fetches from `v2_job.raw_code` (modules stored inline).
-fn resolve_parent_module(
-    modules: &Option<std::collections::HashMap<String, windmill_common::scripts::ScriptModule>>,
+fn resolve_parent_module<'a>(
+    modules: &'a Option<std::collections::HashMap<String, windmill_common::scripts::ScriptModule>>,
     module_key: &str,
-) -> error::Result<windmill_common::scripts::ScriptModule> {
+) -> error::Result<&'a windmill_common::scripts::ScriptModule> {
     if let Some(modules) = modules {
         if let Some(module) = modules.get(module_key) {
-            return Ok(module.clone());
+            return Ok(module);
         }
     }
     Err(error::Error::ExecutionErr(format!(
@@ -2716,7 +2716,7 @@ pub async fn handle_wac_v2_output(
 ) -> error::Result<Box<RawValue>> {
     use crate::wac_executor::{
         load_checkpoint, parse_wac_output, update_checkpoint_for_dispatch,
-        wac_cancelled_mid_segment, WacOutput, WacPark,
+        wac_cancelled_mid_segment, WacOutput, WacPark, WacStepDispatch,
     };
     use serde_json::Value;
     use windmill_common::get_latest_flow_version_info_for_path;
@@ -2724,7 +2724,7 @@ pub async fn handle_wac_v2_output(
     use windmill_common::runnable_settings::{
         ConcurrencySettings, ConcurrencySettingsWithCustom, DebouncingSettings,
     };
-    use windmill_queue::{push, PushArgs, PushIsolationLevel};
+    use windmill_queue::{check_tag_available_for_push, push, PushArgs, PushIsolationLevel};
 
     let output = parse_wac_output(&result)?;
 
@@ -2950,6 +2950,129 @@ pub async fn handle_wac_v2_output(
                 ))),
             }?;
 
+            // Resolve what every task runs, and check any tag it picks, before the parent parks:
+            // a task that cannot be pushed then fails the dispatch with no sibling queued. The
+            // parent's code and input are built per child at push time, so a fan-out never holds
+            // a copy of them for each child at once.
+            enum ChildRunnable<'a> {
+                // Re-runs the parent with `_executing_key`.
+                Parent,
+                // A `./` module of the parent script.
+                Module(&'a windmill_common::scripts::ScriptModule),
+                // A deployed script or flow.
+                Deployed(JobPayload),
+            }
+            struct ResolvedChild<'a> {
+                runnable: ChildRunnable<'a>,
+                email: String,
+                permissioned_as: String,
+            }
+            // The input a task with a runnable of its own is pushed with; the parent re-run gets
+            // the parent's. Both the tag check and the push build it here, so the check resolves
+            // `$args[...]` against what the child actually receives.
+            let own_args = |step: &WacStepDispatch| -> HashMap<String, Box<RawValue>> {
+                step.args
+                    .iter()
+                    .map(|(k, v)| {
+                        let raw = serde_json::value::to_raw_value(v).unwrap();
+                        (k.clone(), raw)
+                    })
+                    .collect()
+            };
+            let mut children: Vec<ResolvedChild> = Vec::with_capacity(num_steps);
+            for step in &steps {
+                let (runnable, on_behalf_of) = match step.dispatch_type.as_str() {
+                    "script" if step.script.starts_with("./") => {
+                        // Module-relative path: resolve from parent script's modules
+                        let module_key = step.script.strip_prefix("./").unwrap();
+                        let module = resolve_parent_module(modules, module_key)?;
+                        // Inline module code, not a separate runnable: it has no
+                        // identity of its own and runs as the parent.
+                        (ChildRunnable::Module(module), None)
+                    }
+                    "script" => {
+                        // Resolve script path to job payload (handles hash, lang, etc.)
+                        let (payload, _, _, _, _, on_behalf_of) = script_path_to_payload(
+                            &step.script,
+                            None, // no authed db for background workers
+                            db.clone(),
+                            &job.workspace_id,
+                            Some(true), // skip preprocessor
+                        )
+                        .await?;
+                        (ChildRunnable::Deployed(payload), on_behalf_of)
+                    }
+                    "flow" => {
+                        let flow_info = get_latest_flow_version_info_for_path(
+                            None,
+                            db,
+                            &job.workspace_id,
+                            &step.script,
+                            true,
+                        )
+                        .await?;
+                        let payload = JobPayload::Flow {
+                            path: step.script.clone(),
+                            dedicated_worker: flow_info.dedicated_worker,
+                            apply_preprocessor: false,
+                            version: flow_info.version,
+                            labels: flow_info.labels.clone(),
+                        };
+                        let on_behalf_of = flow_info.on_behalf_of(&job.workspace_id, db).await?;
+                        (ChildRunnable::Deployed(payload), on_behalf_of)
+                    }
+                    // "inline" — re-run parent with _executing_key
+                    _ => (ChildRunnable::Parent, None),
+                };
+
+                // A target runnable that opts into on-behalf-of runs under its own
+                // identity, never the caller's, so a step that reaches it through a
+                // workflow cannot widen or narrow its permissions. `created_by` still
+                // credits the caller, matching how the run API pushes these jobs.
+                let (email, permissioned_as) = match on_behalf_of {
+                    Some(on_behalf_of) => (on_behalf_of.email, on_behalf_of.permissioned_as),
+                    None => (
+                        job.permissioned_as_email.clone(),
+                        job.permissioned_as.clone(),
+                    ),
+                };
+
+                // A task inheriting the parent's tag skips the check: that tag was
+                // checked when the parent was pushed, and a dedicated worker's tag is
+                // never in CUSTOM_TAGS.
+                if let Some(tag) = step
+                    .tag
+                    .as_deref()
+                    .filter(|t| !t.is_empty() && *t != job.tag.as_str())
+                {
+                    let is_super_admin =
+                        windmill_common::auth::is_super_admin_email(db, &email).await?;
+                    let step_args =
+                        (!matches!(runnable, ChildRunnable::Parent)).then(|| own_args(step));
+                    let args =
+                        PushArgs { args: step_args.as_ref().unwrap_or(&parent_args), extra: None };
+                    check_tag_available_for_push(
+                        db,
+                        &job.workspace_id,
+                        tag,
+                        &args,
+                        is_super_admin,
+                        None,
+                    )
+                    .warn_after_seconds_with_sql(1, "check_tag_available_for_push".to_string())
+                    .await
+                    .map_err(|e| match e {
+                        error::Error::BadRequest(msg) => error::Error::BadRequest(format!(
+                            "task '{}' cannot run on tag '{tag}': {msg}",
+                            step.name
+                        )),
+                        e => e,
+                    })?;
+                }
+
+                children.push(ResolvedChild { runnable, email, permissioned_as });
+            }
+
             // Step 1: Save checkpoint, suspend parent, and seed child checkpoints
             // in a single transaction — all BEFORE children become visible.
             let segment_ms;
@@ -3034,106 +3157,37 @@ pub async fn handle_wac_v2_output(
             // partial failure (e.g. pushing child 3 of 5 fails).
             let mut pushed_ids: Vec<Uuid> = Vec::with_capacity(num_steps);
             let push_result: error::Result<()> = async {
-                for (step, (_, child_uuid)) in steps.iter().zip(job_ids.iter()) {
+                for ((step, (_, child_uuid)), child) in
+                    steps.iter().zip(job_ids.iter()).zip(children)
+                {
                     // A task with a runnable of its own (a deployed script or flow) queues
                     // at that runnable's priority; any other task is the parent's code and
                     // queues at the parent's.
                     let own_runnable = matches!(step.dispatch_type.as_str(), "script" | "flow")
                         && !step.script.starts_with("./");
 
-                    // Resolve job payload based on dispatch_type
-                    let (job_payload, child_args, is_external, on_behalf_of) =
-                        match step.dispatch_type.as_str() {
-                            "script" if step.script.starts_with("./") => {
-                                // Module-relative path: resolve from parent script's modules
-                                let module_key = step.script.strip_prefix("./").unwrap();
-                                let module = resolve_parent_module(modules, module_key)?;
-                                let payload = JobPayload::Code(RawCode {
-                                    content: module.content,
-                                    path: job.runnable_path.clone(),
-                                    hash: None,
-                                    language: module.language,
-                                    lock: module.lock,
-                                    cache_ttl: None,
-                                    cache_ignore_s3_path: None,
-                                    dedicated_worker: None,
-                                    concurrency_settings: ConcurrencySettingsWithCustom::default(),
-                                    debouncing_settings: DebouncingSettings::default(),
-                                    modules: None,
-                                    tag: None,
-                                });
-                                let step_args: HashMap<String, Box<RawValue>> = step
-                                    .args
-                                    .iter()
-                                    .map(|(k, v)| {
-                                        let raw = serde_json::value::to_raw_value(v).unwrap();
-                                        (k.clone(), raw)
-                                    })
-                                    .collect();
-                                // Inline module code, not a separate runnable: it has no
-                                // identity of its own and runs as the parent.
-                                (payload, step_args, true, None)
-                            }
-                            "script" => {
-                                // Resolve script path to job payload (handles hash, lang, etc.)
-                                let (payload, _, _, _, _, on_behalf_of) = script_path_to_payload(
-                                    &step.script,
-                                    None, // no authed db for background workers
-                                    db.clone(),
-                                    &job.workspace_id,
-                                    Some(true), // skip preprocessor
-                                )
-                                .await?;
-                                let step_args: HashMap<String, Box<RawValue>> = step
-                                    .args
-                                    .iter()
-                                    .map(|(k, v)| {
-                                        let raw = serde_json::value::to_raw_value(v).unwrap();
-                                        (k.clone(), raw)
-                                    })
-                                    .collect();
-                                (payload, step_args, true, on_behalf_of)
-                            }
-                            "flow" => {
-                                let flow_info = get_latest_flow_version_info_for_path(
-                                    None,
-                                    db,
-                                    &job.workspace_id,
-                                    &step.script,
-                                    true,
-                                )
-                                .await?;
-                                let payload = JobPayload::Flow {
-                                    path: step.script.clone(),
-                                    dedicated_worker: flow_info.dedicated_worker,
-                                    apply_preprocessor: false,
-                                    version: flow_info.version,
-                                    labels: flow_info.labels.clone(),
-                                };
-                                let on_behalf_of =
-                                    flow_info.on_behalf_of(&job.workspace_id, db).await?;
-                                let step_args: HashMap<String, Box<RawValue>> = step
-                                    .args
-                                    .iter()
-                                    .map(|(k, v)| {
-                                        let raw = serde_json::value::to_raw_value(v).unwrap();
-                                        (k.clone(), raw)
-                                    })
-                                    .collect();
-                                (payload, step_args, true, on_behalf_of)
-                            }
-                            _ => {
-                                // "inline" — re-run parent with _executing_key
-                                (
-                                    job_payload_template.clone(),
-                                    parent_args.clone(),
-                                    false,
-                                    None,
-                                )
-                            }
-                        };
-
-                    let push_args = PushArgs { args: &child_args, extra: None };
+                    let is_external = !matches!(child.runnable, ChildRunnable::Parent);
+                    let job_payload = match child.runnable {
+                        ChildRunnable::Parent => job_payload_template.clone(),
+                        ChildRunnable::Module(module) => JobPayload::Code(RawCode {
+                            content: module.content.clone(),
+                            path: job.runnable_path.clone(),
+                            hash: None,
+                            language: module.language,
+                            lock: module.lock.clone(),
+                            cache_ttl: None,
+                            cache_ignore_s3_path: None,
+                            dedicated_worker: None,
+                            concurrency_settings: ConcurrencySettingsWithCustom::default(),
+                            debouncing_settings: DebouncingSettings::default(),
+                            modules: None,
+                            tag: None,
+                        }),
+                        ChildRunnable::Deployed(payload) => payload,
+                    };
+                    let step_args = is_external.then(|| own_args(step));
+                    let push_args =
+                        PushArgs { args: step_args.as_ref().unwrap_or(&parent_args), extra: None };
 
                     // Apply step-level overrides to payload (cache, concurrency)
                     let mut job_payload = job_payload;
@@ -3181,21 +3235,6 @@ pub async fn handle_wac_v2_output(
                         }
                     }
 
-                    // A target runnable that opts into on-behalf-of runs under its own
-                    // identity, never the caller's, so a step that reaches it through a
-                    // workflow cannot widen or narrow its permissions. `created_by` still
-                    // credits the caller, matching how the run API pushes these jobs.
-                    let (child_email, child_permissioned_as) = match on_behalf_of.as_ref() {
-                        Some(on_behalf_of) => (
-                            on_behalf_of.email.as_str(),
-                            on_behalf_of.permissioned_as.clone(),
-                        ),
-                        None => (
-                            job.permissioned_as_email.as_str(),
-                            job.permissioned_as.clone(),
-                        ),
-                    };
-
                     let (_, mut tx) = push(
                         db,
                         PushIsolationLevel::IsolatedRoot(db.clone()),
@@ -3203,8 +3242,8 @@ pub async fn handle_wac_v2_output(
                         job_payload,
                         push_args,
                         &job.created_by,
-                        child_email,
-                        child_permissioned_as,
+                        &child.email,
+                        child.permissioned_as,
                         None,
                         None,
                         None,
diff --git a/backend/windmill-worker/src/duckdb_executor.rs b/backend/windmill-worker/src/duckdb_executor.rs
index b2e69d26d6..aecdb738b3 100644
--- a/backend/windmill-worker/src/duckdb_executor.rs
+++ b/backend/windmill-worker/src/duckdb_executor.rs
@@ -13,8 +13,8 @@ use windmill_common::error::{to_anyhow, Error, Result};
 use windmill_common::utils::sanitize_string_from_password;
 use windmill_common::worker::{get_memory, to_raw_value, Connection, SqlResultCollectionStrategy};
 use windmill_common::workspaces::{
-    get_datatable_resource_from_db_unchecked, get_ducklake_from_db_unchecked,
-    strip_fork_reserved_attach_args, DucklakeCatalogResourceType,
+    get_datatable_resource_from_db, get_ducklake_from_db_unchecked,
+    strip_fork_reserved_attach_args, DatatableAccess, DucklakeCatalogResourceType,
 };
 use windmill_common::PgDatabase;
 use windmill_object_store::S3_PROXY_LAST_ERRORS_CACHE;
@@ -1494,13 +1494,9 @@ pub async fn do_duckdb(
                 .await?
                 {
                     probe_blocks.extend(q);
-                } else if let Some(q) = transform_attach_datatable(
-                    &query_block,
-                    conn,
-                    &mut hidden_passwords,
-                    &job.workspace_id,
-                )
-                .await?
+                } else if let Some(q) =
+                    transform_attach_datatable(&query_block, conn, &mut hidden_passwords, job)
+                        .await?
                 {
                     probe_blocks.extend(q);
                 } else {
@@ -1575,13 +1571,9 @@ pub async fn do_duckdb(
                 .await?
                 {
                     v.extend(ducklake_query);
-                } else if let Some(datatable_query) = transform_attach_datatable(
-                    &query_block,
-                    conn,
-                    &mut hidden_passwords,
-                    &job.workspace_id,
-                )
-                .await?
+                } else if let Some(datatable_query) =
+                    transform_attach_datatable(&query_block, conn, &mut hidden_passwords, job)
+                        .await?
                 {
                     v.extend(datatable_query);
                 } else {
@@ -2609,33 +2601,79 @@ fn fork_defer_statements(
     Ok(stmts)
 }
 
+struct AttachedDatatable<'a> {
+    /// The data table reference, query string included; a bare `datatable` is `main`.
+    reference: String,
+    alias: &'a str,
+}
+
+/// `ATTACH 'datatable[://<name>][?role=<role>]' AS <alias>`. A bare `datatable` names the default
+/// data table, so the role query string has to be accepted with and without an explicit name. The
+/// reference is split only once the workspace can be read, because a stored name may contain `?`.
+fn parse_attach_datatable(query: &str) -> Option<AttachedDatatable<'_>> {
+    lazy_static::lazy_static! {
+        static ref RE: regex::Regex = regex::Regex::new(
+            r"(?i)ATTACH\s*'datatable(://[^':]+|\?[^':]*)?'\s*AS\s+([^ ;]+)"
+        ).unwrap();
+    }
+    let cap = RE.captures(query)?;
+    let reference = match cap.get(1).map(|m| m.as_str()) {
+        Some(named) if named.starts_with("://") => named[3..].to_string(),
+        Some(query) => format!("main{query}"),
+        None => "main".to_string(),
+    };
+    let alias = cap.get(2).map(|m| m.as_str()).unwrap_or("");
+    Some(AttachedDatatable { reference, alias })
+}
+
 async fn transform_attach_datatable(
     query: &str,
     conn: &Connection,
     hidden_passwords: &mut Arc<Mutex<Vec<String>>>,
-    w_id: &str,
+    job: &MiniPulledJob,
 ) -> Result<Option<Vec<String>>> {
-    lazy_static::lazy_static! {
-        static ref RE: regex::Regex = regex::Regex::new(r"(?i)ATTACH\s*'datatable(://[^':]+)?'\s*AS\s+([^ ;]+)").unwrap();
-    }
-    let Some(cap) = RE.captures(query) else {
+    let Some(attached) = parse_attach_datatable(query) else {
         return Ok(None);
     };
-    let name = cap.get(1).map(|m| &m.as_str()[3..]).unwrap_or("main");
-    let alias_name = cap.get(2).map(|m| m.as_str()).unwrap_or("");
 
+    // A query string that does not parse is refused rather than dropped: attaching under the
+    // default role when the statement asked for another one is the failure this guards.
     let db_resource = match conn {
         Connection::Http(client) => {
-            get_datatable_resource_from_agent_http(client, name, w_id).await?
+            let (name, role) =
+                windmill_common::workspaces::parse_datatable_ref(&attached.reference)?;
+            get_datatable_resource_from_agent_http(client, name, &job.workspace_id, role, &job.id)
+                .await?
+        }
+        Connection::Sql(db) => {
+            let (name, role) = windmill_common::workspaces::parse_datatable_ref_for(
+                db,
+                &job.workspace_id,
+                &attached.reference,
+            )
+            .await?;
+            get_datatable_resource_from_db(
+                db,
+                &job.workspace_id,
+                &name,
+                role.as_deref(),
+                DatatableAccess::PermissionedAs {
+                    permissioned_as: &job.permissioned_as,
+                    email: &job.permissioned_as_email,
+                },
+            )
+            .await?
         }
-        Connection::Sql(db) => get_datatable_resource_from_db_unchecked(db, w_id, name).await?,
     };
 
     if let Some(pwd) = db_resource.get("password").and_then(|p| p.as_str()) {
         hidden_passwords.lock().unwrap().push(pwd.to_string());
     }
 
-    Ok(Some(pg_secret_attach_statements(db_resource, alias_name)?))
+    Ok(Some(pg_secret_attach_statements(
+        db_resource,
+        attached.alias,
+    )?))
 }
 
 // Secret names must be plain identifiers; the hash keeps two aliases distinct even
@@ -2680,6 +2718,11 @@ fn pg_secret_attach_statements(db_resource: Value, alias_name: &str) -> Result<V
             esc(res.password.as_deref().unwrap_or("")),
         ),
         format!("ATTACH 'sslmode={sslmode}' AS {alias_name} (TYPE postgres, SECRET {secret_name});"),
+        // The attachment keeps its own resolved connection string, so the secret is dead weight
+        // once attached — and a live one is a credential the script's own statements can name: an
+        // `ATTACH 'dbname=<other>' (TYPE postgres, SECRET …)` would reach a database nobody
+        // authorized this job for, as this role.
+        format!("DROP TEMPORARY SECRET {secret_name};"),
     ])
 }
 
@@ -2753,6 +2796,45 @@ pub struct Arg {
 mod tests {
     use super::*;
 
+    #[test]
+    fn attach_datatable_parses_name_and_role() {
+        let reference_of = |q: &str| parse_attach_datatable(q).unwrap().reference;
+        let named =
+            parse_attach_datatable("ATTACH 'datatable://sales?role=analytics' AS dt").unwrap();
+        assert_eq!(
+            (named.reference.as_str(), named.alias),
+            ("sales?role=analytics", "dt")
+        );
+        // A bare `datatable` is the default one, and still takes a role.
+        assert_eq!(
+            reference_of("ATTACH 'datatable?role=analytics' AS dt"),
+            "main?role=analytics"
+        );
+        assert_eq!(reference_of("ATTACH 'datatable://sales' AS dt"), "sales");
+        assert_eq!(reference_of("ATTACH 'datatable' AS dt"), "main");
+        assert!(parse_attach_datatable("SELECT 1").is_none());
+        // A stored name can contain `?`, so that is left to the workspace lookup to split.
+        assert_eq!(reference_of("ATTACH 'datatable://a?b' AS dt"), "a?b");
+
+        // The key matches case-insensitively, as the `-- role` annotation does, and a query string
+        // that does not parse is refused rather than attached under the default role.
+        let parse = |q: &str| {
+            windmill_common::workspaces::parse_datatable_ref(&reference_of(q))
+                .map(|(name, role)| (name.to_string(), role.map(str::to_string)))
+        };
+        assert_eq!(
+            parse("ATTACH 'datatable://sales?Role=analytics' AS dt").unwrap(),
+            ("sales".to_string(), Some("analytics".to_string()))
+        );
+        for malformed in [
+            "ATTACH 'datatable://sales?role=' AS dt",
+            "ATTACH 'datatable://sales?role=an;alytics' AS dt",
+            "ATTACH 'datatable://sales?x=1&role=analytics' AS dt",
+        ] {
+            assert!(parse(malformed).is_err(), "silently ignored: {malformed}");
+        }
+    }
+
     #[test]
     fn decode_ffi_error_unescapes_multiline_and_strips_quotes() {
         // Mirror the FFI: JSON-encode the raw DuckDB message, prefix "ERROR ".
@@ -3868,6 +3950,8 @@ mod tests {
             stmts[3],
             format!("ATTACH 'sslmode=require' AS dt (TYPE postgres, SECRET {secret_name});")
         );
+        assert_eq!(stmts[4], format!("DROP TEMPORARY SECRET {secret_name};"));
+        assert_eq!(stmts.len(), 5);
     }
 
     #[test]
diff --git a/backend/windmill-worker/src/pg_executor.rs b/backend/windmill-worker/src/pg_executor.rs
index 1413924bf3..69aa3ee0fb 100644
--- a/backend/windmill-worker/src/pg_executor.rs
+++ b/backend/windmill-worker/src/pg_executor.rs
@@ -26,9 +26,11 @@ use windmill_common::azure_workload_identity::WORKLOAD_IDENTITY_PASSWORD;
 use windmill_common::error::to_anyhow;
 use windmill_common::error::{self, Error};
 use windmill_common::worker::{
-    to_raw_value, Connection, SqlResultCollectionStrategy, CLOUD_HOSTED,
+    to_raw_value, Connection, SqlAnnotations, SqlResultCollectionStrategy, CLOUD_HOSTED,
+};
+use windmill_common::workspaces::{
+    get_datatable_resource_from_db, parse_datatable_ref, parse_datatable_ref_for, DatatableAccess,
 };
-use windmill_common::workspaces::get_datatable_resource_from_db_unchecked;
 use windmill_common::{PgDatabase, PrepareQueryColumnInfo, PrepareQueryResult, DB};
 use windmill_parser::{Arg, Typ};
 use windmill_parser_sql::{
@@ -680,15 +682,36 @@ pub async fn do_postgresql(
     } else {
         match pg_args.get("database").cloned() {
             Some(Value::String(db_str)) if db_str.starts_with("datatable://") => {
-                let db_str = db_str.trim_start_matches("datatable://");
+                let reference = db_str.trim_start_matches("datatable://");
+                // The annotation wins: a generated query can carry a `?role=` in the reference it
+                // was handed, but only the script's author writes the leading comment block.
+                let annotated = SqlAnnotations::datatable_role(&query)?;
                 Some(match conn {
                     Connection::Http(client) => {
-                        get_datatable_resource_from_agent_http(client, &db_str, &job.workspace_id)
-                            .await?
+                        let (name, uri_role) = parse_datatable_ref(reference)?;
+                        get_datatable_resource_from_agent_http(
+                            client,
+                            name,
+                            &job.workspace_id,
+                            annotated.as_deref().or(uri_role),
+                            &job.id,
+                        )
+                        .await?
                     }
                     Connection::Sql(db) => {
-                        get_datatable_resource_from_db_unchecked(db, &job.workspace_id, &db_str)
-                            .await?
+                        let (name, uri_role) =
+                            parse_datatable_ref_for(db, &job.workspace_id, reference).await?;
+                        get_datatable_resource_from_db(
+                            db,
+                            &job.workspace_id,
+                            &name,
+                            annotated.as_deref().or(uri_role.as_deref()),
+                            DatatableAccess::PermissionedAs {
+                                permissioned_as: &job.permissioned_as,
+                                email: &job.permissioned_as_email,
+                            },
+                        )
+                        .await?
                     }
                 })
             }
diff --git a/backend/windmill-worker/src/worker.rs b/backend/windmill-worker/src/worker.rs
index 56b4b26fb0..55a698a9dd 100644
--- a/backend/windmill-worker/src/worker.rs
+++ b/backend/windmill-worker/src/worker.rs
@@ -3859,8 +3859,6 @@ pub async fn run_worker(
 
                     let arc_job = Arc::new(job);
 
-                    windmill_common::sensitive_log_masks::register_running_job(arc_job.id);
-
                     let span = create_span_with_name(&arc_job, &worker_name, Some(hostname), "job");
                     let log_ctx = log_context_for_job(&arc_job, &worker_name, Some(hostname));
 
@@ -3976,8 +3974,6 @@ pub async fn run_worker(
                         _ => {}
                     }
 
-                    windmill_common::sensitive_log_masks::unregister_running_job(job_id);
-
                     #[cfg(feature = "prometheus")]
                     if let Some(duration) = _timer.map(|x| x.stop_and_record()) {
                         register_metric(
@@ -4512,6 +4508,30 @@ async fn detect_and_store_runtime_assets_from_job_args(
     }
 }
 
+/// Holds a job's entry in the log-masking registry for as long as it executes, so
+/// that secrets it fetches can be registered against it, and masks the job's own
+/// token from the start: `$WM_TOKEN` stays valid well past the run, and a script
+/// that echoes it would otherwise leave a live credential in the persisted logs.
+///
+/// Lives here rather than at the call sites so that every way of running a job —
+/// the poller, the interactive worker shell, an inline AI agent tool — is covered
+/// by construction.
+struct RunningJobMasks(Uuid);
+
+impl RunningJobMasks {
+    fn register(job_id: Uuid, token: &str) -> Self {
+        windmill_common::sensitive_log_masks::register_running_job(job_id);
+        windmill_common::sensitive_log_masks::register_secret_for_job(job_id, token);
+        RunningJobMasks(job_id)
+    }
+}
+
+impl Drop for RunningJobMasks {
+    fn drop(&mut self) {
+        windmill_common::sensitive_log_masks::unregister_running_job(self.0);
+    }
+}
+
 pub async fn handle_queued_job(
     job: Arc<MiniPulledJob>,
     raw_code: Option<String>,
@@ -4533,6 +4553,8 @@ pub async fn handle_queued_job(
     flow_runners: Option<Arc<FlowRunners>>,
     #[cfg(feature = "benchmark")] _bench: &mut BenchmarkIter,
 ) -> windmill_common::error::Result<JobOutcome> {
+    let _masks = RunningJobMasks::register(job.id, &client.token);
+
     if job.canceled_by.is_some() {
         return Err(Error::JsonErr(canceled_job_to_result(&job)));
     }
diff --git a/backend/windmill-worker/src/worker_flow.rs b/backend/windmill-worker/src/worker_flow.rs
index 6c0dcaf279..6e01378448 100644
--- a/backend/windmill-worker/src/worker_flow.rs
+++ b/backend/windmill-worker/src/worker_flow.rs
@@ -44,8 +44,7 @@ use windmill_common::flow_status::{
 };
 use windmill_common::flows::{add_virtual_items_if_necessary, Branch, FlowNodeId, StopAfterIf};
 use windmill_common::jobs::{
-    check_tag_available_for_workspace_internal, script_path_to_payload, JobKind, JobPayload,
-    OnBehalfOf, RawCode, ENTRYPOINT_OVERRIDE,
+    script_path_to_payload, JobKind, JobPayload, OnBehalfOf, RawCode, ENTRYPOINT_OVERRIDE,
 };
 use windmill_common::runnable_settings::{
     ConcurrencySettingsWithCustom, DebouncingSettings, RunnableSettingsTrait,
@@ -68,11 +67,12 @@ use windmill_common::{
 };
 use windmill_queue::schedule::get_schedule_opt;
 use windmill_queue::{
-    add_completed_job, add_completed_job_error, append_logs, get_mini_pulled_job,
-    insert_concurrency_key_capped, interpolate_args,
-    report_error_to_workspace_handler_or_critical_side_channel, tag_reads_args,
-    try_schedule_next_job, CanceledBy, FlowRunners, MiniCompletedJob, MiniPulledJob, PushArgs,
-    PushIsolationLevel, SameWorkerPayload, WrappedError,
+    add_completed_job, add_completed_job_error, append_logs,
+    check_tag_written_as_available_for_push, get_mini_pulled_job, insert_concurrency_key_capped,
+    render_tag_path, report_error_to_workspace_handler_or_critical_side_channel, resolve_push_tag,
+    tag_reads_args, tag_reads_flow_expr, try_schedule_next_job, CanceledBy, FlowRunners,
+    MiniCompletedJob, MiniPulledJob, PushArgs, PushIsolationLevel, SameWorkerPayload, WrappedError,
+    RE_FLOW_EXPR_TAG,
 };
 
 use windmill_audit::audit_oss::audit_log;
@@ -537,15 +537,22 @@ pub async fn update_flow_status_after_job_completion_internal(
             if let Some(cached) = RESOLVED_FLOW_ENV_CACHE.get(&flow) {
                 Some(cached)
             } else {
-                resolve_flow_env_for_status_update(db, client, flow, w_id, flow_value)
-                    .await
-                    .map(|(env, is_cacheable)| {
-                        let arc = Arc::new(env);
-                        if is_cacheable {
-                            RESOLVED_FLOW_ENV_CACHE.insert(flow, arc.clone());
-                        }
-                        arc
-                    })
+                resolve_flow_env_for_status_update(
+                    db,
+                    client,
+                    flow,
+                    w_id,
+                    flow_value,
+                    old_status.no_inherited_flow_env,
+                )
+                .await
+                .map(|(env, is_cacheable)| {
+                    let arc = Arc::new(env);
+                    if is_cacheable {
+                        RESOLVED_FLOW_ENV_CACHE.insert(flow, arc.clone());
+                    }
+                    arc
+                })
             }
         } else {
             None
@@ -1520,15 +1527,6 @@ pub async fn update_flow_status_after_job_completion_internal(
                         .is_some_and(|ck| ck.contains("$args"))
             });
             let require_args = concurrency_requires_args || has_debouncing;
-            let mut tag = tag_and_concurrency_key.as_ref().and_then(|x| x.tag.clone());
-            // `$workspace` does not depend on the preprocessor's output, so it has to resolve even
-            // when nothing forced us to fetch args. Leaving it to the `$args` branch below writes a
-            // `$workspace`-only tag back verbatim, naming a queue no worker serves.
-            if let Some(t) = tag.as_ref().filter(|t| t.contains("$workspace")) {
-                let tag_ws =
-                    windmill_queue::tags::tag_workspace_id(&flow_job.workspace_id, db).await;
-                tag = Some(t.replace("$workspace", &tag_ws));
-            }
             let concurrency_key = tag_and_concurrency_key
                 .as_ref()
                 .and_then(|x| x.concurrency_key.clone());
@@ -1576,10 +1574,6 @@ pub async fn update_flow_status_after_job_completion_internal(
                     )
                     .await?;
                 }
-                if let Some(t) = tag {
-                    // `$workspace` is already resolved above; this fills in `$args`.
-                    tag = Some(interpolate_args(t, &args, &flow_job.workspace_id));
-                }
             } else if concurrent_limit.is_some() {
                 insert_concurrency_key_capped(
                     &flow_job.workspace_id,
@@ -1594,6 +1588,23 @@ pub async fn update_flow_status_after_job_completion_internal(
                 .await?;
             }
 
+            // Resolved as `push` resolves a tag, so a `$flow_expr[...]` or empty one comes out as
+            // `None` and the job keeps its current tag instead of queueing on the literal text.
+            let tag = match tag_and_concurrency_key
+                .as_ref()
+                .and_then(|x| x.tag.as_deref())
+            {
+                // `run_flow` checked this tag for whoever ran the flow, an `$args[...]` in it as
+                // written since only this point knows its values: an entry admitting it as
+                // written admits every value here.
+                Some(t) => {
+                    let no_args = HashMap::new();
+                    let args = PushArgs::from(fetched_args.as_ref().unwrap_or(&no_args));
+                    resolve_push_tag(t, &args, &flow_job.workspace_id, db).await
+                }
+                None => None,
+            };
+
             let scheduled_for: Option<chrono::DateTime<chrono::Utc>> = {
                 #[cfg(feature = "private")]
                 {
@@ -2517,6 +2528,7 @@ async fn resolve_flow_env_for_status_update(
     flow_job_id: Uuid,
     workspace_id: &str,
     flow_value: &FlowValue,
+    no_inherited_flow_env: bool,
 ) -> Option<(HashMap<String, Box<RawValue>>, bool)> {
     // Fetch the env source. For the inherited path, we first need to know whether the
     // flow even has a parent — `fetch_root_flow_env` runs a recursive CTE on `v2_job`
@@ -2525,6 +2537,8 @@ async fn resolve_flow_env_for_status_update(
     let (env, mini): (HashMap<String, Box<RawValue>>, Option<MiniPulledJob>) =
         if let Some(ref e) = flow_value.flow_env {
             (e.clone(), None)
+        } else if no_inherited_flow_env {
+            return None;
         } else {
             let mini = match get_mini_pulled_job(db, &flow_job_id).await {
                 Ok(Some(j)) => j,
@@ -2538,7 +2552,13 @@ async fn resolve_flow_env_for_status_update(
                 // No own flow_env and no parent to inherit from — nothing to resolve.
                 return None;
             }
-            let env = fetch_root_flow_env(db, flow_job_id, workspace_id).await?;
+            let env = match fetch_root_flow_env(db, flow_job_id, workspace_id).await {
+                Ok(env) => env?,
+                Err(e) => {
+                    tracing::warn!("Failed to look up the inherited flow_env: {e:#}");
+                    return None;
+                }
+            };
             (env, Some(mini))
         };
     if env.is_empty() {
@@ -2604,7 +2624,7 @@ async fn fetch_root_flow_env(
     db: &DB,
     flow_job_id: Uuid,
     workspace_id: &str,
-) -> Option<HashMap<String, Box<RawValue>>> {
+) -> Result<Option<HashMap<String, Box<RawValue>>>, sqlx::Error> {
     sqlx::query_scalar!(
         r#"WITH RECURSIVE chain(id, parent_job, flow_innermost_root_job, runnable_id, runnable_path, raw_flow, depth) AS (
             SELECT id, parent_job, flow_innermost_root_job, runnable_id, runnable_path, raw_flow, 0
@@ -2641,10 +2661,7 @@ async fn fetch_root_flow_env(
     )
     .fetch_optional(db)
     .await
-    .ok()
-    .flatten()
-    .flatten()
-    .map(|json| json.0)
+    .map(|row| row.flatten().map(|json| json.0))
 }
 
 struct FailureContext {
@@ -2789,18 +2806,31 @@ pub async fn handle_flow(
 ) -> anyhow::Result<()> {
     let flow = flow_data.value();
 
+    let status = flow_job
+        .parse_flow_status()
+        .with_context(|| "Unable to parse flow status")?;
+
     // Sub-flows spawned by `payload_from_modules` for branches/loops don't
     // carry the parent's `flow_env` in their own FlowValue. Fall back to the
     // nearest enclosing scope's `flow_env` so predicates like `skip_if`,
     // `stop_after_if`, and branch conditions see the same env as input
     // transforms.
-    let inherited_env: Option<HashMap<String, Box<RawValue>>> =
-        if flow.flow_env.is_none() && flow_job.parent_job.is_some() {
-            fetch_root_flow_env(db, flow_job.id, &flow_job.workspace_id).await
-        } else {
-            None
-        };
+    let (inherited_env, inherited_env_known) = if flow.flow_env.is_none()
+        && flow_job.parent_job.is_some()
+        && !status.no_inherited_flow_env
+    {
+        match fetch_root_flow_env(db, flow_job.id, &flow_job.workspace_id).await {
+            Ok(env) => (env, true),
+            Err(e) => {
+                tracing::warn!("Failed to look up the inherited flow_env: {e:#}");
+                (None, false)
+            }
+        }
+    } else {
+        (None, true)
+    };
     let env_source = flow.flow_env.as_ref().or(inherited_env.as_ref());
+    let no_flow_env = inherited_env_known && env_source.is_none_or(|e| e.is_empty());
 
     // Resolve $var: and $res: references in flow_env.
     // We resolve into a separate variable to avoid cloning the entire FlowValue
@@ -2846,10 +2876,6 @@ pub async fn handle_flow(
         }
     }
 
-    let status = flow_job
-        .parse_flow_status()
-        .with_context(|| "Unable to parse flow status")?;
-
     let schedule_path = flow_job.schedule_path();
     if !flow_job.is_flow_step()
         && status.retry.fail_count == 0
@@ -2993,6 +3019,7 @@ pub async fn handle_flow(
             status,
             flow,
             flow_env,
+            no_flow_env,
             db,
             client,
             last_result.clone(),
@@ -3115,6 +3142,66 @@ fn resolve_flow_step_tag(
     }
 }
 
+/// Resolves each `$flow_expr[root.key.path]` of a step tag by reading `key.path` from `results`
+/// (where `key` is a step id), `flow_input` or `flow_env`, rendered as `$args[key.path]` would be.
+async fn interpolate_flow_expr_tag(
+    tag: &str,
+    db: &DB,
+    flow_job: &MiniPulledJob,
+    flow_input: &HashMap<String, Box<RawValue>>,
+    flow_env: Option<&HashMap<String, Box<RawValue>>>,
+) -> error::Result<String> {
+    if RE_FLOW_EXPR_TAG
+        .replace_all(tag, "")
+        .contains("$flow_expr[")
+    {
+        return Err(Error::ExecutionErr(format!(
+            "Could not resolve the step tag `{tag}`: each `$flow_expr[...]` must hold a dotted \
+             path such as `results.a.b.c`"
+        )));
+    }
+    let mut rendered: HashMap<&str, String> = HashMap::new();
+    for cap in RE_FLOW_EXPR_TAG.captures_iter(tag) {
+        let path = cap.get(1).unwrap().as_str();
+        if rendered.contains_key(path) {
+            continue;
+        }
+        let (root, key_path) = path.split_once('.').unwrap_or((path, ""));
+        let (key, rest) = key_path.split_once('.').unwrap_or((key_path, ""));
+        if key.is_empty() || !matches!(root, "results" | "flow_input" | "flow_env") {
+            return Err(Error::ExecutionErr(format!(
+                "Could not resolve the step tag `{tag}`: `{path}` must start with \
+                 `results.<step_id>`, `flow_input.<key>` or `flow_env.<key>`"
+            )));
+        }
+        let value = match root {
+            "flow_input" => render_tag_path(flow_input.get(key).map(|x| &**x), rest),
+            "flow_env" => render_tag_path(flow_env.and_then(|e| e.get(key)).map(|x| &**x), rest),
+            _ => match windmill_queue::get_result_by_id(
+                db.clone(),
+                flow_job.workspace_id.clone(),
+                flow_job.id,
+                key.to_string(),
+                None,
+            )
+            .await
+            {
+                Ok(result) => render_tag_path(Some(&*result), rest),
+                Err(Error::NotFound(_)) => String::new(),
+                Err(e) => {
+                    return Err(Error::ExecutionErr(format!(
+                        "Could not resolve the step tag `{tag}`: {e}"
+                    )))
+                }
+            },
+        };
+        rendered.insert(path, value);
+    }
+    Ok(RE_FLOW_EXPR_TAG
+        .replace_all(tag, |cap: &regex::Captures| rendered[&cap[1]].clone())
+        .into_owned())
+}
+
 #[cfg(test)]
 mod tag_resolution_tests {
     use super::resolve_flow_step_tag;
@@ -3176,6 +3263,8 @@ async fn push_next_flow_job(
     mut status: FlowStatus,
     flow: &FlowValue,
     flow_env: Option<&HashMap<String, Box<RawValue>>>,
+    // Neither this flow nor any ancestor defines `flow_env`.
+    no_flow_env: bool,
     db: &sqlx::Pool<sqlx::Postgres>,
     client: &AuthedClient,
     last_job_result: Option<Arc<Box<RawValue>>>,
@@ -4165,7 +4254,14 @@ async fn push_next_flow_job(
 
     let mut tx = db.begin().warn_after_seconds(3).await?;
     let nargs = args.as_ref();
-    for (i, payload_tag) in job_payloads.into_iter().enumerate() {
+    for (i, mut payload_tag) in job_payloads.into_iter().enumerate() {
+        // A `FlowNode` here is a branch/loop sub-flow from `payload_from_modules`: it never defines
+        // its own `flow_env`, so it inherits exactly this flow's. The mark lives in the child's
+        // status, not its definition: a `RawFlow` child's stored definition is replayed by nested
+        // restarts, whose root may have gained a `flow_env` since.
+        if let JobPayload::FlowNode { no_inherited_flow_env, .. } = &mut payload_tag.payload {
+            *no_inherited_flow_env = no_flow_env;
+        }
         if i % 100 == 0 && i != 0 {
             tracing::info!(id = %flow_job.id, root_id = %job_root, "pushed (non-commited yet) first {i} subflows of {len}");
             // Ping on the pool, outside `tx`, so the zombie flow monitor sees it before the
@@ -4193,6 +4289,10 @@ async fn push_next_flow_job(
             None
         };
 
+        // The `flow_input` the step's input transforms read, which a `$flow_expr[flow_input...]`
+        // tag must read too: the body of a simple for-loop also sees `iter` there.
+        let mut step_flow_input = arc_flow_job_args.clone();
+
         let marc;
         let me;
         let args = match &next_status {
@@ -4217,8 +4317,10 @@ async fn push_next_flow_job(
                 if let Some(input_transforms) = simple_input_transforms {
                     //previous id is none because we do not want to use previous id if we are in a for loop
                     let ctx = get_transform_context(&flow_job, "", &status);
+                    let args = Marc::new(args);
+                    step_flow_input = args.clone();
                     let ti = transform_input(
-                        Marc::new(args),
+                        args,
                         flow_env,
                         arc_last_job_result.clone(),
                         input_transforms,
@@ -4397,17 +4499,21 @@ async fn push_next_flow_job(
             payload_tag.tag.as_deref(),
         );
 
-        // `push_args` is empty once the input transforms failed, so a tag reading `$args[...]`
-        // interpolates to a queue nobody serves and the step sits there instead of reporting
-        // the error. Send it to the flow's tag, which a worker is provably serving right now.
+        // A step whose inputs failed to evaluate, or whose `$flow_expr[...]` tag failed to resolve,
+        // is pushed only to report the error, and a computed tag can then name a queue nobody
+        // serves (`push_args` is empty, so `$args[...]` reads nothing), leaving the step stuck
+        // instead. Send it to the flow's tag, which a worker is provably serving right now.
         //
         // A step handed over by id, or one whose tag `push` replaces, never reaches a worker
         // through its tag, so rewriting theirs would be noise.
         let step_is_pulled_by_tag = !continue_on_same_worker
             && !continue_with_runners
             && !payload_tag.payload.is_dedicated_worker();
-        let reroute_to_flow_tag =
-            err.is_some() && step_is_pulled_by_tag && tag.as_deref().is_some_and(tag_reads_args);
+        let reroute_to_flow_tag = err.is_some()
+            && step_is_pulled_by_tag
+            && tag
+                .as_deref()
+                .is_some_and(|t| tag_reads_args(t) || tag_reads_flow_expr(t));
         let tag = if reroute_to_flow_tag {
             Some(flow_job.tag.clone())
         } else {
@@ -4424,8 +4530,32 @@ async fn push_next_flow_job(
             )
         };
 
-        // Check tag availability for flow substeps to prevent abuse.
-        // Skip when the substep inherits the parent flow's tag: that tag was already
+        let written_tag = tag.clone();
+        let mut tag_err = None;
+        let tag = match tag {
+            Some(t) if err.is_none() && tag_reads_flow_expr(&t) => {
+                match interpolate_flow_expr_tag(&t, db, &flow_job, &step_flow_input, flow_env)
+                    .warn_after_seconds(3)
+                    .await
+                {
+                    Ok(resolved) => Some(resolved),
+                    Err(e) => {
+                        tag_err = Some(e);
+                        Some(if step_is_pulled_by_tag {
+                            flow_job.tag.clone()
+                        } else {
+                            t
+                        })
+                    }
+                }
+            }
+            t => t,
+        };
+        let err = err.or(tag_err.as_ref());
+
+        // Check tag availability for flow substeps to prevent abuse. It runs on the tag with its
+        // `$flow_expr[...]` filled in, as `push` fills in the rest, since that is what picks the
+        // queue. Skip when the substep inherits the parent flow's tag: that tag was already
         // validated at flow push time, and for dedicated flows it is the auto-generated
         // `{workspace_id}:flow/{path}` tag which is never in CUSTOM_TAGS.
         if let Some(tag_str) = tag
@@ -4435,17 +4565,16 @@ async fn push_next_flow_job(
             // A step with its own on-behalf-of carries a cached dispatch address, up to one
             // notify poll stale; accepted, see `get_email_from_permissioned_as`.
             let is_super_admin = windmill_common::auth::is_super_admin_email(db, email).await?;
-            check_tag_available_for_workspace_internal(
+            check_tag_written_as_available_for_push(
                 db,
                 &flow_job.workspace_id,
+                written_tag.as_deref().unwrap_or(tag_str),
                 tag_str,
+                &push_args,
                 is_super_admin,
                 None, // no token for flow substeps so no scopes so no scope_tags
             )
-            .warn_after_seconds_with_sql(
-                1,
-                "check_tag_available_for_workspace_internal".to_string(),
-            )
+            .warn_after_seconds_with_sql(1, "check_tag_available_for_push".to_string())
             .await?;
         }
 
@@ -5121,7 +5250,7 @@ fn payload_from_modules<'a>(
     }
 
     if let Some(id) = modules_node {
-        return Some(JobPayload::FlowNode { id, path: path() });
+        return Some(JobPayload::FlowNode { id, path: path(), no_inherited_flow_env: false });
     }
 
     add_virtual_items_if_necessary(&mut modules);
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index 55735ed9fd..1e6cfdd474 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.814.0";
+export const VERSION = "v1.817.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/benchmarks/pulumi/package-lock.json b/benchmarks/pulumi/package-lock.json
deleted file mode 100644
index ddd1f09e83..0000000000
--- a/benchmarks/pulumi/package-lock.json
+++ /dev/null
@@ -1,2465 +0,0 @@
-{
-  "name": "aws-bench",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "name": "aws-bench",
-      "dependencies": {
-        "@pulumi/aws": "^5.0.0",
-        "@pulumi/awsx": "^1.0.4",
-        "@pulumi/pulumi": "^3.0.0",
-        "@pulumi/tailscale": "^0.12.2",
-        "@pulumi/tls": "^4.10.0"
-      },
-      "devDependencies": {
-        "@types/node": "^16",
-        "pulumi": "^0.0.1"
-      }
-    },
-    "node_modules/@grpc/grpc-js": {
-      "version": "1.14.3",
-      "resolved": "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.14.3.tgz",
-      "integrity": "sha512-Iq8QQQ/7X3Sac15oB6p0FmUg/klxQvXLeileoqrTRGJYLV+/9tubbr9ipz0GKHjmXVsgFPo/+W+2cA8eNcR+XA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@grpc/proto-loader": "^0.8.0",
-        "@js-sdsl/ordered-map": "^4.4.2"
-      },
-      "engines": {
-        "node": ">=12.10.0"
-      }
-    },
-    "node_modules/@grpc/proto-loader": {
-      "version": "0.8.0",
-      "resolved": "https://registry.npmjs.org/@grpc/proto-loader/-/proto-loader-0.8.0.tgz",
-      "integrity": "sha512-rc1hOQtjIWGxcxpb9aHAfLpIctjEnsDehj0DAiVfBlmT84uvR0uUtN2hEi/ecvWVjXUGf5qPF4qEgiLOx1YIMQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "lodash.camelcase": "^4.3.0",
-        "long": "^5.0.0",
-        "protobufjs": "^7.5.3",
-        "yargs": "^17.7.2"
-      },
-      "bin": {
-        "proto-loader-gen-types": "build/bin/proto-loader-gen-types.js"
-      },
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/@js-sdsl/ordered-map": {
-      "version": "4.4.2",
-      "resolved": "https://registry.npmjs.org/@js-sdsl/ordered-map/-/ordered-map-4.4.2.tgz",
-      "integrity": "sha512-iUKgm52T8HOE/makSxjqoWhe95ZJA1/G1sYsGev2JDKUSS14KAgg1LHb+Ba+IPow0xflbnSkOsZcO08C7w1gYw==",
-      "license": "MIT",
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/js-sdsl"
-      }
-    },
-    "node_modules/@logdna/tail-file": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@logdna/tail-file/-/tail-file-2.2.0.tgz",
-      "integrity": "sha512-XGSsWDweP80Fks16lwkAUIr54ICyBs6PsI4mpfTLQaWgEJRtY9xEV+PeyDpJ+sJEGZxqINlpmAwe/6tS1pP8Ng==",
-      "engines": {
-        "node": ">=10.3.0"
-      }
-    },
-    "node_modules/@opentelemetry/api": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.4.1.tgz",
-      "integrity": "sha512-O2yRJce1GOc6PAy3QxFM4NzFiWzvScDC1/5ihYBL6BUEVdq0XMWN01sppE+H6bBXbaFYipjwFLEWLg5PaSOThA==",
-      "engines": {
-        "node": ">=8.0.0"
-      }
-    },
-    "node_modules/@opentelemetry/api-metrics": {
-      "version": "0.32.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/api-metrics/-/api-metrics-0.32.0.tgz",
-      "integrity": "sha512-g1WLhpG8B6iuDyZJFRGsR+JKyZ94m5LEmY2f+duEJ9Xb4XRlLHrZvh6G34OH6GJ8iDHxfHb/sWjJ1ZpkI9yGMQ==",
-      "deprecated": "Please use @opentelemetry/api >= 1.3.0",
-      "dependencies": {
-        "@opentelemetry/api": "^1.0.0"
-      },
-      "engines": {
-        "node": ">=14"
-      }
-    },
-    "node_modules/@opentelemetry/context-async-hooks": {
-      "version": "1.15.2",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/context-async-hooks/-/context-async-hooks-1.15.2.tgz",
-      "integrity": "sha512-VAMHG67srGFQDG/N2ns5AyUT9vUcoKpZ/NpJ5fDQIPfJd7t3ju+aHwvDsMcrYBWuCh03U3Ky6o16+872CZchBg==",
-      "engines": {
-        "node": ">=14"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.0.0 <1.5.0"
-      }
-    },
-    "node_modules/@opentelemetry/core": {
-      "version": "1.15.2",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-1.15.2.tgz",
-      "integrity": "sha512-+gBv15ta96WqkHZaPpcDHiaz0utiiHZVfm2YOYSqFGrUaJpPkMoSuLBB58YFQGi6Rsb9EHos84X6X5+9JspmLw==",
-      "dependencies": {
-        "@opentelemetry/semantic-conventions": "1.15.2"
-      },
-      "engines": {
-        "node": ">=14"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.0.0 <1.5.0"
-      }
-    },
-    "node_modules/@opentelemetry/exporter-zipkin": {
-      "version": "1.15.2",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/exporter-zipkin/-/exporter-zipkin-1.15.2.tgz",
-      "integrity": "sha512-j9dPe8tyx4KqIqJAfZ/LCYfkF9+ggsT0V1+bVg9ZKTBNcLf5dTsTMdcxUxc/9s599kgcn6UERnti/tozbzwa6Q==",
-      "dependencies": {
-        "@opentelemetry/core": "1.15.2",
-        "@opentelemetry/resources": "1.15.2",
-        "@opentelemetry/sdk-trace-base": "1.15.2",
-        "@opentelemetry/semantic-conventions": "1.15.2"
-      },
-      "engines": {
-        "node": ">=14"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": "^1.0.0"
-      }
-    },
-    "node_modules/@opentelemetry/instrumentation": {
-      "version": "0.32.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/instrumentation/-/instrumentation-0.32.0.tgz",
-      "integrity": "sha512-y6ADjHpkUz/v1nkyyYjsQa/zorhX+0qVGpFvXMcbjU4sHnBnC02c6wcc93sIgZfiQClIWo45TGku1KQxJ5UUbQ==",
-      "dependencies": {
-        "@opentelemetry/api-metrics": "0.32.0",
-        "require-in-the-middle": "^5.0.3",
-        "semver": "^7.3.2",
-        "shimmer": "^1.2.1"
-      },
-      "engines": {
-        "node": ">=14"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": "^1.0.0"
-      }
-    },
-    "node_modules/@opentelemetry/instrumentation-grpc": {
-      "version": "0.32.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/instrumentation-grpc/-/instrumentation-grpc-0.32.0.tgz",
-      "integrity": "sha512-Az6wdkPx/Mi26lT9LKFV6GhCA9prwQFPz5eCNSExTnSP49YhQ7XCjzPd2POPeLKt84ICitrBMdE1mj0zbPdLAQ==",
-      "dependencies": {
-        "@opentelemetry/api-metrics": "0.32.0",
-        "@opentelemetry/instrumentation": "0.32.0",
-        "@opentelemetry/semantic-conventions": "1.6.0"
-      },
-      "engines": {
-        "node": ">=14"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": "^1.0.0"
-      }
-    },
-    "node_modules/@opentelemetry/instrumentation-grpc/node_modules/@opentelemetry/semantic-conventions": {
-      "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/semantic-conventions/-/semantic-conventions-1.6.0.tgz",
-      "integrity": "sha512-aPfcBeLErM/PPiAuAbNFLN5sNbZLc3KZlar27uohllN8Zs6jJbHyJU1y7cMA6W/zuq+thkaG8mujiS+3iD/FWQ==",
-      "engines": {
-        "node": ">=14"
-      }
-    },
-    "node_modules/@opentelemetry/instrumentation/node_modules/semver": {
-      "version": "7.5.4",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
-      "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
-      "dependencies": {
-        "lru-cache": "^6.0.0"
-      },
-      "bin": {
-        "semver": "bin/semver.js"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/@opentelemetry/propagator-b3": {
-      "version": "1.15.2",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/propagator-b3/-/propagator-b3-1.15.2.tgz",
-      "integrity": "sha512-ZSrL3DpMEDsjD8dPt9Ze3ue53nEXJt512KyxXlLgLWnSNbe1mrWaXWkh7OLDoVJh9LqFw+tlvAhDVt/x3DaFGg==",
-      "dependencies": {
-        "@opentelemetry/core": "1.15.2"
-      },
-      "engines": {
-        "node": ">=14"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.0.0 <1.5.0"
-      }
-    },
-    "node_modules/@opentelemetry/propagator-jaeger": {
-      "version": "1.15.2",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/propagator-jaeger/-/propagator-jaeger-1.15.2.tgz",
-      "integrity": "sha512-6m1yu7PVDIRz6BwA36lacfBZJCfAEHKgu+kSyukNwVdVjsTNeyD9xNPQnkl0WN7Rvhk8/yWJ83tLPEyGhk1wCQ==",
-      "dependencies": {
-        "@opentelemetry/core": "1.15.2"
-      },
-      "engines": {
-        "node": ">=14"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.0.0 <1.5.0"
-      }
-    },
-    "node_modules/@opentelemetry/resources": {
-      "version": "1.15.2",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-1.15.2.tgz",
-      "integrity": "sha512-xmMRLenT9CXmm5HMbzpZ1hWhaUowQf8UB4jMjFlAxx1QzQcsD3KFNAVX/CAWzFPtllTyTplrA4JrQ7sCH3qmYw==",
-      "dependencies": {
-        "@opentelemetry/core": "1.15.2",
-        "@opentelemetry/semantic-conventions": "1.15.2"
-      },
-      "engines": {
-        "node": ">=14"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.0.0 <1.5.0"
-      }
-    },
-    "node_modules/@opentelemetry/sdk-trace-base": {
-      "version": "1.15.2",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-base/-/sdk-trace-base-1.15.2.tgz",
-      "integrity": "sha512-BEaxGZbWtvnSPchV98qqqqa96AOcb41pjgvhfzDij10tkBhIu9m0Jd6tZ1tJB5ZHfHbTffqYVYE0AOGobec/EQ==",
-      "dependencies": {
-        "@opentelemetry/core": "1.15.2",
-        "@opentelemetry/resources": "1.15.2",
-        "@opentelemetry/semantic-conventions": "1.15.2"
-      },
-      "engines": {
-        "node": ">=14"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.0.0 <1.5.0"
-      }
-    },
-    "node_modules/@opentelemetry/sdk-trace-node": {
-      "version": "1.15.2",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-node/-/sdk-trace-node-1.15.2.tgz",
-      "integrity": "sha512-5deakfKLCbPpKJRCE2GPI8LBE2LezyvR17y3t37ZI3sbaeogtyxmBaFV+slmG9fN8OaIT+EUsm1QAT1+z59gbQ==",
-      "dependencies": {
-        "@opentelemetry/context-async-hooks": "1.15.2",
-        "@opentelemetry/core": "1.15.2",
-        "@opentelemetry/propagator-b3": "1.15.2",
-        "@opentelemetry/propagator-jaeger": "1.15.2",
-        "@opentelemetry/sdk-trace-base": "1.15.2",
-        "semver": "^7.5.1"
-      },
-      "engines": {
-        "node": ">=14"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.0.0 <1.5.0"
-      }
-    },
-    "node_modules/@opentelemetry/sdk-trace-node/node_modules/semver": {
-      "version": "7.5.4",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
-      "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
-      "dependencies": {
-        "lru-cache": "^6.0.0"
-      },
-      "bin": {
-        "semver": "bin/semver.js"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/@opentelemetry/semantic-conventions": {
-      "version": "1.15.2",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/semantic-conventions/-/semantic-conventions-1.15.2.tgz",
-      "integrity": "sha512-CjbOKwk2s+3xPIMcd5UNYQzsf+v94RczbdNix9/kQh38WiQkM90sUOi3if8eyHFgiBjBjhwXrA7W3ydiSQP9mw==",
-      "engines": {
-        "node": ">=14"
-      }
-    },
-    "node_modules/@protobufjs/aspromise": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/aspromise/-/aspromise-1.1.2.tgz",
-      "integrity": "sha512-j+gKExEuLmKwvz3OgROXtrJ2UG2x8Ch2YZUxahh+s1F2HZ+wAceUNLkvy6zKCPVRkU++ZWQrdxsUeQXmcg4uoQ==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/base64": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/base64/-/base64-1.1.2.tgz",
-      "integrity": "sha512-AZkcAA5vnN/v4PDqKyMR5lx7hZttPDgClv83E//FMNhR2TMcLUhfRUBHCmSl0oi9zMgDDqRUJkSxO3wm85+XLg==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/codegen": {
-      "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/@protobufjs/codegen/-/codegen-2.0.5.tgz",
-      "integrity": "sha512-zgXFLzW3Ap33e6d0Wlj4MGIm6Ce8O89n/apUaGNB/jx+hw+ruWEp7EwGUshdLKVRCxZW12fp9r40E1mQrf/34g==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/eventemitter": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@protobufjs/eventemitter/-/eventemitter-1.1.0.tgz",
-      "integrity": "sha512-j9ednRT81vYJ9OfVuXG6ERSTdEL1xVsNgqpkxMsbIabzSo3goCjDIveeGv5d03om39ML71RdmrGNjG5SReBP/Q==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/fetch": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@protobufjs/fetch/-/fetch-1.1.0.tgz",
-      "integrity": "sha512-lljVXpqXebpsijW71PZaCYeIcE5on1w5DlQy5WH6GLbFryLUrBD4932W/E2BSpfRJWseIL4v/KPgBFxDOIdKpQ==",
-      "license": "BSD-3-Clause",
-      "dependencies": {
-        "@protobufjs/aspromise": "^1.1.1",
-        "@protobufjs/inquire": "^1.1.0"
-      }
-    },
-    "node_modules/@protobufjs/float": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/float/-/float-1.0.2.tgz",
-      "integrity": "sha512-Ddb+kVXlXst9d+R9PfTIxh1EdNkgoRe5tOX6t01f1lYWOvJnSPDBlG241QLzcyPdoNTsblLUdujGSE4RzrTZGQ==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/inquire": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@protobufjs/inquire/-/inquire-1.1.1.tgz",
-      "integrity": "sha512-mnzgDV26ueAvk7rsbt9L7bE0SuAoqyuys/sMMrmVcN5x9VsxpcG3rqAUSgDyLp0UZlmNfIbQ4fHfCtreVBk8Ew==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/path": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/path/-/path-1.1.2.tgz",
-      "integrity": "sha512-6JOcJ5Tm08dOHAbdR3GrvP+yUUfkjG5ePsHYczMFLq3ZmMkAD98cDgcT2iA1lJ9NVwFd4tH/iSSoe44YWkltEA==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/pool": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@protobufjs/pool/-/pool-1.1.0.tgz",
-      "integrity": "sha512-0kELaGSIDBKvcgS4zkjz1PeddatrjYcmMWOlAuAPwAeccUrPHdUqo/J6LiymHHEiJT5NrF1UVwxY14f+fy4WQw==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/utf8": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@protobufjs/utf8/-/utf8-1.1.1.tgz",
-      "integrity": "sha512-oOAWABowe8EAbMyWKM0tYDKi8Yaox52D+HWZhAIJqQXbqe0xI/GV7FhLWqlEKreMkfDjshR5FKgi3mnle0h6Eg==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@pulumi/aws": {
-      "version": "5.43.0",
-      "resolved": "https://registry.npmjs.org/@pulumi/aws/-/aws-5.43.0.tgz",
-      "integrity": "sha512-ZWI+QvEaFy27wUW8j8EVadgvl6u3926AAgpghflSPxF/9mG5XoDy0rqkRZOgO13ZJinC1qkQDzoMz0ACgmwTiw==",
-      "hasInstallScript": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@pulumi/pulumi": "^3.0.0",
-        "aws-sdk": "^2.0.0",
-        "builtin-modules": "3.0.0",
-        "mime": "^2.0.0",
-        "read-package-tree": "^5.2.1",
-        "resolve": "^1.7.1"
-      }
-    },
-    "node_modules/@pulumi/awsx": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/@pulumi/awsx/-/awsx-1.0.6.tgz",
-      "integrity": "sha512-zTBsRO6EeSg6V2sEkw1b8OtvExaYMg1rUlaJVfui54W86M3KvFANtGI99a+aScUxJMxGqkS9cb6LdzZjTlKQGA==",
-      "hasInstallScript": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@pulumi/aws": "^5.35.0",
-        "@pulumi/docker": "^3.6.1",
-        "@pulumi/pulumi": "^3.0.0",
-        "@types/aws-lambda": "^8.10.23",
-        "mime": "^2.0.0"
-      }
-    },
-    "node_modules/@pulumi/docker": {
-      "version": "3.6.1",
-      "resolved": "https://registry.npmjs.org/@pulumi/docker/-/docker-3.6.1.tgz",
-      "integrity": "sha512-BZME50QkT556v+LvmTXPT8ssB2xxNkp9+msB5xYFEnUnWcdGAx5yUysQw70RJCb+U0GbkJSbxtlgMJgOQf/now==",
-      "hasInstallScript": true,
-      "dependencies": {
-        "@pulumi/pulumi": "^3.0.0",
-        "semver": "^5.4.0"
-      }
-    },
-    "node_modules/@pulumi/pulumi": {
-      "version": "3.77.1",
-      "resolved": "https://registry.npmjs.org/@pulumi/pulumi/-/pulumi-3.77.1.tgz",
-      "integrity": "sha512-smeip4uKWkaKcNhMiAmR5uW4nXRvmHSjq93C7zx+mMneNxeaD9HNIBnYW0H0FFgp7j1AdRYuiIa2ie9Ay51bpw==",
-      "dependencies": {
-        "@grpc/grpc-js": "^1.8.16",
-        "@logdna/tail-file": "^2.0.6",
-        "@opentelemetry/api": "^1.2.0",
-        "@opentelemetry/exporter-zipkin": "^1.6.0",
-        "@opentelemetry/instrumentation": "^0.32.0",
-        "@opentelemetry/instrumentation-grpc": "^0.32.0",
-        "@opentelemetry/resources": "^1.6.0",
-        "@opentelemetry/sdk-trace-base": "^1.6.0",
-        "@opentelemetry/sdk-trace-node": "^1.6.0",
-        "@opentelemetry/semantic-conventions": "^1.6.0",
-        "@pulumi/query": "^0.3.0",
-        "execa": "^5.1.0",
-        "google-protobuf": "^3.5.0",
-        "ini": "^2.0.0",
-        "js-yaml": "^3.14.0",
-        "minimist": "^1.2.6",
-        "normalize-package-data": "^3.0.0",
-        "pkg-dir": "^7.0.0",
-        "read-package-tree": "^5.3.1",
-        "require-from-string": "^2.0.1",
-        "semver": "^7.5.2",
-        "source-map-support": "^0.5.6",
-        "ts-node": "^7.0.1",
-        "typescript": "~3.8.3",
-        "upath": "^1.1.0"
-      },
-      "engines": {
-        "node": ">=8.13.0 || >=10.10.0"
-      }
-    },
-    "node_modules/@pulumi/pulumi/node_modules/semver": {
-      "version": "7.5.4",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
-      "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
-      "dependencies": {
-        "lru-cache": "^6.0.0"
-      },
-      "bin": {
-        "semver": "bin/semver.js"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/@pulumi/query": {
-      "version": "0.3.0",
-      "resolved": "https://registry.npmjs.org/@pulumi/query/-/query-0.3.0.tgz",
-      "integrity": "sha512-xfo+yLRM2zVjVEA4p23IjQWzyWl1ZhWOGobsBqRpIarzLvwNH/RAGaoehdxlhx4X92302DrpdIFgTICMN4P38w=="
-    },
-    "node_modules/@pulumi/tailscale": {
-      "version": "0.12.2",
-      "resolved": "https://registry.npmjs.org/@pulumi/tailscale/-/tailscale-0.12.2.tgz",
-      "integrity": "sha512-eDzXu4I7awua494d6is9nwV/8G56dTI4oL53G/WTqWtl1ezVHb+v6bKxMrcPvhhYGugbIhK56ECWPiqg9k5gJg==",
-      "hasInstallScript": true,
-      "dependencies": {
-        "@pulumi/pulumi": "^3.0.0"
-      }
-    },
-    "node_modules/@pulumi/tls": {
-      "version": "4.10.0",
-      "resolved": "https://registry.npmjs.org/@pulumi/tls/-/tls-4.10.0.tgz",
-      "integrity": "sha512-aK1LXJzDbeVYBIlxycUUboZJSjMr2wIkrpngNRrOFPMIyO4QYNzJHWIwRbNkS463hhpbp1it3IC3htEqtP4lzg==",
-      "hasInstallScript": true,
-      "dependencies": {
-        "@pulumi/pulumi": "^3.0.0"
-      }
-    },
-    "node_modules/@types/aws-lambda": {
-      "version": "8.10.119",
-      "resolved": "https://registry.npmjs.org/@types/aws-lambda/-/aws-lambda-8.10.119.tgz",
-      "integrity": "sha512-Vqm22aZrCvCd6I5g1SvpW151jfqwTzEZ7XJ3yZ6xaZG31nUEOEyzzVImjRcsN8Wi/QyPxId/x8GTtgIbsy8kEw=="
-    },
-    "node_modules/@types/node": {
-      "version": "16.18.40",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-16.18.40.tgz",
-      "integrity": "sha512-+yno3ItTEwGxXiS/75Q/aHaa5srkpnJaH+kdkTVJ3DtJEwv92itpKbxU+FjPoh2m/5G9zmUQfrL4A4C13c+iGA=="
-    },
-    "node_modules/ansi-regex": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/ansi-styles": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
-      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
-      "license": "MIT",
-      "dependencies": {
-        "color-convert": "^2.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
-      }
-    },
-    "node_modules/argparse": {
-      "version": "1.0.10",
-      "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz",
-      "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==",
-      "dependencies": {
-        "sprintf-js": "~1.0.2"
-      }
-    },
-    "node_modules/array-buffer-byte-length": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/array-buffer-byte-length/-/array-buffer-byte-length-1.0.0.tgz",
-      "integrity": "sha512-LPuwb2P+NrQw3XhxGc36+XSvuBPopovXYTR9Ew++Du9Yb/bx5AzBfrIsBoj0EZUifjQU+sHL21sseZ3jerWO/A==",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "is-array-buffer": "^3.0.1"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/array.prototype.reduce": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/array.prototype.reduce/-/array.prototype.reduce-1.0.5.tgz",
-      "integrity": "sha512-kDdugMl7id9COE8R7MHF5jWk7Dqt/fs4Pv+JXoICnYwqpjjjbUurz6w5fT5IG6brLdJhv6/VoHB0H7oyIBXd+Q==",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4",
-        "es-array-method-boxes-properly": "^1.0.0",
-        "is-string": "^1.0.7"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/arraybuffer.prototype.slice": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/arraybuffer.prototype.slice/-/arraybuffer.prototype.slice-1.0.1.tgz",
-      "integrity": "sha512-09x0ZWFEjj4WD8PDbykUwo3t9arLn8NIzmmYEJFpYekOAQjpkGSyrQhNoRTcwwcFRu+ycWF78QZ63oWTqSjBcw==",
-      "dependencies": {
-        "array-buffer-byte-length": "^1.0.0",
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.2.0",
-        "get-intrinsic": "^1.2.1",
-        "is-array-buffer": "^3.0.2",
-        "is-shared-array-buffer": "^1.0.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/arrify": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/arrify/-/arrify-1.0.1.tgz",
-      "integrity": "sha512-3CYzex9M9FGQjCGMGyi6/31c8GJbgb0qGyrx5HWxPd0aCwh4cB2YjMb2Xf9UuoogrMrlO9cTqnB5rI5GHZTcUA==",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/asap": {
-      "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/asap/-/asap-2.0.6.tgz",
-      "integrity": "sha512-BSHWgDSAiKs50o2Re8ppvp3seVHXSRM44cdSsT9FfNEUUZLOGWVCsiWaRPWM1Znn+mqZ1OfVZ3z3DWEzSp7hRA=="
-    },
-    "node_modules/available-typed-arrays": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/available-typed-arrays/-/available-typed-arrays-1.0.5.tgz",
-      "integrity": "sha512-DMD0KiN46eipeziST1LPP/STfDU0sufISXmjSgvVsoU2tqxctQeASejWcfNtxYKqETM1UxQ8sp2OrSBWpHY6sw==",
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/aws-sdk": {
-      "version": "2.1693.0",
-      "resolved": "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.1693.0.tgz",
-      "integrity": "sha512-cJmb8xEnVLT+R6fBS5sn/EFJiX7tUnDaPtOPZ1vFbOJtd0fnZn/Ky2XGgsvvoeliWeH7mL3TWSX5zXXGSQV6gQ==",
-      "deprecated": "The AWS SDK for JavaScript (v2) has reached end-of-support, and no longer receives updates. Please migrate your code to use AWS SDK for JavaScript (v3). More info https://a.co/cUPnyil",
-      "hasInstallScript": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "buffer": "4.9.2",
-        "events": "1.1.1",
-        "ieee754": "1.1.13",
-        "jmespath": "0.16.0",
-        "querystring": "0.2.0",
-        "sax": "1.2.1",
-        "url": "0.10.3",
-        "util": "^0.12.4",
-        "uuid": "8.0.0",
-        "xml2js": "0.6.2"
-      },
-      "engines": {
-        "node": ">= 10.0.0"
-      }
-    },
-    "node_modules/balanced-match": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
-      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="
-    },
-    "node_modules/base64-js": {
-      "version": "1.5.1",
-      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
-      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ]
-    },
-    "node_modules/brace-expansion": {
-      "version": "1.1.14",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
-      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^1.0.0",
-        "concat-map": "0.0.1"
-      }
-    },
-    "node_modules/buffer": {
-      "version": "4.9.2",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-4.9.2.tgz",
-      "integrity": "sha512-xq+q3SRMOxGivLhBNaUdC64hDTQwejJ+H0T/NB1XMtTVEwNTrfFF3gAxiyW0Bu/xWEGhjVKgUcMhCrUy2+uCWg==",
-      "dependencies": {
-        "base64-js": "^1.0.2",
-        "ieee754": "^1.1.4",
-        "isarray": "^1.0.0"
-      }
-    },
-    "node_modules/buffer-from": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
-      "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ=="
-    },
-    "node_modules/builtin-modules": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/builtin-modules/-/builtin-modules-3.0.0.tgz",
-      "integrity": "sha512-hMIeU4K2ilbXV6Uv93ZZ0Avg/M91RaKXucQ+4me2Do1txxBDyDZWCBa5bJSLqoNTRpXTLwEzIk1KmloenDDjhg==",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/call-bind": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.2.tgz",
-      "integrity": "sha512-7O+FbCihrB5WGbFYesctwmTKae6rOiIzmz1icreWJ+0aA7LJfuqhEso2T9ncpcFtzMQtzXf2QGGueWJGTYsqrA==",
-      "dependencies": {
-        "function-bind": "^1.1.1",
-        "get-intrinsic": "^1.0.2"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/cliui": {
-      "version": "8.0.1",
-      "resolved": "https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz",
-      "integrity": "sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==",
-      "license": "ISC",
-      "dependencies": {
-        "string-width": "^4.2.0",
-        "strip-ansi": "^6.0.1",
-        "wrap-ansi": "^7.0.0"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/color-convert": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
-      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
-      "license": "MIT",
-      "dependencies": {
-        "color-name": "~1.1.4"
-      },
-      "engines": {
-        "node": ">=7.0.0"
-      }
-    },
-    "node_modules/color-name": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
-      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
-      "license": "MIT"
-    },
-    "node_modules/concat-map": {
-      "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
-      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg=="
-    },
-    "node_modules/cross-spawn": {
-      "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
-      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
-      "license": "MIT",
-      "dependencies": {
-        "path-key": "^3.1.0",
-        "shebang-command": "^2.0.0",
-        "which": "^2.0.1"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/debug": {
-      "version": "4.3.4",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz",
-      "integrity": "sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==",
-      "dependencies": {
-        "ms": "2.1.2"
-      },
-      "engines": {
-        "node": ">=6.0"
-      },
-      "peerDependenciesMeta": {
-        "supports-color": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/debuglog": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/debuglog/-/debuglog-1.0.1.tgz",
-      "integrity": "sha512-syBZ+rnAK3EgMsH2aYEOLUW7mZSY9Gb+0wUMCFsZvcmiz+HigA0LOcq/HoQqVuGG+EKykunc7QG2bzrponfaSw==",
-      "deprecated": "Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.",
-      "engines": {
-        "node": "*"
-      }
-    },
-    "node_modules/define-properties": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/define-properties/-/define-properties-1.2.0.tgz",
-      "integrity": "sha512-xvqAVKGfT1+UAvPwKTVw/njhdQ8ZhXK4lI0bCIuCMrp2up9nPnaDftrLtmpTazqd1o+UY4zgzU+avtMbDP+ldA==",
-      "dependencies": {
-        "has-property-descriptors": "^1.0.0",
-        "object-keys": "^1.1.1"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/dezalgo": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/dezalgo/-/dezalgo-1.0.4.tgz",
-      "integrity": "sha512-rXSP0bf+5n0Qonsb+SVVfNfIsimO4HEtmnIpPHY8Q1UCzKlQrDMfdobr8nJOOsRgWCyMRqeSBQzmWUMq7zvVig==",
-      "dependencies": {
-        "asap": "^2.0.0",
-        "wrappy": "1"
-      }
-    },
-    "node_modules/diff": {
-      "version": "3.5.1",
-      "resolved": "https://registry.npmjs.org/diff/-/diff-3.5.1.tgz",
-      "integrity": "sha512-Z3u54A8qGyqFOSr2pk0ijYs8mOE9Qz8kTvtKeBI+upoG9j04Sq+oI7W8zAJiQybDcESET8/uIdHzs0p3k4fZlw==",
-      "license": "BSD-3-Clause",
-      "engines": {
-        "node": ">=0.3.1"
-      }
-    },
-    "node_modules/emoji-regex": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
-      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
-      "license": "MIT"
-    },
-    "node_modules/es-abstract": {
-      "version": "1.22.1",
-      "resolved": "https://registry.npmjs.org/es-abstract/-/es-abstract-1.22.1.tgz",
-      "integrity": "sha512-ioRRcXMO6OFyRpyzV3kE1IIBd4WG5/kltnzdxSCqoP8CMGs/Li+M1uF5o7lOkZVFjDs+NLesthnF66Pg/0q0Lw==",
-      "dependencies": {
-        "array-buffer-byte-length": "^1.0.0",
-        "arraybuffer.prototype.slice": "^1.0.1",
-        "available-typed-arrays": "^1.0.5",
-        "call-bind": "^1.0.2",
-        "es-set-tostringtag": "^2.0.1",
-        "es-to-primitive": "^1.2.1",
-        "function.prototype.name": "^1.1.5",
-        "get-intrinsic": "^1.2.1",
-        "get-symbol-description": "^1.0.0",
-        "globalthis": "^1.0.3",
-        "gopd": "^1.0.1",
-        "has": "^1.0.3",
-        "has-property-descriptors": "^1.0.0",
-        "has-proto": "^1.0.1",
-        "has-symbols": "^1.0.3",
-        "internal-slot": "^1.0.5",
-        "is-array-buffer": "^3.0.2",
-        "is-callable": "^1.2.7",
-        "is-negative-zero": "^2.0.2",
-        "is-regex": "^1.1.4",
-        "is-shared-array-buffer": "^1.0.2",
-        "is-string": "^1.0.7",
-        "is-typed-array": "^1.1.10",
-        "is-weakref": "^1.0.2",
-        "object-inspect": "^1.12.3",
-        "object-keys": "^1.1.1",
-        "object.assign": "^4.1.4",
-        "regexp.prototype.flags": "^1.5.0",
-        "safe-array-concat": "^1.0.0",
-        "safe-regex-test": "^1.0.0",
-        "string.prototype.trim": "^1.2.7",
-        "string.prototype.trimend": "^1.0.6",
-        "string.prototype.trimstart": "^1.0.6",
-        "typed-array-buffer": "^1.0.0",
-        "typed-array-byte-length": "^1.0.0",
-        "typed-array-byte-offset": "^1.0.0",
-        "typed-array-length": "^1.0.4",
-        "unbox-primitive": "^1.0.2",
-        "which-typed-array": "^1.1.10"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/es-array-method-boxes-properly": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/es-array-method-boxes-properly/-/es-array-method-boxes-properly-1.0.0.tgz",
-      "integrity": "sha512-wd6JXUmyHmt8T5a2xreUwKcGPq6f1f+WwIJkijUqiGcJz1qqnZgP6XIK+QyIWU5lT7imeNxUll48bziG+TSYcA=="
-    },
-    "node_modules/es-set-tostringtag": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/es-set-tostringtag/-/es-set-tostringtag-2.0.1.tgz",
-      "integrity": "sha512-g3OMbtlwY3QewlqAiMLI47KywjWZoEytKr8pf6iTC8uJq5bIAH52Z9pnQ8pVL6whrCto53JZDuUIsifGeLorTg==",
-      "dependencies": {
-        "get-intrinsic": "^1.1.3",
-        "has": "^1.0.3",
-        "has-tostringtag": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/es-to-primitive": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/es-to-primitive/-/es-to-primitive-1.2.1.tgz",
-      "integrity": "sha512-QCOllgZJtaUo9miYBcLChTUaHNjJF3PYs1VidD7AwiEj1kYxKeQTctLAezAOH5ZKRH0g2IgPn6KwB4IT8iRpvA==",
-      "dependencies": {
-        "is-callable": "^1.1.4",
-        "is-date-object": "^1.0.1",
-        "is-symbol": "^1.0.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/escalade": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.2.0.tgz",
-      "integrity": "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/esprima": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz",
-      "integrity": "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==",
-      "bin": {
-        "esparse": "bin/esparse.js",
-        "esvalidate": "bin/esvalidate.js"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/events": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/events/-/events-1.1.1.tgz",
-      "integrity": "sha512-kEcvvCBByWXGnZy6JUlgAp2gBIUjfCAV6P6TgT1/aaQKcmuAEC4OZTV1I4EWQLz2gxZw76atuVyvHhTxvi0Flw==",
-      "engines": {
-        "node": ">=0.4.x"
-      }
-    },
-    "node_modules/execa": {
-      "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/execa/-/execa-5.1.1.tgz",
-      "integrity": "sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg==",
-      "dependencies": {
-        "cross-spawn": "^7.0.3",
-        "get-stream": "^6.0.0",
-        "human-signals": "^2.1.0",
-        "is-stream": "^2.0.0",
-        "merge-stream": "^2.0.0",
-        "npm-run-path": "^4.0.1",
-        "onetime": "^5.1.2",
-        "signal-exit": "^3.0.3",
-        "strip-final-newline": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sindresorhus/execa?sponsor=1"
-      }
-    },
-    "node_modules/find-up": {
-      "version": "6.3.0",
-      "resolved": "https://registry.npmjs.org/find-up/-/find-up-6.3.0.tgz",
-      "integrity": "sha512-v2ZsoEuVHYy8ZIlYqwPe/39Cy+cFDzp4dXPaxNvkEuouymu+2Jbz0PxpKarJHYJTmv2HWT3O382qY8l4jMWthw==",
-      "dependencies": {
-        "locate-path": "^7.1.0",
-        "path-exists": "^5.0.0"
-      },
-      "engines": {
-        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/for-each": {
-      "version": "0.3.3",
-      "resolved": "https://registry.npmjs.org/for-each/-/for-each-0.3.3.tgz",
-      "integrity": "sha512-jqYfLp7mo9vIyQf8ykW2v7A+2N4QjeCeI5+Dz9XraiO1ign81wjiH7Fb9vSOWvQfNtmSa4H2RoQTrrXivdUZmw==",
-      "dependencies": {
-        "is-callable": "^1.1.3"
-      }
-    },
-    "node_modules/fs.realpath": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
-      "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw=="
-    },
-    "node_modules/function-bind": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.1.tgz",
-      "integrity": "sha512-yIovAzMX49sF8Yl58fSCWJ5svSLuaibPxXQJFLmBObTuCr0Mf1KiPopGM9NiFjiYBCbfaa2Fh6breQ6ANVTI0A=="
-    },
-    "node_modules/function.prototype.name": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/function.prototype.name/-/function.prototype.name-1.1.5.tgz",
-      "integrity": "sha512-uN7m/BzVKQnCUF/iW8jYea67v++2u7m5UgENbHRtdDVclOUP+FMPlCNdmk0h/ysGyo2tavMJEDqJAkJdRa1vMA==",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.3",
-        "es-abstract": "^1.19.0",
-        "functions-have-names": "^1.2.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/functions-have-names": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/functions-have-names/-/functions-have-names-1.2.3.tgz",
-      "integrity": "sha512-xckBUXyTIqT97tq2x2AMb+g163b5JFysYk0x4qxNFwbfQkmNZoiRHb6sPzI9/QV33WeuvVYBUIiD4NzNIyqaRQ==",
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/get-caller-file": {
-      "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/get-caller-file/-/get-caller-file-2.0.5.tgz",
-      "integrity": "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==",
-      "license": "ISC",
-      "engines": {
-        "node": "6.* || 8.* || >= 10.*"
-      }
-    },
-    "node_modules/get-intrinsic": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.2.1.tgz",
-      "integrity": "sha512-2DcsyfABl+gVHEfCOaTrWgyt+tb6MSEGmKq+kI5HwLbIYgjgmMcV8KQ41uaKz1xxUcn9tJtgFbQUEVcEbd0FYw==",
-      "dependencies": {
-        "function-bind": "^1.1.1",
-        "has": "^1.0.3",
-        "has-proto": "^1.0.1",
-        "has-symbols": "^1.0.3"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/get-stream": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz",
-      "integrity": "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==",
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/get-symbol-description": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/get-symbol-description/-/get-symbol-description-1.0.0.tgz",
-      "integrity": "sha512-2EmdH1YvIQiZpltCNgkuiUnyukzxM/R6NDJX31Ke3BG1Nq5b0S2PhX59UKi9vZpPDQVdqn+1IcaAwnzTT5vCjw==",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "get-intrinsic": "^1.1.1"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/glob": {
-      "version": "7.2.3",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
-      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
-      "dependencies": {
-        "fs.realpath": "^1.0.0",
-        "inflight": "^1.0.4",
-        "inherits": "2",
-        "minimatch": "^3.1.1",
-        "once": "^1.3.0",
-        "path-is-absolute": "^1.0.0"
-      },
-      "engines": {
-        "node": "*"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/globalthis": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/globalthis/-/globalthis-1.0.3.tgz",
-      "integrity": "sha512-sFdI5LyBiNTHjRd7cGPWapiHWMOXKyuBNX/cWJ3NfzrZQVa8GI/8cofCl74AOVqq9W5kNmguTIzJ/1s2gyI9wA==",
-      "dependencies": {
-        "define-properties": "^1.1.3"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/google-protobuf": {
-      "version": "3.21.2",
-      "resolved": "https://registry.npmjs.org/google-protobuf/-/google-protobuf-3.21.2.tgz",
-      "integrity": "sha512-3MSOYFO5U9mPGikIYCzK0SaThypfGgS6bHqrUGXG3DPHCrb+txNqeEcns1W0lkGfk0rCyNXm7xB9rMxnCiZOoA=="
-    },
-    "node_modules/gopd": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.0.1.tgz",
-      "integrity": "sha512-d65bNlIadxvpb/A2abVdlqKqV563juRnZ1Wtk6s1sIR8uNsXR70xqIzVqxVf1eTqDunwT2MkczEeaezCKTZhwA==",
-      "dependencies": {
-        "get-intrinsic": "^1.1.3"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/graceful-fs": {
-      "version": "4.2.11",
-      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
-      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ=="
-    },
-    "node_modules/has": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/has/-/has-1.0.3.tgz",
-      "integrity": "sha512-f2dvO0VU6Oej7RkWJGrehjbzMAjFp5/VKPp5tTpWIV4JHHZK1/BxbFRtf/siA2SWTe09caDmVtYYzWEIbBS4zw==",
-      "dependencies": {
-        "function-bind": "^1.1.1"
-      },
-      "engines": {
-        "node": ">= 0.4.0"
-      }
-    },
-    "node_modules/has-bigints": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/has-bigints/-/has-bigints-1.0.2.tgz",
-      "integrity": "sha512-tSvCKtBr9lkF0Ex0aQiP9N+OpV4zi2r/Nee5VkRDbaqv35RLYMzbwQfFSZZH0kR+Rd6302UJZ2p/bJCEoR3VoQ==",
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/has-property-descriptors": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/has-property-descriptors/-/has-property-descriptors-1.0.0.tgz",
-      "integrity": "sha512-62DVLZGoiEBDHQyqG4w9xCuZ7eJEwNmJRWw2VY84Oedb7WFcA27fiEVe8oUQx9hAUJ4ekurquucTGwsyO1XGdQ==",
-      "dependencies": {
-        "get-intrinsic": "^1.1.1"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/has-proto": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/has-proto/-/has-proto-1.0.1.tgz",
-      "integrity": "sha512-7qE+iP+O+bgF9clE5+UoBFzE65mlBiVj3tKCrlNQ0Ogwm0BjpT/gK4SlLYDMybDh5I3TCTKnPPa0oMG7JDYrhg==",
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/has-symbols": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.0.3.tgz",
-      "integrity": "sha512-l3LCuF6MgDNwTDKkdYGEihYjt5pRPbEg46rtlmnSPlUbgmB8LOIrKJbYYFBSbnPaJexMKtiPO8hmeRjRz2Td+A==",
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/has-tostringtag": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.0.tgz",
-      "integrity": "sha512-kFjcSNhnlGV1kyoGk7OXKSawH5JOb/LzUc5w9B02hOTO0dfFRjbHQKvg1d6cf3HbeUmtU9VbbV3qzZ2Teh97WQ==",
-      "dependencies": {
-        "has-symbols": "^1.0.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/hosted-git-info": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-4.1.0.tgz",
-      "integrity": "sha512-kyCuEOWjJqZuDbRHzL8V93NzQhwIB71oFWSyzVo+KPZI+pnQPPxucdkrOZvkLRnrf5URsQM+IJ09Dw29cRALIA==",
-      "dependencies": {
-        "lru-cache": "^6.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/human-signals": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/human-signals/-/human-signals-2.1.0.tgz",
-      "integrity": "sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw==",
-      "engines": {
-        "node": ">=10.17.0"
-      }
-    },
-    "node_modules/ieee754": {
-      "version": "1.1.13",
-      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.1.13.tgz",
-      "integrity": "sha512-4vf7I2LYV/HaWerSo3XmlMkp5eZ83i+/CDluXi/IGTs/O1sejBNhTtnxzmRZfvOUqj7lZjqHkeTvpgSFDlWZTg=="
-    },
-    "node_modules/inflight": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
-      "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
-      "dependencies": {
-        "once": "^1.3.0",
-        "wrappy": "1"
-      }
-    },
-    "node_modules/inherits": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
-      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="
-    },
-    "node_modules/ini": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ini/-/ini-2.0.0.tgz",
-      "integrity": "sha512-7PnF4oN3CvZF23ADhA5wRaYEQpJ8qygSkbtTXWBeXWXmEVRXK+1ITciHWwHhsjv1TmW0MgacIv6hEi5pX5NQdA==",
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/internal-slot": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/internal-slot/-/internal-slot-1.0.5.tgz",
-      "integrity": "sha512-Y+R5hJrzs52QCG2laLn4udYVnxsfny9CpOhNhUvk/SSSVyF6T27FzRbF0sroPidSu3X8oEAkOn2K804mjpt6UQ==",
-      "dependencies": {
-        "get-intrinsic": "^1.2.0",
-        "has": "^1.0.3",
-        "side-channel": "^1.0.4"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/is-arguments": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/is-arguments/-/is-arguments-1.1.1.tgz",
-      "integrity": "sha512-8Q7EARjzEnKpt/PCD7e1cgUS0a6X8u5tdSiMqXhojOdoV9TsMsiO+9VLC5vAmO8N7/GmXn7yjR8qnA6bVAEzfA==",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "has-tostringtag": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-array-buffer": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/is-array-buffer/-/is-array-buffer-3.0.2.tgz",
-      "integrity": "sha512-y+FyyR/w8vfIRq4eQcM1EYgSTnmHXPqaF+IgzgraytCFq5Xh8lllDVmAZolPJiZttZLeFSINPYMaEJ7/vWUa1w==",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "get-intrinsic": "^1.2.0",
-        "is-typed-array": "^1.1.10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-bigint": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/is-bigint/-/is-bigint-1.0.4.tgz",
-      "integrity": "sha512-zB9CruMamjym81i2JZ3UMn54PKGsQzsJeo6xvN3HJJ4CAsQNB6iRutp2To77OfCNuoxspsIhzaPoO1zyCEhFOg==",
-      "dependencies": {
-        "has-bigints": "^1.0.1"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-boolean-object": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/is-boolean-object/-/is-boolean-object-1.1.2.tgz",
-      "integrity": "sha512-gDYaKHJmnj4aWxyj6YHyXVpdQawtVLHU5cb+eztPGczf6cjuTdwve5ZIEfgXqH4e57An1D1AKf8CZ3kYrQRqYA==",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "has-tostringtag": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-callable": {
-      "version": "1.2.7",
-      "resolved": "https://registry.npmjs.org/is-callable/-/is-callable-1.2.7.tgz",
-      "integrity": "sha512-1BC0BVFhS/p0qtw6enp8e+8OD0UrK0oFLztSjNzhcKA3WDuJxxAPXzPuPtKkjEY9UUoEWlX/8fgKeu2S8i9JTA==",
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-core-module": {
-      "version": "2.13.0",
-      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.13.0.tgz",
-      "integrity": "sha512-Z7dk6Qo8pOCp3l4tsX2C5ZVas4V+UxwQodwZhLopL91TX8UyyHEXafPcyoeeWuLrwzHcr3igO78wNLwHJHsMCQ==",
-      "dependencies": {
-        "has": "^1.0.3"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-date-object": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/is-date-object/-/is-date-object-1.0.5.tgz",
-      "integrity": "sha512-9YQaSxsAiSwcvS33MBk3wTCVnWK+HhF8VZR2jRxehM16QcVOdHqPn4VPHmRK4lSr38n9JriurInLcP90xsYNfQ==",
-      "dependencies": {
-        "has-tostringtag": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-fullwidth-code-point": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
-      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/is-generator-function": {
-      "version": "1.0.10",
-      "resolved": "https://registry.npmjs.org/is-generator-function/-/is-generator-function-1.0.10.tgz",
-      "integrity": "sha512-jsEjy9l3yiXEQ+PsXdmBwEPcOxaXWLspKdplFUVI9vq1iZgIekeC0L167qeu86czQaxed3q/Uzuw0swL0irL8A==",
-      "dependencies": {
-        "has-tostringtag": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-negative-zero": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/is-negative-zero/-/is-negative-zero-2.0.2.tgz",
-      "integrity": "sha512-dqJvarLawXsFbNDeJW7zAz8ItJ9cd28YufuuFzh0G8pNHjJMnY08Dv7sYX2uF5UpQOwieAeOExEYAWWfu7ZZUA==",
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-number-object": {
-      "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/is-number-object/-/is-number-object-1.0.7.tgz",
-      "integrity": "sha512-k1U0IRzLMo7ZlYIfzRu23Oh6MiIFasgpb9X76eqfFZAqwH44UI4KTBvBYIZ1dSL9ZzChTB9ShHfLkR4pdW5krQ==",
-      "dependencies": {
-        "has-tostringtag": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-regex": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/is-regex/-/is-regex-1.1.4.tgz",
-      "integrity": "sha512-kvRdxDsxZjhzUX07ZnLydzS1TU/TJlTUHHY4YLL87e37oUA49DfkLqgy+VjFocowy29cKvcSiu+kIv728jTTVg==",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "has-tostringtag": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-shared-array-buffer": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/is-shared-array-buffer/-/is-shared-array-buffer-1.0.2.tgz",
-      "integrity": "sha512-sqN2UDu1/0y6uvXyStCOzyhAjCSlHceFoMKJW8W9EU9cvic/QdsZ0kEU93HEy3IUEFZIiH/3w+AH/UQbPHNdhA==",
-      "dependencies": {
-        "call-bind": "^1.0.2"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-stream": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz",
-      "integrity": "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==",
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/is-string": {
-      "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/is-string/-/is-string-1.0.7.tgz",
-      "integrity": "sha512-tE2UXzivje6ofPW7l23cjDOMa09gb7xlAqG6jG5ej6uPV32TlWP3NKPigtaGeHNu9fohccRYvIiZMfOOnOYUtg==",
-      "dependencies": {
-        "has-tostringtag": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-symbol": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/is-symbol/-/is-symbol-1.0.4.tgz",
-      "integrity": "sha512-C/CPBqKWnvdcxqIARxyOh4v1UUEOCHpgDa0WYgpKDFMszcrPcffg5uhwSgPCLD2WWxmq6isisz87tzT01tuGhg==",
-      "dependencies": {
-        "has-symbols": "^1.0.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-typed-array": {
-      "version": "1.1.12",
-      "resolved": "https://registry.npmjs.org/is-typed-array/-/is-typed-array-1.1.12.tgz",
-      "integrity": "sha512-Z14TF2JNG8Lss5/HMqt0//T9JeHXttXy5pH/DBU4vi98ozO2btxzq9MwYDZYnKwU8nRsz/+GVFVRDq3DkVuSPg==",
-      "dependencies": {
-        "which-typed-array": "^1.1.11"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-weakref": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/is-weakref/-/is-weakref-1.0.2.tgz",
-      "integrity": "sha512-qctsuLZmIQ0+vSSMfoVvyFe2+GSEvnmZ2ezTup1SBse9+twCCeial6EEi3Nc2KFcf6+qz2FBPnjXsk8xhKSaPQ==",
-      "dependencies": {
-        "call-bind": "^1.0.2"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/isarray": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz",
-      "integrity": "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ=="
-    },
-    "node_modules/isexe": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
-      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw=="
-    },
-    "node_modules/jmespath": {
-      "version": "0.16.0",
-      "resolved": "https://registry.npmjs.org/jmespath/-/jmespath-0.16.0.tgz",
-      "integrity": "sha512-9FzQjJ7MATs1tSpnco1K6ayiYE3figslrXA72G2HQ/n76RzvYlofyi5QM+iX4YRs/pu3yzxlVQSST23+dMDknw==",
-      "engines": {
-        "node": ">= 0.6.0"
-      }
-    },
-    "node_modules/js-yaml": {
-      "version": "3.14.2",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz",
-      "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==",
-      "license": "MIT",
-      "dependencies": {
-        "argparse": "^1.0.7",
-        "esprima": "^4.0.0"
-      },
-      "bin": {
-        "js-yaml": "bin/js-yaml.js"
-      }
-    },
-    "node_modules/json-parse-even-better-errors": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/json-parse-even-better-errors/-/json-parse-even-better-errors-2.3.1.tgz",
-      "integrity": "sha512-xyFwyhro/JEof6Ghe2iz2NcXoj2sloNsWr/XsERDK/oiPCfaNhl5ONfp+jQdAZRQQ0IJWNzH9zIZF7li91kh2w=="
-    },
-    "node_modules/locate-path": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-7.2.0.tgz",
-      "integrity": "sha512-gvVijfZvn7R+2qyPX8mAuKcFGDf6Nc61GdvGafQsHL0sBIxfKzA+usWn4GFC/bk+QdwPUD4kWFJLhElipq+0VA==",
-      "dependencies": {
-        "p-locate": "^6.0.0"
-      },
-      "engines": {
-        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/lodash.camelcase": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/lodash.camelcase/-/lodash.camelcase-4.3.0.tgz",
-      "integrity": "sha512-TwuEnCnxbc3rAvhf/LbG7tJUDzhqXyFnv3dtzLOPgCG/hODL7WFnsbwktkD7yUV0RrreP/l1PALq/YSg6VvjlA==",
-      "license": "MIT"
-    },
-    "node_modules/long": {
-      "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/long/-/long-5.3.2.tgz",
-      "integrity": "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==",
-      "license": "Apache-2.0"
-    },
-    "node_modules/lru-cache": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
-      "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
-      "dependencies": {
-        "yallist": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/make-error": {
-      "version": "1.3.6",
-      "resolved": "https://registry.npmjs.org/make-error/-/make-error-1.3.6.tgz",
-      "integrity": "sha512-s8UhlNe7vPKomQhC1qFelMokr/Sc3AgNbso3n74mVPA5LTZwkB9NlXf4XPamLxJE8h0gh73rM94xvwRT2CVInw=="
-    },
-    "node_modules/merge-stream": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/merge-stream/-/merge-stream-2.0.0.tgz",
-      "integrity": "sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w=="
-    },
-    "node_modules/mime": {
-      "version": "2.6.0",
-      "resolved": "https://registry.npmjs.org/mime/-/mime-2.6.0.tgz",
-      "integrity": "sha512-USPkMeET31rOMiarsBNIHZKLGgvKc/LrjofAnBlOttf5ajRvqiRA8QsenbcooctK6d6Ts6aqZXBA+XbkKthiQg==",
-      "bin": {
-        "mime": "cli.js"
-      },
-      "engines": {
-        "node": ">=4.0.0"
-      }
-    },
-    "node_modules/mimic-fn": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/mimic-fn/-/mimic-fn-2.1.0.tgz",
-      "integrity": "sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/minimatch": {
-      "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
-      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
-      "license": "ISC",
-      "dependencies": {
-        "brace-expansion": "^1.1.7"
-      },
-      "engines": {
-        "node": "*"
-      }
-    },
-    "node_modules/minimist": {
-      "version": "1.2.8",
-      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
-      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/mkdirp": {
-      "version": "0.5.6",
-      "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.6.tgz",
-      "integrity": "sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==",
-      "dependencies": {
-        "minimist": "^1.2.6"
-      },
-      "bin": {
-        "mkdirp": "bin/cmd.js"
-      }
-    },
-    "node_modules/module-details-from-path": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/module-details-from-path/-/module-details-from-path-1.0.3.tgz",
-      "integrity": "sha512-ySViT69/76t8VhE1xXHK6Ch4NcDd26gx0MzKXLO+F7NOtnqH68d9zF94nT8ZWSxXh8ELOERsnJO/sWt1xZYw5A=="
-    },
-    "node_modules/ms": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
-      "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w=="
-    },
-    "node_modules/normalize-package-data": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/normalize-package-data/-/normalize-package-data-3.0.3.tgz",
-      "integrity": "sha512-p2W1sgqij3zMMyRC067Dg16bfzVH+w7hyegmpIvZ4JNjqtGOVAIvLmjBx3yP7YTe9vKJgkoNOPjwQGogDoMXFA==",
-      "dependencies": {
-        "hosted-git-info": "^4.0.1",
-        "is-core-module": "^2.5.0",
-        "semver": "^7.3.4",
-        "validate-npm-package-license": "^3.0.1"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/normalize-package-data/node_modules/semver": {
-      "version": "7.5.4",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
-      "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
-      "dependencies": {
-        "lru-cache": "^6.0.0"
-      },
-      "bin": {
-        "semver": "bin/semver.js"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/npm-normalize-package-bin": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/npm-normalize-package-bin/-/npm-normalize-package-bin-1.0.1.tgz",
-      "integrity": "sha512-EPfafl6JL5/rU+ot6P3gRSCpPDW5VmIzX959Ob1+ySFUuuYHWHekXpwdUZcKP5C+DS4GEtdJluwBjnsNDl+fSA=="
-    },
-    "node_modules/npm-run-path": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-4.0.1.tgz",
-      "integrity": "sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw==",
-      "dependencies": {
-        "path-key": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/object-inspect": {
-      "version": "1.12.3",
-      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.12.3.tgz",
-      "integrity": "sha512-geUvdk7c+eizMNUDkRpW1wJwgfOiOeHbxBR/hLXK1aT6zmVSO0jsQcs7fj6MGw89jC/cjGfLcNOrtMYtGqm81g==",
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/object-keys": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/object-keys/-/object-keys-1.1.1.tgz",
-      "integrity": "sha512-NuAESUOUMrlIXOfHKzD6bpPu3tYt3xvjNdRIQ+FeT0lNb4K8WR70CaDxhuNguS2XG+GjkyMwOzsN5ZktImfhLA==",
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/object.assign": {
-      "version": "4.1.4",
-      "resolved": "https://registry.npmjs.org/object.assign/-/object.assign-4.1.4.tgz",
-      "integrity": "sha512-1mxKf0e58bvyjSCtKYY4sRe9itRk3PJpquJOjeIkz885CczcI4IvJJDLPS72oowuSh+pBxUFROpX+TU++hxhZQ==",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "has-symbols": "^1.0.3",
-        "object-keys": "^1.1.1"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/object.getownpropertydescriptors": {
-      "version": "2.1.6",
-      "resolved": "https://registry.npmjs.org/object.getownpropertydescriptors/-/object.getownpropertydescriptors-2.1.6.tgz",
-      "integrity": "sha512-lq+61g26E/BgHv0ZTFgRvi7NMEPuAxLkFU7rukXjc/AlwH4Am5xXVnIXy3un1bg/JPbXHrixRkK1itUzzPiIjQ==",
-      "dependencies": {
-        "array.prototype.reduce": "^1.0.5",
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.2.0",
-        "es-abstract": "^1.21.2",
-        "safe-array-concat": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/once": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
-      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
-      "dependencies": {
-        "wrappy": "1"
-      }
-    },
-    "node_modules/onetime": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/onetime/-/onetime-5.1.2.tgz",
-      "integrity": "sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==",
-      "dependencies": {
-        "mimic-fn": "^2.1.0"
-      },
-      "engines": {
-        "node": ">=6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/p-limit": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-4.0.0.tgz",
-      "integrity": "sha512-5b0R4txpzjPWVw/cXXUResoD4hb6U/x9BH08L7nw+GN1sezDzPdxeRvpc9c433fZhBan/wusjbCsqwqm4EIBIQ==",
-      "dependencies": {
-        "yocto-queue": "^1.0.0"
-      },
-      "engines": {
-        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/p-locate": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-6.0.0.tgz",
-      "integrity": "sha512-wPrq66Llhl7/4AGC6I+cqxT07LhXvWL08LNXz1fENOw0Ap4sRZZ/gZpTTJ5jpurzzzfS2W/Ge9BY3LgLjCShcw==",
-      "dependencies": {
-        "p-limit": "^4.0.0"
-      },
-      "engines": {
-        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/path-exists": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-5.0.0.tgz",
-      "integrity": "sha512-RjhtfwJOxzcFmNOi6ltcbcu4Iu+FL3zEj83dk4kAS+fVpTxXLO1b38RvJgT/0QwvV/L3aY9TAnyv0EOqW4GoMQ==",
-      "engines": {
-        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
-      }
-    },
-    "node_modules/path-is-absolute": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
-      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/path-key": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
-      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/path-parse": {
-      "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/path-parse/-/path-parse-1.0.7.tgz",
-      "integrity": "sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw=="
-    },
-    "node_modules/pkg-dir": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/pkg-dir/-/pkg-dir-7.0.0.tgz",
-      "integrity": "sha512-Ie9z/WINcxxLp27BKOCHGde4ITq9UklYKDzVo1nhk5sqGEXU3FpkwP5GM2voTGJkGd9B3Otl+Q4uwSOeSUtOBA==",
-      "dependencies": {
-        "find-up": "^6.3.0"
-      },
-      "engines": {
-        "node": ">=14.16"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/protobufjs": {
-      "version": "7.5.6",
-      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.5.6.tgz",
-      "integrity": "sha512-M71sTMB146U3u0di3yup8iM+zv8yPRNQVr1KK4tyBitl3qFvEGucq/rGDRShD2rsJhtN02RJaJ7j5X5hmy8SJg==",
-      "hasInstallScript": true,
-      "license": "BSD-3-Clause",
-      "dependencies": {
-        "@protobufjs/aspromise": "^1.1.2",
-        "@protobufjs/base64": "^1.1.2",
-        "@protobufjs/codegen": "^2.0.5",
-        "@protobufjs/eventemitter": "^1.1.0",
-        "@protobufjs/fetch": "^1.1.0",
-        "@protobufjs/float": "^1.0.2",
-        "@protobufjs/inquire": "^1.1.1",
-        "@protobufjs/path": "^1.1.2",
-        "@protobufjs/pool": "^1.1.0",
-        "@protobufjs/utf8": "^1.1.1",
-        "@types/node": ">=13.7.0",
-        "long": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=12.0.0"
-      }
-    },
-    "node_modules/pulumi": {
-      "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/pulumi/-/pulumi-0.0.1.tgz",
-      "integrity": "sha512-Sow9mG2Yf3vRwQV5pux3EfZNvs7uoEjhYGTUWeGDTVrRT/6w3xybp8/a+SpDkH7dooHnGWDJW4QrSAbd+HvK5A==",
-      "deprecated": "To install Pulumi, use the @pulumi/pulumi package: 'npm -i @pulumi/pulumi'",
-      "dev": true
-    },
-    "node_modules/punycode": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/punycode/-/punycode-1.3.2.tgz",
-      "integrity": "sha512-RofWgt/7fL5wP1Y7fxE7/EmTLzQVnB0ycyibJ0OOHIlJqTNzglYFxVwETOcIoJqJmpDXJ9xImDv+Fq34F/d4Dw=="
-    },
-    "node_modules/querystring": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/querystring/-/querystring-0.2.0.tgz",
-      "integrity": "sha512-X/xY82scca2tau62i9mDyU9K+I+djTMUsvwf7xnUX5GLvVzgJybOJf4Y6o9Zx3oJK/LSXg5tTZBjwzqVPaPO2g==",
-      "deprecated": "The querystring API is considered Legacy. new code should use the URLSearchParams API instead.",
-      "engines": {
-        "node": ">=0.4.x"
-      }
-    },
-    "node_modules/read-package-json": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/read-package-json/-/read-package-json-2.1.2.tgz",
-      "integrity": "sha512-D1KmuLQr6ZSJS0tW8hf3WGpRlwszJOXZ3E8Yd/DNRaM5d+1wVRZdHlpGBLAuovjr28LbWvjpWkBHMxpRGGjzNA==",
-      "dependencies": {
-        "glob": "^7.1.1",
-        "json-parse-even-better-errors": "^2.3.0",
-        "normalize-package-data": "^2.0.0",
-        "npm-normalize-package-bin": "^1.0.0"
-      }
-    },
-    "node_modules/read-package-json/node_modules/hosted-git-info": {
-      "version": "2.8.9",
-      "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-2.8.9.tgz",
-      "integrity": "sha512-mxIDAb9Lsm6DoOJ7xH+5+X4y1LU/4Hi50L9C5sIswK3JzULS4bwk1FvjdBgvYR4bzT4tuUQiC15FE2f5HbLvYw=="
-    },
-    "node_modules/read-package-json/node_modules/normalize-package-data": {
-      "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/normalize-package-data/-/normalize-package-data-2.5.0.tgz",
-      "integrity": "sha512-/5CMN3T0R4XTj4DcGaexo+roZSdSFW/0AOOTROrjxzCG1wrWXEsGbRKevjlIL+ZDE4sZlJr5ED4YW0yqmkK+eA==",
-      "dependencies": {
-        "hosted-git-info": "^2.1.4",
-        "resolve": "^1.10.0",
-        "semver": "2 || 3 || 4 || 5",
-        "validate-npm-package-license": "^3.0.1"
-      }
-    },
-    "node_modules/read-package-tree": {
-      "version": "5.3.1",
-      "resolved": "https://registry.npmjs.org/read-package-tree/-/read-package-tree-5.3.1.tgz",
-      "integrity": "sha512-mLUDsD5JVtlZxjSlPPx1RETkNjjvQYuweKwNVt1Sn8kP5Jh44pvYuUHCp6xSVDZWbNxVxG5lyZJ921aJH61sTw==",
-      "deprecated": "The functionality that this package provided is now in @npmcli/arborist",
-      "dependencies": {
-        "read-package-json": "^2.0.0",
-        "readdir-scoped-modules": "^1.0.0",
-        "util-promisify": "^2.1.0"
-      }
-    },
-    "node_modules/readdir-scoped-modules": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/readdir-scoped-modules/-/readdir-scoped-modules-1.1.0.tgz",
-      "integrity": "sha512-asaikDeqAQg7JifRsZn1NJZXo9E+VwlyCfbkZhwyISinqk5zNS6266HS5kah6P0SaQKGF6SkNnZVHUzHFYxYDw==",
-      "deprecated": "This functionality has been moved to @npmcli/fs",
-      "dependencies": {
-        "debuglog": "^1.0.1",
-        "dezalgo": "^1.0.0",
-        "graceful-fs": "^4.1.2",
-        "once": "^1.3.0"
-      }
-    },
-    "node_modules/regexp.prototype.flags": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/regexp.prototype.flags/-/regexp.prototype.flags-1.5.0.tgz",
-      "integrity": "sha512-0SutC3pNudRKgquxGoRGIz946MZVHqbNfPjBdxeOhBrdgDKlRoXmYLQN9xRbrR09ZXWeGAdPuif7egofn6v5LA==",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.2.0",
-        "functions-have-names": "^1.2.3"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/require-directory": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/require-directory/-/require-directory-2.1.1.tgz",
-      "integrity": "sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/require-from-string": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
-      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/require-in-the-middle": {
-      "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/require-in-the-middle/-/require-in-the-middle-5.2.0.tgz",
-      "integrity": "sha512-efCx3b+0Z69/LGJmm9Yvi4cqEdxnoGnxYxGxBghkkTTFeXRtTCmmhO0AnAfHz59k957uTSuy8WaHqOs8wbYUWg==",
-      "dependencies": {
-        "debug": "^4.1.1",
-        "module-details-from-path": "^1.0.3",
-        "resolve": "^1.22.1"
-      },
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/resolve": {
-      "version": "1.22.4",
-      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.4.tgz",
-      "integrity": "sha512-PXNdCiPqDqeUou+w1C2eTQbNfxKSuMxqTCuvlmmMsk1NWHL5fRrhY6Pl0qEYYc6+QqGClco1Qj8XnjPego4wfg==",
-      "dependencies": {
-        "is-core-module": "^2.13.0",
-        "path-parse": "^1.0.7",
-        "supports-preserve-symlinks-flag": "^1.0.0"
-      },
-      "bin": {
-        "resolve": "bin/resolve"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/safe-array-concat": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/safe-array-concat/-/safe-array-concat-1.0.0.tgz",
-      "integrity": "sha512-9dVEFruWIsnie89yym+xWTAYASdpw3CJV7Li/6zBewGf9z2i1j31rP6jnY0pHEO4QZh6N0K11bFjWmdR8UGdPQ==",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "get-intrinsic": "^1.2.0",
-        "has-symbols": "^1.0.3",
-        "isarray": "^2.0.5"
-      },
-      "engines": {
-        "node": ">=0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/safe-array-concat/node_modules/isarray": {
-      "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/isarray/-/isarray-2.0.5.tgz",
-      "integrity": "sha512-xHjhDr3cNBK0BzdUJSPXZntQUx/mwMS5Rw4A7lPJ90XGAO6ISP/ePDNuo0vhqOZU+UD5JoodwCAAoZQd3FeAKw=="
-    },
-    "node_modules/safe-regex-test": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/safe-regex-test/-/safe-regex-test-1.0.0.tgz",
-      "integrity": "sha512-JBUUzyOgEwXQY1NuPtvcj/qcBDbDmEvWufhlnXZIm75DEHp+afM1r1ujJpJsV/gSM4t59tpDyPi1sd6ZaPFfsA==",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "get-intrinsic": "^1.1.3",
-        "is-regex": "^1.1.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/sax": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/sax/-/sax-1.2.1.tgz",
-      "integrity": "sha512-8I2a3LovHTOpm7NV5yOyO8IHqgVsfK4+UuySrXU8YXkSRX7k6hCV9b3HrkKCr3nMpgj+0bmocaJJWpvp1oc7ZA==",
-      "license": "ISC"
-    },
-    "node_modules/semver": {
-      "version": "5.7.2",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz",
-      "integrity": "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g==",
-      "bin": {
-        "semver": "bin/semver"
-      }
-    },
-    "node_modules/shebang-command": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
-      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
-      "dependencies": {
-        "shebang-regex": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/shebang-regex": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
-      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/shimmer": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/shimmer/-/shimmer-1.2.1.tgz",
-      "integrity": "sha512-sQTKC1Re/rM6XyFM6fIAGHRPVGvyXfgzIDvzoq608vM+jeyVD0Tu1E6Np0Kc2zAIFWIj963V2800iF/9LPieQw=="
-    },
-    "node_modules/side-channel": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.0.4.tgz",
-      "integrity": "sha512-q5XPytqFEIKHkGdiMIrY10mvLRvnQh42/+GoBlFW3b2LXLE2xxJpZFdm94we0BaoV3RwJyGqg5wS7epxTv0Zvw==",
-      "dependencies": {
-        "call-bind": "^1.0.0",
-        "get-intrinsic": "^1.0.2",
-        "object-inspect": "^1.9.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/signal-exit": {
-      "version": "3.0.7",
-      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
-      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ=="
-    },
-    "node_modules/source-map": {
-      "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/source-map-support": {
-      "version": "0.5.21",
-      "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.21.tgz",
-      "integrity": "sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w==",
-      "dependencies": {
-        "buffer-from": "^1.0.0",
-        "source-map": "^0.6.0"
-      }
-    },
-    "node_modules/spdx-correct": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/spdx-correct/-/spdx-correct-3.2.0.tgz",
-      "integrity": "sha512-kN9dJbvnySHULIluDHy32WHRUu3Og7B9sbY7tsFLctQkIqnMh3hErYgdMjTYuqmcXX+lK5T1lnUt3G7zNswmZA==",
-      "dependencies": {
-        "spdx-expression-parse": "^3.0.0",
-        "spdx-license-ids": "^3.0.0"
-      }
-    },
-    "node_modules/spdx-exceptions": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/spdx-exceptions/-/spdx-exceptions-2.3.0.tgz",
-      "integrity": "sha512-/tTrYOC7PPI1nUAgx34hUpqXuyJG+DTHJTnIULG4rDygi4xu/tfgmq1e1cIRwRzwZgo4NLySi+ricLkZkw4i5A=="
-    },
-    "node_modules/spdx-expression-parse": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-3.0.1.tgz",
-      "integrity": "sha512-cbqHunsQWnJNE6KhVSMsMeH5H/L9EpymbzqTQ3uLwNCLZ1Q481oWaofqH7nO6V07xlXwY6PhQdQ2IedWx/ZK4Q==",
-      "dependencies": {
-        "spdx-exceptions": "^2.1.0",
-        "spdx-license-ids": "^3.0.0"
-      }
-    },
-    "node_modules/spdx-license-ids": {
-      "version": "3.0.13",
-      "resolved": "https://registry.npmjs.org/spdx-license-ids/-/spdx-license-ids-3.0.13.tgz",
-      "integrity": "sha512-XkD+zwiqXHikFZm4AX/7JSCXA98U5Db4AFd5XUg/+9UNtnH75+Z9KxtpYiJZx36mUDVOwH83pl7yvCer6ewM3w=="
-    },
-    "node_modules/sprintf-js": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz",
-      "integrity": "sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g=="
-    },
-    "node_modules/string-width": {
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
-      "license": "MIT",
-      "dependencies": {
-        "emoji-regex": "^8.0.0",
-        "is-fullwidth-code-point": "^3.0.0",
-        "strip-ansi": "^6.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/string.prototype.trim": {
-      "version": "1.2.7",
-      "resolved": "https://registry.npmjs.org/string.prototype.trim/-/string.prototype.trim-1.2.7.tgz",
-      "integrity": "sha512-p6TmeT1T3411M8Cgg9wBTMRtY2q9+PNy9EV1i2lIXUN/btt763oIfxwN3RR8VU6wHX8j/1CFy0L+YuThm6bgOg==",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/string.prototype.trimend": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/string.prototype.trimend/-/string.prototype.trimend-1.0.6.tgz",
-      "integrity": "sha512-JySq+4mrPf9EsDBEDYMOb/lM7XQLulwg5R/m1r0PXEFqrV0qHvl58sdTilSXtKOflCsK2E8jxf+GKC0T07RWwQ==",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/string.prototype.trimstart": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/string.prototype.trimstart/-/string.prototype.trimstart-1.0.6.tgz",
-      "integrity": "sha512-omqjMDaY92pbn5HOX7f9IccLA+U1tA9GvtU4JrodiXFfYB7jPzzHpRzpglLAjtUV6bB557zwClJezTqnAiYnQA==",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/strip-ansi": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
-      "license": "MIT",
-      "dependencies": {
-        "ansi-regex": "^5.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/strip-final-newline": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/strip-final-newline/-/strip-final-newline-2.0.0.tgz",
-      "integrity": "sha512-BrpvfNAE3dcvq7ll3xVumzjKjZQ5tI1sEUIKr3Uoks0XUl45St3FlatVqef9prk4jRDzhW6WZg+3bk93y6pLjA==",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/supports-preserve-symlinks-flag": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/supports-preserve-symlinks-flag/-/supports-preserve-symlinks-flag-1.0.0.tgz",
-      "integrity": "sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==",
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/ts-node": {
-      "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/ts-node/-/ts-node-7.0.1.tgz",
-      "integrity": "sha512-BVwVbPJRspzNh2yfslyT1PSbl5uIk03EZlb493RKHN4qej/D06n1cEhjlOJG69oFsE7OT8XjpTUcYf6pKTLMhw==",
-      "dependencies": {
-        "arrify": "^1.0.0",
-        "buffer-from": "^1.1.0",
-        "diff": "^3.1.0",
-        "make-error": "^1.1.1",
-        "minimist": "^1.2.0",
-        "mkdirp": "^0.5.1",
-        "source-map-support": "^0.5.6",
-        "yn": "^2.0.0"
-      },
-      "bin": {
-        "ts-node": "dist/bin.js"
-      },
-      "engines": {
-        "node": ">=4.2.0"
-      }
-    },
-    "node_modules/typed-array-buffer": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/typed-array-buffer/-/typed-array-buffer-1.0.0.tgz",
-      "integrity": "sha512-Y8KTSIglk9OZEr8zywiIHG/kmQ7KWyjseXs1CbSo8vC42w7hg2HgYTxSWwP0+is7bWDc1H+Fo026CpHFwm8tkw==",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "get-intrinsic": "^1.2.1",
-        "is-typed-array": "^1.1.10"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/typed-array-byte-length": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/typed-array-byte-length/-/typed-array-byte-length-1.0.0.tgz",
-      "integrity": "sha512-Or/+kvLxNpeQ9DtSydonMxCx+9ZXOswtwJn17SNLvhptaXYDJvkFFP5zbfU/uLmvnBJlI4yrnXRxpdWH/M5tNA==",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "for-each": "^0.3.3",
-        "has-proto": "^1.0.1",
-        "is-typed-array": "^1.1.10"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/typed-array-byte-offset": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/typed-array-byte-offset/-/typed-array-byte-offset-1.0.0.tgz",
-      "integrity": "sha512-RD97prjEt9EL8YgAgpOkf3O4IF9lhJFr9g0htQkm0rchFp/Vx7LW5Q8fSXXub7BXAODyUQohRMyOc3faCPd0hg==",
-      "dependencies": {
-        "available-typed-arrays": "^1.0.5",
-        "call-bind": "^1.0.2",
-        "for-each": "^0.3.3",
-        "has-proto": "^1.0.1",
-        "is-typed-array": "^1.1.10"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/typed-array-length": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/typed-array-length/-/typed-array-length-1.0.4.tgz",
-      "integrity": "sha512-KjZypGq+I/H7HI5HlOoGHkWUUGq+Q0TPhQurLbyrVrvnKTBgzLhIJ7j6J/XTQOi0d1RjyZ0wdas8bKs2p0x3Ng==",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "for-each": "^0.3.3",
-        "is-typed-array": "^1.1.9"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/typescript": {
-      "version": "3.8.3",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-3.8.3.tgz",
-      "integrity": "sha512-MYlEfn5VrLNsgudQTVJeNaQFUAI7DkhnOjdpAp4T+ku1TfQClewlbSuTVHiA+8skNBgaf02TL/kLOvig4y3G8w==",
-      "bin": {
-        "tsc": "bin/tsc",
-        "tsserver": "bin/tsserver"
-      },
-      "engines": {
-        "node": ">=4.2.0"
-      }
-    },
-    "node_modules/unbox-primitive": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/unbox-primitive/-/unbox-primitive-1.0.2.tgz",
-      "integrity": "sha512-61pPlCD9h51VoreyJ0BReideM3MDKMKnh6+V9L08331ipq6Q8OFXZYiqP6n/tbHx4s5I9uRhcye6BrbkizkBDw==",
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "has-bigints": "^1.0.2",
-        "has-symbols": "^1.0.3",
-        "which-boxed-primitive": "^1.0.2"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/upath": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/upath/-/upath-1.2.0.tgz",
-      "integrity": "sha512-aZwGpamFO61g3OlfT7OQCHqhGnW43ieH9WZeP7QxN/G/jS4jfqUkZxoryvJgVPEcrl5NL/ggHsSmLMHuH64Lhg==",
-      "engines": {
-        "node": ">=4",
-        "yarn": "*"
-      }
-    },
-    "node_modules/url": {
-      "version": "0.10.3",
-      "resolved": "https://registry.npmjs.org/url/-/url-0.10.3.tgz",
-      "integrity": "sha512-hzSUW2q06EqL1gKM/a+obYHLIO6ct2hwPuviqTTOcfFVc61UbfJ2Q32+uGL/HCPxKqrdGB5QUwIe7UqlDgwsOQ==",
-      "dependencies": {
-        "punycode": "1.3.2",
-        "querystring": "0.2.0"
-      }
-    },
-    "node_modules/util": {
-      "version": "0.12.5",
-      "resolved": "https://registry.npmjs.org/util/-/util-0.12.5.tgz",
-      "integrity": "sha512-kZf/K6hEIrWHI6XqOFUiiMa+79wE/D8Q+NCNAWclkyg3b4d2k7s0QGepNjiABc+aR3N1PAyHL7p6UcLY6LmrnA==",
-      "dependencies": {
-        "inherits": "^2.0.3",
-        "is-arguments": "^1.0.4",
-        "is-generator-function": "^1.0.7",
-        "is-typed-array": "^1.1.3",
-        "which-typed-array": "^1.1.2"
-      }
-    },
-    "node_modules/util-promisify": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/util-promisify/-/util-promisify-2.1.0.tgz",
-      "integrity": "sha512-K+5eQPYs14b3+E+hmE2J6gCZ4JmMl9DbYS6BeP2CHq6WMuNxErxf5B/n0fz85L8zUuoO6rIzNNmIQDu/j+1OcA==",
-      "dependencies": {
-        "object.getownpropertydescriptors": "^2.0.3"
-      }
-    },
-    "node_modules/uuid": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.0.0.tgz",
-      "integrity": "sha512-jOXGuXZAWdsTH7eZLtyXMqUb9EcWMGZNbL9YcGBJl4MH4nrxHmZJhEHvyLFrkxo+28uLb/NYRcStH48fnD0Vzw==",
-      "bin": {
-        "uuid": "dist/bin/uuid"
-      }
-    },
-    "node_modules/validate-npm-package-license": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/validate-npm-package-license/-/validate-npm-package-license-3.0.4.tgz",
-      "integrity": "sha512-DpKm2Ui/xN7/HQKCtpZxoRWBhZ9Z0kqtygG8XCgNQ8ZlDnxuQmWhj566j8fN4Cu3/JmbhsDo7fcAJq4s9h27Ew==",
-      "dependencies": {
-        "spdx-correct": "^3.0.0",
-        "spdx-expression-parse": "^3.0.0"
-      }
-    },
-    "node_modules/which": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
-      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
-      "dependencies": {
-        "isexe": "^2.0.0"
-      },
-      "bin": {
-        "node-which": "bin/node-which"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/which-boxed-primitive": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/which-boxed-primitive/-/which-boxed-primitive-1.0.2.tgz",
-      "integrity": "sha512-bwZdv0AKLpplFY2KZRX6TvyuN7ojjr7lwkg6ml0roIy9YeuSr7JS372qlNW18UQYzgYK9ziGcerWqZOmEn9VNg==",
-      "dependencies": {
-        "is-bigint": "^1.0.1",
-        "is-boolean-object": "^1.1.0",
-        "is-number-object": "^1.0.4",
-        "is-string": "^1.0.5",
-        "is-symbol": "^1.0.3"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/which-typed-array": {
-      "version": "1.1.11",
-      "resolved": "https://registry.npmjs.org/which-typed-array/-/which-typed-array-1.1.11.tgz",
-      "integrity": "sha512-qe9UWWpkeG5yzZ0tNYxDmd7vo58HDBc39mZ0xWWpolAGADdFOzkfamWLDxkOWcvHQKVmdTyQdLD4NOfjLWTKew==",
-      "dependencies": {
-        "available-typed-arrays": "^1.0.5",
-        "call-bind": "^1.0.2",
-        "for-each": "^0.3.3",
-        "gopd": "^1.0.1",
-        "has-tostringtag": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/wrap-ansi": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
-      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^4.0.0",
-        "string-width": "^4.1.0",
-        "strip-ansi": "^6.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
-      }
-    },
-    "node_modules/wrappy": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
-      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="
-    },
-    "node_modules/xml2js": {
-      "version": "0.6.2",
-      "resolved": "https://registry.npmjs.org/xml2js/-/xml2js-0.6.2.tgz",
-      "integrity": "sha512-T4rieHaC1EXcES0Kxxj4JWgaUQHDk+qwHcYOCFHfiwKz7tOVPLq7Hjq9dM1WCMhylqMEfP7hMcOIChvotiZegA==",
-      "license": "MIT",
-      "dependencies": {
-        "sax": ">=0.6.0",
-        "xmlbuilder": "~11.0.0"
-      },
-      "engines": {
-        "node": ">=4.0.0"
-      }
-    },
-    "node_modules/xmlbuilder": {
-      "version": "11.0.1",
-      "resolved": "https://registry.npmjs.org/xmlbuilder/-/xmlbuilder-11.0.1.tgz",
-      "integrity": "sha512-fDlsI/kFEx7gLvbecc0/ohLG50fugQp8ryHzMTuW9vSa1GJ0XYWKnhsUx7oie3G98+r56aTQIUB4kht42R3JvA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=4.0"
-      }
-    },
-    "node_modules/y18n": {
-      "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",
-      "integrity": "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==",
-      "license": "ISC",
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/yallist": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
-      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A=="
-    },
-    "node_modules/yargs": {
-      "version": "17.7.2",
-      "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.2.tgz",
-      "integrity": "sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==",
-      "license": "MIT",
-      "dependencies": {
-        "cliui": "^8.0.1",
-        "escalade": "^3.1.1",
-        "get-caller-file": "^2.0.5",
-        "require-directory": "^2.1.1",
-        "string-width": "^4.2.3",
-        "y18n": "^5.0.5",
-        "yargs-parser": "^21.1.1"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/yargs-parser": {
-      "version": "21.1.1",
-      "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-21.1.1.tgz",
-      "integrity": "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==",
-      "license": "ISC",
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/yn": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/yn/-/yn-2.0.0.tgz",
-      "integrity": "sha512-uTv8J/wiWTgUTg+9vLTi//leUl5vDQS6uii/emeTb2ssY7vl6QWf2fFbIIGjnhjvbdKlU0ed7QPgY1htTC86jQ==",
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/yocto-queue": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-1.0.0.tgz",
-      "integrity": "sha512-9bnSc/HEW2uRy67wc+T8UwauLuPJVn28jb+GtJY16iiKWyvmYJRXVT4UamsAEGQfPohgr2q4Tq0sQbQlxTfi1g==",
-      "engines": {
-        "node": ">=12.20"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    }
-  }
-}
diff --git a/chat-sdk/package-lock.json b/chat-sdk/package-lock.json
index 83475ba1c8..ff470d4ffe 100644
--- a/chat-sdk/package-lock.json
+++ b/chat-sdk/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "windmill-chat",
-  "version": "1.814.0",
+  "version": "1.817.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "windmill-chat",
-      "version": "1.814.0",
+      "version": "1.817.0",
       "license": "Apache-2.0",
       "devDependencies": {
         "@ai-sdk/react": "^4.0.102",
diff --git a/chat-sdk/package.json b/chat-sdk/package.json
index 57df9050f6..5655adc64e 100644
--- a/chat-sdk/package.json
+++ b/chat-sdk/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-chat",
   "description": "Build chat interfaces on Windmill flows deployed in chat mode, from any frontend or raw app",
-  "version": "1.814.0",
+  "version": "1.817.0",
   "author": "Ruben Fiszel",
   "license": "Apache-2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/chat-sdk#readme",
diff --git a/cli/build-npm.ts b/cli/build-npm.ts
index 1dbc9261de..776726c3a0 100644
--- a/cli/build-npm.ts
+++ b/cli/build-npm.ts
@@ -72,7 +72,7 @@ const packageJson = {
     url: "https://github.com/windmill-labs/windmill/issues",
   },
   dependencies: {
-    esbuild: "0.28.0",
+    esbuild: "0.28.2",
     ...Object.fromEntries(parserPackages.map(p => [p, cliDeps[p] ?? "*"])),
   },
   optionalDependencies: {
diff --git a/cli/bun.lock b/cli/bun.lock
index cf3a87bf41..0e0885f563 100644
--- a/cli/bun.lock
+++ b/cli/bun.lock
@@ -11,7 +11,7 @@
         "@cliffy/table": "npm:@jsr/cliffy__table@1.0.0",
         "@windmill-labs/shared-utils": "^1.0.13",
         "diff": "^5.2.0",
-        "esbuild": "0.28.0",
+        "esbuild": "0.28.2",
         "get-port": "7.1.0",
         "jszip": "3.8.0",
         "minimatch": "^10.0.0",
@@ -34,7 +34,7 @@
         "windmill-parser-wasm-ts": "1.695.0",
         "windmill-parser-wasm-yaml": "1.770.0",
         "windmill-yaml-validator": "1.1.1",
-        "ws": "8.18.0",
+        "ws": "8.21.3",
         "yaml": "^2.7.0",
       },
       "devDependencies": {
@@ -57,57 +57,57 @@
 
     "@cliffy/table": ["@jsr/cliffy__table@1.0.0", "https://npm.jsr.io/~/11/@jsr/cliffy__table/1.0.0.tgz", { "dependencies": { "@jsr/std__fmt": "^1.0.9" } }, "sha512-VoLxH0DjofHWPWKUc5N+oCwXB6O6e+carnhp23yJTa7qokBb+SCrTIABEgQdIe/p0bxgmZhz17xt2efaAxXvbQ=="],
 
-    "@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.28.0", "", { "os": "aix", "cpu": "ppc64" }, "sha512-lhRUCeuOyJQURhTxl4WkpFTjIsbDayJHih5kZC1giwE+MhIzAb7mEsQMqMf18rHLsrb5qI1tafG20mLxEWcWlA=="],
+    "@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.28.2", "", { "os": "aix", "cpu": "ppc64" }, "sha512-XExcO+dvLKvVtNTibSTBej1NCAbaGhWn9Ww1ZPx80qsahhPFe/8jgWP0IchNe0F3HwkU7n8ejhH8bjonqht8mQ=="],
 
-    "@esbuild/android-arm": ["@esbuild/android-arm@0.28.0", "", { "os": "android", "cpu": "arm" }, "sha512-wqh0ByljabXLKHeWXYLqoJ5jKC4XBaw6Hk08OfMrCRd2nP2ZQ5eleDZC41XHyCNgktBGYMbqnrJKq/K/lzPMSQ=="],
+    "@esbuild/android-arm": ["@esbuild/android-arm@0.28.2", "", { "os": "android", "cpu": "arm" }, "sha512-kXXoiPVVGQcnIYGOeaovwOURpniDBpSq4A03qkQ+BMQqtGG6HYap3xne9C1O1yo4TR3qxlCX5IqqmX6fFo2Lqg=="],
 
-    "@esbuild/android-arm64": ["@esbuild/android-arm64@0.28.0", "", { "os": "android", "cpu": "arm64" }, "sha512-+WzIXQOSaGs33tLEgYPYe/yQHf0WTU0X42Jca3y8NWMbUVhp7rUnw+vAsRC/QiDrdD31IszMrZy+qwPOPjd+rw=="],
+    "@esbuild/android-arm64": ["@esbuild/android-arm64@0.28.2", "", { "os": "android", "cpu": "arm64" }, "sha512-5YfKeeI8qWfBZIX+u2xZC3Zlb3Os/gLS2sbEKM+I4ZOcsWmHS2WLysCcQZDAFRslDUU5Oiq44gf6PYN1vGwG5A=="],
 
-    "@esbuild/android-x64": ["@esbuild/android-x64@0.28.0", "", { "os": "android", "cpu": "x64" }, "sha512-+VJggoaKhk2VNNqVL7f6S189UzShHC/mR9EE8rDdSkdpN0KflSwWY/gWjDrNxxisg8Fp1ZCD9jLMo4m0OUfeUA=="],
+    "@esbuild/android-x64": ["@esbuild/android-x64@0.28.2", "", { "os": "android", "cpu": "x64" }, "sha512-O387ite7SzUyCcy3JQX4P4bLtEA7bLLkx+esve5JHnyYfNTxcVpXZo9jhdB0lTKN44gztELTdU7nS8Nr16Fs1Q=="],
 
-    "@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.28.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-0T+A9WZm+bZ84nZBtk1ckYsOvyA3x7e2Acj1KdVfV4/2tdG4fzUp91YHx+GArWLtwqp77pBXVCPn2We7Letr0Q=="],
+    "@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.28.2", "", { "os": "darwin", "cpu": "arm64" }, "sha512-n4KqkOQrraxHJcgjM1RvwbigfQKIKJVpM7xp+KsxiyUSrRdIXnt73VhrPAx0fV44hgfmIVKjxMN9J1t5jySVkw=="],
 
-    "@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.28.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-fyzLm/DLDl/84OCfp2f/XQ4flmORsjU7VKt8HLjvIXChJoFFOIL6pLJPH4Yhd1n1gGFF9mPwtlN5Wf82DZs+LQ=="],
+    "@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.28.2", "", { "os": "darwin", "cpu": "x64" }, "sha512-uq6suIWYP37qzGddBKPw5QEQPi6HiLGsO7UmkpfyaYNQ3D+rN6w6WfwH+nuqcGXWvawGwxOEroO4YGnFh95azw=="],
 
-    "@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.28.0", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-l9GeW5UZBT9k9brBYI+0WDffcRxgHQD8ShN2Ur4xWq/NFzUKm3k5lsH4PdaRgb2w7mI9u61nr2gI2mLI27Nh3Q=="],
+    "@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.28.2", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-n+I0BTSRIoy+d6RPKnEVwql5UwBJolytvY4mAOIEJorKlqgPII8ix6slVVrfZ5Tnj7glIZvloylbB/EJPMWEXw=="],
 
-    "@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.28.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-BXoQai/A0wPO6Es3yFJ7APCiKGc1tdAEOgeTNy3SsB491S3aHn4S4r3e976eUnPdU+NbdtmBuLncYir2tMU9Nw=="],
+    "@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.28.2", "", { "os": "freebsd", "cpu": "x64" }, "sha512-78XJTJkvPs0kz2w61301PJjXl4g7q3JqiYMZ/M/yVI73EHBrCRTgkhu9oqG7vPqq+a/yadEW8aD+agKlk5xrmg=="],
 
-    "@esbuild/linux-arm": ["@esbuild/linux-arm@0.28.0", "", { "os": "linux", "cpu": "arm" }, "sha512-CjaaREJagqJp7iTaNQjjidaNbCKYcd4IDkzbwwxtSvjI7NZm79qiHc8HqciMddQ6CKvJT6aBd8lO9kN/ZudLlw=="],
+    "@esbuild/linux-arm": ["@esbuild/linux-arm@0.28.2", "", { "os": "linux", "cpu": "arm" }, "sha512-XlDnu2q5yoqems+xay6wSAcg9DDD7K9RLKZEBOMZm3ckNpJBvOX20tSfby8KfrrhINDyv9V2YVZKY/SpoGJI8w=="],
 
-    "@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.28.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-RVyzfb3FWsGA55n6WY0MEIEPURL1FcbhFE6BffZEMEekfCzCIMtB5yyDcFnVbTnwk+CLAgTujmV/Lgvih56W+A=="],
+    "@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.28.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-pW4AC0P3it8c7do9MVM4p51FzHzdM/TZrerurgRcHJ2WTa1VQ1CIq18xncfpBJw4ojkiZZrKW2yIBWBP92j6Ug=="],
 
-    "@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.28.0", "", { "os": "linux", "cpu": "ia32" }, "sha512-KBnSTt1kxl9x70q+ydterVdl+Cn0H18ngRMRCEQfrbqdUuntQQ0LoMZv47uB97NljZFzY6HcfqEZ2SAyIUTQBQ=="],
+    "@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.28.2", "", { "os": "linux", "cpu": "ia32" }, "sha512-CYbnj78HsIeA+DhgUKgFCfvNsTHFhMMrinUrMZpDXJXKN8T3XViTZ/+wtHeVxEWY8ewSzTFN+nRmSwO2tZaLUQ=="],
 
-    "@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.28.0", "", { "os": "linux", "cpu": "none" }, "sha512-zpSlUce1mnxzgBADvxKXX5sl8aYQHo2ezvMNI8I0lbblJtp8V4odlm3Yzlj7gPyt3T8ReksE6bK+pT3WD+aJRg=="],
+    "@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.28.2", "", { "os": "linux", "cpu": "none" }, "sha512-buwkd8nsph4R+ajRvw0qM5Hja/TXQow3ptzWO2EbG/cqcIkHloRrdlBtQlshyYGTNFvfkfJ5tpPLVkY4DtsPfQ=="],
 
-    "@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.28.0", "", { "os": "linux", "cpu": "none" }, "sha512-2jIfP6mmjkdmeTlsX/9vmdmhBmKADrWqN7zcdtHIeNSCH1SqIoNI63cYsjQR8J+wGa4Y5izRcSHSm8K3QWmk3w=="],
+    "@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.28.2", "", { "os": "linux", "cpu": "none" }, "sha512-ZVykbDyk7519VwiNb9Lcj9m8XM6v5V9uKPvrEMkkEedVewf+0itkhahp4HDpgERXhwLRpWFypsGbG/J8s0QjJA=="],
 
-    "@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.28.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-bc0FE9wWeC0WBm49IQMPSPILRocGTQt3j5KPCA8os6VprfuJ7KD+5PzESSrJ6GmPIPJK965ZJHTUlSA6GNYEhg=="],
+    "@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.28.2", "", { "os": "linux", "cpu": "ppc64" }, "sha512-CAXl+Dtd9UUuJd8pKKdwh6MLm3MUMiqMPmhZ3tTSXPqfyQ3vDl6R5hZdZ/kYojK4ofXtdfSv1tFq8XzWx3heNQ=="],
 
-    "@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.28.0", "", { "os": "linux", "cpu": "none" }, "sha512-SQPZOwoTTT/HXFXQJG/vBX8sOFagGqvZyXcgLA3NhIqcBv1BJU1d46c0rGcrij2B56Z2rNiSLaZOYW5cUk7yLQ=="],
+    "@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.28.2", "", { "os": "linux", "cpu": "none" }, "sha512-GeXCej4IQtU1B+QlDV8W/RRvbzI3O/Stss+/bCXv4lZls5WGRtu2a+3JkA3i4qIUlMXpcHebWpF8AkJhATowuA=="],
 
-    "@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.28.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-SCfR0HN8CEEjnYnySJTd2cw0k9OHB/YFzt5zgJEwa+wL/T/raGWYMBqwDNAC6dqFKmJYZoQBRfHjgwLHGSrn3Q=="],
+    "@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.28.2", "", { "os": "linux", "cpu": "s390x" }, "sha512-3H1weTYZPxt/WOhByszQZybS9w5lKzUn1FDMsgEChbHWQwHYQQRfBxgCcZvPhjHfKyJjIievvMmEUawJrdY9Dg=="],
 
-    "@esbuild/linux-x64": ["@esbuild/linux-x64@0.28.0", "", { "os": "linux", "cpu": "x64" }, "sha512-us0dSb9iFxIi8srnpl931Nvs65it/Jd2a2K3qs7fz2WfGPHqzfzZTfec7oxZJRNPXPnNYZtanmRc4AL/JwVzHQ=="],
+    "@esbuild/linux-x64": ["@esbuild/linux-x64@0.28.2", "", { "os": "linux", "cpu": "x64" }, "sha512-4xTZr1FUmSoQW4XIWmit3tzQrUTZM+N3P0XV8xROKYF50XfI7xeO90+1bZvNwxIufQ9hDQVRJH5YhgPVF8A/HQ=="],
 
-    "@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.28.0", "", { "os": "none", "cpu": "arm64" }, "sha512-CR/RYotgtCKwtftMwJlUU7xCVNg3lMYZ0RzTmAHSfLCXw3NtZtNpswLEj/Kkf6kEL3Gw+BpOekRX0BYCtklhUw=="],
+    "@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.28.2", "", { "os": "none", "cpu": "arm64" }, "sha512-sSATRjPeDBg3pdgHoQfoYBob11Kk1FGa9lui5RIHZCoCkJa9QKlvl3/vKz2usCmYYjs7ymJR/2Nnsqe+Hjt5nw=="],
 
-    "@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.28.0", "", { "os": "none", "cpu": "x64" }, "sha512-nU1yhmYutL+fQ71Kxnhg8uEOdC0pwEW9entHykTgEbna2pw2dkbFSMeqjjyHZoCmt8SBkOSvV+yNmm94aUrrqw=="],
+    "@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.28.2", "", { "os": "none", "cpu": "x64" }, "sha512-lqnzCV+mM0gIADaKihiCg6ifgfU2L3h5E33rNQBN1Y4MaVGnzryzmvvf7UHxprpQdE8hpqLolJ9Rl+SkIRDpyw=="],
 
-    "@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.28.0", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-cXb5vApOsRsxsEl4mcZ1XY3D4DzcoMxR/nnc4IyqYs0rTI8ZKmW6kyyg+11Z8yvgMfAEldKzP7AdP64HnSC/6g=="],
+    "@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.28.2", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-AL2qJILH7lNjrDmCQDvdxMfAUIv8KMNZOvrwAQ8i8//ntL9FflhOyMJ8OZSMBb8/AWXe3/5v5S20y3zCoZWKoQ=="],
 
-    "@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.28.0", "", { "os": "openbsd", "cpu": "x64" }, "sha512-8wZM2qqtv9UP3mzy7HiGYNH/zjTA355mpeuA+859TyR+e+Tc08IHYpLJuMsfpDJwoLo1ikIJI8jC3GFjnRClzA=="],
+    "@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.28.2", "", { "os": "openbsd", "cpu": "x64" }, "sha512-QtiuPytchRyC4rwUKhexJdQKvDuZ6hWloi3igqPQNUJCS1/v9EiO3UTOXR6A3FoMo4fnAKbWJdqaIwhOzh8qEw=="],
 
-    "@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.28.0", "", { "os": "none", "cpu": "arm64" }, "sha512-FLGfyizszcef5C3YtoyQDACyg95+dndv79i2EekILBofh5wpCa1KuBqOWKrEHZg3zrL3t5ouE5jgr94vA+Wb2w=="],
+    "@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.28.2", "", { "os": "none", "cpu": "arm64" }, "sha512-WkhYDmpTjLvGlScA1rwjRUmhl4k8oXR3cIbtqWmELgU/dFeHHlEllxDvdWcNJV9rbzCexB5vz8gtNewWLgCT7Q=="],
 
-    "@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.28.0", "", { "os": "sunos", "cpu": "x64" }, "sha512-1ZgjUoEdHZZl/YlV76TSCz9Hqj9h9YmMGAgAPYd+q4SicWNX3G5GCyx9uhQWSLcbvPW8Ni7lj4gDa1T40akdlw=="],
+    "@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.28.2", "", { "os": "sunos", "cpu": "x64" }, "sha512-GPMSkTOtMnv2U2F8gxe4Io6qmVs+YKyp832Etqqxr0hFngmXQ3rzwytelm3GIn7T4VviRUlf3sOgBOiTdvaf7g=="],
 
-    "@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.28.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-Q9StnDmQ/enxnpxCCLSg0oo4+34B9TdXpuyPeTedN/6+iXBJ4J+zwfQI28u/Jl40nOYAxGoNi7mFP40RUtkmUA=="],
+    "@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.28.2", "", { "os": "win32", "cpu": "arm64" }, "sha512-PIhhEkE9uPBleRBrQEJpUn7MBnibZzbGzYWPmY3x+YoVg/95zbjB4CxPPOQ8l5tYYM4mMaCthF8/1DIfBQQyWQ=="],
 
-    "@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.28.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-zF3ag/gfiCe6U2iczcRzSYJKH1DCI+ByzSENHlM2FcDbEeo5Zd2C86Aq0tKUYAJJ1obRP84ymxIAksZUcdztHA=="],
+    "@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.28.2", "", { "os": "win32", "cpu": "ia32" }, "sha512-YmJbfTlvU7Sdn9BB+4PRES4oB6pxgS37MAONj+hBr/cpXS1aBPKXxNnDbu+QCWPj0o9dgyxeq79g6c5P8KeuYA=="],
 
-    "@esbuild/win32-x64": ["@esbuild/win32-x64@0.28.0", "", { "os": "win32", "cpu": "x64" }, "sha512-pEl1bO9mfAmIC+tW5btTmrKaujg3zGtUmWNdCw/xs70FBjwAL3o9OEKNHvNmnyylD6ubxUERiEhdsL0xBQ9efw=="],
+    "@esbuild/win32-x64": ["@esbuild/win32-x64@0.28.2", "", { "os": "win32", "cpu": "x64" }, "sha512-5ebpxr3nWMzrL/rnUI755Jkuee0bHL/Gq0WTF9lvcpv73wAp5eu8MfBUgWK9bhWvZjj7yX8etf/8tI8Ney695g=="],
 
     "@jridgewell/gen-mapping": ["@jridgewell/gen-mapping@0.3.13", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.5.0", "@jridgewell/trace-mapping": "^0.3.24" } }, "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA=="],
 
@@ -211,7 +211,7 @@
 
     "diff": ["diff@5.2.2", "", {}, "sha512-vtcDfH3TOjP8UekytvnHH1o1P4FcUdt4eQ1Y+Abap1tk/OB2MWQvcwS2ClCd1zuIhc3JKOx6p3kod8Vfys3E+A=="],
 
-    "esbuild": ["esbuild@0.28.0", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.28.0", "@esbuild/android-arm": "0.28.0", "@esbuild/android-arm64": "0.28.0", "@esbuild/android-x64": "0.28.0", "@esbuild/darwin-arm64": "0.28.0", "@esbuild/darwin-x64": "0.28.0", "@esbuild/freebsd-arm64": "0.28.0", "@esbuild/freebsd-x64": "0.28.0", "@esbuild/linux-arm": "0.28.0", "@esbuild/linux-arm64": "0.28.0", "@esbuild/linux-ia32": "0.28.0", "@esbuild/linux-loong64": "0.28.0", "@esbuild/linux-mips64el": "0.28.0", "@esbuild/linux-ppc64": "0.28.0", "@esbuild/linux-riscv64": "0.28.0", "@esbuild/linux-s390x": "0.28.0", "@esbuild/linux-x64": "0.28.0", "@esbuild/netbsd-arm64": "0.28.0", "@esbuild/netbsd-x64": "0.28.0", "@esbuild/openbsd-arm64": "0.28.0", "@esbuild/openbsd-x64": "0.28.0", "@esbuild/openharmony-arm64": "0.28.0", "@esbuild/sunos-x64": "0.28.0", "@esbuild/win32-arm64": "0.28.0", "@esbuild/win32-ia32": "0.28.0", "@esbuild/win32-x64": "0.28.0" }, "bin": "bin/esbuild" }, "sha512-sNR9MHpXSUV/XB4zmsFKN+QgVG82Cc7+/aaxJ8Adi8hyOac+EXptIp45QBPaVyX3N70664wRbTcLTOemCAnyqw=="],
+    "esbuild": ["esbuild@0.28.2", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.28.2", "@esbuild/android-arm": "0.28.2", "@esbuild/android-arm64": "0.28.2", "@esbuild/android-x64": "0.28.2", "@esbuild/darwin-arm64": "0.28.2", "@esbuild/darwin-x64": "0.28.2", "@esbuild/freebsd-arm64": "0.28.2", "@esbuild/freebsd-x64": "0.28.2", "@esbuild/linux-arm": "0.28.2", "@esbuild/linux-arm64": "0.28.2", "@esbuild/linux-ia32": "0.28.2", "@esbuild/linux-loong64": "0.28.2", "@esbuild/linux-mips64el": "0.28.2", "@esbuild/linux-ppc64": "0.28.2", "@esbuild/linux-riscv64": "0.28.2", "@esbuild/linux-s390x": "0.28.2", "@esbuild/linux-x64": "0.28.2", "@esbuild/netbsd-arm64": "0.28.2", "@esbuild/netbsd-x64": "0.28.2", "@esbuild/openbsd-arm64": "0.28.2", "@esbuild/openbsd-x64": "0.28.2", "@esbuild/openharmony-arm64": "0.28.2", "@esbuild/sunos-x64": "0.28.2", "@esbuild/win32-arm64": "0.28.2", "@esbuild/win32-ia32": "0.28.2", "@esbuild/win32-x64": "0.28.2" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-HKVLS8dvII+xoKW9kmqxbRKrnWEXfJJr/FZhhJmiqIB0e053QNYFqOBouTMO/k5sID4MvCiUCvv8b9M4h32wIA=="],
 
     "esm-env": ["esm-env@1.2.2", "", {}, "sha512-Epxrv+Nr/CaL4ZcFGPJIYLWFom+YeV1DqMLHJoEd9SYRxNbaFruBwfEX/kkHUJf55j2+TUbmDcmuilbP1TmXHA=="],
 
@@ -321,7 +321,7 @@
 
     "windmill-yaml-validator": ["windmill-yaml-validator@1.1.1", "", { "dependencies": { "@stoplight/yaml": "^4.3.0", "ajv": "^8.17.1" } }, "sha512-CVgAwEoBdJhF39q2N012QffhlGPRIyIWd8gj7NnfG+/lMWgH2k5CBLtKIt6cPF8Bxz+6DGC3st1ARSsecDtbTg=="],
 
-    "ws": ["ws@8.18.0", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-8VbfWfHLbbwu3+N6OKsOMpBdT4kXPDDB9cJk2bJ6mh9ucxdlnNvH1e+roYkKmN9Nxw2yjz7VzeO9oOz2zJ04Pw=="],
+    "ws": ["ws@8.21.3", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw=="],
 
     "wsl-utils": ["wsl-utils@0.1.0", "", { "dependencies": { "is-wsl": "^3.1.0" } }, "sha512-h3Fbisa2nKGPxCpm89Hk33lBLsnaGBvctQopaBSOW/uIs6FTe1ATyAnKFJrzVs9vpGdsTe73WF3V4lIsk4Gacw=="],
 
diff --git a/cli/package.json b/cli/package.json
index 03497dc887..5e7623a7ab 100644
--- a/cli/package.json
+++ b/cli/package.json
@@ -23,7 +23,7 @@
     "@cliffy/table": "npm:@jsr/cliffy__table@1.0.0",
     "@windmill-labs/shared-utils": "^1.0.13",
     "diff": "^5.2.0",
-    "esbuild": "0.28.0",
+    "esbuild": "0.28.2",
     "get-port": "7.1.0",
     "jszip": "3.8.0",
     "minimatch": "^10.0.0",
@@ -46,7 +46,7 @@
     "windmill-parser-wasm-ts": "1.695.0",
     "windmill-parser-wasm-yaml": "1.770.0",
     "windmill-yaml-validator": "1.1.1",
-    "ws": "8.18.0",
+    "ws": "8.21.3",
     "yaml": "^2.7.0"
   },
   "devDependencies": {
diff --git a/cli/src/commands/app/raw_apps.ts b/cli/src/commands/app/raw_apps.ts
index 8d82edb9df..36c8260e25 100644
--- a/cli/src/commands/app/raw_apps.ts
+++ b/cli/src/commands/app/raw_apps.ts
@@ -55,6 +55,8 @@ export interface AppFile {
     tables?: string[];
     datatable?: string;
     schema?: string;
+    /** The role the app uses each data table through, by data table name. */
+    roles?: Record<string, string>;
   };
   // Mirrors granular ACLs on the raw_app path. Synced via /acls/* by
   // applyExtraPermsDiff — never through update_app_raw — so a perm-only
diff --git a/cli/src/commands/init/template.ts b/cli/src/commands/init/template.ts
index 9032cee397..8a433d69d4 100644
--- a/cli/src/commands/init/template.ts
+++ b/cli/src/commands/init/template.ts
@@ -140,6 +140,7 @@ export const CONFIG_REFERENCE: ConfigOption[] = [
       type: "object",
       properties: {
         relative_path: { type: "string", description: "Path to the codebase directory" },
+        extra_digest_paths: { type: "array", items: { type: "string" }, description: "Paths outside relative_path that scripts import, relative to wmill.yaml; hashed recursively" },
         includes: { type: "array", items: { type: "string" }, description: "Glob patterns for files to include in bundle" },
         excludes: { type: "array", items: { type: "string" }, description: "Glob patterns for files to exclude from bundle" },
         format: { type: "string", enum: ["cjs", "esm"], description: "Bundle output format" },
@@ -159,6 +160,7 @@ export const CONFIG_REFERENCE: ConfigOption[] = [
     example: [
       "# codebases:",
       '#   - relative_path: ./shared          # path to the codebase',
+      '#     # extra_digest_paths: ["../packages/utils/src"] # imported paths outside relative_path, hashed recursively (skip node_modules/dist)',
       '#     includes: ["**/*.ts"]            # files to include in bundle',
       '#     excludes: ["node_modules/**"]    # files to exclude',
       '#     format: esm                      # bundle format: "cjs" or "esm"',
diff --git a/cli/src/commands/script/script.ts b/cli/src/commands/script/script.ts
index fe193e5d85..06db3db1bf 100644
--- a/cli/src/commands/script/script.ts
+++ b/cli/src/commands/script/script.ts
@@ -61,7 +61,11 @@ import {
   readConfigFile,
   readEffectiveSyncBehavior,
 } from "../../core/conf.ts";
-import { SyncCodebase, listSyncCodebases } from "../../utils/codebase.ts";
+import {
+  SyncCodebase,
+  listSyncCodebases,
+  uncoveredBundleInputs,
+} from "../../utils/codebase.ts";
 import { pollJobWithQueueLogging } from "../../utils/job_polling.ts";
 import fs from "node:fs";
 import { createTarBlob, type TarEntry } from "../../utils/tar.ts";
@@ -446,8 +450,19 @@ export async function handleFile(
           target: format == "cjs" ? "node20.15.1" : "esnext",
           banner: codebase.banner,
           // ...(codebase.banner != null && { banner: codebase.banner }),
+          metafile: true,
         });
         const endTime = performance.now();
+        const uncovered = uncoveredBundleInputs(
+          codebase,
+          path,
+          Object.keys(out.metafile?.inputs ?? {})
+        );
+        if (uncovered.length > 0) {
+          log.warnAlways(
+            `${path} bundles files outside codebase ${codebase.relative_path}; edits to them won't be detected as changes unless listed in extra_digest_paths: ${uncovered.join(", ")}`
+          );
+        }
         bundleContent = out.outputFiles[0].text;
         outputFiles = out.outputFiles ?? [];
         if (outputFiles.length == 0) {
diff --git a/cli/src/commands/sync/sync.ts b/cli/src/commands/sync/sync.ts
index 138a346594..6185decc5a 100644
--- a/cli/src/commands/sync/sync.ts
+++ b/cli/src/commands/sync/sync.ts
@@ -1153,7 +1153,7 @@ export function ZipFSElement(
             ? "script"
             : p.endsWith(".resource.json")
               ? "resource"
-              : p.startsWith("dependencies/")
+              : isWorkspaceDependencies(p)
                 ? "dependencies"
                 : "other";
 
@@ -2546,9 +2546,9 @@ export function preservePendingScriptLocks(
 }
 
 // `sync push` never applies the workspace's display name from settings.yaml and
-// applies its color only when the local file carries one (see
-// pushWorkspaceSettings), so on a push the fields it would not apply must
-// compare equal, or the row is listed on every run.
+// applies its color and auto_invite.instance_groups only when the local file
+// carries them (see pushWorkspaceSettings), so on a push the fields it would not
+// apply must compare equal, or the row is listed on every run.
 const isWorkspaceSettingsFile = (p: string) =>
   /^settings(\.[^./\\]+)?\.(yaml|json)$/.test(p);
 function stripUnappliedSettingsFields(local: any, remote: any) {
@@ -2558,6 +2558,20 @@ function stripUnappliedSettingsFields(local: any, remote: any) {
     delete local?.color;
     delete remote?.color;
   }
+  // push reads a missing auto_invite as {} on both sides
+  if (local) local.auto_invite ??= {};
+  if (remote) remote.auto_invite ??= {};
+  const localInvite = local?.auto_invite;
+  const remoteInvite = remote?.auto_invite;
+  if (localInvite?.instance_groups == null) {
+    for (const invite of [localInvite, remoteInvite]) {
+      delete invite?.instance_groups;
+      delete invite?.instance_groups_roles;
+    }
+  } else {
+    localInvite.instance_groups_roles ??= {};
+    if (remoteInvite) remoteInvite.instance_groups_roles ??= {};
+  }
 }
 
 export async function compareDynFSElement(
@@ -2738,7 +2752,7 @@ export async function compareDynFSElement(
       if (skipMetadata) {
         continue;
       }
-      if (k.startsWith("dependencies/")) {
+      if (isWorkspaceDependencies(k)) {
         if (!workspaceDependenciesPathToLanguageAndFilename(k)) {
           log.warn(`Skipping unrecognized workspace dependencies file: ${k}`);
           continue;
@@ -3580,12 +3594,15 @@ export async function pull(
 ) {
   if ((opts as any).jsonOutput) log.setSilent(true);
   const originalCliOpts = { ...opts };
-  opts = await mergeConfigWithConfigFile(opts);
-
-  // --include-secrets overrides skipSecrets from wmill.yaml
-  if ((originalCliOpts as any).includeSecrets) {
-    opts.skipSecrets = false;
-  }
+  const withConfigFile = async () => {
+    const merged = await mergeConfigWithConfigFile({ ...originalCliOpts });
+    // --include-secrets overrides skipSecrets from wmill.yaml
+    if ((originalCliOpts as any).includeSecrets) {
+      merged.skipSecrets = false;
+    }
+    return merged;
+  };
+  opts = await withConfigFile();
 
   // Resolve workspace name for config lookups.
   // --branch resolves git branch → workspace name (deprecated but still supported).
@@ -3620,10 +3637,6 @@ export async function pull(
     throw error;
   }
 
-  if (opts.stateful) {
-    await mkdir(path.join(process.cwd(), ".wmill"), { recursive: true });
-  }
-
   const workspace = await resolveWorkspace(opts, wsNameForConfig);
   await requireLogin(opts);
 
@@ -3715,6 +3728,14 @@ export async function pull(
       });
       return;
     }
+
+    // The pull writes into the branch now checked out, so its wmill.yaml
+    // applies, not the cloned branch's: a fork branch that turned on
+    // `dedupeLockfiles` would otherwise get one lockfile per script back.
+    if (getCurrentGitBranch() !== clonedBranchName) {
+      opts = await withConfigFile();
+      wsNameForConfig = resolveWsNameForConfigFromFlags(opts);
+    }
   }
 
   // If wsNameForConfig wasn't set from flags, infer from the resolved profile
@@ -3749,6 +3770,10 @@ export async function pull(
   // Merge CLI flags with resolved settings (CLI flags take precedence only for explicit overrides)
   opts = mergeCliWithEffectiveOptions(originalCliOpts, effectiveOpts);
 
+  if (opts.stateful) {
+    await mkdir(path.join(process.cwd(), ".wmill"), { recursive: true });
+  }
+
   const codebases = await listSyncCodebases(opts);
 
   log.info(
diff --git a/cli/src/commands/workspace/fork.ts b/cli/src/commands/workspace/fork.ts
index 219252bb7a..0aca0984ff 100644
--- a/cli/src/commands/workspace/fork.ts
+++ b/cli/src/commands/workspace/fork.ts
@@ -239,6 +239,7 @@ async function createWorkspaceFork(
   interface ForkedDatatableInfo {
     name: string;
     new_dbname: string;
+    fork_behavior?: "schema_only" | "schema_and_data";
   }
   const forkedDatatables: ForkedDatatableInfo[] = [];
 
@@ -285,6 +286,23 @@ async function createWorkspaceFork(
 
         const newDbName = `${trueWorkspaceId.replace(/-/g, "_")}__${dt.name}`;
 
+        const forkBehavior = dtBehavior as "schema_only" | "schema_and_data";
+        // A server that reports `permissioned` copies each data table in the fork request itself,
+        // and refuses a database copied beforehand. An older one only takes a database copied here.
+        if (typeof dt.permissioned === "boolean") {
+          log.info(
+            colors.blue(
+              `  Datatable "${dt.name}" will be cloned (${forkBehavior === "schema_only" ? "schema" : "schema + data"}) into "${newDbName}" when the fork is created.`
+            )
+          );
+          forkedDatatables.push({
+            name: dt.name,
+            new_dbname: newDbName,
+            fork_behavior: forkBehavior,
+          });
+          continue;
+        }
+
         try {
           log.info(
             colors.blue(`  Creating database "${newDbName}" for datatable "${dt.name}"...`)
@@ -300,7 +318,7 @@ async function createWorkspaceFork(
 
           log.info(
             colors.blue(
-              `  Importing ${dtBehavior === "schema_only" ? "schema" : "schema + data"}...`
+              `  Importing ${forkBehavior === "schema_only" ? "schema" : "schema + data"}...`
             )
           );
 
@@ -310,7 +328,7 @@ async function createWorkspaceFork(
               source: `datatable://${dt.name}`,
               target: `datatable://${dt.name}`,
               target_dbname_override: newDbName,
-              fork_behavior: dtBehavior as "schema_only" | "schema_and_data",
+              fork_behavior: forkBehavior,
             },
           });
 
@@ -336,6 +354,8 @@ async function createWorkspaceFork(
         id: trueWorkspaceId,
         name: opts.createWorkspaceName ?? workspaceName ?? trueWorkspaceId,
         color: forkColor,
+        // So a clone the fork would refuse is refused before any branch is created.
+        forked_datatables: forkedDatatables,
       },
     });
     if (gitSyncJobIds && gitSyncJobIds.length > 0) {
diff --git a/cli/src/core/conf.ts b/cli/src/core/conf.ts
index 0c746d2261..7c6eb13274 100644
--- a/cli/src/core/conf.ts
+++ b/cli/src/core/conf.ts
@@ -115,6 +115,7 @@ export interface SyncOptions {
 
 export interface Codebase {
   relative_path: string;
+  extra_digest_paths?: string[];
   includes?: string[];
   excludes?: string[];
   assets?: {
diff --git a/cli/src/core/constants.ts b/cli/src/core/constants.ts
index a399ec1b85..9728b6edd7 100644
--- a/cli/src/core/constants.ts
+++ b/cli/src/core/constants.ts
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
 // (e.g. utils.ts) can read it without importing main.ts and creating a circular
 // dependency (main → workspace → utils → main) that triggers a TDZ.
 // Re-exported from main.ts for backwards compatibility.
-export const VERSION = "1.814.0";
+export const VERSION = "1.817.0";
diff --git a/cli/src/core/settings.ts b/cli/src/core/settings.ts
index 4c95090bcf..6a9358b468 100644
--- a/cli/src/core/settings.ts
+++ b/cli/src/core/settings.ts
@@ -239,8 +239,19 @@ export async function pushWorkspaceSettings(
     });
   }
 
-  // Handle auto_invite using grouped format
-  if (!deepEqual(localSettings.auto_invite, settings.auto_invite)) {
+  // Handle auto_invite using grouped format. The domain invite and the instance groups
+  // are applied by separate endpoints, each rewriting only its own keys.
+  const {
+    instance_groups: localGroups,
+    instance_groups_roles: localGroupRoles,
+    ...localDomainInvite
+  } = localSettings.auto_invite ?? {};
+  const {
+    instance_groups: remoteGroups,
+    instance_groups_roles: remoteGroupRoles,
+    ...remoteDomainInvite
+  } = settings.auto_invite ?? {};
+  if (!deepEqual(localDomainInvite, remoteDomainInvite)) {
     log.debug(`Updating auto invite...`);
 
     const localAutoInvite = localSettings.auto_invite;
@@ -278,6 +289,20 @@ export async function pushWorkspaceSettings(
     }
   }
 
+  // Only when settings.yaml declares instance_groups: clearing a group removes the
+  // workspace members it granted, so an absent key must never clear it.
+  if (
+    localGroups != undefined &&
+    (!deepEqual(localGroups, remoteGroups) ||
+      !deepEqual(localGroupRoles ?? {}, remoteGroupRoles ?? {}))
+  ) {
+    log.debug(`Updating instance groups...`);
+    await wmill.editInstanceGroups({
+      workspace,
+      requestBody: { groups: localGroups, roles: localGroupRoles ?? {} },
+    });
+  }
+
   if (!deepEqual(localSettings.ai_config, settings.ai_config)) {
     log.debug(`Updating copilot settings...`);
     await wmill.editCopilotConfig({
@@ -393,10 +418,17 @@ export async function pushWorkspaceSettings(
 
   if (!deepEqual(localSettings.datatable, settings.datatable)) {
     log.debug(`Updating datatable config...`);
-    await wmill.editDataTableConfig({
+    const { stranded_references } = await wmill.editDataTableConfig({
       workspace,
       requestBody: { settings: localSettings.datatable ?? { datatables: {} } },
     });
+    if (stranded_references?.length) {
+      log.warn(
+        `Removed data tables governed data tables in other workspaces, which no longer resolve: ${stranded_references
+          .map((r) => `${r.workspace_id}/${r.datatable}`)
+          .join(", ")}. A superadmin can point them somewhere else.`,
+      );
+    }
   }
 
   if (localSettings.slack_command_script != settings.slack_command_script) {
diff --git a/cli/src/guidance/skills.gen.ts b/cli/src/guidance/skills.gen.ts
index 035c25a574..81895997b9 100644
--- a/cli/src/guidance/skills.gen.ts
+++ b/cli/src/guidance/skills.gen.ts
@@ -1110,6 +1110,8 @@ parseS3Object(s3Object: S3Object): S3ObjectRecord
 /**
  * Create a SQL template function for PostgreSQL/datatable queries
  * @param name - Database/datatable name (default: "main")
+ * @param opts.role - Connect as this data table role instead of the data table's default one.
+ *   Only meaningful on a data table under roles, and only for a role you are a tenant of.
  * @returns SQL template function for building parameterized queries
  * @example
  * let sql = wmill.datatable()
@@ -1119,8 +1121,11 @@ parseS3Object(s3Object: S3Object): S3ObjectRecord
  *   SELECT * FROM friends
  *     WHERE name = \${name} AND age = \${age}::int
  * \`.fetch()
+ * @example
+ * // Read through a restricted role
+ * let sql = wmill.datatable("main", { role: "analytics" })
  */
-datatable(name: string = "main"): DatatableSqlTemplateFunction
+datatable(name: string = "main", opts?: DatatableOptions): DatatableSqlTemplateFunction
 
 /**
  * Create a SQL template function for DuckDB/ducklake queries
@@ -1901,6 +1906,8 @@ parseS3Object(s3Object: S3Object): S3ObjectRecord
 /**
  * Create a SQL template function for PostgreSQL/datatable queries
  * @param name - Database/datatable name (default: "main")
+ * @param opts.role - Connect as this data table role instead of the data table's default one.
+ *   Only meaningful on a data table under roles, and only for a role you are a tenant of.
  * @returns SQL template function for building parameterized queries
  * @example
  * let sql = wmill.datatable()
@@ -1910,8 +1917,11 @@ parseS3Object(s3Object: S3Object): S3ObjectRecord
  *   SELECT * FROM friends
  *     WHERE name = \${name} AND age = \${age}::int
  * \`.fetch()
+ * @example
+ * // Read through a restricted role
+ * let sql = wmill.datatable("main", { role: "analytics" })
  */
-datatable(name: string = "main"): DatatableSqlTemplateFunction
+datatable(name: string = "main", opts?: DatatableOptions): DatatableSqlTemplateFunction
 
 /**
  * Create a SQL template function for DuckDB/ducklake queries
@@ -2786,6 +2796,8 @@ parseS3Object(s3Object: S3Object): S3ObjectRecord
 /**
  * Create a SQL template function for PostgreSQL/datatable queries
  * @param name - Database/datatable name (default: "main")
+ * @param opts.role - Connect as this data table role instead of the data table's default one.
+ *   Only meaningful on a data table under roles, and only for a role you are a tenant of.
  * @returns SQL template function for building parameterized queries
  * @example
  * let sql = wmill.datatable()
@@ -2795,8 +2807,11 @@ parseS3Object(s3Object: S3Object): S3ObjectRecord
  *   SELECT * FROM friends
  *     WHERE name = \${name} AND age = \${age}::int
  * \`.fetch()
+ * @example
+ * // Read through a restricted role
+ * let sql = wmill.datatable("main", { role: "analytics" })
  */
-datatable(name: string = "main"): DatatableSqlTemplateFunction
+datatable(name: string = "main", opts?: DatatableOptions): DatatableSqlTemplateFunction
 
 /**
  * Create a SQL template function for DuckDB/ducklake queries
@@ -4405,10 +4420,13 @@ def send_teams_message(conversation_id: str, text: str, success: bool = True, ca
 # 
 # Args:
 #     name: Database name (default: "main")
+#     role: Connect as this data table role instead of the data table's default one.
+#         Only meaningful on a data table under roles, and only for a role you are a
+#         tenant of.
 # 
 # Returns:
 #     DataTableClient instance
-def datatable(name: str = 'main')
+def datatable(name: str = 'main', *, role: Optional[str] = None)
 
 # Get a DuckLake client for DuckDB queries.
 # 
@@ -4626,7 +4644,7 @@ def parse_sql_client_name(name: str) -> tuple[str, Optional[str]]
 # 
 #     @task(retry={"attempts": 3, "delay": 30, "multiplier": 2})
 #     async def call_api(payload: dict): ...
-def task(_func = None, path: Optional[str] = None, tag: Optional[str] = None, timeout: Optional[int] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None, retry: Optional[dict] = None)
+def task(_func = None, *, path: Optional[str] = None, tag: Optional[str] = None, timeout: Optional[int] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None, retry: Optional[dict] = None)
 
 # Create a task that dispatches to a separate Windmill script.
 # 
@@ -4639,7 +4657,7 @@ def task(_func = None, path: Optional[str] = None, tag: Optional[str] = None, ti
 #     @workflow
 #     async def main():
 #         data = await extract(url="https://...")
-def task_script(path: str, timeout: Optional[int] = None, tag: Optional[str] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None, retry: Optional[dict] = None)
+def task_script(path: str, *, timeout: Optional[int] = None, tag: Optional[str] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None, retry: Optional[dict] = None)
 
 # Create a task that dispatches to a separate Windmill flow.
 # 
@@ -4652,7 +4670,7 @@ def task_script(path: str, timeout: Optional[int] = None, tag: Optional[str] = N
 #     @workflow
 #     async def main():
 #         result = await pipeline(input=data)
-def task_flow(path: str, timeout: Optional[int] = None, tag: Optional[str] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None, retry: Optional[dict] = None)
+def task_flow(path: str, *, timeout: Optional[int] = None, tag: Optional[str] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None, retry: Optional[dict] = None)
 
 # Decorator marking an async function as a workflow-as-code entry point.
 # 
@@ -4717,7 +4735,7 @@ async def wait_for_approval(timeout: int = 1800, form: dict | None = None, self_
 #         ...
 # 
 #     results = await parallel(items, process, concurrency=5)
-async def parallel(items, fn, concurrency: Optional[int] = None)
+async def parallel(items, fn, *, concurrency: Optional[int] = None)
 
 # Commit Kafka offsets for a trigger with auto_commit disabled.
 # 
@@ -5808,6 +5826,8 @@ data:
   tables:
     - main/users            # Table in public schema
     - main/app_schema:items # Table in specific schema
+  roles:                    # Optional: the role the app uses each datatable through
+    main: analyst
 \`\`\`
 
 **Table reference formats:**
@@ -5815,6 +5835,8 @@ data:
 - \`<datatable>/<table>\` — Specific table in public schema
 - \`<datatable>/<schema>:<table>\` — Table in specific schema
 
+**Roles:** when a datatable is under roles, its queries run as a role, which only reaches what it was granted. \`roles\` records the role the app uses each datatable through; the app's code must pass the same role: \`wmill.datatable('main', { role: 'analyst' })\` in TypeScript, \`wmill.datatable('main', role='analyst')\` in Python. A datatable without an entry is used as its default role.
+
 ## SQL Migrations (sql_to_apply/)
 
 The \`sql_to_apply/\` folder is for creating/modifying database tables during development.
diff --git a/cli/src/types.ts b/cli/src/types.ts
index 5713d06390..866b2be21e 100644
--- a/cli/src/types.ts
+++ b/cli/src/types.ts
@@ -391,7 +391,7 @@ export function getTypeStrFromPath(
   if (isSharedLockPath(p)) {
     return "shared_lock";
   }
-  if (p.startsWith("dependencies" + SEP)) {
+  if (isWorkspaceDependencies(p)) {
     return "workspace_dependencies";
   }
   if (isFileResource(p) || isFilesetResource(p)) {
diff --git a/cli/src/utils/codebase.ts b/cli/src/utils/codebase.ts
index e665d060b2..2eb63caeec 100644
--- a/cli/src/utils/codebase.ts
+++ b/cli/src/utils/codebase.ts
@@ -1,6 +1,44 @@
 import { Codebase, SyncOptions } from "../core/conf.ts";
 import * as log from "../core/log.ts";
-import { digestDir } from "./utils.ts";
+import { digestDir, generateHash, generateHashFromBuffer } from "./utils.ts";
+import { readFile, stat } from "node:fs/promises";
+import path from "node:path";
+
+// A bare string is accepted, like `includes`/`excludes` in findCodebase.
+function extraDigestPaths(codebase: Codebase): string[] {
+  return ([] as string[]).concat(codebase.extra_digest_paths ?? []);
+}
+
+async function digestPath(p: string): Promise<string> {
+  let s;
+  try {
+    s = await stat(p);
+  } catch {
+    throw new Error(
+      `Codebase extra_digest_paths entry not found: ${p} (resolved to ${path.resolve(p)})`
+    );
+  }
+  return s.isDirectory()
+    ? await digestDir(p, "")
+    : await generateHashFromBuffer(await readFile(p));
+}
+
+/** Bundle inputs that no codebase digest covers, so edits to them would not trigger a re-push. */
+export function uncoveredBundleInputs(
+  codebase: Codebase,
+  entry: string,
+  inputs: string[]
+): string[] {
+  const entryAbs = path.resolve(entry);
+  const roots = [codebase.relative_path, ...extraDigestPaths(codebase)]
+    .map((r) => path.resolve(r));
+  return inputs.filter((i) => {
+    // non-file namespaces ("<define:x>", "(disabled):x", "ns:path") and installed packages
+    if (/^[<(]|^[a-z-]{2,}:/i.test(i) || i.includes("node_modules")) return false;
+    const abs = path.resolve(i);
+    return abs != entryAbs && !roots.some((r) => abs == r || abs.startsWith(r + path.sep));
+  });
+}
 
 export type SyncCodebase = Codebase & {
   getDigest: (forceTar?: boolean) => Promise<string>;
@@ -23,13 +61,20 @@ export function listSyncCodebases(options: SyncOptions): SyncCodebase[] {
       forceTar?: boolean
     ) => {
       if (_digest == undefined) {
-        _digest = await digestDir(
+        // Concurrent callers read `_digest` across these awaits: assign it only once complete.
+        let digest = await digestDir(
           codebase.relative_path,
           JSON.stringify(codebase)
         );
-        if (codebase.format == "esm") {
-          _digest += ".esm";
+        const extra = extraDigestPaths(codebase);
+        if (extra.length > 0) {
+          const hashes = await Promise.all(extra.map(digestPath));
+          digest = await generateHash(digest + hashes.join(""));
         }
+        if (codebase.format == "esm") {
+          digest += ".esm";
+        }
+        _digest = digest;
         if (!alreadyPrinted) {
           alreadyPrinted = true;
           log.info(`Codebase ${codebase.relative_path}, digest: ${_digest}`);
diff --git a/cli/src/utils/esbuild_loader.ts b/cli/src/utils/esbuild_loader.ts
index 4801c51a46..83d44f4534 100644
--- a/cli/src/utils/esbuild_loader.ts
+++ b/cli/src/utils/esbuild_loader.ts
@@ -25,7 +25,7 @@ type Esbuild = typeof import("esbuild");
 
 // Version to fall back to if the native host's version can't be read. Keep in
 // sync with the "esbuild" pin in cli/package.json.
-const FALLBACK_VERSION = "0.28.0";
+const FALLBACK_VERSION = "0.28.2";
 
 let cached: Esbuild | undefined;
 let inFlight: Promise<Esbuild> | undefined;
diff --git a/cli/src/utils/script_common.ts b/cli/src/utils/script_common.ts
index d804318491..611268c27c 100644
--- a/cli/src/utils/script_common.ts
+++ b/cli/src/utils/script_common.ts
@@ -45,7 +45,9 @@ export const workspaceDependenciesLanguages: WorkspaceDependenciesLanguage[] = [
 ] as const;
 
 export function workspaceDependenciesPathToLanguageAndFilename(path: string): { name: string | undefined, language: ScriptLanguage } | undefined {
-  const relativePath = path.replace("dependencies/", "");
+  // Sync paths carry the platform separator, while a set's name is always
+  // forward-slashed.
+  const relativePath = path.replaceAll("\\", "/").replace("dependencies/", "");
   for (const { filename, language } of workspaceDependenciesLanguages) {
     if (relativePath.endsWith(filename)) {
       return {
diff --git a/cli/src/utils/utils.ts b/cli/src/utils/utils.ts
index 0801c03911..526dffbde4 100644
--- a/cli/src/utils/utils.ts
+++ b/cli/src/utils/utils.ts
@@ -223,8 +223,9 @@ export function isRawAppFile(path: string): boolean {
   return isRawAppPath(path);
 }
 
+/** Sync paths carry the platform separator: `dependencies\x` on Windows. */
 export function isWorkspaceDependencies(path: string): boolean {
-  return path.startsWith("dependencies/");
+  return path.startsWith("dependencies/") || path.startsWith("dependencies\\");
 }
 
 export function printSync(input: string | Uint8Array) {
diff --git a/cli/test/codebase_digest_unit.test.ts b/cli/test/codebase_digest_unit.test.ts
new file mode 100644
index 0000000000..f12b928de4
--- /dev/null
+++ b/cli/test/codebase_digest_unit.test.ts
@@ -0,0 +1,48 @@
+import { expect, test } from "bun:test";
+import { mkdtemp, mkdir, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  listSyncCodebases,
+  uncoveredBundleInputs,
+} from "../src/utils/codebase.ts";
+
+test("extra_digest_paths edits change the codebase digest", async () => {
+  const root = await mkdtemp(join(tmpdir(), "wmill-codebase-"));
+  await mkdir(join(root, "f"));
+  await mkdir(join(root, "packages/utils"), { recursive: true });
+  await writeFile(join(root, "f/main.ts"), "export * from '../packages/utils/a'");
+  await writeFile(join(root, "packages/utils/a.ts"), "export const a = 1");
+
+  const digest = () =>
+    listSyncCodebases({
+      codebases: [
+        {
+          relative_path: join(root, "f"),
+          extra_digest_paths: [join(root, "packages/utils")],
+        },
+      ],
+    } as any)[0].getDigest();
+
+  try {
+    const before = await digest();
+    await writeFile(join(root, "packages/utils/a.ts"), "export const a = 2");
+    expect(await digest()).not.toBe(before);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("uncoveredBundleInputs reports only files outside the digested roots", () => {
+  const codebase = { relative_path: "f", extra_digest_paths: ["packages/a"] };
+  expect(
+    uncoveredBundleInputs(codebase, "g/entry.ts", [
+      "g/entry.ts",
+      "f/main.ts",
+      "packages/a/x.ts",
+      "packages/ab/y.ts",
+      "node_modules/pg/index.js",
+      "<define:process.env>",
+    ])
+  ).toEqual(["packages/ab/y.ts"]);
+});
diff --git a/cli/test/gitsync_deploy_branch_config.test.ts b/cli/test/gitsync_deploy_branch_config.test.ts
new file mode 100644
index 0000000000..eeab7a0120
--- /dev/null
+++ b/cli/test/gitsync_deploy_branch_config.test.ts
@@ -0,0 +1,94 @@
+import { expect, test } from "bun:test";
+import { execFileSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { createRemoteWorkspaceDeps, withTestBackend } from "./test_backend.ts";
+
+function git(cwd: string, ...args: string[]): string {
+  return execFileSync("git", args, { cwd, encoding: "utf8" }).trim();
+}
+
+// The git-sync deploy callback starts in a clone of the tracked branch and
+// switches to the fork's branch before pulling. What it writes there must follow
+// that branch's wmill.yaml: a fork branch that turned on `dedupeLockfiles` keeps
+// its shared lockfile instead of getting a `.script.lock` per script back.
+test("git-sync fork deploy follows the fork branch's wmill.yaml", async () => {
+  await withTestBackend(async (backend) => {
+    const post = (path: string, body: unknown) =>
+      backend.apiRequest!(`/api/w/${backend.workspace}${path}`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+      });
+    await createRemoteWorkspaceDeps(backend, "python3", "wmill\n");
+    await post("/folders/create", { name: "dedupe" });
+    const script = await post("/scripts/create", {
+      path: "f/dedupe/a",
+      summary: "",
+      description: "",
+      content: "def main():\n    pass\n",
+      language: "python3",
+      lock: "wmill==1.0.0\n",
+    });
+    expect(script.ok).toBe(true);
+
+    const bare = await mkdtemp(join(tmpdir(), "wmill_deploy_cfg_bare_"));
+    const seed = await mkdtemp(join(tmpdir(), "wmill_deploy_cfg_seed_"));
+    const work = await mkdtemp(join(tmpdir(), "wmill_deploy_cfg_work_"));
+    try {
+      execFileSync("git", ["init", "--bare", "--initial-branch=main", bare]);
+      git(seed, "init", "--initial-branch=main");
+      git(seed, "config", "user.email", "seed@windmill.dev");
+      git(seed, "config", "user.name", "seed");
+      git(seed, "remote", "add", "origin", `file://${bare}`);
+      const wmillYaml = "defaultTs: bun\nincludes:\n  - f/dedupe/**\nexcludes: []\n";
+      await writeFile(join(seed, "wmill.yaml"), wmillYaml);
+      git(seed, "add", "-A");
+      git(seed, "commit", "-m", "main");
+      git(seed, "push", "origin", "main");
+
+      // Any parent id makes the callback deploy as a fork, to this branch.
+      const forkBranch = `wm-fork/main/${backend.workspace}`;
+      git(seed, "checkout", "-b", forkBranch);
+      await writeFile(
+        join(seed, "wmill.yaml"),
+        wmillYaml + "dedupeLockfiles: true\n",
+      );
+      const pulled = await backend.runCLICommand(["sync", "pull", "--yes"], seed);
+      expect(pulled.code).toBe(0);
+      expect(existsSync(join(seed, "locks/requirements.in.lock"))).toBe(true);
+      git(seed, "add", "-A");
+      git(seed, "commit", "-m", "dedupe");
+      git(seed, "push", "origin", forkBranch);
+
+      // Git for Windows defaults to autocrlf=true, which checks the pulled LF
+      // files out as CRLF; the deploy's pull would rewrite every one of them
+      // and the clean-tree assertion below would read that as a change.
+      git(work, "clone", "-c", "core.autocrlf=false", `file://${bare}`, ".");
+      const deployed = await backend.runCLICommand(
+        [
+          "sync",
+          "git-deploy",
+          "--repository",
+          "u/test/unused",
+          "--git-deploy-items",
+          JSON.stringify([
+            { path_type: "script", path: "f/dedupe/a", commit_msg: "deploy" },
+          ]),
+          "--parent-workspace-id",
+          "parent",
+        ],
+        work,
+      );
+      expect(deployed.code).toBe(0);
+      expect(git(work, "rev-parse", "--abbrev-ref", "HEAD")).toBe(forkBranch);
+      expect(git(work, "status", "--porcelain")).toBe("");
+    } finally {
+      await rm(bare, { recursive: true, force: true });
+      await rm(seed, { recursive: true, force: true });
+      await rm(work, { recursive: true, force: true });
+    }
+  });
+});
diff --git a/cli/test/push_diff_convergence_unit.test.ts b/cli/test/push_diff_convergence_unit.test.ts
index 67f6d5b4dd..a6f2c132c0 100644
--- a/cli/test/push_diff_convergence_unit.test.ts
+++ b/cli/test/push_diff_convergence_unit.test.ts
@@ -320,3 +320,29 @@ test("push: settings.yaml differing only by name or an unset color is not a chan
   });
   expect(await diff(otherColor, remote, skips)).toEqual(["edited settings.yaml"]);
 });
+
+// A push applies auto_invite.instance_groups only when the local file declares
+// them (see pushWorkspaceSettings).
+test("push: settings.yaml without instance_groups is not a change", async () => {
+  const remote = local({
+    "settings.yaml":
+      "name: prod\nauto_invite:\n  enabled: false\n  instance_groups:\n    - eng\n  instance_groups_roles:\n    eng: developer\n",
+  });
+  const undeclared = local({
+    "settings.yaml": "name: prod\nauto_invite:\n  enabled: false\n",
+  });
+  const skips = { includeSettings: true };
+  expect(await diff(undeclared, remote, skips)).toEqual([]);
+
+  const groupsOnlyRemote = local({
+    "settings.yaml": "name: prod\nauto_invite:\n  instance_groups:\n    - eng\n",
+  });
+  const noAutoInvite = local({ "settings.yaml": "name: prod\n" });
+  expect(await diff(noAutoInvite, groupsOnlyRemote, skips)).toEqual([]);
+
+  const otherGroups = local({
+    "settings.yaml":
+      "name: prod\nauto_invite:\n  enabled: false\n  instance_groups: []\n",
+  });
+  expect(await diff(otherGroups, remote, skips)).toEqual(["edited settings.yaml"]);
+});
diff --git a/cli/test/push_workspace_settings_auto_invite_unit.test.ts b/cli/test/push_workspace_settings_auto_invite_unit.test.ts
new file mode 100644
index 0000000000..b04d895056
--- /dev/null
+++ b/cli/test/push_workspace_settings_auto_invite_unit.test.ts
@@ -0,0 +1,82 @@
+/**
+ * Regression guard: `sync push` (pushWorkspaceSettings) applies the domain invite and
+ * the instance groups of `auto_invite` through their own endpoints, and never clears
+ * instance groups that settings.yaml does not declare.
+ */
+
+import { expect, test, describe, beforeEach, mock } from "bun:test";
+
+let editAutoInviteCalls: unknown[] = [];
+let editInstanceGroupsCalls: unknown[] = [];
+const remoteAutoInvite = {
+  enabled: true,
+  domain: "*",
+  operator: false,
+  mode: "invite",
+  instance_groups: ["eng"],
+  instance_groups_roles: { eng: "developer" },
+};
+
+// Every wmill.* call reachable from pushWorkspaceSettings is stubbed: bun shares one
+// mocked module across test files, and names missing from whichever mock loads first
+// stay missing for the others.
+mock.module("../gen/services.gen.ts", () => ({
+  getSettings: async () => ({ auto_invite: remoteAutoInvite }),
+  getWorkspaceName: async () => "phoenix",
+  changeWorkspaceName: async () => {},
+  changeWorkspaceColor: async () => {},
+  editWebhook: async () => {},
+  editAutoInvite: async (a: unknown) => {
+    editAutoInviteCalls.push(a);
+  },
+  editInstanceGroups: async (a: unknown) => {
+    editInstanceGroupsCalls.push(a);
+  },
+  editErrorHandler: async () => {},
+  editSuccessHandler: async () => {},
+  editCopilotConfig: async () => {},
+  editLargeFileStorageConfig: async () => {},
+  editWorkspaceGitSyncConfig: async () => {},
+  editWorkspaceDefaultApp: async () => {},
+  editDefaultScripts: async () => {},
+  workspaceMuteCriticalAlertsUi: async () => {},
+  updateOperatorSettings: async () => {},
+  editDataTableConfig: async () => {},
+  editSlackCommand: async () => {},
+  setWorkspaceSlackOauthConfig: async () => {},
+  deleteWorkspaceSlackOauthConfig: async () => {},
+}));
+
+const { pushWorkspaceSettings } = await import("../src/core/settings.ts");
+
+describe("pushWorkspaceSettings auto_invite", () => {
+  beforeEach(() => {
+    editAutoInviteCalls = [];
+    editInstanceGroupsCalls = [];
+  });
+
+  test("an instance-group-only change updates the groups and leaves the domain invite", async () => {
+    await pushWorkspaceSettings("phoenix", "settings", undefined, {
+      name: "phoenix",
+      auto_invite: { ...remoteAutoInvite, instance_groups_roles: { eng: "admin" } },
+    });
+    expect(editAutoInviteCalls.length).toBe(0);
+    expect(editInstanceGroupsCalls).toEqual([
+      {
+        workspace: "phoenix",
+        requestBody: { groups: ["eng"], roles: { eng: "admin" } },
+      },
+    ]);
+  });
+
+  test("a settings.yaml without instance_groups does not clear them", async () => {
+    const { instance_groups: _g, instance_groups_roles: _r, ...domainInvite } =
+      remoteAutoInvite;
+    await pushWorkspaceSettings("phoenix", "settings", undefined, {
+      name: "phoenix",
+      auto_invite: { ...domainInvite, operator: true },
+    });
+    expect(editAutoInviteCalls.length).toBe(1);
+    expect(editInstanceGroupsCalls.length).toBe(0);
+  });
+});
diff --git a/cli/test/push_workspace_settings_identity_unit.test.ts b/cli/test/push_workspace_settings_identity_unit.test.ts
index c583a53282..5dcf9815ef 100644
--- a/cli/test/push_workspace_settings_identity_unit.test.ts
+++ b/cli/test/push_workspace_settings_identity_unit.test.ts
@@ -31,6 +31,7 @@ mock.module("../gen/services.gen.ts", () => ({
     editWebhookCalls.push(a);
   },
   editAutoInvite: async () => {},
+  editInstanceGroups: async () => {},
   editErrorHandler: async () => {},
   editSuccessHandler: async () => {},
   editCopilotConfig: async () => {},
diff --git a/cli/test/sync_pull_push.test.ts b/cli/test/sync_pull_push.test.ts
index 24c4a282a3..fa52510e6c 100644
--- a/cli/test/sync_pull_push.test.ts
+++ b/cli/test/sync_pull_push.test.ts
@@ -2185,18 +2185,20 @@ describe("settings sync", () => {
       const files = await listFilesRecursive(tempDir);
       expect(files).toContain("settings.yaml");
 
-      // Read and modify a safe setting (webhook URL)
+      // Read and modify a safe setting (webhook URL). The server resolves the
+      // webhook host when it is saved and refuses one that does not resolve to a
+      // public address, so this must be a real public hostname.
+      const webhook = "https://example.com/hook";
       const settingsContent = await readFile(`${tempDir}/settings.yaml`, "utf-8");
 
       let modifiedSettings: string;
       if (settingsContent.includes("webhook:")) {
         modifiedSettings = settingsContent.replace(
           /webhook:.*/,
-          'webhook: "https://test-webhook.example.com/hook"'
+          `webhook: "${webhook}"`
         );
       } else {
-        modifiedSettings =
-          settingsContent + '\nwebhook: "https://test-webhook.example.com/hook"\n';
+        modifiedSettings = settingsContent + `\nwebhook: "${webhook}"\n`;
       }
       await writeFile(`${tempDir}/settings.yaml`, modifiedSettings, "utf-8");
 
@@ -2213,7 +2215,7 @@ describe("settings sync", () => {
       );
       expect(apiResp.status).toEqual(200);
       const settingsData = await apiResp.json();
-      expect(settingsData.webhook).toEqual("https://test-webhook.example.com/hook");
+      expect(settingsData.webhook).toEqual(webhook);
     });
   });
 });
diff --git a/cli/test/workspace_deps_path_unit.test.ts b/cli/test/workspace_deps_path_unit.test.ts
new file mode 100644
index 0000000000..45d725c6e5
--- /dev/null
+++ b/cli/test/workspace_deps_path_unit.test.ts
@@ -0,0 +1,23 @@
+import { expect, test } from "bun:test";
+import { isWorkspaceDependencies } from "../src/utils/utils.ts";
+import { workspaceDependenciesPathToLanguageAndFilename } from "../src/utils/script_common.ts";
+
+// Sync paths carry the platform separator. A Windows path parsed to a different
+// set name pushes the file to a set the workspace does not have.
+test("workspace dependency paths parse the same with either separator", () => {
+  for (const sep of ["/", "\\"]) {
+    expect(isWorkspaceDependencies(`dependencies${sep}requirements.in`)).toBe(true);
+    expect(
+      workspaceDependenciesPathToLanguageAndFilename(`dependencies${sep}requirements.in`),
+    ).toEqual({ name: undefined, language: "python3" });
+    expect(
+      workspaceDependenciesPathToLanguageAndFilename(`dependencies${sep}team.package.json`),
+    ).toEqual({ name: "team", language: "bun" });
+    expect(
+      workspaceDependenciesPathToLanguageAndFilename(
+        `dependencies${sep}team${sep}python.requirements.in`,
+      ),
+    ).toEqual({ name: "team/python", language: "python3" });
+  }
+  expect(isWorkspaceDependencies("f\\dependencies\\requirements.in")).toBe(false);
+});
diff --git a/cli/wmill.schema.json b/cli/wmill.schema.json
index b4b10087a8..022156e5c9 100644
--- a/cli/wmill.schema.json
+++ b/cli/wmill.schema.json
@@ -147,6 +147,13 @@
             "type": "string",
             "description": "Path to the codebase directory"
           },
+          "extra_digest_paths": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Paths outside relative_path that scripts import, relative to wmill.yaml; hashed recursively"
+          },
           "includes": {
             "type": "array",
             "items": {
diff --git a/docker/DockerfileCuda b/docker/DockerfileCuda
index 098670f9a3..031921070b 100644
--- a/docker/DockerfileCuda
+++ b/docker/DockerfileCuda
@@ -1,4 +1,5 @@
-FROM ghcr.io/windmill-labs/windmill-ee:dev
+ARG BASE_IMAGE=ghcr.io/windmill-labs/windmill-ee:dev
+FROM ${BASE_IMAGE}
 
 # Install any necessary dependencies for managing repositories and packages
 RUN apt-get update && apt-get install -y curl gnupg2
diff --git a/docker/DockerfileExtra b/docker/DockerfileExtra
index 9eb2a987f2..8aa24206a4 100644
--- a/docker/DockerfileExtra
+++ b/docker/DockerfileExtra
@@ -110,11 +110,12 @@ WORKDIR /multiplayer
 
 # Copy multiplayer server files
 COPY multiplayer/package.json .
+COPY multiplayer/package-lock.json .
 COPY multiplayer/server.mjs .
 COPY multiplayer/gateway.mjs .
 
 # Install dependencies
-RUN npm install
+RUN npm ci --omit=dev
 
 # ============================================================================
 # Entrypoint Setup
diff --git a/docker/DockerfileFull b/docker/DockerfileFull
index b827208c1d..8ef6be78bb 100644
--- a/docker/DockerfileFull
+++ b/docker/DockerfileFull
@@ -1,4 +1,5 @@
-FROM ghcr.io/windmill-labs/windmill:dev
+ARG BASE_IMAGE=ghcr.io/windmill-labs/windmill:dev
+FROM ${BASE_IMAGE}
 
 # Rust
 COPY --from=rust:1.97.0 /usr/local/cargo /usr/local/cargo
diff --git a/docker/DockerfileFullEe b/docker/DockerfileFullEe
index 5b5347558a..88ed619c19 100644
--- a/docker/DockerfileFullEe
+++ b/docker/DockerfileFullEe
@@ -1,3 +1,5 @@
+ARG BASE_IMAGE=ghcr.io/windmill-labs/windmill-ee:dev
+
 FROM alpine:3.14 AS oracledb-client
 
 ARG TARGETPLATFORM
@@ -17,7 +19,7 @@ RUN if [ "$TARGETPLATFORM" = "linux/arm64" ]; then \
         mv /opt/oracle/23/amd64/lib /opt/oracle/23/lib; \
     fi
 
-FROM ghcr.io/windmill-labs/windmill-ee:dev
+FROM ${BASE_IMAGE}
 
 # Rust
 COPY --from=rust:1.97.0 /usr/local/cargo /usr/local/cargo
diff --git a/docker/DockerfileSlim b/docker/DockerfileSlim
index 64fd1b735e..6418a2cfda 100644
--- a/docker/DockerfileSlim
+++ b/docker/DockerfileSlim
@@ -1,4 +1,7 @@
 ARG DEBIAN_IMAGE=debian:trixie-slim
+ARG BASE_IMAGE=ghcr.io/windmill-labs/windmill:dev
+
+FROM ${BASE_IMAGE} AS windmill_image
 
 FROM debian:trixie-slim AS nsjail
 
@@ -103,7 +106,7 @@ RUN arch="$(dpkg --print-architecture)"; \
 
 WORKDIR ${APP}
 
-COPY --from=ghcr.io/windmill-labs/windmill:dev --chmod=755  ${APP}/windmill ${APP}/windmill
+COPY --from=windmill_image --chmod=755  ${APP}/windmill ${APP}/windmill
 
 RUN ln -s ${APP}/windmill /usr/local/bin/windmill
 
diff --git a/docker/DockerfileSlimEe b/docker/DockerfileSlimEe
index de0d61a780..24ef941b87 100644
--- a/docker/DockerfileSlimEe
+++ b/docker/DockerfileSlimEe
@@ -1,4 +1,7 @@
 ARG DEBIAN_IMAGE=debian:trixie-slim
+ARG BASE_IMAGE=ghcr.io/windmill-labs/windmill-ee:dev
+
+FROM ${BASE_IMAGE} AS windmill_image
 
 FROM debian:trixie-slim AS nsjail
 
@@ -103,7 +106,7 @@ RUN arch="$(dpkg --print-architecture)"; \
 
 WORKDIR ${APP}
 
-COPY --from=ghcr.io/windmill-labs/windmill-ee:dev --chmod=755  ${APP}/windmill ${APP}/windmill
+COPY --from=windmill_image --chmod=755  ${APP}/windmill ${APP}/windmill
 
 RUN ln -s ${APP}/windmill /usr/local/bin/windmill
 
diff --git a/docs/auth-surface.md b/docs/auth-surface.md
index abeba1fe2b..15f2538cc5 100644
--- a/docs/auth-surface.md
+++ b/docs/auth-surface.md
@@ -12,18 +12,92 @@ Symbols, not line numbers, are cited: they drift less.
   by `create_session_token` (`windmill-api-users/src/users.rs`). `GET /api/users/refresh_token`
   mints one for any non-job token but returns plain text, no redirect.
 - **`tokens/impersonate`** (superadmin) returns a multi-use token and sets no cookie.
-- **A token's label decides whether its expiry raises alerts.** When `delete_expired_items`
-  removes an expired `token` row, the monitor emails the owner and raises a critical alert (if
-  enabled); rows registered by `register_token_expiry_notification` also get an "expiring soon"
-  warning first. Neither happens when `is_user_token` (`windmill-common/src/auth.rs`) reserves
-  the label, so a token the system mints for itself, whether from the backend or from the frontend
-  through `tokens/create`, needs a reserved label. An `ephemeral-` prefix needs no other change
-  (keep it clear of `is_server_minted_label` if minted through `tokens/create`); a new prefix
-  also goes into the SQL and Svelte mirrors that function's doc lists.
+- **`max_token_expiration_days`** caps `POST /users/tokens/create` and `tokens/impersonate`, by
+  shortening the stored expiration (`cap_token_expiration`), never by refusing: the CLI
+  authorization page, `wmill user create-token` and the editor's language-server token all pick a
+  lifetime without reading the setting, and CLIs already installed never will. The CLI signs in
+  again on its own when its token expires, which is why the authorization page labels it
+  `cli-login:<username>`, reserved in `is_user_token` so its expiry does not email the user. A token
+  owned by a service account is exempt: one in the workspace the token names, or in any workspace
+  for a workspace-less token (for `tokens/impersonate`, the impersonated account). Any workspace
+  admin can therefore create and impersonate a service account to hold an uncapped token, so the
+  ceiling bounds personal tokens only. Only the stored expiration is capped: the auth lookup never
+  reads the setting, so tokens that exist when it is turned on or lowered keep theirs, including
+  none. Deliberately outside it: server-side mints (`create_token_internal` callers such as native
+  trigger webhook tokens, which never expire for GitHub and Nextcloud), and tokens with their own
+  fixed lifetime that outlive a short ceiling: sessions (`MAX_SESSION_VALIDITY_SECONDS`, 3 days, and
+  re-mintable through `GET /users/refresh_token`) and MCP OAuth access tokens (7 days, with a
+  rotating 30-day refresh token). Any logged-in user can read the setting through `GET
+  /settings/global/{key}`, which the token form uses to offer only expirations within it. The
+  settings API and config sync reject any value `parse_max_token_expiration_days` cannot read, since
+  the token routes would read it as no ceiling; `parseMaxTokenExpirationDays` in the frontend must
+  accept exactly the same values.
+- **A token's label decides whether its expiry raises alerts.** When `delete_expired_items` removes
+  an expired `token` row, the monitor emails the owner and raises a critical alert (if enabled);
+  rows registered by `register_token_expiry_notification` also get an "expiring soon" warning first,
+  except a token whose whole lifetime fits in `TOKEN_EXPIRY_WARNING_DAYS` (7), which gets no row
+  since the warning would arrive minutes after it was created. Neither happens when `is_user_token`
+  (`windmill-common/src/auth.rs`) reserves the label, so a token the system mints for itself,
+  whether from the backend or from the frontend through `tokens/create`, needs a reserved label. An
+  `ephemeral-` prefix needs no other change (keep it clear of `is_server_minted_label` if minted
+  through `tokens/create`); a new prefix also goes into the SQL and Svelte mirrors that function's
+  doc lists.
 - **Every superadmin route refuses a job token**: `require_super_admin`
   (`windmill-api-auth/src/lib.rs`) errors on `authed.job_id.is_some()`. A script that needs
   `users/create`, `tokens/impersonate`, `set_login_type`, … must use a dedicated superadmin user
   token stored as a secret, never `$WM_TOKEN`. Token scopes cannot narrow superadmin routes.
+- **Write access to a folder steers its readers' AI chat.** An `ai_instruction` resource's body is
+  delivered to the global chat of everyone who can read the resource, with no opt-in, whenever the
+  chat touches a path under its folder (`copilot/chat/folderInstructions.ts`); the chat then acts
+  with that reader's permissions, outside the folder too. `ai_skill` bodies are likewise in play
+  for every reader until turned off. The resource ACL is the only control, so granting write on a
+  folder grants that influence.
+- **A remote deploy token is a credential for another instance**, held per account and workspace
+  (`remote_deploy_token`, encrypted under the workspace key, re-keyed by `set_encryption_key`).
+  Its `email` references `password(email)` with `ON DELETE/UPDATE CASCADE`, so whatever deletes or
+  renames an account takes the token along and a recycled address cannot inherit it; removal from
+  a workspace deletes it explicitly (`delete_workspace_user_internal`, both `leave_workspace`). The
+  row records the target it was granted for, and
+  `remote_deploy::proxy` only sends it to a target still matching the workspace setting, so
+  re-pointing the setting cannot redirect anyone's token to a URL of the admin's choosing.
+  `require_own_credentials` refuses job, scoped and read-only tokens (on `set_target` too): the
+  stored token carries none of their restrictions. The proxy turns the local session into a remote
+  bearer credential, so every ambient-cookie vector becomes one on the remote: its URL carries the
+  row's random `proxy_key` (a link riding the `SameSite=Lax` cookie cannot know it; a header would
+  do, but the frontend's only per-call hook is the global `OpenAPI.HEADERS`, whose mere presence
+  switches every download to in-memory blobs). The key is served `no-store`, withheld from the
+  credentials `require_own_credentials` refuses, and masked in this instance's own request logs
+  (`RedactedUri`, used by the request span and the log context); a reverse proxy in front still
+  writes the full path to its access log. `connect` names the target the token was obtained for
+  and is refused, before the token is sent anywhere, if the workspace now points elsewhere; the
+  token only ever goes to that target. It takes no lock against what clears these rows (a removal
+  from the workspace, a target change, a key rotation): their writers take the account, membership,
+  key and settings rows in every order, so any lock held there could close a deadlock. A row can
+  therefore land after one of them ran, however long its remote call took, and every read
+  (`load_connection`) voids it instead, by identity rather than by comparing times: the connect
+  records, before its remote call, the target setting's version (`remote_deploy_target_changed_at`)
+  and the `created_at` of the owner's membership, and the row counts only while both are still
+  the same (or the owner is a superadmin) and it decrypts. So a target set A → B → A, or a
+  removal and re-add, voids it whatever the clocks say. A superadmin with no membership is bound
+  through the credential making the request instead: the insert requires its `token` row to
+  still exist, and `delete_user`, offboarding and SCIM removal delete an account's tokens, so an
+  address deleted that way and re-created during the call does not inherit the connection (a JWT,
+  having no row, cannot connect a workspace its owner is not a member of). `leave_instance`
+  deletes only the `password` row, leaving the tokens and the memberships, which is not covered.
+  Neither is a member's connect across an account re-creation: an address is not expected to pass
+  to another person. A disconnect empties and stamps the row
+  (inserting one if needed) rather than deleting it, `connected_at` is when a connect started,
+  and the connect's upsert leaves a row stamped after that alone, so an older connect cannot undo
+  a disconnect or a newer connect. Connecting by redirect: the remote's
+  `/user/remote_deploy_authorize` page
+  mints a token bound to the one remote workspace (`remote-deploy:<source host>`, a label
+  reserved in `is_user_token` so its expiry emails nobody) only on an
+  explicit Authorize, only for a callback whose path is `/remote_deploy/callback`, and refuses to
+  render inside a frame; the token travels in the fragment, and the callback checks a single-use
+  `state` the drawer stored, so no other page can plant a token as the user's. The proxy also refuses a path the URL parser would rewrite,
+  serves every response under `CSP: sandbox` + `nosniff`, forwards only the method, query, body,
+  content-type and accept — never this instance's cookie or token — and turns the target's 401
+  into a 502, because the browser logs the user out of *this* instance on an unhandled 401.
 - **`login_type`** (`password` table) is a free-form `VARCHAR(50)`. Password login and password
   reset require `login_type = 'password'`; `set_password` also accepts `pending_oauth` and turns
   the account into a `password` one in the same statement (an account created ahead of its owner
diff --git a/docs/feature-telemetry.md b/docs/feature-telemetry.md
index ae62d46b94..9dacfc1cbd 100644
--- a/docs/feature-telemetry.md
+++ b/docs/feature-telemetry.md
@@ -4,10 +4,10 @@
 anonymous usage-stats payload. It answers "does anyone use this, and which variant do they pick"
 without any identifying data leaving the instance.
 
-It currently carries 51 registered actions across nineteen features (`ai_session`, `ai_chat`,
-`ai_fix`, `ai_agent`, `ai_agent_eval`, `app_sandbox`, `datatable`, `flow_editor`, `flow_run`,
-`flow_step`, `home`, `run_form`, `debugger`, `trigger`, `command_script`, `hub_script`,
-`usage_meter`, `sso_groups_claim`, `cloud_trial_offer`). Nearly all of the
+It currently carries 58 registered actions across twenty features (`ai_session`, `ai_chat`,
+`ai_fix`, `ai_agent`, `ai_agent_eval`, `app_sandbox`, `datatable`, `db_manager`, `flow_editor`,
+`flow_run`, `flow_step`, `home`, `run_form`, `debugger`, `trigger`, `command_script`,
+`hub_script`, `usage_meter`, `sso_groups_claim`, `cloud_trial_offer`). Nearly all of the
 product is uninstrumented, so new user-facing work is the opportunity to change that.
 
 ## When to instrument
diff --git a/flake.nix b/flake.nix
index 9062fdb4fd..f005644e3d 100644
--- a/flake.nix
+++ b/flake.nix
@@ -65,7 +65,10 @@
 
           # Misc
           libtool
-          postgresql
+          # Must not trail the server the dev database runs (postgres:18): pg_dump refuses a
+          # server newer than itself by a major version, which takes out every data table
+          # export, clone and fork-with-data.
+          postgresql_18
 
           # Build tooling
           pkg-config
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 935a1aa475..611cd0c91f 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.814.0",
+	"version": "1.817.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@windmill-labs/components",
-			"version": "1.814.0",
+			"version": "1.817.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
@@ -19,8 +19,10 @@
 				"@codingame/monaco-vscode-standalone-json-language-features": "=25.0.0",
 				"@codingame/monaco-vscode-standalone-languages": "=25.0.0",
 				"@codingame/monaco-vscode-standalone-typescript-language-features": "=25.0.0",
+				"@floating-ui/core": "^1.3.1",
 				"@json2csv/plainjs": "^7.0.6",
 				"@leeoniya/ufuzzy": "^1.0.8",
+				"@melt-ui/svelte": "^0.86.2",
 				"@popperjs/core": "^2.11.8",
 				"@redocly/json-to-json-schema": "^0.0.1",
 				"@scalar/openapi-parser": "^0.15.0",
@@ -29,6 +31,7 @@
 				"@windmill-labs/svelte-dnd-action": "^0.9.44",
 				"@xterm/addon-fit": "^0.10.0",
 				"@xyflow/svelte": "^1.0.0",
+				"@zerodevx/svelte-toast": "^0.9.6",
 				"acorn": "^8.15.0",
 				"ag-charts-community": "^9.0.1",
 				"ag-charts-enterprise": "^9.0.1",
@@ -39,10 +42,11 @@
 				"chartjs-adapter-date-fns": "^3.0.0",
 				"chartjs-plugin-zoom": "^2.0.0",
 				"clone": "^2.1.2",
+				"d3-dag": "^0.11.5",
 				"d3-zoom": "^3.0.0",
 				"date-fns": "^2.30.0",
-				"diff": "^7.0.0",
-				"dompurify": "^3.3.1",
+				"diff": "^8.0.3",
+				"dompurify": "^3.4.13",
 				"driver.js": "^1.3.0",
 				"esm-env": "^1.0.0",
 				"fast-equals": "^5.0.1",
@@ -54,8 +58,8 @@
 				"lru-cache": "^11.1.0",
 				"lucide-svelte": "^0.540.0",
 				"mdast-util-find-and-replace": "^3.0.2",
-				"mermaid": "^11.15.0",
-				"minimatch": "^10.0.1",
+				"mermaid": "^11.16.1",
+				"minimatch": "^10.2.3",
 				"modern-screenshot": "^4.7.0",
 				"monaco-editor": "npm:@codingame/monaco-vscode-editor-api@=25.0.0",
 				"monaco-languageclient": "10.6.0",
@@ -67,15 +71,23 @@
 				"panzoom": "^9.4.3",
 				"pdfjs-dist": "4.8.69",
 				"quicktype-core": "^23.2.6",
-				"quill": "^1.3.7",
+				"quill": "^2.0.3",
 				"rehype-github-alerts": "^3.0.0",
 				"rehype-raw": "^7.0.0",
 				"rehype-sanitize": "^6.0.0",
 				"rfc4648": "^1.5.3",
 				"runed": "^0.36.0",
+				"style-to-object": "^0.4.1",
+				"svelte": "^5.55.7",
+				"svelte-awesome-color-picker": "^3.0.4",
 				"svelte-carousel": "^1.0.25",
 				"svelte-exmarkdown": "^5.0.0",
+				"svelte-floating-ui": "^1.5.8",
+				"svelte-highlight": "^7.6.0",
 				"svelte-infinite-loading": "^1.4.0",
+				"svelte-popperjs": "^1.3.2",
+				"svelte-range-slider-pips": "^2.3.1",
+				"svelte-splitpanes": "^8.0.9",
 				"tailwind-merge": "^1.13.2",
 				"unist-util-visit": "^5.0.0",
 				"vscode": "npm:@codingame/monaco-vscode-extension-api@=25.0.0",
@@ -102,33 +114,28 @@
 				"xterm-readline": "^1.1.2",
 				"y-monaco": "^0.1.4",
 				"y-websocket": "^1.5.4",
-				"yaml": "^2.8.0",
+				"yaml": "^2.8.3",
 				"yjs": "^13.6.7",
 				"zod": "^4.1.10"
 			},
 			"devDependencies": {
-				"@floating-ui/core": "^1.3.1",
 				"@hey-api/openapi-ts": "^0.43.0",
 				"@melt-ui/pp": "^0.3.2",
-				"@melt-ui/svelte": "^0.86.2",
 				"@playwright/test": "^1.57.0",
 				"@sveltejs/adapter-static": "^3.0.6",
-				"@sveltejs/kit": "^2.53.4",
+				"@sveltejs/kit": "^2.69.1",
 				"@sveltejs/package": "^2.5.7",
 				"@sveltejs/vite-plugin-svelte": "^7.0.0",
 				"@tailwindcss/forms": "^0.5.3",
 				"@tailwindcss/typography": "^0.5.8",
 				"@types/d3": "^7.4.0",
 				"@types/d3-zoom": "^3.0.3",
-				"@types/diff": "^7.0.1",
 				"@types/lodash": "^4.14.195",
 				"@types/vscode": "^1.83.5",
 				"@typescript-eslint/eslint-plugin": "^5.59.8",
 				"@typescript-eslint/parser": "^5.60.0",
-				"@zerodevx/svelte-toast": "^0.9.6",
 				"autoprefixer": "^10.4.13",
 				"cssnano": "^6.0.1",
-				"d3-dag": "^0.11.5",
 				"dts-bundle-generator": "^9.5.1",
 				"eslint": "^8.47.0",
 				"eslint-config-prettier": "^8.6.0",
@@ -142,25 +149,17 @@
 				"postcss-load-config": "^4.0.1",
 				"prettier": "^3.1.0",
 				"prettier-plugin-svelte": "^3.3.3",
-				"style-to-object": "^0.4.1",
 				"stylelint-config-recommended": "^13.0.0",
-				"svelte": "^5.53.5",
-				"svelte-awesome-color-picker": "^3.0.4",
 				"svelte-check": "^4.4.3",
 				"svelte-fast-check": "^0.4.5",
-				"svelte-floating-ui": "^1.5.8",
-				"svelte-highlight": "^7.6.0",
-				"svelte-popperjs": "^1.3.2",
 				"svelte-preprocess": "^6.0.0",
-				"svelte-range-slider-pips": "^2.3.1",
-				"svelte-splitpanes": "^8.0.9",
 				"tailwindcss": "^3.4.1",
-				"tar": "^7.5.4",
+				"tar": "^7.5.18",
 				"tslib": "^2.6.1",
 				"typescript": "^5.5.0",
 				"vite": "^8.2.0",
 				"vite-plugin-mkcert": "^2.0.0",
-				"vitest": "^4.1.0",
+				"vitest": "^4.1.11",
 				"vitest-browser-svelte": "^2.0.1"
 			},
 			"optionalDependencies": {
@@ -1152,9 +1151,9 @@
 			}
 		},
 		"node_modules/@eslint/eslintrc/node_modules/ajv": {
-			"version": "6.12.6",
-			"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
-			"integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
+			"version": "6.15.0",
+			"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
+			"integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
@@ -1176,9 +1175,9 @@
 			"license": "MIT"
 		},
 		"node_modules/@eslint/eslintrc/node_modules/minimatch": {
-			"version": "3.1.2",
-			"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-			"integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+			"version": "3.1.5",
+			"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+			"integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
 			"dev": true,
 			"license": "ISC",
 			"dependencies": {
@@ -1220,7 +1219,6 @@
 			"version": "1.7.3",
 			"resolved": "https://registry.npmjs.org/@floating-ui/core/-/core-1.7.3.tgz",
 			"integrity": "sha512-sGnvb5dmrJaKEZ+LDIpguvdX3bDlEllmv4/ClQ9awcmCZrlx5jQyyMWFM5kBI+EyNOCDDiKk8il0zeuX3Zlg/w==",
-			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"@floating-ui/utils": "^0.2.10"
@@ -1230,7 +1228,6 @@
 			"version": "1.7.4",
 			"resolved": "https://registry.npmjs.org/@floating-ui/dom/-/dom-1.7.4.tgz",
 			"integrity": "sha512-OOchDgh4F2CchOX94cRVqhvy7b3AFb+/rQXyswmzmGakRfkMgoWVjfnLWkRirfLEfuD4ysVW16eXzwt3jHIzKA==",
-			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"@floating-ui/core": "^1.7.3",
@@ -1241,7 +1238,6 @@
 			"version": "0.2.10",
 			"resolved": "https://registry.npmjs.org/@floating-ui/utils/-/utils-0.2.10.tgz",
 			"integrity": "sha512-aGTxbpbg8/b5JfU1HXSrbH3wXZuLPJcNEcZQFMxLs3oSzgtVu6nFPkbbGGUvBcUjKV2YyB9Wxxabo+HEH9tcRQ==",
-			"dev": true,
 			"license": "MIT"
 		},
 		"node_modules/@glideapps/ts-necessities": {
@@ -1290,9 +1286,9 @@
 			}
 		},
 		"node_modules/@humanwhocodes/config-array/node_modules/minimatch": {
-			"version": "3.1.2",
-			"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-			"integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+			"version": "3.1.5",
+			"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+			"integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
 			"dev": true,
 			"license": "ISC",
 			"dependencies": {
@@ -1345,33 +1341,11 @@
 			"version": "3.10.0",
 			"resolved": "https://registry.npmjs.org/@internationalized/date/-/date-3.10.0.tgz",
 			"integrity": "sha512-oxDR/NTEJ1k+UFVQElaNIk65E/Z83HK1z1WI3lQyhTtnNg4R5oVXaPzK3jcpKG8UHKDVuDQHzn+wsxSz8RP3aw==",
-			"dev": true,
 			"license": "Apache-2.0",
 			"dependencies": {
 				"@swc/helpers": "^0.5.0"
 			}
 		},
-		"node_modules/@isaacs/balanced-match": {
-			"version": "4.0.1",
-			"resolved": "https://registry.npmjs.org/@isaacs/balanced-match/-/balanced-match-4.0.1.tgz",
-			"integrity": "sha512-yzMTt9lEb8Gv7zRioUilSglI0c0smZ9k5D65677DLWLtWJaXIS3CqcGyUFByYKlnUj6TkjLVs54fBl6+TiGQDQ==",
-			"license": "MIT",
-			"engines": {
-				"node": "20 || >=22"
-			}
-		},
-		"node_modules/@isaacs/brace-expansion": {
-			"version": "5.0.0",
-			"resolved": "https://registry.npmjs.org/@isaacs/brace-expansion/-/brace-expansion-5.0.0.tgz",
-			"integrity": "sha512-ZT55BDLV0yv0RBm2czMiZ+SqCGO7AvmOM3G/w2xhVPH+te0aKgFjmBvGlL1dH+ql2tgGO3MVrbb3jCKyvpgnxA==",
-			"license": "MIT",
-			"dependencies": {
-				"@isaacs/balanced-match": "^4.0.1"
-			},
-			"engines": {
-				"node": "20 || >=22"
-			}
-		},
 		"node_modules/@isaacs/cliui": {
 			"version": "8.0.2",
 			"resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
@@ -1598,7 +1572,6 @@
 			"version": "0.86.6",
 			"resolved": "https://registry.npmjs.org/@melt-ui/svelte/-/svelte-0.86.6.tgz",
 			"integrity": "sha512-Jer+M7DgIwT5IHfTayb4Iw/fkkxWNmC/mqn/nMh9JrbPbkxmyabfLQnhJ+JDn5HK77f84j34lubO3iqFtYAfMg==",
-			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"@floating-ui/core": "^1.3.1",
@@ -1613,12 +1586,12 @@
 			}
 		},
 		"node_modules/@mermaid-js/parser": {
-			"version": "1.1.1",
-			"resolved": "https://registry.npmjs.org/@mermaid-js/parser/-/parser-1.1.1.tgz",
-			"integrity": "sha512-VuHdsYMK1bT6X2JbcAaWAhugTRvRBRyuZgd+c22swUeI9g/ntaxF7CY7dYarhZovofCbUNO0G7JesfmNtjYOCw==",
+			"version": "1.2.1",
+			"resolved": "https://registry.npmjs.org/@mermaid-js/parser/-/parser-1.2.1.tgz",
+			"integrity": "sha512-n12NohV3mrUyUL2o93IgG/ifeW9FTyeJn3zDxkhwa8MJ9Fxg3HQMlA3RiGmD/3UnJvheztkjjQAjA2T4LmUcpw==",
 			"license": "MIT",
 			"dependencies": {
-				"@chevrotain/types": "~11.1.1"
+				"@chevrotain/types": "~11.1.2"
 			}
 		},
 		"node_modules/@noble/hashes": {
@@ -2045,9 +2018,9 @@
 			}
 		},
 		"node_modules/@sveltejs/acorn-typescript": {
-			"version": "1.0.6",
-			"resolved": "https://registry.npmjs.org/@sveltejs/acorn-typescript/-/acorn-typescript-1.0.6.tgz",
-			"integrity": "sha512-4awhxtMh4cx9blePWl10HRHj8Iivtqj+2QdDCSMDzxG+XKa9+VCNupQuCuvzEhYPzZSrX+0gC+0lHA/0fFKKQQ==",
+			"version": "1.0.13",
+			"resolved": "https://registry.npmjs.org/@sveltejs/acorn-typescript/-/acorn-typescript-1.0.13.tgz",
+			"integrity": "sha512-wgKggnhZVL9Bfx1OaKKTrYY9BFRk6C8UAkQNUcIv1+llzYrIqy+RZm5HPKzn0NpEBvTVhTqB4kQyllZywsRBRQ==",
 			"license": "MIT",
 			"peerDependencies": {
 				"acorn": "^8.9.0"
@@ -2064,18 +2037,18 @@
 			}
 		},
 		"node_modules/@sveltejs/kit": {
-			"version": "2.53.4",
-			"resolved": "https://registry.npmjs.org/@sveltejs/kit/-/kit-2.53.4.tgz",
-			"integrity": "sha512-iAIPEahFgDJJyvz8g0jP08KvqnM6JvdW8YfsygZ+pMeMvyM2zssWMltcsotETvjSZ82G3VlitgDtBIvpQSZrTA==",
+			"version": "2.70.3",
+			"resolved": "https://registry.npmjs.org/@sveltejs/kit/-/kit-2.70.3.tgz",
+			"integrity": "sha512-UDvEYuZqAMbfB/oXIoqKvbKcb7YczK5zYrzmsGV1zRJk03jntwp8dXiYoIJotxAndsKvcPFtx9H1GRSKFdSHgg==",
 			"devOptional": true,
 			"license": "MIT",
 			"dependencies": {
 				"@standard-schema/spec": "^1.0.0",
-				"@sveltejs/acorn-typescript": "^1.0.5",
+				"@sveltejs/acorn-typescript": "^1.0.9",
 				"@types/cookie": "^0.6.0",
-				"acorn": "^8.14.1",
+				"acorn": "^8.16.0",
 				"cookie": "^0.6.0",
-				"devalue": "^5.6.3",
+				"devalue": "^5.8.1",
 				"esm-env": "^1.2.2",
 				"kleur": "^4.1.5",
 				"magic-string": "^0.30.5",
@@ -2093,7 +2066,7 @@
 				"@opentelemetry/api": "^1.0.0",
 				"@sveltejs/vite-plugin-svelte": "^3.0.0 || ^4.0.0-next.1 || ^5.0.0 || ^6.0.0-next.0 || ^7.0.0",
 				"svelte": "^4.0.0 || ^5.0.0-next.0",
-				"typescript": "^5.3.3",
+				"typescript": "^5.3.3 || ^6.0.0",
 				"vite": "^5.0.3 || ^6.0.0 || ^7.0.0-beta.0 || ^8.0.0"
 			},
 			"peerDependenciesMeta": {
@@ -2182,7 +2155,6 @@
 			"version": "0.5.17",
 			"resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.17.tgz",
 			"integrity": "sha512-5IKx/Y13RsYd+sauPb2x+U/xZikHjolzfuDgTAl/Tdf3Q8rslRvC19NKDLgAJQ6wsqADk10ntlv08nPFw/gO/A==",
-			"dev": true,
 			"license": "Apache-2.0",
 			"dependencies": {
 				"tslib": "^2.8.0"
@@ -2240,16 +2212,6 @@
 				"url": "https://github.com/sponsors/tannerlinsley"
 			}
 		},
-		"node_modules/@trysound/sax": {
-			"version": "0.2.0",
-			"resolved": "https://registry.npmjs.org/@trysound/sax/-/sax-0.2.0.tgz",
-			"integrity": "sha512-L7z9BgrNEcYyUYtF+HaEfiS5ebkh9jXqbszz7pC0hRBPaatV0XjSD3+eHrpqFemQfgwiFF0QPIarnIihIDn7OA==",
-			"dev": true,
-			"license": "ISC",
-			"engines": {
-				"node": ">=10.13.0"
-			}
-		},
 		"node_modules/@tutorlatin/svelte-tiny-virtual-list": {
 			"version": "3.0.16",
 			"resolved": "https://registry.npmjs.org/@tutorlatin/svelte-tiny-virtual-list/-/svelte-tiny-virtual-list-3.0.16.tgz",
@@ -2552,13 +2514,6 @@
 			"dev": true,
 			"license": "MIT"
 		},
-		"node_modules/@types/diff": {
-			"version": "7.0.2",
-			"resolved": "https://registry.npmjs.org/@types/diff/-/diff-7.0.2.tgz",
-			"integrity": "sha512-JSWRMozjFKsGlEjiiKajUjIJVKuKdE3oVy2DNtK+fUo8q82nhFZ2CPQwicAIkXrofahDXrWJ7mjelvZphMS98Q==",
-			"dev": true,
-			"license": "MIT"
-		},
 		"node_modules/@types/estree": {
 			"version": "1.0.8",
 			"resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
@@ -2642,7 +2597,8 @@
 			"version": "2.0.7",
 			"resolved": "https://registry.npmjs.org/@types/trusted-types/-/trusted-types-2.0.7.tgz",
 			"integrity": "sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==",
-			"license": "MIT"
+			"license": "MIT",
+			"optional": true
 		},
 		"node_modules/@types/unist": {
 			"version": "3.0.3",
@@ -2987,31 +2943,31 @@
 			}
 		},
 		"node_modules/@vitest/expect": {
-			"version": "4.1.0",
-			"resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.0.tgz",
-			"integrity": "sha512-EIxG7k4wlWweuCLG9Y5InKFwpMEOyrMb6ZJ1ihYu02LVj/bzUwn2VMU+13PinsjRW75XnITeFrQBMH5+dLvCDA==",
+			"version": "4.1.11",
+			"resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.11.tgz",
+			"integrity": "sha512-VX2x5vNJXET47KAFzwERI+KRMtTTCSWTfSMKsW7JsUsXV4psq++e3DvZpuTDOpHcxytiDs6p2nhVb2tVDiiUYw==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"@standard-schema/spec": "^1.1.0",
 				"@types/chai": "^5.2.2",
-				"@vitest/spy": "4.1.0",
-				"@vitest/utils": "4.1.0",
+				"@vitest/spy": "4.1.11",
+				"@vitest/utils": "4.1.11",
 				"chai": "^6.2.2",
-				"tinyrainbow": "^3.0.3"
+				"tinyrainbow": "^3.1.0"
 			},
 			"funding": {
 				"url": "https://opencollective.com/vitest"
 			}
 		},
 		"node_modules/@vitest/mocker": {
-			"version": "4.1.0",
-			"resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.0.tgz",
-			"integrity": "sha512-evxREh+Hork43+Y4IOhTo+h5lGmVRyjqI739Rz4RlUPqwrkFFDF6EMvOOYjTx4E8Tl6gyCLRL8Mu7Ry12a13Tw==",
+			"version": "4.1.11",
+			"resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.11.tgz",
+			"integrity": "sha512-2XJVD55d1o5AZous5CCGKS74g/riOj9odEt2bQpCVZeblHyHdnMeFl4jl0XjU21stf4mbjUkew2eXQZt65g5CQ==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
-				"@vitest/spy": "4.1.0",
+				"@vitest/spy": "4.1.11",
 				"estree-walker": "^3.0.3",
 				"magic-string": "^0.30.21"
 			},
@@ -3020,7 +2976,7 @@
 			},
 			"peerDependencies": {
 				"msw": "^2.4.9",
-				"vite": "^6.0.0 || ^7.0.0 || ^8.0.0-0"
+				"vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
 			},
 			"peerDependenciesMeta": {
 				"msw": {
@@ -3032,26 +2988,26 @@
 			}
 		},
 		"node_modules/@vitest/pretty-format": {
-			"version": "4.1.0",
-			"resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.0.tgz",
-			"integrity": "sha512-3RZLZlh88Ib0J7NQTRATfc/3ZPOnSUn2uDBUoGNn5T36+bALixmzphN26OUD3LRXWkJu4H0s5vvUeqBiw+kS0A==",
+			"version": "4.1.11",
+			"resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.11.tgz",
+			"integrity": "sha512-yiZzPbGTS9Sr/JpFl8zHrcIkAofNbFV6k21vIgQN/cY/oxZeXhJv5sc/MBJ5jFKWmWs+oJHw0UXLZjmf931+Vw==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
-				"tinyrainbow": "^3.0.3"
+				"tinyrainbow": "^3.1.0"
 			},
 			"funding": {
 				"url": "https://opencollective.com/vitest"
 			}
 		},
 		"node_modules/@vitest/runner": {
-			"version": "4.1.0",
-			"resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.0.tgz",
-			"integrity": "sha512-Duvx2OzQ7d6OjchL+trw+aSrb9idh7pnNfxrklo14p3zmNL4qPCDeIJAK+eBKYjkIwG96Bc6vYuxhqDXQOWpoQ==",
+			"version": "4.1.11",
+			"resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.11.tgz",
+			"integrity": "sha512-LztvUgdwMNJMIkj3hQnnxiC2Xy1zNxq928W/xhjCLaNCzqTZOudjwbQf6v9IntZGPw132i2Lq2rgTRZHD3JHNw==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
-				"@vitest/utils": "4.1.0",
+				"@vitest/utils": "4.1.11",
 				"pathe": "^2.0.3"
 			},
 			"funding": {
@@ -3066,14 +3022,14 @@
 			"license": "MIT"
 		},
 		"node_modules/@vitest/snapshot": {
-			"version": "4.1.0",
-			"resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.0.tgz",
-			"integrity": "sha512-0Vy9euT1kgsnj1CHttwi9i9o+4rRLEaPRSOJ5gyv579GJkNpgJK+B4HSv/rAWixx2wdAFci1X4CEPjiu2bXIMg==",
+			"version": "4.1.11",
+			"resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.11.tgz",
+			"integrity": "sha512-pN7ikn1ON7h8ee4gIAp4AzyK+zBtJPzVbqOgu5LCEh4VaJVbPQcgYQYJIMGQPXVeJJq1fnfazis7a5pFNPahog==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
-				"@vitest/pretty-format": "4.1.0",
-				"@vitest/utils": "4.1.0",
+				"@vitest/pretty-format": "4.1.11",
+				"@vitest/utils": "4.1.11",
 				"magic-string": "^0.30.21",
 				"pathe": "^2.0.3"
 			},
@@ -3089,9 +3045,9 @@
 			"license": "MIT"
 		},
 		"node_modules/@vitest/spy": {
-			"version": "4.1.0",
-			"resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.0.tgz",
-			"integrity": "sha512-pz77k+PgNpyMDv2FV6qmk5ZVau6c3R8HC8v342T2xlFxQKTrSeYw9waIJG8KgV9fFwAtTu4ceRzMivPTH6wSxw==",
+			"version": "4.1.11",
+			"resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.11.tgz",
+			"integrity": "sha512-apNa/prQy2qCeywhnixOHPRCgGNhvg7T4Dapfl1GahLp/R+uhBm5cPyFoNVyqsNd2h1nJxL6BqqdIjiABL60YA==",
 			"dev": true,
 			"license": "MIT",
 			"funding": {
@@ -3099,15 +3055,15 @@
 			}
 		},
 		"node_modules/@vitest/utils": {
-			"version": "4.1.0",
-			"resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.0.tgz",
-			"integrity": "sha512-XfPXT6a8TZY3dcGY8EdwsBulFCIw+BeeX0RZn2x/BtiY/75YGh8FeWGG8QISN/WhaqSrE2OrlDgtF8q5uhOTmw==",
+			"version": "4.1.11",
+			"resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.11.tgz",
+			"integrity": "sha512-zTCVGpyFsGWBhllOyKlTw/vnr6D9qxsfSDyfbyZmTyjHw5N/VuvzHpHoQjm2ZJzn4RJgx5w4r7V0er69CmLgPQ==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
-				"@vitest/pretty-format": "4.1.0",
+				"@vitest/pretty-format": "4.1.11",
 				"convert-source-map": "^2.0.0",
-				"tinyrainbow": "^3.0.3"
+				"tinyrainbow": "^3.1.0"
 			},
 			"funding": {
 				"url": "https://opencollective.com/vitest"
@@ -3184,7 +3140,6 @@
 			"version": "0.9.6",
 			"resolved": "https://registry.npmjs.org/@zerodevx/svelte-toast/-/svelte-toast-0.9.6.tgz",
 			"integrity": "sha512-nHlTrCjverlPK9yukK6fqbG3e/R+f10ldrc4nJHOe2qNDScuPTuYVSFEk2dDDtzWAwTN5pmdEXgA3M2RbT8jiw==",
-			"dev": true,
 			"license": "ISC",
 			"peerDependencies": {
 				"svelte": "^3.57.0 || ^4.0.0 || ^5.0.0"
@@ -3221,9 +3176,9 @@
 			}
 		},
 		"node_modules/acorn": {
-			"version": "8.15.0",
-			"resolved": "https://registry.npmjs.org/acorn/-/acorn-8.15.0.tgz",
-			"integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
+			"version": "8.18.0",
+			"resolved": "https://registry.npmjs.org/acorn/-/acorn-8.18.0.tgz",
+			"integrity": "sha512-lGq+9yr1/GuAWaVYIHRjvvySG5/4VfKIvC8EWxStPdcDh/Ka7FG3twP6v4d5BkravUilhIAsG4Qj83t02LWUPQ==",
 			"license": "MIT",
 			"bin": {
 				"acorn": "bin/acorn"
@@ -3274,9 +3229,9 @@
 			}
 		},
 		"node_modules/ajv": {
-			"version": "8.17.1",
-			"resolved": "https://registry.npmjs.org/ajv/-/ajv-8.17.1.tgz",
-			"integrity": "sha512-B/gBuNg5SiMTrPkC+A2+cW0RszwxYmn6VYxB/inlBStS5nx6xHIt/ehKRhIMhqusl7a8LjQoZnjCs5vhwxOQ1g==",
+			"version": "8.20.0",
+			"resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
+			"integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
 			"license": "MIT",
 			"dependencies": {
 				"fast-deep-equal": "^3.1.3",
@@ -3556,13 +3511,16 @@
 			"license": "MIT"
 		},
 		"node_modules/baseline-browser-mapping": {
-			"version": "2.8.16",
-			"resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.8.16.tgz",
-			"integrity": "sha512-OMu3BGQ4E7P1ErFsIPpbJh0qvDudM/UuJeHgkAvfWe+0HFJCXh+t/l8L6fVLR55RI/UbKrVLnAXZSVwd9ysWYw==",
+			"version": "2.11.24",
+			"resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.24.tgz",
+			"integrity": "sha512-hYrgxie335U08WqICoGqKRzV1HFXv6zdxwJE4ekCb80CM9a0SVVsN4QPwT67RraRo+9h8IATk6uxHJw7QSkdOg==",
 			"dev": true,
 			"license": "Apache-2.0",
 			"bin": {
-				"baseline-browser-mapping": "dist/cli.js"
+				"baseline-browser-mapping": "dist/cli.cjs"
+			},
+			"engines": {
+				"node": ">=6.0.0"
 			}
 		},
 		"node_modules/bezier-easing": {
@@ -3614,9 +3572,9 @@
 			"license": "ISC"
 		},
 		"node_modules/brace-expansion": {
-			"version": "1.1.12",
-			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-			"integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+			"version": "1.1.21",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
+			"integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
@@ -3651,9 +3609,9 @@
 			"license": "MIT"
 		},
 		"node_modules/browserslist": {
-			"version": "4.26.3",
-			"resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.26.3.tgz",
-			"integrity": "sha512-lAUU+02RFBuCKQPj/P6NgjlbCnLBMp4UtgTx7vNHd3XSIJF87s9a5rA3aH2yw3GS9DqZAUbOtZdCCiZeVRqt0w==",
+			"version": "4.29.0",
+			"resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.29.0.tgz",
+			"integrity": "sha512-3GSvyjvDI4Dur1Meg2BekJquu5uF+9R9a1+5M1Mde192eZoXbeXjzgOsgqPS2V8D5wrrip0gR5Hf/GhWQ9ZzaA==",
 			"dev": true,
 			"funding": [
 				{
@@ -3671,11 +3629,11 @@
 			],
 			"license": "MIT",
 			"dependencies": {
-				"baseline-browser-mapping": "^2.8.9",
-				"caniuse-lite": "^1.0.30001746",
-				"electron-to-chromium": "^1.5.227",
-				"node-releases": "^2.0.21",
-				"update-browserslist-db": "^1.1.3"
+				"baseline-browser-mapping": "^2.11.23",
+				"caniuse-lite": "^1.0.30001810",
+				"electron-to-chromium": "^1.5.427",
+				"node-releases": "^2.0.55",
+				"update-browserslist-db": "^1.3.3"
 			},
 			"bin": {
 				"browserslist": "cli.js"
@@ -3781,28 +3739,11 @@
 				"node": ">=8.10.0"
 			}
 		},
-		"node_modules/call-bind": {
-			"version": "1.0.8",
-			"resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.8.tgz",
-			"integrity": "sha512-oKlSFMcMwpUg2ednkhQ454wfWiU/ul3CkJe/PEHcTKuiX6RpbehUiFMXu13HalGZxfUwCQzZG747YXBn1im9ww==",
-			"license": "MIT",
-			"dependencies": {
-				"call-bind-apply-helpers": "^1.0.0",
-				"es-define-property": "^1.0.0",
-				"get-intrinsic": "^1.2.4",
-				"set-function-length": "^1.2.2"
-			},
-			"engines": {
-				"node": ">= 0.4"
-			},
-			"funding": {
-				"url": "https://github.com/sponsors/ljharb"
-			}
-		},
 		"node_modules/call-bind-apply-helpers": {
 			"version": "1.0.2",
 			"resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
 			"integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
+			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"es-errors": "^1.3.0",
@@ -3816,6 +3757,7 @@
 			"version": "1.0.4",
 			"resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz",
 			"integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==",
+			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"call-bind-apply-helpers": "^1.0.2",
@@ -3937,9 +3879,9 @@
 			}
 		},
 		"node_modules/caniuse-lite": {
-			"version": "1.0.30001750",
-			"resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001750.tgz",
-			"integrity": "sha512-cuom0g5sdX6rw00qOoLNSFCJ9/mYIsuSOA+yzpDw8eopiFqcVwQvZHqov0vmEighRxX++cfC0Vg1G+1Iy/mSpQ==",
+			"version": "1.0.30001810",
+			"resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001810.tgz",
+			"integrity": "sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==",
 			"dev": true,
 			"funding": [
 				{
@@ -4185,7 +4127,6 @@
 			"version": "2.9.3",
 			"resolved": "https://registry.npmjs.org/colord/-/colord-2.9.3.tgz",
 			"integrity": "sha512-jeC1axXpnb0/2nn/Y1LPuLdgXBLH7aDcHu4KEKfqw3CUhX7ZpfBSlPKyqXE6btIgEzfWtrX3/tyBCaCvXvMkOw==",
-			"dev": true,
 			"license": "MIT"
 		},
 		"node_modules/combined-stream": {
@@ -4263,9 +4204,9 @@
 			"license": "MIT"
 		},
 		"node_modules/cookie": {
-			"version": "0.6.0",
-			"resolved": "https://registry.npmjs.org/cookie/-/cookie-0.6.0.tgz",
-			"integrity": "sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw==",
+			"version": "0.7.2",
+			"resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
+			"integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
 			"devOptional": true,
 			"license": "MIT",
 			"engines": {
@@ -4711,7 +4652,6 @@
 			"version": "0.11.5",
 			"resolved": "https://registry.npmjs.org/d3-dag/-/d3-dag-0.11.5.tgz",
 			"integrity": "sha512-sNHvYqjzDlvV2fyEkoOCSuLs2GeWliIg7pJcAiKXgtUSxl0kIX0C2q1J8JzzA9CQWptKxYtzxFCXiKptTW8qsQ==",
-			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"d3-array": "^3.1.6",
@@ -5257,26 +5197,6 @@
 			"dev": true,
 			"license": "MIT"
 		},
-		"node_modules/deep-equal": {
-			"version": "1.1.2",
-			"resolved": "https://registry.npmjs.org/deep-equal/-/deep-equal-1.1.2.tgz",
-			"integrity": "sha512-5tdhKF6DbU7iIzrIOa1AOUt39ZRm13cmL1cGEh//aqR8x9+tNfbywRf0n5FD/18OKMdo7DNEtrX2t22ZAkI+eg==",
-			"license": "MIT",
-			"dependencies": {
-				"is-arguments": "^1.1.1",
-				"is-date-object": "^1.0.5",
-				"is-regex": "^1.1.4",
-				"object-is": "^1.1.5",
-				"object-keys": "^1.1.1",
-				"regexp.prototype.flags": "^1.5.1"
-			},
-			"engines": {
-				"node": ">= 0.4"
-			},
-			"funding": {
-				"url": "https://github.com/sponsors/ljharb"
-			}
-		},
 		"node_modules/deep-extend": {
 			"version": "0.6.0",
 			"resolved": "https://registry.npmjs.org/deep-extend/-/deep-extend-0.6.0.tgz",
@@ -5319,44 +5239,10 @@
 				"node": ">=6"
 			}
 		},
-		"node_modules/define-data-property": {
-			"version": "1.1.4",
-			"resolved": "https://registry.npmjs.org/define-data-property/-/define-data-property-1.1.4.tgz",
-			"integrity": "sha512-rBMvIzlpA8v6E+SJZoo++HAYqsLrkg7MSfIinMPFhmkorw7X+dOXVJQs+QT69zGkzMyfDnIMN2Wid1+NbL3T+A==",
-			"license": "MIT",
-			"dependencies": {
-				"es-define-property": "^1.0.0",
-				"es-errors": "^1.3.0",
-				"gopd": "^1.0.1"
-			},
-			"engines": {
-				"node": ">= 0.4"
-			},
-			"funding": {
-				"url": "https://github.com/sponsors/ljharb"
-			}
-		},
-		"node_modules/define-properties": {
-			"version": "1.2.1",
-			"resolved": "https://registry.npmjs.org/define-properties/-/define-properties-1.2.1.tgz",
-			"integrity": "sha512-8QmQKqEASLd5nx0U1B1okLElbUuuttJ/AnYmRXbbbGDWh6uS208EjD4Xqq/I9wK7u0v6O08XhTWnt5XtEbR6Dg==",
-			"license": "MIT",
-			"dependencies": {
-				"define-data-property": "^1.0.1",
-				"has-property-descriptors": "^1.0.0",
-				"object-keys": "^1.1.1"
-			},
-			"engines": {
-				"node": ">= 0.4"
-			},
-			"funding": {
-				"url": "https://github.com/sponsors/ljharb"
-			}
-		},
 		"node_modules/defu": {
-			"version": "6.1.4",
-			"resolved": "https://registry.npmjs.org/defu/-/defu-6.1.4.tgz",
-			"integrity": "sha512-mEQCMmwJu317oSz8CwdIOdwf3xMif1ttiM8LTufzc3g6kR+9Pe236twL8j3IYT1F7GfRgGcW6MWxzZjLIkuHIg==",
+			"version": "6.1.7",
+			"resolved": "https://registry.npmjs.org/defu/-/defu-6.1.7.tgz",
+			"integrity": "sha512-7z22QmUWiQ/2d0KkdYmANbRUVABpZ9SNYyH5vx6PZ+nE5bcC0l7uFvEfHlyld/HcGBFTL536ClDt3DEcSlEJAQ==",
 			"dev": true,
 			"license": "MIT"
 		},
@@ -5406,9 +5292,9 @@
 			}
 		},
 		"node_modules/devalue": {
-			"version": "5.6.3",
-			"resolved": "https://registry.npmjs.org/devalue/-/devalue-5.6.3.tgz",
-			"integrity": "sha512-nc7XjUU/2Lb+SvEFVGcWLiKkzfw8+qHI7zn8WYXKkLMgfGSHbgCEaR6bJpev8Cm6Rmrb19Gfd/tZvGqx9is3wg==",
+			"version": "5.9.2",
+			"resolved": "https://registry.npmjs.org/devalue/-/devalue-5.9.2.tgz",
+			"integrity": "sha512-po4PAY5c53tw5XMocSnf8A/5OHhbbUftpr93aEN6BBoAdntUmK7vu7wOATqvt7cXO7m1Cl4gMVn6p7n6n4mj0w==",
 			"license": "MIT"
 		},
 		"node_modules/devlop": {
@@ -5443,9 +5329,9 @@
 			"license": "Apache-2.0"
 		},
 		"node_modules/diff": {
-			"version": "7.0.0",
-			"resolved": "https://registry.npmjs.org/diff/-/diff-7.0.0.tgz",
-			"integrity": "sha512-PJWHUb1RFevKCwaFA9RlG5tCd+FO5iRh9A8HEtkmBH2Li03iJriB6m6JIN4rGz3K3JLawI7/veA1xzRKP6ISBw==",
+			"version": "8.0.4",
+			"resolved": "https://registry.npmjs.org/diff/-/diff-8.0.4.tgz",
+			"integrity": "sha512-DPi0FmjiSU5EvQV0++GFDOJ9ASQUVFh5kD+OzOnYdi7n3Wpm9hWWGfB/O2blfHcMVTL5WkQXSnRiK9makhrcnw==",
 			"license": "BSD-3-Clause",
 			"engines": {
 				"node": ">=0.3.1"
@@ -5542,9 +5428,9 @@
 			}
 		},
 		"node_modules/dompurify": {
-			"version": "3.3.1",
-			"resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz",
-			"integrity": "sha512-qkdCKzLNtrgPFP1Vo+98FRzJnBRGe4ffyCea9IwHB1fyxPOeNTHpLKYGd4Uk9xvNoH0ZoOjwZxNptyMwqrId1Q==",
+			"version": "3.4.15",
+			"resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.15.tgz",
+			"integrity": "sha512-EUBjM+B+lkDE41iE82DDSCfkoPGfXx8IxFxPMjNzm/Uk4xDet77rTN9wqlxlVg71kK7XGuUMv6wUxJUwwv+Xyw==",
 			"license": "(MPL-2.0 OR Apache-2.0)",
 			"optionalDependencies": {
 				"@types/trusted-types": "^2.0.7"
@@ -5605,6 +5491,7 @@
 			"version": "1.0.1",
 			"resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
 			"integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
+			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"call-bind-apply-helpers": "^1.0.1",
@@ -5640,9 +5527,9 @@
 			}
 		},
 		"node_modules/electron-to-chromium": {
-			"version": "1.5.235",
-			"resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.235.tgz",
-			"integrity": "sha512-i/7ntLFwOdoHY7sgjlTIDo4Sl8EdoTjWIaKinYOVfC6bOp71bmwenyZthWHcasxgHDNWbWxvG9M3Ia116zIaYQ==",
+			"version": "1.5.430",
+			"resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.430.tgz",
+			"integrity": "sha512-e1QEj72Y4zd8RlNZVmoTg+iCOSVwpk05IOiiQwdrkwCSVlZfPthevErhE+nckGd2YbsXfp1SkisznhGVIXP2NQ==",
 			"dev": true,
 			"license": "ISC"
 		},
@@ -5719,6 +5606,7 @@
 			"version": "1.0.1",
 			"resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
 			"integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
+			"dev": true,
 			"license": "MIT",
 			"engines": {
 				"node": ">= 0.4"
@@ -5728,6 +5616,7 @@
 			"version": "1.3.0",
 			"resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
 			"integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
+			"dev": true,
 			"license": "MIT",
 			"engines": {
 				"node": ">= 0.4"
@@ -5744,6 +5633,7 @@
 			"version": "1.1.1",
 			"resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
 			"integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
+			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"es-errors": "^1.3.0"
@@ -5963,9 +5853,9 @@
 			}
 		},
 		"node_modules/eslint-plugin-svelte/node_modules/postcss-selector-parser": {
-			"version": "6.1.2",
-			"resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.2.tgz",
-			"integrity": "sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==",
+			"version": "6.1.4",
+			"resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz",
+			"integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
@@ -6014,9 +5904,9 @@
 			}
 		},
 		"node_modules/eslint/node_modules/ajv": {
-			"version": "6.12.6",
-			"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
-			"integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
+			"version": "6.15.0",
+			"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
+			"integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
@@ -6065,9 +5955,9 @@
 			"license": "MIT"
 		},
 		"node_modules/eslint/node_modules/minimatch": {
-			"version": "3.1.2",
-			"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-			"integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+			"version": "3.1.5",
+			"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+			"integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
 			"dev": true,
 			"license": "ISC",
 			"dependencies": {
@@ -6087,7 +5977,6 @@
 			"version": "0.0.3",
 			"resolved": "https://registry.npmjs.org/esm-env-robust/-/esm-env-robust-0.0.3.tgz",
 			"integrity": "sha512-90Gnuw2DALOqlL1581VxP3GHPUNHX9U+fQ+8FNcTTFClhY5gEggAAnJ3q1b2Oq23knRsjv8YpNeMRPaMLUymOA==",
-			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"esm-env": "^1.0.0"
@@ -6148,15 +6037,6 @@
 				"node": ">=4.0"
 			}
 		},
-		"node_modules/esrap": {
-			"version": "2.2.3",
-			"resolved": "https://registry.npmjs.org/esrap/-/esrap-2.2.3.tgz",
-			"integrity": "sha512-8fOS+GIGCQZl/ZIlhl59htOlms6U8NvX6ZYgYHpRU/b6tVSh3uHkOHZikl3D4cMbYM0JlpBe+p/BkZEi8J9XIQ==",
-			"license": "MIT",
-			"dependencies": {
-				"@jridgewell/sourcemap-codec": "^1.4.15"
-			}
-		},
 		"node_modules/esrecurse": {
 			"version": "4.3.0",
 			"resolved": "https://registry.npmjs.org/esrecurse/-/esrecurse-4.3.0.tgz",
@@ -6220,9 +6100,9 @@
 			}
 		},
 		"node_modules/eventemitter3": {
-			"version": "2.0.3",
-			"resolved": "https://registry.npmjs.org/eventemitter3/-/eventemitter3-2.0.3.tgz",
-			"integrity": "sha512-jLN68Dx5kyFHaePoXWPsCGW5qdyZQtLYHkxkg02/Mz6g0kYpDx4FyP6XfArhQdlOC4b8Mv+EMxPo/8La7Tzghg==",
+			"version": "5.0.4",
+			"resolved": "https://registry.npmjs.org/eventemitter3/-/eventemitter3-5.0.4.tgz",
+			"integrity": "sha512-mlsTRyGaPBjPedk6Bvw+aqbsXDtoAyAzm5MO7JgU+yVRyMQ5O8bD4Kcci7BS85f93veegeCPkL8R4GLClnjLFw==",
 			"license": "MIT"
 		},
 		"node_modules/events": {
@@ -6277,9 +6157,9 @@
 			"license": "MIT"
 		},
 		"node_modules/fast-diff": {
-			"version": "1.1.2",
-			"resolved": "https://registry.npmjs.org/fast-diff/-/fast-diff-1.1.2.tgz",
-			"integrity": "sha512-KaJUt+M9t1qaIteSvjc6P3RbMdXsNhK61GRftR6SNxqmhthcd9MGIi4T+o0jD8LUSpSnSKXE20nLtJ3fOHxQig==",
+			"version": "1.3.0",
+			"resolved": "https://registry.npmjs.org/fast-diff/-/fast-diff-1.3.0.tgz",
+			"integrity": "sha512-VxPP4NqbUjj6MaAOafWeUn2cXWLcCtljklUtZf0Ind4XQ+QPtmA0b18zZy0jIQx+ExRVCR/ZQpBmik5lXshNsw==",
 			"license": "Apache-2.0"
 		},
 		"node_modules/fast-equals": {
@@ -6343,9 +6223,9 @@
 			"license": "MIT"
 		},
 		"node_modules/fast-uri": {
-			"version": "3.1.0",
-			"resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.0.tgz",
-			"integrity": "sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==",
+			"version": "3.1.8",
+			"resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz",
+			"integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==",
 			"funding": [
 				{
 					"type": "github",
@@ -6358,6 +6238,15 @@
 			],
 			"license": "BSD-3-Clause"
 		},
+		"node_modules/fastdom": {
+			"version": "1.0.12",
+			"resolved": "https://registry.npmjs.org/fastdom/-/fastdom-1.0.12.tgz",
+			"integrity": "sha512-LB+xjSTEbjHE1cWsxu+tN2Xqr1kpi+V9aADI7sVM5ZMaXyYGPHULQMzpJMYqOTULK/73pUkWVzzObFRBkPr+hg==",
+			"license": "MIT",
+			"dependencies": {
+				"strictdom": "^1.0.1"
+			}
+		},
 		"node_modules/fastest-levenshtein": {
 			"version": "1.0.16",
 			"resolved": "https://registry.npmjs.org/fastest-levenshtein/-/fastest-levenshtein-1.0.16.tgz",
@@ -6373,7 +6262,6 @@
 			"version": "0.7.2",
 			"resolved": "https://registry.npmjs.org/fastpriorityqueue/-/fastpriorityqueue-0.7.2.tgz",
 			"integrity": "sha512-5DtIKh6vtOmEGkYdEPNNb+mxeYCnBiKbK3s4gq52l6cX8I5QaTDWWw0Wx/iYo80fVOblSycHu1/iJeqeNxG8Jw==",
-			"dev": true,
 			"license": "Apache-2.0"
 		},
 		"node_modules/fastq": {
@@ -6445,9 +6333,9 @@
 			}
 		},
 		"node_modules/flatted": {
-			"version": "3.3.3",
-			"resolved": "https://registry.npmjs.org/flatted/-/flatted-3.3.3.tgz",
-			"integrity": "sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg==",
+			"version": "3.4.4",
+			"resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.4.tgz",
+			"integrity": "sha512-5+ybhBZANEJxaH3X5evAFatUxLfEHSr7n6kYJ+1Qd0mUqr4eu9gIf6GDbWHf8RJijHrjjO8G+la14SlL2SeS1Q==",
 			"dev": true,
 			"license": "ISC"
 		},
@@ -6455,7 +6343,6 @@
 			"version": "7.6.5",
 			"resolved": "https://registry.npmjs.org/focus-trap/-/focus-trap-7.6.5.tgz",
 			"integrity": "sha512-7Ke1jyybbbPZyZXFxEftUtxFGLMpE2n6A+z//m4CRDlj0hW+o3iYSmh8nFlYMurOiJVDmJRilUQtJr08KfIxlg==",
-			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"tabbable": "^6.2.0"
@@ -6479,17 +6366,17 @@
 			}
 		},
 		"node_modules/form-data": {
-			"version": "4.0.4",
-			"resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.4.tgz",
-			"integrity": "sha512-KrGhL9Q4zjj0kiUt5OO4Mr/A/jlI2jDYs5eHBpYHPcBEVSiipAvn2Ko2HnPe20rmcuuvMHNdZFp+4IlGTMF0Ow==",
+			"version": "4.0.6",
+			"resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz",
+			"integrity": "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"asynckit": "^0.4.0",
 				"combined-stream": "^1.0.8",
 				"es-set-tostringtag": "^2.1.0",
-				"hasown": "^2.0.2",
-				"mime-types": "^2.1.12"
+				"hasown": "^2.0.4",
+				"mime-types": "^2.1.35"
 			},
 			"engines": {
 				"node": ">= 6"
@@ -6557,15 +6444,7 @@
 			"version": "1.1.2",
 			"resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
 			"integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
-			"license": "MIT",
-			"funding": {
-				"url": "https://github.com/sponsors/ljharb"
-			}
-		},
-		"node_modules/functions-have-names": {
-			"version": "1.2.3",
-			"resolved": "https://registry.npmjs.org/functions-have-names/-/functions-have-names-1.2.3.tgz",
-			"integrity": "sha512-xckBUXyTIqT97tq2x2AMb+g163b5JFysYk0x4qxNFwbfQkmNZoiRHb6sPzI9/QV33WeuvVYBUIiD4NzNIyqaRQ==",
+			"dev": true,
 			"license": "MIT",
 			"funding": {
 				"url": "https://github.com/sponsors/ljharb"
@@ -6604,6 +6483,7 @@
 			"version": "1.3.0",
 			"resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
 			"integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
+			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"call-bind-apply-helpers": "^1.0.2",
@@ -6628,6 +6508,7 @@
 			"version": "1.0.1",
 			"resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
 			"integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
+			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"dunder-proto": "^1.0.1",
@@ -6706,9 +6587,9 @@
 			}
 		},
 		"node_modules/glob/node_modules/minimatch": {
-			"version": "3.1.2",
-			"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-			"integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+			"version": "3.1.5",
+			"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+			"integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
 			"dev": true,
 			"license": "ISC",
 			"dependencies": {
@@ -6811,6 +6692,7 @@
 			"version": "1.2.0",
 			"resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
 			"integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
+			"dev": true,
 			"license": "MIT",
 			"engines": {
 				"node": ">= 0.4"
@@ -6861,9 +6743,9 @@
 			}
 		},
 		"node_modules/handlebars": {
-			"version": "4.7.8",
-			"resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.7.8.tgz",
-			"integrity": "sha512-vafaFqs8MZkRrSX7sFVUdo3ap/eNiLnb4IakshzvP56X5Nr1iGKAIqdX6tMlm6HcNRIkr6AxO5jFEoJzzpT8aQ==",
+			"version": "4.7.9",
+			"resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.7.9.tgz",
+			"integrity": "sha512-4E71E0rpOaQuJR2A3xDZ+GM1HyWYv1clR58tC8emQNeQe3RH7MAzSbat+V0wG78LQBo6m6bzSG/L4pBuCsgnUQ==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
@@ -6903,22 +6785,11 @@
 				"node": ">=8"
 			}
 		},
-		"node_modules/has-property-descriptors": {
-			"version": "1.0.2",
-			"resolved": "https://registry.npmjs.org/has-property-descriptors/-/has-property-descriptors-1.0.2.tgz",
-			"integrity": "sha512-55JNKuIW+vq4Ke1BjOTjM2YctQIvCT7GFzHwmfZPGo5wnrgkid0YQtnAleFSqumZm4az3n2BS+erby5ipJdgrg==",
-			"license": "MIT",
-			"dependencies": {
-				"es-define-property": "^1.0.0"
-			},
-			"funding": {
-				"url": "https://github.com/sponsors/ljharb"
-			}
-		},
 		"node_modules/has-symbols": {
 			"version": "1.1.0",
 			"resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
 			"integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
+			"dev": true,
 			"license": "MIT",
 			"engines": {
 				"node": ">= 0.4"
@@ -6931,6 +6802,7 @@
 			"version": "1.0.2",
 			"resolved": "https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.2.tgz",
 			"integrity": "sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==",
+			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"has-symbols": "^1.0.3"
@@ -6949,9 +6821,10 @@
 			"license": "MIT"
 		},
 		"node_modules/hasown": {
-			"version": "2.0.2",
-			"resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
-			"integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
+			"version": "2.0.4",
+			"resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
+			"integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
+			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"function-bind": "^1.1.2"
@@ -7338,7 +7211,6 @@
 			"version": "0.1.1",
 			"resolved": "https://registry.npmjs.org/inline-style-parser/-/inline-style-parser-0.1.1.tgz",
 			"integrity": "sha512-7NXolsK4CAS5+xvdj5OMMbI962hU/wvwoxk+LWR9Ek9bVtyuuYScDN6eS0rUm6TxApFpw7CX1o4uJzcd4AyD3Q==",
-			"dev": true,
 			"license": "MIT"
 		},
 		"node_modules/internmap": {
@@ -7350,22 +7222,6 @@
 				"node": ">=12"
 			}
 		},
-		"node_modules/is-arguments": {
-			"version": "1.2.0",
-			"resolved": "https://registry.npmjs.org/is-arguments/-/is-arguments-1.2.0.tgz",
-			"integrity": "sha512-7bVbi0huj/wrIAOzb8U1aszg9kdi3KN/CyU19CTI7tAoZYEZoL9yCDXpbXN+uPsuWnP02cyug1gleqq+TU+YCA==",
-			"license": "MIT",
-			"dependencies": {
-				"call-bound": "^1.0.2",
-				"has-tostringtag": "^1.0.2"
-			},
-			"engines": {
-				"node": ">= 0.4"
-			},
-			"funding": {
-				"url": "https://github.com/sponsors/ljharb"
-			}
-		},
 		"node_modules/is-arrayish": {
 			"version": "0.2.1",
 			"resolved": "https://registry.npmjs.org/is-arrayish/-/is-arrayish-0.2.1.tgz",
@@ -7403,22 +7259,6 @@
 				"url": "https://github.com/sponsors/ljharb"
 			}
 		},
-		"node_modules/is-date-object": {
-			"version": "1.1.0",
-			"resolved": "https://registry.npmjs.org/is-date-object/-/is-date-object-1.1.0.tgz",
-			"integrity": "sha512-PwwhEakHVKTdRNVOw+/Gyh0+MzlCl4R6qKvkhuvLtPMggI1WAHt9sOwZxQLSGpUaDnrdyDsomoRgNnCfKNSXXg==",
-			"license": "MIT",
-			"dependencies": {
-				"call-bound": "^1.0.2",
-				"has-tostringtag": "^1.0.2"
-			},
-			"engines": {
-				"node": ">= 0.4"
-			},
-			"funding": {
-				"url": "https://github.com/sponsors/ljharb"
-			}
-		},
 		"node_modules/is-extglob": {
 			"version": "2.1.1",
 			"resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
@@ -7509,24 +7349,6 @@
 				"@types/estree": "^1.0.6"
 			}
 		},
-		"node_modules/is-regex": {
-			"version": "1.2.1",
-			"resolved": "https://registry.npmjs.org/is-regex/-/is-regex-1.2.1.tgz",
-			"integrity": "sha512-MjYsKHO5O7mCsmRGxWcLWheFqN9DJ/2TmngvjKXihe6efViPqc274+Fx/4fYj/r03+ESvBdTXK0V6tA3rgez1g==",
-			"license": "MIT",
-			"dependencies": {
-				"call-bound": "^1.0.2",
-				"gopd": "^1.2.0",
-				"has-tostringtag": "^1.0.2",
-				"hasown": "^2.0.2"
-			},
-			"engines": {
-				"node": ">= 0.4"
-			},
-			"funding": {
-				"url": "https://github.com/sponsors/ljharb"
-			}
-		},
 		"node_modules/is-url": {
 			"version": "1.2.4",
 			"resolved": "https://registry.npmjs.org/is-url/-/is-url-1.2.4.tgz",
@@ -7576,7 +7398,6 @@
 			"version": "0.4.24",
 			"resolved": "https://registry.npmjs.org/javascript-lp-solver/-/javascript-lp-solver-0.4.24.tgz",
 			"integrity": "sha512-5edoDKnMrt/u3M6GnZKDDIPxOyFOg+WrwDv8mjNiMC2DePhy2H9/FFQgf4ggywaXT1utvkxusJcjQUER72cZmA==",
-			"dev": true,
 			"license": "Unlicense"
 		},
 		"node_modules/jiti": {
@@ -7604,10 +7425,20 @@
 			"peer": true
 		},
 		"node_modules/js-yaml": {
-			"version": "4.1.0",
-			"resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
-			"integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==",
+			"version": "4.3.2",
+			"resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
+			"integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
 			"dev": true,
+			"funding": [
+				{
+					"type": "github",
+					"url": "https://github.com/sponsors/puzrin"
+				},
+				{
+					"type": "github",
+					"url": "https://github.com/sponsors/nodeca"
+				}
+			],
 			"license": "MIT",
 			"dependencies": {
 				"argparse": "^2.0.1"
@@ -7752,9 +7583,9 @@
 			}
 		},
 		"node_modules/jsdom/node_modules/undici": {
-			"version": "7.29.0",
-			"resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz",
-			"integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==",
+			"version": "7.29.1",
+			"resolved": "https://registry.npmjs.org/undici/-/undici-7.29.1.tgz",
+			"integrity": "sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q==",
 			"dev": true,
 			"license": "MIT",
 			"engines": {
@@ -7845,9 +7676,9 @@
 			}
 		},
 		"node_modules/json-refs/node_modules/js-yaml": {
-			"version": "3.14.2",
-			"resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz",
-			"integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==",
+			"version": "3.15.2",
+			"resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz",
+			"integrity": "sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
@@ -8546,9 +8377,9 @@
 			}
 		},
 		"node_modules/lodash": {
-			"version": "4.17.21",
-			"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
-			"integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
+			"version": "4.18.1",
+			"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
+			"integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
 			"license": "MIT"
 		},
 		"node_modules/lodash-es": {
@@ -8711,6 +8542,7 @@
 			"version": "1.1.0",
 			"resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
 			"integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
+			"dev": true,
 			"license": "MIT",
 			"engines": {
 				"node": ">= 0.4"
@@ -8896,9 +8728,9 @@
 			}
 		},
 		"node_modules/mdast-util-to-hast": {
-			"version": "13.2.0",
-			"resolved": "https://registry.npmjs.org/mdast-util-to-hast/-/mdast-util-to-hast-13.2.0.tgz",
-			"integrity": "sha512-QGYKEuUsYT9ykKBCMOEDLsU5JRObWQusAolFMeko/tYPufNkRffBAQjIE+99jbA87xv6FgmjLtwjh9wBWajwAA==",
+			"version": "13.2.1",
+			"resolved": "https://registry.npmjs.org/mdast-util-to-hast/-/mdast-util-to-hast-13.2.1.tgz",
+			"integrity": "sha512-cctsq2wp5vTsLIcaymblUriiTcZd0CwWtCbLvrOzYCDZoWyMNV8sZ7krj09FSnsiJi3WVsHLM4k6Dq/yaPyCXA==",
 			"license": "MIT",
 			"dependencies": {
 				"@types/hast": "^3.0.0",
@@ -9010,26 +8842,27 @@
 			}
 		},
 		"node_modules/mermaid": {
-			"version": "11.15.0",
-			"resolved": "https://registry.npmjs.org/mermaid/-/mermaid-11.15.0.tgz",
-			"integrity": "sha512-pTMbcf3rWdtLiYGpmoTjHEpeY8seiy6sR+9nD7LOs8KfUbHE4lOUAprTRqRAcWSQ6MQpdX+YEsxShtGsINtPtw==",
+			"version": "11.17.2",
+			"resolved": "https://registry.npmjs.org/mermaid/-/mermaid-11.17.2.tgz",
+			"integrity": "sha512-V6K3C8EBdEsPFZXSKMJe6ppQOENxuHARr9GvHX4hh47lAbhMRD9qf4oEK7LoaRQxULMa80/qt5gHO73aCleBBg==",
 			"license": "MIT",
 			"dependencies": {
-				"@braintree/sanitize-url": "^7.1.1",
+				"@braintree/sanitize-url": "^7.1.2",
 				"@iconify/utils": "^3.0.2",
-				"@mermaid-js/parser": "^1.1.1",
+				"@mermaid-js/parser": "^1.2.1",
 				"@types/d3": "^7.4.3",
 				"@upsetjs/venn.js": "^2.0.0",
-				"cytoscape": "^3.33.1",
+				"cytoscape": "^3.34.0",
 				"cytoscape-cose-bilkent": "^4.1.0",
 				"cytoscape-fcose": "^2.2.0",
 				"d3": "^7.9.0",
 				"d3-sankey": "^0.12.3",
 				"dagre-d3-es": "7.0.14",
-				"dayjs": "^1.11.19",
-				"dompurify": "^3.3.1",
+				"dayjs": "^1.11.21",
+				"dompurify": "^3.3.3",
 				"es-toolkit": "^1.45.1",
-				"katex": "^0.16.25",
+				"fastdom": "1.0.12",
+				"katex": "^0.16.47",
 				"khroma": "^2.1.0",
 				"marked": "^16.3.0",
 				"roughjs": "^4.6.6",
@@ -9697,20 +9530,41 @@
 			}
 		},
 		"node_modules/minimatch": {
-			"version": "10.0.3",
-			"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.0.3.tgz",
-			"integrity": "sha512-IPZ167aShDZZUMdRk66cyQAW3qr0WzbHkPdMYa8bzZhlHhO3jALbKdxcaak7W9FfT2rZNpQuUu4Od7ILEpXSaw==",
-			"license": "ISC",
+			"version": "10.2.6",
+			"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
+			"integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
+			"license": "BlueOak-1.0.0",
 			"dependencies": {
-				"@isaacs/brace-expansion": "^5.0.0"
+				"brace-expansion": "^5.0.8"
 			},
 			"engines": {
-				"node": "20 || >=22"
+				"node": "18 || 20 || >=22"
 			},
 			"funding": {
 				"url": "https://github.com/sponsors/isaacs"
 			}
 		},
+		"node_modules/minimatch/node_modules/balanced-match": {
+			"version": "4.0.4",
+			"resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+			"integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+			"license": "MIT",
+			"engines": {
+				"node": "18 || 20 || >=22"
+			}
+		},
+		"node_modules/minimatch/node_modules/brace-expansion": {
+			"version": "5.0.12",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
+			"integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
+			"license": "MIT",
+			"dependencies": {
+				"balanced-match": "^4.0.2"
+			},
+			"engines": {
+				"node": "20 || >=22"
+			}
+		},
 		"node_modules/minimist": {
 			"version": "1.2.8",
 			"resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
@@ -9896,10 +9750,9 @@
 			}
 		},
 		"node_modules/nanoid": {
-			"version": "5.1.6",
-			"resolved": "https://registry.npmjs.org/nanoid/-/nanoid-5.1.6.tgz",
-			"integrity": "sha512-c7+7RQ+dMB5dPwwCp4ee1/iV/q2P6aK1mTZcfr1BTuVlyW9hJYiMPybJCcnBlQtuSmTIWNeazm/zqNoZSSElBg==",
-			"dev": true,
+			"version": "5.1.16",
+			"resolved": "https://registry.npmjs.org/nanoid/-/nanoid-5.1.16.tgz",
+			"integrity": "sha512-kVrnsrJqMR8+oLJnGEmSWw9BivK5mt7H3FZatVRjrc5wGqFYuBxX1yG7+A7Gi5AefkX6t/oCkizcQgpu0cY1dQ==",
 			"funding": [
 				{
 					"type": "github",
@@ -10022,11 +9875,14 @@
 			}
 		},
 		"node_modules/node-releases": {
-			"version": "2.0.23",
-			"resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.23.tgz",
-			"integrity": "sha512-cCmFDMSm26S6tQSDpBCg/NR8NENrVPhAJSf+XbxBG4rPFaaonlEoE9wHQmun+cls499TQGSb7ZyPBRlzgKfpeg==",
+			"version": "2.0.55",
+			"resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.55.tgz",
+			"integrity": "sha512-mIrE/Cw9y+9Au6dS5vDKDhQza9YvG6w+ZrS6X+ZzA7yFW/soAeaups4Qzn1bL6g5FVy8WtP79+0j82oPIbqRjQ==",
 			"dev": true,
-			"license": "MIT"
+			"license": "MIT",
+			"engines": {
+				"node": ">=18"
+			}
 		},
 		"node_modules/normalize-package-data": {
 			"version": "3.0.3",
@@ -10139,31 +9995,6 @@
 				"url": "https://github.com/sponsors/ljharb"
 			}
 		},
-		"node_modules/object-is": {
-			"version": "1.1.6",
-			"resolved": "https://registry.npmjs.org/object-is/-/object-is-1.1.6.tgz",
-			"integrity": "sha512-F8cZ+KfGlSGi09lJT7/Nd6KJZ9ygtvYC0/UYYLI9nmQKLMnydpB9yvbv9K1uSkEu7FU9vYPmVwLg328tX+ot3Q==",
-			"license": "MIT",
-			"dependencies": {
-				"call-bind": "^1.0.7",
-				"define-properties": "^1.2.1"
-			},
-			"engines": {
-				"node": ">= 0.4"
-			},
-			"funding": {
-				"url": "https://github.com/sponsors/ljharb"
-			}
-		},
-		"node_modules/object-keys": {
-			"version": "1.1.1",
-			"resolved": "https://registry.npmjs.org/object-keys/-/object-keys-1.1.1.tgz",
-			"integrity": "sha512-NuAESUOUMrlIXOfHKzD6bpPu3tYt3xvjNdRIQ+FeT0lNb4K8WR70CaDxhuNguS2XG+GjkyMwOzsN5ZktImfhLA==",
-			"license": "MIT",
-			"engines": {
-				"node": ">= 0.4"
-			}
-		},
 		"node_modules/obug": {
 			"version": "2.1.1",
 			"resolved": "https://registry.npmjs.org/obug/-/obug-2.1.1.tgz",
@@ -10356,9 +10187,9 @@
 			}
 		},
 		"node_modules/parchment": {
-			"version": "1.1.4",
-			"resolved": "https://registry.npmjs.org/parchment/-/parchment-1.1.4.tgz",
-			"integrity": "sha512-J5FBQt/pM2inLzg4hEWmzQx/8h8D0CiDxaG3vyp9rKrQRSDgBlhjdP5jQGgosEajXPSQouXGHOmVdgo7QmJuOg==",
+			"version": "3.0.0",
+			"resolved": "https://registry.npmjs.org/parchment/-/parchment-3.0.0.tgz",
+			"integrity": "sha512-HUrJFQ/StvgmXRcQ1ftY6VEZUq3jA2t9ncFN4F84J/vN0/FPpQF+8FKXb3l6fLces6q0uOHj6NJn+2xvZnxO6A==",
 			"license": "BSD-3-Clause"
 		},
 		"node_modules/parent-module": {
@@ -10735,9 +10566,9 @@
 			}
 		},
 		"node_modules/postcss-calc/node_modules/postcss-selector-parser": {
-			"version": "6.1.2",
-			"resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.2.tgz",
-			"integrity": "sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==",
+			"version": "6.1.4",
+			"resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz",
+			"integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
@@ -10953,9 +10784,9 @@
 			}
 		},
 		"node_modules/postcss-merge-rules/node_modules/postcss-selector-parser": {
-			"version": "6.1.2",
-			"resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.2.tgz",
-			"integrity": "sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==",
+			"version": "6.1.4",
+			"resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz",
+			"integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
@@ -11035,9 +10866,9 @@
 			}
 		},
 		"node_modules/postcss-minify-selectors/node_modules/postcss-selector-parser": {
-			"version": "6.1.2",
-			"resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.2.tgz",
-			"integrity": "sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==",
+			"version": "6.1.4",
+			"resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz",
+			"integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
@@ -11075,9 +10906,9 @@
 			}
 		},
 		"node_modules/postcss-nested/node_modules/postcss-selector-parser": {
-			"version": "6.1.2",
-			"resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.2.tgz",
-			"integrity": "sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==",
+			"version": "6.1.4",
+			"resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz",
+			"integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
@@ -11380,9 +11211,9 @@
 			}
 		},
 		"node_modules/postcss-unique-selectors/node_modules/postcss-selector-parser": {
-			"version": "6.1.2",
-			"resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.2.tgz",
-			"integrity": "sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==",
+			"version": "6.1.4",
+			"resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz",
+			"integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
@@ -11401,9 +11232,9 @@
 			"license": "MIT"
 		},
 		"node_modules/postcss/node_modules/nanoid": {
-			"version": "3.3.16",
-			"resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz",
-			"integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
+			"version": "3.3.19",
+			"resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.19.tgz",
+			"integrity": "sha512-Y2tUNy4ouw6tq5oDSKeQYGOyhkUBhNOcGV/02KC+6kd9eDGqdZd++mjMiIDilrBYvjEnCYvVtsuHCuP+okSfug==",
 			"devOptional": true,
 			"funding": [
 				{
@@ -11509,9 +11340,9 @@
 			}
 		},
 		"node_modules/protocol-buffers-schema": {
-			"version": "3.6.0",
-			"resolved": "https://registry.npmjs.org/protocol-buffers-schema/-/protocol-buffers-schema-3.6.0.tgz",
-			"integrity": "sha512-TdDRD+/QNdrCGCE7v8340QyuXd4kIWIgapsE2+n/SaGiSSbomYl4TjHlvIoCWRpE7wFt02EpB35VVA2ImcBVqw==",
+			"version": "3.6.1",
+			"resolved": "https://registry.npmjs.org/protocol-buffers-schema/-/protocol-buffers-schema-3.6.1.tgz",
+			"integrity": "sha512-VG2K63Igkiv9p76tk1lilczEK1cT+kCjKtkdhw1dQZV3k3IXJbd3o6Ho8b9zJZaHSnT2hKe4I+ObmX9w6m5SmQ==",
 			"license": "MIT"
 		},
 		"node_modules/prr": {
@@ -11543,13 +11374,14 @@
 			}
 		},
 		"node_modules/qs": {
-			"version": "6.14.0",
-			"resolved": "https://registry.npmjs.org/qs/-/qs-6.14.0.tgz",
-			"integrity": "sha512-YWWTjgABSKcvs/nWBi9PycY/JiPJqOD4JA6o9Sej2AtvSGarXxKC3OQSk4pAarbdQlKAh5D4FCQkJNkW+GAn3w==",
+			"version": "6.16.0",
+			"resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz",
+			"integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==",
 			"dev": true,
 			"license": "BSD-3-Clause",
 			"dependencies": {
-				"side-channel": "^1.1.0"
+				"es-define-property": "^1.0.1",
+				"side-channel": "^1.1.1"
 			},
 			"engines": {
 				"node": ">=0.6"
@@ -11562,7 +11394,6 @@
 			"version": "1.6.1",
 			"resolved": "https://registry.npmjs.org/quadprog/-/quadprog-1.6.1.tgz",
 			"integrity": "sha512-fN5Jkcjlln/b3pJkseDKREf89JkKIyu6cKIVXisgL6ocKPQ0yTp9n6NZUAq3otEPPw78WZMG9K0o9WsfKyMWJw==",
-			"dev": true,
 			"license": "MIT",
 			"engines": {
 				"node": ">=8.x"
@@ -11676,31 +11507,32 @@
 			}
 		},
 		"node_modules/quill": {
-			"version": "1.3.7",
-			"resolved": "https://registry.npmjs.org/quill/-/quill-1.3.7.tgz",
-			"integrity": "sha512-hG/DVzh/TiknWtE6QmWAF/pxoZKYxfe3J/d/+ShUWkDvvkZQVTPeVmUJVu1uE6DDooC4fWTiCLh84ul89oNz5g==",
+			"version": "2.0.3",
+			"resolved": "https://registry.npmjs.org/quill/-/quill-2.0.3.tgz",
+			"integrity": "sha512-xEYQBqfYx/sfb33VJiKnSJp8ehloavImQ2A6564GAbqG55PGw1dAWUn1MUbQB62t0azawUS2CZZhWCjO8gRvTw==",
 			"license": "BSD-3-Clause",
 			"dependencies": {
-				"clone": "^2.1.1",
-				"deep-equal": "^1.0.1",
-				"eventemitter3": "^2.0.3",
-				"extend": "^3.0.2",
-				"parchment": "^1.1.4",
-				"quill-delta": "^3.6.2"
+				"eventemitter3": "^5.0.1",
+				"lodash-es": "^4.17.21",
+				"parchment": "^3.0.0",
+				"quill-delta": "^5.1.0"
+			},
+			"engines": {
+				"npm": ">=8.2.3"
 			}
 		},
 		"node_modules/quill-delta": {
-			"version": "3.6.3",
-			"resolved": "https://registry.npmjs.org/quill-delta/-/quill-delta-3.6.3.tgz",
-			"integrity": "sha512-wdIGBlcX13tCHOXGMVnnTVFtGRLoP0imqxM696fIPwIf5ODIYUHIvHbZcyvGlZFiFhK5XzDC2lpjbxRhnM05Tg==",
+			"version": "5.1.0",
+			"resolved": "https://registry.npmjs.org/quill-delta/-/quill-delta-5.1.0.tgz",
+			"integrity": "sha512-X74oCeRI4/p0ucjb5Ma8adTXd9Scumz367kkMK5V/IatcX6A0vlgLgKbzXWy5nZmCGeNJm2oQX0d2Eqj+ZIlCA==",
 			"license": "MIT",
 			"dependencies": {
-				"deep-equal": "^1.0.1",
-				"extend": "^3.0.2",
-				"fast-diff": "1.1.2"
+				"fast-diff": "^1.3.0",
+				"lodash.clonedeep": "^4.5.0",
+				"lodash.isequal": "^4.5.0"
 			},
 			"engines": {
-				"node": ">=0.10"
+				"node": ">= 12.0.0"
 			}
 		},
 		"node_modules/rbush": {
@@ -11873,26 +11705,6 @@
 				"url": "https://github.com/sponsors/sindresorhus"
 			}
 		},
-		"node_modules/regexp.prototype.flags": {
-			"version": "1.5.4",
-			"resolved": "https://registry.npmjs.org/regexp.prototype.flags/-/regexp.prototype.flags-1.5.4.tgz",
-			"integrity": "sha512-dYqgNSZbDwkaJ2ceRd9ojCGjBq+mOm9LmtXnAnEGyHhN/5R7iDW2TRw3h+o/jCFxus3P2LfWIIiwowAjANm7IA==",
-			"license": "MIT",
-			"dependencies": {
-				"call-bind": "^1.0.8",
-				"define-properties": "^1.2.1",
-				"es-errors": "^1.3.0",
-				"get-proto": "^1.0.1",
-				"gopd": "^1.2.0",
-				"set-function-name": "^2.0.2"
-			},
-			"engines": {
-				"node": ">= 0.4"
-			},
-			"funding": {
-				"url": "https://github.com/sponsors/ljharb"
-			}
-		},
 		"node_modules/rehype-github-alerts": {
 			"version": "3.0.0",
 			"resolved": "https://registry.npmjs.org/rehype-github-alerts/-/rehype-github-alerts-3.0.0.tgz",
@@ -12240,6 +12052,16 @@
 			"integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
 			"license": "MIT"
 		},
+		"node_modules/sax": {
+			"version": "1.6.1",
+			"resolved": "https://registry.npmjs.org/sax/-/sax-1.6.1.tgz",
+			"integrity": "sha512-42tBVwLWnaQvW5zc4HbZrTuWccECCZfBi92FDuwtqxasH+JbPB3/FOKb1m222K42R4WxuxzzMsTswfzgtSu64Q==",
+			"dev": true,
+			"license": "BlueOak-1.0.0",
+			"engines": {
+				"node": ">=11.0.0"
+			}
+		},
 		"node_modules/saxes": {
 			"version": "6.0.0",
 			"resolved": "https://registry.npmjs.org/saxes/-/saxes-6.0.0.tgz",
@@ -12279,38 +12101,6 @@
 			"devOptional": true,
 			"license": "MIT"
 		},
-		"node_modules/set-function-length": {
-			"version": "1.2.2",
-			"resolved": "https://registry.npmjs.org/set-function-length/-/set-function-length-1.2.2.tgz",
-			"integrity": "sha512-pgRc4hJ4/sNjWCSS9AmnS40x3bNMDTknHgL5UaMBTMyJnU90EgWh1Rz+MC9eFu4BuN/UwZjKQuY/1v3rM7HMfg==",
-			"license": "MIT",
-			"dependencies": {
-				"define-data-property": "^1.1.4",
-				"es-errors": "^1.3.0",
-				"function-bind": "^1.1.2",
-				"get-intrinsic": "^1.2.4",
-				"gopd": "^1.0.1",
-				"has-property-descriptors": "^1.0.2"
-			},
-			"engines": {
-				"node": ">= 0.4"
-			}
-		},
-		"node_modules/set-function-name": {
-			"version": "2.0.2",
-			"resolved": "https://registry.npmjs.org/set-function-name/-/set-function-name-2.0.2.tgz",
-			"integrity": "sha512-7PGFlmtwsEADb0WYyvCMa1t+yke6daIG4Wirafur5kcf+MhUnPms1UeR0CKQdTZD81yESwMHbtn+TR+dMviakQ==",
-			"license": "MIT",
-			"dependencies": {
-				"define-data-property": "^1.1.4",
-				"es-errors": "^1.3.0",
-				"functions-have-names": "^1.2.3",
-				"has-property-descriptors": "^1.0.2"
-			},
-			"engines": {
-				"node": ">= 0.4"
-			}
-		},
 		"node_modules/setimmediate": {
 			"version": "1.0.5",
 			"resolved": "https://registry.npmjs.org/setimmediate/-/setimmediate-1.0.5.tgz",
@@ -12341,15 +12131,15 @@
 			}
 		},
 		"node_modules/side-channel": {
-			"version": "1.1.0",
-			"resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz",
-			"integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==",
+			"version": "1.1.1",
+			"resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz",
+			"integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"es-errors": "^1.3.0",
-				"object-inspect": "^1.13.3",
-				"side-channel-list": "^1.0.0",
+				"object-inspect": "^1.13.4",
+				"side-channel-list": "^1.0.1",
 				"side-channel-map": "^1.0.1",
 				"side-channel-weakmap": "^1.0.2"
 			},
@@ -12361,14 +12151,14 @@
 			}
 		},
 		"node_modules/side-channel-list": {
-			"version": "1.0.0",
-			"resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.0.tgz",
-			"integrity": "sha512-FCLHtRD/gnpCiCHEiJLOwdmFP+wzCmDEkc9y7NsYxeF4u7Btsn1ZuwgwJGxImImHicJArLP4R0yX4c2KCrMrTA==",
+			"version": "1.0.1",
+			"resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz",
+			"integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"es-errors": "^1.3.0",
-				"object-inspect": "^1.13.3"
+				"object-inspect": "^1.13.4"
 			},
 			"engines": {
 				"node": ">= 0.4"
@@ -12646,6 +12436,12 @@
 			"dev": true,
 			"license": "MIT"
 		},
+		"node_modules/strictdom": {
+			"version": "1.0.1",
+			"resolved": "https://registry.npmjs.org/strictdom/-/strictdom-1.0.1.tgz",
+			"integrity": "sha512-cEmp9QeXXRmjj/rVp9oyiqcvyocWab/HaoN4+bwFeZ7QzykJD6L3yD4v12K1x0tHpqRqVpJevN3gW7kyM39Bqg==",
+			"license": "MIT"
+		},
 		"node_modules/string_decoder": {
 			"version": "1.3.0",
 			"resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
@@ -12750,7 +12546,6 @@
 			"version": "0.4.4",
 			"resolved": "https://registry.npmjs.org/style-to-object/-/style-to-object-0.4.4.tgz",
 			"integrity": "sha512-HYNoHZa2GorYNyqiCaBgsxvcJIn7OHq6inEga+E6Ke3m5JkoqpQbnFssk4jwe+K7AhGa2fcha4wSOf1Kn01dMg==",
-			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"inline-style-parser": "0.1.1"
@@ -12774,9 +12569,9 @@
 			}
 		},
 		"node_modules/stylehacks/node_modules/postcss-selector-parser": {
-			"version": "6.1.2",
-			"resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.2.tgz",
-			"integrity": "sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==",
+			"version": "6.1.4",
+			"resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz",
+			"integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
@@ -12907,9 +12702,9 @@
 			"peer": true
 		},
 		"node_modules/stylelint/node_modules/postcss-selector-parser": {
-			"version": "6.1.2",
-			"resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.2.tgz",
-			"integrity": "sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==",
+			"version": "6.1.4",
+			"resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz",
+			"integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==",
 			"dev": true,
 			"license": "MIT",
 			"peer": true,
@@ -12969,9 +12764,9 @@
 			"license": "MIT"
 		},
 		"node_modules/sucrase/node_modules/brace-expansion": {
-			"version": "2.0.2",
-			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
-			"integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+			"version": "2.1.7",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz",
+			"integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
@@ -12989,9 +12784,10 @@
 			}
 		},
 		"node_modules/sucrase/node_modules/glob": {
-			"version": "10.4.5",
-			"resolved": "https://registry.npmjs.org/glob/-/glob-10.4.5.tgz",
-			"integrity": "sha512-7Bv8RF0k6xjo7d4A/PxYLbUCfb6c+Vpd2/mB2yRDlew7Jb5hEXiCD9ibfO7wpk8i4sevK6DFny9h7EYbM3/sHg==",
+			"version": "10.5.0",
+			"resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz",
+			"integrity": "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==",
+			"deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
 			"dev": true,
 			"license": "ISC",
 			"dependencies": {
@@ -13010,13 +12806,13 @@
 			}
 		},
 		"node_modules/sucrase/node_modules/minimatch": {
-			"version": "9.0.5",
-			"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
-			"integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
+			"version": "9.0.9",
+			"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
+			"integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
 			"dev": true,
 			"license": "ISC",
 			"dependencies": {
-				"brace-expansion": "^2.0.1"
+				"brace-expansion": "^2.0.2"
 			},
 			"engines": {
 				"node": ">=16 || 14 >=14.17"
@@ -13094,23 +12890,22 @@
 			}
 		},
 		"node_modules/svelte": {
-			"version": "5.53.5",
-			"resolved": "https://registry.npmjs.org/svelte/-/svelte-5.53.5.tgz",
-			"integrity": "sha512-YkqERnF05g8KLdDZwZrF8/i1eSbj6Eoat8Jjr2IfruZz9StLuBqo8sfCSzjosNKd+ZrQ8DkKZDjpO5y3ht1Pow==",
+			"version": "5.57.0",
+			"resolved": "https://registry.npmjs.org/svelte/-/svelte-5.57.0.tgz",
+			"integrity": "sha512-NdbDn7fl4be1ViUG0oq/lvG6OZy3oENolV2ONjiqqsfVoeAfzaQAKUcEX3MrQod/Bebv1PgwET9rfXhgn9s4Kg==",
 			"license": "MIT",
 			"dependencies": {
 				"@jridgewell/remapping": "^2.3.4",
 				"@jridgewell/sourcemap-codec": "^1.5.0",
-				"@sveltejs/acorn-typescript": "^1.0.5",
+				"@sveltejs/acorn-typescript": "^1.0.10",
 				"@types/estree": "^1.0.5",
-				"@types/trusted-types": "^2.0.7",
 				"acorn": "^8.12.1",
 				"aria-query": "5.3.1",
 				"axobject-query": "^4.1.0",
 				"clsx": "^2.1.1",
-				"devalue": "^5.6.3",
+				"devalue": "^5.8.1",
 				"esm-env": "^1.2.1",
-				"esrap": "^2.2.2",
+				"esrap": "^2.2.12",
 				"is-reference": "^3.0.3",
 				"locate-character": "^3.0.0",
 				"magic-string": "^0.30.11",
@@ -13124,7 +12919,6 @@
 			"version": "3.1.4",
 			"resolved": "https://registry.npmjs.org/svelte-awesome-color-picker/-/svelte-awesome-color-picker-3.1.4.tgz",
 			"integrity": "sha512-tiFakxvSpCwodOSFW6CflnLVSldSlDY77rDipHfW7hvB+4gTP3y6uO+Dm9O9e7P5N7K+CNyNjjdjbZOHYkMyNQ==",
-			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"colord": "^2.9.3",
@@ -13138,7 +12932,6 @@
 			"version": "1.1.2",
 			"resolved": "https://registry.npmjs.org/svelte-awesome-slider/-/svelte-awesome-slider-1.1.2.tgz",
 			"integrity": "sha512-HFIWwq6rtX6aXyc6ns2R0P6pDLYIr6nRjTPyAddAiTAgZqsohAoEfOEwKKqMmZ6Q+CH48zzcFdyo6lFkBJvyQw==",
-			"dev": true,
 			"license": "MIT",
 			"peerDependencies": {
 				"svelte": "^3.54.0 || ^4.0.0 || ^5.0.0"
@@ -13311,7 +13104,6 @@
 			"version": "1.6.2",
 			"resolved": "https://registry.npmjs.org/svelte-floating-ui/-/svelte-floating-ui-1.6.2.tgz",
 			"integrity": "sha512-EC+DZtBey50P6l3NSzNQWon3cip8a1bzwdpmCdc45kymqEWL4BKhPemAq7SQ9QLebDPaMECW6YodxFbs2d+O/w==",
-			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"@floating-ui/dom": "^1.6.13"
@@ -13321,7 +13113,6 @@
 			"version": "7.8.4",
 			"resolved": "https://registry.npmjs.org/svelte-highlight/-/svelte-highlight-7.8.4.tgz",
 			"integrity": "sha512-aVp+Q0hH9kI7PlSDrklmFTF4Uj7wYj7UGuqkREnkXlqpEffxr2g6esZcMMaTgECdg5rb2mJqM88+nwS10ecoTg==",
-			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"highlight.js": "11.11.1"
@@ -13337,7 +13128,6 @@
 			"version": "1.3.2",
 			"resolved": "https://registry.npmjs.org/svelte-popperjs/-/svelte-popperjs-1.3.2.tgz",
 			"integrity": "sha512-fwrErlkvngL876WXRnL3OLlfk/n9YkZwwLxuKRpZOYCJLt1zrwhoKTXS+/sRgDveD/zd6GQ35hV89EOip+NBGA==",
-			"dev": true,
 			"license": "MIT",
 			"peerDependencies": {
 				"@popperjs/core": ">=2",
@@ -13404,14 +13194,12 @@
 			"version": "2.3.1",
 			"resolved": "https://registry.npmjs.org/svelte-range-slider-pips/-/svelte-range-slider-pips-2.3.1.tgz",
 			"integrity": "sha512-P29PNqHld+SiaDuHzf98rLvhSYWXb3TVL9p7U5RG9UX8emUgypZgp9zuIIwpmIXysGQC6JG8duMc5FuaPnSVdg==",
-			"dev": true,
 			"license": "MPL-2.0"
 		},
 		"node_modules/svelte-splitpanes": {
 			"version": "8.0.9",
 			"resolved": "https://registry.npmjs.org/svelte-splitpanes/-/svelte-splitpanes-8.0.9.tgz",
 			"integrity": "sha512-L3oLXTC99M191FInTXJ/f/2i0welRql1QuVbPaU8iy6nvCR6X9VyjHCsCpLqKGWHwqkWo/AM9CQ1c0nzlb+MkA==",
-			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"esm-env-robust": "0.0.3"
@@ -13420,6 +13208,38 @@
 				"svelte": "^4.2.19 || ^5.1.0"
 			}
 		},
+		"node_modules/svelte/node_modules/@typescript-eslint/types": {
+			"version": "8.70.0",
+			"resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.70.0.tgz",
+			"integrity": "sha512-asTOIYhDg4zdzOScCyaytrsV3cR6B4ecPQlXw/dJIm7J/MZTtCtfVII9JD8Geh4jTCrK/Xe6cg5UevoleMcoJQ==",
+			"license": "MIT",
+			"optional": true,
+			"peer": true,
+			"engines": {
+				"node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+			},
+			"funding": {
+				"type": "opencollective",
+				"url": "https://opencollective.com/typescript-eslint"
+			}
+		},
+		"node_modules/svelte/node_modules/esrap": {
+			"version": "2.3.7",
+			"resolved": "https://registry.npmjs.org/esrap/-/esrap-2.3.7.tgz",
+			"integrity": "sha512-n2nf7fZR3c9yXf0BPEuHuXqT+KW0SJVj4cN5FMEkpCZ3scLjOQWpiccyCxVzCC2q1wubTghuEGzngJY/7Ah0Ow==",
+			"license": "MIT",
+			"dependencies": {
+				"@jridgewell/sourcemap-codec": "^1.4.15"
+			},
+			"peerDependencies": {
+				"@typescript-eslint/types": "^8.2.0"
+			},
+			"peerDependenciesMeta": {
+				"@typescript-eslint/types": {
+					"optional": true
+				}
+			}
+		},
 		"node_modules/svelte2tsx": {
 			"version": "0.7.49",
 			"resolved": "https://registry.npmjs.org/svelte2tsx/-/svelte2tsx-0.7.49.tgz",
@@ -13443,19 +13263,19 @@
 			"peer": true
 		},
 		"node_modules/svgo": {
-			"version": "3.3.2",
-			"resolved": "https://registry.npmjs.org/svgo/-/svgo-3.3.2.tgz",
-			"integrity": "sha512-OoohrmuUlBs8B8o6MB2Aevn+pRIH9zDALSR+6hhqVfa6fRwG/Qw9VUMSMW9VNg2CFc/MTIfabtdOVl9ODIJjpw==",
+			"version": "3.3.5",
+			"resolved": "https://registry.npmjs.org/svgo/-/svgo-3.3.5.tgz",
+			"integrity": "sha512-8SQMzdrvWaD8deUmrnYB+ASyxBVgWUOilg+A75nE/76WdLpj6LopCwiAVvkzkcqy/9b7t2Mg7faFLjg0ZRcZ3w==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
-				"@trysound/sax": "0.2.0",
 				"commander": "^7.2.0",
 				"css-select": "^5.1.0",
 				"css-tree": "^2.3.1",
 				"css-what": "^6.1.0",
 				"csso": "^5.0.5",
-				"picocolors": "^1.0.0"
+				"picocolors": "^1.0.0",
+				"sax": "^1.5.0"
 			},
 			"bin": {
 				"svgo": "bin/svgo"
@@ -13489,7 +13309,6 @@
 			"version": "6.2.0",
 			"resolved": "https://registry.npmjs.org/tabbable/-/tabbable-6.2.0.tgz",
 			"integrity": "sha512-Cat63mxsVJlzYvN51JmVXIgNoUokrIaT2zLclCXjRd8boZ0004U4KCs/sToJ75C6sdlByWxpYnb5Boif1VSFew==",
-			"dev": true,
 			"license": "MIT"
 		},
 		"node_modules/table": {
@@ -13597,9 +13416,9 @@
 			}
 		},
 		"node_modules/tailwindcss/node_modules/postcss-selector-parser": {
-			"version": "6.1.2",
-			"resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.2.tgz",
-			"integrity": "sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==",
+			"version": "6.1.4",
+			"resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz",
+			"integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
@@ -13624,9 +13443,9 @@
 			}
 		},
 		"node_modules/tar": {
-			"version": "7.5.11",
-			"resolved": "https://registry.npmjs.org/tar/-/tar-7.5.11.tgz",
-			"integrity": "sha512-ChjMH33/KetonMTAtpYdgUFr0tbz69Fp2v7zWxQfYZX4g5ZN2nOBXm1R2xyA+lMIKrLKIoKAwFj93jE/avX9cQ==",
+			"version": "7.5.22",
+			"resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz",
+			"integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==",
 			"dev": true,
 			"license": "BlueOak-1.0.0",
 			"dependencies": {
@@ -13786,9 +13605,9 @@
 			}
 		},
 		"node_modules/tinyrainbow": {
-			"version": "3.1.0",
-			"resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.1.0.tgz",
-			"integrity": "sha512-Bf+ILmBgretUrdJxzXM0SgXLZ3XfiaUuOj/IKQHuTXip+05Xn+uyEYdVg0kYDipTBcLrCVyUzAPz7QmArb0mmw==",
+			"version": "3.1.1",
+			"resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.1.1.tgz",
+			"integrity": "sha512-yau8yJdTt989Mm0Bd/236QnzEiPf2xLLTqUZRUJOo/3CB078LSwzei343DgtJVmfJKJE3TMINY1u42SQsP6mXw==",
 			"dev": true,
 			"license": "MIT",
 			"engines": {
@@ -14021,9 +13840,9 @@
 			}
 		},
 		"node_modules/undici": {
-			"version": "8.1.0",
-			"resolved": "https://registry.npmjs.org/undici/-/undici-8.1.0.tgz",
-			"integrity": "sha512-E9MkTS4xXLnRPYqxH2e6Hr2/49e7WFDKczKcCaFH4VaZs2iNvHMqeIkyUAD9vM8kujy9TjVrRlQ5KkdEJxB2pw==",
+			"version": "8.10.2",
+			"resolved": "https://registry.npmjs.org/undici/-/undici-8.10.2.tgz",
+			"integrity": "sha512-/y4/bH9YNU5hi9NIrpOuvGXFcxrj3CMrV+/AYpowAYTpHn8gX/XPFjNy766FPoYY0miQhdW977JFWKGNhBdwyQ==",
 			"dev": true,
 			"license": "MIT",
 			"engines": {
@@ -14156,9 +13975,9 @@
 			}
 		},
 		"node_modules/update-browserslist-db": {
-			"version": "1.1.3",
-			"resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.1.3.tgz",
-			"integrity": "sha512-UxhIZQ+QInVdunkDAaiazvvT/+fXL5Osr0JZlJulepYu6Jd7qJtDZjlur0emRlT71EN3ScPoE7gvsuIKKNavKw==",
+			"version": "1.3.3",
+			"resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.3.tgz",
+			"integrity": "sha512-pJ2sYawQS0R/WI928Gj5GlPhTGzbMelq0+4INtSYNDV9ErKJcX6xjGWkoG/VnB3dpUm00zALaqkrUD77pO5TDQ==",
 			"dev": true,
 			"funding": [
 				{
@@ -14418,19 +14237,19 @@
 			}
 		},
 		"node_modules/vitest": {
-			"version": "4.1.0",
-			"resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.0.tgz",
-			"integrity": "sha512-YbDrMF9jM2Lqc++2530UourxZHmkKLxrs4+mYhEwqWS97WJ7wOYEkcr+QfRgJ3PW9wz3odRijLZjHEaRLTNbqw==",
+			"version": "4.1.11",
+			"resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.11.tgz",
+			"integrity": "sha512-fhACrNXUidIbGSBr5FlbuBkO7VWC1ZyLl0DO4CU2DrQoAPxX84Ysxs+HeGQpii5lZWV1Q4gBZTTu49mF+A6Edw==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
-				"@vitest/expect": "4.1.0",
-				"@vitest/mocker": "4.1.0",
-				"@vitest/pretty-format": "4.1.0",
-				"@vitest/runner": "4.1.0",
-				"@vitest/snapshot": "4.1.0",
-				"@vitest/spy": "4.1.0",
-				"@vitest/utils": "4.1.0",
+				"@vitest/expect": "4.1.11",
+				"@vitest/mocker": "4.1.11",
+				"@vitest/pretty-format": "4.1.11",
+				"@vitest/runner": "4.1.11",
+				"@vitest/snapshot": "4.1.11",
+				"@vitest/spy": "4.1.11",
+				"@vitest/utils": "4.1.11",
 				"es-module-lexer": "^2.0.0",
 				"expect-type": "^1.3.0",
 				"magic-string": "^0.30.21",
@@ -14441,8 +14260,8 @@
 				"tinybench": "^2.9.0",
 				"tinyexec": "^1.0.2",
 				"tinyglobby": "^0.2.15",
-				"tinyrainbow": "^3.0.3",
-				"vite": "^6.0.0 || ^7.0.0 || ^8.0.0-0",
+				"tinyrainbow": "^3.1.0",
+				"vite": "^6.0.0 || ^7.0.0 || ^8.0.0",
 				"why-is-node-running": "^2.3.0"
 			},
 			"bin": {
@@ -14458,13 +14277,15 @@
 				"@edge-runtime/vm": "*",
 				"@opentelemetry/api": "^1.9.0",
 				"@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0",
-				"@vitest/browser-playwright": "4.1.0",
-				"@vitest/browser-preview": "4.1.0",
-				"@vitest/browser-webdriverio": "4.1.0",
-				"@vitest/ui": "4.1.0",
+				"@vitest/browser-playwright": "4.1.11",
+				"@vitest/browser-preview": "4.1.11",
+				"@vitest/browser-webdriverio": "4.1.11",
+				"@vitest/coverage-istanbul": "4.1.11",
+				"@vitest/coverage-v8": "4.1.11",
+				"@vitest/ui": "4.1.11",
 				"happy-dom": "*",
 				"jsdom": "*",
-				"vite": "^6.0.0 || ^7.0.0 || ^8.0.0-0"
+				"vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
 			},
 			"peerDependenciesMeta": {
 				"@edge-runtime/vm": {
@@ -14485,6 +14306,12 @@
 				"@vitest/browser-webdriverio": {
 					"optional": true
 				},
+				"@vitest/coverage-istanbul": {
+					"optional": true
+				},
+				"@vitest/coverage-v8": {
+					"optional": true
+				},
 				"@vitest/ui": {
 					"optional": true
 				},
@@ -14621,18 +14448,18 @@
 			"license": "MIT"
 		},
 		"node_modules/vscode-languageclient/node_modules/brace-expansion": {
-			"version": "2.0.2",
-			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
-			"integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+			"version": "2.1.7",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz",
+			"integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==",
 			"license": "MIT",
 			"dependencies": {
 				"balanced-match": "^1.0.0"
 			}
 		},
 		"node_modules/vscode-languageclient/node_modules/minimatch": {
-			"version": "5.1.6",
-			"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.6.tgz",
-			"integrity": "sha512-lKwV/1brpG6mBUFHtb7NUmtABCb2WZZmm2wNiOA5hAb8VdCS4B3dtMWyvcoViccwAW/COERjXLt0zP1zXUN26g==",
+			"version": "5.1.9",
+			"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.9.tgz",
+			"integrity": "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==",
 			"license": "ISC",
 			"dependencies": {
 				"brace-expansion": "^2.0.1"
@@ -15158,9 +14985,9 @@
 			}
 		},
 		"node_modules/y-websocket/node_modules/ws": {
-			"version": "6.2.3",
-			"resolved": "https://registry.npmjs.org/ws/-/ws-6.2.3.tgz",
-			"integrity": "sha512-jmTjYU0j60B+vHey6TfR3Z7RD61z/hmxBS3VMSGIrroOWXQEneK1zNuotOUrGyBHQj0yrpsLHPWtigEFd13ndA==",
+			"version": "6.2.6",
+			"resolved": "https://registry.npmjs.org/ws/-/ws-6.2.6.tgz",
+			"integrity": "sha512-XTrf1gv7kXoVf1hbC3PAyAiPgR8Wz1blcrYIjEsUmr08BLksT41R8KbjmS9408C2ERx7v1JDLD/BkpLEttjfKA==",
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -15188,15 +15015,18 @@
 			}
 		},
 		"node_modules/yaml": {
-			"version": "2.8.1",
-			"resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.1.tgz",
-			"integrity": "sha512-lcYcMxX2PO9XMGvAJkJ3OsNMw+/7FKes7/hgerGUYWIoWu5j/+YQqcZr5JnPZWzOsEBgMbSbiSTn/dv/69Mkpw==",
+			"version": "2.9.1",
+			"resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.1.tgz",
+			"integrity": "sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==",
 			"license": "ISC",
 			"bin": {
 				"yaml": "bin.mjs"
 			},
 			"engines": {
 				"node": ">= 14.6"
+			},
+			"funding": {
+				"url": "https://github.com/sponsors/eemeli"
 			}
 		},
 		"node_modules/yargs": {
diff --git a/frontend/package.json b/frontend/package.json
index eedca8f2c8..46db11793f 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.814.0",
+	"version": "1.817.0",
 	"scripts": {
 		"dev": "vite dev",
 		"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
@@ -22,28 +22,23 @@
 		"test:e2e": "playwright test"
 	},
 	"devDependencies": {
-		"@floating-ui/core": "^1.3.1",
 		"@hey-api/openapi-ts": "^0.43.0",
 		"@melt-ui/pp": "^0.3.2",
-		"@melt-ui/svelte": "^0.86.2",
 		"@playwright/test": "^1.57.0",
 		"@sveltejs/adapter-static": "^3.0.6",
-		"@sveltejs/kit": "^2.53.4",
+		"@sveltejs/kit": "^2.69.1",
 		"@sveltejs/package": "^2.5.7",
 		"@sveltejs/vite-plugin-svelte": "^7.0.0",
 		"@tailwindcss/forms": "^0.5.3",
 		"@tailwindcss/typography": "^0.5.8",
 		"@types/d3": "^7.4.0",
 		"@types/d3-zoom": "^3.0.3",
-		"@types/diff": "^7.0.1",
 		"@types/lodash": "^4.14.195",
 		"@types/vscode": "^1.83.5",
 		"@typescript-eslint/eslint-plugin": "^5.59.8",
 		"@typescript-eslint/parser": "^5.60.0",
-		"@zerodevx/svelte-toast": "^0.9.6",
 		"autoprefixer": "^10.4.13",
 		"cssnano": "^6.0.1",
-		"d3-dag": "^0.11.5",
 		"dts-bundle-generator": "^9.5.1",
 		"eslint": "^8.47.0",
 		"eslint-config-prettier": "^8.6.0",
@@ -57,32 +52,27 @@
 		"postcss-load-config": "^4.0.1",
 		"prettier": "^3.1.0",
 		"prettier-plugin-svelte": "^3.3.3",
-		"style-to-object": "^0.4.1",
 		"stylelint-config-recommended": "^13.0.0",
-		"svelte": "^5.53.5",
-		"svelte-awesome-color-picker": "^3.0.4",
 		"svelte-check": "^4.4.3",
 		"svelte-fast-check": "^0.4.5",
-		"svelte-floating-ui": "^1.5.8",
-		"svelte-highlight": "^7.6.0",
-		"svelte-popperjs": "^1.3.2",
 		"svelte-preprocess": "^6.0.0",
-		"svelte-range-slider-pips": "^2.3.1",
-		"svelte-splitpanes": "^8.0.9",
 		"tailwindcss": "^3.4.1",
-		"tar": "^7.5.4",
+		"tar": "^7.5.18",
 		"tslib": "^2.6.1",
 		"typescript": "^5.5.0",
 		"vite": "^8.2.0",
 		"vite-plugin-mkcert": "^2.0.0",
-		"vitest": "^4.1.0",
+		"vitest": "^4.1.11",
 		"vitest-browser-svelte": "^2.0.1"
 	},
 	"overrides": {
 		"monaco-graphql": {
 			"monaco-editor": "$monaco-editor"
 		},
-		"tar": "$tar"
+		"tar": "$tar",
+		"dompurify": "$dompurify",
+		"cookie": "^0.7.0",
+		"handlebars": "^4.7.9"
 	},
 	"type": "module",
 	"dependencies": {
@@ -95,8 +85,10 @@
 		"@codingame/monaco-vscode-standalone-json-language-features": "=25.0.0",
 		"@codingame/monaco-vscode-standalone-languages": "=25.0.0",
 		"@codingame/monaco-vscode-standalone-typescript-language-features": "=25.0.0",
+		"@floating-ui/core": "^1.3.1",
 		"@json2csv/plainjs": "^7.0.6",
 		"@leeoniya/ufuzzy": "^1.0.8",
+		"@melt-ui/svelte": "^0.86.2",
 		"@popperjs/core": "^2.11.8",
 		"@redocly/json-to-json-schema": "^0.0.1",
 		"@scalar/openapi-parser": "^0.15.0",
@@ -105,6 +97,7 @@
 		"@windmill-labs/svelte-dnd-action": "^0.9.44",
 		"@xterm/addon-fit": "^0.10.0",
 		"@xyflow/svelte": "^1.0.0",
+		"@zerodevx/svelte-toast": "^0.9.6",
 		"acorn": "^8.15.0",
 		"ag-charts-community": "^9.0.1",
 		"ag-charts-enterprise": "^9.0.1",
@@ -115,10 +108,11 @@
 		"chartjs-adapter-date-fns": "^3.0.0",
 		"chartjs-plugin-zoom": "^2.0.0",
 		"clone": "^2.1.2",
+		"d3-dag": "^0.11.5",
 		"d3-zoom": "^3.0.0",
 		"date-fns": "^2.30.0",
-		"diff": "^7.0.0",
-		"dompurify": "^3.3.1",
+		"diff": "^8.0.3",
+		"dompurify": "^3.4.13",
 		"driver.js": "^1.3.0",
 		"esm-env": "^1.0.0",
 		"fast-equals": "^5.0.1",
@@ -130,8 +124,8 @@
 		"lru-cache": "^11.1.0",
 		"lucide-svelte": "^0.540.0",
 		"mdast-util-find-and-replace": "^3.0.2",
-		"mermaid": "^11.15.0",
-		"minimatch": "^10.0.1",
+		"mermaid": "^11.16.1",
+		"minimatch": "^10.2.3",
 		"modern-screenshot": "^4.7.0",
 		"monaco-editor": "npm:@codingame/monaco-vscode-editor-api@=25.0.0",
 		"monaco-languageclient": "10.6.0",
@@ -143,15 +137,23 @@
 		"panzoom": "^9.4.3",
 		"pdfjs-dist": "4.8.69",
 		"quicktype-core": "^23.2.6",
-		"quill": "^1.3.7",
+		"quill": "^2.0.3",
 		"rehype-github-alerts": "^3.0.0",
 		"rehype-raw": "^7.0.0",
 		"rehype-sanitize": "^6.0.0",
 		"rfc4648": "^1.5.3",
 		"runed": "^0.36.0",
+		"style-to-object": "^0.4.1",
+		"svelte": "^5.55.7",
+		"svelte-awesome-color-picker": "^3.0.4",
 		"svelte-carousel": "^1.0.25",
 		"svelte-exmarkdown": "^5.0.0",
+		"svelte-floating-ui": "^1.5.8",
+		"svelte-highlight": "^7.6.0",
 		"svelte-infinite-loading": "^1.4.0",
+		"svelte-popperjs": "^1.3.2",
+		"svelte-range-slider-pips": "^2.3.1",
+		"svelte-splitpanes": "^8.0.9",
 		"tailwind-merge": "^1.13.2",
 		"unist-util-visit": "^5.0.0",
 		"vscode": "npm:@codingame/monaco-vscode-extension-api@=25.0.0",
@@ -178,7 +180,7 @@
 		"xterm-readline": "^1.1.2",
 		"y-monaco": "^0.1.4",
 		"y-websocket": "^1.5.4",
-		"yaml": "^2.8.0",
+		"yaml": "^2.8.3",
 		"yjs": "^13.6.7",
 		"zod": "^4.1.10"
 	},
diff --git a/frontend/scripts/ui_builder_artifact.json b/frontend/scripts/ui_builder_artifact.json
index 87ce066c87..68c1c558b1 100644
--- a/frontend/scripts/ui_builder_artifact.json
+++ b/frontend/scripts/ui_builder_artifact.json
@@ -1,5 +1,5 @@
 {
 	"baseUrl": "https://pub-06154ed168a24e73a86ab84db6bf15d8.r2.dev",
-	"version": "1522e43",
-	"sha256": "0c44db3a52e02e6530860d0e9e9031fcdad7a09a98897b6c97e6f522c1d4754c"
+	"version": "60b6904",
+	"sha256": "85b68e8418c97d96f3a419b3e345ef8a1987976943b8439a7df841f9217a9b34"
 }
diff --git a/frontend/src/lib/accentColor.test.ts b/frontend/src/lib/accentColor.test.ts
new file mode 100644
index 0000000000..6d3b855240
--- /dev/null
+++ b/frontend/src/lib/accentColor.test.ts
@@ -0,0 +1,25 @@
+import { describe, it, expect } from 'vitest'
+import { accentStylesheet } from './accentColor'
+
+describe('accentStylesheet', () => {
+	it('refuses anything but #rrggbb, since the value lands in a stylesheet', () => {
+		for (const bad of ['#000;}body{display:none', '#fff', 'red', '1f9d55', 123, null]) {
+			expect(accentStylesheet(bad)).toBeUndefined()
+		}
+	})
+
+	it('overrides every accent token with an in-range r g b triplet in each theme', () => {
+		// A saturated color exercises the gamut clamp, a grey the zero-chroma path.
+		for (const color of ['#ff0000', '#808080']) {
+			const rules = accentStylesheet(color)!.split('\n')
+			expect(rules).toHaveLength(3)
+			for (const rule of rules) {
+				const triplets = [...rule.matchAll(/--color-[a-z-]+: (\d+) (\d+) (\d+);/g)]
+				expect(triplets).toHaveLength(10)
+				for (const [, ...channels] of triplets) {
+					for (const c of channels) expect(Number(c)).toBeLessThanOrEqual(255)
+				}
+			}
+		}
+	})
+})
diff --git a/frontend/src/lib/accentColor.ts b/frontend/src/lib/accentColor.ts
new file mode 100644
index 0000000000..f11a96bb79
--- /dev/null
+++ b/frontend/src/lib/accentColor.ts
@@ -0,0 +1,138 @@
+import tokensFile from './assets/tokens/tokens.json'
+import githubDarkTokens from './assets/tokens/githubDark.json'
+import { darkModeName, lightModeName } from './assets/tokens/colorTokensConfig'
+
+/** Instance-wide accent color, `#rrggbb` (mirrors `ACCENT_COLOR_SETTING` in the backend). */
+export const ACCENT_COLOR_SETTING = 'accent_color'
+
+const ACCENT_TOKENS = [
+	'surface-accent-primary',
+	'surface-accent-hover',
+	'surface-accent-clicked',
+	'surface-accent-selected',
+	'surface-accent-secondary',
+	'surface-accent-secondary-hover',
+	'surface-accent-secondary-clicked',
+	'text-accent',
+	'border-accent',
+	'border-selected'
+] as const
+
+const STYLE_ID = 'wm-accent-color'
+const ACCENT_ATTR = 'data-wm-accent'
+
+/**
+ * The stored setting as a color, or `undefined` for "use the default theme".
+ *
+ * The backend already rejects anything but `#rrggbb`, but the value is interpolated into a
+ * stylesheet, so this is the last place that can refuse a row written around the validator.
+ */
+export function parseAccentColor(value: unknown): string | undefined {
+	return typeof value === 'string' && /^#[0-9a-fA-F]{6}$/.test(value)
+		? value.toLowerCase()
+		: undefined
+}
+
+type Oklch = [l: number, c: number, h: number]
+
+function srgbToLinear(v: number): number {
+	return v <= 0.04045 ? v / 12.92 : Math.pow((v + 0.055) / 1.055, 2.4)
+}
+
+function linearToSrgb(v: number): number {
+	return v <= 0.0031308 ? v * 12.92 : 1.055 * Math.pow(v, 1 / 2.4) - 0.055
+}
+
+function hexToOklch(hex: string): Oklch {
+	const [r, g, b] = [1, 3, 5].map((i) => srgbToLinear(parseInt(hex.slice(i, i + 2), 16) / 255))
+	const l = Math.cbrt(0.4122214708 * r + 0.5363325363 * g + 0.0514459929 * b)
+	const m = Math.cbrt(0.2119034982 * r + 0.6806995451 * g + 0.1073969566 * b)
+	const s = Math.cbrt(0.0883024619 * r + 0.2817188376 * g + 0.6299787005 * b)
+	const L = 0.2104542553 * l + 0.793617785 * m - 0.0040720468 * s
+	const A = 1.9779984951 * l - 2.428592205 * m + 0.4505937099 * s
+	const B = 0.0259040371 * l + 0.7827717662 * m - 0.808675766 * s
+	return [L, Math.hypot(A, B), Math.atan2(B, A)]
+}
+
+/** Linear sRGB channels, possibly out of [0, 1] when the color is outside the gamut. */
+function oklchToLinearRgb([L, C, h]: Oklch): [number, number, number] {
+	const A = C * Math.cos(h)
+	const B = C * Math.sin(h)
+	const l = (L + 0.3963377774 * A + 0.2158037573 * B) ** 3
+	const m = (L - 0.1055613458 * A - 0.0638541728 * B) ** 3
+	const s = (L - 0.0894841775 * A - 1.291485548 * B) ** 3
+	return [
+		4.0767416621 * l - 3.3077115913 * m + 0.2309699292 * s,
+		-1.2684380046 * l + 2.6097574011 * m - 0.3413193965 * s,
+		-0.0041960863 * l - 0.7034186147 * m + 1.707614701 * s
+	]
+}
+
+/** `r g b` triplet (the format the `--color-*` variables use), chroma reduced into gamut. */
+function oklchToRgbTriplet([L, C, h]: Oklch): string {
+	const inGamut = (c: number) =>
+		oklchToLinearRgb([L, c, h]).every((v) => v >= -1e-4 && v <= 1 + 1e-4)
+	let lo = 0
+	let hi = C
+	if (!inGamut(C)) {
+		for (let i = 0; i < 20; i++) {
+			const mid = (lo + hi) / 2
+			if (inGamut(mid)) lo = mid
+			else hi = mid
+		}
+	} else lo = C
+	return oklchToLinearRgb([L, lo, h])
+		.map((v) => Math.round(Math.min(1, Math.max(0, linearToSrgb(v))) * 255))
+		.join(' ')
+}
+
+// Below this chroma the chosen color reads as grey, and the accents fade with it.
+const FULL_CHROMA = 0.1
+
+/**
+ * Move each accent token to the chosen hue while keeping its own lightness, so every
+ * text/background pairing keeps the contrast the default palette was designed with.
+ * Taking the chosen color verbatim would put white text on a pale yellow button.
+ */
+function recolor(tokens: Record<string, string>, accent: Oklch): string {
+	const chromaScale = Math.min(1, accent[1] / FULL_CHROMA)
+	return ACCENT_TOKENS.map((name) => {
+		const [l, c] = hexToOklch(tokens[name])
+		return `--color-${name}: ${oklchToRgbTriplet([l, c * chromaScale, accent[2]])};`
+	}).join('')
+}
+
+/** The accent overrides for every theme, or `undefined` when `value` is not `#rrggbb`. */
+export function accentStylesheet(value: unknown): string | undefined {
+	const color = parseAccentColor(value)
+	if (color == undefined) return undefined
+	const accent = hexToOklch(color)
+	// `:root[attr]` outranks the `html`, `html.dark` and `html.dark.github-dark` rules
+	// that define the default tokens, whatever order the stylesheets load in.
+	return [
+		`:root[${ACCENT_ATTR}]{${recolor(tokensFile.tokens[lightModeName], accent)}` +
+			`--sidebar-bg-light:color-mix(in oklab, ${color} 18%, var(--sidebar-bg-light-base));}`,
+		`:root[${ACCENT_ATTR}].dark{${recolor(tokensFile.tokens[darkModeName], accent)}` +
+			`--sidebar-bg-dark:color-mix(in oklab, ${color} 22%, var(--sidebar-bg-dark-base));}`,
+		`:root[${ACCENT_ATTR}].dark.github-dark{${recolor(githubDarkTokens, accent)}}`
+	].join('\n')
+}
+
+/** Apply the instance accent to the whole document, or restore the default with `undefined`. */
+export function applyAccentColor(value: string | undefined): void {
+	const root = document.documentElement
+	let style = document.getElementById(STYLE_ID)
+	const css = accentStylesheet(value)
+	if (css == undefined) {
+		style?.remove()
+		root.removeAttribute(ACCENT_ATTR)
+		return
+	}
+	if (!style) {
+		style = document.createElement('style')
+		style.id = STYLE_ID
+		document.head.appendChild(style)
+	}
+	style.textContent = css
+	root.setAttribute(ACCENT_ATTR, '')
+}
diff --git a/frontend/src/lib/aiStore.ts b/frontend/src/lib/aiStore.ts
index 6ac98d69e8..ff02157e4a 100644
--- a/frontend/src/lib/aiStore.ts
+++ b/frontend/src/lib/aiStore.ts
@@ -51,6 +51,8 @@ export const copilotInfo = writable<{
 	aiModels: AIProviderModel[]
 	customPrompts?: Record<string, string>
 	maxTokensPerModel?: Record<string, number>
+	/** Context windows per `provider:model`, overriding the built-in window table. */
+	contextWindowPerModel?: Record<string, number>
 	/** Negotiated rates per `provider:model`, overriding the built-in price table. */
 	modelPricing?: Record<string, ModelPriceOverride>
 	webSearchEnabledProviders?: Partial<Record<AIProvider, boolean>>
@@ -67,6 +69,7 @@ export const copilotInfo = writable<{
 	aiModels: [],
 	customPrompts: {},
 	maxTokensPerModel: {},
+	contextWindowPerModel: {},
 	modelPricing: {},
 	webSearchEnabledProviders: {}
 })
@@ -144,6 +147,7 @@ export function setCopilotInfo(aiConfig: AIConfig) {
 			aiModels: aiModels,
 			customPrompts: aiConfig.custom_prompts ?? {},
 			maxTokensPerModel: aiConfig.max_tokens_per_model ?? {},
+			contextWindowPerModel: aiConfig.context_window_per_model ?? {},
 			webSearchEnabledProviders,
 			modelPricing: aiConfig.model_pricing ?? {},
 			freeTier: aiConfig.free_tier
@@ -160,6 +164,7 @@ export function setCopilotInfo(aiConfig: AIConfig) {
 			aiModels: [],
 			customPrompts: {},
 			maxTokensPerModel: {},
+			contextWindowPerModel: {},
 			webSearchEnabledProviders: {},
 			modelPricing: {},
 			// An exhausted free grant lands here — no providers, but the reason AI is off
diff --git a/frontend/src/lib/assets/app.css b/frontend/src/lib/assets/app.css
index f6dc648234..4217c95831 100644
--- a/frontend/src/lib/assets/app.css
+++ b/frontend/src/lib/assets/app.css
@@ -3,7 +3,10 @@
 @tailwind components;
 @tailwind utilities;
 
-@media (min-width: 1760px) {
+/* Keyed on the screen, not the window: a viewport query rescales the whole app
+   whenever the window is resized or split. Mirrored in editorFontSize.svelte.ts,
+   TextInput.svelte's leading classes and FlowGraphPreviewButton.svelte. */
+@media (min-device-width: 1760px) {
 	:root {
 		font-size: 18px;
 	}
diff --git a/frontend/src/lib/components/AIAgentLogViewer.svelte b/frontend/src/lib/components/AIAgentLogViewer.svelte
deleted file mode 100644
index 2549fbb29f..0000000000
--- a/frontend/src/lib/components/AIAgentLogViewer.svelte
+++ /dev/null
@@ -1,281 +0,0 @@
-<script lang="ts">
-	import type { GraphModuleState } from './graph'
-	import {
-		JobService,
-		type CompletedJob,
-		type FlowModule,
-		type FlowStatusModule,
-		type Job
-	} from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
-	import FlowLogViewerWrapper from './FlowLogViewerWrapper.svelte'
-	import { z } from 'zod'
-	import { untrack } from 'svelte'
-	import type { AgentTool } from './flows/agentToolUtils'
-
-	type AgentActionWithContent = NonNullable<FlowStatusModule['agent_actions']>[number] & {
-		content?: unknown
-	}
-
-	const resultSchema = z.object({
-		messages: z.array(
-			z.object({
-				role: z.string(),
-				content: z.unknown(),
-				agent_action: z
-					.union([
-						z.object({
-							type: z.literal('tool_call'),
-							job_id: z.string(),
-							module_id: z.string(),
-							function_name: z.string()
-						}),
-						z.object({
-							type: z.literal('mcp_tool_call'),
-							call_id: z.string(),
-							function_name: z.string(),
-							resource_path: z.string(),
-							arguments: z.record(z.any(), z.any()).optional()
-						}),
-						z.object({
-							type: z.literal('message')
-						}),
-						z.object({
-							type: z.literal('web_search')
-						})
-					])
-					.optional()
-			})
-		)
-	})
-
-	interface Props {
-		tools: AgentTool[]
-		agentJob: Partial<CompletedJob> & Pick<CompletedJob, 'id'> & { type: 'CompletedJob' }
-		workspaceId?: string | undefined
-		storedToolCallJobs?: Record<number, Job>
-		onToolJobLoaded?: (job: Job, idx: number) => void
-		noPadding?: boolean
-	}
-
-	let {
-		tools,
-		agentJob,
-		workspaceId,
-		onToolJobLoaded,
-		storedToolCallJobs,
-		noPadding = false
-	}: Props = $props()
-
-	const fakeModuleStates: Record<string, GraphModuleState> = $state({})
-
-	async function loadMissingJobs(
-		agentActions: AgentActionWithContent[],
-		gen: number
-	): Promise<Record<string, GraphModuleState>> {
-		const states: Record<string, GraphModuleState> = {}
-		const promises = agentActions.map(async (toolCall, idx) => {
-			if (toolCall.type === 'tool_call') {
-				let job: Job | undefined = storedToolCallJobs?.[idx]
-
-				if (!job || job.type !== 'CompletedJob') {
-					job = await JobService.getJob({
-						id: toolCall.job_id,
-						workspace: workspaceId ?? $workspaceStore!
-					})
-				}
-				states[idx.toString()] = {
-					args: job.args,
-					type: job['success'] ? 'Success' : 'Failure',
-					logs: job.logs,
-					result: job['result'],
-					job_id: toolCall.job_id
-				}
-				// Keyed by index in the parent's cache, so a superseded run must not write into it.
-				if (gen === loadGen) {
-					onToolJobLoaded?.(job, idx)
-				}
-			} else if (toolCall.type === 'mcp_tool_call') {
-				states[idx.toString()] = {
-					type: 'Success',
-					args: toolCall.arguments ?? {},
-					logs: '',
-					result: toolCall.content
-				}
-			} else if (toolCall.type === 'web_search') {
-				states[idx.toString()] = {
-					type: 'Success',
-					args: {},
-					logs: '',
-					result: toolCall.content
-				}
-			} else {
-				states[idx.toString()] = {
-					type: 'Success',
-					args: {},
-					logs: '',
-					result: toolCall.content
-				}
-			}
-		})
-
-		await Promise.all(promises)
-		return states
-	}
-
-	let job: Partial<Job> | undefined = $state(undefined)
-	// Every prop change starts another load; only the newest may write the shared view, else a
-	// slower reload for a previous run restores its logs over the one now selected.
-	let loadGen = 0
-	async function loadToolCalls(agentJob: Props['agentJob'], tools: AgentTool[]) {
-		const gen = ++loadGen
-		let parsedResult = resultSchema.safeParse(agentJob.result)
-		if (!parsedResult.success) {
-			console.error('Invalid result', parsedResult.error)
-			// A failed agent job has no parseable action list. Drop the view rather than leave the
-			// previously selected step's tool tree rendered under this one's header.
-			if (gen === loadGen) {
-				job = undefined
-				for (const key of Object.keys(fakeModuleStates)) {
-					delete fakeModuleStates[key]
-				}
-			}
-			return
-		}
-		let agentActions = parsedResult.data.messages
-			.map(
-				(m) =>
-					(m.agent_action?.type === 'message'
-						? {
-								type: 'message',
-								content: m.content
-							}
-						: m.agent_action?.type === 'tool_call'
-							? {
-									type: 'tool_call',
-									job_id: m.agent_action.job_id,
-									module_id: m.agent_action.module_id,
-									function_name: m.agent_action.function_name
-								}
-							: m.agent_action?.type === 'mcp_tool_call'
-								? {
-										type: 'mcp_tool_call',
-										content: m.content,
-										call_id: m.agent_action.call_id,
-										function_name: m.agent_action.function_name,
-										arguments: m.agent_action.arguments
-									}
-								: m.agent_action?.type === 'web_search'
-									? {
-											type: 'web_search',
-											content: m.content
-										}
-									: undefined) as AgentActionWithContent | undefined
-			)
-			.filter((m) => m !== undefined)
-
-		const states = await loadMissingJobs(agentActions, gen)
-		if (gen !== loadGen) {
-			return
-		}
-		for (const key of Object.keys(fakeModuleStates)) {
-			delete fakeModuleStates[key]
-		}
-		Object.assign(fakeModuleStates, states)
-
-		job = {
-			...agentJob,
-			raw_flow: {
-				modules: agentActions
-					.map((toolCall, idx) => {
-						if (toolCall.type === 'message') {
-							return {
-								id: idx.toString(),
-								value: {
-									type: 'identity' as const
-								}
-							}
-						} else if (toolCall.type === 'mcp_tool_call') {
-							return {
-								id: idx.toString(),
-								value: {
-									type: 'identity' as const
-								},
-								summary: toolCall.function_name,
-								arguments: toolCall.arguments
-							}
-						} else if (toolCall.type === 'web_search') {
-							return {
-								id: idx.toString(),
-								value: {
-									type: 'identity' as const
-								},
-								summary: 'Web Search'
-							}
-						} else {
-							const module = tools.find((m) => m.summary === toolCall.function_name)
-							// A definition can be missing for a call that did run: the tool was renamed or
-							// removed since, or it belongs to a linked agent whose resource is no longer
-							// readable. Keep the recorded call — its args, logs and result come from the
-							// child job — rather than dropping it from the history.
-							return module
-								? ({
-										...module,
-										id: idx.toString()
-									} as FlowModule)
-								: ({
-										id: idx.toString(),
-										value: { type: 'identity' as const },
-										summary: toolCall.function_name
-									} as FlowModule)
-						}
-					})
-			}
-		}
-	}
-
-	// Identity, not a summary digest: a refreshed resource can change a tool's path, code or id while
-	// keeping its name and count. The store swaps the array only when its contents actually differ,
-	// so one version per array instance tracks that exactly. An empty list is always the same key,
-	// since callers hand out a fresh [] for it on every render.
-	const toolsVersions = new WeakMap<object, number>()
-	let nextToolsVersion = 0
-	function toolsIdentity(list: AgentTool[]): string {
-		if (list.length === 0) {
-			return 'empty'
-		}
-		let version = toolsVersions.get(list)
-		if (version === undefined) {
-			version = ++nextToolsVersion
-			toolsVersions.set(list, version)
-		}
-		return String(version)
-	}
-
-	// Rebuild when the inputs change, not only on mount: a linked agent's tools resolve
-	// asynchronously after the first render, and switching between completed runs reuses this
-	// component — either would otherwise keep the first snapshot. Keyed by value, because callers
-	// rebuild the `agentJob` object on every render and identity alone would reload in a loop.
-	let reloadKey = $derived(`${agentJob?.id ?? ''}|${toolsIdentity(tools)}`)
-	$effect(() => {
-		reloadKey
-		untrack(() => {
-			if (agentJob) {
-				loadToolCalls(agentJob, tools)
-			}
-		})
-	})
-</script>
-
-{#if job}
-	<div class={noPadding ? '' : 'p-2'}>
-		<FlowLogViewerWrapper
-			{job}
-			localModuleStates={fakeModuleStates}
-			{workspaceId}
-			render={true}
-			onSelectedIteration={async () => {}}
-			mode="aiagent"
-		/>
-	</div>
-{/if}
diff --git a/frontend/src/lib/components/AIProviderPicker.svelte b/frontend/src/lib/components/AIProviderPicker.svelte
index 19b1346b84..f69bb6e8f4 100644
--- a/frontend/src/lib/components/AIProviderPicker.svelte
+++ b/frontend/src/lib/components/AIProviderPicker.svelte
@@ -3,11 +3,13 @@
 	import Select from './select/Select.svelte'
 	import { fetchAvailableModels, AI_PROVIDERS } from './copilot/lib'
 	import type { AIProvider, ProviderConfig } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import ResourcePicker from './ResourcePicker.svelte'
 	import Toggle from './Toggle.svelte'
 	import { saveConfig, removeConfig, isSameAsStoredConfig } from './aiProviderStorage'
 	import AIReasoningEffortPicker from './AIReasoningEffortPicker.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		value: ProviderConfig | undefined
@@ -26,7 +28,7 @@
 		workspace = undefined
 	}: Props = $props()
 
-	let effectiveWorkspace = $derived(workspace ?? $workspaceStore ?? '')
+	let effectiveWorkspace = $derived(workspace ?? $operatingWorkspace ?? '')
 
 	let value = $derived.by(() => {
 		if (!_uncheckedValue || typeof _uncheckedValue !== 'object') return undefined
diff --git a/frontend/src/lib/components/AgentResultDisplay.svelte b/frontend/src/lib/components/AgentResultDisplay.svelte
new file mode 100644
index 0000000000..ad84cc263b
--- /dev/null
+++ b/frontend/src/lib/components/AgentResultDisplay.svelte
@@ -0,0 +1,109 @@
+<script lang="ts">
+	import type { Snippet } from 'svelte'
+	import { Badge } from '$lib/components/common'
+	import GfmMarkdown from './GfmMarkdown.svelte'
+	import AgentTrace from './AgentTrace.svelte'
+	import ChatCollapsibleCard from './copilot/chat/ChatCollapsibleCard.svelte'
+	import LabeledDivider from './LabeledDivider.svelte'
+	import { buildAgentTrace, splitFinalAnswer } from './agentTrace'
+	import { runPane } from './agentScroll'
+	import { createBottomSticker } from './stickToBottom'
+	import { formatTokenCount, summarizeAgentResult, type AgentResult } from './aiAgentResult'
+
+	interface Props {
+		result: AgentResult
+		workspaceId?: string
+		/** Identifies the run, so a reused viewer lands on the new one's output. */
+		runKey?: string
+		/**
+		 * How to render an output that is not text: whatever the result viewer would do
+		 * with that object on its own, a table for rows or the file viewer for an S3
+		 * object. Passed in rather than imported so this does not reach back into the
+		 * viewer rendering it.
+		 */
+		structuredOutput: Snippet<[unknown]>
+	}
+
+	let { result, workspaceId, runKey, structuredOutput }: Props = $props()
+
+	let summary = $derived(summarizeAgentResult(result))
+	let textOutput = $derived(typeof result.output === 'string' ? result.output : undefined)
+
+	// The turn that produced `output` is not a trace row: the output block below is
+	// that same text, and printing it twice in one scroll reads as the agent having
+	// answered itself. Its citations stay in the trace, on the search that found them.
+	let trace = $derived(splitFinalAnswer(buildAgentTrace(result.messages), result.output))
+	let reasoning = $derived(result.reasoning?.trim())
+	let reasoningExpanded = $state(false)
+
+	let anchor: HTMLElement | undefined = $state()
+	const sticker = createBottomSticker()
+	$effect(() => {
+		// Also on arrival from a stream: the run finishing adds the output separator,
+		// so the end has moved from wherever the stream had the reader parked.
+		runKey
+		trace.length
+		reasoning
+		sticker.scrollToEnd(runPane(anchor))
+	})
+</script>
+
+<div bind:this={anchor} class="flex flex-col w-full py-3">
+	{#if trace.length > 0}
+		<AgentTrace entries={trace} {workspaceId} />
+	{/if}
+	{#if reasoning}
+		<!-- The whole run's thinking, which the worker hands back joined rather than
+		     per iteration, so it reads as one block above the answer it led to. -->
+		<ChatCollapsibleCard
+			label="Thinking"
+			expanded={reasoningExpanded}
+			onToggle={() => (reasoningExpanded = !reasoningExpanded)}
+			contentClass="font-main"
+		>
+			<GfmMarkdown md={reasoning} prose="xs" noPadding />
+		</ChatCollapsibleCard>
+	{/if}
+	{#if trace.length > 0 || reasoning}
+		<LabeledDivider class="my-3">
+			<span class="text-2xs text-hint">Output</span>
+		</LabeledDivider>
+	{/if}
+	<div>
+		{#if textOutput !== undefined}
+			{#if textOutput === ''}
+				<span class="text-tertiary text-xs">The agent returned no answer</span>
+			{:else}
+				<!-- A model writes this, and what it writes is steerable by whatever
+					     reached its context — a user message, a tool's output. So it is
+					     untrusted input and goes through the shared sanitizing chain, which
+					     is also what makes it inert on the public replay page. -->
+				<GfmMarkdown md={textOutput} noPadding />
+			{/if}
+		{:else}
+			{@render structuredOutput(result.output)}
+		{/if}
+	</div>
+
+	<!-- What the run cost, as a footnote to what it produced. -->
+	<div class="flex items-center gap-2 flex-wrap text-xs mt-3">
+		{#if summary.toolCalls > 0}
+			<Badge color="blue">
+				{summary.toolCalls}
+				{summary.toolCalls === 1 ? 'tool call' : 'tool calls'}
+			</Badge>
+		{/if}
+		{#if summary.webSearches > 0}
+			<Badge color="blue">
+				{summary.webSearches}
+				{summary.webSearches === 1 ? 'web search' : 'web searches'}
+			</Badge>
+		{/if}
+		{#if summary.tokens !== undefined}
+			<Badge color="gray">{formatTokenCount(summary.tokens)} tokens</Badge>
+		{/if}
+		{#if summary.cachedTokens}
+			<Badge color="gray">{formatTokenCount(summary.cachedTokens)} cached</Badge>
+		{/if}
+	</div>
+</div>
diff --git a/frontend/src/lib/components/AgentStreamDisplay.svelte b/frontend/src/lib/components/AgentStreamDisplay.svelte
new file mode 100644
index 0000000000..cf1646a614
--- /dev/null
+++ b/frontend/src/lib/components/AgentStreamDisplay.svelte
@@ -0,0 +1,111 @@
+<script lang="ts">
+	import { untrack } from 'svelte'
+	import ChatCollapsibleCard from './copilot/chat/ChatCollapsibleCard.svelte'
+	import GfmMarkdown from './GfmMarkdown.svelte'
+	import { runPane } from './agentScroll'
+	import { createBottomSticker } from './stickToBottom'
+	import {
+		advanceAgentStream,
+		emptyAgentStreamProgress,
+		type AgentStreamProgress
+	} from './aiAgentResult'
+
+	interface Props {
+		/** The raw `result_stream` buffer, which only ever grows for a given run. */
+		raw: string
+		/** Identifies the run, so a viewer reused for another one starts over. */
+		streamKey?: string
+	}
+
+	let { raw, streamKey }: Props = $props()
+
+	let progress: AgentStreamProgress & { key?: string } = $state(emptyAgentStreamProgress())
+
+	$effect(() => {
+		raw
+		streamKey
+		untrack(() => {
+			// A shorter buffer than what was already folded in cannot be a longer
+			// version of the same stream, so treat it as a different one.
+			const continues = progress.key === streamKey && raw.length >= progress.consumed
+			const base = continues ? progress : emptyAgentStreamProgress()
+			progress = { ...advanceAgentStream(raw, base), key: streamKey }
+			if (!continues) {
+				// Another run, so the reader's decision to stop following the previous
+				// one does not carry over: this one starts at its latest output.
+				following = true
+			}
+		})
+	})
+
+	let stream = $derived(progress.stream)
+
+	let anchor: HTMLElement | undefined = $state()
+	// Carry the reader along as the text is written, unless they have scrolled up
+	// to read something — then the pane is theirs until they come back to the end.
+	let following = true
+	const sticker = createBottomSticker()
+
+	// The listener goes on the pane, not on this element: a scroll event fires on
+	// whatever actually scrolled and does not bubble, so a handler here would never
+	// run and the reader would be dragged back on every poll.
+	$effect(() => {
+		const pane = runPane(anchor)
+		if (!pane) {
+			return
+		}
+		const onScroll = () => {
+			if (!sticker.isOwnScroll()) {
+				following = sticker.isAtEnd(pane)
+			}
+		}
+		pane.addEventListener('scroll', onScroll, { passive: true })
+		return () => pane.removeEventListener('scroll', onScroll)
+	})
+
+	$effect(() => {
+		stream.current
+		stream.reasoning
+		stream.entries.length
+		if (following) {
+			sticker.scrollToEnd(runPane(anchor))
+		}
+	})
+</script>
+
+<!-- One gap on the container rather than margins per child, and the same gap the
+     finished trace uses: a turn's text must not shift when a tool call turns it from
+     the live text into a row. The text at the bottom is deliberately unlabelled — a
+     turn that goes on to call a tool was narration, and the run's end settles which. -->
+<div bind:this={anchor} class="flex flex-col w-full py-3 gap-1">
+	{#each stream.entries as entry, index (entry.kind === 'tool' ? entry.callId : index)}
+		{#if entry.kind === 'tool'}
+			<ChatCollapsibleCard
+				label={entry.name}
+				expanded={false}
+				toggleable={false}
+				shimmer={entry.running}
+				onToggle={() => {}}
+				labelClass={entry.success === false ? 'text-red-500' : ''}
+			/>
+		{:else}
+			<div>
+				<GfmMarkdown md={entry.content} noPadding />
+			</div>
+		{/if}
+	{/each}
+
+	{#if stream.current !== ''}
+		<div>
+			<!-- Same sanitizing chain as a finished output: a partial answer is written
+			     by the same model and is no more trusted for arriving in pieces. -->
+			<GfmMarkdown md={stream.current} noPadding />
+		</div>
+	{:else if stream.reasoning !== ''}
+		<!-- Reasoning arrives before the text, so on its own it means the model is
+		     still thinking rather than that this run has nothing to say. -->
+		<div class="text-secondary">
+			<GfmMarkdown md={stream.reasoning} prose="xs" noPadding />
+		</div>
+	{/if}
+</div>
diff --git a/frontend/src/lib/components/AgentTrace.svelte b/frontend/src/lib/components/AgentTrace.svelte
new file mode 100644
index 0000000000..7f2a90e621
--- /dev/null
+++ b/frontend/src/lib/components/AgentTrace.svelte
@@ -0,0 +1,155 @@
+<script lang="ts">
+	import { ExternalLink, Globe } from 'lucide-svelte'
+	import { JobService, type Job } from '$lib/gen'
+	import { base } from '$lib/base'
+	import { msToReadableTimeShort } from '$lib/utils'
+	import ChatCollapsibleCard from './copilot/chat/ChatCollapsibleCard.svelte'
+	import ToolContentDisplay from './copilot/chat/ToolContentDisplay.svelte'
+	import WebSearchSourcesDisplay from './copilot/chat/WebSearchSourcesDisplay.svelte'
+	import { webSearchResultOf, type WebSearchResult } from './copilot/chat/shared'
+	import GfmMarkdown from './GfmMarkdown.svelte'
+	import type { AgentTraceEntry } from './agentTrace'
+	import { SvelteMap, SvelteSet } from 'svelte/reactivity'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+
+	interface Props {
+		entries: AgentTraceEntry[]
+		workspaceId?: string
+	}
+
+	let { entries, workspaceId }: Props = $props()
+
+	let expanded = new SvelteSet<number>()
+	// A search opens on its sources, so for it the reader's toggle records a close.
+	let collapsedSearches = new SvelteSet<number>()
+	// Row state is keyed by position, which means nothing once the viewer is handed
+	// another run: row 0 would stay open showing the previous run's job.
+	$effect(() => {
+		entries
+		expanded.clear()
+		collapsedSearches.clear()
+		jobs.clear()
+	})
+	// A tool's own job holds what the envelope does not: its logs, how long it
+	// took, and whether it succeeded. Fetched when a row is opened rather than
+	// upfront, so a run with twenty calls does not issue twenty requests to draw
+	// a list of names.
+	let jobs = new SvelteMap<string, Job | 'loading' | 'failed'>()
+
+	async function loadJob(jobId: string) {
+		if (jobs.has(jobId)) {
+			return
+		}
+		jobs.set(jobId, 'loading')
+		try {
+			jobs.set(
+				jobId,
+				await JobService.getJob({ id: jobId, workspace: workspaceId ?? $operatingWorkspace! })
+			)
+		} catch {
+			// A tool job can be gone (retention) or unreadable. The row still has its
+			// arguments and result from the envelope, so only the extras are lost.
+			jobs.set(jobId, 'failed')
+		}
+	}
+
+	function toggle(index: number, entry: AgentTraceEntry) {
+		if (expanded.delete(index)) {
+			return
+		}
+		expanded.add(index)
+		if (entry.kind === 'tool' && entry.jobId) {
+			loadJob(entry.jobId)
+		}
+	}
+
+	function jobOf(jobId: string | undefined): Job | undefined {
+		if (!jobId) return undefined
+		const job = jobs.get(jobId)
+		return typeof job === 'object' ? job : undefined
+	}
+
+	function toolLabel(
+		entry: Extract<AgentTraceEntry, { kind: 'tool' }>,
+		search: WebSearchResult | undefined
+	): string {
+		const duration = jobOf(entry.jobId)?.['duration_ms']
+		return [
+			entry.name,
+			search?.query !== undefined ? `"${search.query}"` : undefined,
+			duration !== undefined ? msToReadableTimeShort(duration) : undefined
+		]
+			.filter((part) => part !== undefined)
+			.join(' · ')
+	}
+</script>
+
+<div class="flex flex-col w-full min-w-0 gap-1">
+	{#each entries as entry, index (index)}
+		{#if entry.kind === 'assistant'}
+			<div class="min-w-0">
+				<GfmMarkdown md={entry.content} noPadding />
+			</div>
+		{:else if entry.kind === 'search'}
+			<!-- Open on its sources, as the session chat shows a search. A tool that returns the
+			     same shape stays closed like every other tool row: the agent may call it twenty
+			     times, and the reader came for the run, not for its bibliography. -->
+			<ChatCollapsibleCard
+				label="Searched the web"
+				expanded={Boolean(entry.sources) && !collapsedSearches.has(index)}
+				toggleable={Boolean(entry.sources)}
+				onToggle={() => {
+					if (!collapsedSearches.delete(index)) collapsedSearches.add(index)
+				}}
+			>
+				{#if entry.sources}
+					<WebSearchSourcesDisplay sources={entry.sources} />
+				{/if}
+			</ChatCollapsibleCard>
+		{:else}
+			{@const job = jobOf(entry.jobId)}
+			{@const failed = job?.type === 'CompletedJob' && !job.success}
+			{@const search = webSearchResultOf(entry.result)}
+			<ChatCollapsibleCard
+				label={toolLabel(entry, search)}
+				expanded={expanded.has(index)}
+				onToggle={() => toggle(index, entry)}
+				contentClass="space-y-3"
+			>
+				{#if entry.args}
+					<ToolContentDisplay title="Parameters" content={entry.args} toolName={entry.name} />
+				{/if}
+				{#if job?.logs}
+					<ToolContentDisplay title="Logs" content={job.logs} />
+				{/if}
+				{#if search && !failed}
+					<WebSearchSourcesDisplay sources={search.sources} favicons={false} />
+				{:else}
+					<ToolContentDisplay
+						title="Result"
+						content={entry.result}
+						error={failed ? entry.result : undefined}
+					/>
+				{/if}
+				{#if entry.resourcePath}
+					<div class="text-2xs text-hint flex items-center gap-1">
+						<Globe size={11} />
+						{entry.resourcePath}
+					</div>
+				{:else if entry.jobId}
+					<a
+						class="text-2xs text-accent inline-flex items-center gap-1 w-fit hover:underline"
+						href="{base}/run/{entry.jobId}?workspace={workspaceId ?? $operatingWorkspace}"
+						target="_blank"
+						rel="noreferrer"
+					>
+						<ExternalLink size={11} />
+						Open job
+					</a>
+				{/if}
+			</ChatCollapsibleCard>
+		{/if}
+	{/each}
+</div>
diff --git a/frontend/src/lib/components/ApiConnectForm.svelte b/frontend/src/lib/components/ApiConnectForm.svelte
index dedeee90e2..2255817c5e 100644
--- a/frontend/src/lib/components/ApiConnectForm.svelte
+++ b/frontend/src/lib/components/ApiConnectForm.svelte
@@ -1,7 +1,6 @@
 <script lang="ts">
 	import { OauthService, type ResourceType } from '$lib/gen'
 	import FilesetEditor from './FilesetEditor.svelte'
-	import { workspaceStore } from '$lib/stores'
 	import { emptySchema, emptyString } from '$lib/utils'
 	import SchemaForm from './SchemaForm.svelte'
 	import Toggle from './Toggle.svelte'
@@ -20,6 +19,9 @@
 	import { base } from '$lib/base'
 	import { isDataTableWizardEnabled } from './workspaceSettings/utils.svelte'
 	import { parsePostgresConnectionString } from '$lib/utils/postgresConnectionString'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		resourceType: string
@@ -152,7 +154,7 @@
 		}
 	}
 	$effect(() => {
-		$workspaceStore && untrack(() => loadSchema())
+		$operatingWorkspace && untrack(() => loadSchema())
 	})
 	$effect(() => {
 		notFound && rawCode && untrack(() => parseJson())
diff --git a/frontend/src/lib/components/AppConnectInner.svelte b/frontend/src/lib/components/AppConnectInner.svelte
index cef58fcdb2..c695227964 100644
--- a/frontend/src/lib/components/AppConnectInner.svelte
+++ b/frontend/src/lib/components/AppConnectInner.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
 	import { run } from 'svelte/legacy'
 
-	import { userStore, workspaceStore } from '$lib/stores'
+	import { userStore } from '$lib/stores'
 	import LabelsInput from './LabelsInput.svelte'
 	import IconedResourceType from './IconedResourceType.svelte'
 	import {
@@ -53,6 +53,9 @@
 	import Label from './Label.svelte'
 	import ResourcePathHint from './ResourcePathHint.svelte'
 	import SchemaForm from './SchemaForm.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		step?: number
@@ -84,7 +87,7 @@
 		fillPath = undefined
 	}: Props = $props()
 
-	let effectiveWorkspace = $derived(workspace ?? $workspaceStore!)
+	let effectiveWorkspace = $derived(workspace ?? $operatingWorkspace!)
 
 	let isValid = $state(true)
 
diff --git a/frontend/src/lib/components/ArgInfo.svelte b/frontend/src/lib/components/ArgInfo.svelte
index a1cfdf6276..b071434f9d 100644
--- a/frontend/src/lib/components/ArgInfo.svelte
+++ b/frontend/src/lib/components/ArgInfo.svelte
@@ -1,12 +1,14 @@
 <script lang="ts">
 	import { ResourceService, VariableService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { copyToClipboard, truncate } from '$lib/utils'
 	import { ClipboardCopy, Expand } from 'lucide-svelte'
 	import Drawer from './common/drawer/Drawer.svelte'
 	import ObjectViewer from './propertyPicker/ObjectViewer.svelte'
 	import Tooltip from './Tooltip.svelte'
 	import { Button, DrawerContent } from './common'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		value: any
@@ -22,14 +24,14 @@
 
 	async function getResource(path: string) {
 		jsonViewerContent = await ResourceService.getResourceValue({
-			workspace: $workspaceStore!,
+			workspace: $operatingWorkspace!,
 			path
 		})
 	}
 
 	async function getVariable(path: string) {
 		jsonViewerContent = await VariableService.getVariableValue({
-			workspace: $workspaceStore!,
+			workspace: $operatingWorkspace!,
 			path
 		})
 	}
diff --git a/frontend/src/lib/components/ArgInput.svelte b/frontend/src/lib/components/ArgInput.svelte
index d62f8aed0f..62165bc758 100644
--- a/frontend/src/lib/components/ArgInput.svelte
+++ b/frontend/src/lib/components/ArgInput.svelte
@@ -41,12 +41,14 @@
 	import { safeSelectItems } from './select/utils.svelte'
 	import S3ArgInput from './common/fileUpload/S3ArgInput.svelte'
 	import { base } from '$lib/base'
-	import { workspaceStore } from '$lib/stores'
 	import { getJsonSchemaFromResource } from './schema/jsonSchemaResource.svelte'
 	import AIProviderPicker from './AIProviderPicker.svelte'
 	import TextInput from './text_input/TextInput.svelte'
 	import FileInput from './common/fileInput/FileInput.svelte'
 	import { randomUUID } from '$lib/utils/uuid'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		label?: string
@@ -823,7 +825,7 @@
 				/>
 			{/await}
 		{:else if inputCat == 'object' && format?.startsWith('jsonschema-')}
-			{#await getJsonSchemaFromResource(format.substring('jsonschema-'.length), workspace ?? $workspaceStore ?? '')}
+			{#await getJsonSchemaFromResource(format.substring('jsonschema-'.length), workspace ?? $operatingWorkspace ?? '')}
 				<Loader2 class="animate-spin" />
 			{:then schema}
 				{#if !schema || !schema.properties}
diff --git a/frontend/src/lib/components/AssignableTagsInner.svelte b/frontend/src/lib/components/AssignableTagsInner.svelte
index e1ad0baf8e..fd5859b784 100644
--- a/frontend/src/lib/components/AssignableTagsInner.svelte
+++ b/frontend/src/lib/components/AssignableTagsInner.svelte
@@ -2,7 +2,8 @@
 	import { preventDefault, stopPropagation } from 'svelte/legacy'
 
 	import { Button } from './common'
-	import { ExternalLink, Loader2, X } from 'lucide-svelte'
+	import { AlertTriangle, ExternalLink, Loader2, X } from 'lucide-svelte'
+	import Popover from './meltComponents/Popover.svelte'
 	import { SettingService, WorkerService } from '$lib/gen'
 	import { sendUserToast } from '$lib/toast'
 	import { superadmin, devopsRole } from '$lib/stores'
@@ -38,20 +39,65 @@
 	const dispatch = createEventDispatcher()
 
 	// Mirrors CUSTOM_TAG_REGEX in backend/windmill-common/src/worker.rs — keep both in sync.
-	const customTagRegex = /^([\w-]+)\(((?:[\w-]+\*?\+)*[\w-]+\*?|(?:\^[\w-]+\*?)+)\)$/
-	const dynamicTagRegex = /\$args\[((?:\w+\.)*\w+)\]/
+	const customTagRegex =
+		/^((?:[\w-]|\$workspace|\$(?:args|flow_expr)\[(?:\w+\.)*\w+\])+)\(((?:[\w-]+\*?\+)*[\w-]+\*?|(?:\^[\w-]+\*?)+)\)$/
+	// Mirrors RE_ARG_TAG and RE_FLOW_EXPR_TAG in backend/windmill-queue/src/jobs.rs.
+	const dynamicTagRegex = /\$(args|flow_expr)\[((?:\w+\.)*\w+)\]/
 
 	function formatWorkspace(w: { id: string; includeForks: boolean }) {
 		return w.includeForks ? `${w.id} (and its forks)` : w.id
 	}
 
+	// What an entry matches job tags against: a workspace specific entry's name, which may be
+	// dynamic like any other entry.
+	function nameOf(entry: string) {
+		return entry.match(customTagRegex)?.[1] ?? entry
+	}
+	let tagName = $derived(nameOf(newTag.trim()))
+
 	let dynamicTag = $derived.by(() => {
-		let r = newTag.trim()
-		if (r == '') return undefined
-		let matched = r.match(dynamicTagRegex)
-		return matched?.[1]
+		if (tagName == '') return undefined
+		let matched = tagName.match(dynamicTagRegex)
+		return matched ? { kind: matched[1], path: matched[2] } : undefined
 	})
 
+	// Mirrors custom_tag_matches in backend/windmill-common/src/worker.rs: a job's tag is judged on
+	// what it resolves to, and a placeholder in a custom tag stands for any text, unless two of them
+	// are tied (same kind, and the same path or one inside the other). A tied entry admits only a
+	// tag written exactly like it; an untied one is a pattern fenced only by its fixed text.
+	function placeholdersOf(entry: string) {
+		return [...entry.matchAll(new RegExp(dynamicTagRegex.source, 'g'))].map((m) => ({
+			kind: m[1],
+			path: m[2],
+			start: m.index,
+			end: m.index + m[0].length
+		}))
+	}
+	function isTied(entry: string) {
+		const placeholders = placeholdersOf(entry)
+		return placeholders.some((a, i) =>
+			placeholders
+				.slice(i + 1)
+				.some(
+					(b) =>
+						a.kind == b.kind &&
+						(a.path == b.path || a.path.startsWith(b.path + '.') || b.path.startsWith(a.path + '.'))
+				)
+		)
+	}
+	// With nothing fixed at its start or its end, a pattern reaches almost any tag.
+	function reachesAnyTag(entry: string) {
+		const placeholders = placeholdersOf(entry)
+		return (
+			placeholders.length > 0 &&
+			!isTied(entry) &&
+			placeholders[0].start == 0 &&
+			placeholders[placeholders.length - 1].end == entry.length
+		)
+	}
+	let dynamicTagTied = $derived(isTied(tagName))
+	let dynamicTagReachesAnyTag = $derived(reachesAnyTag(tagName))
+
 	let extractedCustomTag = $derived.by(() => {
 		let r = newTag.trim()
 		if (r == '') return undefined
@@ -125,6 +171,42 @@
 
 <svelte:window onkeydown={onKeyDown} />
 
+{#snippet reachesAnyTagWarning(scoped: boolean)}
+	Nothing fixed at its start or its end, so it allows anyone{scoped ? ' in its workspaces' : ''} to reach
+	almost any tag. We highly recommend a prefix or a suffix, ideally both, to limit its reach: for instance
+	<code>gpu-$args[size]</code>
+	or <code>gpu-$args[size]-eu</code>.
+{/snippet}
+
+{#snippet dynamicTagInfo(scoped: boolean)}
+	{#if tagName.includes('$workspace')}
+		<div>Interpolated tag based on workspace id the job was created in </div>
+	{/if}
+	{#if dynamicTag?.kind == 'flow_expr'}
+		<div>
+			Interpolated tag based on the flow value at <b>{dynamicTag.path}</b>, resolved when the flow
+			step starts
+		</div>
+	{:else if dynamicTag}
+		<div>Interpolated tag based on args input of <b>{dynamicTag.path}</b></div>
+	{/if}
+	{#if dynamicTagTied}
+		<div class="mt-1">
+			Its placeholders read the same value, or one reads inside the other, so it allows only jobs
+			whose tag is written exactly like this
+		</div>
+	{:else if dynamicTagReachesAnyTag}
+		<div class="mt-1 text-yellow-600 dark:text-yellow-500">
+			{@render reachesAnyTagWarning(scoped)}
+		</div>
+	{:else if dynamicTag}
+		<div class="mt-1">
+			Allows any tag it resolves to{scoped ? ' in these workspaces' : ''}, with the text around the
+			placeholder as written
+		</div>
+	{/if}
+{/snippet}
+
 <div
 	class="flex flex-col gap-2"
 	class:w-72={variant === 'popover'}
@@ -135,8 +217,26 @@
 	{:else}
 		<div class="flex flex-row flex-wrap gap-y-1 gap-x-2">
 			{#each customTags as customTag}
+				{@const name = nameOf(customTag)}
 				<Badge color="blue">
 					{customTag}
+					{#if reachesAnyTag(name)}
+						<Popover
+							openOnHover
+							placement="top"
+							class="inline-flex items-center"
+							triggerAttrs={{ 'aria-label': 'Warning: this tag allows reaching almost any tag' }}
+						>
+							{#snippet trigger()}
+								<AlertTriangle size={14} class="text-yellow-500" />
+							{/snippet}
+							{#snippet content()}
+								<div class="max-w-72 p-3 text-xs text-primary">
+									{@render reachesAnyTagWarning(name != customTag)}
+								</div>
+							{/snippet}
+						</Popover>
+					{/if}
 
 					{#if tagEditor}
 						<button
@@ -167,8 +267,11 @@
 			</Button>
 		</div>
 		{#if extractedCustomTag}
+			{@const dynamic = tagName.includes('$workspace') || dynamicTag != undefined}
 			<div class="text-2xs text-primary p-2 bg-surface-secondary rounded">
-				<div class="font-medium mb-1">Workspace specific tag</div>
+				<div class="font-medium mb-1">
+					Workspace specific {#if dynamic}dynamic tag{:else}tag{/if}
+				</div>
 				<div>
 					<b>Tag:</b>
 					{extractedCustomTag.tag}
@@ -181,9 +284,23 @@
 						All workspaces except {extractedCustomTag.workspaces?.map(formatWorkspace).join(', ')}
 					{/if}
 				</div>
+				{@render dynamicTagInfo(true)}
+				<!-- Only an editor loads the entries as written, which tell a global `tag` from `tag(ws)`. -->
+				{#if !dynamic && tagEditor}
+					{#if (customTags ?? []).includes(tagName)}
+						<div class="mt-1 text-yellow-600 dark:text-yellow-500">
+							<code>{tagName}</code> is also listed without workspaces, which keeps it open to every
+							workspace
+						</div>
+					{:else}
+						<div class="mt-1">
+							Workspaces outside this scope cannot use it, even through a dynamic tag it fits
+						</div>
+					{/if}
+				{/if}
 			</div>
 		{:else if newTag.trim()}
-			{#if newTag.includes('(') || newTag.includes(')') || newTag.includes('+') || newTag.includes('^') || newTag.includes('*') || ((newTag.includes('.') || newTag.includes('$args[')) && !dynamicTag)}
+			{#if newTag.includes('(') || newTag.includes(')') || newTag.includes('+') || newTag.includes('^') || newTag.includes('*') || ((newTag.includes('.') || newTag.includes('$args[') || newTag.includes('$flow_expr[')) && !dynamicTag)}
 				<div class="text-2xs text-primary p-2 bg-surface-secondary rounded border">
 					<div class="font-medium mb-1 text-red-500">Invalid tag</div>
 					<div>
@@ -194,7 +311,7 @@
 			{:else}
 				<div class="text-2xs text-primary p-2 bg-surface-secondary rounded border">
 					<div class="font-medium mb-1">
-						{#if newTag.includes('$workspace') || newTag.includes('$args')}
+						{#if newTag.includes('$workspace') || dynamicTag}
 							Dynamic tag
 						{:else}
 							Simple tag
@@ -204,12 +321,7 @@
 						<b>Tag:</b>
 						{newTag.trim()}
 					</div>
-					{#if newTag.includes('$workspace') && !dynamicTag}
-						<div>Interpolated tag based on workspace id the job was created in </div>
-					{/if}
-					{#if dynamicTag}
-						<div>Interpolated tag based on args input of <b>{dynamicTag}</b></div>
-					{/if}
+					{@render dynamicTagInfo(false)}
 				</div>
 			{/if}
 		{/if}
@@ -252,6 +364,26 @@
 			>
 			based on args input, use <pre class="inline text-emphasis">$args[a.b.c]</pre> where
 			<pre class="inline">a.b.c</pre> is the path to the value in the args object.
+			<br />{#if variant !== 'drawer'}<br />{/if}
+			For
+			<a
+				href="https://www.windmill.dev/docs/core_concepts/worker_groups#dynamic-tag"
+				target="_blank">dynamic tags <ExternalLink size={12} class="inline-block" /></a
+			>
+			based on flow step results, flow input or flow env, use
+			<pre class="inline text-emphasis">$flow_expr[results.a.b.c]</pre> where
+			<pre class="inline">a</pre> is the step id, or
+			<pre class="inline text-emphasis">$flow_expr[flow_input.a.b.c]</pre> and
+			<pre class="inline text-emphasis">$flow_expr[flow_env.a.b.c]</pre>.
+			<br />{#if variant !== 'drawer'}<br />{/if}
+			A dynamic tag is checked on the tag it resolves to: it is allowed when that tag is listed here,
+			or fits a listed dynamic tag such as
+			<pre class="inline text-emphasis">gpu-$args[size]</pre>, which allows any tag starting with
+			<pre class="inline">gpu-</pre>. Scope it like any other tag, e.g.
+			<pre class="inline text-emphasis">gpu-$args[size](workspace1+workspace2)</pre>, to allow those
+			tags only in some workspaces. A tag listed by its own name for some workspaces, e.g.
+			<pre class="inline text-emphasis">gpu-secret(workspace1)</pre>, stays limited to them even
+			when a dynamic tag fits it, unless it is also listed without workspaces.
 		</span>
 	{/if}
 </div>
diff --git a/frontend/src/lib/components/BedrockCredentialsCheck.svelte b/frontend/src/lib/components/BedrockCredentialsCheck.svelte
index 877ca9ff72..fa39309a50 100644
--- a/frontend/src/lib/components/BedrockCredentialsCheck.svelte
+++ b/frontend/src/lib/components/BedrockCredentialsCheck.svelte
@@ -1,9 +1,11 @@
 <script lang="ts">
 	import { JobService, type FlowValue } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { tryEvery } from '$lib/utils'
 	import { Check, LoaderCircle, Server, X, Cpu } from 'lucide-svelte'
 	import Button from './common/button/Button.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface CredentialsCheckResult {
 		available: boolean
@@ -28,7 +30,7 @@
 		apiResult = null
 
 		try {
-			const response = await fetch(`/api/w/${$workspaceStore}/ai/check_bedrock_credentials`)
+			const response = await fetch(`/api/w/${$operatingWorkspace}/ai/check_bedrock_credentials`)
 			if (!response.ok) {
 				throw new Error(`HTTP error: ${response.status}`)
 			}
@@ -78,7 +80,7 @@
 			}
 
 			const job = await JobService.runFlowPreview({
-				workspace: $workspaceStore!,
+				workspace: $operatingWorkspace!,
 				requestBody: {
 					value: flowValue as unknown as FlowValue,
 					args: {}
@@ -88,7 +90,7 @@
 			tryEvery({
 				tryCode: async () => {
 					const testResult = await JobService.getCompletedJob({
-						workspace: $workspaceStore!,
+						workspace: $operatingWorkspace!,
 						id: job
 					})
 
@@ -130,7 +132,7 @@
 					workerStatus = 'error'
 					try {
 						await JobService.cancelQueuedJob({
-							workspace: $workspaceStore!,
+							workspace: $operatingWorkspace!,
 							id: job,
 							requestBody: {
 								reason: 'Timeout checking Bedrock credentials'
diff --git a/frontend/src/lib/components/ChannelSelector.svelte b/frontend/src/lib/components/ChannelSelector.svelte
index d7a720d877..1b5faee265 100644
--- a/frontend/src/lib/components/ChannelSelector.svelte
+++ b/frontend/src/lib/components/ChannelSelector.svelte
@@ -1,9 +1,11 @@
 <script lang="ts">
 	import Select from './select/Select.svelte'
 	import { WorkspaceService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { RefreshCcw } from 'lucide-svelte'
 	import { Button } from './common'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface ChannelItem {
 		channel_id?: string
@@ -21,8 +23,8 @@
 		showRefreshButton?: boolean
 		onError?: (error: Error) => void
 		onSelectedChannelChange?: (channel: ChannelItem | undefined) => void
-		/** Workspace to list Teams channels from; defaults to the nav
-		 * `$workspaceStore`. A forked session passes its acting workspace. */
+		/** Workspace to list Teams channels from; defaults to the operating workspace (see
+		 * `useOperatingWorkspace`). */
 		workspace?: string
 	}
 
@@ -40,7 +42,7 @@
 		workspace = undefined
 	}: Props = $props()
 
-	let effectiveWorkspace = $derived(workspace ?? $workspaceStore)
+	let effectiveWorkspace = $derived(workspace ?? $operatingWorkspace)
 
 	let isFetching = $state(false)
 	let loadedChannels = $state<ChannelItem[]>([])
diff --git a/frontend/src/lib/components/CliHelpBox.svelte b/frontend/src/lib/components/CliHelpBox.svelte
index 951a7e3d5a..0bee33825c 100644
--- a/frontend/src/lib/components/CliHelpBox.svelte
+++ b/frontend/src/lib/components/CliHelpBox.svelte
@@ -1,7 +1,9 @@
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import ClipboardPanel from './details/ClipboardPanel.svelte'
 	import Section from './Section.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let url = $derived(`${window.location.protocol}//${window.location.hostname}/`)
 </script>
@@ -20,7 +22,7 @@
 				<span class="font-medium">Setup the wmill cli for this workspace & remote:</span>
 				<div class="mt-1">
 					<ClipboardPanel
-						content={`wmill workspace add ${$workspaceStore} ${$workspaceStore} ${url}`}
+						content={`wmill workspace add ${$operatingWorkspace} ${$operatingWorkspace} ${url}`}
 					/>
 				</div>
 			</li>
diff --git a/frontend/src/lib/components/ContextualVariableEditor.svelte b/frontend/src/lib/components/ContextualVariableEditor.svelte
index 43277787ba..9adde76e74 100644
--- a/frontend/src/lib/components/ContextualVariableEditor.svelte
+++ b/frontend/src/lib/components/ContextualVariableEditor.svelte
@@ -1,7 +1,6 @@
 <script lang="ts">
 	import { WorkspaceService } from '$lib/gen'
 	import { createEventDispatcher } from 'svelte'
-	import { workspaceStore } from '$lib/stores'
 	import { Button } from './common'
 	import Drawer from './common/drawer/Drawer.svelte'
 	import DrawerContent from './common/drawer/DrawerContent.svelte'
@@ -10,6 +9,9 @@
 	import autosize from '$lib/autosize'
 	import Label from './Label.svelte'
 	import TextInput from './text_input/TextInput.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	const dispatch = createEventDispatcher()
 
@@ -35,7 +37,7 @@
 
 	async function updateVariable(): Promise<void> {
 		await WorkspaceService.setEnvironmentVariable({
-			workspace: $workspaceStore!,
+			workspace: $operatingWorkspace!,
 			requestBody: {
 				value: value,
 				name: name
diff --git a/frontend/src/lib/components/DBManager.svelte b/frontend/src/lib/components/DBManager.svelte
index 7520cc5013..16e64dc5a0 100644
--- a/frontend/src/lib/components/DBManager.svelte
+++ b/frontend/src/lib/components/DBManager.svelte
@@ -1,11 +1,18 @@
 <script lang="ts">
-	import { superadmin, userStore, type DBSchema } from '$lib/stores'
+	import { untrack, type Snippet } from 'svelte'
+	import { isCloudHosted } from '$lib/cloud'
+	import { superadmin, type DBSchema } from '$lib/stores'
 	import {
 		ChevronDownIcon,
 		EditIcon,
 		Loader2,
 		Plus,
 		Table2,
+		Database as DatabaseIcon,
+		Folder as FolderIcon,
+		History as HistoryIcon,
+		KeyRound as KeyRoundIcon,
+		Download as DownloadIcon,
 		Trash2Icon,
 		UploadIcon
 	} from 'lucide-svelte'
@@ -21,9 +28,6 @@
 	import DbTableEditor from './DBTableEditor.svelte'
 	import type { DbType } from './dbTypes'
 	import Portal from './Portal.svelte'
-	import Select from './select/Select.svelte'
-	import { safeSelectItems } from './select/utils.svelte'
-	import type { Snippet } from 'svelte'
 	import {
 		dbSupportsTransactionalDdl,
 		diffTableEditorValues
@@ -32,15 +36,57 @@
 	import { capitalize, onlyAlphaNumAndUnderscore, pluralize } from '$lib/utils'
 	import type { DbFeatures } from './apps/components/display/dbtable/dbFeatures'
 	import Star from './Star.svelte'
-	import type { Asset } from '$lib/gen'
+	import ResizeTransitionWrapper from './common/ResizeTransitionWrapper.svelte'
+	import PgAclEditor from './datatableAcl/PgAclEditor.svelte'
+	import { favoriteManager } from './sidebar/FavoriteMenu.svelte'
+	import DatatableRoleBadge from './DatatableRoleBadge.svelte'
+	import type { AclTarget, Asset, DataTableTables } from '$lib/gen'
+	import { ADMIN_DATATABLE_ROLE, datatableNameTakesRole, type DatatableRowAction } from './dbTypes'
+	import TextInput from './text_input/TextInput.svelte'
+	import Checkbox from './common/checkbox/Checkbox.svelte'
+	import DbSchemaDiagram from './dbdiagram/DbSchemaDiagram.svelte'
+	import type { DbRelation } from './dbRelations'
+	import { useOperatingUser } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	/** Represents a selected table with its schema */
 	export interface SelectedTable {
+		/** Absent when the tree has no data table level (a plain database). */
+		datatable?: string
 		schema: string
 		table: string
 	}
 
+	/** An action asked for on one data table's row, waiting for the manager to be
+	 * connected to that data table. `datatable` is what it was asked for: a switch
+	 * that lands anywhere else — because the target failed to load, or because the
+	 * user picked another one meanwhile — must not run it there. */
+	export type RowAction =
+		| { kind: 'create-table'; schema: string }
+		| { kind: 'create-schema' }
+		| { kind: 'alter-table'; schema: string; table: string }
+		| { kind: 'delete-table'; schema: string; table: string }
+		| { kind: 'drop-schema'; schema: string }
+		| { kind: 'rename-schema'; schema: string }
+
+	export type PendingRowAction = RowAction & { datatable: string }
+
+	/** The right pane's content: the rows of one table, or the schema diagram. */
+	export type DbManagerViewMode = 'data' | 'diagram'
+
 	type Props = {
+		/** Which of the two views the right pane shows. Owned by whoever renders the
+		 * control that switches it; ignored for a database with no diagram. */
+		requestedViewMode?: DbManagerViewMode
+		/** Asked for from inside, e.g. opening a table from the diagram. */
+		onViewMode?: (mode: DbManagerViewMode) => void
+		/** Identifies the database this is connected to, stable across reloads of
+		 * it. A string rather than one of the objects read from it: those are
+		 * replaced as the manager re-reads, which says nothing about the database
+		 * having changed. */
+		databaseKey?: string
 		dbType: DbType
 		dbSchema: DBSchema
 		dbSupportsSchemas: boolean
@@ -58,7 +104,23 @@
 		initialTableKey?: string
 		selectedSchemaKey?: string | undefined
 		selectedTableKey?: string | undefined
-		dbSelector?: Snippet<[]>
+		/** Every data table with its schemas and tables. Present only when the manager
+		 * is on a data table — that is what puts a data-table level at the top of the
+		 * tree; otherwise the tree starts at schemas. */
+		datatableTree?: DataTableTables[]
+		datatableTreeLoading?: boolean
+		onSelectDatatable?: (datatable: string) => void
+		/** Role the manager is connected as; undefined means the data table's default. */
+		currentRole?: string
+		/** Switch a data table's role from its row badge. */
+		onSelectRole?: (datatable: string, role: string) => void
+		pendingAction?: PendingRowAction | undefined
+		/** Row-menu actions on a data table, run against that row's data table. */
+		onDatatableAction?: (datatable: string, action: DatatableRowAction) => void
+		/** Workspace the access drawer's own calls run against. */
+		workspace?: string
+		/** Whether the caller administers data tables here, which is who may edit their roles. */
+		canManageDatatable?: boolean
 		/** Enable multi-select mode with checkboxes in sidebar */
 		multiSelectMode?: boolean
 		/** Selected tables in multi-select mode */
@@ -67,9 +129,14 @@
 		disabledTables?: SelectedTable[]
 		features?: DbFeatures
 		asset?: Asset
+		/** Shown in the data pane instead of the table, e.g. why the database could not be read. */
+		mainPane?: Snippet
 		onImport?: (mode: 'schema_and_data' | 'schema_only') => void
 	}
 	let {
+		requestedViewMode = 'data',
+		onViewMode,
+		databaseKey,
 		dbType,
 		dbSchema,
 		dbTableOpsFactory,
@@ -82,81 +149,419 @@
 		initialTableKey,
 		selectedSchemaKey = $bindable(undefined),
 		selectedTableKey = $bindable(undefined),
-		dbSelector,
+		datatableTree,
+		datatableTreeLoading,
+		onSelectDatatable,
+		currentRole,
+		onSelectRole,
+		pendingAction = $bindable(),
+		onDatatableAction,
+		workspace,
+		canManageDatatable = false,
 		multiSelectMode = false,
 		selectedTables = $bindable([]),
 		disabledTables = [],
 		features,
 		asset,
-		onImport
+		onImport,
+		mainPane
 	}: Props = $props()
 
-	// Helper to check if a table is selected in multi-select mode
-	function isTableSelected(schema: string, table: string): boolean {
-		return selectedTables.some((t) => t.schema === schema && t.table === table)
+	// The engines whose SQL has `ALTER SCHEMA .. RENAME TO`: BigQuery datasets and DuckDB schemas
+	// cannot be renamed.
+	const SCHEMA_RENAME_DB_TYPES: DbType[] = ['postgresql', 'snowflake']
+
+	// PostgreSQL is the only database whose foreign keys can be read for the whole
+	// database in one query; the others would need one job per table. A caller
+	// already using the tree's checkboxes to collect tables keeps them.
+	let supportsDiagram = $derived(dbType === 'postgresql' && !multiSelectMode)
+
+	// The mode is asked for from outside, where the control that sets it lives, so
+	// a database this manager cannot draw has to be clamped here rather than left
+	// showing a diagram with no control in reach to leave it by.
+	let viewMode = $derived(supportsDiagram ? requestedViewMode : 'data')
+
+	// Everything the diagram remembers, against the database it is about. The
+	// manager is not remounted when that database changes, so every read goes
+	// through `diagram`, where a key that no longer matches reads as the fresh
+	// diagram a switch should give. Kept apart from `selectedTables` so that
+	// checking a table to see it drawn can never add it to whatever the caller's
+	// multi-select is collecting.
+	type DiagramState = {
+		databaseKey: string | undefined
+		tables: SelectedTable[]
+		/** Whether this database's first draw has happened — by the user checking
+		 * something, or by the automatic one below. */
+		drawn: boolean
+	}
+	let diagramState = $state<DiagramState>({ databaseKey: undefined, tables: [], drawn: false })
+	let diagram = $derived<DiagramState>(
+		diagramState.databaseKey === databaseKey
+			? diagramState
+			: { databaseKey, tables: [], drawn: false }
+	)
+	let diagramTables = $derived(diagram.tables)
+
+	let checkedTables = $derived(viewMode === 'diagram' ? diagramTables : selectedTables)
+
+	function setCheckedTables(tables: SelectedTable[]) {
+		if (viewMode === 'diagram') diagramState = { databaseKey, tables, drawn: true }
+		else selectedTables = tables
 	}
 
-	// Helper to check if a table is disabled (already added)
-	function isTableDisabled(schema: string, table: string): boolean {
-		return disabledTables.some((t) => t.schema === schema && t.table === table)
+	/** The diagram only has the schema and relations of the database it is connected
+	 * to, so another data table's rows get no checkbox there. */
+	function showsCheckbox(datatable: string | undefined): boolean {
+		return multiSelectMode || (viewMode === 'diagram' && datatable === currentDatatable)
 	}
 
-	// Toggle table selection in multi-select mode
-	function toggleTableSelection(schema: string, table: string) {
-		if (isTableDisabled(schema, table)) return
+	const sameTable = (a: SelectedTable, b: SelectedTable) =>
+		a.datatable === b.datatable && a.schema === b.schema && a.table === b.table
 
-		const idx = selectedTables.findIndex((t) => t.schema === schema && t.table === table)
-		if (idx >= 0) {
-			selectedTables = selectedTables.filter((_, i) => i !== idx)
-		} else {
-			selectedTables = [...selectedTables, { schema, table }]
+	function isTableSelected(t: SelectedTable): boolean {
+		return checkedTables.some((s) => sameTable(s, t))
+	}
+
+	/** Already added by the caller: shown ticked and locked. Only the caller's
+	 * selection has tables that are already spoken for. */
+	function isTableDisabled(t: SelectedTable): boolean {
+		return viewMode !== 'diagram' && disabledTables.some((s) => sameTable(s, t))
+	}
+
+	function toggleTableSelection(t: SelectedTable) {
+		if (isTableDisabled(t)) return
+		setCheckedTables(
+			isTableSelected(t) ? checkedTables.filter((s) => !sameTable(s, t)) : [...checkedTables, t]
+		)
+	}
+
+	/** In the diagram a row toggles what is drawn: selecting it would fetch that one
+	 * table's foreign keys for a data pane that is not shown. */
+	function onTableRowClick(t: SelectedTable) {
+		if (viewMode === 'diagram' && t.datatable === currentDatatable) toggleTableSelection(t)
+		else selectTable(t.datatable, t.schema, t.table)
+	}
+
+	/** Every table under a node, as it is currently rendered — so a batch toggle
+	 * acts on what the user can see, search filter included. */
+	function tablesUnder(datatable: string | undefined, schemaKey?: string): SelectedTable[] {
+		return treeRoots
+			.filter((r) => r.datatable === datatable)
+			.flatMap((r) =>
+				r.schemas
+					.filter((sc) => schemaKey === undefined || sc.schemaKey === schemaKey)
+					.flatMap((sc) => sc.tables.map((table) => ({ datatable, schema: sc.schemaKey, table })))
+			)
+	}
+
+	/** Tri-state of a node's batch checkbox. Locked tables count as ticked, so a
+	 * node whose tables were all already added reads as full rather than empty. */
+	function batchState(
+		datatable: string | undefined,
+		schemaKey?: string
+	): { checked: boolean; indeterminate: boolean; disabled: boolean } {
+		const tables = tablesUnder(datatable, schemaKey)
+		const selectable = tables.filter((t) => !isTableDisabled(t))
+		const n = tables.filter((t) => isTableSelected(t) || isTableDisabled(t)).length
+		return {
+			checked: tables.length > 0 && n === tables.length,
+			indeterminate: n > 0 && n < tables.length,
+			disabled: selectable.length === 0
 		}
 	}
 
-	// Get tables for a schema (filtered by search)
-	function getTablesForSchema(schema: string): string[] {
-		const tables = Object.keys(dbSchema.schema[schema] ?? {})
-		if (search) {
-			return tables.filter((t) => t.toLowerCase().includes(search.toLowerCase())).sort()
-		}
-		return tables.sort()
-	}
-
-	// Check if all selectable tables in a schema are selected
-	function isSchemaFullySelected(schema: string): boolean {
-		const tables = getTablesForSchema(schema)
-		if (tables.length === 0) return false
-		const selectableTables = tables.filter((t) => !isTableDisabled(schema, t))
-		if (selectableTables.length === 0) return true // All disabled means "fully selected"
-		return selectableTables.every((t) => isTableSelected(schema, t))
-	}
-
-	// Check if some (but not all) tables in a schema are selected
-	function isSchemaPartiallySelected(schema: string): boolean {
-		const tables = getTablesForSchema(schema)
-		const selectableTables = tables.filter((t) => !isTableDisabled(schema, t))
-		const selectedCount = selectableTables.filter((t) => isTableSelected(schema, t)).length
-		return selectedCount > 0 && selectedCount < selectableTables.length
-	}
-
-	// Toggle all tables in a schema
-	function toggleSchemaSelection(schema: string) {
-		const tables = getTablesForSchema(schema)
-		const selectableTables = tables.filter((t) => !isTableDisabled(schema, t))
-
-		if (isSchemaFullySelected(schema)) {
-			// Deselect all selectable tables in this schema
-			selectedTables = selectedTables.filter((t) => t.schema !== schema)
+	function toggleBatch(datatable: string | undefined, schemaKey?: string) {
+		const selectable = tablesUnder(datatable, schemaKey).filter((t) => !isTableDisabled(t))
+		if (selectable.every((t) => isTableSelected(t))) {
+			setCheckedTables(checkedTables.filter((s) => !selectable.some((t) => sameTable(s, t))))
 		} else {
-			// Select all selectable tables in this schema
-			const newSelections = selectableTables
-				.filter((t) => !isTableSelected(schema, t))
-				.map((t) => ({ schema, table: t }))
-			selectedTables = [...selectedTables, ...newSelections]
+			const missing = selectable.filter((t) => !isTableSelected(t))
+			setCheckedTables([...checkedTables, ...missing])
 		}
 	}
 
 	let schemaKeys = $derived(Object.keys(dbSchema.schema ?? {}))
+
+	// --- Left-pane tree ---------------------------------------------------------
+	// Levels: data table -> schema -> table. The top two collapse away on their own
+	// terms: no `datatableTree` means this is not a data table, and a database
+	// without schemas has nothing to put between a data table and its tables.
+	const currentDatatable = $derived(asset?.kind === 'datatable' ? asset.path : undefined)
+
+	/** Favourites are keyed by the table's own asset URI, so a row under another
+	 * data table must not borrow the one the manager is currently pointed at. */
+	function tableAssetPath(datatable: string | undefined, schemaKey: string, tableKey: string) {
+		const kind = datatable !== undefined ? 'datatable' : asset!.kind
+		const path = datatable ?? asset!.path
+		return `${kind}://${path === 'main' ? '' : path}/${schemaKey}.${tableKey}`
+	}
+
+	/** Tables per schema for a data table, as `schema -> table[]`. */
+	function schemasOf(datatable: string | undefined): Record<string, string[]> {
+		// The open data table reads from `dbSchema`, which is refetched after a DDL;
+		// the tree snapshot is not, so using it here would hide a table until the
+		// next full reload.
+		if (datatable === undefined || datatable === currentDatatable) {
+			return Object.fromEntries(
+				Object.entries(dbSchema.schema ?? {}).map(([sk, tables]) => [sk, Object.keys(tables ?? {})])
+			)
+		}
+		return datatableTree?.find((d) => d.datatable_name === datatable)?.schemas ?? {}
+	}
+
+	function errorOf(datatable: string): string | undefined {
+		return datatableTree?.find((d) => d.datatable_name === datatable)?.error
+	}
+
+	/** Whether the role this connection uses may create a table in that schema,
+	 * or a schema at all. A plain database reports nothing, and there the buttons
+	 * stay: hiding them on no information would be worse than a refusal. */
+	function canCreateTableIn(datatable: string | undefined, schemaKey: string): boolean {
+		const entry = datatableTree?.find((d) => d.datatable_name === datatable)
+		if (!entry?.creatable_schemas) return true
+		// A schema created since the snapshot is not in it yet; the role just made
+		// it, so it can write to it.
+		if (!(schemaKey in entry.schemas)) return true
+		return entry.creatable_schemas.includes(schemaKey)
+	}
+
+	/** Roles and grants only exist on the instance database, which cloud does not offer. Whether
+	 * the caller may change them is the access editor's to say: it opens read-only for everyone
+	 * else. */
+	function isInstanceDatatable(datatable: string | undefined): boolean {
+		return (
+			!isCloudHosted() && !!datatableTree?.find((d) => d.datatable_name === datatable)?.instance
+		)
+	}
+
+	function canCreateSchemaIn(datatable: string | undefined): boolean {
+		const entry = datatableTree?.find((d) => d.datatable_name === datatable)
+		return entry === undefined || !!entry.can_create_schema
+	}
+
+	/** The role a data table row is reached through, and what it can be switched
+	 * to. `none` is a data table under roles that grants this caller none of them.
+	 * Absent where naming the role says nothing: a data table not under roles, or
+	 * one whose single usable role is already `admin`. */
+	function roleOf(
+		datatable: string
+	): { kind: 'role'; role: string; roles: string[] } | { kind: 'none' } | undefined {
+		const entry = datatableTree?.find((d) => d.datatable_name === datatable)
+		if (!entry?.permissioned || !datatableNameTakesRole(datatable)) return undefined
+		const roles = entry.usable_roles
+		if (roles.length === 0) return { kind: 'none' }
+		const role = (datatable === currentDatatable ? currentRole : undefined) ?? entry.default_role
+		if (roles.length === 1 && roles[0] === ADMIN_DATATABLE_ROLE && role === ADMIN_DATATABLE_ROLE) {
+			return undefined
+		}
+		return { kind: 'role', role, roles }
+	}
+
+	const matchesSearch = (t: string) => t.toLowerCase().includes(search.trim().toLowerCase())
+
+	/** The tree as rendered: only nodes with a matching descendant survive a search. */
+	let treeRoots = $derived.by(() => {
+		const datatables = datatableTree
+			? datatableTree.map((d) => d.datatable_name)
+			: [undefined as string | undefined]
+		return datatables
+			.map((dt) => {
+				const schemas = Object.entries(schemasOf(dt))
+					.map(([schemaKey, tables]) => ({
+						schemaKey,
+						// A schema that matches keeps all of its tables — the search named
+						// the schema, so what is in it is the answer. Copy before sorting:
+						// `tables` belongs to the tree snapshot, which is reactive state.
+						tables: (matchesSearch(schemaKey) ? [...tables] : tables.filter(matchesSearch)).sort()
+					}))
+					.filter(
+						(sc) => search.trim() === '' || matchesSearch(sc.schemaKey) || sc.tables.length > 0
+					)
+				schemas.sort((a, b) => a.schemaKey.localeCompare(b.schemaKey))
+				return { datatable: dt, schemas, error: dt ? errorOf(dt) : undefined }
+			})
+			.filter(
+				// A search narrows the tree to what matched; a data table with no match
+				// left in it would otherwise sit there as an empty row.
+				(root) => search.trim() === '' || root.schemas.length > 0
+			)
+	})
+
+	// Explicit open/closed choices, over a default rule. Storing only the
+	// overrides is what lets the current data table and selected schema — which
+	// default to open — actually be folded; a plain "expanded" set could never
+	// close them, since the default would keep winning.
+	// What the permissions drawer is open on, if anything: a schema, or a table.
+	let aclDrawer = $state<{ datatable: string | undefined; target: AclTarget } | undefined>(
+		undefined
+	)
+
+	let expandOverrides = $state<Map<string, boolean>>(new Map())
+	const nodeKey = (dt: string | undefined, schemaKey?: string) =>
+		`${dt ?? ''}${schemaKey === undefined ? '' : `/${schemaKey}`}`
+
+	function defaultExpanded(dt: string | undefined, schemaKey?: string): boolean {
+		if (dt !== undefined && dt !== currentDatatable) return false
+		return schemaKey === undefined || schemaKey === selected.schemaKey
+	}
+
+	function isExpanded(dt: string | undefined, schemaKey?: string): boolean {
+		// A search narrows the tree to what matched, so everything left is shown.
+		if (search.trim() !== '') return true
+		return expandOverrides.get(nodeKey(dt, schemaKey)) ?? defaultExpanded(dt, schemaKey)
+	}
+
+	function toggle(dt: string | undefined, schemaKey?: string) {
+		const key = nodeKey(dt, schemaKey)
+		const open = expandOverrides.get(key) ?? defaultExpanded(dt, schemaKey)
+		const next = new Map(expandOverrides)
+		next.set(key, !open)
+		expandOverrides = next
+	}
+
+	const rowChevronClass = (open: boolean) =>
+		'shrink-0 text-secondary transition-transform ' + (open ? '' : '-rotate-90')
+
+	/** A favourite says something about the table, so it stays visible; an empty
+	 * star is just an affordance and waits for the pointer. */
+	const rowStarClass = (path: string) =>
+		'-ml-1 w-1 flex shrink-0 transition-opacity ' +
+		(favoriteManager.isStarred(path, 'asset') ? '' : 'opacity-0 group-hover:opacity-100')
+
+	/** Reveal a node, dropping a stale "closed" that would hide a new selection. */
+	function reveal(dt: string | undefined, schemaKey?: string) {
+		const next = new Map(expandOverrides)
+		next.delete(nodeKey(dt))
+		next.delete(nodeKey(dt, schemaKey))
+		expandOverrides = next
+	}
+
+	function selectTable(dt: string | undefined, schemaKey: string, tableKey: string) {
+		if (dt !== undefined && dt !== currentDatatable) {
+			// Switching data table re-mounts this component against the new one, so
+			// the target has to travel through the bound keys the parent keeps —
+			// local state here is about to be thrown away.
+			selectedSchemaKey = schemaKey
+			selectedTableKey = tableKey
+			onSelectDatatable?.(dt)
+			return
+		}
+		reveal(dt, schemaKey)
+		rowFilter = undefined
+		selected = { schemaKey, tableKey }
+	}
+
+	/** Run a row action on the data table it belongs to, switching to it first
+	 * when it is not the one the manager is connected to. */
+	function onDatatable(dt: string | undefined, action: RowAction): boolean {
+		if (dt === undefined || dt === currentDatatable) return true
+		if ('schema' in action) selectedSchemaKey = action.schema
+		if ('table' in action) selectedTableKey = action.table
+		pendingAction = { ...action, datatable: dt }
+		onSelectDatatable?.(dt)
+		return false
+	}
+
+	function startCreateTable(dt: string | undefined, schema: string) {
+		if (!onDatatable(dt, { kind: 'create-table', schema })) return
+		selected = { schemaKey: schema, tableKey: undefined }
+		dbTableEditorState = { open: true }
+	}
+
+	function startCreateSchema(dt: string | undefined) {
+		if (!onDatatable(dt, { kind: 'create-schema' })) return
+		schemaDialog = { mode: 'create' }
+	}
+
+	function startAlterTable(dt: string | undefined, schema: string, table: string) {
+		if (!onDatatable(dt, { kind: 'alter-table', schema, table })) return
+		selected = { schemaKey: schema, tableKey: table }
+		dbTableEditorState = { open: true, alterTableKey: table }
+	}
+
+	function startDeleteTable(dt: string | undefined, schema: string, table: string) {
+		if (!onDatatable(dt, { kind: 'delete-table', schema, table })) return
+		askingForConfirmation = {
+			title: `Are you sure you want to delete ${table} ? This action is irreversible`,
+			confirmationText: 'Delete permanently',
+			open: true,
+			id: 'db-manager-delete-table-confirmation-modal',
+			onConfirm: async () => {
+				askingForConfirmation && (askingForConfirmation.loading = true)
+				try {
+					await dbSchemaOps.onDelete({ tableKey: table, schema })
+					refresh?.()
+					sendUserToast(`Table '${table}' deleted successfully`)
+				} catch (e) {
+					let msg: string | undefined = (e as any).body ?? (e as Error).message
+					if (typeof msg !== 'string') msg = e ? JSON.stringify(e) : undefined
+					sendUserToast(msg ?? 'Action failed!', true)
+				}
+				askingForConfirmation = undefined
+			}
+		}
+	}
+
+	function startRenameSchema(dt: string | undefined, schema: string) {
+		if (!onDatatable(dt, { kind: 'rename-schema', schema })) return
+		schemaDialog = { mode: 'rename', schema }
+		newSchemaName = schema
+	}
+
+	function startDropSchema(dt: string | undefined, schema: string) {
+		if (!onDatatable(dt, { kind: 'drop-schema', schema })) return
+		askingForConfirmation = {
+			title: `Are you sure you want to drop ${schema} ? Everything in it goes with it, and this action is irreversible`,
+			confirmationText: 'Drop permanently',
+			open: true,
+			id: 'db-manager-drop-schema-confirmation-modal',
+			onConfirm: async () => {
+				askingForConfirmation && (askingForConfirmation.loading = true)
+				try {
+					await dbSchemaOps.onDeleteSchema({ schema })
+					refresh?.()
+					sendUserToast(`Schema '${schema}' dropped successfully`)
+				} catch (e) {
+					let msg: string | undefined = (e as any).body ?? (e as Error).message
+					if (typeof msg !== 'string') msg = e ? JSON.stringify(e) : undefined
+					sendUserToast(msg ?? 'Action failed!', true)
+				}
+				askingForConfirmation = undefined
+			}
+		}
+	}
+
+	// Finishes an action requested before the switch, now that this component is
+	// mounted against the data table it targeted.
+	$effect(() => {
+		const req = pendingAction
+		if (!req) return
+		// Landed somewhere else: the target may have failed to load, or the user
+		// may have moved on. Either way this action was asked for on another
+		// database, and dropping a schema is not a thing to do by approximation.
+		// `undefined` is somewhere else too — a plain postgres resource or a
+		// DuckLake — so the two must be equal, not merely not-known-to-differ.
+		if (req.datatable !== currentDatatable) {
+			pendingAction = undefined
+			return
+		}
+		// Creating a schema is the one action a data table with none can still
+		// take, so it must not wait on a schema being there.
+		if (req.kind === 'create-schema') {
+			pendingAction = undefined
+			schemaDialog = { mode: 'create' }
+			return
+		}
+		if (!schemaKeys.length) return
+		pendingAction = undefined
+		if (!schemaKeys.includes(req.schema)) return
+		if (req.kind === 'create-table') startCreateTable(undefined, req.schema)
+		else if (req.kind === 'drop-schema') startDropSchema(undefined, req.schema)
+		else if (req.kind === 'rename-schema') startRenameSchema(undefined, req.schema)
+		else if (req.kind === 'alter-table') startAlterTable(undefined, req.schema, req.table)
+		else startDeleteTable(undefined, req.schema, req.table)
+	})
+
 	let search = $state('')
 	let selected: {
 		schemaKey?: undefined | string
@@ -229,11 +634,6 @@
 			: undefined
 	)
 
-	function selectTable(schemaKey: string | undefined, table: string) {
-		rowFilter = undefined
-		selected = { schemaKey, tableKey: table }
-	}
-
 	/** Where a foreign key's `schema.table` target lives in the sidebar, or
 	 * undefined when it cannot be opened from here. */
 	function resolveForeignKeyTarget(
@@ -261,7 +661,7 @@
 			return
 		}
 		const { schemaKey, table } = resolved
-		selectTable(schemaKey, table)
+		selectTable(currentDatatable, schemaKey, table)
 		rowFilter = {
 			tableKey: dbSupportsSchemas ? `${schemaKey}.${table}` : table,
 			column: target.column,
@@ -296,6 +696,104 @@
 		)
 	})
 
+	// Fetched once for the whole database rather than per table: the diagram needs
+	// every relation at once, and the per-table query would be one job each. A
+	// queued job cannot be recalled, so there is at most one read per database and
+	// metadata, kept across mode changes — not a `resource`, which abandons a run
+	// on any change of its inputs, a toggle included. A read is replaced only by
+	// another database, reloaded metadata, or a retry after failing.
+	type RelationsRead = {
+		databaseKey: string | undefined
+		/** The metadata it was read beside, which is what the cards are built from. */
+		defs: Record<string, ColumnDef[]>
+		token: number
+		status: 'loading' | 'ok' | 'failed'
+		relations: DbRelation[]
+		error?: string
+	}
+	let relationsRead = $state.raw<RelationsRead | undefined>(undefined)
+	let relationsToken = 0
+
+	$effect(() => {
+		const key = databaseKey
+		// The metadata can land after the schema; its arrival re-runs this.
+		const defs = colDefs
+		if (viewMode !== 'diagram' || defs === undefined) return
+		untrack(() => {
+			const current = relationsRead
+			const reusable =
+				!!current &&
+				current.databaseKey === key &&
+				current.defs === defs &&
+				current.status !== 'failed'
+			if (reusable) return
+			const token = ++relationsToken
+			relationsRead = { databaseKey: key, defs, token, status: 'loading', relations: [] }
+			dbSchemaOps.onFetchAllForeignKeys().then(
+				(relations) => settleRelations(token, { status: 'ok', relations }),
+				(e) =>
+					settleRelations(token, {
+						status: 'failed',
+						relations: [],
+						error: (e as any)?.body ?? (e as Error)?.message ?? String(e)
+					})
+			)
+		})
+	})
+
+	/** A read that has since been replaced answers about something no longer shown. */
+	function settleRelations(
+		token: number,
+		outcome: Pick<RelationsRead, 'status' | 'relations' | 'error'>
+	) {
+		if (relationsRead?.token !== token) return
+		relationsRead = { ...relationsRead, ...outcome }
+	}
+
+	// Only ever shown beside the database and metadata it was read from.
+	let shownRelationsRead = $derived(
+		relationsRead?.databaseKey === databaseKey && relationsRead?.defs === colDefs
+			? relationsRead
+			: undefined
+	)
+	let currentRelations = $derived(shownRelationsRead?.relations ?? [])
+
+	/** The schema a database's diagram opens on. `selected.schemaKey` follows the
+	 * tree and is only replaced once it is empty, so after a switch between
+	 * databases it can still name a schema of the previous one; it is taken only
+	 * when this database actually has it. */
+	function schemaToDraw(schema: DBSchema['schema']): string | undefined {
+		const browsed = selected.schemaKey
+		if (browsed && browsed in schema) return browsed
+		return ['public', 'dbo', 'main'].find((s) => s in schema) ?? Object.keys(schema)[0]
+	}
+
+	// Opening the diagram on an empty canvas would make it look broken, so a
+	// database's first draw is that schema — unless it is big enough that drawing
+	// all of it is a choice the user should make. Everything it needs is read
+	// reactively: after a switch the schema arrives late, and counting the draw
+	// done without it is how a database ends up on a blank canvas for good.
+	const DIAGRAM_AUTOSELECT_LIMIT = 40
+	$effect(() => {
+		const key = databaseKey
+		const schema = dbSchema.schema
+		if (viewMode !== 'diagram' || diagram.drawn) return
+		const schemaKey = schemaToDraw(schema)
+		if (!schemaKey) return
+		const tables = Object.keys(schema[schemaKey] ?? {})
+		if (!tables.length) return
+		untrack(() => {
+			diagramState = {
+				databaseKey: key,
+				tables:
+					tables.length > DIAGRAM_AUTOSELECT_LIMIT
+						? []
+						: tables.map((table) => ({ datatable: currentDatatable, schema: schemaKey, table })),
+				drawn: true
+			}
+		})
+	})
+
 	let askingForConfirmation:
 		| (ConfirmationModal['$$prop_def'] & { onConfirm: () => void })
 		| undefined = $state()
@@ -320,9 +818,30 @@
 		}
 	)
 
-	let newSchemaDialogOpen = $state(false)
+	// Naming a schema: a new one, or a new name for one that exists.
+	let schemaDialog = $state<{ mode: 'create' } | { mode: 'rename'; schema: string } | undefined>(
+		undefined
+	)
 	let newSchemaName = $state('')
 
+	/** What the drawer is about, for its title. */
+	function aclLabel(target: AclTarget | undefined): string {
+		if (!target) return ''
+		switch (target.kind) {
+			case 'table':
+				return `${target.schema}.${target.table}`
+			case 'schema':
+				return target.schema
+			default:
+				return 'database'
+		}
+	}
+
+	function closeSchemaDialog() {
+		schemaDialog = undefined
+		newSchemaName = ''
+	}
+
 	// Check if the sanitized schema name already exists
 	const sanitizedNewSchemaName = $derived.by(() => {
 		let s = newSchemaName.trim().replace(/[^a-zA-Z0-9_]/g, '')
@@ -331,296 +850,355 @@
 	})
 	const schemaAlreadyExists = $derived(
 		sanitizedNewSchemaName !== '' &&
-			schemaKeys.map((s) => s.toLowerCase()).includes(sanitizedNewSchemaName.toLowerCase())
+			schemaKeys
+				.filter((s) => !(schemaDialog?.mode === 'rename' && s === schemaDialog.schema))
+				.map((s) => s.toLowerCase())
+				.includes(sanitizedNewSchemaName.toLowerCase())
 	)
 
+	/** The statement the dialog is about to run, which is also what it asks about. */
+	const schemaStatement = $derived(
+		schemaDialog?.mode === 'rename'
+			? `ALTER SCHEMA ${schemaDialog.schema} RENAME TO ${sanitizedNewSchemaName}`
+			: `CREATE SCHEMA ${sanitizedNewSchemaName}`
+	)
+
+	const canSubmitSchemaName = $derived(
+		!!sanitizedNewSchemaName &&
+			!schemaAlreadyExists &&
+			(schemaDialog?.mode !== 'rename' || sanitizedNewSchemaName !== schemaDialog.schema)
+	)
+
+	function submitSchemaName() {
+		const dialog = schemaDialog
+		if (!dialog || !canSubmitSchemaName) return
+		const name = sanitizedNewSchemaName
+		askingForConfirmation = {
+			confirmationText: dialog.mode === 'rename' ? `Rename to ${name}` : `Create ${name}`,
+			type: 'reload',
+			title: `This will run '${schemaStatement}' on your database. Are you sure?`,
+			open: true,
+			id: 'db-schema-name-confirmation-modal',
+			onConfirm: async () => {
+				askingForConfirmation && (askingForConfirmation.loading = true)
+				try {
+					if (dialog.mode === 'rename') {
+						await dbSchemaOps.onRenameSchema({ schema: dialog.schema, newSchema: name })
+					} else {
+						await dbSchemaOps.onCreateSchema({ schema: name })
+					}
+					refresh?.()
+					selected.schemaKey = name
+					closeSchemaDialog()
+				} finally {
+					askingForConfirmation = undefined
+				}
+			}
+		}
+	}
+
 	let _dbTable: DBTable | undefined = $state()
 	export const dbTable = () => _dbTable
 </script>
 
 <Splitpanes>
-	<Pane size={24} class="relative flex flex-col">
+	<Pane size={28} class="relative flex flex-col">
 		<div class="mx-3 mt-3 flex flex-col gap-2">
-			{#if dbSelector}
-				{@render dbSelector()}
-			{/if}
-			{#if dbSupportsSchemas && !multiSelectMode}
-				<Select
-					bind:value={selected.schemaKey}
-					items={safeSelectItems(schemaKeys)}
-					id="db-schema-select"
-					transformInputSelectedText={(s) => `Schema: ${s}`}
-					RightIcon={ChevronDownIcon}
-					placeholder="Search or create schema..."
-					showPlaceholderOnOpen
-					onCreateItem={(schema) => {
-						schema = schema.trim().replace(/[^a-zA-Z0-9_]/g, '')
-						if (dbType === 'snowflake') schema = schema.toUpperCase()
-						askingForConfirmation = {
-							confirmationText: `Create ${schema}`,
-							type: 'reload',
-							title: `This will run 'CREATE SCHEMA ${schema}' on your database. Are you sure ?`,
-							open: true,
-							id: 'db-create-schema-confirmation-modal',
-							onConfirm: async () => {
-								askingForConfirmation && (askingForConfirmation.loading = true)
-								try {
-									await dbSchemaOps.onCreateSchema({ schema })
-									refresh?.()
-									selected.schemaKey = schema
-								} finally {
-									askingForConfirmation = undefined
-								}
-							}
-						}
-					}}
-				/>
-			{/if}
-			<ClearableInput bind:value={search} placeholder="Search table..." />
+			<TextInput bind:value={search} inputProps={{ placeholder: 'Search table or schema...' }} />
 		</div>
-		<div class="overflow-x-clip overflow-y-auto relative mt-3 border-y flex-1">
-			{#if multiSelectMode}
-				<!-- Multi-select mode: show all schemas with their tables -->
-				{#if dbSupportsSchemas}
-					<!-- New schema button -->
+		<div class="overflow-x-clip overflow-y-auto relative mt-1.5 flex-1">
+			<!-- Normal mode: data table -> schema -> table, each level dropping out
+				     when it has nothing to say (no data table / no schemas). -->
+			{#if datatableTreeLoading && (datatableTree?.length ?? 0) === 0}
+				<div class="flex items-center gap-2 text-tertiary p-3">
+					<Loader2 class="animate-spin" size={14} />
+					<span class="text-xs">Loading...</span>
+				</div>
+			{/if}
+			{#each treeRoots as root (root.datatable ?? '')}
+				{@const dtOpen = isExpanded(root.datatable)}
+				{#if root.datatable !== undefined}
+					{@const hasMenu = !multiSelectMode && onDatatableAction !== undefined}
+					{@const roleInfo = roleOf(root.datatable)}
 					<button
-						class="w-full text-sm font-medium flex gap-2 items-center h-9 cursor-pointer pl-3 pr-1 hover:bg-gray-500/10 border-b border-surface-secondary text-tertiary"
-						onclick={() => (newSchemaDialogOpen = true)}
+						class="group w-full text-xs font-normal text-primary flex gap-2 items-center h-8 cursor-pointer pl-3 pr-1 hover:bg-gray-500/10"
+						onclick={() => toggle(root.datatable)}
 					>
-						<Plus class="shrink-0" size={14} />
-						<span class="text-xs">New schema</span>
+						{#if showsCheckbox(root.datatable)}
+							{@const state = batchState(root.datatable)}
+							<Checkbox
+								checked={state.checked}
+								indeterminate={state.indeterminate}
+								disabled={state.disabled}
+								onChange={() => toggleBatch(root.datatable)}
+								onClick={(e) => e.stopPropagation()}
+								class="shrink-0"
+							/>
+						{/if}
+						<ChevronDownIcon class={rowChevronClass(dtOpen)} size={14} />
+						<DatabaseIcon class="shrink-0" size={14} />
+						<span class="truncate text-ellipsis text-left text-xs">{root.datatable}</span>
+						{#if root.datatable === currentDatatable}
+							<!-- Several data tables are listed, but only one is the one being
+							     queried; the tree would otherwise not say which. -->
+							<span
+								class="shrink-0 w-1.5 h-1.5 rounded-full bg-green-400"
+								title="The data table this manager is connected to"
+							></span>
+						{/if}
+						{#if roleInfo?.kind === 'role'}
+							{@const dt = root.datatable}
+							<DatatableRoleBadge
+								role={roleInfo.role}
+								roles={roleInfo.roles}
+								onSelect={(role) => onSelectRole?.(dt, role)}
+							/>
+						{:else if roleInfo?.kind === 'none'}
+							<span
+								class="shrink-0 text-2xs text-tertiary"
+								title="This data table is under roles, and none of them is granted to you. Ask an admin of the workspace that governs it."
+							>
+								No usable role
+							</span>
+						{/if}
+						<div class="grow"></div>
+						<div class="relative shrink-0 w-6 h-8 flex items-center justify-end mr-2">
+							{#if hasMenu}
+								{@const dt = root.datatable}
+								<DropdownV2
+									enableFlyTransition
+									items={() => [
+										{
+											displayName: 'Migrations',
+											icon: HistoryIcon,
+											action: () => onDatatableAction?.(dt, 'migrations')
+										},
+										...(canManageDatatable && isInstanceDatatable(dt)
+											? [
+													{
+														displayName: 'Roles',
+														icon: KeyRoundIcon,
+														action: () => onDatatableAction?.(dt, 'roles')
+													}
+												]
+											: []),
+										{
+											displayName: 'Export',
+											icon: DownloadIcon,
+											action: () => onDatatableAction?.(dt, 'export')
+										},
+										{
+											displayName: 'Import',
+											icon: UploadIcon,
+											action: () => onDatatableAction?.(dt, 'import')
+										}
+									]}
+									btnId={'db-manager-datatable-actions-' + onlyAlphaNumAndUnderscore(dt)}
+								/>
+							{/if}
+						</div>
 					</button>
 				{/if}
-				{#each schemaKeys as schemaKey}
-					{@const schemaTables = getTablesForSchema(schemaKey)}
-					{@const isFullySelected = isSchemaFullySelected(schemaKey)}
-					{@const isPartiallySelected = isSchemaPartiallySelected(schemaKey)}
-					{@const hasNoTables = schemaTables.length === 0}
-					<!-- Schema header with checkbox (or just label if empty) -->
-					<div
-						class="group w-full text-sm font-medium flex gap-2 items-center h-9 cursor-pointer pl-3 pr-1 hover:bg-gray-500/10 border-b border-surface-secondary"
-						role="button"
-						tabindex="0"
-						onclick={() => {
-							if (!hasNoTables) {
-								toggleSchemaSelection(schemaKey)
-							}
-						}}
-						onkeydown={(e) => {
-							if (e.key === 'Enter' || e.key === ' ') {
-								if (!hasNoTables) {
-									toggleSchemaSelection(schemaKey)
-								}
-							}
-						}}
-					>
-						{#if hasNoTables}
-							<!-- Empty schema: no checkbox, just indent space -->
-							<span class="shrink-0 w-4"></span>
-						{:else}
-							<span class="shrink-0">
-								<input
-									type="checkbox"
-									checked={isFullySelected}
-									indeterminate={isPartiallySelected}
-									class="w-4 h-4 cursor-pointer"
-									onclick={(e) => e.stopPropagation()}
-									onchange={() => toggleSchemaSelection(schemaKey)}
-								/>
-							</span>
-						{/if}
-						<span class="truncate text-ellipsis grow text-left text-tertiary text-xs"
-							>{schemaKey}</span
-						>
-						<span class="text-2xs text-tertiary mr-2 group-hover:hidden">
-							{schemaTables.length}
-						</span>
-						<!-- Delete schema button (on hover) -->
-						<button
-							class="hidden group-hover:flex p-1 hover:bg-red-100 dark:hover:bg-red-900/30 rounded transition-colors mr-1"
-							title="Delete schema"
-							onclick={(e) => {
-								e.stopPropagation()
-								askingForConfirmation = {
-									title: `Are you sure you want to delete schema "${schemaKey}"? This will drop all tables in this schema. This action is irreversible.`,
-									confirmationText: 'Drop schema',
-									open: true,
-									onConfirm: async () => {
-										askingForConfirmation && (askingForConfirmation.loading = true)
-										try {
-											await dbSchemaOps.onDeleteSchema({ schema: schemaKey })
-											refresh?.()
-											sendUserToast(`Schema '${schemaKey}' deleted successfully`)
-										} catch (e) {
-											let msg: string | undefined = (e as any).body ?? (e as Error).message
-											if (typeof msg !== 'string') msg = e ? JSON.stringify(e) : undefined
-											sendUserToast(msg ?? 'Action failed!', true)
-										}
-										askingForConfirmation = undefined
-									}
-								}
-							}}
-						>
-							<Trash2Icon size={12} class="text-red-500" />
-						</button>
-					</div>
-					<!-- Tables under this schema -->
-					{#each schemaTables as tableKey}
-						{@const isDisabled = isTableDisabled(schemaKey, tableKey)}
-						{@const isChecked = isTableSelected(schemaKey, tableKey) || isDisabled}
-						{@const isCurrentPreview =
-							selected.schemaKey === schemaKey && selected.tableKey === tableKey}
-						<div
-							class={'group w-full text-sm font-normal flex gap-2 items-center h-8 cursor-pointer pl-7 pr-1 ' +
-								(isCurrentPreview ? 'bg-gray-500/25' : 'hover:bg-gray-500/10') +
-								(isDisabled ? ' opacity-50' : '')}
-							role="button"
-							tabindex="0"
-							onclick={() => {
-								selectTable(schemaKey, tableKey)
-								toggleTableSelection(schemaKey, tableKey)
-							}}
-							onkeydown={(e) => {
-								if (e.key === 'Enter' || e.key === ' ') {
-									selectTable(schemaKey, tableKey)
-									toggleTableSelection(schemaKey, tableKey)
-								}
-							}}
-						>
-							<span class="shrink-0">
-								<input
-									type="checkbox"
-									checked={isChecked}
-									disabled={isDisabled}
-									class="w-4 h-4 cursor-pointer"
-									onclick={(e) => e.stopPropagation()}
-									onchange={() => toggleTableSelection(schemaKey, tableKey)}
-								/>
-							</span>
-							<Table2 class="text-primary shrink-0" size={14} />
-							<p class="truncate text-ellipsis grow text-left text-emphasis text-xs">{tableKey}</p>
-							<!-- Delete table button (on hover) -->
+				{#if dtOpen}
+					{#if root.error}
+						<p class="text-xs text-red-400 px-3 py-2">{root.error}</p>
+					{/if}
+					{#each root.schemas as sc (sc.schemaKey)}
+						{@const schemaOpen = isExpanded(root.datatable, sc.schemaKey)}
+						{@const indent = root.datatable !== undefined ? 'pl-7' : 'pl-3'}
+						{#if dbSupportsSchemas}
 							<button
-								class="hidden group-hover:flex p-1 hover:bg-red-100 dark:hover:bg-red-900/30 rounded transition-colors mr-1"
-								title="Delete table"
-								onclick={(e) => {
-									e.stopPropagation()
-									askingForConfirmation = {
-										title: `Are you sure you want to delete table "${tableKey}"? This action is irreversible.`,
-										confirmationText: 'Drop table',
-										open: true,
-										onConfirm: async () => {
-											askingForConfirmation && (askingForConfirmation.loading = true)
-											try {
-												await dbSchemaOps.onDelete({ tableKey, schema: schemaKey })
-												refresh?.()
-												sendUserToast(`Table '${tableKey}' deleted successfully`)
-											} catch (e) {
-												let msg: string | undefined = (e as any).body ?? (e as Error).message
-												if (typeof msg !== 'string') msg = e ? JSON.stringify(e) : undefined
-												sendUserToast(msg ?? 'Action failed!', true)
-											}
-											askingForConfirmation = undefined
-										}
-									}
-								}}
+								class={'group w-full text-xs font-normal text-primary flex gap-2 items-center h-8 cursor-pointer pr-1 hover:bg-gray-500/10 ' +
+									indent}
+								onclick={() => toggle(root.datatable, sc.schemaKey)}
 							>
-								<Trash2Icon size={12} class="text-red-500" />
-							</button>
-						</div>
-					{/each}
-					<!-- New table button for this schema -->
-					<button
-						class="w-full text-sm font-normal flex gap-2 items-center h-8 cursor-pointer pl-7 pr-1 hover:bg-gray-500/10 text-tertiary"
-						onclick={() => {
-							selected.schemaKey = schemaKey
-							dbTableEditorState = { open: true }
-						}}
-					>
-						<Plus class="shrink-0" size={14} />
-						<span class="text-xs">New table</span>
-					</button>
-				{/each}
-			{:else}
-				<!-- Normal mode: show tables for selected schema -->
-				{#each filteredTableKeys as tableKey}
-					<!-- PLACEHOLDER -->
-					<button
-						class={'w-full text-sm font-normal flex gap-2 items-center h-10 cursor-pointer pl-3 pr-1 ' +
-							(selected.tableKey === tableKey ? 'bg-surface-secondary' : 'hover:bg-surface-hover')}
-						onclick={() => selectTable(selected.schemaKey, tableKey)}
-					>
-						{#if asset}
-							<Star
-								kind="asset"
-								path={`${asset.kind}://${asset.path == 'main' ? '' : asset.path}/${selected.schemaKey}.${tableKey}`}
-							/>
-						{:else}
-							<Table2 class="text-primary shrink-0" size={14} />
-						{/if}
-
-						<p
-							class="db-manager-table-key truncate text-ellipsis grow text-left text-emphasis text-xs"
-						>
-							{tableKey}
-						</p>
-						<DropdownV2
-							items={() => [
-								{
-									displayName: 'Delete table',
-									icon: Trash2Icon,
-									action: () =>
-										(askingForConfirmation = {
-											title: `Are you sure you want to delete ${tableKey} ? This action is irreversible`,
-											confirmationText: 'Delete permanently',
-											open: true,
-											id: 'db-manager-delete-table-confirmation-modal',
-											onConfirm: async () => {
-												askingForConfirmation && (askingForConfirmation.loading = true)
-												try {
-													await dbSchemaOps.onDelete({ tableKey, schema: selected.schemaKey })
-													refresh?.()
-													sendUserToast(`Table '${tableKey}' deleted successfully`)
-												} catch (e) {
-													let msg: string | undefined = (e as any).body ?? (e as Error).message
-													if (typeof msg !== 'string') msg = e ? JSON.stringify(e) : undefined
-													sendUserToast(msg ?? 'Action failed!', true)
+								{#if showsCheckbox(root.datatable)}
+									{@const state = batchState(root.datatable, sc.schemaKey)}
+									<Checkbox
+										checked={state.checked}
+										indeterminate={state.indeterminate}
+										disabled={state.disabled}
+										onChange={() => toggleBatch(root.datatable, sc.schemaKey)}
+										onClick={(e) => e.stopPropagation()}
+										class="shrink-0"
+									/>
+								{/if}
+								<ChevronDownIcon class={rowChevronClass(schemaOpen)} size={14} />
+								<FolderIcon class="shrink-0" size={14} />
+								<span class="truncate text-ellipsis grow text-left text-xs">{sc.schemaKey}</span>
+								<div class="relative shrink-0 w-6 h-8 flex items-center justify-end mr-2">
+									{#if !multiSelectMode}
+										<DropdownV2
+											enableFlyTransition
+											items={() => [
+												...(isInstanceDatatable(root.datatable)
+													? [
+															{
+																displayName: 'Access',
+																icon: KeyRoundIcon,
+																action: () =>
+																	(aclDrawer = {
+																		datatable: root.datatable,
+																		target: { kind: 'schema', schema: sc.schemaKey }
+																	})
+															}
+														]
+													: []),
+												...(SCHEMA_RENAME_DB_TYPES.includes(dbType)
+													? [
+															{
+																displayName: 'Rename schema',
+																icon: EditIcon,
+																action: () => startRenameSchema(root.datatable, sc.schemaKey)
+															}
+														]
+													: []),
+												{
+													displayName: 'Drop schema',
+													icon: Trash2Icon,
+													type: 'delete',
+													action: () => startDropSchema(root.datatable, sc.schemaKey)
 												}
-												askingForConfirmation = undefined
-											}
-										})
-								},
-								{
-									displayName: 'Alter table',
-									icon: EditIcon,
-									action: () => {
-										dbTableEditorState = {
-											open: true,
-											alterTableKey: tableKey
-										}
-									}
-								}
-							]}
-							class="w-fit"
-							btnId={'db-manager-table-actions-' + onlyAlphaNumAndUnderscore(tableKey)}
-						/>
-					</button>
-				{/each}
-			{/if}
+											]}
+											btnId={'db-manager-schema-actions-' + onlyAlphaNumAndUnderscore(sc.schemaKey)}
+										/>
+									{/if}
+								</div>
+							</button>
+						{/if}
+						<!-- Opening a schema slides its tables in rather than snapping them. -->
+						<ResizeTransitionWrapper vertical innerClass="w-full">
+							{#if schemaOpen || !dbSupportsSchemas}
+								{@const tableIndent = dbSupportsSchemas
+									? root.datatable !== undefined
+										? 'pl-11'
+										: 'pl-7'
+									: root.datatable !== undefined
+										? 'pl-7'
+										: 'pl-3'}
+								{#each sc.tables as tableKey (tableKey)}
+									{@const entry = {
+										datatable: root.datatable,
+										schema: sc.schemaKey,
+										table: tableKey
+									}}
+									{@const hasMenu = !multiSelectMode}
+									{@const isSelected =
+										root.datatable === currentDatatable &&
+										selected.schemaKey === sc.schemaKey &&
+										selected.tableKey === tableKey}
+									<button
+										class={'group w-full text-xs font-normal text-primary flex gap-2 items-center h-8 cursor-pointer pr-1 ' +
+											tableIndent +
+											' ' +
+											(isSelected ? 'bg-surface-secondary' : 'hover:bg-surface-hover')}
+										onclick={() => onTableRowClick(entry)}
+									>
+										{#if showsCheckbox(root.datatable)}
+											<Checkbox
+												checked={isTableSelected(entry) || isTableDisabled(entry)}
+												disabled={isTableDisabled(entry)}
+												title={isTableDisabled(entry) ? 'Already added' : undefined}
+												onChange={() => toggleTableSelection(entry)}
+												onClick={(e) => e.stopPropagation()}
+												class="shrink-0"
+											/>
+										{/if}
+										<span class="shrink-0 w-3.5"></span>
+										<Table2 class="shrink-0" size={14} />
+										<p class="db-manager-table-key truncate text-ellipsis text-left text-xs">
+											{tableKey}
+										</p>
+										{#if asset}
+											{@const starPath = tableAssetPath(root.datatable, sc.schemaKey, tableKey)}
+											<span class={rowStarClass(starPath)}>
+												<Star size={14} kind="asset" path={starPath} />
+											</span>
+										{/if}
+										<div class="grow"></div>
+										<div class="relative shrink-0 w-6 h-8 flex items-center justify-end mr-2">
+											{#if hasMenu}
+												<DropdownV2
+													enableFlyTransition
+													items={() => [
+														...(isInstanceDatatable(root.datatable)
+															? [
+																	{
+																		displayName: 'Access',
+																		icon: KeyRoundIcon,
+																		action: () =>
+																			(aclDrawer = {
+																				datatable: root.datatable,
+																				target: {
+																					kind: 'table',
+																					schema: sc.schemaKey,
+																					table: tableKey
+																				}
+																			})
+																	}
+																]
+															: []),
+														{
+															displayName: 'Delete table',
+															icon: Trash2Icon,
+															action: () => startDeleteTable(root.datatable, sc.schemaKey, tableKey)
+														},
+														{
+															displayName: 'Alter table',
+															icon: EditIcon,
+															action: () => startAlterTable(root.datatable, sc.schemaKey, tableKey)
+														}
+													]}
+													btnId={'db-manager-table-actions-' + onlyAlphaNumAndUnderscore(tableKey)}
+												/>
+											{/if}
+										</div>
+									</button>
+								{/each}
+								{#if canCreateTableIn(root.datatable, sc.schemaKey)}
+									<button
+										class={'w-full text-xs font-normal flex gap-2 items-center h-8 cursor-pointer pr-1 hover:bg-gray-500/10 text-secondary ' +
+											tableIndent}
+										onclick={() => startCreateTable(root.datatable, sc.schemaKey)}
+									>
+										<Plus class="shrink-0" size={14} />
+										<span class="text-xs">New table</span>
+									</button>
+								{/if}
+							{/if}
+						</ResizeTransitionWrapper>
+					{/each}
+					{#if dbSupportsSchemas && search.trim() === '' && canCreateSchemaIn(root.datatable)}
+						<button
+							class={'w-full text-xs font-normal flex gap-2 items-center h-8 cursor-pointer pr-1 hover:bg-gray-500/10 text-secondary ' +
+								(root.datatable !== undefined ? 'pl-7' : 'pl-3')}
+							onclick={() => startCreateSchema(root.datatable)}
+						>
+							<Plus class="shrink-0" size={14} />
+							<span class="text-xs">New schema</span>
+						</button>
+					{/if}
+				{/if}
+			{/each}
 		</div>
-		{#if !multiSelectMode}
-			<Button
-				on:click={() => (dbTableEditorState = { open: true })}
-				wrapperClasses="mx-2 my-2 text-sm"
-				startIcon={{ icon: Plus }}
-				variant={tableKeys.length === 0 ? 'accent' : 'default'}
-			>
-				New table
-			</Button>
-		{/if}
 	</Pane>
-	<Pane class="p-3 pt-1">
-		{#if tableKey && colDefs?.[tableKey]?.length}
+	<Pane class={viewMode === 'diagram' && !mainPane ? '' : 'p-3 pt-1'}>
+		{#if mainPane}
+			{@render mainPane()}
+		{:else if viewMode === 'diagram'}
+			<DbSchemaDiagram
+				{dbSchema}
+				{colDefs}
+				selectedTables={diagramTables}
+				relations={currentRelations}
+				loading={shownRelationsRead?.status === 'loading'}
+				error={shownRelationsRead?.error}
+				onOpenTable={({ schema, table }) => {
+					onViewMode?.('data')
+					selectTable(currentDatatable, schema, table)
+				}}
+			/>
+		{:else if tableKey && colDefs?.[tableKey]?.length}
 			{@const dbTableOps = dbTableOpsFactory({ colDefs: colDefs[tableKey], tableKey, whereClause })}
 			<DBTable
 				{dbTableOps}
@@ -644,7 +1222,7 @@
 								Import schema from database
 							</span>
 						</button>
-						{#if !!$userStore?.is_admin || !!$superadmin}
+						{#if !!actingUser?.is_admin || !!$superadmin}
 							<button
 								onclick={() => onImport('schema_and_data')}
 								class="hover:opacity-70 transition-opacity rounded-md border aspect-square w-52 gap-4 p-4 center-center flex-col"
@@ -663,6 +1241,23 @@
 </Splitpanes>
 
 <Portal>
+	<Drawer open={!!aclDrawer} size="900px" on:close={() => (aclDrawer = undefined)}>
+		<DrawerContent
+			title="Access — {aclLabel(aclDrawer?.target)}"
+			on:close={() => (aclDrawer = undefined)}
+			tooltip="Who owns this, and what each role may do with it."
+		>
+			{#if aclDrawer && workspace}
+				{@const dt = aclDrawer.datatable ?? currentDatatable}
+				{#if dt}
+					{#key `${dt}~${JSON.stringify(aclDrawer.target)}`}
+						<PgAclEditor {workspace} datatable={dt} target={aclDrawer.target} />
+					{/key}
+				{/if}
+			{/if}
+		</DrawerContent>
+	</Drawer>
+
 	<ConfirmationModal
 		{...askingForConfirmation ?? { confirmationText: '', title: '' }}
 		on:canceled={() => (askingForConfirmation = undefined)}
@@ -750,20 +1345,12 @@
 	</DrawerContent>
 </Drawer>
 
-<Drawer
-	size="400px"
-	open={newSchemaDialogOpen}
-	on:close={() => {
-		newSchemaDialogOpen = false
-		newSchemaName = ''
-	}}
->
+<Drawer size="400px" open={!!schemaDialog} on:close={closeSchemaDialog}>
 	<DrawerContent
-		on:close={() => {
-			newSchemaDialogOpen = false
-			newSchemaName = ''
-		}}
-		title="Create a new schema"
+		on:close={closeSchemaDialog}
+		title={schemaDialog?.mode === 'rename'
+			? `Rename ${schemaDialog.schema}`
+			: 'Create a new schema'}
 	>
 		<div class="flex flex-col gap-4">
 			<div>
@@ -775,27 +1362,7 @@
 					placeholder="Enter schema name..."
 					autofocus
 					on:keydown={(e) => {
-						if (e.key === 'Enter' && sanitizedNewSchemaName && !schemaAlreadyExists) {
-							askingForConfirmation = {
-								confirmationText: `Create ${sanitizedNewSchemaName}`,
-								type: 'reload',
-								title: `This will run 'CREATE SCHEMA ${sanitizedNewSchemaName}' on your database. Are you sure?`,
-								open: true,
-								id: 'db-create-schema-confirmation-modal',
-								onConfirm: async () => {
-									askingForConfirmation && (askingForConfirmation.loading = true)
-									try {
-										await dbSchemaOps.onCreateSchema({ schema: sanitizedNewSchemaName })
-										refresh?.()
-										selected.schemaKey = sanitizedNewSchemaName
-										newSchemaDialogOpen = false
-										newSchemaName = ''
-									} finally {
-										askingForConfirmation = undefined
-									}
-								}
-							}
-						}
+						if (e.key === 'Enter') submitSchemaName()
 					}}
 				/>
 				{#if schemaAlreadyExists}
@@ -810,32 +1377,8 @@
 			</div>
 		</div>
 		{#snippet actions()}
-			<Button
-				color="blue"
-				disabled={!sanitizedNewSchemaName || schemaAlreadyExists}
-				on:click={() => {
-					askingForConfirmation = {
-						confirmationText: `Create ${sanitizedNewSchemaName}`,
-						type: 'reload',
-						title: `This will run 'CREATE SCHEMA ${sanitizedNewSchemaName}' on your database. Are you sure?`,
-						open: true,
-						id: 'db-create-schema-confirmation-modal',
-						onConfirm: async () => {
-							askingForConfirmation && (askingForConfirmation.loading = true)
-							try {
-								await dbSchemaOps.onCreateSchema({ schema: sanitizedNewSchemaName })
-								refresh?.()
-								selected.schemaKey = sanitizedNewSchemaName
-								newSchemaDialogOpen = false
-								newSchemaName = ''
-							} finally {
-								askingForConfirmation = undefined
-							}
-						}
-					}
-				}}
-			>
-				Create schema
+			<Button variant="accent" disabled={!canSubmitSchemaName} on:click={submitSchemaName}>
+				{schemaDialog?.mode === 'rename' ? 'Rename schema' : 'Create schema'}
 			</Button>
 		{/snippet}
 	</DrawerContent>
diff --git a/frontend/src/lib/components/DBManagerContent.svelte b/frontend/src/lib/components/DBManagerContent.svelte
index b0ef2859df..b88b1d1510 100644
--- a/frontend/src/lib/components/DBManagerContent.svelte
+++ b/frontend/src/lib/components/DBManagerContent.svelte
@@ -1,16 +1,21 @@
 <script lang="ts">
-	import { dbSchemas, workspaceStore, type DBSchema } from '$lib/stores'
+	import { dbSchemas, type DBSchema } from '$lib/stores'
+	import type { DataTableTables } from '$lib/gen'
 	import { sortArray } from '$lib/utils'
 	import { Loader2, RefreshCcw } from 'lucide-svelte'
 	import Alert from './common/alert/Alert.svelte'
 	import Button from './common/button/Button.svelte'
-	import { dbSupportsSchemas } from './apps/components/display/dbtable/utils'
+	import {
+		dbSupportsSchemas,
+		getLanguageByResourceType
+	} from './apps/components/display/dbtable/utils'
 	import DbManager from './DBManager.svelte'
 	import DbWorkerTagPicker from './DbWorkerTagPicker.svelte'
 	import MissingWorkerTagAlert from './jobs/MissingWorkerTagAlert.svelte'
 	import {
 		dbSchemaOpsWithPreviewScripts,
 		dbTableOpsWithPreviewScripts,
+		getDatabaseArg,
 		getDbType,
 		getDefaultDbTag,
 		getDucklakeSchema
@@ -18,17 +23,20 @@
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import SqlRepl from './SqlRepl.svelte'
 	import SimpleAgTable from './SimpleAgTable.svelte'
-	import { type Snippet } from 'svelte'
-	import type { DbInput } from './dbTypes'
+	import type { DatatableRowAction, DbInput } from './dbTypes'
+	import { schemaCacheKey } from './dbSchemaCache'
 	import { getDbSchemas, loadAllTablesMetaData } from './apps/components/display/dbtable/metadata'
 
-	import type { SelectedTable } from './DBManager.svelte'
+	import type { DbManagerViewMode, PendingRowAction, SelectedTable } from './DBManager.svelte'
 	import { getDbFeatures } from './apps/components/display/dbtable/dbFeatures'
 	import { resource } from 'runed'
 	import ConfirmationModal from './common/confirmationModal/ConfirmationModal.svelte'
 	import { createAsyncConfirmationModal } from './common/confirmationModal/asyncConfirmationModal.svelte'
 	import Portal from '$lib/components/Portal.svelte'
 	import { outOfOrderRunMessage } from './workspaceSettings/datatableMigrationUtils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		input?: DbInput
@@ -36,7 +44,15 @@
 		hasReplResult?: boolean
 		selectedSchemaKey?: string | undefined
 		selectedTableKey?: string | undefined
-		dbSelector?: Snippet<[]>
+		/** Every data table with its schemas and tables, for the left-pane tree. Undefined when
+		 * the manager is not on a data table, which drops the tree's top level. */
+		datatableTree?: DataTableTables[]
+		datatableTreeLoading?: boolean
+		onSelectDatatable?: (datatable: string) => void
+		onSelectRole?: (datatable: string, role: string) => void
+		pendingAction?: PendingRowAction | undefined
+		onDatatableAction?: (datatable: string, action: DatatableRowAction) => void
+		canManageDatatable?: boolean
 		/** Enable multi-select mode with checkboxes in sidebar */
 		multiSelectMode?: boolean
 		/** Selected tables in multi-select mode */
@@ -44,13 +60,15 @@
 		/** Tables that are already added and should show as disabled */
 		disabledTables?: SelectedTable[]
 		onImport?: (mode: 'schema_and_data' | 'schema_only') => void
-		/** Workspace the datatable/schema lookups run against. Defaults to the
-		 *  navigation `$workspaceStore`; pass the acting workspace when embedded in
-		 *  a session preview whose workspace differs from the top nav. */
+		/** Workspace the datatable/schema lookups run against. Defaults to the operating
+		 *  workspace (see `useOperatingWorkspace`). */
 		workspace?: string
 		/** Worker tag every job of this manager runs on, overriding the database
 		 *  language's native tag. Bound so the hints below can offer to set it. */
 		workerTag?: string
+		/** Which view the right pane shows, set by the control the caller renders. */
+		requestedViewMode?: DbManagerViewMode
+		onViewMode?: (mode: DbManagerViewMode) => void
 	}
 
 	let {
@@ -59,44 +77,44 @@
 		hasReplResult = $bindable(false),
 		selectedSchemaKey = $bindable(undefined),
 		selectedTableKey = $bindable(undefined),
-		dbSelector,
+		datatableTree,
+		datatableTreeLoading,
+		onSelectDatatable,
+		onSelectRole,
+		pendingAction = $bindable(),
+		onDatatableAction,
+		canManageDatatable,
 		multiSelectMode = false,
 		selectedTables = $bindable([]),
 		disabledTables = [],
 		onImport,
 		workspace = undefined,
-		workerTag = $bindable()
+		workerTag = $bindable(),
+		requestedViewMode,
+		onViewMode
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
-	let dbSchema: DBSchema | undefined = $derived(input && $dbSchemas[schemaCacheKey(input)])
+	let dbSchema: DBSchema | undefined = $derived(input && $dbSchemas[schemaCacheKey(ws, input)])
 
 	const outOfOrderModal = createAsyncConfirmationModal()
 
-	function getDbSchemasPath(input: DbInput): string {
-		switch (input.type) {
-			case 'database':
-				return input.resourcePath
-			case 'ducklake':
-				return 'ducklake://' + input.ducklake
-		}
-	}
-
-	// Scope the shared `dbSchemas` cache by the acting workspace: a datatable of
-	// the same name can exist in both the nav and the acting workspace, so the
-	// bare resource path alone would let one workspace's schema be reused for the
-	// other while DB operations target the acting one.
-	function schemaCacheKey(input: DbInput): string {
-		return `${ws}:${getDbSchemasPath(input)}`
-	}
-
 	// Reported in place of the loading spinner: both queries run as jobs, so
 	// anything from a bad connection to a tag no worker serves surfaces here
 	// instead of leaving the manager spinning with no explanation. Each query
 	// owns its slot so neither can clear the other's error on a refetch.
 	let schemaError = $state<string | undefined>(undefined)
 	let colDefsError = $state<string | undefined>(undefined)
+	function emptySchemaFor(db: DbInput): DBSchema {
+		return {
+			lang: db.type === 'ducklake' ? 'ducklake' : getLanguageByResourceType(db.resourceType),
+			schema: {},
+			publicOnly: undefined,
+			stringified: ''
+		} as DBSchema
+	}
+
 	let loadError = $derived(
 		schemaError
 			? { title: 'Could not load the database schema', message: schemaError }
@@ -119,9 +137,10 @@
 			const run = ++colDefsRun
 			colDefsError = undefined
 			if (!input) return
+			const databaseKey = schemaCacheKey(ws, input)
 			try {
 				const metadata = await loadAllTablesMetaData(ws, input, workerTag)
-				return run === colDefsRun ? metadata : colDefs.current
+				return run === colDefsRun ? { databaseKey, metadata } : colDefs.current
 			} catch (e) {
 				if (run !== colDefsRun) return colDefs.current
 				colDefsError = 'Error loading tables metadata: ' + ((e as Error)?.message || e)
@@ -129,6 +148,14 @@
 			}
 		}
 	)
+	// A resource keeps its previous value while it refetches, and after a switch of
+	// database that value is the previous database's metadata. Handed down as this
+	// one's, it would draw that database's columns and key work to the wrong one.
+	let colDefsOfInput = $derived(
+		input && colDefs.current?.databaseKey === schemaCacheKey(ws, input)
+			? colDefs.current.metadata
+			: undefined
+	)
 
 	let dbSchemasPromise = resource(
 		() => [input, ws, workerTag],
@@ -136,14 +163,23 @@
 			const run = ++schemaRun
 			schemaError = undefined
 			if (!input) return
-			const dbSchemasPath = schemaCacheKey(input)
+			const dbSchemasPath = schemaCacheKey(ws, input)
 			if (input.type == 'database') {
+				let connection = input.resourcePath
+				try {
+					// The role'd reference, validated: an invalid role fails here rather than
+					// reading the schema as the data table's default role.
+					if (connection.startsWith('datatable://')) connection = getDatabaseArg(input).database!
+				} catch (e) {
+					schemaError = (e as Error)?.message ?? String(e)
+					return
+				}
 				// Reported through a local, not `schemaError` directly, so a superseded
 				// run's callback can't fail a load that already succeeded.
 				let queryError: string | undefined
 				const schema = await getDbSchemas(
 					input.resourceType,
-					input.resourcePath,
+					connection,
 					ws,
 					(message: string) => (queryError = message),
 					{ customTag: workerTag }
@@ -223,17 +259,23 @@
 	}}
 />
 
-<!-- The error branch comes first on purpose: `dbSchema` is read from a cache that
-	survives a failed refetch, so ordering it first would hide the failure behind
-	stale content. -->
-{#if loadError}
+<!-- A load error replaces only the data pane: the tree, its role badge and menus, and the REPL
+	stay usable, so another data table or role can be picked and the connection tried by hand.
+	The tree then gets an empty schema: the cached one survives a failed refetch and would pass
+	stale content off as what this connection reaches. -->
+{#snippet errorPane()}
 	<div class="h-full w-full flex flex-col items-center justify-center gap-3 p-8">
 		<div class="max-w-2xl w-full flex flex-col gap-3">
-			<Alert type="error" title={loadError.title} size="xs">
-				{loadError.message}
+			<Alert type="error" title={loadError?.title ?? ''} size="xs">
+				{loadError?.message}
 			</Alert>
 			<div class="self-start">
-				<Button size="xs" color="light" startIcon={{ icon: RefreshCcw }} on:click={() => refresh()}>
+				<Button
+					unifiedSize="sm"
+					variant="default"
+					startIcon={{ icon: RefreshCcw }}
+					on:click={() => refresh()}
+				>
 					Retry
 				</Button>
 			</div>
@@ -247,9 +289,12 @@
 			/>
 		</div>
 	</div>
-{:else if dbSchema && ws && input}
+{/snippet}
+
+{#if (loadError || dbSchema) && ws && input}
 	{@const _input = input}
 	{@const dbType = getDbType(_input)}
+	{@const shownSchema = loadError || !dbSchema ? emptySchemaFor(_input) : dbSchema}
 	<Splitpanes horizontal>
 		<Pane class="relative">
 			<!-- svelte-ignore a11y_click_events_have_key_events -->
@@ -273,10 +318,15 @@
 				{/if}
 			</div>
 			<DbManager
+				{requestedViewMode}
+				{onViewMode}
+				databaseKey={schemaCacheKey(ws, _input)}
 				dbSupportsSchemas={dbSupportsSchemas(dbType)}
-				databaseIsEmpty={!Object.values(dbSchema.schema).flatMap((s) => Object.values(s)).length}
-				{dbSchema}
-				colDefs={colDefs.current}
+				databaseIsEmpty={!loadError &&
+					!Object.values(shownSchema.schema).flatMap((s) => Object.values(s)).length}
+				dbSchema={shownSchema}
+				mainPane={loadError ? errorPane : undefined}
+				colDefs={loadError ? undefined : colDefsOfInput}
 				dbTableOpsFactory={({ colDefs, tableKey, whereClause }) =>
 					dbTableOpsWithPreviewScripts({
 						colDefs,
@@ -306,7 +356,15 @@
 						: undefined}
 				{dbType}
 				refresh={() => refresh()}
-				{dbSelector}
+				{datatableTree}
+				{datatableTreeLoading}
+				{onSelectDatatable}
+				{onSelectRole}
+				workspace={ws}
+				currentRole={input.type === 'database' ? input.role : undefined}
+				bind:pendingAction
+				{onDatatableAction}
+				{canManageDatatable}
 				{onImport}
 				bind:selectedSchemaKey
 				bind:selectedTableKey
@@ -329,12 +387,12 @@
 					onSchemaChange={() => refresh()}
 					placeholderTableName={sortArray(
 						Object.keys(
-							dbSchema?.schema[
-								'public' in dbSchema?.schema
+							shownSchema.schema[
+								'public' in shownSchema.schema
 									? 'public'
-									: 'dbo' in dbSchema?.schema
+									: 'dbo' in shownSchema.schema
 										? 'dbo'
-										: Object.keys(dbSchema?.schema ?? {})?.[0]
+										: Object.keys(shownSchema.schema ?? {})?.[0]
 							] ?? {}
 						)
 					)?.[0]}
diff --git a/frontend/src/lib/components/DBManagerDrawer.svelte b/frontend/src/lib/components/DBManagerDrawer.svelte
index 4cac116f06..2d4060a59c 100644
--- a/frontend/src/lib/components/DBManagerDrawer.svelte
+++ b/frontend/src/lib/components/DBManagerDrawer.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
-	import { superadmin, userStore, workspaceStore } from '$lib/stores'
-	import { WorkspaceService } from '$lib/gen'
+	import { enterpriseLicense, superadmin, userStore, workspaceStore } from '$lib/stores'
+	import { WorkspaceService, type DataTableTables } from '$lib/gen'
+	import { listUsableDatatableRoles } from './datatableUsableRoles'
 	import Button from './common/button/Button.svelte'
 	import Drawer from './common/drawer/Drawer.svelte'
 	import DrawerContent from './common/drawer/DrawerContent.svelte'
@@ -10,16 +11,29 @@
 		Copy,
 		Download,
 		Expand,
-		LoaderCircle,
 		Minimize,
+		Network,
 		RefreshCcw,
+		Table2,
 		Upload
 	} from 'lucide-svelte'
 	import DBManagerContent from './DBManagerContent.svelte'
+	import type { DbManagerViewMode, PendingRowAction } from './DBManager.svelte'
+	import ToggleButtonGroup from './common/toggleButton-v2/ToggleButtonGroup.svelte'
+	import ToggleButton from './common/toggleButton-v2/ToggleButton.svelte'
+	import { logFeatureUsage } from '$lib/utils/featureUsage'
+	import { getDbType } from './dbOps'
 	import DataTableMigrationsButton from './workspaceSettings/DataTableMigrationsButton.svelte'
+	import DataTablePermissionsButton from './workspaceSettings/DataTablePermissionsButton.svelte'
 	import { resource } from 'runed'
-	import { untrack } from 'svelte'
+	import { tick, untrack } from 'svelte'
 	import type { DbManagerUriState } from './dbManagerDrawerModel.svelte'
+	import {
+		ADMIN_DATATABLE_ROLE,
+		datatableNameTakesRole,
+		defaultMigrationRole,
+		type DatatableRowAction
+	} from './dbTypes'
 	import ResourcePicker from './ResourcePicker.svelte'
 	import Alert from './common/alert/Alert.svelte'
 	import { sendUserToast } from '$lib/toast'
@@ -41,31 +55,122 @@
 	// the editor that opened it (set via openDrawer), else the nav workspace.
 	let ws = $derived(uriState.workspace ?? $workspaceStore)
 
-	// Load available datatables when drawer opens with datatable input
-	const datatables = resource<string[]>([], async () => {
-		if (!ws) return []
-		try {
-			return (await WorkspaceService.listDataTables({ workspace: ws })).map((d) => d.name)
-		} catch (e) {
-			console.error('Failed to load datatables:', e)
-			return []
-		}
-	})
+	// A create started on a data table other than the current one: survives the
+	// re-mount the switch causes.
+	let pendingAction = $state<PendingRowAction | undefined>(undefined)
 
-	const datatableItems = $derived(
-		datatables.current.map((dt) => ({
-			value: dt,
-			label: dt
-		}))
+	// Read once through primitives: the getters return values of a freshly parsed URL, which
+	// changes on every table click, and the listings below must not refetch for that.
+	const selectedDatatable = $derived(uriState.selectedDatatable)
+	const selectedRole = $derived(uriState.selectedRole)
+
+	// Roles the caller may use, to settle the role before anything connects. Offering only
+	// these is a convenience: the server refuses any other.
+	const usableRoles = resource(
+		() => [ws, selectedDatatable] as const,
+		async ([workspace, datatable]) => {
+			if (!workspace || !datatable) return undefined
+			try {
+				return {
+					workspace,
+					datatable,
+					...(await listUsableDatatableRoles(workspace, datatable))
+				}
+			} catch (e) {
+				// Never leave the drawer waiting on this: fall back to the
+				// unpermissioned shape so it opens and the server picks the role.
+				console.error('Failed to load datatable roles:', e)
+				return {
+					workspace,
+					datatable,
+					permissioned: false,
+					roles: [],
+					default_role: ADMIN_DATATABLE_ROLE
+				}
+			}
+		}
 	)
 
-	// Refetch datatables when switching to a datatable input
+	// A resource keeps its previous value while refetching, and roles are per data table of one
+	// workspace: settling from another answer would connect to this data table as a role it may
+	// not even have.
+	const rolesOfCurrent = $derived(
+		usableRoles.current?.datatable === selectedDatatable && usableRoles.current?.workspace === ws
+			? usableRoles.current
+			: undefined
+	)
+
+	// Nothing that connects runs until the role is settled: a first round sent without a role
+	// would run — and cache — as whatever the server defaults to.
+	const roleSettled = $derived(
+		!uriState.isDatatableInput ||
+			(rolesOfCurrent !== undefined &&
+				(!rolesOfCurrent.permissioned ||
+					rolesOfCurrent.roles.length === 0 ||
+					selectedRole !== undefined ||
+					// Its reference cannot name a role, so it connects as the default one.
+					(selectedDatatable !== undefined && !datatableNameTakesRole(selectedDatatable))))
+	)
+
+	// Make the role explicit before anything queries the data table, so the URL, the
+	// cache and every migration the manager writes name it. A role already in the URL
+	// is kept even when it is not usable: the server refuses it, visibly.
 	$effect(() => {
-		if (uriState.isDatatableInput) {
-			untrack(() => datatables.refetch())
-		}
+		const roles = rolesOfCurrent
+		if (
+			!roles?.permissioned ||
+			selectedRole !== undefined ||
+			(selectedDatatable !== undefined && !datatableNameTakesRole(selectedDatatable))
+		)
+			return
+		const effective = roles.roles.includes(roles.default_role) ? roles.default_role : roles.roles[0]
+		if (effective) untrack(() => (uriState.selectedRole = effective))
 	})
 
+	const contentInput = $derived.by(() => {
+		const input = uriState.effectiveInput
+		if (input?.type !== 'database' || selectedDatatable === undefined) return input
+		const migrationRole = defaultMigrationRole(
+			selectedDatatable,
+			rolesOfCurrent?.permissioned,
+			rolesOfCurrent?.default_role
+		)
+		return migrationRole === undefined ? input : { ...input, migrationRole }
+	})
+
+	// Every data table with its schemas and tables, in one call: this is what the
+	// left pane's tree navigates, so it has to cover the data tables the user is
+	// not currently on, not just the selected one. The privileges it reports are
+	// the connected role's, so the role picked on the open data table is part of
+	// what is being asked. Gated on the drawer being open on a data table: this
+	// reaches every data table's database in turn, and the component is mounted on
+	// every logged-in page.
+	let datatablesRun = 0
+	const datatables = resource(
+		() =>
+			[
+				open && uriState.isDatatableInput,
+				ws,
+				selectedDatatable,
+				selectedRole,
+				roleSettled
+			] as const,
+		async ([active, workspace, roleFor, role, settled]): Promise<DataTableTables[]> => {
+			if (!active || !workspace) return []
+			if (!settled) return untrack(() => datatables.current)
+			const run = ++datatablesRun
+			try {
+				const result = await WorkspaceService.listDataTableTables({ workspace, roleFor, role })
+				// An answer for a selection that has since changed describes another role.
+				return run === datatablesRun ? result : untrack(() => datatables.current)
+			} catch (e) {
+				console.error('Failed to load datatables:', e)
+				return run === datatablesRun ? [] : untrack(() => datatables.current)
+			}
+		},
+		{ initialValue: [] }
+	)
+
 	function handleClose() {
 		uriState.closeDrawer()
 		dbManagerContent?.clearReplResult()
@@ -78,6 +183,10 @@
 		if (!open) {
 			expand = false
 			uriState.closeDrawer()
+			// An action asked for on one data table must not be waiting when the
+			// drawer is next opened on another database — or on no data table at
+			// all, where nothing would recognise it as foreign.
+			pendingAction = undefined
 		}
 	})
 
@@ -91,12 +200,24 @@
 
 	let hasReplResult = $state(false)
 
+	// Which view the manager shows. Held here, beside the control that switches it
+	// and outside the key that remounts the manager, so picking another data table
+	// or role stays on the view the user was reading.
+	let requestedViewMode = $state<DbManagerViewMode>('data')
+	// Only PostgreSQL has a diagram; the manager clamps the mode itself, and this
+	// keeps the control off the header for a database that cannot show one.
+	let diagramSupported = $derived(
+		!!uriState.effectiveInput && getDbType(uriState.effectiveInput) === 'postgresql'
+	)
+
 	// Export/Import state
 	let exportDrawerOpen = $state(false)
 	let exportResult = $state('')
 	let importDrawerOpen = $state(false)
 	let importLoading = $state(false)
 	let importSource = $state<string | undefined>(undefined)
+	/** Which database an import writes into; set when driven from a tree row. */
+	let importTarget = $state<string | undefined>(undefined)
 	let importBehavior = $state<'schema_only' | 'schema_and_data'>('schema_only')
 
 	let isPostgresqlInput = $derived(
@@ -116,13 +237,49 @@
 		return toSourceIdentifier(input.resourcePath)
 	}
 
+	// The tree's row menus act on the data table of the row that was clicked, which
+	// is not necessarily the one currently open — so the target is set first and the
+	// headless modals are keyed on it.
+	let actionDatatable = $state<string | undefined>(undefined)
+	let migrationsModal = $state<DataTableMigrationsButton | undefined>()
+	let permissionsDrawer = $state<DataTablePermissionsButton | undefined>()
+
+	async function runDatatableAction(datatable: string, action: DatatableRowAction) {
+		actionDatatable = datatable
+		// Let the keyed block above mount against the new target before driving it.
+		await tick()
+		switch (action) {
+			case 'migrations':
+				migrationsModal?.open()
+				break
+			case 'roles':
+				permissionsDrawer?.open()
+				break
+			case 'export':
+				await handleExportSchema(`datatable://${datatable}`)
+				break
+			case 'import':
+				importTarget = `datatable://${datatable}`
+				importDrawerOpen = true
+				break
+		}
+	}
+
 	function refreshManager() {
 		dbManagerContent?.refresh()
 		dbManagerContent?.dbManager()?.dbTable()?.refresh()
+		refreshRoles()
 	}
 
-	async function handleExportSchema() {
-		const source = currentSourceIdentifier()
+	/** Re-read what the tree and the role picker show: both are answers about the
+	 * data table's roles, which the permissions drawer can have just changed. */
+	function refreshRoles() {
+		datatables.refetch()
+		usableRoles.refetch()
+	}
+
+	async function handleExportSchema(explicitSource?: string) {
+		const source = explicitSource ?? currentSourceIdentifier()
 		if (!source || !ws) return
 		try {
 			exportResult = await WorkspaceService.exportPgSchema({
@@ -137,7 +294,7 @@
 
 	async function handleImportDatabase() {
 		if (!importSource || !ws) return
-		const target = currentSourceIdentifier()
+		const target = importTarget ?? currentSourceIdentifier()
 		if (!target) return
 		importLoading = true
 		try {
@@ -183,55 +340,65 @@
 		noPadding
 		id="db-manager-drawer"
 	>
-		{#if uriState.effectiveInput && ws}
-			{#key uriState.selectedDatatable}
+		{#if contentInput && ws && roleSettled}
+			{#key `${selectedDatatable}~${selectedRole ?? ''}`}
 				<DBManagerContent
 					bind:this={dbManagerContent}
-					input={uriState.effectiveInput}
+					{requestedViewMode}
+					onViewMode={(mode) => (requestedViewMode = mode)}
+					input={contentInput}
 					workspace={uriState.workspace}
+					datatableTree={uriState.isDatatableInput ? datatables.current : undefined}
+					datatableTreeLoading={datatables.loading}
+					onSelectDatatable={(dt) => (uriState.selectedDatatable = dt)}
+					onSelectRole={(dt, role) => {
+						// Setting the data table clears the role, so the order matters.
+						uriState.selectedDatatable = dt
+						uriState.selectedRole = role
+					}}
+					bind:pendingAction
+					canManageDatatable={!!($superadmin || $userStore?.is_admin) &&
+						!!$enterpriseLicense &&
+						!isCloudHosted()}
+					onDatatableAction={runDatatableAction}
 					bind:workerTag={() => workerTag.tag, (v) => (workerTag.tag = v)}
 					bind:hasReplResult
 					bind:selectedSchemaKey={uriState.selectedSchema}
 					bind:selectedTableKey={uriState.selectedTable}
 					onImport={enableImportExport
-						? (mode) => ((importDrawerOpen = true), (importBehavior = mode))
+						? (mode) => (
+								(importTarget = undefined),
+								(importDrawerOpen = true),
+								(importBehavior = mode)
+							)
 						: undefined}
-				>
-					{#snippet dbSelector()}
-						{#if uriState.isDatatableInput}
-							{#if datatables.loading}
-								<div class="flex items-center gap-2 text-tertiary ml-2">
-									<LoaderCircle size={14} class="animate-spin" />
-									<span class="text-sm">Loading...</span>
-								</div>
-							{:else if datatables.current.length >= 1}
-								<Select
-									transformInputSelectedText={(s) => `Datatable: ${s}`}
-									items={datatableItems}
-									bind:value={uriState.selectedDatatable}
-									placeholder="Select data table"
-									size="md"
-								/>
-							{/if}
-						{/if}
-					{/snippet}
-				</DBManagerContent>
+				></DBManagerContent>
 			{/key}
 		{/if}
 		{#snippet actions()}
-			{#if uriState.isDatatableInput && uriState.selectedDatatable && ws}
-				<DataTableMigrationsButton
-					workspace={ws}
-					datatable={uriState.selectedDatatable}
-					onSchemaChanged={refreshManager}
-				/>
-			{/if}
-			{#if enableImportExport}
-				<Button startIcon={{ icon: Download }} onClick={handleExportSchema}>Export</Button>
-				<Button startIcon={{ icon: Upload }} onClick={() => (importDrawerOpen = true)}>
+			<!-- A data table exports and imports from its row menu in the tree; a plain
+				 database has no tree row to hold them. -->
+			{#if enableImportExport && !uriState.isDatatableInput}
+				<Button startIcon={{ icon: Download }} onClick={() => handleExportSchema()}>Export</Button>
+				<Button
+					startIcon={{ icon: Upload }}
+					onClick={() => ((importTarget = undefined), (importDrawerOpen = true))}
+				>
 					Import
 				</Button>
 			{/if}
+			{#if diagramSupported}
+				<ToggleButtonGroup
+					bind:selected={requestedViewMode}
+					noWFull
+					onSelected={(v) => logFeatureUsage('db_manager', 'view_mode', { key: v })}
+				>
+					{#snippet children({ item })}
+						<ToggleButton value="data" label="Data" icon={Table2} {item} />
+						<ToggleButton value="diagram" label="Diagram" icon={Network} {item} />
+					{/snippet}
+				</ToggleButtonGroup>
+			{/if}
 			{#if uriState.effectiveInput && ws}
 				<DbWorkerTagButton
 					bind:tag={() => workerTag.tag, (v) => (workerTag.tag = v)}
@@ -260,6 +427,27 @@
 	</DrawerContent>
 </Drawer>
 
+{#if actionDatatable && ws}
+	{#key actionDatatable}
+		<DataTableMigrationsButton
+			bind:this={migrationsModal}
+			hideTrigger
+			workspace={ws}
+			datatable={actionDatatable}
+			onSchemaChanged={refreshManager}
+		/>
+		{#if $enterpriseLicense && !isCloudHosted()}
+			<DataTablePermissionsButton
+				bind:this={permissionsDrawer}
+				hideTrigger
+				workspace={ws}
+				datatable={actionDatatable}
+				onSaved={refreshRoles}
+			/>
+		{/if}
+	{/key}
+{/if}
+
 <Drawer bind:open={exportDrawerOpen} size="800px" offset={offset + 1}>
 	<DrawerContent title="Export Schemas" on:close={() => (exportDrawerOpen = false)}>
 		{#if exportResult}
diff --git a/frontend/src/lib/components/DBTable.svelte b/frontend/src/lib/components/DBTable.svelte
index adcf65c2b9..d1f314c615 100644
--- a/frontend/src/lib/components/DBTable.svelte
+++ b/frontend/src/lib/components/DBTable.svelte
@@ -66,7 +66,6 @@
 </script>
 
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
 	import { createGrid, type GridApi, type IDatasource } from 'ag-grid-community'
 	import { transformColumnDefs } from './apps/components/display/table/utils'
@@ -82,6 +81,9 @@
 	import 'ag-grid-community/styles/ag-theme-alpine.css'
 	import '$lib/components/apps/components/display/table/theme/windmill-theme.css'
 	import { untrack } from 'svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	type Props = {
 		dbTableOps: IDbTableOps
@@ -101,7 +103,7 @@
 
 	let datasource: IDatasource = {
 		getRows: async function (params) {
-			if (!$workspaceStore) return params.failCallback()
+			if (!$operatingWorkspace) return params.failCallback()
 			let lastRow = rowCount && rowCount <= params.endRow ? rowCount : -1
 
 			const items = await dbTableOps.getRows({
@@ -132,7 +134,7 @@
 						minWidth: 150,
 						editable: true,
 						onCellValueChanged: (e) => {
-							if (!$workspaceStore) return
+							if (!$operatingWorkspace) return
 							const colDef = e.colDef as unknown as { field: string; datatype: string }
 							dbTableOps
 								.onUpdate?.(
@@ -169,7 +171,7 @@
 
 	let prevUpdateKey: any = undefined
 	$effect(() => {
-		if (!$workspaceStore || !api) return
+		if (!$operatingWorkspace || !api) return
 		const key = { quicksearch, colDefs: dbTableOps.colDefs, refreshCount, rowFilter }
 		if (deepEqual(key, prevUpdateKey)) return
 		prevUpdateKey = key
@@ -191,7 +193,7 @@
 			),
 			...(dbTableOps.onDelete && {
 				onDelete: (values) => {
-					if (!$workspaceStore) return
+					if (!$operatingWorkspace) return
 					dbTableOps
 						.onDelete?.({ values })
 						.then(() => {
@@ -249,7 +251,7 @@
 				columnDefs={dbTableOps.colDefs ?? []}
 				dbType={dbTableOps.dbType}
 				onInsert={(values) => {
-					if (!$workspaceStore) return
+					if (!$operatingWorkspace) return
 					dbTableOps.onInsert?.({ values }).then((result) => {
 						refresh?.()
 						sendUserToast('Row inserted')
diff --git a/frontend/src/lib/components/DBTableEditor.svelte b/frontend/src/lib/components/DBTableEditor.svelte
index de3106d5ad..4eb07aea5f 100644
--- a/frontend/src/lib/components/DBTableEditor.svelte
+++ b/frontend/src/lib/components/DBTableEditor.svelte
@@ -503,7 +503,7 @@
 		{/if}
 		{#if askingForConfirmation?.codeContent}
 			<div
-				class="bg-surface-secondary border border-surface-selected rounded-md p-2 relative group"
+				class="bg-surface-secondary border border-surface-selected rounded-md p-2 relative group min-w-0"
 			>
 				<button
 					class="absolute top-2 right-2 opacity-0 group-hover:opacity-100 transition-opacity p-1 rounded hover:bg-surface-hover"
@@ -512,9 +512,7 @@
 				>
 					<ClipboardCopy size={14} />
 				</button>
-				<pre class="whitespace-pre-wrap text-sm"
-					><code>{askingForConfirmation.codeContent}</code></pre
-				>
+				<pre class="overflow-x-auto text-sm"><code>{askingForConfirmation.codeContent}</code></pre>
 			</div>
 		{/if}
 	</ConfirmationModal>
diff --git a/frontend/src/lib/components/DatatablePicker.svelte b/frontend/src/lib/components/DatatablePicker.svelte
index e1741aaf4c..53617acf36 100644
--- a/frontend/src/lib/components/DatatablePicker.svelte
+++ b/frontend/src/lib/components/DatatablePicker.svelte
@@ -1,10 +1,12 @@
 <script lang="ts">
 	import { WorkspaceService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 
 	import Select from './select/Select.svelte'
 	import ExploreAssetButton, { assetCanBeExplored } from './ExploreAssetButton.svelte'
 	import { usePromise } from '$lib/svelte5Utils.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		value?: string | undefined
@@ -29,7 +31,7 @@
 	}: Props = $props()
 
 	let datatables = usePromise(() =>
-		WorkspaceService.listDataTables({ workspace: $workspaceStore ?? '' }).then((d) =>
+		WorkspaceService.listDataTables({ workspace: $operatingWorkspace ?? '' }).then((d) =>
 			d.map((d) => d.name)
 		)
 	)
diff --git a/frontend/src/lib/components/DatatableRoleBadge.svelte b/frontend/src/lib/components/DatatableRoleBadge.svelte
new file mode 100644
index 0000000000..b64a2f3227
--- /dev/null
+++ b/frontend/src/lib/components/DatatableRoleBadge.svelte
@@ -0,0 +1,66 @@
+<script lang="ts">
+	import { ChevronDown } from 'lucide-svelte'
+	import SelectDropdown from './select/SelectDropdown.svelte'
+	import Badge from './common/badge/Badge.svelte'
+	import { clickOutside } from '$lib/utils'
+
+	let {
+		role,
+		roles,
+		onSelect
+	}: {
+		/** The role in effect, shown on the badge. */
+		role: string
+		/** The roles the caller may switch to. */
+		roles: string[]
+		onSelect: (role: string) => void
+	} = $props()
+
+	let open = $state(false)
+	let anchorEl: HTMLSpanElement | undefined = $state()
+	const items = $derived(roles.map((r) => ({ label: r, value: r })))
+
+	// The table picker's drawer opens at `disposables + 10000`, which the
+	// dropdown's own z-index would sit under.
+	const dropdownClass = 'z-[20000]'
+</script>
+
+<span
+	bind:this={anchorEl}
+	class="relative flex min-w-0"
+	use:clickOutside={{ onClickOutside: () => (open = false) }}
+>
+	<Badge
+		clickable
+		color="gray"
+		wrapperClass="min-w-0"
+		class="min-w-0 gap-0.5 pl-2 pr-1 bg-surface-sunken hover:bg-surface-sunken text-primary
+			transition-[filter,transform] hover:brightness-95 active:brightness-90 active:scale-[0.97]
+			{open ? 'brightness-95' : ''}"
+		onclick={(e) => {
+			// The row underneath folds on click, and picking a role is not that.
+			e.stopPropagation()
+			open = !open
+		}}
+	>
+		<!-- A long role name gives way rather than pushing the row's own actions
+		     past its right edge. -->
+		<span class="truncate">{role}</span>
+		<ChevronDown
+			size={11}
+			class="shrink-0 text-secondary transition-transform {open ? 'rotate-180' : ''}"
+		/>
+	</Badge>
+	<SelectDropdown
+		processedItems={items}
+		value={role}
+		{open}
+		listAutoWidth={false}
+		class={dropdownClass}
+		getInputRect={anchorEl && (() => anchorEl!.getBoundingClientRect())}
+		onSelectValue={(item) => {
+			open = false
+			if (item.value !== role) onSelect(item.value)
+		}}
+	/>
+</span>
diff --git a/frontend/src/lib/components/DdlMigrationGuard.svelte b/frontend/src/lib/components/DdlMigrationGuard.svelte
index 3bda6aa216..0dab262fd0 100644
--- a/frontend/src/lib/components/DdlMigrationGuard.svelte
+++ b/frontend/src/lib/components/DdlMigrationGuard.svelte
@@ -6,8 +6,18 @@
 	import { joinSqlStatements, splitSqlRuns } from './sqlDdl'
 	import { logDdlGuardChoice } from './workspaceSettings/datatableTelemetry'
 	import { CornerDownLeft } from 'lucide-svelte'
+	import { withMigrationRole } from './datatableMigrationRole'
 
-	let { workspace, datatable }: { workspace: string; datatable: string } = $props()
+	let {
+		workspace,
+		datatable,
+		role
+	}: {
+		workspace: string
+		datatable: string
+		/** The role the editor runs as. The migration declares it, or it would run as admin. */
+		role?: string
+	} = $props()
 
 	type Choice = 'run' | 'migrate' | 'cancel'
 
@@ -73,7 +83,7 @@
 	function openMigrationModal(sql: string): Promise<boolean> {
 		return new Promise((resolve) => {
 			resolveMigrationClosed = (created: boolean) => resolve(created)
-			newMigrationModal?.open({ codeUp: sql })
+			newMigrationModal?.open({ codeUp: withMigrationRole(sql, role) })
 		})
 	}
 
@@ -145,6 +155,11 @@
 				migrations rather than run ad-hoc. Create a migration for it instead?
 			{/if}
 		</p>
+		{#if role}
+			<p class="text-sm text-secondary">
+				It will run as role <span class="font-mono">{role}</span>.
+			</p>
+		{/if}
 		<pre
 			class="text-xs whitespace-pre-wrap font-mono bg-surface-secondary rounded p-3 max-h-48 overflow-auto"
 			>{promptSql}</pre
diff --git a/frontend/src/lib/components/DefaultScripts.svelte b/frontend/src/lib/components/DefaultScripts.svelte
index dde49ecf2f..b5b83c7067 100644
--- a/frontend/src/lib/components/DefaultScripts.svelte
+++ b/frontend/src/lib/components/DefaultScripts.svelte
@@ -1,10 +1,13 @@
 <script lang="ts">
-	import { userStore } from '$lib/stores'
 	import { SettingsIcon } from 'lucide-svelte'
 	import { Button } from './common'
 	import Drawer from './common/drawer/Drawer.svelte'
 	import DrawerContent from './common/drawer/DrawerContent.svelte'
 	import DefaultScriptsInner from './DefaultScriptsInner.svelte'
+	import { useOperatingUser } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	interface Props {
 		placement?: 'left' | 'right'
@@ -17,7 +20,7 @@
 	let drawer: Drawer | undefined = $state()
 </script>
 
-{#if $userStore?.is_admin || $userStore?.is_super_admin}
+{#if actingUser?.is_admin || actingUser?.is_super_admin}
 	<Drawer bind:this={drawer} {placement}>
 		<DrawerContent title="Edit Default Scripts" on:close={drawer?.closeDrawer}>
 			<DefaultScriptsInner />
diff --git a/frontend/src/lib/components/DefaultScriptsInner.svelte b/frontend/src/lib/components/DefaultScriptsInner.svelte
index eaa3d989a0..b062fb4c49 100644
--- a/frontend/src/lib/components/DefaultScriptsInner.svelte
+++ b/frontend/src/lib/components/DefaultScriptsInner.svelte
@@ -1,10 +1,13 @@
 <script lang="ts">
 	import { WorkspaceService, type Script, type WorkspaceDefaultScripts } from '$lib/gen'
-	import { defaultScripts, workspaceStore } from '$lib/stores'
+	import { defaultScripts } from '$lib/stores'
 	import { flip } from 'svelte/animate'
 	import Toggle from './Toggle.svelte'
 	import { defaultScriptLanguages } from '$lib/scripts'
 	import Alert from './common/alert/Alert.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		small?: boolean
@@ -29,7 +32,7 @@
 		}
 		defaultScripts.update((s) => ({ ...s, order: norder }))
 		await WorkspaceService.editDefaultScripts({
-			workspace: $workspaceStore!,
+			workspace: $operatingWorkspace!,
 			requestBody: $defaultScripts
 		})
 	}
diff --git a/frontend/src/lib/components/DeployWorkspace.svelte b/frontend/src/lib/components/DeployWorkspace.svelte
index c8983fcaab..53ca12cf03 100644
--- a/frontend/src/lib/components/DeployWorkspace.svelte
+++ b/frontend/src/lib/components/DeployWorkspace.svelte
@@ -6,15 +6,21 @@
 		collectTransformRefs
 	} from './deployDependencies'
 	import { base } from '$lib/base'
-	import { enterpriseLicense, superadmin, workspaceStore } from '$lib/stores'
+	import { enterpriseLicense, superadmin } from '$lib/stores'
 	import {
 		AppService,
 		FlowService,
 		ResourceService,
 		ScheduleService,
 		UserService,
-		WorkspaceService
+		WorkspaceService,
+		type RemoteDeployStatus
 	} from '$lib/gen'
+	import { remoteDeployLabel, remoteDeployWorkspace } from '$lib/remoteDeploy'
+	import RemoteDeployConnect from './RemoteDeployConnect.svelte'
+	import ToggleButtonGroup from './common/toggleButton-v2/ToggleButtonGroup.svelte'
+	import ToggleButton from './common/toggleButton-v2/ToggleButton.svelte'
+	import TextInput from './text_input/TextInput.svelte'
 	import { getAllModules } from './flows/flowExplorer'
 	import Button from './common/button/Button.svelte'
 	import Tooltip from './Tooltip.svelte'
@@ -44,13 +50,12 @@
 		type OnBehalfOfDetails
 	} from './OnBehalfOfSelector.svelte'
 	import ParentWorkspaceProtectionAlert from './ParentWorkspaceProtectionAlert.svelte'
-	import { getDetailWorkspace } from '$lib/components/details/detailWorkspace'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	const dispatch = createEventDispatcher()
 
-	const detailWs = getDetailWorkspace()
-	let ws = $derived(detailWs?.() ?? $workspaceStore)
-
 	interface Props {
 		kind: Kind
 		initialPath?: string
@@ -71,11 +76,22 @@
 
 	let canSeeTarget: 'yes' | 'cant-deploy-to-workspace' | 'cant-see-all-deps' | undefined =
 		$state(undefined)
+	/** What the target answered when it refused, for a destination whose credential can go stale. */
+	let targetError: string | undefined = $state(undefined)
+
+	// The two destinations a workspace can have: its parent on this instance, and a workspace on
+	// another instance. Both are set by an admin, so a workspace may have either, both or neither.
+	type Destination = 'parent' | 'remote'
+	let parentWorkspace: string | undefined = $state(undefined)
+	let remoteStatus = $state<RemoteDeployStatus | undefined>(undefined)
+	let destination: Destination | undefined = $state(undefined)
+	let remoteTarget = $derived(remoteStatus?.target)
+	let isRemote = $derived(destination === 'remote')
 
 	type Dependency = { kind: Kind; path: string; include: boolean }
 	let dependencies: Dependency[] | undefined = $state<Dependency[] | undefined>(undefined)
 
-	const allAlreadyExists: { [key: string]: boolean } = $state({})
+	let allAlreadyExists: { [key: string]: boolean } = $state({})
 
 	let diffDrawer: DiffDrawer | undefined = $state(undefined)
 	let notSet: boolean | undefined = $state(undefined)
@@ -124,17 +140,37 @@
 	}
 
 	async function reload(path: string) {
+		const target = workspaceToDeployTo
+		// Everything below is about this one target; switching destination starts its own pass, and
+		// the one it replaced must not write its answers into the new one's state.
+		const stillCurrent = () => target === workspaceToDeployTo
+		canSeeTarget = undefined
+		targetError = undefined
+		dependencies = undefined
+		allAlreadyExists = {}
+		deploymentStatus = {}
+		targetOnBehalfOfInfo = {}
+		onBehalfOfChoice = {}
+		customOnBehalfOf = {}
 		try {
-			if (!$superadmin) {
-				const targetUser = await UserService.whoami({ workspace: workspaceToDeployTo! })
-				canPreserveOnBehalfOf =
-					targetUser.is_admin || targetUser.groups?.includes('wm_deployers') || false
-			} else {
-				canPreserveOnBehalfOf = true
+			// Being superadmin here says nothing about the other instance, so a remote target is
+			// always asked.
+			let canPreserve = true
+			if (!$superadmin || isRemote) {
+				const targetUser = await UserService.whoami({ workspace: target! })
+				canPreserve =
+					targetUser.is_admin ||
+					targetUser.is_super_admin ||
+					targetUser.groups?.includes('wm_deployers') ||
+					false
 			}
+			if (!stillCurrent()) return
+			canPreserveOnBehalfOf = canPreserve
 			canSeeTarget = 'yes'
-		} catch {
+		} catch (e: any) {
+			if (!stillCurrent()) return
 			canSeeTarget = 'cant-deploy-to-workspace'
+			targetError = e?.body ?? e?.message
 			canPreserveOnBehalfOf = false
 			return
 		}
@@ -143,6 +179,7 @@
 		try {
 			allDeps = await getDependencies(kind, path)
 		} catch {
+			if (!stillCurrent()) return
 			canSeeTarget = 'cant-see-all-deps'
 			return
 		}
@@ -154,10 +191,9 @@
 			}
 		})
 		for (const dep of sortedSet) {
-			allAlreadyExists[computeStatusPath(dep.kind, dep.path)] = await checkAlreadyExists(
-				dep.kind,
-				dep.path
-			)
+			const exists = await checkAlreadyExists(dep.kind, dep.path)
+			if (!stillCurrent()) return
+			allAlreadyExists[computeStatusPath(dep.kind, dep.path)] = exists
 		}
 		dependencies = sortedSet.map((x) => ({
 			...x,
@@ -173,26 +209,22 @@
 			['flow', 'script', 'app', 'trigger'].includes(d.kind)
 		)) {
 			const key = computeStatusPath(dep.kind, dep.path)
+			let source: string | undefined
+			let targetValue: string | undefined
 			try {
-				sourceOnBehalfOfInfo[key] = await getOnBehalfOf(
+				source = await getOnBehalfOf(
 					dep.kind,
 					dep.path,
-					ws!,
+					$operatingWorkspace!,
 					additionalInformation
 				)
-			} catch {
-				sourceOnBehalfOfInfo[key] = undefined
-			}
+			} catch {}
 			try {
-				targetOnBehalfOfInfo[key] = await getOnBehalfOf(
-					dep.kind,
-					dep.path,
-					workspaceToDeployTo!,
-					additionalInformation
-				)
-			} catch {
-				targetOnBehalfOfInfo[key] = undefined
-			}
+				targetValue = await getOnBehalfOf(dep.kind, dep.path, target!, additionalInformation)
+			} catch {}
+			if (!stillCurrent()) return
+			sourceOnBehalfOfInfo[key] = source
+			targetOnBehalfOfInfo[key] = targetValue
 		}
 	}
 
@@ -202,7 +234,10 @@
 	): Promise<{ kind: Kind; path: string }[]> {
 		async function rec(kind: Kind, path: string): Promise<{ kind: Kind; path: string }[]> {
 			if (kind == 'schedule') {
-				const schedule = await ScheduleService.getSchedule({ workspace: ws!, path })
+				const schedule = await ScheduleService.getSchedule({
+					workspace: $operatingWorkspace!,
+					path
+				})
 				if (schedule.script_path && schedule.script_path != '') {
 					if (schedule.script_path) {
 						return [{ kind: 'script', path: schedule.script_path }]
@@ -213,7 +248,7 @@
 					return []
 				}
 			} else if (kind == 'flow') {
-				const flow = await FlowService.getFlowByPath({ workspace: ws!, path })
+				const flow = await FlowService.getFlowByPath({ workspace: $operatingWorkspace!, path })
 				return getAllModules(flow.value.modules, flow.value.failure_module).flatMap((x) => {
 					let result: { kind: Kind; path: string }[] = []
 					if (x.value.type == 'script' || x.value.type == 'rawscript' || x.value.type == 'flow') {
@@ -233,7 +268,7 @@
 					return result
 				})
 			} else if (kind == 'app') {
-				const app = await AppService.getAppByPath({ workspace: ws!, path })
+				const app = await AppService.getAppByPath({ workspace: $operatingWorkspace!, path })
 				let result: { kind: Kind; path: string }[] = []
 				if (app.raw_app) {
 					const rawAppValue = app.value as { runnables?: Record<string, Runnable> }
@@ -261,7 +296,7 @@
 				}
 				return result
 			} else if (kind == 'resource') {
-				const res = await ResourceService.getResource({ workspace: ws!, path })
+				const res = await ResourceService.getResource({ workspace: $operatingWorkspace!, path })
 				function recObj(obj: any): { kind: Kind; path: string }[] {
 					if (typeof obj == 'string') {
 						if (obj.startsWith('$var:')) {
@@ -286,12 +321,16 @@
 				]
 			} else if (kind == 'trigger') {
 				if (additionalInformation?.triggers) {
-					return getTriggerDependency(additionalInformation.triggers.kind, path, ws!)
+					return getTriggerDependency(
+						additionalInformation.triggers.kind,
+						path,
+						$operatingWorkspace!
+					)
 				}
 				throw new Error('Missing trigger information')
 			} else if (kind == 'script') {
 				const imports = await WorkspaceService.getImports({
-					workspace: ws!,
+					workspace: $operatingWorkspace!,
 					importerPath: path
 				})
 				return imports.map((importedPath) => ({ kind: 'script' as Kind, path: importedPath }))
@@ -326,25 +365,29 @@
 		return checkItemExists(kind, path, workspaceToDeployTo!, additionalInformation)
 	}
 
-	const deploymentStatus: Record<
+	let deploymentStatus: Record<
 		string,
 		{ status: 'loading' | 'deployed' | 'failed'; error?: string }
 	> = $state({})
 
 	async function deploy(kind: Kind, path: string) {
 		const statusPath = computeStatusPath(kind, path)
+		const target = workspaceToDeployTo
 		deploymentStatus[statusPath] = { status: 'loading' }
 
 		const result = await deployItem({
 			kind,
 			path,
-			workspaceFrom: ws!,
-			workspaceTo: workspaceToDeployTo!,
+			workspaceFrom: $operatingWorkspace!,
+			workspaceTo: target!,
 			additionalInformation,
 			onBehalfOf: getOnBehalfOfForDeploy(statusPath, kind),
-			onBehalfOfPrincipal: getOnBehalfOfPermissionedAsForDeploy(statusPath, kind)
+			onBehalfOfPrincipal: getOnBehalfOfPermissionedAsForDeploy(statusPath, kind),
+			targetBaseUrl: isRemote ? remoteTarget?.base_url : undefined
 		})
 
+		// The statuses on screen are the current destination's; this deploy went to `target`.
+		if (target !== workspaceToDeployTo) return
 		if (result.success) {
 			allAlreadyExists[statusPath] = true
 			deploymentStatus[statusPath] = { status: 'deployed' }
@@ -370,7 +413,7 @@
 		diffDrawer?.openDrawer()
 		let values = await Promise.all([
 			getItemValue(kind, path, workspaceToDeployTo!, additionalInformation),
-			getItemValue(kind, path, ws!, additionalInformation)
+			getItemValue(kind, path, $operatingWorkspace!, additionalInformation)
 		])
 		diffDrawer?.setDiff({
 			mode: 'simple',
@@ -380,13 +423,45 @@
 		})
 	}
 
+	async function loadDestinations() {
+		const workspace = $operatingWorkspace!
+		const [deployTo, remote] = await Promise.all([
+			WorkspaceService.getDeployTo({ workspace }),
+			WorkspaceService.getRemoteDeployTarget({ workspace }).catch(() => undefined)
+		])
+		if (workspace !== $operatingWorkspace) return
+		parentWorkspace = deployTo.deploy_to
+		remoteStatus = remote
+		// Keep the user's pick across a reload, but only while this workspace still has it: the
+		// drawer stays mounted when the workspace is switched.
+		const available = {
+			parent: parentWorkspace != undefined,
+			remote: remote?.target != undefined
+		}
+		if (!destination || !available[destination]) {
+			destination = available.parent ? 'parent' : available.remote ? 'remote' : undefined
+		}
+		notSet = destination == undefined
+	}
+
 	$effect(() => {
-		WorkspaceService.getDeployTo({ workspace: ws! }).then((x) => {
-			workspaceToDeployTo = x.deploy_to
-			if (x.deploy_to == undefined) {
-				notSet = true
-			}
-		})
+		$operatingWorkspace && untrack(() => loadDestinations())
+	})
+
+	// Until the caller has a token for the remote instance there is nothing to deploy against, so
+	// the target stays unset and the drawer's Deploy buttons stay disabled.
+	let destinationWorkspace = $derived(
+		destination === 'parent'
+			? parentWorkspace
+			: isRemote && remoteStatus?.connection
+				? remoteDeployWorkspace($operatingWorkspace!, remoteStatus.connection)
+				: undefined
+	)
+	let destinationLabel = $derived(
+		isRemote && remoteTarget ? remoteDeployLabel(remoteTarget) : (parentWorkspace ?? '')
+	)
+	$effect(() => {
+		workspaceToDeployTo = destinationWorkspace
 	})
 
 	$effect(() => {
@@ -457,8 +532,9 @@
 		>Deploy to staging/prod from the web UI is only available with an enterprise license</Alert
 	>
 {:else if notSet == true}
-	<Alert type="error" title="Staging/Prod deploy not set up"
-		>As an admin, go to Settings {'->'} Workspace {'->'} Dev workspace</Alert
+	<Alert type="error" title="Deploy destination not set up"
+		>As an admin, go to Settings {'->'} Workspace {'->'} Dev workspace, to pair this workspace with a
+		prod workspace on this instance or point it at a workspace on another instance</Alert
 	>
 {:else}
 	<Alert type="info" title="Shareable page"
@@ -467,22 +543,62 @@
 	>
 
 	<h3 class="mb-2 mt-8"
-		>Destination Workspace&nbsp; <Tooltip
-			>Workspace to deploy to is set in the workspace settings</Tooltip
+		>Destination&nbsp; <Tooltip
+			>Where this workspace deploys is set in the workspace settings</Tooltip
 		></h3
 	>
-	<input class="max-w-xs" type="text" disabled value={workspaceToDeployTo} />
+	{#if parentWorkspace && remoteTarget}
+		<ToggleButtonGroup
+			selected={destination}
+			onSelected={(v) => (destination = v as Destination)}
+			noWFull
+		>
+			{#snippet children({ item })}
+				<ToggleButton
+					value="parent"
+					label={parentWorkspace ?? ''}
+					tooltip="Workspace this one deploys into on this instance"
+					{item}
+				/>
+				<ToggleButton
+					value="remote"
+					label={remoteDeployLabel(remoteTarget!)}
+					tooltip="Workspace on another instance"
+					{item}
+				/>
+			{/snippet}
+		</ToggleButtonGroup>
+	{:else}
+		<TextInput value={destinationLabel} inputProps={{ disabled: true }} class="max-w-xs" />
+	{/if}
+
+	{#if isRemote && remoteTarget}
+		<div class="mt-3">
+			<RemoteDeployConnect
+				workspace={$operatingWorkspace!}
+				target={remoteTarget}
+				connection={remoteStatus?.connection}
+				returnTo={kind === 'trigger'
+					? undefined
+					: `${base}/deploy/${kind}/${initialPath}?workspace=${encodeURIComponent($operatingWorkspace!)}`}
+				onChange={loadDestinations}
+			/>
+		</div>
+	{/if}
 
 	{#if workspaceToDeployTo}
 		<ParentWorkspaceProtectionAlert
 			parentWorkspaceId={workspaceToDeployTo}
+			displayName={destinationLabel}
 			onUpdateCanDeploy={(canDeploy) => {
 				canDeployToWorkspace = canDeploy
 			}}
 		/>
 	{/if}
 
-	{#if canSeeTarget == undefined}
+	{#if workspaceToDeployTo == undefined}
+		<!-- A remote destination nobody has connected to yet: the connect form above is the next step. -->
+	{:else if canSeeTarget == undefined}
 		<div class="mt-6"></div>
 		<Loader2 class="animate-spin" />
 	{:else if canSeeTarget == 'yes'}
@@ -608,6 +724,15 @@
 			user to deploy this item using the shareable link or get the proper permissions on the
 			dependencies</Alert
 		>
+	{:else if isRemote}
+		<div class="my-2"></div>
+		<Alert type="error" title="Could not deploy to {destinationLabel}"
+			><p>{targetError ?? 'The remote instance did not accept the request'}</p>
+			<p class="mt-1"
+				>Disconnect above and connect again with a valid token for that instance, or ask someone
+				permissioned there to deploy this item using the shareable link</p
+			></Alert
+		>
 	{:else}
 		<div class="my-2"></div>
 		<Alert type="error" title="User not allowed to deploy to this workspace"
diff --git a/frontend/src/lib/components/DiffDrawer.svelte b/frontend/src/lib/components/DiffDrawer.svelte
index d70046d62a..2e5810e036 100644
--- a/frontend/src/lib/components/DiffDrawer.svelte
+++ b/frontend/src/lib/components/DiffDrawer.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
 	import { Alert, Button, Drawer, DrawerContent } from './common'
-	import { Loader2 } from 'lucide-svelte'
+	import { ArrowRight, Loader2 } from 'lucide-svelte'
 	import { scriptLangToEditorLang } from '$lib/scripts'
 	import Tabs from './common/tabs/Tabs.svelte'
 	import Tab from './common/tabs/Tab.svelte'
@@ -11,7 +11,10 @@
 		type Value
 	} from '$lib/utils'
 	import { orderedYamlStringify } from '$lib/utils/orderedYaml'
+	import { sendUserToast } from '$lib/toast'
 	import type { Script } from '$lib/gen'
+	import Select from './select/Select.svelte'
+	import type { DiffVersionOption } from './diff_drawer'
 
 	type DiffData = {
 		lang?: string
@@ -44,6 +47,13 @@
 		| {
 				mode: 'normal'
 				deployed: DiffData | undefined
+				/** Which deployed version the left side is — the reader otherwise has no
+				 *  way to tell what their draft is being compared against. */
+				deployedLabel?: string
+				versions?: DiffVersionOption[]
+				onTakeLatest?: (head?: string) => void | Promise<void>
+				draftBase?: string
+				deployedHead?: string
 				draft: DiffData | undefined
 				current: DiffData
 				path?: string
@@ -58,7 +68,13 @@
 		  }
 		| undefined = $state(undefined)
 
-	export function openDrawer() {
+	export function openDrawer(token?: number) {
+		// No token means the caller is taking the drawer for itself, so claim one here:
+		// every reuse (a deploy-override's "Show diff", a draft badge, a workspace
+		// comparison) then invalidates an editor opening that is still fetching, instead
+		// of being replaced by it when it lands.
+		if (token != null && token !== openingToken) return
+		if (token == null) openingToken++
 		data = undefined
 		diffType = undefined
 		diffViewer?.openDrawer()
@@ -68,6 +84,36 @@
 		diffViewer?.closeDrawer()
 	}
 
+	/** Counted per opening, and counted here rather than in the editor that opens one: a
+	 *  path change remounts the editor while this drawer stays, so a counter local to it is
+	 *  one an outlived request still matches, and that request would fill the drawer with
+	 *  the item the user just left. Every write an opening makes checks this first. */
+	let openingToken = 0
+
+	export function beginOpening(): number {
+		return ++openingToken
+	}
+
+	export function ownsOpening(token: number): boolean {
+		return token === openingToken
+	}
+
+	/** Drop an opening and everything it put on screen: its editor is going away, so a diff
+	 *  it filled acts on an item that is gone (Take latest would move the base of whatever
+	 *  loaded in its place) and one still in flight would leave the spinner behind. A no-op
+	 *  once another opening owns the drawer: what it shows is then someone else's. */
+	export function abandonOpening(token: number) {
+		if (token !== openingToken) return
+		openingToken++
+		// The version load and the page in flight, if any, belong to the diff being dropped.
+		versionLoadGeneration++
+		versionListGeneration++
+		loadingVersion = false
+		data = undefined
+		diffType = undefined
+		diffViewer?.closeDrawer()
+	}
+
 	function prepareDiff(data: Value) {
 		const metadata = structuredClone(cleanValueProperties(replaceFalseWithUndefined(data)))
 		const content = metadata['content']
@@ -81,11 +127,145 @@
 		}
 	}
 
+	// Which deployed version the left pane shows. The drawer keeps the id opaque and
+	// hands it back to the editor, which knows how to fetch it for its own kind.
+	let selectedVersion: string | undefined = $state(undefined)
+	let versionLoader: ((id: string) => Promise<Value | undefined>) | undefined = $state(undefined)
+	let headLabel: string | undefined = $state(undefined)
+	/** The deployed head, prepared for diffing as `data.deployed` is: `data.deployed`
+	 *  follows the picker while Restore always restores the head, so its enabled state
+	 *  compares against this. Must hold `prepareDiff`'s output, not the raw value, or the
+	 *  comparison never matches and Restore is always enabled. */
+	let headDeployed: ReturnType<typeof prepareDiff> | undefined = $state(undefined)
+	let loadingVersion = $state(false)
+	/** Which version load the spinner belongs to, counted rather than keyed on the id so
+	 *  re-picking the same version is still generation-safe. A response from any other
+	 *  generation is stale — a slower earlier pick, or one outlived by a drawer reset —
+	 *  and neither replaces the diff nor clears the spinner, which `disabled` rides on. */
+	let versionLoadGeneration = 0
+	/** Counted separately from `versionLoadGeneration`: only a diff replacing this one
+	 *  invalidates a page in flight. Picking a version while one loads is not a reason to
+	 *  drop it — the editor's cursor has already moved past that page, so discarding it
+	 *  would skip it until the drawer is reopened. */
+	let versionListGeneration = 0
+	/** Pages of `versions` fetched after the first. Kept beside `data` so a diff swapped in
+	 *  by a newer opening drops them along with the list they extended. */
+	let extraVersions: DiffVersionOption[] = $state([])
+	let moreLoader: (() => Promise<DiffVersionOption[] | undefined>) | undefined = $state(undefined)
+	let loadingMore = $state(false)
+	/** What the picker offers: the page the editor handed over plus whatever the reader has
+	 *  asked for since. Every read of the version list goes through this. */
+	const pickerVersions = $derived.by(() =>
+		data?.mode === 'normal' ? [...(data.versions ?? []), ...extraVersions] : []
+	)
+
+	/** The editors hand over one page, so a path a pipeline has deployed thousands of times
+	 *  does not hold the drawer shut while its whole history arrives. */
+	async function fetchMoreVersions() {
+		if (!moreLoader || loadingMore) return
+		loadingMore = true
+		const generation = versionListGeneration
+		try {
+			const more = await moreLoader()
+			// A diff swapped in while this ran owns the picker now; appending would splice
+			// one item's history onto another's.
+			if (generation !== versionListGeneration) return
+			if (more?.length) {
+				extraVersions = [...extraVersions, ...more]
+			} else {
+				// Nothing came back, so there is nothing further to ask for.
+				moreLoader = undefined
+			}
+		} catch (e: any) {
+			if (generation === versionListGeneration) {
+				sendUserToast(`Could not load older versions: ${e?.body ?? e?.message ?? e}`, true)
+			}
+		} finally {
+			// Guarded like the writes above: an outlived request clearing this would hand
+			// the drawer that replaced it a second concurrent page.
+			if (generation === versionListGeneration) loadingMore = false
+		}
+	}
+
+	async function selectVersion(id: string | undefined) {
+		if (!id || !versionLoader || !data || data.mode !== 'normal') return
+		const shown = selectedVersion
+		selectedVersion = id
+		const generation = ++versionLoadGeneration
+		loadingVersion = true
+		try {
+			const value = await versionLoader(id)
+			if (generation !== versionLoadGeneration) return
+			if (!value || !data || data.mode !== 'normal') {
+				// Nothing loaded: the diff still shows the previous version, so the picker
+				// has to say so rather than name one the reader is not looking at.
+				selectedVersion = shown
+				if (!value) sendUserToast(`Could not load version ${id}`, true)
+				return
+			}
+			const opt = pickerVersions.find((v) => v.id === id)
+			data = {
+				...data,
+				deployed: prepareDiff(value),
+				deployedLabel: opt?.isHead ? headLabel : opt?.label
+			}
+		} catch (e: any) {
+			// The snap-back would otherwise be the only sign the version never loaded.
+			if (generation === versionLoadGeneration) {
+				selectedVersion = shown
+				sendUserToast(`Could not load version ${id}: ${e?.body ?? e?.message ?? e}`, true)
+			}
+		} finally {
+			if (generation === versionLoadGeneration) loadingVersion = false
+		}
+	}
+
+	/** The version this drawer presents as the deployed head: the one its list marks, else
+	 *  the head the editor knows. Both the action's gate and the base it adopts hang off
+	 *  it, so "take latest" means the version the reader is looking at. */
+	const headShown = $derived.by(() =>
+		data?.mode === 'normal'
+			? (pickerVersions.find((v) => v.isHead)?.id ?? data.deployedHead)
+			: undefined
+	)
+	/** Behind as the drawer can see it. Unknown counts as not behind: offering to adopt a
+	 *  head nobody could name would move the base to a version never shown. */
+	const behindShown = $derived.by(
+		() =>
+			data?.mode === 'normal' &&
+			data.draftBase != null &&
+			headShown != null &&
+			data.draftBase !== headShown
+	)
+
+	let takingLatest = $state(false)
+	async function takeLatest() {
+		if (!data || data.mode !== 'normal' || !data.onTakeLatest || takingLatest) return
+		takingLatest = true
+		// Persisting the base is awaited, and this drawer outlives the editor that filled
+		// it: close only the opening this action belongs to, or it takes down whichever
+		// diff was opened meanwhile.
+		const opening = openingToken
+		try {
+			await data.onTakeLatest(headShown)
+			if (opening === openingToken) diffViewer?.closeDrawer()
+		} finally {
+			takingLatest = false
+		}
+	}
+
 	export function setDiff(
 		diff:
 			| {
 					mode: 'normal'
 					deployed: Value
+					deployedLabel?: string
+					versions?: DiffVersionOption[]
+					loadVersion?: (id: string) => Promise<Value | undefined>
+					loadMoreVersions?: () => Promise<DiffVersionOption[] | undefined>
+					onTakeLatest?: (head?: string) => void | Promise<void>
+					draftBase?: string
+					deployedHead?: string
 					draft?: Value | undefined
 					current: Value
 					defaultDiffType?: 'deployed' | 'draft'
@@ -97,13 +277,46 @@
 					current: Value
 					title: string
 					button?: { text: string; onClick: () => void }
-			  }
+			  },
+		token?: number
 	) {
+		// Same rule as `openDrawer`: an opening's own token has to still be current, and a
+		// caller with none is taking the drawer, so it claims one.
+		if (token != null && token !== openingToken) return
+		if (token == null) openingToken++
 		if (diff.mode === 'normal') {
-			const { deployed, draft, current, button } = diff
+			const {
+				deployed,
+				deployedLabel,
+				versions,
+				loadVersion,
+				loadMoreVersions,
+				onTakeLatest,
+				draftBase,
+				deployedHead,
+				draft,
+				current,
+				button
+			} = diff
+			versionLoader = loadVersion
+			moreLoader = loadMoreVersions
+			headLabel = deployedLabel
+			headDeployed = !deployed.draft_only ? prepareDiff(deployed) : undefined
+			// A load or page still in flight belongs to the diff being replaced.
+			versionLoadGeneration++
+			versionListGeneration++
+			loadingVersion = false
+			extraVersions = []
+			loadingMore = false
+			selectedVersion = versions?.find((v) => v.isHead)?.id
 			data = {
 				mode: 'normal',
 				deployed: !deployed.draft_only ? prepareDiff(deployed) : undefined,
+				deployedLabel,
+				versions,
+				onTakeLatest,
+				draftBase,
+				deployedHead,
 				draft: draft ? prepareDiff(draft) : undefined,
 				current: prepareDiff(current),
 				path: draft?.path || deployed?.path,
@@ -130,19 +343,46 @@
 <Drawer bind:this={diffViewer} size="1200px" on:close>
 	<DrawerContent title="Diff" on:close={diffViewer.closeDrawer}>
 		<div class="flex flex-col gap-4 h-full">
-			{#if data?.mode === 'normal'}
-				<Button
-					unifiedSize="md"
-					variant="default"
-					wrapperClasses="self-start"
-					onClick={restoreDeployed}
-					disabled={!data.draft &&
-						orderedJsonStringify(data.deployed) === orderedJsonStringify(data.current)}
-				>
-					Restore to deployed{data.draft ? ' and discard draft' : ''}
-				</Button>
-			{/if}
 			{#if data}
+				<!-- Outside the `contentType` check on purpose: with no differences against
+				     the head, picking an older version is exactly how the reader finds one,
+				     so the picker has to outlive the "no changes" state. -->
+				{#if data.mode === 'normal' && (data.deployedLabel || pickerVersions.length)}
+					<div class="flex gap-2 items-center text-xs text-secondary">
+						{#if pickerVersions.length && versionLoader}
+							<div class="w-72">
+								<Select
+									items={pickerVersions.map((v) => ({
+										value: v.id,
+										label: v.label,
+										subtitle: v.subtitle
+									}))}
+									bind:value={() => selectedVersion, (v) => selectVersion(v as string)}
+									disabled={loadingVersion}
+									clearable={false}
+								/>
+							</div>
+							{#if loadingVersion}
+								<Loader2 size={12} class="animate-spin shrink-0" />
+							{/if}
+							{#if moreLoader}
+								<Button
+									variant="subtle"
+									unifiedSize="2xs"
+									disabled={loadingMore}
+									on:click={fetchMoreVersions}>Load older</Button
+								>
+							{/if}
+							{#if loadingMore}
+								<Loader2 size={12} class="animate-spin shrink-0" />
+							{/if}
+						{:else if data.deployedLabel}
+							<span class="font-medium text-primary">{data.deployedLabel}</span>
+						{/if}
+						<ArrowRight size={12} class="shrink-0" />
+						<span>your draft</span>
+					</div>
+				{/if}
 				{#if contentType}
 					{@const content =
 						data.mode === 'normal' ? data.deployed?.content : data.original?.content}
@@ -224,6 +464,23 @@
 			{/if}
 		</div>
 		{#snippet actions()}
+			{#if data?.mode === 'normal' && data.onTakeLatest && behindShown}
+				<Button unifiedSize="sm" variant="default" loading={takingLatest} onClick={takeLatest}>
+					Take latest, keep my edits
+				</Button>
+			{/if}
+			{#if data?.mode === 'normal'}
+				<Button
+					unifiedSize="sm"
+					variant="default"
+					onClick={restoreDeployed}
+					disabled={!data.draft &&
+						orderedJsonStringify(headDeployed ?? data.deployed) ===
+							orderedJsonStringify(data.current)}
+				>
+					Restore to deployed{data.draft ? ' and discard draft' : ''}
+				</Button>
+			{/if}
 			{#if data?.button}
 				<Button
 					variant="subtle"
diff --git a/frontend/src/lib/components/DisplayResult.svelte b/frontend/src/lib/components/DisplayResult.svelte
index 47bafa4d5a..d0de2026cf 100644
--- a/frontend/src/lib/components/DisplayResult.svelte
+++ b/frontend/src/lib/components/DisplayResult.svelte
@@ -54,6 +54,11 @@
 	import DOMPurify from 'dompurify'
 	import MarkupApprovalGate from './MarkupApprovalGate.svelte'
 	import type { MarkupTrust } from './apps/markupTrust'
+	import AgentResultDisplay from './AgentResultDisplay.svelte'
+	import AgentStreamDisplay from './AgentStreamDisplay.svelte'
+	import AgentTrace from './AgentTrace.svelte'
+	import { isAgentStream, parseAgentErrorMessages, parseAgentResult } from './aiAgentResult'
+	import { buildAgentTrace } from './agentTrace'
 
 	const TABLE_MAX_SIZE = 5000000
 	const DISPLAY_MAX_SIZE = 100000
@@ -85,6 +90,7 @@
 		| 'map'
 		| 'nondisplayable'
 		| 'pdf'
+		| 'aiagent'
 		| undefined
 	let resultKind: ResultKind = $state()
 	/** Kinds whose renderer leaves the page: S3/ducklake previews fetch the file or
@@ -94,7 +100,10 @@
 	const REPLAY_INERT_KINDS: ResultKind[] = ['s3object', 's3object-list', 'materialized', 'approval']
 	/** Kinds whose markup pulls subresources: DOMPurify stops scripting but keeps
 	 * `<img src>` and SVG `<image href>`, and `map` tiles are requests by
-	 * construction. Kinds absent here carry their bytes as `data:` and reach nothing.
+	 * construction. Kinds absent here carry their bytes as `data:` and reach nothing,
+	 * or render through a component that is itself inert on the public page —
+	 * `aiagent` is the second case, via `GfmMarkdown`, which is why it renders
+	 * markdown yet is not listed while `markdown` still is.
 	 * Inert only on the public page, which promises to issue no requests. */
 	const OFFLINE_INERT_KINDS: ResultKind[] = ['markdown', 'html', 'svg', 'map']
 	let length = $state(1)
@@ -110,6 +119,12 @@
 		filename?: string | undefined
 		disableExpand?: boolean
 		jobId?: string | undefined
+		/**
+		 * Which run this result belongs to. Separate from `jobId`, which the replay
+		 * page withholds so nothing fetches: the agent views still have to tell one
+		 * run from the next, or a second one continues the first one's fold.
+		 */
+		runKey?: string | undefined
 		workspaceId?: string | undefined
 		hideAsJson?: boolean
 		noControls?: boolean
@@ -135,6 +150,7 @@
 		filename = undefined,
 		disableExpand = false,
 		jobId = undefined,
+		runKey = undefined,
 		workspaceId = undefined,
 		hideAsJson = false,
 		noControls = false,
@@ -154,6 +170,16 @@
 		growVertical = false
 	}: Props = $props()
 	let s3FileDisplayRawMode = $state(false)
+	/** What a max-iterations failure got through before it gave up, if this is one.
+	 *  Empty for a run that failed before the worker tagged anything, and for one
+	 *  that predates the tags reaching this payload at all — in which case the
+	 *  section is not rendered rather than heading an empty box. */
+	let agentErrorTrace = $derived.by(() => {
+		const messages = parseAgentErrorMessages(result)
+		if (!messages) return undefined
+		const entries = buildAgentTrace(messages)
+		return entries.length > 0 ? entries : undefined
+	})
 
 	// Build the image/PDF source URL for an S3 object. When `appPath` is set
 	// (deployed app view) the read is authorized on-behalf of the app author via
@@ -293,6 +319,17 @@
 					return 'materialized'
 				}
 
+				// Classified before the size caps below: an agent's answer stays small
+				// however long its conversation grows, so a run with a long trace
+				// must not fall back to the JSON tree that hides the answer inside it.
+				// `largeObject` is still set honestly, so switching to JSON gets the
+				// same too-big handling as any other oversized result.
+				if (parseAgentResult(result)) {
+					is_render_all = false
+					largeObject = roughSizeOfObject(result) > DISPLAY_MAX_SIZE
+					return 'aiagent'
+				}
+
 				is_render_all =
 					keys.length == 1 && keys.includes('render_all') && Array.isArray(result['render_all'])
 
@@ -731,7 +768,13 @@
 		<div class="flex items-center gap-2 text-secondary text-xs">
 			<Loader2 class="animate-spin" size={14} /> Streaming result
 		</div>
-		<ResultStreamDisplay {result_stream} />
+		{#if isAgentStream(result_stream)}
+			<!-- An agent streams one JSON event per line, so the raw stream is a wall of
+			     event objects rather than the answer being written. -->
+			<AgentStreamDisplay raw={result_stream} streamKey={runKey ?? jobId} />
+		{:else}
+			<ResultStreamDisplay {result_stream} />
+		{/if}
 	</div>
 {:else if is_render_all}
 	<div class="flex flex-col w-full gap-2">
@@ -973,6 +1016,16 @@
 						{/if}
 						{@render children?.()}
 					</div>
+					{#if agentErrorTrace}
+						<!-- A run stopped by max_iterations fails, so the error above is what it
+						     returned. What it managed to do rides inside that error and is the
+						     whole reason to look at such a run, so it is added under the error
+						     rather than replacing it. -->
+						<div class="flex flex-col gap-1 pt-4 w-full min-w-0">
+							<span class="text-emphasis text-xs font-semibold">Trace</span>
+							<AgentTrace entries={agentErrorTrace} {workspaceId} />
+						</div>
+					{/if}
 					{#if !isTest && language === 'bun'}
 						<div class="pt-20"></div>
 						<Alert size="xs" type="info" title="Seeing an odd error?">
@@ -1229,6 +1282,27 @@
 							{/each}
 						</div>
 					</div>
+				{:else if !forceJson && resultKind === 'aiagent'}
+					{@const agentResult = parseAgentResult(result)}
+					{#if agentResult}
+						<AgentResultDisplay result={agentResult} {workspaceId} runKey={runKey ?? jobId}>
+							{#snippet structuredOutput(output)}
+								<DisplayResult
+									noControls
+									hideAsJson
+									result={output}
+									{markupTrust}
+									{filename}
+									{disableExpand}
+									{jobId}
+									{nodeId}
+									{workspaceId}
+									{appPath}
+									growVertical
+								/>
+							{/snippet}
+						</AgentResultDisplay>
+					{/if}
 				{:else if !forceJson && resultKind === 'markdown'}
 					<div class={markdownProse.sm}>
 						<Markdown md={result?.md ?? result?.markdown} />
diff --git a/frontend/src/lib/components/DraftConflictAlert.svelte b/frontend/src/lib/components/DraftConflictAlert.svelte
new file mode 100644
index 0000000000..0e0fd1fb97
--- /dev/null
+++ b/frontend/src/lib/components/DraftConflictAlert.svelte
@@ -0,0 +1,31 @@
+<script lang="ts">
+	import { Alert, Button } from '$lib/components/common'
+
+	interface Props {
+		/** Take the draft the server holds, replacing what is on screen. */
+		onReload: () => void
+		/** Write what is on screen over the server's draft. */
+		onOverwrite: () => void
+		/** A resolution is in flight: neither answer is offered again until it settles. */
+		busy?: boolean
+	}
+
+	let { onReload, onOverwrite, busy = false }: Props = $props()
+</script>
+
+<Alert type="warning" title="Your draft changed elsewhere">
+	<div class="flex flex-col items-start gap-2">
+		<div>
+			It was saved from another tab or session since this one read it, so your changes here are no
+			longer being saved.
+		</div>
+		<div class="flex flex-row gap-2">
+			<Button unifiedSize="sm" variant="default" disabled={busy} onClick={onReload}>
+				Load the other version
+			</Button>
+			<Button unifiedSize="sm" variant="default" disabled={busy} onClick={onOverwrite}>
+				Keep mine
+			</Button>
+		</div>
+	</div>
+</Alert>
diff --git a/frontend/src/lib/components/DropdownSubmenuItem.svelte b/frontend/src/lib/components/DropdownSubmenuItem.svelte
index 60f7ad2d64..a67411a039 100644
--- a/frontend/src/lib/components/DropdownSubmenuItem.svelte
+++ b/frontend/src/lib/components/DropdownSubmenuItem.svelte
@@ -13,9 +13,10 @@
 		item: Item
 		builders: ReturnType<typeof createDropdownMenu>['builders']
 		meltItem: MenubarMenuElements['item']
+		close?: (afterClose?: () => void) => void
 	}
 
-	let { item, builders, meltItem }: Props = $props()
+	let { item, builders, meltItem, close }: Props = $props()
 
 	const {
 		elements: { subTrigger, subMenu },
@@ -23,6 +24,8 @@
 	} = untrack(() => builders).createSubmenu()
 
 	let subItems = $derived((item.submenuItems ?? []).filter((i) => !i.hide))
+	const CustomSubmenu = $derived(item.customSubmenu)
+	const closeMenu = $derived(close ?? (() => {}))
 </script>
 
 <button
@@ -46,14 +49,20 @@
 {#if $subOpen}
 	<div
 		use:melt={$subMenu}
-		class="z-[6000] bg-surface-tertiary dark:border w-48 origin-top-right rounded-lg shadow-lg focus:outline-none overflow-y-auto py-1"
+		class="z-[6000] bg-surface-tertiary dark:border {CustomSubmenu
+			? ''
+			: 'w-48 overflow-y-auto py-1'} origin-top-right rounded-lg shadow-lg focus:outline-none"
 	>
-		{#each subItems as subItem}
-			{#if subItem.separatorTop}
-				<div class="my-1 border-t border-border-light"></div>
-			{/if}
-			{@render subMenuItem(subItem)}
-		{/each}
+		{#if CustomSubmenu}
+			<CustomSubmenu {...item.customSubmenuProps} close={closeMenu} />
+		{:else}
+			{#each subItems as subItem}
+				{#if subItem.separatorTop}
+					<div class="my-1 border-t border-border-light"></div>
+				{/if}
+				{@render subMenuItem(subItem)}
+			{/each}
+		{/if}
 	</div>
 {/if}
 
diff --git a/frontend/src/lib/components/DropdownV2.svelte b/frontend/src/lib/components/DropdownV2.svelte
index 6738e7ace8..1d86519293 100644
--- a/frontend/src/lib/components/DropdownV2.svelte
+++ b/frontend/src/lib/components/DropdownV2.svelte
@@ -132,8 +132,9 @@
 		})
 	})
 
-	export function close() {
+	export function close(afterClose?: () => void) {
 		open = false
+		if (afterClose) setTimeout(afterClose, 10)
 	}
 
 	async function computeItems(): Promise<Item[]> {
@@ -145,6 +146,9 @@
 		}
 	}
 	async function getMenuElements(): Promise<HTMLElement[]> {
+		// Runs on every pointerdown anywhere, for every mounted dropdown. Skip the
+		// whole-document query when the outside handler below cannot act anyway.
+		if (!usePointerDownOutside || !open) return []
 		return Array.from(document.querySelectorAll('[data-menu]')) as HTMLElement[]
 	}
 </script>
@@ -206,7 +210,7 @@
 				class="bg-surface-tertiary dark:border w-56 origin-top-right rounded-lg shadow-lg focus:outline-none overflow-y-auto py-1"
 				style={`${customWidth ? `width: ${customWidth}px;` : ''} max-height: ${maxHeight || '50vh'};`}
 			>
-				<DropdownV2Inner {aiId} items={computeItems} meltItem={item} {builders} />
+				<DropdownV2Inner {aiId} items={computeItems} meltItem={item} {builders} {close} />
 			</div>
 		{/if}
 	</div>
diff --git a/frontend/src/lib/components/DropdownV2Inner.svelte b/frontend/src/lib/components/DropdownV2Inner.svelte
index 7749310b5b..31fd9426f5 100644
--- a/frontend/src/lib/components/DropdownV2Inner.svelte
+++ b/frontend/src/lib/components/DropdownV2Inner.svelte
@@ -13,9 +13,10 @@
 		items?: Item[] | (() => Item[]) | (() => Promise<Item[]>)
 		meltItem: MenubarMenuElements['item']
 		builders?: ReturnType<typeof createDropdownMenu>['builders']
+		close?: (afterClose?: () => void) => void
 	}
 
-	let { aiId, items = [], meltItem, builders }: Props = $props()
+	let { aiId, items = [], meltItem, builders, close }: Props = $props()
 
 	let computedItems: Item[] | undefined = $state(undefined)
 	async function computeItems() {
@@ -102,8 +103,8 @@
 			{#if item.separatorTop}
 				<div class="my-1 border-t border-border-light"></div>
 			{/if}
-			{#if item.submenuItems && builders}
-				<DropdownSubmenuItem {item} {builders} {meltItem} />
+			{#if (item.submenuItems || item.customSubmenu) && builders}
+				<DropdownSubmenuItem {item} {builders} {meltItem} close={close ?? (() => {})} />
 			{:else if item.disabled && item.tooltip}
 				<!-- Wrapper carries the native `title`; the disabled button's `pointer-events-none`
 				     lets the hover reach it so the user learns why the item is disabled. -->
diff --git a/frontend/src/lib/components/DucklakePicker.svelte b/frontend/src/lib/components/DucklakePicker.svelte
index e84ddb9060..3a6f2bf739 100644
--- a/frontend/src/lib/components/DucklakePicker.svelte
+++ b/frontend/src/lib/components/DucklakePicker.svelte
@@ -1,10 +1,12 @@
 <script lang="ts">
 	import { WorkspaceService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 
 	import Select from './select/Select.svelte'
 	import ExploreAssetButton, { assetCanBeExplored } from './ExploreAssetButton.svelte'
 	import { usePromise } from '$lib/svelte5Utils.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		value?: string | undefined
@@ -29,9 +31,8 @@
 	}: Props = $props()
 
 	let ducklakes = usePromise(() =>
-		WorkspaceService.listDucklakes({ workspace: $workspaceStore ?? '' })
+		WorkspaceService.listDucklakes({ workspace: $operatingWorkspace ?? '' })
 	)
-
 </script>
 
 <div class={className}>
@@ -46,9 +47,6 @@
 		{onClear}
 	/>
 	{#if showSchemaExplorer && value && assetCanBeExplored({ kind: 'ducklake', path: value })}
-		<ExploreAssetButton
-			class="mt-1 w-fit"
-			asset={{ kind: 'ducklake', path: value }}
-		/>
+		<ExploreAssetButton class="mt-1 w-fit" asset={{ kind: 'ducklake', path: value }} />
 	{/if}
 </div>
diff --git a/frontend/src/lib/components/EditableSchemaForm.svelte b/frontend/src/lib/components/EditableSchemaForm.svelte
index bd3399d9d2..79173424d9 100644
--- a/frontend/src/lib/components/EditableSchemaForm.svelte
+++ b/frontend/src/lib/components/EditableSchemaForm.svelte
@@ -4,7 +4,6 @@
 	const bubble = createBubbler()
 	import type { Schema } from '$lib/common'
 	import { VariableService, type ScriptLang } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { Button } from './common'
 	import ItemPicker from './ItemPicker.svelte'
 	import VariableEditor from './VariableEditor.svelte'
@@ -36,6 +35,9 @@
 	import Section from '$lib/components/Section.svelte'
 	import Editor from './Editor.svelte'
 	import AddPropertyV2 from './schema/AddPropertyV2.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	// export let openEditTab: () => void = () => {}
 	const dispatch = createEventDispatcher()
@@ -128,7 +130,7 @@
 		workspace = undefined
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	$effect.pre(() => {
 		if (args == undefined) {
diff --git a/frontend/src/lib/components/Editor.svelte b/frontend/src/lib/components/Editor.svelte
index 987aa937eb..6aabc30c2b 100644
--- a/frontend/src/lib/components/Editor.svelte
+++ b/frontend/src/lib/components/Editor.svelte
@@ -42,7 +42,6 @@
 	import { editorConfig, registerWebviewPaste, updateOptions } from '$lib/editorUtils'
 	import { editorFontSize } from '$lib/editorFontSize.svelte'
 	import { createHash as randomHash } from '$lib/editorLangUtils'
-	import { workspaceStore } from '$lib/stores'
 	import DdlMigrationGuard from './DdlMigrationGuard.svelte'
 	import {
 		type Preview,
@@ -120,6 +119,9 @@
 	import { rawAppLintStore, type MonacoLintError } from './raw_apps/lintStore'
 	import { MarkerSeverity } from 'monaco-editor'
 	import { resource, useDebounce, watch } from 'runed'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 	// import EditorTheme from './EditorTheme.svelte'
 
 	let divEl: HTMLDivElement | null = $state(null)
@@ -684,7 +686,7 @@
 	// via a short-TTL cache — macros are late-bound, so mild staleness is fine.
 	async function addWorkspaceMacroCompletions() {
 		workspaceMacroCompletor?.dispose()
-		const workspace = $workspaceStore
+		const workspace = $operatingWorkspace
 		if (!workspace) return
 		let macros: Awaited<ReturnType<typeof listWorkspaceMacrosCached>> = []
 		try {
@@ -739,7 +741,7 @@
 			provideCompletionItems: async function (model, position) {
 				// Read the store per request, not at registration — the provider
 				// outlives a workspace switch.
-				const workspace = $workspaceStore
+				const workspace = $operatingWorkspace
 				if (!workspace) return { suggestions: [] }
 				const before = model.getLineContent(position.lineNumber).slice(0, position.column - 1)
 				if (!/^\s*(\/\/|--|#)\s*(column|data_test|on|materialize)\b/.test(before)) {
@@ -780,7 +782,7 @@
 				$dbSchemas[resourcePath] = await getDbSchemas(
 					lang === 'graphql' ? 'graphql' : (scriptLang ?? ''),
 					resourcePath,
-					$workspaceStore,
+					$operatingWorkspace,
 					(e) => console.error(`error getting ${lang} (${scriptLang}) db schema`, e),
 					{ customTag }
 				)
@@ -1778,9 +1780,9 @@
 	let customTsTypesData = resource([() => lang], async () => {
 		if (lang !== 'typescript') return undefined
 		let datatables = (
-			await WorkspaceService.listDataTables({ workspace: $workspaceStore ?? '' })
+			await WorkspaceService.listDataTables({ workspace: $operatingWorkspace ?? '' })
 		).map((d) => d.name)
-		let ducklakes = await WorkspaceService.listDucklakes({ workspace: $workspaceStore ?? '' })
+		let ducklakes = await WorkspaceService.listDucklakes({ workspace: $operatingWorkspace ?? '' })
 		return { datatables, ducklakes }
 	})
 	function setTypescriptCustomTypes() {
@@ -1822,7 +1824,7 @@
 				scriptLang === 'nativets')
 		) {
 			const resourceTypes = await ResourceService.listResourceType({
-				workspace: $workspaceStore ?? ''
+				workspace: $operatingWorkspace ?? ''
 			})
 
 			const namespace = formatResourceTypes(
@@ -2023,7 +2025,7 @@
 			$lspTokenStore = newToken
 			token = newToken
 		}
-		let root = hostname + '/api/scripts_u/tokened_raw/' + $workspaceStore + '/' + token
+		let root = hostname + '/api/scripts_u/tokened_raw/' + $operatingWorkspace + '/' + token
 		return root
 	}
 
@@ -2274,10 +2276,10 @@
 
 <svelte:window onkeydown={onKeyDown} />
 <EditorTheme />
-{#if datatableForMigrations && $workspaceStore}
+{#if datatableForMigrations && $operatingWorkspace}
 	<DdlMigrationGuard
 		bind:this={ddlGuard}
-		workspace={$workspaceStore}
+		workspace={$operatingWorkspace}
 		datatable={datatableForMigrations}
 	/>
 {/if}
diff --git a/frontend/src/lib/components/EditorBar.svelte b/frontend/src/lib/components/EditorBar.svelte
index 91516843ab..81ef6c1c96 100644
--- a/frontend/src/lib/components/EditorBar.svelte
+++ b/frontend/src/lib/components/EditorBar.svelte
@@ -22,7 +22,6 @@
 <script lang="ts">
 	import { ResourceService, VariableService, WorkspaceService, type Script } from '$lib/gen'
 
-	import { workspaceStore } from '$lib/stores'
 	import { base } from '$lib/base'
 	import type Editor from './Editor.svelte'
 	import ItemPicker from './ItemPicker.svelte'
@@ -76,6 +75,9 @@
 	import FlowInlineScriptAiButton from './copilot/FlowInlineScriptAIButton.svelte'
 	import GitRepoPopoverPicker from './GitRepoPopoverPicker.svelte'
 	import { insertDelegateToGitRepoInCode } from '$lib/ansibleUtils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		lang: SupportedLanguage | 'bunnative' | undefined
@@ -121,9 +123,8 @@
 		right?: import('svelte').Snippet
 		openAiChat?: boolean
 		moduleId?: string
-		// Workspace to scope variable/resource/data-table lookups to. Defaults to
-		// the nav `$workspaceStore`; an AI-session live editor passes the session's
-		// acting workspace (a fork) so the helper pickers hit the right workspace.
+		// Workspace to scope variable/resource/data-table lookups to. Defaults to the
+		// operating workspace (see `useOperatingWorkspace`).
 		workspace?: string
 	}
 
@@ -153,7 +154,7 @@
 		workspace = undefined
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	let contextualVariablePicker: ItemPicker | undefined = $state()
 	let variablePicker: ItemPicker | undefined = $state()
diff --git a/frontend/src/lib/components/EditorHeader.svelte b/frontend/src/lib/components/EditorHeader.svelte
index fdf18b4b50..25291fa5f0 100644
--- a/frontend/src/lib/components/EditorHeader.svelte
+++ b/frontend/src/lib/components/EditorHeader.svelte
@@ -15,7 +15,15 @@
 	} from '$lib/components/workspacePicker'
 	import BreadcrumbSegment from '$lib/components/BreadcrumbSegment.svelte'
 	import { isOwner } from '$lib/utils'
-	import { userStore, workspaceStore } from '$lib/stores'
+	import { userStore } from '$lib/stores'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	interface Props {
 		summary?: string
@@ -47,9 +55,8 @@
 		 * dropped, leaving only the summary. Used by the condensed session-
 		 * preview top bar to save vertical room. */
 		hidePath?: boolean
-		/** Workspace whose items the breadcrumb picker lists. Session live
-		 * editors pass their acting workspace so the picker isn't scoped to the
-		 * navigation workspace; falls back to $workspaceStore in the picker. */
+		/** Workspace whose items the breadcrumb picker lists; defaults to the operating
+		 * workspace (see `useOperatingWorkspace`). */
 		workspaceId?: string
 	}
 
@@ -116,7 +123,7 @@
 	// Treat an empty path as ownable so the pen popover lets a user pick the
 	// path for a brand-new item. `Path.reset()` then synthesizes a default
 	// under their own user/folder scope.
-	let own = $derived(!path || isOwner(path, $userStore, $workspaceStore))
+	let own = $derived(!path || isOwner(path, actingUser, $operatingWorkspace))
 
 	// Virtual entry for the picker: surfaces the currently-edited item at its
 	// live path (which may differ from `savedPath` mid-rename, so the picker
diff --git a/frontend/src/lib/components/ErrorOrRecoveryHandler.svelte b/frontend/src/lib/components/ErrorOrRecoveryHandler.svelte
index 89e2554c01..0adb5dc690 100644
--- a/frontend/src/lib/components/ErrorOrRecoveryHandler.svelte
+++ b/frontend/src/lib/components/ErrorOrRecoveryHandler.svelte
@@ -1,4 +1,6 @@
 <script lang="ts" module>
+	import type { ErrorHandler } from '$lib/gen/types.gen'
+
 	export const errorHandlerArgs = [
 		'path',
 		'workspace_id',
@@ -17,6 +19,17 @@
 	]
 
 	export const slackErrorHandlerHubPathEnding = '/workspace-or-schedule-error-handler-slack'
+
+	/** The stored `<script|flow>/<path>` form of a handler. `kind` is the Custom tab's Script/Flow
+	 * choice and survives switching to a built-in tab, whose handlers are all scripts: stored as
+	 * `flow/...` they never run. */
+	export function handlerFullPath(
+		selected: ErrorHandler,
+		kind: 'flow' | 'script',
+		path: string
+	): string {
+		return `${selected === 'custom' ? kind : 'script'}/${path}`
+	}
 </script>
 
 <script lang="ts">
@@ -31,7 +44,7 @@
 
 	import type { Schema, SupportedLanguage } from '$lib/common'
 	import { base } from '$lib/base'
-	import { enterpriseLicense, workspaceStore } from '$lib/stores'
+	import { enterpriseLicense } from '$lib/stores'
 	import MsTeamsIcon from '$lib/components/icons/MSTeamsIcon.svelte'
 	import { classNames, emptySchema, emptyString, sendUserToast, tryEvery } from '$lib/utils'
 	import MultiSelect from '$lib/components/select/MultiSelect.svelte'
@@ -43,7 +56,6 @@
 		WorkspaceService,
 		type Flow
 	} from '$lib/gen'
-	import type { ErrorHandler } from '$lib/gen/types.gen'
 	import { inferArgs } from '$lib/infer'
 	import { hubBaseUrlStore } from '$lib/stores'
 
@@ -61,6 +73,9 @@
 	import SmtpConfigurationStatus from './common/smtp/SmtpConfigurationStatus.svelte'
 	import { SettingService } from '$lib/gen'
 	import { isSmtpSettingsValid } from './instanceSettings/SmtpSettings.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	const slackRecoveryHandler = hubPaths.slackRecoveryHandler
 	const slackHandlerScriptPath = hubPaths.slackErrorHandler
@@ -81,9 +96,8 @@
 		customHandlerKind?: 'flow' | 'script'
 		customTabTooltip?: import('svelte').Snippet
 		noMargin?: boolean
-		/** Workspace for handler lookup / settings / test jobs. Defaults to the
-		 * nav `$workspaceStore`; a trigger editor in a forked session passes its
-		 * acting workspace so the handler is resolved and saved there. */
+		/** Workspace for handler lookup / settings / test jobs. Defaults to the operating
+		 * workspace (see `useOperatingWorkspace`). */
 		workspace?: string
 		/** Offer the instance critical alert channels as a destination. Workspace-level
 		 * error handling only: schedules and triggers have no such setting. */
@@ -106,13 +120,12 @@
 		showInstanceAlerts = false
 	}: Props = $props()
 
-	let effectiveWorkspace = $derived(workspace ?? $workspaceStore)
-	// Carry the acting workspace onto the "create from template" route when an
-	// explicit override is set, so a forked session creates the handler script
-	// there. `customScriptTemplate` already has a query string (`?hub=…`).
+	let effectiveWorkspace = $derived(workspace ?? $operatingWorkspace)
+	// Carry the workspace onto the "create from template" route, so the handler script is
+	// created where this handler is saved. `customScriptTemplate` already has a query string.
 	let templateHref = $derived(
-		workspace
-			? `${customScriptTemplate}&workspace=${encodeURIComponent(workspace)}`
+		effectiveWorkspace
+			? `${customScriptTemplate}&workspace=${encodeURIComponent(effectiveWorkspace)}`
 			: customScriptTemplate
 	)
 
diff --git a/frontend/src/lib/components/ExploreAssetButton.svelte b/frontend/src/lib/components/ExploreAssetButton.svelte
index 85ee7f0b98..d48688a871 100644
--- a/frontend/src/lib/components/ExploreAssetButton.svelte
+++ b/frontend/src/lib/components/ExploreAssetButton.svelte
@@ -33,15 +33,18 @@
 	import { Button, ButtonType } from '$lib/components/common'
 	import S3FilePicker from '$lib/components/S3FilePicker.svelte'
 	import { VolumeService } from '$lib/gen'
-	import {
-		globalDbManagerDrawer,
-		globalS3FilePickerExplorer,
-		userStore,
-		workspaceStore
-	} from '$lib/stores'
+	import { globalDbManagerDrawer, globalS3FilePickerExplorer } from '$lib/stores'
 	import { isS3Uri } from '$lib/utils'
 	import { Database, File, HardDriveIcon } from 'lucide-svelte'
 	import DucklakeIcon from './icons/DucklakeIcon.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	const {
 		asset,
@@ -69,7 +72,7 @@
 	} = $props()
 
 	let dbManagerDrawer = $derived(globalDbManagerDrawer.val)
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 	const assetUri = $derived(formatAsset(asset))
 	// Contexts with a select/upload flow pass their own picker; everything else
 	// (e.g. the resources list) falls back to the global read-only explorer.
@@ -80,7 +83,7 @@
 </script>
 
 <Button
-	disabled={$userStore?.operator || disabled}
+	disabled={actingUser?.operator || disabled}
 	unifiedSize={'md'}
 	variant={buttonVariant}
 	wrapperClasses={className}
diff --git a/frontend/src/lib/components/FilterSearchbar.svelte b/frontend/src/lib/components/FilterSearchbar.svelte
index 6c89f1a039..3a4833866a 100644
--- a/frontend/src/lib/components/FilterSearchbar.svelte
+++ b/frontend/src/lib/components/FilterSearchbar.svelte
@@ -1,6 +1,7 @@
 <script lang="ts" module>
 	import { z } from 'zod'
 	import { useSearchParams } from '$lib/svelte5UtilsKit.svelte'
+	import { useHostedPage } from '$lib/components/hostedPage'
 	import { formatDatePretty, parsePrettyDate, type IconType } from '$lib/utils'
 
 	export type FilterSchemaRec = Record<string, FilterSchema>
@@ -134,8 +135,9 @@
 		// URL lacks, so a value written to the instance is undone on the next sync. Going through
 		// urlFilter rather than straight to history keeps the search-param cells in step, so it
 		// does not matter whether a popstate follows.
+		const hosted = useHostedPage()
 		function seed(values: Partial<FilterInstanceRec<T>>) {
-			const sp = new URLSearchParams(window.location.search)
+			const sp = new URLSearchParams(hosted ? untrack(() => hosted.search) : window.location.search)
 			for (const [key, value] of Object.entries(values) as [string, unknown][]) {
 				if (value === undefined || value === null || sp.has(key)) continue
 				urlFilter[key] = value instanceof Date ? value.toISOString() : value
diff --git a/frontend/src/lib/components/FlowBuilder.svelte b/frontend/src/lib/components/FlowBuilder.svelte
index 10c73d882e..10001207ae 100644
--- a/frontend/src/lib/components/FlowBuilder.svelte
+++ b/frontend/src/lib/components/FlowBuilder.svelte
@@ -10,6 +10,7 @@
 		type Job
 	} from '$lib/gen'
 	import { initHistory, redo, undo } from '$lib/history.svelte'
+	import { VERSION_PAGE_SIZE } from '$lib/components/diff_drawer'
 	import {
 		clearLinkedAgentTools,
 		linkedAgentToolsForScope,
@@ -17,13 +18,7 @@
 		linkedAgentToolsVersion,
 		migrateLinkedAgentToolsScope
 	} from '$lib/components/flows/linkedAgentToolsStore.svelte'
-	import {
-		enterpriseLicense,
-		userStore,
-		userWorkspaces,
-		workspaceStore,
-		usedTriggerKinds
-	} from '$lib/stores'
+	import { enterpriseLicense, userStore, userWorkspaces, usedTriggerKinds } from '$lib/stores'
 	import {
 		generateRandomString,
 		orderedJsonStringify,
@@ -41,7 +36,7 @@
 	import DeployOverrideConfirmationModal from '$lib/components/common/confirmationModal/DeployOverrideConfirmationModal.svelte'
 	import AIChangesWarningModal from '$lib/components/copilot/chat/flow/AIChangesWarningModal.svelte'
 
-	import { getContext, setContext, untrack } from 'svelte'
+	import { getContext, onDestroy, setContext, untrack } from 'svelte'
 	import { writable } from 'svelte/store'
 	import CenteredPage from './CenteredPage.svelte'
 	import { Button } from './common'
@@ -111,9 +106,22 @@
 	import { UserDraft } from '$lib/userDraft.svelte'
 	import { setOpenInSessionHandoff } from './sessions/openInSessionContext'
 	import { getEditorStoragePath, setEditorStoragePath } from './editorStoragePathContext'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	let {
 		initialPath = $bindable(''),
+		/** The draft row's own path (the URL path). Unlike `initialPath`, which the
+		 *  route re-seeds from `draft_path` so the topbar shows the pending name,
+		 *  this stays where the item actually is. */
+		userDraftPath = '',
+		onTakeLatest = undefined,
 		pathStoreInit = undefined,
 		newFlow,
 		selectedId,
@@ -158,9 +166,9 @@
 	// and the AutosaveIndicator all target it. Falls back to the global store, so
 	// the full-page editor is unchanged; the sessions preview overrides it to the
 	// session's (forked) workspace, so an embedded editor acts on the session's
-	// fork rather than the navigation workspace ($workspaceStore, which stays put).
+	// fork rather than the navigation workspace (`workspaceStore`, which stays put).
 	// indicatorPath is the matching draft path.
-	const opWorkspace = $derived(autosaveWorkspace ?? $workspaceStore)
+	const opWorkspace = $derived(autosaveWorkspace ?? $operatingWorkspace)
 	const indicatorPath = $derived(autosavePath ?? liveEditorDraftStoragePath)
 
 	let initialPathStore = writable(initialPath)
@@ -183,6 +191,10 @@
 
 	// Used by multiplayer deploy collision warning
 	let deployedValue: Value | undefined = $state(undefined) // Value to diff against
+	let deployedLabel: string | undefined = $state(undefined) // Names it in the diff
+	/** The flow_version the payload in `deployedValue` came from, so the picker marks that
+	 *  one as head rather than trusting the history's first row. */
+	let deployedVersionShown: number | undefined = $state(undefined)
 	let deployedBy: string | undefined = $state(undefined) // Author
 	let confirmCallback: () => void = $state(() => {}) // What happens when user clicks `override` in warning
 	let open: boolean = $state(false) // Is confirmation modal open
@@ -336,7 +348,7 @@
 		// a draft, else the load-time head. This catches both a concurrent deploy
 		// (head moved since open) AND a stale draft reopened after a deploy (head ==
 		// load-time head, but the draft was forked from an older version).
-		const base = draftBaseVersion ?? version
+		const base = draftBaseVersion ?? (version != null ? String(version) : undefined)
 		if (base === undefined) {
 			return
 		}
@@ -347,7 +359,7 @@
 					path: initialPath
 				})
 
-				onLatest = base === flowVersion?.id
+				onLatest = flowVersion != null && base === String(flowVersion.id)
 			} else {
 				onLatest = true
 			}
@@ -463,12 +475,19 @@
 			}
 		}
 	}
-	async function syncWithDeployed() {
+	async function syncWithDeployed(opening?: number) {
 		const flow = await FlowService.getFlowByPath({
 			workspace: opWorkspace!,
-			path: initialPath,
+			// The draft row's own path, not `initialPath` — the route re-seeds that from
+			// the draft's `draft_path` so the topbar shows the pending name, which after
+			// someone renames the item still names the old location. Comparing against
+			// that fetches the row left behind there instead of the live one.
+			path: userDraftPath || initialPath,
 			withStarredInfo: true
 		})
+		// A superseded opening must not write these: the current one would then render
+		// and offer Take latest against the older head.
+		if (opening != null && !diffDrawer?.ownsOpening(opening)) return
 		deployedValue = replaceFalseWithUndefined({
 			...flow,
 			edited_at: undefined,
@@ -476,6 +495,10 @@
 			workspace_id: undefined
 		})
 		deployedBy = flow.edited_by
+		deployedVersionShown = flow.version_id
+		// Names the deployed side of the diff. Without it the reader is shown two panes
+		// and told nothing about what the left one is.
+		deployedLabel = `Deployed${flow.version_id != null ? ` ${flow.version_id}` : ''}${flow.edited_by ? ` by ${flow.edited_by}` : ''} · latest`
 	}
 
 	async function saveFlow(deploymentMsg?: string, toDeploy?: DraftChangesToDeploy): Promise<void> {
@@ -607,7 +630,7 @@
 					await deployTriggers(
 						triggersToDeploy,
 						opWorkspace,
-						!!$userStore?.is_admin || !!$userStore?.is_super_admin,
+						!!actingUser?.is_admin || !!actingUser?.is_super_admin,
 						usedTriggerKinds,
 						$pathStore,
 						true
@@ -618,7 +641,7 @@
 					await deployTriggers(
 						triggersToDeploy,
 						opWorkspace,
-						!!$userStore?.is_admin || !!$userStore?.is_super_admin,
+						!!actingUser?.is_admin || !!actingUser?.is_super_admin,
 						usedTriggerKinds,
 						initialPath
 					)
@@ -1117,21 +1140,117 @@
 		}
 	}
 
-	async function openDiffDrawer() {
+	/** Deployed versions for the diff picker, newest first. Best-effort: losing the
+	 *  list costs the picker, not the diff. */
+	/** Throws: the drawer says so and lets the reader ask for the same page again. */
+	async function fetchVersionPage(page: number) {
+		const path = userDraftPath || initialPath
+		if (!opWorkspace || !path) return undefined
+		{
+			const history = await FlowService.getFlowHistory({
+				workspace: opWorkspace,
+				path,
+				page,
+				perPage: VERSION_PAGE_SIZE
+			})
+			// Head is the version the payload beside this list came from, not whatever the
+			// history now leads with: a deploy landing between the two fetches would
+			// otherwise label the shown (older) value as the latest.
+			const head = deployedVersionShown ?? history[0]?.id
+			// No ordinal: the list arrives a page at a time, so a number counted within one
+			// would rename versions as more load.
+			return history.map((h) => {
+				const detail = [
+					h.created_by,
+					h.created_at ? new Date(h.created_at).toLocaleString() : undefined,
+					h.deployment_msg
+				].filter(Boolean)
+				const isHead = h.id === head
+				return {
+					id: String(h.id),
+					label: `${h.id}${isHead ? ' · latest' : ''}`,
+					subtitle: detail.length ? detail.join(' · ') : undefined,
+					isHead
+				}
+			})
+		}
+	}
+
+	/** The first page, best-effort: losing it costs the picker, not the diff. */
+	async function deployedVersionOptions() {
+		try {
+			return await fetchVersionPage(1)
+		} catch {
+			return undefined
+		}
+	}
+
+	/** Hands the drawer the next page each time the reader asks for one. The page number
+	 *  belongs to this item's history, so it lives here — and only moves once a page has
+	 *  actually arrived, or a failed request would skip it. */
+	function moreVersionsLoader() {
+		let loaded = 1
+		return async () => {
+			const page = await fetchVersionPage(loaded + 1)
+			loaded += 1
+			return page
+		}
+	}
+
+	/** The opening this editor claimed last. A path change remounts this editor while the
+	 *  drawer stays mounted, so its teardown hands that opening back rather than leaving
+	 *  the drawer on the item the user left. */
+	let lastOpening: number | undefined = undefined
+	onDestroy(() => {
+		if (lastOpening != null) diffDrawer?.abandonOpening(lastOpening)
+	})
+
+	export async function openDiffDrawer() {
 		if (!savedFlow) return
-		await syncWithDeployed()
+		// The fetches below are awaited, so a reopen (or a path change, which remounts
+		// this editor but not the drawer) while they run must not have the older one
+		// land last. The drawer counts the openings for that reason.
+		const opening = diffDrawer?.beginOpening()
+		lastOpening = opening
+		if (opening == null) return
+		await syncWithDeployed(opening)
 		const currentDraftTriggers = structuredClone(triggersState.getDraftTriggersSnapshot())
-		diffDrawer?.openDrawer()
+		// Blanking the drawer belongs to the opening that will fill it.
+		if (!diffDrawer?.ownsOpening(opening)) return
+		diffDrawer.openDrawer(opening)
 		const currentFlow = flowStore.val
-		diffDrawer?.setDiff({
-			mode: 'normal',
-			deployed: deployedValue ?? savedFlow,
-			current: {
-				...currentFlow,
-				path: $pathStore,
-				draft_triggers: currentDraftTriggers
-			}
-		})
+		const versions = await deployedVersionOptions()
+		if (!diffDrawer?.ownsOpening(opening)) return
+		diffDrawer.setDiff(
+			{
+				mode: 'normal',
+				deployed: deployedValue ?? savedFlow,
+				deployedLabel,
+				versions,
+				loadMoreVersions: moreVersionsLoader(),
+				onTakeLatest,
+				draftBase: draftBaseVersion,
+				deployedHead: deployedVersionShown != null ? String(deployedVersionShown) : undefined,
+				loadVersion: async (id) => {
+					const v = await FlowService.getFlowVersion({
+						workspace: opWorkspace!,
+						version: Number(id)
+					})
+					return replaceFalseWithUndefined({
+						...v,
+						edited_at: undefined,
+						edited_by: undefined,
+						workspace_id: undefined
+					})
+				},
+				current: {
+					...currentFlow,
+					path: $pathStore,
+					draft_triggers: currentDraftTriggers
+				}
+			},
+			opening
+		)
 	}
 
 	let flowCopilotContext: FlowCopilotContext = $state({
@@ -1376,6 +1495,7 @@
 	{confirmCallback}
 	bind:open
 	{diffDrawer}
+	claimOpening={() => (lastOpening = diffDrawer?.beginOpening())}
 	bind:deployedValue
 	currentValue={flowStore.val}
 />
@@ -1396,7 +1516,7 @@
 <AIChangesWarningModal bind:open={aiChangesWarningOpen} onConfirm={aiChangesConfirmCallback} />
 
 {#key renderCount}
-	{#if !$userStore?.operator}
+	{#if !actingUser?.operator}
 		{#if $pathStore}
 			<FlowHistory bind:this={flowHistory} path={$pathStore} {onHistoryRestore} />
 		{/if}
diff --git a/frontend/src/lib/components/FlowGraphViewer.svelte b/frontend/src/lib/components/FlowGraphViewer.svelte
index 945533bcc8..daff7cf8db 100644
--- a/frontend/src/lib/components/FlowGraphViewer.svelte
+++ b/frontend/src/lib/components/FlowGraphViewer.svelte
@@ -10,10 +10,12 @@
 	import FlowGraphViewerStep from './FlowGraphViewerStep.svelte'
 	import FlowGraphV2 from './graph/FlowGraphV2.svelte'
 	import { dfs } from './flows/dfs'
-	import { workspaceStore } from '$lib/stores'
 	import { untrack } from 'svelte'
 	import { publishLinkedAgentTools } from './flows/flowState'
 	import { linkedToolsScope } from './flows/linkedAgentToolsStore.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		flow: {
@@ -45,7 +47,7 @@
 		noGraph = false,
 		triggerNode = false,
 		stepDetail = $bindable(undefined),
-		workspace = $workspaceStore,
+		workspace = $operatingWorkspace,
 		minHeight = 400,
 		noBorder = false,
 		hideDefaultInputs = false,
diff --git a/frontend/src/lib/components/FlowGraphViewerStep.svelte b/frontend/src/lib/components/FlowGraphViewerStep.svelte
index 1e4525274f..1081371b6f 100644
--- a/frontend/src/lib/components/FlowGraphViewerStep.svelte
+++ b/frontend/src/lib/components/FlowGraphViewerStep.svelte
@@ -12,7 +12,7 @@
 	import SchemaViewer from './SchemaViewer.svelte'
 	import { scriptPathToHref } from '$lib/scripts'
 	import { cleanExpr, copyToClipboard } from '$lib/utils'
-	import { hubBaseUrlStore, workspaceStore } from '$lib/stores'
+	import { hubBaseUrlStore } from '$lib/stores'
 
 	import { twMerge } from 'tailwind-merge'
 	import FlowModuleScript from './flows/content/FlowModuleScript.svelte'
@@ -20,6 +20,9 @@
 	import HighlightTheme from './HighlightTheme.svelte'
 	import LanguageIcon from './common/languageIcons/LanguageIcon.svelte'
 	import FlowGraphViewerStepHeader from './FlowGraphViewerStepHeader.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		schema?: any | undefined
@@ -41,7 +44,7 @@
 		workspace = undefined,
 		onBack = undefined
 	}: Props = $props()
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 	let codeViewer: Drawer | undefined = $state()
 </script>
 
diff --git a/frontend/src/lib/components/FlowHistoryJobPicker.svelte b/frontend/src/lib/components/FlowHistoryJobPicker.svelte
index 26fa41f1af..dfb4927af1 100644
--- a/frontend/src/lib/components/FlowHistoryJobPicker.svelte
+++ b/frontend/src/lib/components/FlowHistoryJobPicker.svelte
@@ -3,9 +3,11 @@
 	import { createEventDispatcher, untrack } from 'svelte'
 	import PopoverV2 from '$lib/components/meltComponents/Popover.svelte'
 	import HistoricInputs from './HistoricInputs.svelte'
-	import { workspaceStore } from '$lib/stores'
 	import { JobService } from '$lib/gen'
 	import { Button } from './common'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		path: string
@@ -27,7 +29,7 @@
 	async function loadInitial() {
 		loading = true
 		let jobs = await JobService.listJobs({
-			workspace: $workspaceStore!,
+			workspace: $operatingWorkspace!,
 			scriptPathExact: path,
 			jobKinds: ['flow', 'flowpreview'].join(','),
 			perPage: 1
@@ -43,7 +45,7 @@
 	}
 
 	$effect(() => {
-		if ($workspaceStore && !newFlow) {
+		if ($operatingWorkspace && !newFlow) {
 			untrack(() => loadInitial())
 		}
 	})
diff --git a/frontend/src/lib/components/FlowJobResult.svelte b/frontend/src/lib/components/FlowJobResult.svelte
index eea95a6ecf..66e30aefec 100644
--- a/frontend/src/lib/components/FlowJobResult.svelte
+++ b/frontend/src/lib/components/FlowJobResult.svelte
@@ -2,10 +2,7 @@
 	import { Loader2 } from 'lucide-svelte'
 	import DisplayResult from './DisplayResult.svelte'
 	import LogViewer from './LogViewer.svelte'
-	import type { CompletedJob, Job } from '$lib/gen'
-	import AiAgentLogViewer from './AIAgentLogViewer.svelte'
 	import { twMerge } from 'tailwind-merge'
-	import type { AgentTool } from './flows/agentToolUtils'
 
 	interface Props {
 		waitingForExecutor?: boolean
@@ -16,17 +13,13 @@
 		loading: boolean
 		filename?: string | undefined
 		jobId?: string | undefined
+		/** Identifies the run, which `jobId` cannot on the replay page. */
+		runKey?: string | undefined
 		tag?: string | undefined
 		workspaceId?: string | undefined
 		refreshLog?: boolean
 		downloadLogs?: boolean
 		tagLabel?: string | undefined
-		aiAgentStatus?: {
-			tools: AgentTool[]
-			agentJob: Partial<CompletedJob> & Pick<CompletedJob, 'id'> & { type: 'CompletedJob' }
-			storedToolCallJobs?: Record<number, Job>
-			onToolJobLoaded?: (job: Job, idx: number) => void
-		}
 	}
 
 	let {
@@ -38,11 +31,11 @@
 		loading,
 		filename = undefined,
 		jobId = undefined,
+		runKey = undefined,
 		tag = undefined,
 		workspaceId = undefined,
 		downloadLogs = true,
-		tagLabel = undefined,
-		aiAgentStatus = undefined
+		tagLabel = undefined
 	}: Props = $props()
 </script>
 
@@ -60,7 +53,15 @@
 				: 'max-h-80'} overflow-auto rounded-md grow min-h-0 border bg-surface-tertiary p-2"
 		>
 			{#if result !== undefined || result_stream !== undefined}
-				<DisplayResult {workspaceId} {jobId} {filename} {result} {result_stream} growVertical />
+				<DisplayResult
+					{workspaceId}
+					{jobId}
+					{runKey}
+					{filename}
+					{result}
+					{result_stream}
+					growVertical
+				/>
 			{:else if loading}
 				<Loader2 class="animate-spin" />
 			{:else}
@@ -70,19 +71,15 @@
 	</div>
 	<div class="relative flex flex-col gap-1">
 		<span class="text-emphasis text-xs font-semibold">Logs</span>
-		{#if aiAgentStatus}
-			<AiAgentLogViewer {...aiAgentStatus} {workspaceId} noPadding />
-		{:else}
-			<div class="rounded-md grow min-h-0 border bg-surface-tertiary overflow-hidden">
-				<LogViewer
-					{tagLabel}
-					download={downloadLogs}
-					content={logs ?? ''}
-					{jobId}
-					isLoading={waitingForExecutor}
-					{tag}
-				/>
-			</div>
-		{/if}
+		<div class="rounded-md grow min-h-0 border bg-surface-tertiary overflow-hidden">
+			<LogViewer
+				{tagLabel}
+				download={downloadLogs}
+				content={logs ?? ''}
+				{jobId}
+				isLoading={waitingForExecutor}
+				{tag}
+			/>
+		</div>
 	</div>
 </div>
diff --git a/frontend/src/lib/components/FlowLogViewer.svelte b/frontend/src/lib/components/FlowLogViewer.svelte
index 385d028e7e..6a8db18a76 100644
--- a/frontend/src/lib/components/FlowLogViewer.svelte
+++ b/frontend/src/lib/components/FlowLogViewer.svelte
@@ -11,7 +11,6 @@
 		Keyboard
 	} from 'lucide-svelte'
 	import { base } from '$lib/base'
-	import { workspaceStore } from '$lib/stores'
 	import ObjectViewer from './propertyPicker/ObjectViewer.svelte'
 	import LogViewer from './LogViewer.svelte'
 	import FlowLogViewer from './FlowLogViewer.svelte'
@@ -26,6 +25,9 @@
 	import { Tooltip } from './meltComponents'
 	import FlowTimelineBar from './FlowTimelineBar.svelte'
 	import { getActiveReplay } from './recording/replay.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	type RootJobData = Partial<Job>
 
@@ -49,7 +51,6 @@
 		) => Promise<void>
 		getSelectedIteration: (stepId: string) => number
 		flowSummary?: string
-		mode?: 'flow' | 'aiagent'
 		currentId?: string | null
 		navigationChain?: NavigationChain
 		select: (id: string) => void
@@ -81,7 +82,6 @@
 		onSelectedIteration,
 		getSelectedIteration,
 		flowSummary,
-		mode = 'flow',
 		currentId,
 		navigationChain = $bindable(),
 		select,
@@ -98,7 +98,7 @@
 
 	function getJobLink(jobId: string | undefined): string {
 		if (!jobId) return ''
-		return `${base}/run/${jobId}?workspace=${workspaceId ?? $workspaceStore}`
+		return `${base}/run/${jobId}?workspace=${workspaceId ?? $operatingWorkspace}`
 	}
 
 	function getStatusColor(status: FlowStatusModule['type'] | undefined): string {
@@ -127,18 +127,16 @@
 	function getStepProgress(job: RootJobData | undefined, totalSteps: number): string {
 		if (!job || totalSteps === 0) return ''
 
-		const stepWord = mode === 'aiagent' ? 'action' : 'step'
-
 		// If flow is completed, show total steps
 		if (job.type === 'CompletedJob') {
-			return ` (${totalSteps} ${stepWord}${totalSteps === 1 ? '' : 's'})`
+			return ` (${totalSteps} step${totalSteps === 1 ? '' : 's'})`
 		}
 
 		// If flow is running, use flow_status.step if available (like JobStatus.svelte)
 		if (job.type === 'QueuedJob') {
 			if (job.flow_status?.step !== undefined) {
 				const currentStep = (job.flow_status.step ?? 0) + 1
-				return ` (${stepWord} ${currentStep} of ${totalSteps})`
+				return ` (step ${currentStep} of ${totalSteps})`
 			}
 
 			return ''
@@ -558,7 +556,7 @@
 					{@render flowIcon(getFlowStatus(rootJob), flowInfo?.hasErrors)}
 
 					<div class="text-xs text-left font-mono">
-						{mode === 'aiagent' ? 'AI Agent' : level == 0 ? 'Flow' : 'Subflow'}
+						{level == 0 ? 'Flow' : 'Subflow'}
 						{#if flowInfo?.label}
 							: {flowInfo.label}
 						{/if}
@@ -703,32 +701,22 @@
 												<div class="flex items-center gap-2">
 													<span class="text-xs font-mono text-left">
 														<b class="flex items-center gap-1">
-															{#if mode === 'aiagent'}
-																{#if module.summary}
-																	Tool call: {module.summary}
-																{:else}
-																	Message
-																{/if}
-															{:else}
-																{module.id}
-															{/if}
+															{module.id}
 														</b>
-														{#if mode === 'flow'}
-															{#if module.value.type === 'forloopflow'}
-																For loop
-															{:else if module.value.type === 'whileloopflow'}
-																While loop
-															{:else if module.value.type === 'branchall'}
-																Branch to all
-															{:else if module.value.type === 'branchone'}
-																Branch to one
-															{:else if module.value.type === 'flow'}
-																Subflow
-															{:else}
-																Step
-															{/if}
+														{#if module.value.type === 'forloopflow'}
+															For loop
+														{:else if module.value.type === 'whileloopflow'}
+															While loop
+														{:else if module.value.type === 'branchall'}
+															Branch to all
+														{:else if module.value.type === 'branchone'}
+															Branch to one
+														{:else if module.value.type === 'flow'}
+															Subflow
+														{:else}
+															Step
 														{/if}
-														{#if module.summary && mode !== 'aiagent'}
+														{#if module.summary}
 															: {module.summary}
 														{/if}
 														{#if hasEmptySubflowValue}
diff --git a/frontend/src/lib/components/FlowLogViewerWrapper.svelte b/frontend/src/lib/components/FlowLogViewerWrapper.svelte
index 648dbc9f06..12abe9bfb2 100644
--- a/frontend/src/lib/components/FlowLogViewerWrapper.svelte
+++ b/frontend/src/lib/components/FlowLogViewerWrapper.svelte
@@ -20,7 +20,6 @@
 				| { id: string; index: number; manuallySet: true; moduleId: string }
 				| { manuallySet: false; moduleId: string }
 		) => Promise<void>
-		mode?: 'flow' | 'aiagent'
 	}
 
 	let {
@@ -29,8 +28,7 @@
 		localDurationStatuses,
 		workspaceId,
 		render,
-		onSelectedIteration,
-		mode = 'flow'
+		onSelectedIteration
 	}: Props = $props()
 
 	// State for tracking expanded rows - using Record to allow explicit control
@@ -180,7 +178,6 @@
 		{render}
 		{getSelectedIteration}
 		flowId="root"
-		{mode}
 		{currentId}
 		bind:navigationChain
 		{select}
diff --git a/frontend/src/lib/components/FlowLoopIterationPreview.svelte b/frontend/src/lib/components/FlowLoopIterationPreview.svelte
index 0a4f5c60ee..f136cbfe39 100644
--- a/frontend/src/lib/components/FlowLoopIterationPreview.svelte
+++ b/frontend/src/lib/components/FlowLoopIterationPreview.svelte
@@ -1,6 +1,5 @@
 <script lang="ts">
 	import { type Job, JobService, type FlowModule, type RestartedFrom } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { Button } from './common'
 	import { createEventDispatcher, getContext } from 'svelte'
 	import type { FlowEditorContext } from './flows/types'
@@ -11,6 +10,9 @@
 	import FlowProgressBar from './flows/FlowProgressBar.svelte'
 	import { CornerDownLeft, Play, RefreshCw, X } from 'lucide-svelte'
 	import type { Schema } from '$lib/common'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		open: boolean
@@ -165,7 +167,7 @@
 					try {
 						jobId &&
 							(await JobService.cancelQueuedJob({
-								workspace: opWorkspace?.() ?? $workspaceStore ?? '',
+								workspace: opWorkspace?.() ?? $operatingWorkspace ?? '',
 								id: jobId,
 								requestBody: {}
 							}))
diff --git a/frontend/src/lib/components/FlowPreviewContent.svelte b/frontend/src/lib/components/FlowPreviewContent.svelte
index 32b46cb2be..9ccac1d8c6 100644
--- a/frontend/src/lib/components/FlowPreviewContent.svelte
+++ b/frontend/src/lib/components/FlowPreviewContent.svelte
@@ -6,7 +6,6 @@
 		type OpenFlow,
 		type ScriptLang
 	} from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { Badge, Button } from './common'
 	import { createEventDispatcher, getContext, untrack } from 'svelte'
 	import type { FlowEditorContext } from './flows/types'
@@ -44,6 +43,9 @@
 	import FlowRestartButton from './FlowRestartButton.svelte'
 	import { useNestedRestartState } from './useNestedRestartState.svelte'
 	import { buildFlowRecording, downloadRecordingJson } from './recording/runRecording'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		previewMode: 'upTo' | 'whole'
@@ -138,7 +140,7 @@
 		opWorkspace
 	} = $state(getContext<FlowEditorContext>('FlowEditorContext'))
 	// Acting workspace when previewing inside an AI session; else the nav workspace.
-	let opWs = $derived(opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(opWorkspace?.() ?? $operatingWorkspace)
 	const dispatch = createEventDispatcher()
 
 	let renderCount: number = $state(0)
@@ -471,7 +473,9 @@
 							return jobId ?? ''
 						}}
 						conversationKind="test"
+						frame="boxed"
 						path={$pathStore}
+						identity={$initialPathStore || fakeInitialPath}
 						inputSchema={flowStore.val.schema}
 						flowModules={flowStore.val.value?.modules}
 					/>
@@ -558,7 +562,13 @@
 				</div>
 			{/if}
 		{/if}
-		<div class="pt-4 flex flex-col border-t relative">
+		<!-- The rule divides the inputs form from its results. Chat mode has no form: the
+		     chat is its own panel, and a second line right under it reads as a stray edge. -->
+		<div
+			class="pt-4 flex flex-col relative {flowStore.val.value?.chat_input_enabled
+				? ''
+				: 'border-t'}"
+		>
 			{#if flowHasChanged()}
 				<div class="pb-2">
 					<div
diff --git a/frontend/src/lib/components/FlowRestartButton.svelte b/frontend/src/lib/components/FlowRestartButton.svelte
index d470c51b54..2c7f323649 100644
--- a/frontend/src/lib/components/FlowRestartButton.svelte
+++ b/frontend/src/lib/components/FlowRestartButton.svelte
@@ -1,9 +1,11 @@
 <script lang="ts">
 	import { Badge, Button } from './common'
 	import Popover from './meltComponents/Popover.svelte'
-	import { Play, RefreshCw } from 'lucide-svelte'
+	import { ChevronDown, Play, RefreshCw } from 'lucide-svelte'
 	import { FlowService, JobService, type FlowVersion } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 	import { emptyString, sendUserToast } from '$lib/utils'
 
 	interface Props {
@@ -18,6 +20,8 @@
 		enterpriseOnly?: boolean
 		variant?: 'default' | 'accent'
 		unifiedSize?: 'xs' | 'sm' | 'md' | 'lg'
+		/** `link` renders the trigger as inline text, for use inside a sentence. */
+		triggerStyle?: 'button' | 'link'
 		/**
 		 * For nested-step restarts: path of ancestor containers from the top-level
 		 * step down to the leaf. When provided, the LAST entry's step_id is the
@@ -69,6 +73,7 @@
 		enterpriseOnly = false,
 		variant = 'default',
 		unifiedSize = 'md',
+		triggerStyle = 'button',
 		nestedPath = undefined,
 		nestedTopStepId = undefined,
 		nestedTopBranchOrIterationN = undefined,
@@ -87,6 +92,10 @@
 			: selectedJobStep
 	)
 
+	const restartTitle = $derived(
+		`Re-start this flow from step ${displayStepId} (included).${enterpriseOnly ? ' This is a feature only available in enterprise edition.' : ''}`
+	)
+
 	// Sentinel value meaning "use the same version as the original run" (backend receives undefined)
 	const RUN_VERSION_SENTINEL = -1
 
@@ -140,8 +149,13 @@
 		})
 		return out
 	})
+	// A link has no button of its own to restart on click: it always opens the
+	// popover, whose Restart button then acts as the confirmation.
 	const needsPopup = $derived(
-		!!flowPath || iterationFields.length > 0 || selectedJobStepType !== 'single'
+		triggerStyle === 'link' ||
+			!!flowPath ||
+			iterationFields.length > 0 ||
+			selectedJobStepType !== 'single'
 	)
 	let selectedFlowVersion: number = $state(RUN_VERSION_SENTINEL)
 	let flowVersions: Array<FlowVersion> = $state([])
@@ -166,7 +180,7 @@
 					flow_version: flowVersion
 				}
 		let run = await JobService.restartFlowAtStep({
-			workspace: $workspaceStore!,
+			workspace: $operatingWorkspace!,
 			id: jobId,
 			requestBody
 		})
@@ -178,7 +192,7 @@
 		loadingVersions = true
 		try {
 			flowVersions = await FlowService.getFlowHistory({
-				workspace: $workspaceStore!,
+				workspace: $operatingWorkspace!,
 				path: flowPath
 			})
 			if (flowVersions.length > 0) {
@@ -242,12 +256,21 @@
 	</label>
 {/snippet}
 {#snippet restartTriggerButton(usePlayIcon: boolean)}
+	{#if triggerStyle === 'link'}
+		<!-- The popover trigger is already a <button>; nesting another is invalid. -->
+		<span class="underline hover:no-underline" title={restartTitle}>Restart from this step</span>
+	{:else}
+		{@render restartButton(usePlayIcon)}
+	{/if}
+{/snippet}
+{#snippet restartButton(usePlayIcon: boolean)}
 	<Button
-		title={`Re-start this flow from step ${displayStepId} (included).${enterpriseOnly ? ' This is a feature only available in enterprise edition.' : ''}`}
+		title={restartTitle}
 		{variant}
 		{unifiedSize}
 		{disabled}
 		startIcon={{ icon: usePlayIcon ? Play : RefreshCw }}
+		endIcon={needsPopup ? { icon: ChevronDown } : undefined}
 		nonCaptureEvent={!usePlayIcon || !!flowPath}
 		onClick={() => {
 			if (usePlayIcon && !flowPath) {
@@ -271,6 +294,12 @@
 	<Popover
 		floatingConfig={{ strategy: 'absolute', placement: 'bottom-start' }}
 		disablePopup={!needsPopup}
+		triggerAttrs={{
+			'aria-label':
+				triggerStyle === 'link'
+					? `Restart from this step (${displayStepId})`
+					: `Re-start from ${displayStepId}`
+		}}
 		on:openChange={(e) => {
 			if (e.detail) {
 				loadFlowVersions()
diff --git a/frontend/src/lib/components/FlowStatusViewer.svelte b/frontend/src/lib/components/FlowStatusViewer.svelte
index cfca77b748..7a2a28775e 100644
--- a/frontend/src/lib/components/FlowStatusViewer.svelte
+++ b/frontend/src/lib/components/FlowStatusViewer.svelte
@@ -4,8 +4,11 @@
 	import { setContext, untrack } from 'svelte'
 	import type { DurationStatus, FlowStatusViewerContext, GraphModuleState } from './graph'
 	import { isOwner as loadIsOwner, type StateStore } from '$lib/utils'
-	import { userStore, workspaceStore } from '$lib/stores'
+	import { userStore } from '$lib/stores'
 	import type { CompletedJob, FlowModule, FlowNote, FlowValue, Job } from '$lib/gen'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		jobId: string
@@ -98,7 +101,7 @@
 	})
 
 	function loadOwner(path: string) {
-		isOwner = loadIsOwner(path, $userStore!, workspaceId ?? $workspaceStore!)
+		isOwner = loadIsOwner(path, $userStore!, workspaceId ?? $operatingWorkspace!)
 	}
 
 	async function updateJobId() {
diff --git a/frontend/src/lib/components/FlowStatusViewerInner.svelte b/frontend/src/lib/components/FlowStatusViewerInner.svelte
index 3b860dc3a1..1d56c20b38 100644
--- a/frontend/src/lib/components/FlowStatusViewerInner.svelte
+++ b/frontend/src/lib/components/FlowStatusViewerInner.svelte
@@ -15,7 +15,6 @@
 		type FlowNote,
 		type FlowValue
 	} from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { base } from '$lib/base'
 	import FlowJobResult from './FlowJobResult.svelte'
 	import WorkflowTimeline from './WorkflowTimeline.svelte'
@@ -65,11 +64,13 @@
 	import { getActiveReplay } from './recording/replay.svelte'
 	import { publishLinkedAgentTools } from './flows/flowState'
 	import {
-		getLinkedAgentTools,
 		linkedToolsScope,
 		releaseLinkedToolsScope,
 		retainLinkedToolsScope
 	} from './flows/linkedAgentToolsStore.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let {
 		flowState: flowStateStore,
@@ -169,7 +170,7 @@
 		isSubflow = false,
 		reducedPolling = false,
 		wideResults = false,
-		workspace = $workspaceStore,
+		workspace = $operatingWorkspace,
 		prefix = undefined,
 		topModuleStates = undefined,
 		refreshGlobal,
@@ -243,7 +244,7 @@
 						resourceMetadataCache[asset.path] = undefined
 						if (!isReplay) {
 							ResourceService.getResource({
-								workspace: workspace ?? $workspaceStore!,
+								workspace: workspace ?? $operatingWorkspace!,
 								path: asset.path
 							})
 								.then((r) => (resourceMetadataCache[asset.path] = r))
@@ -279,7 +280,7 @@
 	// resolving in the navigation one finds nothing, or an unrelated resource sharing the path. The
 	// store scope stays keyed on `workspace` to match what FlowGraphV2 reads — the job id in the key
 	// already makes the bucket unique.
-	let agentFetchWorkspace = $derived(workspaceId ?? job?.workspace_id ?? $workspaceStore)
+	let agentFetchWorkspace = $derived(workspaceId ?? job?.workspace_id ?? $operatingWorkspace)
 	// Hold this scope for as long as the viewer is mounted, so the store's cap can't drop tools the
 	// run still needs (nothing would refetch them — the set of linked steps hasn't changed).
 	$effect(() => {
@@ -628,7 +629,7 @@
 				) {
 					if (!isReplay) {
 						JobService.getJob({
-							workspace: workspaceId ?? $workspaceStore ?? '',
+							workspace: workspaceId ?? $operatingWorkspace ?? '',
 							id: mod.job ?? '',
 							noLogs: true,
 							noCode: true
@@ -723,7 +724,7 @@
 						})
 						if (!isReplay) {
 							JobService.getStartedAtByIds({
-								workspace: workspaceId ?? $workspaceStore ?? '',
+								workspace: workspaceId ?? $operatingWorkspace ?? '',
 								requestBody: missingStartedAtIds
 							})
 								.then((jobs) => {
@@ -943,6 +944,15 @@
 		}
 	}
 
+	// A running parallel module keeps this flow's own id in `job` (its children are only in
+	// `flow_jobs`), so passing it through would make the nested viewer watch this flow again.
+	function innerViewerJobId(mod: FlowStatusModule): string {
+		if (mod.job && mod.job == job?.id && mod.flow_jobs?.length) {
+			return mod.flow_jobs[0]
+		}
+		return mod.job ?? ''
+	}
+
 	function onJobsLoadedInner(mod: FlowStatusModule, job: Job, force?: boolean): void {
 		let id = mod.id
 		if (id && ((mod.flow_jobs ?? []).length == 0 || force)) {
@@ -1570,7 +1580,7 @@
 									let storedJob = storedListJobs[j]
 									if (!storedJob && !isReplay) {
 										storedJob = await JobService.getJob({
-											workspace: workspaceId ?? $workspaceStore ?? '',
+											workspace: workspaceId ?? $operatingWorkspace ?? '',
 											id: loopJobId,
 											noLogs: true,
 											noCode: true
@@ -1782,7 +1792,7 @@
 										{subflowParentsGlobalModuleStates}
 										{subflowParentsDurationStatuses}
 										{isSelectedBranch}
-										jobId={mod.job ?? ''}
+										jobId={innerViewerJobId(mod)}
 										{reducedPolling}
 										innerModule={mod.flow_jobs ? job.raw_flow?.modules[i]?.value : undefined}
 										flowJobIds={mod.flow_jobs
@@ -2121,6 +2131,7 @@
 														tagLabel={customUi?.tagLabel}
 														workspaceId={isReplay ? undefined : job?.workspace_id}
 														jobId={isReplay ? undefined : job?.id}
+														runKey={job?.id}
 														filename={job.id}
 														loading={job['running']}
 														tag={job?.tag}
@@ -2135,22 +2146,13 @@
 															id={isReplay ? undefined : job.id}
 															workspace={isReplay
 																? undefined
-																: (job.workspace_id ?? $workspaceStore ?? 'no_w')}
+																: (job.workspace_id ?? $operatingWorkspace ?? 'no_w')}
 															args={job.args}
 														/>
 													{:else}
 														<p class="text-secondary">No arguments</p>
 													{/if}
 												{:else if node}
-													{@const module =
-														stepDetail && typeof stepDetail !== 'string' ? stepDetail : undefined}
-													{@const agentTools =
-														module && module.value.type === 'aiagent'
-															? module.value.agent
-																? getLinkedAgentTools(linkedToolsViewScope, module.id)
-																: (module.value.tools ?? [])
-															: undefined}
-													{@const parentLoopsPrefix = getParentLoopsPrefix(module?.id ?? '')}
 													{#if node.flow_jobs_results}
 														<div>
 															<span class="pl-1 text-emphasis text-xs font-medium"
@@ -2211,7 +2213,7 @@
 																			id={isReplay ? undefined : node.job_id}
 																			workspace={isReplay
 																				? undefined
-																				: (job.workspace_id ?? $workspaceStore ?? 'no_w')}
+																				: (job.workspace_id ?? $operatingWorkspace ?? 'no_w')}
 																			args={node.args}
 																		/>
 																	</div>
@@ -2236,6 +2238,7 @@
 																tagLabel={customUi?.tagLabel}
 																workspaceId={isReplay ? undefined : job?.workspace_id}
 																jobId={isReplay ? undefined : node.job_id}
+																runKey={node.job_id}
 																loading={node.type != 'Success' && node.type != 'Failure'}
 																waitingForExecutor={node.type == 'WaitingForExecutor'}
 																refreshLog={node.type == 'InProgress'}
@@ -2245,30 +2248,6 @@
 																tag={node.tag}
 																logs={node.logs}
 																downloadLogs={!hideDownloadLogs && !isReplay}
-																aiAgentStatus={agentTools &&
-																node?.job_id &&
-																(node.type === 'Success' || node.type === 'Failure')
-																	? {
-																			tools: agentTools,
-																			agentJob: {
-																				id: node.job_id,
-																				result: node.result,
-																				logs: node.logs,
-																				args: node.args,
-																				success: node.type === 'Success',
-																				type: 'CompletedJob'
-																			},
-																			storedToolCallJobs: module
-																				? toolCallStore?.getLocalToolCallJobs(parentLoopsPrefix)
-																				: undefined,
-																			onToolJobLoaded: (job, idx) => {
-																				if (module) {
-																					const storeKey = parentLoopsPrefix + module.id + '-' + idx
-																					toolCallStore?.setStoredToolCallJob(storeKey, job)
-																				}
-																			}
-																		}
-																	: undefined}
 															/>
 														</div>
 													</div>
diff --git a/frontend/src/lib/components/FlowViewer.svelte b/frontend/src/lib/components/FlowViewer.svelte
index 03baebb501..c68d62ad42 100644
--- a/frontend/src/lib/components/FlowViewer.svelte
+++ b/frontend/src/lib/components/FlowViewer.svelte
@@ -7,12 +7,14 @@
 	import { Loader2 } from 'lucide-svelte'
 	import { cleanValueProperties, replaceFalseWithUndefined } from '$lib/utils'
 	import { orderedYamlStringify } from '$lib/utils/orderedYaml'
-	import { workspaceStore } from '$lib/stores'
 	import { watch } from 'runed'
 
 	import HighlightTheme from './HighlightTheme.svelte'
 	import FlowViewerInner from './FlowViewerInner.svelte'
 	import FlowInputViewer from './FlowInputViewer.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface PreviousFlow {
 		summary: string
@@ -86,7 +88,7 @@
 				return
 			}
 			previousFlow = await FlowService.getFlowVersion({
-				workspace: $workspaceStore!,
+				workspace: $operatingWorkspace!,
 				version
 			})
 			previousFlowCache[version] = previousFlow
diff --git a/frontend/src/lib/components/FolderEditor.svelte b/frontend/src/lib/components/FolderEditor.svelte
index e8f37a625c..7af2066fa6 100644
--- a/frontend/src/lib/components/FolderEditor.svelte
+++ b/frontend/src/lib/components/FolderEditor.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
 	import { userStore, workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 	import {
 		type Folder,
 		type FolderDefaultPermissionedAs,
@@ -89,8 +90,12 @@
 		workspace
 	}: Props = $props()
 
-	const targetWorkspace = $derived(workspace ?? $workspaceStore ?? '')
-	const aimedElsewhere = $derived(!!workspace && workspace !== $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const targetWorkspace = $derived(workspace ?? $operatingWorkspace ?? '')
+	const aimedElsewhere = $derived(!!targetWorkspace && targetWorkspace !== $workspaceStore)
+	// The group editor and permission history act on the operating workspace and take no
+	// workspace of their own, so they can only follow a drawer aimed at that one.
+	const offOperating = $derived(!!targetWorkspace && targetWorkspace !== $operatingWorkspace)
 
 	// `$userStore` describes the workspace the app is *in*. Aimed at another one it answers
 	// the wrong question — a folder admin there would get read-only controls, and a
@@ -121,9 +126,9 @@
 	})
 
 	async function loadTargetUser(): Promise<void> {
-		if (!aimedElsewhere || !workspace) return
+		if (!aimedElsewhere) return
 		try {
-			targetUser = await UserService.whoami({ workspace })
+			targetUser = await UserService.whoami({ workspace: targetWorkspace })
 		} catch {
 			// Not a member, or the call failed: no membership means read-only controls,
 			// which is the safe reading — the write would be refused anyway.
@@ -551,7 +556,7 @@
 	let loadStarted = false
 	$effect.pre(() => {
 		if (loadStarted) return
-		if ($workspaceStore && $userStore) {
+		if (targetWorkspace && $userStore) {
 			loadStarted = true
 			untrack(() => {
 				load()
@@ -675,10 +680,7 @@
 											class="grow min-w-0"
 										>
 											{#snippet endSnippet({ item, close: closeSelect })}
-												<!-- GroupEditor reads and writes `$workspaceStore` and takes no workspace of its
-												     own, so it cannot follow a drawer aimed at another one: viewing a group
-												     there would edit the same-named group in the active workspace. -->
-												{#if ownerKind == 'group' && !aimedElsewhere}
+												{#if ownerKind == 'group' && !offOperating}
 													<Button
 														title="View group"
 														variant="subtle"
@@ -696,7 +698,7 @@
 												{/if}
 											{/snippet}
 											{#snippet bottomSnippet({ close: closeSelect })}
-												{#if ownerKind == 'group' && !aimedElsewhere}
+												{#if ownerKind == 'group' && !offOperating}
 													<Button
 														variant="subtle"
 														unifiedSize="sm"
@@ -838,11 +840,9 @@
 								</Cell>
 								<Cell last actions>
 									<div class="flex items-center justify-end">
-										<!-- The group editor reads `$workspaceStore`, so it can only be opened for the
-										     workspace the app is in — see the picker's own buttons. It decides on its
-										     own whether the group is editable here; a member with no write on it still
-										     gets to see who is in it. -->
-										{#if ownerKindOf(perm.owner_name) === 'group' && !aimedElsewhere}
+										<!-- The group editor decides on its own whether the group is editable here; a
+										     member with no write on it still gets to see who is in it. -->
+										{#if ownerKindOf(perm.owner_name) === 'group' && !offOperating}
 											<Button
 												title="Manage group"
 												variant="subtle"
@@ -1001,9 +1001,7 @@
 		</CollapseLink>
 	{/if}
 
-	<!-- PermissionHistory fetches against `$workspaceStore`; aimed elsewhere it would show
-	     another folder's history entirely. -->
-	{#if !isNew && !aimedElsewhere && reloadHistory > 0}
+	{#if !isNew && !offOperating && reloadHistory > 0}
 		{#key reloadHistory}
 			<PermissionHistory
 				{name}
diff --git a/frontend/src/lib/components/FolderPicker.svelte b/frontend/src/lib/components/FolderPicker.svelte
index 6f8a4858c3..0b5bc05897 100644
--- a/frontend/src/lib/components/FolderPicker.svelte
+++ b/frontend/src/lib/components/FolderPicker.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
 	import { FolderService, UserService, type User } from '$lib/gen'
 	import { workspaceStore, userStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 	import { isDemoWorkspaceRestricted } from '$lib/cloud'
 	import { ChevronDown, Pen, PlusIcon } from 'lucide-svelte'
 	import { Button } from './common'
@@ -39,14 +40,15 @@
 		workspace
 	}: Props = $props()
 
-	const targetWorkspace = $derived(workspace ?? $workspaceStore ?? '')
+	const operatingWorkspace = useOperatingWorkspace()
+	const targetWorkspace = $derived(workspace ?? $operatingWorkspace ?? '')
 
 	// `$userStore` describes the workspace the app is *in*. When this picker is aimed
 	// somewhere else, those memberships answer the wrong question — and since a folder
 	// without write access renders disabled, a stale answer makes the real folders
 	// unpickable. Resolve the membership for the workspace actually being listed.
 	let targetUser: User | undefined = $state(undefined)
-	const aimedElsewhere = $derived(!!workspace && workspace !== $workspaceStore)
+	const aimedElsewhere = $derived(!!targetWorkspace && targetWorkspace !== $workspaceStore)
 	const membership = $derived(aimedElsewhere ? targetUser : ($userStore ?? undefined))
 
 	const restricted = $derived(
@@ -129,9 +131,9 @@
 	}
 
 	async function loadTargetUser(): Promise<void> {
-		if (!workspace || workspace === $workspaceStore) return
+		if (!aimedElsewhere) return
 		try {
-			targetUser = await UserService.whoami({ workspace })
+			targetUser = await UserService.whoami({ workspace: targetWorkspace })
 		} catch {
 			// Not a member, or the call failed: every folder stays read-only, which is
 			// the safe reading — the import would be refused anyway.
diff --git a/frontend/src/lib/components/GitDiffPreview.svelte b/frontend/src/lib/components/GitDiffPreview.svelte
index 948ae4d4e8..1d18806109 100644
--- a/frontend/src/lib/components/GitDiffPreview.svelte
+++ b/frontend/src/lib/components/GitDiffPreview.svelte
@@ -1,8 +1,11 @@
 <script lang="ts">
 	import type { SyncResponse } from '$lib/git-sync'
 
-	let { previewResult } = $props<{
+	let { previewResult, heightClass = 'max-h-40' } = $props<{
 		previewResult: SyncResponse | undefined
+		/** Room the list gets before it scrolls. A host with a whole step to spare hands it
+		 *  `flex-1 min-h-0` so it takes what is left. */
+		heightClass?: string
 	}>()
 
 	let added = $derived(
@@ -16,7 +19,7 @@
 	)
 </script>
 
-<div class="border rounded p-2 text-xs max-h-40 overflow-y-auto bg-surface-secondary">
+<div class="border rounded p-2 text-xs {heightClass} overflow-y-auto bg-surface-secondary">
 	<div class="font-semibold text-[11px] mb-1 text-primary">Preview of changes:</div>
 
 	{#if !added.length && !deleted.length && !edited.length}
diff --git a/frontend/src/lib/components/GitHubAppIntegration.svelte b/frontend/src/lib/components/GitHubAppIntegration.svelte
index 89a80de6b0..6fb5a9fbf3 100644
--- a/frontend/src/lib/components/GitHubAppIntegration.svelte
+++ b/frontend/src/lib/components/GitHubAppIntegration.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-	import { workspaceStore, enterpriseLicense, userStore } from '$lib/stores'
+	import { enterpriseLicense } from '$lib/stores'
 	import Popover from './meltComponents/Popover.svelte'
 	import Button from './common/button/Button.svelte'
 	import { Loader2, Github, RotateCw, Plus, Minus, Download, AlertTriangle } from 'lucide-svelte'
@@ -18,6 +18,14 @@
 		type GitHubAppState
 	} from '$lib/githubApp'
 	import RepositorySelector from './RepositorySelector.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	interface Props {
 		resourceType: string
@@ -70,14 +78,14 @@
 
 	let showGitHubApp = $derived(
 		resourceType === 'git_repository' &&
-			$workspaceStore &&
-			($userStore?.is_admin || $userStore?.is_super_admin)
+			$operatingWorkspace &&
+			(actingUser?.is_admin || actingUser?.is_super_admin)
 	)
 
 	// Load GitHub installations when conditions are met
 	$effect(() => {
-		if (showGitHubApp && $enterpriseLicense && $workspaceStore) {
-			loadGithubInstallations(githubState, $workspaceStore).catch((error) => {
+		if (showGitHubApp && $enterpriseLicense && $operatingWorkspace) {
+			loadGithubInstallations(githubState, $operatingWorkspace).catch((error) => {
 				console.error('Failed to load GitHub installations:', error)
 			})
 		}
@@ -113,11 +121,11 @@
 	}
 
 	async function handleDeleteInstallation(installationId: number) {
-		if (!$workspaceStore) return
+		if (!$operatingWorkspace) return
 
 		try {
-			await deleteInstallation($workspaceStore, installationId, () =>
-				loadGithubInstallations(githubState, $workspaceStore!)
+			await deleteInstallation($operatingWorkspace, installationId, () =>
+				loadGithubInstallations(githubState, $operatingWorkspace!)
 			)
 		} catch (error) {
 			console.error('Failed to delete installation:', error)
@@ -125,11 +133,11 @@
 	}
 
 	async function handleAddInstallation(installationId: number, workspaceId: string) {
-		if (!$workspaceStore) return
+		if (!$operatingWorkspace) return
 
 		try {
-			await addInstallationToWorkspace($workspaceStore, installationId, workspaceId, () =>
-				loadGithubInstallations(githubState, $workspaceStore!)
+			await addInstallationToWorkspace($operatingWorkspace, installationId, workspaceId, () =>
+				loadGithubInstallations(githubState, $operatingWorkspace!)
 			)
 		} catch (error) {
 			console.error('Failed to add installation:', error)
@@ -137,22 +145,22 @@
 	}
 
 	async function handleExportInstallation(installationId: number) {
-		if (!$workspaceStore) return
+		if (!$operatingWorkspace) return
 
 		try {
-			await exportInstallation($workspaceStore, installationId)
+			await exportInstallation($operatingWorkspace, installationId)
 		} catch (error) {
 			console.error('Failed to export installation:', error)
 		}
 	}
 
 	async function handleImportInstallation() {
-		if (!$workspaceStore) return
+		if (!$operatingWorkspace) return
 
 		try {
-			await importInstallation($workspaceStore, githubState.importJwt, () => {
+			await importInstallation($operatingWorkspace, githubState.importJwt, () => {
 				githubState.importJwt = ''
-				loadGithubInstallations(githubState, $workspaceStore!)
+				loadGithubInstallations(githubState, $operatingWorkspace!)
 			})
 		} catch (error) {
 			console.error('Failed to import installation:', error)
@@ -160,17 +168,17 @@
 	}
 
 	function handleRefreshInstallations() {
-		if (!$workspaceStore) return
+		if (!$operatingWorkspace) return
 
-		loadGithubInstallations(githubState, $workspaceStore).catch((error) => {
+		loadGithubInstallations(githubState, $operatingWorkspace).catch((error) => {
 			console.error('Failed to refresh installations:', error)
 		})
 	}
 
 	function handleInstallClickWithPopover() {
-		if (!$workspaceStore) return
+		if (!$operatingWorkspace) return
 
-		handleInstallClick(githubState, $workspaceStore, () => {
+		handleInstallClick(githubState, $operatingWorkspace, () => {
 			githubAppPopover?.open()
 		})
 	}
@@ -297,9 +305,9 @@
 										target="_blank"
 										disabled={githubState.isCheckingInstallation}
 										on:click={() => {
-											if ($workspaceStore) {
-												startInstallationCheck(githubState, $workspaceStore, () =>
-													loadGithubInstallations(githubState, $workspaceStore!)
+											if ($operatingWorkspace) {
+												startInstallationCheck(githubState, $operatingWorkspace, () =>
+													loadGithubInstallations(githubState, $operatingWorkspace!)
 												)
 											}
 										}}
diff --git a/frontend/src/lib/components/GitLabIntegration.svelte b/frontend/src/lib/components/GitLabIntegration.svelte
index 66dcaa9ff7..71ef23a633 100644
--- a/frontend/src/lib/components/GitLabIntegration.svelte
+++ b/frontend/src/lib/components/GitLabIntegration.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-	import { workspaceStore, userStore, enterpriseLicense } from '$lib/stores'
+	import { enterpriseLicense } from '$lib/stores'
 	import { GitSyncService, type GitlabProject } from '$lib/gen'
 	import { sendUserToast } from '$lib/toast'
 	import Popover from './meltComponents/Popover.svelte'
@@ -8,6 +8,14 @@
 	import TextInput from './text_input/TextInput.svelte'
 	import Select from './select/Select.svelte'
 	import { GitBranch, Gitlab, Loader2 } from 'lucide-svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	interface Props {
 		resourceType: string
@@ -30,7 +38,7 @@
 		onArgsUpdate
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	let baseUrl = $state('https://gitlab.com')
 	let token = $state('')
@@ -50,7 +58,7 @@
 	let show = $derived(
 		resourceType === 'git_repository' &&
 			!!ws &&
-			($userStore?.is_admin || $userStore?.is_super_admin)
+			(actingUser?.is_admin || actingUser?.is_super_admin)
 	)
 	// The project listing is served by an enterprise-only route, so on a build
 	// without it the form's first request would 404. The button still shows,
diff --git a/frontend/src/lib/components/GitRepoPopoverPicker.svelte b/frontend/src/lib/components/GitRepoPopoverPicker.svelte
index f8050a90a2..a8eeeb3fe9 100644
--- a/frontend/src/lib/components/GitRepoPopoverPicker.svelte
+++ b/frontend/src/lib/components/GitRepoPopoverPicker.svelte
@@ -1,9 +1,11 @@
 <script lang="ts">
 	import { ResourceService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { Popover } from './meltComponents'
 	import { GitBranch, Loader2 } from 'lucide-svelte'
 	import { createEventDispatcher, untrack } from 'svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		isOpen?: boolean
@@ -20,12 +22,12 @@
 	let gitRepoResources = $state<{ path: string; description?: string }[]>([])
 
 	async function loadGitRepoResources() {
-		if (!$workspaceStore || loading) return
+		if (!$operatingWorkspace || loading) return
 
 		loading = true
 		try {
 			const resources = await ResourceService.listResource({
-				workspace: $workspaceStore,
+				workspace: $operatingWorkspace,
 				resourceType: 'git_repository'
 			})
 
@@ -39,7 +41,7 @@
 	}
 
 	$effect(() => {
-		if (isOpen && $workspaceStore) {
+		if (isOpen && $operatingWorkspace) {
 			untrack(() => loadGitRepoResources())
 		}
 	})
diff --git a/frontend/src/lib/components/GitRepoResourcePicker.svelte b/frontend/src/lib/components/GitRepoResourcePicker.svelte
index 8e49190526..96f7185bf2 100644
--- a/frontend/src/lib/components/GitRepoResourcePicker.svelte
+++ b/frontend/src/lib/components/GitRepoResourcePicker.svelte
@@ -1,10 +1,12 @@
 <script lang="ts">
 	import { HelpersService, ResourceService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { Button, Drawer, DrawerContent } from './common'
 	import { GitBranch, Loader2, FolderOpen } from 'lucide-svelte'
 	import Select from './select/Select.svelte'
 	import { createEventDispatcher } from 'svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		open: boolean
@@ -27,7 +29,7 @@
 		workspace: workspaceProp = undefined
 	}: Props = $props()
 
-	let ws = $derived(workspaceProp ?? $workspaceStore)
+	let ws = $derived(workspaceProp ?? $operatingWorkspace)
 
 	const dispatch = createEventDispatcher<{
 		selected: {
diff --git a/frontend/src/lib/components/GitRepoViewer.svelte b/frontend/src/lib/components/GitRepoViewer.svelte
index 8383748e5f..53ddea2a96 100644
--- a/frontend/src/lib/components/GitRepoViewer.svelte
+++ b/frontend/src/lib/components/GitRepoViewer.svelte
@@ -3,11 +3,13 @@
 	import { untrack } from 'svelte'
 	import { Alert, Button } from './common'
 	import S3FilePickerInner from './S3FilePickerInner.svelte'
-	import { workspaceStore } from '$lib/stores'
 	import { base } from '$lib/base'
 	import { Loader, Loader2, ChevronDown, ChevronRight, ExternalLink } from 'lucide-svelte'
 	import { hubPaths } from '$lib/hub'
 	import { sleep } from '$lib/utils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	const CLONE_MARKER_FILE = '.windmill_clone_complete'
 	const POLL_INTERVAL_MS = 1500
@@ -42,7 +44,7 @@
 		workspace: workspaceProp = undefined
 	}: Props = $props()
 
-	let ws = $derived(workspaceProp ?? $workspaceStore)
+	let ws = $derived(workspaceProp ?? $operatingWorkspace)
 
 	let commitHash = $derived(commitHashInput)
 
diff --git a/frontend/src/lib/components/GroupEditor.svelte b/frontend/src/lib/components/GroupEditor.svelte
index 4fc881be5f..f8d0445840 100644
--- a/frontend/src/lib/components/GroupEditor.svelte
+++ b/frontend/src/lib/components/GroupEditor.svelte
@@ -6,7 +6,7 @@
 		type Group,
 		type InstanceGroup
 	} from '$lib/gen'
-	import { userStore, workspaceStore } from '$lib/stores'
+	import { userStore } from '$lib/stores'
 	import { onMount, tick, untrack } from 'svelte'
 	import { Button } from './common'
 	import Skeleton from './common/skeleton/Skeleton.svelte'
@@ -34,6 +34,14 @@
 		type GroupDraft,
 		type GroupRole
 	} from '$lib/groupDraft'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	const ROLE_TOOLTIPS = {
 		member:
@@ -74,10 +82,18 @@
 	}: Props = $props()
 
 	const restricted = $derived(
-		isDemoWorkspaceRestricted($workspaceStore, $userStore?.is_admin, $userStore?.is_super_admin)
+		isDemoWorkspaceRestricted($operatingWorkspace, actingUser?.is_admin, actingUser?.is_super_admin)
 	)
 
-	let can_write = $state(false)
+	let groupPerms = $state<Record<string, boolean> | undefined>(undefined)
+	// A verdict that does not come from a loaded group: a new one is writable, one that failed
+	// to load is not.
+	let writeVerdict = $state<boolean | undefined>(undefined)
+	// Derived for the same reason as the trigger editors: the acting user's role can land after
+	// the group does, and a snapshot taken first would stay read-only.
+	const can_write = $derived(
+		writeVerdict ?? (groupPerms !== undefined && canWrite(name, groupPerms, actingUser))
+	)
 	let group: Group | undefined
 	let instance_group: InstanceGroup | undefined = $state()
 	let usernames: string[] = $state([])
@@ -123,11 +139,11 @@
 	}
 
 	async function loadUsernames(): Promise<void> {
-		usernames = await UserService.listUsernames({ workspace: $workspaceStore! })
+		usernames = await UserService.listUsernames({ workspace: $operatingWorkspace! })
 	}
 
 	async function loadGroupNames(): Promise<void> {
-		groupNames = (await GroupService.listGroupNames({ workspace: $workspaceStore! })) ?? []
+		groupNames = (await GroupService.listGroupNames({ workspace: $operatingWorkspace! })) ?? []
 	}
 
 	async function loadInstanceGroup(): Promise<void> {
@@ -142,7 +158,7 @@
 		loadAside(loadUsernames)
 		if (isNew) {
 			loadAside(loadGroupNames)
-			can_write = true
+			writeVerdict = true
 			setDraft(emptyDraft())
 			loaded = true
 		} else {
@@ -159,8 +175,9 @@
 		const apply = (value: GroupDraft) =>
 			opts?.baselineOnly ? (baseline = structuredClone(value)) : setDraft(value)
 		try {
-			group = await GroupService.getGroup({ workspace: $workspaceStore!, name })
-			can_write = canWrite(name, group.extra_perms ?? {}, $userStore)
+			group = await GroupService.getGroup({ workspace: $operatingWorkspace!, name })
+			groupPerms = group.extra_perms ?? {}
+			writeVerdict = undefined
 			apply({
 				summary: group.summary ?? '',
 				members: Array.from(
@@ -179,7 +196,7 @@
 			sendUserToast(e?.body ?? String(e), true)
 			// Only the opening read decides this. Revoking it on a failed reconcile would
 			// disable Save against a draft that is still dirty, with nothing left to reload.
-			if (!opts?.baselineOnly) can_write = false
+			if (!opts?.baselineOnly) writeVerdict = false
 		} finally {
 			loaded = true
 		}
@@ -245,7 +262,7 @@
 	 * membership goes through the endpoints that name who was added or promoted — which is
 	 * what the permission history reads back. The diff itself is in `groupDraft.ts`. */
 	async function applyMemberChanges(next: GroupDraft['members'], prev: GroupDraft['members']) {
-		const workspace = $workspaceStore ?? ''
+		const workspace = $operatingWorkspace ?? ''
 		for (const call of groupMemberDiff(prev, next, $userStore?.username)) {
 			switch (call.kind) {
 				case 'addUser':
@@ -289,7 +306,7 @@
 		try {
 			if (created) {
 				await GroupService.createGroup({
-					workspace: $workspaceStore ?? '',
+					workspace: $operatingWorkspace ?? '',
 					requestBody: { name, summary: next.summary }
 				})
 				alreadyCreated = true
@@ -299,7 +316,7 @@
 			} else {
 				if (next.summary !== prev.summary) {
 					await GroupService.updateGroup({
-						workspace: $workspaceStore ?? '',
+						workspace: $operatingWorkspace ?? '',
 						name,
 						requestBody: { summary: next.summary }
 					})
@@ -335,7 +352,7 @@
 	let loadStarted = false
 	$effect.pre(() => {
 		if (loadStarted) return
-		if ($workspaceStore && $userStore) {
+		if ($operatingWorkspace && $userStore) {
 			loadStarted = true
 			untrack(() => {
 				load()
diff --git a/frontend/src/lib/components/HistoricInputs.svelte b/frontend/src/lib/components/HistoricInputs.svelte
index d4d11b68ca..48d1290356 100644
--- a/frontend/src/lib/components/HistoricInputs.svelte
+++ b/frontend/src/lib/components/HistoricInputs.svelte
@@ -7,10 +7,9 @@
 	import { DataTable } from '$lib/components/table'
 	import HistoricList from './HistoricList.svelte'
 	import { Loader2 } from 'lucide-svelte'
-	import { workspaceStore } from '$lib/stores'
-	import { getDetailWorkspace } from '$lib/components/details/detailWorkspace'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
-	const detailWs = getDetailWorkspace()
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		runnableId?: string | undefined
@@ -35,7 +34,7 @@
 		workspace = undefined
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? detailWs?.() ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	let historicList: HistoricList | undefined = $state(undefined)
 	const dispatch = createEventDispatcher()
diff --git a/frontend/src/lib/components/HistoricList.svelte b/frontend/src/lib/components/HistoricList.svelte
index bb34daee77..89da866fc2 100644
--- a/frontend/src/lib/components/HistoricList.svelte
+++ b/frontend/src/lib/components/HistoricList.svelte
@@ -1,9 +1,11 @@
 <script lang="ts">
 	import { InputService, type RunnableType } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { onDestroy, untrack } from 'svelte'
 	import InfiniteList from './InfiniteList.svelte'
 	import JobSchemaPicker from './schema/JobSchemaPicker.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		runnableId: string | undefined
@@ -52,7 +54,7 @@
 		refreshInterval()
 		loadInputsPageFn = async (page: number, perPage: number) => {
 			const inputs = await InputService.getInputHistory({
-				workspace: $workspaceStore!,
+				workspace: $operatingWorkspace!,
 				runnableId,
 				runnableType,
 				page,
@@ -109,7 +111,7 @@
 		if (!id) return
 		const payloadData = await InputService.getArgsFromHistoryOrSavedInput({
 			jobOrInputId: id,
-			workspace: $workspaceStore!,
+			workspace: $operatingWorkspace!,
 			input,
 			allowLarge
 		})
@@ -122,7 +124,11 @@
 	}
 
 	$effect(() => {
-		$workspaceStore && runnableId && runnableType && infiniteList && untrack(() => initLoadInputs())
+		$operatingWorkspace &&
+			runnableId &&
+			runnableType &&
+			infiniteList &&
+			untrack(() => initLoadInputs())
 	})
 </script>
 
diff --git a/frontend/src/lib/components/InputTransformPickers.svelte b/frontend/src/lib/components/InputTransformPickers.svelte
index 199039fb67..d50a63786a 100644
--- a/frontend/src/lib/components/InputTransformPickers.svelte
+++ b/frontend/src/lib/components/InputTransformPickers.svelte
@@ -1,11 +1,13 @@
 <script lang="ts">
 	import { VariableService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { watch } from 'runed'
 	import { Plus } from 'lucide-svelte'
 	import { Button } from './common'
 	import ItemPicker from './ItemPicker.svelte'
 	import VariableEditor from './VariableEditor.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		/** The transforms being edited. A picked variable is written into `pickForField`'s. */
@@ -26,7 +28,7 @@
 		variableEditor = $bindable()
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	watch(
 		() => ws,
diff --git a/frontend/src/lib/components/InputTransformSchemaForm.svelte b/frontend/src/lib/components/InputTransformSchemaForm.svelte
index 31f2eb0054..0a5091323c 100644
--- a/frontend/src/lib/components/InputTransformSchemaForm.svelte
+++ b/frontend/src/lib/components/InputTransformSchemaForm.svelte
@@ -1,7 +1,6 @@
 <script lang="ts">
 	import type { Schema } from '$lib/common'
 	import { type InputTransform } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { allTrue, type DynamicInput as DynamicInputTypes } from '$lib/utils'
 	import { untrack } from 'svelte'
 	import StepInputsGen from './copilot/StepInputsGen.svelte'
@@ -12,6 +11,9 @@
 	import type ItemPicker from './ItemPicker.svelte'
 	import type VariableEditor from './VariableEditor.svelte'
 	import ResizeTransitionWrapper from './common/ResizeTransitionWrapper.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		schema: Schema | { properties?: Record<string, any> }
@@ -54,7 +56,7 @@
 		workspace
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	let inputCheck: { [id: string]: boolean } = $state({})
 
diff --git a/frontend/src/lib/components/InstanceBanner.svelte b/frontend/src/lib/components/InstanceBanner.svelte
index 6325861b63..0277cba4c1 100644
--- a/frontend/src/lib/components/InstanceBanner.svelte
+++ b/frontend/src/lib/components/InstanceBanner.svelte
@@ -3,60 +3,16 @@
 	import { classes as alertClasses, icons as alertIcons } from '$lib/components/common/alert/model'
 	import { ExternalLink, X } from 'lucide-svelte'
 	import { useLocalStorageValue } from '$lib/svelte5Utils.svelte'
-	import {
-		fetchInstanceBanner,
-		isInstanceBannerVisible,
-		type ResolvedInstanceBanner
-	} from './instanceBanner'
-	import { instanceSettingsSaved } from './instanceSettings'
+	import { isInstanceBannerVisible, resolveInstanceBanner } from './instanceBanner'
+	import { instanceUi } from '$lib/instanceUi'
 
-	// Mounted only on the managed cloud (see the render site in the logged layout), so the
-	// poll costs nothing anywhere else. An announcement is only worth broadcasting while it
-	// is current, hence polling rather than waiting for the next full page load: a session
-	// left open all day is exactly the one that needs to hear about the maintenance window.
-	const POLL_MS = 60_000
-
-	let banner = $state<ResolvedInstanceBanner | undefined>(undefined)
+	// Fetched by `InstanceUiSync`, which also carries the accent color.
+	let banner = $derived(resolveInstanceBanner($instanceUi?.instance_banner))
 
 	// Per-viewer, per-announcement. Holds the fingerprint of the dismissed banner, so
 	// a new announcement shows up again for everyone who dismissed the previous one.
 	const dismissed = useLocalStorageValue<string>('instance_banner_dismissed', '', 'string')
 
-	// The poll, the tab-focus refresh and the post-save refresh all call `load()` and can
-	// overlap. Responses are not ordered, so without this a slow earlier fetch lands last
-	// and puts a retracted announcement back on screen until the next successful poll.
-	let latestLoad = 0
-
-	async function load() {
-		const generation = ++latestLoad
-		try {
-			const next = await fetchInstanceBanner()
-			if (generation === latestLoad) banner = next
-		} catch (e) {
-			// Keep whatever is on screen: a transient failure must not silently retract
-			// an announcement that is still in force.
-			console.warn('Could not fetch the instance banner', e)
-		}
-	}
-
-	$effect(() => {
-		// Re-runs on save so a superadmin who just published an announcement sees it
-		// immediately rather than on the next poll or page load.
-		$instanceSettingsSaved
-		load()
-		const interval = setInterval(() => {
-			if (!document.hidden) load()
-		}, POLL_MS)
-		const onVisible = () => {
-			if (!document.hidden) load()
-		}
-		document.addEventListener('visibilitychange', onVisible)
-		return () => {
-			clearInterval(interval)
-			document.removeEventListener('visibilitychange', onVisible)
-		}
-	})
-
 	let shown = $derived(isInstanceBannerVisible(banner, dismissed.val))
 	let palette = $derived(alertClasses[banner?.severity ?? 'info'])
 	let Icon = $derived(alertIcons[banner?.severity ?? 'info'])
diff --git a/frontend/src/lib/components/InstanceSetting.svelte b/frontend/src/lib/components/InstanceSetting.svelte
index 1e67652f60..0da63ffbb0 100644
--- a/frontend/src/lib/components/InstanceSetting.svelte
+++ b/frontend/src/lib/components/InstanceSetting.svelte
@@ -27,6 +27,7 @@
 	import WebhookBaseUrlSetting from './instanceSettings/WebhookBaseUrlSetting.svelte'
 	import WsConnectivityTest from './instanceSettings/WsConnectivityTest.svelte'
 	import InstanceBannerSetting from './instanceSettings/InstanceBannerSetting.svelte'
+	import AccentColorSetting from './instanceSettings/AccentColorSetting.svelte'
 	import IndexerMemorySettings from './instanceSettings/IndexerMemorySettings.svelte'
 	import IndexerJobIndexSettings from './instanceSettings/IndexerJobIndexSettings.svelte'
 	import IndexerLogIndexSettings from './instanceSettings/IndexerLogIndexSettings.svelte'
@@ -871,7 +872,9 @@
 				{:else if setting.fieldType == 'ws_connectivity'}
 					<WsConnectivityTest {values} />
 				{:else if setting.fieldType == 'instance_banner'}
-					<InstanceBannerSetting {values} disabled={loading} />
+					<InstanceBannerSetting {values} disabled={loading || !$enterpriseLicense} />
+				{:else if setting.fieldType == 'accent_color'}
+					<AccentColorSetting {values} disabled={loading || !$enterpriseLicense} />
 				{/if}
 				{#if hasError}
 					<span class="text-red-600 dark:text-red-400 text-xs">
diff --git a/frontend/src/lib/components/InstanceSettings.svelte b/frontend/src/lib/components/InstanceSettings.svelte
index f38c0d3892..7cb8ced225 100644
--- a/frontend/src/lib/components/InstanceSettings.svelte
+++ b/frontend/src/lib/components/InstanceSettings.svelte
@@ -727,8 +727,8 @@
 	// Each entry maps a top-level key to its sensitive sub-field names.
 	const nestedSensitiveFields: Record<string, string[]> = {
 		smtp_settings: ['smtp_password'],
-		secret_backend: ['token'],
-		object_store_cache_config: ['secret_key', 'serviceAccountKey'],
+		secret_backend: ['token', 'client_secret', 'secret_access_key'],
+		object_store_cache_config: ['secret_key', 'serviceAccountKey', 'accessKey'],
 		custom_instance_pg_databases: ['user_pwd'],
 		rsa_keys: ['private_key'],
 		github_enterprise_app: ['private_key']
@@ -1090,10 +1090,15 @@
 							whether app sandbox isolation is turned on, whether a step's workspace script is
 							edited from the flow editor, which skin approval steps are given, how many AI sessions
 							are brought back from the workspace object storage backup, how data tables and their
-							migrations are set up and used, how often an empty workspace home is seen, how often
+							migrations are set up and used, how often the database manager is switched between its
+							data and schema diagram views, how often an empty workspace home is seen, how often
 							the home page’s create menu and hub-project picker are opened and from which entry
 							point, the name of any public hub project imported from the home page and how far that
-							import got, and whether a pre-approved trial offer was opened, last 30 days)</li
+							import got, whether a pre-approved trial offer was opened, whether data tables are put
+							under roles and whether callers name a role or take the default, which kinds of access
+							change (grant, revoke, ownership, default privileges) are applied to data tables, and
+							whether a data table under roles is cloned into a fork with its schema only or with
+							its data, last 30 days)</li
 						>
 						<li
 							>feature adoption (counts of which flow, script, trigger, worker and data table
@@ -1156,10 +1161,15 @@
 							whether app sandbox isolation is turned on, whether a step's workspace script is
 							edited from the flow editor, which skin approval steps are given, how many AI sessions
 							are brought back from the workspace object storage backup, how data tables and their
-							migrations are set up and used, how often an empty workspace home is seen, how often
+							migrations are set up and used, how often the database manager is switched between its
+							data and schema diagram views, how often an empty workspace home is seen, how often
 							the home page’s create menu and hub-project picker are opened and from which entry
 							point, the name of any public hub project imported from the home page and how far that
-							import got, and whether a pre-approved trial offer was opened, last 30 days)</li
+							import got, whether a pre-approved trial offer was opened, whether data tables are put
+							under roles and whether callers name a role or take the default, which kinds of access
+							change (grant, revoke, ownership, default privileges) are applied to data tables, and
+							whether a data table under roles is cloned into a fork with its schema only or with
+							its data, last 30 days)</li
 						>
 						<li
 							>feature adoption (counts of which flow, script, trigger, worker and data table
diff --git a/frontend/src/lib/components/InstanceUiSync.svelte b/frontend/src/lib/components/InstanceUiSync.svelte
new file mode 100644
index 0000000000..c9ae00eb29
--- /dev/null
+++ b/frontend/src/lib/components/InstanceUiSync.svelte
@@ -0,0 +1,55 @@
+<script lang="ts">
+	import { get } from 'svelte/store'
+	import { SettingService, SettingsService } from '$lib/gen'
+	import { enterpriseLicense } from '$lib/stores'
+	import { useLocalStorageValue } from '$lib/svelte5Utils.svelte'
+	import { applyAccentColor, parseAccentColor } from '$lib/accentColor'
+	import { instanceUi } from '$lib/instanceUi'
+	import { instanceSettingsSaved } from './instanceSettings'
+
+	// The only fetcher of `/settings/instance_ui`: the banner renders from the store this
+	// fills. Loaded once per full page load (and after a settings save), not polled: a
+	// change reaches other sessions on their next reload.
+
+	// Painted on mount, before the license and settings requests return, so a reload does
+	// not flash the default blue. Only written on a licensed instance, and cleared once the
+	// license check says there is none.
+	const cached = useLocalStorageValue<string>('instance_accent_color', '', 'string')
+
+	let color = $state(parseAccentColor(cached.val))
+
+	// Successive saves can refetch concurrently, and responses are not ordered: without
+	// this a slow earlier fetch lands last and puts a retracted announcement back on screen.
+	let latestLoad = 0
+
+	async function load() {
+		const generation = ++latestLoad
+		try {
+			// `enterpriseLicense` stays unset both while loading and on CE, so ask directly.
+			// Not through `setLicense()`: it swallows a failed request, which would read as CE
+			// and retract the banner and accent of a licensed instance.
+			const license = get(enterpriseLicense) || (await SettingsService.getLicenseId())
+			if (license && !get(enterpriseLicense)) enterpriseLicense.set(license)
+			const next = license ? await SettingService.getInstanceUi() : undefined
+			if (generation !== latestLoad) return
+			instanceUi.set(next)
+			color = parseAccentColor(next?.accent_color)
+			cached.val = color ?? ''
+		} catch (e) {
+			// Keep whatever is on screen: a transient failure must not silently retract
+			// an announcement that is still in force.
+			console.warn('Could not fetch the instance banner and accent color', e)
+		}
+	}
+
+	$effect(() => {
+		// Re-runs on save so a superadmin sees their change without reloading.
+		$instanceSettingsSaved
+		load()
+	})
+
+	$effect(() => {
+		applyAccentColor(color)
+		return () => applyAccentColor(undefined)
+	})
+</script>
diff --git a/frontend/src/lib/components/JobLoader.svelte b/frontend/src/lib/components/JobLoader.svelte
index 71bd2fbb51..0994905121 100644
--- a/frontend/src/lib/components/JobLoader.svelte
+++ b/frontend/src/lib/components/JobLoader.svelte
@@ -14,7 +14,6 @@
 		type WorkflowStatus,
 		type OpenFlow
 	} from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { getViewToken } from '$lib/viewToken'
 	import { WM_LOGS_SKIPPED } from '$lib/consts'
 	import { getContext, onDestroy, tick, untrack } from 'svelte'
@@ -22,6 +21,9 @@
 	import { sendUserToast } from '$lib/toast'
 	import { DynamicInput, isScriptPreview } from '$lib/utils'
 	import { getActiveReplay, getReplayStartTime } from './recording/replay.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	// Will be set to number if job is not a flow
 
@@ -75,7 +77,7 @@
 		children
 	}: Props = $props()
 
-	let workspace = $derived(workspaceOverride ?? $workspaceStore)
+	let workspace = $derived(workspaceOverride ?? $operatingWorkspace)
 
 	let syncIteration: number = 0
 	let errorIteration = 0
@@ -442,6 +444,8 @@
 										streamedResult.length >= completedResult.length
 											? streamedResult
 											: completedResult
+									njob.raw_code ??= job?.raw_code
+									njob.raw_flow = job?.raw_flow ?? njob.raw_flow
 									job = njob
 									await onJobCompleted(testId, job, callbacks)
 								}
@@ -868,6 +872,11 @@
 									const njob = previewJobUpdates.job as Job & { result_stream?: string }
 									njob.logs = pickMoreCompleteLogs(job?.logs, njob.logs)
 									njob.result_stream = job?.result_stream ?? ''
+									// The server sends the completed job without its code to keep the
+									// update small (no raw_code, "..." for a deployed flow's inline
+									// steps), so keep the code fetched with the initial job.
+									njob.raw_code ??= job?.raw_code
+									njob.raw_flow = job?.raw_flow ?? njob.raw_flow
 									job = njob
 									onJobCompleted(id, job, callbacks)
 								}
diff --git a/frontend/src/lib/components/JobOtelTraces.svelte b/frontend/src/lib/components/JobOtelTraces.svelte
index d57a7158e1..9332abdff1 100644
--- a/frontend/src/lib/components/JobOtelTraces.svelte
+++ b/frontend/src/lib/components/JobOtelTraces.svelte
@@ -1,9 +1,11 @@
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import { Alert, Skeleton } from './common'
 	import { Activity } from 'lucide-svelte'
 	import { JobService } from '$lib/gen'
 	import { msToReadableTime } from '$lib/utils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	// OTEL SpanKind enum values from opentelemetry-proto/opentelemetry/proto/trace/v1/trace.proto
 	const SpanKind = {
@@ -54,14 +56,14 @@
 	})
 
 	async function loadTraces() {
-		if (!$workspaceStore || !jobId) return
+		if (!$operatingWorkspace || !jobId) return
 
 		loading = true
 		error = null
 
 		try {
 			const response = await JobService.getJobOtelTraces({
-				workspace: $workspaceStore,
+				workspace: $operatingWorkspace,
 				id: jobId
 			})
 			traces = response as unknown as OtelSpan[]
@@ -123,12 +125,18 @@
 
 	function getKindLabel(kind: number): string {
 		switch (kind) {
-			case SpanKind.INTERNAL: return 'Internal'
-			case SpanKind.SERVER: return 'Server'
-			case SpanKind.CLIENT: return 'Client'
-			case SpanKind.PRODUCER: return 'Producer'
-			case SpanKind.CONSUMER: return 'Consumer'
-			default: return 'Unknown'
+			case SpanKind.INTERNAL:
+				return 'Internal'
+			case SpanKind.SERVER:
+				return 'Server'
+			case SpanKind.CLIENT:
+				return 'Client'
+			case SpanKind.PRODUCER:
+				return 'Producer'
+			case SpanKind.CONSUMER:
+				return 'Consumer'
+			default:
+				return 'Unknown'
 		}
 	}
 
@@ -182,17 +190,15 @@
 			<Activity size={48} class="mb-4 opacity-50" />
 			<p class="text-lg font-medium">No HTTP requests captured</p>
 			<p class="text-sm mt-2">
-				This job did not make any HTTP/HTTPS requests, or HTTP Request Tracing is not enabled in instance settings.
+				This job did not make any HTTP/HTTPS requests, or HTTP Request Tracing is not enabled in
+				instance settings.
 			</p>
 		</div>
 	{:else}
 		<div class="space-y-4">
 			<div class="flex items-center justify-between">
 				<h3 class="text-lg font-semibold">Traces ({traces.length} spans)</h3>
-				<button
-					class="text-sm text-blue-600 hover:underline"
-					onclick={loadTraces}
-				>
+				<button class="text-sm text-blue-600 hover:underline" onclick={loadTraces}>
 					Refresh
 				</button>
 			</div>
@@ -219,10 +225,7 @@
 						{@const statusCode = span.status?.code ?? 0}
 
 						<div class="hover:bg-surface-hover">
-							<button
-								class="w-full px-4 py-2 text-left"
-								onclick={() => toggleSpan(span.span_id)}
-							>
+							<button class="w-full px-4 py-2 text-left" onclick={() => toggleSpan(span.span_id)}>
 								<div class="grid grid-cols-12 gap-2 items-center">
 									<div class="col-span-4 flex items-center gap-2">
 										<span class="text-xs text-secondary">
@@ -293,7 +296,9 @@
 													{#each Object.entries(parsedAttrs) as [key, value]}
 														<div class="flex gap-2">
 															<span class="text-secondary font-medium shrink-0">{key}:</span>
-															<span class="font-mono break-all">{typeof value === 'object' ? JSON.stringify(value) : value}</span>
+															<span class="font-mono break-all"
+																>{typeof value === 'object' ? JSON.stringify(value) : value}</span
+															>
 														</div>
 													{/each}
 												</div>
diff --git a/frontend/src/lib/components/LabeledDivider.svelte b/frontend/src/lib/components/LabeledDivider.svelte
new file mode 100644
index 0000000000..145abc111f
--- /dev/null
+++ b/frontend/src/lib/components/LabeledDivider.svelte
@@ -0,0 +1,19 @@
+<!-- A horizontal rule with something centred in it: the login page's "or" and the
+	agent run's output separator. Takes a snippet rather than a string because the
+	middle is sometimes a button, not a label. -->
+<script lang="ts">
+	import { twMerge } from 'tailwind-merge'
+
+	interface Props {
+		class?: string
+		children: import('svelte').Snippet
+	}
+
+	let { class: clazz, children }: Props = $props()
+</script>
+
+<div class={twMerge('flex items-center gap-2', clazz)}>
+	<div class="h-px flex-1 bg-border-light"></div>
+	{@render children()}
+	<div class="h-px flex-1 bg-border-light"></div>
+</div>
diff --git a/frontend/src/lib/components/LabelsInput.svelte b/frontend/src/lib/components/LabelsInput.svelte
index c7eda30d66..cd85b9fd76 100644
--- a/frontend/src/lib/components/LabelsInput.svelte
+++ b/frontend/src/lib/components/LabelsInput.svelte
@@ -2,7 +2,9 @@
 	import Badge from './common/badge/Badge.svelte'
 	import Button from './common/button/Button.svelte'
 	import { Plus, Tag, X } from 'lucide-svelte'
-	import { workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		labels: string[] | undefined
@@ -53,7 +55,7 @@
 
 	async function loadExistingLabels() {
 		try {
-			const resp = await fetch(`/api/w/${workspace ?? $workspaceStore}/labels/list`)
+			const resp = await fetch(`/api/w/${workspace ?? $operatingWorkspace}/labels/list`)
 			if (resp.ok) existingLabels = await resp.json()
 		} catch {}
 	}
diff --git a/frontend/src/lib/components/LightweightResourcePicker.svelte b/frontend/src/lib/components/LightweightResourcePicker.svelte
index 58557e8c8b..14a7228ef5 100644
--- a/frontend/src/lib/components/LightweightResourcePicker.svelte
+++ b/frontend/src/lib/components/LightweightResourcePicker.svelte
@@ -1,6 +1,5 @@
 <script lang="ts">
 	import { ResourceService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { getContext, untrack } from 'svelte'
 	import DarkModeObserver from './DarkModeObserver.svelte'
 	import { Button, Drawer, DrawerContent } from './common'
@@ -11,6 +10,9 @@
 	import IconedResourceType from './IconedResourceType.svelte'
 	import { addResourceTitle } from './resourceTypeDisplay'
 	import { loadResourceTypeDisplayName } from './displayNameLoaders'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		value: string | undefined
@@ -35,7 +37,7 @@
 	let open = $state(false)
 	let refreshCount = $state(0)
 	const appViewerContext = getContext<AppViewerContext>('AppViewerContext')
-	let ws = $derived(workspace ?? appViewerContext?.workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? appViewerContext?.workspace ?? $operatingWorkspace)
 
 	let collection = $state(value ? [{ value, label: value }] : [])
 
@@ -139,7 +141,7 @@
 				title="App connection"
 				class="w-full h-full"
 				src="{base}/embed_connect?resource_type={resourceType}&workspace={appViewerContext?.workspace ??
-					$workspaceStore}&express=false"
+					$operatingWorkspace}&express=false"
 			/> -->
 		</DrawerContent>
 	</Drawer>
diff --git a/frontend/src/lib/components/LogViewer.svelte b/frontend/src/lib/components/LogViewer.svelte
index dbb8015459..be4ecb5b36 100644
--- a/frontend/src/lib/components/LogViewer.svelte
+++ b/frontend/src/lib/components/LogViewer.svelte
@@ -18,7 +18,6 @@
 	import { withExternalDomain } from '$lib/externalDomain'
 	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
 	import { appendViewToken } from '$lib/viewToken'
-	import { workspaceStore } from '$lib/stores'
 	import { AnsiUp } from 'ansi_up'
 	import NoWorkerWithTagWarning from './runs/NoWorkerWithTagWarning.svelte'
 	import { JobService } from '$lib/gen'
@@ -27,6 +26,9 @@
 	import Tooltip from './Tooltip.svelte'
 	import { twMerge } from 'tailwind-merge'
 	import QueuePosition from './QueuePosition.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		content: string | undefined
@@ -111,7 +113,7 @@
 		const id = jobId
 		fetchedSkippedJobId = id
 		untrack(() => {
-			JobService.getJob({ workspace: $workspaceStore ?? '', id })
+			JobService.getJob({ workspace: $operatingWorkspace ?? '', id })
 				.then((j) => {
 					if (fetchedSkippedJobId === id) {
 						const logs = (j as { logs?: string })['logs'] ?? ''
@@ -219,7 +221,7 @@
 		if (downloadStartUrl) {
 			scroll = false
 			let res = (await JobService.getLogFileFromStore({
-				workspace: $workspaceStore ?? '',
+				workspace: $operatingWorkspace ?? '',
 				path: downloadStartUrl
 			})) as string
 			LOG_LIMIT += Math.min(LOG_INC, res.length)
@@ -250,7 +252,7 @@
 			fetchedSkippedJobId = undefined
 		}
 	})
-	let logsApiPath = $derived(appendViewToken(`/w/${$workspaceStore}/jobs_u/get_logs/${jobId}`))
+	let logsApiPath = $derived(appendViewToken(`/w/${$operatingWorkspace}/jobs_u/get_logs/${jobId}`))
 	let downloadHref = $derived(withExternalDomain(`${base}/api${logsApiPath}`))
 	let downloadName = $derived(`windmill_logs_${jobId}.txt`)
 	let truncatedContent = $derived(
diff --git a/frontend/src/lib/components/Login.svelte b/frontend/src/lib/components/Login.svelte
index 44ba7e4e15..76f4a2b995 100644
--- a/frontend/src/lib/components/Login.svelte
+++ b/frontend/src/lib/components/Login.svelte
@@ -1,5 +1,6 @@
 <script module lang="ts">
 	import { noteSessionEmail } from '$lib/onboardingProfile'
+	import LabeledDivider from './LabeledDivider.svelte'
 	import type { LastLoginMethod } from '$lib/lastLoginMethod'
 
 	/** Feeds the login card a fixed instance configuration instead of the live one.
@@ -396,7 +397,8 @@
 		if (loginsResult.status === 'fulfilled') {
 			logins = loginsResult.value.oauth.map((login) => ({
 				type: login.type,
-				displayName: login.display_name || login.type
+				displayName:
+					login.display_name || providers.find((p) => p.type === login.type)?.name || login.type
 			}))
 			saml = loginsResult.value.saml
 			autoLogin = loginsResult.value.auto_login
@@ -747,11 +749,9 @@
 {/snippet}
 
 {#snippet orDivider()}
-	<div class="flex items-center gap-3 my-6">
-		<div class="h-px flex-1 bg-border-light"></div>
+	<LabeledDivider class="gap-3 my-6">
 		<span class="text-2xs uppercase text-secondary">or</span>
-		<div class="h-px flex-1 bg-border-light"></div>
-	</div>
+	</LabeledDivider>
 {/snippet}
 
 <div class="bg-surface px-4 py-8 border sm:rounded-lg sm:px-10">
diff --git a/frontend/src/lib/components/ModulePreviewForm.svelte b/frontend/src/lib/components/ModulePreviewForm.svelte
index e71bf11b58..093661c1e8 100644
--- a/frontend/src/lib/components/ModulePreviewForm.svelte
+++ b/frontend/src/lib/components/ModulePreviewForm.svelte
@@ -14,9 +14,11 @@
 	import type SimpleEditor from './SimpleEditor.svelte'
 	import { getResourceTypes } from './resourceTypesStore'
 	import { twMerge } from 'tailwind-merge'
-	import { workspaceStore } from '$lib/stores'
 	import { AGENT_FIELDS, initialVisibleAgentFields } from './flows/agentFormFields'
 	import { openAgentFields } from './flows/content/AiAgentStepInputs.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		schema: Schema | { properties?: Record<string, any>; required?: string[] }
@@ -47,7 +49,7 @@
 	const { stepsInputArgs, flowStateStore, flowStore, previewArgs, opWorkspace } =
 		getContext<FlowEditorContext>('FlowEditorContext')
 
-	let opWs = $derived(opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(opWorkspace?.() ?? $operatingWorkspace)
 
 	let inputCheck: { [id: string]: boolean } = $state({})
 	$effect(() => {
diff --git a/frontend/src/lib/components/ModulePreviewResultViewer.svelte b/frontend/src/lib/components/ModulePreviewResultViewer.svelte
index 3f39531b0a..fccb258b0d 100644
--- a/frontend/src/lib/components/ModulePreviewResultViewer.svelte
+++ b/frontend/src/lib/components/ModulePreviewResultViewer.svelte
@@ -8,10 +8,8 @@
 	import OutputPickerInner from '$lib/components/flows/propPicker/OutputPickerInner.svelte'
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import type { FlowEditorContext, OutputViewerJob } from './flows/types'
-	import type { AgentTool } from './flows/agentToolUtils'
 	import { getContext } from 'svelte'
 	import { getStringError } from './copilot/chat/utils'
-	import AiAgentLogViewer from './AIAgentLogViewer.svelte'
 
 	interface Props {
 		lang: Script['language']
@@ -27,9 +25,6 @@
 		onUpdateMock?: (mock: { enabled: boolean; return_value?: unknown }) => void
 		loadingJob?: boolean
 		tagLabel?: string
-		// A linked agent persists no tools of its own; its resolved resource tools are passed here so
-		// the log viewer can label each tool_call with the definition that ran.
-		linkedAgentTools?: AgentTool[]
 	}
 
 	let {
@@ -45,8 +40,7 @@
 		disableHistory = false,
 		onUpdateMock,
 		loadingJob = false,
-		tagLabel = undefined,
-		linkedAgentTools = undefined
+		tagLabel = undefined
 	}: Props = $props()
 
 	const { stepsInputArgs, flowStateStore } = getContext<FlowEditorContext>('FlowEditorContext')
@@ -105,15 +99,6 @@
 				customEmptyMessage="Using pinned data"
 				{tagLabel}
 			/>
-		{:else if mod.value.type === 'aiagent' && logJob?.type === 'CompletedJob'}
-			<AiAgentLogViewer
-				tools={linkedAgentTools ?? mod.value.tools ?? []}
-				agentJob={{
-					...logJob,
-					type: 'CompletedJob'
-				}}
-				workspaceId={logJob.workspace_id}
-			/>
 		{:else}
 			<LogViewer
 				small
diff --git a/frontend/src/lib/components/ModuleTest.svelte b/frontend/src/lib/components/ModuleTest.svelte
index 41199989d2..e35ac291c9 100644
--- a/frontend/src/lib/components/ModuleTest.svelte
+++ b/frontend/src/lib/components/ModuleTest.svelte
@@ -4,10 +4,8 @@
 		type AiAgent,
 		type FlowModule,
 		type InputTransform,
-		type JavascriptTransform,
 		type Job
 	} from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { getScriptByPath } from '$lib/scripts'
 	import { getContext, untrack } from 'svelte'
 	import type { FlowEditorContext } from './flows/types'
@@ -21,8 +19,11 @@
 		type LinkedAgentDraft
 	} from './flows/linkedAgentDrafts'
 	import { AGENT_FLOW_LOCAL_KEYS } from './flows/agentResourceUtils'
-	import { AGENT_HISTORY_KEYS } from './flows/agentFormFields'
+	import { agentTestInputTransforms } from './flows/agentFormFields'
 	import { sendUserToast } from '$lib/toast'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		mod: FlowModule
@@ -56,7 +57,7 @@
 	let previewBase = $derived($pathStore ?? '')
 
 	// Acting workspace when the flow editor runs in an AI session; else the nav workspace.
-	let opWs = $derived(opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(opWorkspace?.() ?? $operatingWorkspace)
 
 	let jobLoader: JobLoader | undefined = $state(undefined)
 	let jobProgressReset: () => void = () => {}
@@ -173,37 +174,17 @@
 
 			// `args` spans the whole AI agent schema, so on a linked step it carries every brain key as
 			// undefined; overlaying those would shadow the draft's brain, so an inlined step takes only
-			// the inputs its form offers. A blank history input is unset, as on the step: an expression
-			// evaluating to nothing reads as an empty memory id, and the step's transform is stale.
-			const isBlank = (v: unknown) => v == undefined || v === '' || (Array.isArray(v) && !v.length)
-			const formKeys = (
-				draft ? (AGENT_FLOW_LOCAL_KEYS as readonly string[]) : Object.keys(args)
-			).filter(
-				(key) => !(AGENT_HISTORY_KEYS as readonly string[]).includes(key) || !isBlank(args[key])
-			)
-			const stepTransforms = Object.fromEntries(
-				Object.entries((agentVal.input_transforms ?? {}) as Record<string, InputTransform>).filter(
-					([key]) => !(AGENT_HISTORY_KEYS as readonly string[]).includes(key) || !isBlank(args[key])
-				)
-			)
-
+			// the inputs its form offers.
 			// The test form only covers the schema it was given, and for a standalone agent that may be
 			// the flow-local one (the agent editor shows the brain in its own form, not here). Take the
 			// brain from the module as authored and let the form's own keys win over it, so an edit made
 			// in the form after the test panel mounted is what runs. A linked agent needs none of this:
 			// the server reads its brain from the resource.
-			const inputTransforms: { [key: string]: JavascriptTransform | InputTransform } = {
-				...(agentVal.agent ? {} : stepTransforms),
-				...Object.fromEntries(
-					formKeys.map((key) => [
-						key,
-						{
-							expr: `flow_input.${key}`,
-							type: 'javascript'
-						}
-					])
-				)
-			}
+			const inputTransforms = agentTestInputTransforms(
+				agentVal.agent ? {} : ((agentVal.input_transforms ?? {}) as Record<string, InputTransform>),
+				args,
+				draft ? AGENT_FLOW_LOCAL_KEYS : Object.keys(args)
+			)
 
 			await jobLoader?.runFlowPreview(
 				args,
diff --git a/frontend/src/lib/components/MoveDrawer.svelte b/frontend/src/lib/components/MoveDrawer.svelte
index 020783330e..9e8c735237 100644
--- a/frontend/src/lib/components/MoveDrawer.svelte
+++ b/frontend/src/lib/components/MoveDrawer.svelte
@@ -8,16 +8,19 @@
 	import { updateItemPathAndSummary, checkFlowOnBehalfOf } from './moveRenameManager'
 	import Label from './Label.svelte'
 	import TextInput from './text_input/TextInput.svelte'
-	import { FlowService, ScriptService, type TriggersCount } from '$lib/gen'
-	import { getDetailWorkspace } from '$lib/components/details/detailWorkspace'
+	import { DraftService, FlowService, ScriptService, type TriggersCount } from '$lib/gen'
 
 	const dispatch = createEventDispatcher()
 
-	const detailWs = getDetailWorkspace()
-	let ws = $derived(detailWs?.() ?? $workspaceStore)
-
 	type Kind = 'script' | 'resource' | 'schedule' | 'variable' | 'flow' | 'app'
 
+	/** The address the move endpoint takes: where a draft-only item's row lives, which
+	 * `initialPath` (what the user sees and edits) need not equal. Empty for a deployed
+	 * item, which is addressed by `initialPath` instead. */
+	let storagePath = $state('')
+	let rawApp = $state(false)
+	let draftOnly = $derived(storagePath !== '')
+
 	let kind = $state<Kind>('flow')
 	let initialPath = $state('')
 	let initialSummary = $state('')
@@ -70,23 +73,33 @@
 	})
 	let attachedTotal = $derived(attachedSummary.reduce((s, { count }) => s + count, 0))
 
+	/** `draft` marks an item that exists only as the caller's draft: pass the
+	 * generated path its draft row sits at, and `initialPath_l` is then the name
+	 * the user sees. Nothing is deployed, so there are no triggers to cascade
+	 * and no on-behalf-of identity to warn about. */
 	export async function openDrawer(
 		initialPath_l: string,
 		summary_l: string | undefined,
-		kind_l: Kind
+		kind_l: Kind,
+		draft?: { storagePath: string; rawApp?: boolean }
 	) {
 		kind = kind_l
 		path = undefined
 		dirtyPath = false
 		onBehalfOfEmail = undefined
 		attachedTriggers = undefined
+		storagePath = draft?.storagePath ?? ''
+		rawApp = draft?.rawApp ?? false
 		initialPath = initialPath_l
 		initialSummary = summary_l ?? ''
 		summary = summary_l
 		loadOwner()
 		drawer.openDrawer()
+		if (draftOnly) {
+			return
+		}
 		if (kind === 'flow') {
-			onBehalfOfEmail = await checkFlowOnBehalfOf(ws!, initialPath_l)
+			onBehalfOfEmail = await checkFlowOnBehalfOf($workspaceStore!, initialPath_l)
 		}
 		if (kind === 'script' || kind === 'flow') {
 			void loadAttachedTriggers()
@@ -95,7 +108,7 @@
 
 	async function loadAttachedTriggers() {
 		try {
-			const workspace = ws!
+			const workspace = $workspaceStore!
 			attachedTriggers =
 				kind === 'flow'
 					? await FlowService.getTriggersCountOfFlow({ workspace, path: initialPath })
@@ -107,13 +120,20 @@
 	}
 
 	function loadOwner() {
-		own = isOwner(initialPath, $userStore!, ws!)
+		own = isOwner(draftOnly ? storagePath : initialPath, $userStore!, $workspaceStore!)
 	}
 
 	async function updatePath() {
-		if (kind === 'flow' || kind === 'script' || kind === 'app') {
+		if (draftOnly && (kind === 'flow' || kind === 'script' || kind === 'app')) {
+			await DraftService.moveDraft({
+				workspace: $workspaceStore!,
+				kind: kind === 'app' && rawApp ? 'raw_app' : kind,
+				path: storagePath,
+				requestBody: { new_path: path ?? '', summary: summary ?? '' }
+			})
+		} else if (kind === 'flow' || kind === 'script' || kind === 'app') {
 			await updateItemPathAndSummary({
-				workspace: ws!,
+				workspace: $workspaceStore!,
 				kind,
 				initialPath,
 				newPath: path ?? '',
diff --git a/frontend/src/lib/components/NoDirectDeployAlert.svelte b/frontend/src/lib/components/NoDirectDeployAlert.svelte
index 8223d3a73d..d1017f7347 100644
--- a/frontend/src/lib/components/NoDirectDeployAlert.svelte
+++ b/frontend/src/lib/components/NoDirectDeployAlert.svelte
@@ -4,27 +4,55 @@
 	 * workspace and the admin bypass in its popover. Renders nothing for operators, who have no edit
 	 * affordance for it to explain.
 	 */
-	import { userStore, userWorkspaces, workspaceStore } from '$lib/stores'
+	import { userWorkspaces, workspaceStore } from '$lib/stores'
+	import { resource } from 'runed'
 	import {
-		canUserBypassRuleKind,
-		getActiveRulesetsForKind,
-		isRuleActive
+		canUserBypassRuleKindInRulesets,
+		fetchProtectionRulesForWorkspace,
+		getActiveRulesetsForKindInRulesets,
+		isRuleActiveInRulesets,
+		protectionRulesState
 	} from '$lib/workspaceProtectionRules.svelte'
 	import { findCanonicalDevWorkspace } from '$lib/utils/workspaceHierarchy'
 	import { devLabelKey, devLabelNoun } from '$lib/utils/devWorkspaceLabel'
-	import { canCreateFork } from '$lib/utils/editInFork'
 	import { switchWorkspace } from '$lib/storeUtils'
 	import { Badge, Button } from './common'
 	import Popover from './meltComponents/Popover.svelte'
 	import Toggle from './Toggle.svelte'
 	import { GitFork, Lock, ShieldOff } from 'lucide-svelte'
+	import {
+		useOperatingWorkspace,
+		useOperatingUser
+	} from '$lib/components/operatingWorkspace.svelte'
 
-	let activeDeployRulesets = $derived(getActiveRulesetsForKind('DisableDirectDeployment'))
-	let canBypass = $derived(canUserBypassRuleKind('DisableDirectDeployment', $userStore))
-	let canonicalDev = $derived(findCanonicalDevWorkspace($workspaceStore, $userWorkspaces))
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+
+	// The shared rules state holds the navigation workspace's rules, so a host acting on another
+	// workspace (an AI session's fork) has to ask for that one's.
+	const foreignRules = resource(
+		() => ($operatingWorkspace !== $workspaceStore ? $operatingWorkspace : undefined),
+		(workspace) => (workspace ? fetchProtectionRulesForWorkspace(workspace) : Promise.resolve([]))
+	)
+	let rulesets = $derived(
+		$operatingWorkspace === $workspaceStore
+			? (protectionRulesState.rulesets ?? [])
+			: (foreignRules.current ?? [])
+	)
+
+	let activeDeployRulesets = $derived(
+		getActiveRulesetsForKindInRulesets(rulesets, 'DisableDirectDeployment')
+	)
+	let canBypass = $derived(
+		canUserBypassRuleKindInRulesets(rulesets, 'DisableDirectDeployment', operatingUser.current)
+	)
+	let canonicalDev = $derived(findCanonicalDevWorkspace($operatingWorkspace, $userWorkspaces))
 	// Forking may itself be blocked by DisableWorkspaceForking, so only suggest it
 	// when the user can actually fork this workspace.
-	let canFork = $derived(canCreateFork($userStore))
+	let canFork = $derived(
+		!isRuleActiveInRulesets(rulesets, 'DisableWorkspaceForking') ||
+			canUserBypassRuleKindInRulesets(rulesets, 'DisableWorkspaceForking', operatingUser.current)
+	)
 	let editAdvice = $derived(
 		canFork
 			? 'You will need to either fork the workspace, or make your changes locally and submit a PR to an authorized user.'
@@ -34,7 +62,9 @@
 	// The toggle is only offered to a user who can bypass, but the answer can change under a
 	// workspace switch, so the checked flag alone never grants the edit.
 	let bypassActive = $derived(canBypass && overrideChecked)
-	let canEdit = $derived(!isRuleActive('DisableDirectDeployment') || bypassActive)
+	let canEdit = $derived(
+		!isRuleActiveInRulesets(rulesets, 'DisableDirectDeployment') || bypassActive
+	)
 
 	let {
 		onUpdateCanEditStatus = (value) => {}
@@ -55,7 +85,7 @@
 	)
 </script>
 
-{#if !$userStore?.operator && activeDeployRulesets.length > 0}
+{#if !operatingUser.current?.operator && activeDeployRulesets.length > 0}
 	<div class="my-2">
 		<Popover
 			placement="bottom-start"
diff --git a/frontend/src/lib/components/ParentWorkspaceProtectionAlert.svelte b/frontend/src/lib/components/ParentWorkspaceProtectionAlert.svelte
index f280f514ee..cd3c208813 100644
--- a/frontend/src/lib/components/ParentWorkspaceProtectionAlert.svelte
+++ b/frontend/src/lib/components/ParentWorkspaceProtectionAlert.svelte
@@ -13,9 +13,13 @@
 
 	let {
 		parentWorkspaceId,
+		displayName,
 		onUpdateCanDeploy = (value) => {}
 	}: {
 		parentWorkspaceId: string
+		/** How to name the target in the message, when its id is not what a reader would recognize
+		 * — a remote deploy target is addressed through a proxy path. */
+		displayName?: string
 		onUpdateCanDeploy?: (value: boolean) => void
 	} = $props()
 
@@ -73,7 +77,8 @@
 	<Alert type="info" title="Target workspace protection active" class="my-2">
 		<div class="flex flex-col gap-2">
 			<p>
-				The workspace {parentWorkspaceId} has a protection rule{activeDeployRulesets.length > 1
+				The workspace {displayName ?? parentWorkspaceId} has a protection rule{activeDeployRulesets.length >
+				1
 					? 's'
 					: ''}
 				<b>{activeDeployRulesets.map((r) => r.name).join(', ')}</b>
diff --git a/frontend/src/lib/components/ParqetCsvTableRenderer.svelte b/frontend/src/lib/components/ParqetCsvTableRenderer.svelte
index 70a182ea62..f51d9b4536 100644
--- a/frontend/src/lib/components/ParqetCsvTableRenderer.svelte
+++ b/frontend/src/lib/components/ParqetCsvTableRenderer.svelte
@@ -10,9 +10,12 @@
 	import { AppService, HelpersService } from '$lib/gen'
 	import { base } from '$lib/base'
 	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
-	import { enterpriseLicense, workspaceStore } from '$lib/stores'
+	import { enterpriseLicense } from '$lib/stores'
 	import { Download } from 'lucide-svelte'
 	import { Loader2 } from 'lucide-svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	// import 'ag-grid-community/dist/styles/ag-theme-alpine-dark.css'
 
@@ -53,7 +56,7 @@
 	// is set, else the viewer-scoped helpers. Same request/response shape either
 	// way — the only difference is which identity authorizes the S3 read.
 	function loadRowCount(searchCol: string | undefined, searchTerm: string | undefined) {
-		const workspace = workspaceId ?? $workspaceStore!
+		const workspace = workspaceId ?? $operatingWorkspace!
 		return appPath
 			? AppService.appLoadTableCount({
 					workspace,
@@ -82,7 +85,7 @@
 		searchTerm?: string
 		csvSeparator?: string
 	}) {
-		const workspace = workspaceId ?? $workspaceStore!
+		const workspace = workspaceId ?? $operatingWorkspace!
 		const csv = s3resource.endsWith('.csv')
 		if (appPath) {
 			const data = {
diff --git a/frontend/src/lib/components/PasswordArgInput.svelte b/frontend/src/lib/components/PasswordArgInput.svelte
index ee1f67e9c3..9c3683f6ad 100644
--- a/frontend/src/lib/components/PasswordArgInput.svelte
+++ b/frontend/src/lib/components/PasswordArgInput.svelte
@@ -1,11 +1,14 @@
 <script lang="ts">
 	import { VariableService } from '$lib/gen'
-	import { userStore, workspaceStore } from '$lib/stores'
+	import { userStore } from '$lib/stores'
 	import { ephemeralSecretPrefix, mintEphemeralSecret } from './secretArgUtils'
 	import { sendUserToast } from '$lib/toast'
 	import { Button } from './common'
 	import Password from './Password.svelte'
 	import { untrack } from 'svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		value?: string | undefined
@@ -18,7 +21,7 @@
 
 	let { value = $bindable(undefined), disabled, minRows, workspace }: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	let path = $state('')
 	// Workspace the variable at `path` actually lives in; `ws` can move away from it.
diff --git a/frontend/src/lib/components/Path.svelte b/frontend/src/lib/components/Path.svelte
index ee87cc9511..68604a4a91 100644
--- a/frontend/src/lib/components/Path.svelte
+++ b/frontend/src/lib/components/Path.svelte
@@ -26,7 +26,7 @@
 		AzureTriggerService,
 		EmailTriggerService
 	} from '$lib/gen'
-	import { superadmin, userStore, workspaceStore, type UserExt } from '$lib/stores'
+	import { superadmin, type UserExt } from '$lib/stores'
 	import { createEventDispatcher, getContext, untrack } from 'svelte'
 	import { writable } from 'svelte/store'
 	import { Alert, Button } from './common'
@@ -45,6 +45,15 @@
 	import Select from './select/Select.svelte'
 	import { twMerge } from 'tailwind-merge'
 	import InputError from './InputError.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace,
+		useOperatingWorkspaceHref
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const operatingHref = useOperatingWorkspaceHref()
 
 	type PathKind =
 		| 'resource'
@@ -81,15 +90,12 @@
 		disableEditing?: boolean
 		size?: 'sm' | 'md'
 		drawerOffset?: number
-		/** Workspace the folder list and path-existence checks run against.
-		 *  Defaults to the navigation `$workspaceStore`; pass the session's acting
-		 *  workspace when the editor operates on a workspace other than the one the
-		 *  top nav points at (see the sessions preview / dev-workspace flows). */
+		/** Workspace the folder list and path-existence checks run against. Defaults to the
+		 *  operating workspace (see `useOperatingWorkspace`). */
 		workspaceOverride?: string
 		/** The user acting in `workspaceOverride`, for the owner suggestion and the folder
-		 *  write flags. Omit it to stand in the navigation `$userStore`, who is a member of
-		 *  the navigation workspace only; pass `null` for "not known (yet)", which that user
-		 *  must not answer for either. */
+		 *  write flags. Omit it to stand in the user acting in the operating workspace; pass
+		 *  `null` for "not known (yet)", which no user must answer for. */
 		actingUser?: UserExt | null
 		/** One path that does not count as taken, for a caller creating something that may
 		 *  already have written there itself — a setup flow correcting its own failed attempt.
@@ -121,11 +127,11 @@
 		warnOnRename = true
 	}: Props = $props()
 
-	let ws = $derived(workspaceOverride ?? $workspaceStore)
-	// Sole place this component falls back to the ambient user, and only for a caller that
-	// passed none; everything below reads `user`, so a caller acting on another workspace is
-	// never mixed with the navigation user's memberships.
-	let user = $derived(actingUser === undefined ? $userStore : (actingUser ?? undefined))
+	let ws = $derived(workspaceOverride ?? $operatingWorkspace)
+	// Sole place this component falls back to an ambient user, and only for a caller that passed
+	// none: the one acting in `ws`, never the navigation user, whose memberships belong to
+	// another workspace. Everything below reads `user`.
+	let user = $derived(actingUser === undefined ? operatingUser.in(ws) : (actingUser ?? undefined))
 
 	$effect.pre(() => {
 		if (path == undefined) {
@@ -612,13 +618,13 @@
 					<Tooltip>
 						<ul>
 							{#each scripts || [] as path}
-								<li><a target="_blank" href="/scripts/edit/{path}">{path}</a></li>
+								<li><a target="_blank" href={operatingHref(`/scripts/edit/${path}`)}>{path}</a></li>
 							{/each}
 							{#each flows || [] as path}
-								<li><a target="_blank" href="/flows/edit/{path}">{path}</a></li>
+								<li><a target="_blank" href={operatingHref(`/flows/edit/${path}`)}>{path}</a></li>
 							{/each}
 							{#each apps || [] as path}
-								<li><a target="_blank" href="/apps/edit/{path}">{path}</a></li>
+								<li><a target="_blank" href={operatingHref(`/apps/edit/${path}`)}>{path}</a></li>
 							{/each}
 						</ul>
 					</Tooltip>
@@ -632,21 +638,33 @@
 						<ul class="list-disc">
 							{#each scripts || [] as scriptPath}
 								<li>
-									<a href={`/scripts/edit/${scriptPath}`} class="text-blue-400" target="_blank">
+									<a
+										href={operatingHref(`/scripts/edit/${scriptPath}`)}
+										class="text-blue-400"
+										target="_blank"
+									>
 										{scriptPath}
 									</a>
 								</li>
 							{/each}
 							{#each flows || [] as flowPath}
 								<li>
-									<a href={`/flows/edit/${flowPath}`} class="text-blue-400" target="_blank">
+									<a
+										href={operatingHref(`/flows/edit/${flowPath}`)}
+										class="text-blue-400"
+										target="_blank"
+									>
 										{flowPath}
 									</a>
 								</li>
 							{/each}
 							{#each apps || [] as appPath}
 								<li>
-									<a href={`/apps/edit/${appPath}`} class="text-blue-400" target="_blank">
+									<a
+										href={operatingHref(`/apps/edit/${appPath}`)}
+										class="text-blue-400"
+										target="_blank"
+									>
 										{appPath}
 									</a>
 								</li>
diff --git a/frontend/src/lib/components/PathNameAutocomplete.svelte b/frontend/src/lib/components/PathNameAutocomplete.svelte
index 10d5c10640..1d8bb4bd46 100644
--- a/frontend/src/lib/components/PathNameAutocomplete.svelte
+++ b/frontend/src/lib/components/PathNameAutocomplete.svelte
@@ -87,7 +87,9 @@
 <script lang="ts">
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
 	import Badge from '$lib/components/common/badge/Badge.svelte'
-	import { workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 	import { untrack } from 'svelte'
 
 	type Props = {
@@ -101,9 +103,8 @@
 		error?: string | boolean
 		textInputClass?: string
 		onkeyup?: (e: KeyboardEvent) => void
-		/** Workspace whose paths feed the autocomplete. Defaults to the navigation
-		 *  `$workspaceStore`; pass the acting workspace when the editor operates on
-		 *  a workspace other than the one the top nav points at. */
+		/** Workspace whose paths feed the autocomplete. Defaults to the operating workspace
+		 *  (see `useOperatingWorkspace`). */
 		workspace?: string
 	}
 
@@ -121,7 +122,7 @@
 		workspace = undefined
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	let inputEl: TextInput | undefined = $state(undefined)
 	export function focus() {
diff --git a/frontend/src/lib/components/PermissionHistory.svelte b/frontend/src/lib/components/PermissionHistory.svelte
index 23f3ec151f..82177b87a9 100644
--- a/frontend/src/lib/components/PermissionHistory.svelte
+++ b/frontend/src/lib/components/PermissionHistory.svelte
@@ -1,9 +1,11 @@
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import { untrack } from 'svelte'
 	import TableCustom from './TableCustom.svelte'
 	import Skeleton from './common/skeleton/Skeleton.svelte'
 	import Label from './Label.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface PermissionChange {
 		id?: number
@@ -31,10 +33,10 @@
 	let perPage = $state(50)
 
 	async function loadHistory() {
-		if (!$workspaceStore) return
+		if (!$operatingWorkspace) return
 		loading = true
 		try {
-			history = await fetchHistory($workspaceStore, name, page, perPage)
+			history = await fetchHistory($operatingWorkspace, name, page, perPage)
 		} catch (e) {
 			console.error('Failed to load permission history:', e)
 			history = []
@@ -56,7 +58,7 @@
 	}
 
 	$effect.pre(() => {
-		if ($workspaceStore && name) {
+		if ($operatingWorkspace && name) {
 			untrack(() => {
 				loadHistory()
 			})
@@ -80,13 +82,13 @@
 	{:else}
 		<TableCustom>
 			{#snippet headerRow()}
-								<tr >
+				<tr>
 					<th>Changed By</th>
 					<th>Change Type</th>
 					<th>Affected</th>
 					<th>Date</th>
 				</tr>
-							{/snippet}
+			{/snippet}
 			{#snippet body()}
 				<tbody>
 					{#each history as change}
diff --git a/frontend/src/lib/components/PersistentScriptDrawer.svelte b/frontend/src/lib/components/PersistentScriptDrawer.svelte
index d73e35335b..168169e937 100644
--- a/frontend/src/lib/components/PersistentScriptDrawer.svelte
+++ b/frontend/src/lib/components/PersistentScriptDrawer.svelte
@@ -3,17 +3,15 @@
 	import { Badge, Button, Drawer } from './common'
 	import DrawerContent from './common/drawer/DrawerContent.svelte'
 	import { createEventDispatcher, onDestroy } from 'svelte'
-	import { workspaceStore } from '$lib/stores'
 	import { base } from '$lib/base'
 	import { displayDate, sleep, sendUserToast } from '$lib/utils'
 	import TableCustom from './TableCustom.svelte'
 	import { Hourglass, Loader2, Play, RefreshCw } from 'lucide-svelte'
-	import { getDetailWorkspace } from '$lib/components/details/detailWorkspace'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let dispatch = createEventDispatcher()
-
-	const detailWs = getDetailWorkspace()
-	let ws = $derived(detailWs?.() ?? $workspaceStore)
 	let drawer: Drawer | undefined = $state()
 
 	let script: Script | undefined = $state()
@@ -42,7 +40,7 @@
 		const timeStart = new Date().getTime()
 		queuedJobsLoading = true
 		let qjs = await JobService.listQueue({
-			workspace: ws ?? '',
+			workspace: $operatingWorkspace ?? '',
 			orderDesc: false,
 			scriptPathExact: script?.path
 		})
@@ -74,7 +72,7 @@
 	async function scaleToZero() {
 		cancellingInProgress = true
 		await JobService.cancelPersistentQueuedJobs({
-			workspace: ws ?? '',
+			workspace: $operatingWorkspace ?? '',
 			path: script?.path ?? '',
 			requestBody: {
 				reason: undefined
@@ -143,15 +141,17 @@
 							<td class="text-xs">
 								<a
 									class="pr-3"
-									href="{base}/scripts/get/{scriptHash}?workspace={ws}"
+									href="{base}/scripts/get/{scriptHash}?workspace={$operatingWorkspace}"
 									target="_blank"
 								>
 									{scriptHash}
 								</a>
 							</td>
 							<td class="text-xs">
-								<a class="pr-3" href="{base}/run/{jobId}?workspace={ws}" target="_blank"
-									>{jobId.substring(24)}</a
+								<a
+									class="pr-3"
+									href="{base}/run/{jobId}?workspace={$operatingWorkspace}"
+									target="_blank">{jobId.substring(24)}</a
 								>
 							</td>
 							<td class="text-xs">
diff --git a/frontend/src/lib/components/QueuePosition.svelte b/frontend/src/lib/components/QueuePosition.svelte
index 135feae899..61245613d6 100644
--- a/frontend/src/lib/components/QueuePosition.svelte
+++ b/frontend/src/lib/components/QueuePosition.svelte
@@ -1,8 +1,10 @@
 <script lang="ts">
 	import { JobService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { forLater, getDbClockNow } from '$lib/forLater'
 	import { displayDate } from '$lib/utils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let {
 		jobId,
@@ -15,7 +17,7 @@
 
 	let fetchingQueuePosition = false
 
-	let workspace = $derived(workspaceId ?? $workspaceStore)
+	let workspace = $derived(workspaceId ?? $operatingWorkspace)
 
 	let scheduledFor = $state(undefined) as undefined | number
 
diff --git a/frontend/src/lib/components/RemoteDeployConnect.svelte b/frontend/src/lib/components/RemoteDeployConnect.svelte
new file mode 100644
index 0000000000..d5824a4f2e
--- /dev/null
+++ b/frontend/src/lib/components/RemoteDeployConnect.svelte
@@ -0,0 +1,181 @@
+<script lang="ts">
+	import { page } from '$app/state'
+	import { untrack } from 'svelte'
+	import { WorkspaceService, type RemoteDeployConnection, type RemoteDeployTarget } from '$lib/gen'
+	import {
+		CHANNEL,
+		remoteDeployAuthorizeUrl,
+		remoteHost,
+		type RemoteDeployEvent
+	} from '$lib/remoteDeploy'
+	import { sendUserToast } from '$lib/toast'
+	import { ExternalLink, LogIn, Unplug } from 'lucide-svelte'
+	import { Button } from './common'
+	import Password from './Password.svelte'
+
+	let {
+		workspace,
+		target,
+		connection,
+		returnTo,
+		onChange
+	}: {
+		workspace: string
+		target: RemoteDeployTarget
+		connection: RemoteDeployConnection | undefined
+		/** Where to land after signing in when the popup is blocked and this tab navigates away:
+		 * a page that shows the connection, since a drawer does not survive the round trip. */
+		returnTo?: string
+		onChange: () => void
+	} = $props()
+
+	let host = $derived(remoteHost(target.base_url))
+	let token: string | undefined = $state(undefined)
+	let connecting = $state(false)
+	let waitingForRemote = $state(false)
+	let showPaste = $state(false)
+	let error: string | undefined = $state(undefined)
+	let popupWatch: ReturnType<typeof setInterval> | undefined = undefined
+
+	function signIn() {
+		error = undefined
+		const url = remoteDeployAuthorizeUrl(
+			target,
+			workspace,
+			returnTo ?? page.url.pathname + page.url.search
+		)
+		// Opened blank and cut loose before it navigates: the remote page gets no handle on this
+		// window, and a blocked popup is still detected.
+		const popup = window.open('', 'windmill-remote-deploy', 'popup,width=640,height=760')
+		if (!popup) {
+			window.location.href = url
+			return
+		}
+		popup.opener = null
+		popup.location.href = url
+		waitingForRemote = true
+		clearInterval(popupWatch)
+		popupWatch = setInterval(() => {
+			if (popup.closed) {
+				clearInterval(popupWatch)
+				waitingForRemote = false
+			}
+		}, 500)
+	}
+
+	$effect(() => () => clearInterval(popupWatch))
+
+	// The drawer stays mounted across a workspace switch: a token pasted for one target must not
+	// be submitted to the next one.
+	$effect(() => {
+		;[workspace, target.base_url, target.workspace_id]
+		untrack(() => {
+			token = undefined
+			error = undefined
+		})
+	})
+
+	// The callback page runs in the popup, or in this tab when the popup was blocked.
+	$effect(() => {
+		const channel = new BroadcastChannel(CHANNEL)
+		channel.onmessage = (event: MessageEvent<RemoteDeployEvent>) => {
+			if (event.data?.workspace !== workspace) return
+			waitingForRemote = false
+			if (event.data.type === 'connected') {
+				onChange()
+			} else {
+				error = event.data.error
+			}
+		}
+		return () => channel.close()
+	})
+
+	async function connect() {
+		if (!token) return
+		connecting = true
+		error = undefined
+		try {
+			await WorkspaceService.connectRemoteDeploy({ workspace, requestBody: { token, target } })
+			token = undefined
+			onChange()
+		} catch (e: any) {
+			error = e?.body ?? e?.message ?? String(e)
+		} finally {
+			connecting = false
+		}
+	}
+
+	async function disconnect() {
+		await WorkspaceService.disconnectRemoteDeploy({ workspace })
+		sendUserToast(`Disconnected from ${target.base_url}`)
+		onChange()
+	}
+</script>
+
+{#if connection}
+	<div class="flex flex-row items-center gap-2 text-xs text-secondary">
+		<span>
+			Deploying as <span class="font-semibold text-primary">{connection.remote_email}</span> on
+			{target.base_url}
+		</span>
+		<Button variant="subtle" unifiedSize="xs" startIcon={{ icon: Unplug }} onclick={disconnect}>
+			Disconnect
+		</Button>
+	</div>
+{:else}
+	<div class="flex flex-col gap-3 max-w-xl">
+		<p class="text-xs text-secondary">
+			Deploys to {target.workspace_id} on {target.base_url} run with your own account on that instance,
+			so its permissions, protection rules and audit logs apply. Sign in there to connect; the token
+			it issues is stored encrypted and only ever sent to that instance.
+		</p>
+		<div class="flex flex-row items-center gap-3">
+			<Button variant="accent" unifiedSize="sm" startIcon={{ icon: LogIn }} onclick={signIn}>
+				Sign in to {host}
+			</Button>
+			{#if waitingForRemote}
+				<span class="text-xs text-secondary">Waiting for {host}…</span>
+			{/if}
+			<Button variant="subtle" unifiedSize="sm" onclick={() => (showPaste = !showPaste)}>
+				{showPaste ? 'Hide token field' : 'Paste a token instead'}
+			</Button>
+		</div>
+		{#if showPaste}
+			<div class="flex flex-col gap-2">
+				<a
+					class="text-xs flex flex-row items-center gap-1 w-fit"
+					href="{target.base_url}/#user-settings"
+					target="_blank"
+					rel="noopener noreferrer"
+				>
+					Create a token on {host}
+					<ExternalLink size={12} />
+				</a>
+				<div class="flex flex-row gap-2 items-start">
+					<div class="grow">
+						<Password
+							bind:password={token}
+							small
+							allowMultiline={false}
+							placeholder="Token for {target.base_url}"
+							error={error != undefined}
+							onKeyDown={(e) => e.key == 'Enter' && connect()}
+						/>
+					</div>
+					<Button
+						variant="default"
+						unifiedSize="sm"
+						disabled={!token || connecting}
+						loading={connecting}
+						onclick={connect}
+					>
+						Connect
+					</Button>
+				</div>
+			</div>
+		{/if}
+		{#if error}
+			<p class="text-xs text-red-500 dark:text-red-400 break-words">{error}</p>
+		{/if}
+	</div>
+{/if}
diff --git a/frontend/src/lib/components/RemoteDeployTargetSetting.svelte b/frontend/src/lib/components/RemoteDeployTargetSetting.svelte
new file mode 100644
index 0000000000..91f876ec17
--- /dev/null
+++ b/frontend/src/lib/components/RemoteDeployTargetSetting.svelte
@@ -0,0 +1,111 @@
+<script lang="ts">
+	import { WorkspaceService } from '$lib/gen'
+	import { enterpriseLicense, workspaceStore } from '$lib/stores'
+	import { sendUserToast } from '$lib/toast'
+	import { resource } from 'runed'
+	import { Button } from './common'
+	import Alert from './common/alert/Alert.svelte'
+	import SettingCard from './instanceSettings/SettingCard.svelte'
+	import TextInput from './text_input/TextInput.svelte'
+
+	let baseUrl = $state('')
+	let remoteWorkspaceId = $state('')
+	let saving = $state(false)
+
+	const targetResource = resource(
+		() => $workspaceStore,
+		async (workspace, previous, { signal }) => {
+			if (workspace !== previous) {
+				baseUrl = ''
+				remoteWorkspaceId = ''
+			}
+			const status = workspace
+				? await WorkspaceService.getRemoteDeployTarget({ workspace })
+				: undefined
+			// runed keeps a superseded fetch's result: filling the form with it would let a save
+			// point the workspace switched to at the previous one's instance.
+			if (signal.aborted) throw new DOMException('superseded', 'AbortError')
+			baseUrl = status?.target?.base_url ?? ''
+			remoteWorkspaceId = status?.target?.workspace_id ?? ''
+			return { workspace, target: status?.target }
+		}
+	)
+	let loaded = $derived(
+		targetResource.current?.workspace === $workspaceStore ? targetResource.current : undefined
+	)
+	let saved = $derived(loaded?.target)
+	let hasChanges = $derived(
+		baseUrl !== (saved?.base_url ?? '') || remoteWorkspaceId !== (saved?.workspace_id ?? '')
+	)
+
+	async function save(target: { base_url: string; workspace_id: string } | undefined) {
+		const workspace = loaded?.workspace
+		if (!workspace) return
+		saving = true
+		try {
+			const message = await WorkspaceService.setRemoteDeployTarget({
+				workspace,
+				requestBody: { target }
+			})
+			sendUserToast(message)
+			await targetResource.refetch()
+		} catch (e: any) {
+			sendUserToast(e?.body ?? e?.message ?? String(e), true)
+		} finally {
+			saving = false
+		}
+	}
+</script>
+
+<SettingCard
+	label="Workspace on another instance"
+	description="Deploy the same items to a workspace on a different Windmill instance. Each person deploying connects with their own token for that instance, from the deploy drawer."
+	class="mt-6"
+>
+	{#if !$enterpriseLicense}
+		<Alert type="warning" title="Enterprise license required">
+			Deploying to another instance from the web UI is only available with an enterprise license
+		</Alert>
+	{:else}
+		<div class="flex flex-col gap-3 mt-2 max-w-md">
+			<label class="flex flex-col gap-1">
+				<span class="text-xs font-semibold text-emphasis">Instance URL</span>
+				<TextInput
+					bind:value={baseUrl}
+					inputProps={{ placeholder: 'https://windmill.example.com' }}
+				/>
+			</label>
+			<label class="flex flex-col gap-1">
+				<span class="text-xs font-semibold text-emphasis">Workspace on that instance</span>
+				<TextInput bind:value={remoteWorkspaceId} inputProps={{ placeholder: 'prod' }} />
+			</label>
+			<div class="flex flex-row gap-2">
+				<Button
+					variant="accent"
+					unifiedSize="sm"
+					disabled={!loaded || !hasChanges || !baseUrl || !remoteWorkspaceId || saving}
+					onclick={() => save({ base_url: baseUrl, workspace_id: remoteWorkspaceId })}
+				>
+					Save
+				</Button>
+				{#if saved}
+					<Button
+						variant="default"
+						unifiedSize="sm"
+						destructive
+						disabled={saving}
+						onclick={() => save(undefined)}
+					>
+						Remove target
+					</Button>
+				{/if}
+			</div>
+			{#if saved}
+				<p class="text-xs text-secondary">
+					Changing the instance URL or workspace drops every token stored for the current target, so
+					everyone connects again.
+				</p>
+			{/if}
+		</div>
+	{/if}
+</SettingCard>
diff --git a/frontend/src/lib/components/ResourceDescriptionField.svelte b/frontend/src/lib/components/ResourceDescriptionField.svelte
new file mode 100644
index 0000000000..2f065176dc
--- /dev/null
+++ b/frontend/src/lib/components/ResourceDescriptionField.svelte
@@ -0,0 +1,59 @@
+<!-- The description field of a resource, wherever one is created or edited: the
+	resource form and the save-as-reusable-agent drawer. One component, for the same
+	reason as ResourcePathHint next to it — two copies drift. -->
+<script lang="ts">
+	import { Pen } from 'lucide-svelte'
+	import { Button } from '$lib/components/common'
+	import GfmMarkdown from './GfmMarkdown.svelte'
+	import Required from './Required.svelte'
+	import TextInput from './text_input/TextInput.svelte'
+
+	interface Props {
+		description: string
+		label?: string
+		placeholder?: string
+		canWrite?: boolean
+	}
+
+	let {
+		description = $bindable(),
+		label = 'Resource description',
+		placeholder = 'Describe what this resource is for',
+		canWrite = true
+	}: Props = $props()
+
+	let editing = $state(false)
+</script>
+
+<div class="flex flex-col gap-1">
+	<h4 class="inline-flex items-center gap-2 text-xs text-emphasis font-semibold"
+		>{label}
+		<Required required={false} />
+		{#if canWrite}
+			<Button
+				variant="subtle"
+				unifiedSize="xs"
+				btnClasses={editing ? 'bg-surface-hover' : ''}
+				startIcon={{ icon: Pen }}
+				iconOnly
+				title={editing ? 'Stop editing the description' : 'Edit the description'}
+				aria-label={editing ? 'Stop editing the description' : 'Edit the description'}
+				on:click={() => (editing = !editing)}
+			/>
+		{/if}
+	</h4>
+	{#if canWrite && editing}
+		<div class="relative">
+			<div class="text-2xs text-primary absolute -top-4 right-0">GH Markdown</div>
+			<TextInput
+				underlyingInputEl="textarea"
+				bind:value={description}
+				inputProps={{ placeholder, 'aria-label': label, disabled: !canWrite }}
+			/>
+		</div>
+	{:else if description == undefined || description == ''}
+		<div class="text-xs text-secondary font-normal">No description provided</div>
+	{:else}
+		<GfmMarkdown md={description} prose="sm" noPadding />
+	{/if}
+</div>
diff --git a/frontend/src/lib/components/ResourceEditor.svelte b/frontend/src/lib/components/ResourceEditor.svelte
index bcb886ee7d..9847454aca 100644
--- a/frontend/src/lib/components/ResourceEditor.svelte
+++ b/frontend/src/lib/components/ResourceEditor.svelte
@@ -9,7 +9,6 @@
 	} from '$lib/gen'
 	import { canWrite } from '$lib/utils'
 	import { createEventDispatcher, onDestroy, untrack } from 'svelte'
-	import { workspaceStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
 	import { clearJsonSchemaResourceCache } from './schema/jsonSchemaResource.svelte'
 	import ResourceForm from './ResourceForm.svelte'
@@ -20,8 +19,13 @@
 	import { useActingUser } from '$lib/actingUser.svelte'
 	import { UserDraft, draftValuesEqual, type UserDraftHandle } from '$lib/userDraft.svelte'
 	import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
+	import { useDraftConflictSession } from '$lib/draftConflictSession.svelte'
+	import DraftConflictAlert from './DraftConflictAlert.svelte'
 	import { setLocalDraftHint } from '$lib/localDraftHints.svelte'
 	import { onUserInput } from '$lib/userDraftEditGate'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		canSave?: boolean
@@ -46,6 +50,9 @@
 		 * so it can hide the banner's Discard button in read-only mode (matches
 		 * the trigger editors' `disabled={!can_write}` wiring). */
 		onCanWriteChange?: (canWrite: boolean) => void
+		/** The drawer renders the conflict alert: inside this scrollable form it can land above the
+		 *  viewport on a long resource, leaving the fixed banner claiming the edits are saved. */
+		onDraftConflictChange?: (state: { conflicted: boolean; busy: boolean }) => void
 	}
 
 	let {
@@ -59,7 +66,8 @@
 		selected: selectedProp = $bindable(),
 		viewJsonSchema = $bindable(),
 		onDraftStateChange,
-		onCanWriteChange
+		onCanWriteChange,
+		onDraftConflictChange
 	}: Props = $props()
 
 	type ResourceState = {
@@ -74,7 +82,7 @@
 
 	// Sole ambient read in this file: the acting workspace is an input, and only its
 	// default comes from the navigation store.
-	let effectiveWorkspace = $derived(workspace ?? $workspaceStore!)
+	let effectiveWorkspace = $derived(workspace ?? $operatingWorkspace!)
 	// Fallback to `effectiveWorkspace` insulates against reactify-style
 	// parents that re-spread props without `selected` — otherwise it
 	// transiently resets and the form below remounts on every keystroke.
@@ -261,6 +269,132 @@
 	)
 	const anyDirty = $derived(dirtyWorkspaces.length > 0)
 
+	/** Scoped by `selected` so switching workspace-specific versions is a new session. Ending is
+	 *  exported on top of that because the drawer, not this component, knows when its own session
+	 *  is over: this component outlives it. */
+	const conflictSession = useDraftConflictSession(() => selected)
+	export function endEditingSession(): void {
+		conflictSession.end()
+	}
+	onDestroy(endEditingSession)
+	const resolvingConflict = $derived(conflictSession.busy)
+	/** The server refused this tab's autosave because the row moved under it: another tab, or the
+	 *  AI chat, which writes these drafts too. Nothing typed here reaches the server until the user
+	 *  picks a version, and the unsaved-changes banner says the opposite — that the edits are held
+	 *  as a draft — so without this they are told their work is safe while it is being dropped. */
+	const draftConflict = $derived(
+		selected && initialPath
+			? UserDraftDbSyncer.getConflict({
+					workspace: selected,
+					itemKind: 'resource',
+					path: initialPath
+				}).conflict
+			: undefined
+	)
+
+	async function resolveDraftConflict(keepMine: boolean): Promise<void> {
+		const ws = selected
+		const p = initialPath
+		if (!ws || !p || resolvingConflict) return
+		const query = { workspace: ws, itemKind: 'resource' as const, path: p }
+		const token = conflictSession.start()
+		const stillOurs = () => conflictSession.holds(token) && selected === ws
+		try {
+			if (keepMine) {
+				// Settle the key first: an ordinary autosave still queued would displace the forced
+				// write below, and being conditional it would be refused — so "Keep mine" would
+				// finish without keeping anything and leave the alert standing.
+				await UserDraftDbSyncer.quiesce(query)
+				// A resolution belongs to the session that started it. One that outlives its editor
+				// stops here rather than writing on: whatever replaced it — another session on the
+				// same draft, or its own resolution — owns the key now, and the edit this one was
+				// keeping is still parked for a later flush either way.
+				if (!stillOurs()) return
+				// A parked `null` is this tab's "no draft any more" — a discard, or an edit that
+				// landed back on the deployed value. Keeping that means removing the row, not
+				// writing the baseline back as a draft with no dirty banner to discard it through.
+				const parked = UserDraftDbSyncer.peekPending(query)
+				const mine = parked?.value === null ? null : $state.snapshot(states[ws]?.draft)
+				// Forced, so it goes over the row that refused us, and its response reseeds
+				// `last_sync` so the next ordinary save is conditional again.
+				if (mine !== undefined) await UserDraftDbSyncer.overwrite({ ...query, value: mine })
+				// Say so rather than leave the alert up with no explanation: a write displaced by
+				// something typed meanwhile can still lose the race.
+				if (UserDraftDbSyncer.getConflict(query).conflict) {
+					sendUserToast('Could not keep your version — try again', true)
+				}
+				return
+			}
+			// Settle the key BEFORE reading, so what comes back is the version the server is left
+			// holding: a write this tab started can still be in flight — a forced one it walked
+			// away from included — and a response fetched past it describes a version about to be
+			// replaced, which would then be seeded along with its already-stale `last_sync`.
+			// Nothing is given up by waiting; `quiesce` only stops the pipeline.
+			await UserDraftDbSyncer.quiesce(query)
+			if (!stillOurs()) return
+			// Read BEFORE giving anything up: until the server has answered, the refused payload is
+			// still the only copy of this tab's edit, and the conflict is still true.
+			const r = await ResourceService.getResource({ workspace: ws, path: p, getDraft: true })
+			const deployedState: ResourceState = {
+				path: r.path,
+				args: (r.value ?? {}) as Record<string, any>,
+				description: r.description ?? '',
+				labels: r.labels ?? undefined,
+				wsSpecific: r.ws_specific ?? false
+			}
+			// Everything below writes shared editor state, so first make sure it is still this
+			// resource's: the drawer stays closable while the read is out, and another resource
+			// opened meanwhile would otherwise get this one's baseline — and with it this one's
+			// path as its save target.
+			if (!stillOurs()) return
+			// Again, because the form stayed editable while the read was out: `quiesce` settles what
+			// is running when it is called, not the key for the rest of the resolution, so a
+			// keystroke since can have started a save of its own. Left running, its rejection lands
+			// after the baseline below and raises the conflict this just resolved.
+			await UserDraftDbSyncer.quiesce(query)
+			if (!stillOurs()) return
+			// Now, and not in `quiesce`: the refused payload belongs to the version being replaced,
+			// but until this point it was still the only copy of the edit, and a resolution that
+			// gave up before here has to leave it behind.
+			UserDraftDbSyncer.dropPending(query)
+			UserDraftDbSyncer.clearConflict(query)
+			initialStates[ws] = structuredClone(deployedState)
+			// Everything else the load path takes from this same response. The item can have been
+			// deleted, recreated under another type, or had its permissions changed while the
+			// conflict stood, and the fields below decide create-vs-update, the schema and write
+			// access — so refreshing only what is displayed would leave those deciding on the
+			// version the user just replaced.
+			fetchedResources[ws] = r
+			existedInitially[ws] = !(r as any).no_deployed
+			if (ws === effectiveWorkspace) resource_type = r.resource_type
+			UserDraftDbSyncer.recordRemoteSync(query, (r as any).draft_saved_at)
+			const loadedDraft = (r as any).draft as ResourceState | undefined
+			// Loading a draft makes this workspace one that opened with a draft, whatever it opened
+			// with before — a refused deletion opens gated, and gated the settling absorber would
+			// fold the version just loaded into the deployed baseline, leaving it silently clean
+			// with Save disabled. Ungate here rather than leaving it to the effect, so no write
+			// between the two is absorbed.
+			openedOnDraft[ws] = !!loadedDraft
+			if (loadedDraft) {
+				setGated(ws, false)
+			} else {
+				// Accepting "there is no draft" has to shut the gate, the way discarding one does.
+				// The edit that raised the conflict set `userEdited`, and left open, the form's
+				// settling writes — schema defaults materializing over the loaded value — read as
+				// the user's and recreate the draft just accepted away.
+				userEdited[ws] = false
+				setGated(ws, true)
+			}
+			UserDraft.seed('resource', p, loadedDraft ?? deployedState, { workspace: ws })
+		} catch (e) {
+			// Nothing was given up above, so the conflict stands and the edit is still here to
+			// resolve again — which is the whole point of reading first.
+			sendUserToast(`Could not load the other version: ${e}`, true)
+		} finally {
+			conflictSession.finish(token)
+		}
+	}
+
 	// The syncer owns the list-page `*` hint; the editor only CLEARS it when a
 	// workspace is at the deployed baseline (so a draft discarded elsewhere
 	// vanishes on reopen). Never SET here. See VariableEditor for the full note.
@@ -336,15 +470,33 @@
 						labels: r.labels ?? undefined,
 						wsSpecific: r.ws_specific ?? false
 					}
-					// Open with the saved draft if present, else the deployed.
-					const s: ResourceState = savedDraftState ?? deployedState
-					openedOnDraft[ws] = !!savedDraftState
+					// A refused save leaves this tab's own version parked. `.draft` is the
+					// version that refused it, so opening on that would quietly drop the edit
+					// the alert is about and leave "Keep mine" offering to keep the other one.
+					const conflictQuery = {
+						workspace: ws,
+						itemKind: 'resource' as const,
+						path: initialPath
+					}
+					const refused = UserDraftDbSyncer.getConflict(conflictQuery).conflict
+						? UserDraftDbSyncer.peekPending(conflictQuery)
+						: undefined
+					// A parked `null` is this tab's "no draft any more", which on screen is the
+					// deployed value — so only a payload with content counts as a local draft.
+					const refusedDraft = (refused?.value ?? undefined) as ResourceState | undefined
+					const hasLocalDraft = refused ? refused.value !== null : !!savedDraftState
+					// Open with this tab's refused version if there is one, else the saved
+					// draft, else the deployed.
+					const s: ResourceState = refused
+						? (refusedDraft ?? deployedState)
+						: (savedDraftState ?? deployedState)
+					openedOnDraft[ws] = hasLocalDraft
 					// Gate BEFORE the handle is acquired: `stopSync` queues on a
 					// not-yet-live entry, and the form can settle before the effect
 					// above gets a chance to run. Only worth doing when no draft exists
 					// yet — where one does, there is no phantom to prevent and
 					// suspending could only drop a write.
-					if (!savedDraftState) setGated(ws, true)
+					if (!hasLocalDraft) setGated(ws, true)
 					ensureHandle(ws, s)
 					initialStates[ws] = structuredClone(deployedState)
 					// Draft-only paths (`no_deployed`) have no row — saving must
@@ -424,6 +576,13 @@
 	$effect(() => {
 		onCanWriteChange?.(can_write === true)
 	})
+	$effect(() => {
+		onDraftConflictChange?.({ conflicted: !!draftConflict, busy: resolvingConflict })
+	})
+
+	export function resolveDraftConflictFromBanner(keepMine: boolean): void {
+		void resolveDraftConflict(keepMine)
+	}
 
 	export function localDraftDeployed(): ResourceState | undefined {
 		return selected ? initialStates[selected] : undefined
@@ -471,6 +630,12 @@
 		current.path = npath
 	}
 
+	/** The path the resource has in `ws`: after a save, the one it was saved under. Each
+	 * workspace-specific version keeps its own, so the selected one says nothing about `ws`. */
+	export function pathIn(ws: string): string | undefined {
+		return initialStates[ws]?.path
+	}
+
 	/** Whether the write landed. It toasts its own failure, so most callers ignore this;
 	 * one that follows the save with bookkeeping of its own has to know not to. */
 	export async function save(): Promise<boolean> {
@@ -531,6 +696,18 @@
 
 <div>
 	<div class="flex flex-col gap-6 pb-2">
+		<!-- Only when nobody above is showing it. A host that takes `onDraftConflictChange` puts it
+		     in its own fixed banner, where a long form cannot scroll it out of view; one that embeds
+		     this editor directly — the AI chat's MCP section, and the SDK surface — would otherwise
+		     get no warning at all, which is the very thing this alert exists to prevent. -->
+		{#if draftConflict && !onDraftConflictChange}
+			<DraftConflictAlert
+				busy={resolvingConflict}
+				onReload={() => void resolveDraftConflict(false)}
+				onOverwrite={() => void resolveDraftConflict(true)}
+			/>
+		{/if}
+
 		{#if otherDirty.length > 0}
 			<Alert type="warning" title="Editing multiple workspaces">
 				You are going to edit the value in: {otherDirty.join(', ')}
diff --git a/frontend/src/lib/components/ResourceEditorDrawer.svelte b/frontend/src/lib/components/ResourceEditorDrawer.svelte
index 052c8c9e92..b37ebf356f 100644
--- a/frontend/src/lib/components/ResourceEditorDrawer.svelte
+++ b/frontend/src/lib/components/ResourceEditorDrawer.svelte
@@ -5,10 +5,10 @@
 
 	import { History, Loader2, Save } from 'lucide-svelte'
 	import WsSpecificVersions from './WsSpecificVersions.svelte'
-	import { workspaceStore } from '$lib/stores'
 	import { isOwner } from '$lib/utils'
 	import { useActingUser } from '$lib/actingUser.svelte'
 	import LocalDraftBanner from './LocalDraftBanner.svelte'
+	import DraftConflictAlert from './DraftConflictAlert.svelte'
 	import OpenInSessionButton from './sessions/OpenInSessionButton.svelte'
 	import {
 		clearPageDrawerAnchor,
@@ -20,10 +20,15 @@
 	import IconedResourceType from './IconedResourceType.svelte'
 	import { addResourceTitle } from './resourceTypeDisplay'
 	import { loadResourceTypeDisplayName } from './displayNameLoaders'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let {
 		workspace = undefined,
 		disableChatOffset = false,
+		inline = false,
+		onClose = undefined,
 		onRestored = undefined,
 		onSaved = undefined
 	}: {
@@ -31,10 +36,17 @@
 		 * once, at `effectiveWorkspace`, and nowhere else in this file. */
 		workspace?: string
 		disableChatOffset?: boolean
+		/** Render in place, filling the parent, with no drawer or close button — for a host
+		 * that gives the editor a whole pane. Saving and restoring then leave it open: the
+		 * host remounts it on what was written. */
+		inline?: boolean
+		/** With `inline`, closes whatever hosts the editor; the header has a close button only when set. */
+		onClose?: () => void
 		onRestored?: () => void
 		/** Fires after Save has written, for a caller showing state derived from the
-		 * resource — `onRestored` only covers restoring an old version. */
-		onSaved?: () => void
+		 * resource — `onRestored` only covers restoring an old version. `path` is where the
+		 * resource now lives in this drawer's workspace, undefined when the save failed. */
+		onSaved?: (path: string | undefined) => void
 	} = $props()
 
 	let drawer: Drawer | undefined = $state()
@@ -45,20 +57,24 @@
 
 	let resourceEditor:
 		| {
-				save: () => void
+				save: () => Promise<boolean>
+				pathIn: (ws: string) => string | undefined
 				localDraftDeployed: () => unknown
 				localDraftCurrent: () => unknown
 				discardLocalDraft: () => void
+				endEditingSession: () => void
+				resolveDraftConflictFromBanner: (keepMine: boolean) => void
 		  }
 		| undefined = $state(undefined)
 	let hasLocalDraft = $state(false)
+	let draftConflict = $state({ conflicted: false, busy: false })
 	let canWriteSelected = $state(true)
 
 	let path: string | undefined = $state(undefined)
 	let selected: string | undefined = $state(undefined)
 	let viewJsonSchema = $state(false)
 
-	let effectiveWorkspace = $derived(workspace ?? $workspaceStore!)
+	let effectiveWorkspace = $derived(workspace ?? $operatingWorkspace!)
 	// The editor renders whichever workspace-specific variant `selected` points at, so history has
 	// to follow it too — otherwise a restore would write over the variant the user is not looking at.
 	let historyWorkspace = $derived(selected ?? effectiveWorkspace)
@@ -126,22 +142,46 @@
 	)
 </script>
 
-<Drawer
-	bind:this={drawer}
-	size="50rem"
-	{disableChatOffset}
-	on:close={() => {
-		if (keepAnchorOnClose) {
-			keepAnchorOnClose = false
-			return
-		}
-		clearPageDrawerAnchor(RESOURCES_PATH)
-	}}
->
+{#if inline}
+	<!-- ResourceEditor reads its path once, at mount — a drawer mounts it only when opened. -->
+	{#if path !== undefined || resource_type !== undefined}
+		{@render content()}
+	{/if}
+{:else}
+	<Drawer
+		bind:this={drawer}
+		size="50rem"
+		{disableChatOffset}
+		on:close={() => {
+			// The editor outlives this drawer, so tell it the session is over: a conflict resolution
+			// still in flight must not land on whatever the next opening shows.
+			resourceEditor?.endEditingSession?.()
+			if (keepAnchorOnClose) {
+				keepAnchorOnClose = false
+				return
+			}
+			clearPageDrawerAnchor(RESOURCES_PATH)
+		}}
+	>
+		{@render content()}
+	</Drawer>
+{/if}
+
+{#snippet content()}
 	<DrawerContent
 		title={mode == 'edit' ? 'Edit ' + path : addResourceTitle(resource_type)}
 		bannerReserved={mode == 'edit'}
-		on:close={drawer?.closeDrawer}
+		hideClose={inline && !onClose}
+		fullScreen={!inline}
+		on:close={() => {
+			// Inline has no drawer to emit a close, so the session ends here instead.
+			if (inline) {
+				resourceEditor?.endEditingSession?.()
+				onClose?.()
+			} else {
+				drawer?.closeDrawer()
+			}
+		}}
 	>
 		{#snippet titleExtra()}
 			{#if mode == 'new' && resource_type}
@@ -162,10 +202,18 @@
 				bind:selected
 				bind:viewJsonSchema
 				onDraftStateChange={(v) => (hasLocalDraft = v)}
+				onDraftConflictChange={(v) => (draftConflict = v)}
 				onCanWriteChange={(v) => (canWriteSelected = v)}
 			/>
 		{/await}
 		{#snippet banner()}
+			{#if draftConflict.conflicted}
+				<DraftConflictAlert
+					busy={draftConflict.busy}
+					onReload={() => resourceEditor?.resolveDraftConflictFromBanner?.(false)}
+					onOverwrite={() => resourceEditor?.resolveDraftConflictFromBanner?.(true)}
+				/>
+			{/if}
 			<LocalDraftBanner
 				show={hasLocalDraft}
 				reserveSpace={mode == 'edit'}
@@ -201,10 +249,10 @@
 					// Closed before the write is awaited, the way it always was: `save()` toasts its
 					// own failures and never rejects, so waiting would only add visible lag to every
 					// caller of this drawer. `onSaved` still fires after the write lands.
-					const saved = resourceEditor?.save()
+					const editor = resourceEditor
+					const saved = editor?.save()
 					drawer?.closeDrawer()
-					await saved
-					onSaved?.()
+					onSaved?.((await saved) ? editor?.pathIn(effectiveWorkspace) : undefined)
 				}}
 				disabled={!canSave}
 			>
@@ -212,7 +260,7 @@
 			</Button>
 		{/snippet}
 	</DrawerContent>
-</Drawer>
+{/snippet}
 
 <Drawer bind:this={historyDrawer} size="1200px">
 	<DrawerContent title="Versions History" on:close={historyDrawer?.closeDrawer} noPadding>
diff --git a/frontend/src/lib/components/ResourceForm.svelte b/frontend/src/lib/components/ResourceForm.svelte
index df1aa5bd99..1d4f091236 100644
--- a/frontend/src/lib/components/ResourceForm.svelte
+++ b/frontend/src/lib/components/ResourceForm.svelte
@@ -1,4 +1,5 @@
 <script lang="ts">
+	import ResourceDescriptionField from './ResourceDescriptionField.svelte'
 	import type { Schema } from '$lib/common'
 	import type { Resource, ResourceType } from '$lib/gen'
 	import { onDestroy } from 'svelte'
@@ -7,24 +8,23 @@
 	import { Alert, Skeleton } from './common'
 	import Path from './Path.svelte'
 	import LabelsInput from './LabelsInput.svelte'
-	import Required from './Required.svelte'
-	import { workspaceStore, type UserExt } from '$lib/stores'
+	import { type UserExt } from '$lib/stores'
 	import SchemaForm from './SchemaForm.svelte'
 	import SimpleEditor from './SimpleEditor.svelte'
 	import FilesetEditor from './FilesetEditor.svelte'
 	import Toggle from './Toggle.svelte'
 	import TestConnection from './TestConnection.svelte'
-	import { Pen } from 'lucide-svelte'
-	import autosize from '$lib/autosize'
 	import GfmMarkdown from './GfmMarkdown.svelte'
 	import TestTriggerConnection from './triggers/TestTriggerConnection.svelte'
 	import GitHubAppIntegration from './GitHubAppIntegration.svelte'
 	import GitLabIntegration from './GitLabIntegration.svelte'
-	import Button from './common/button/Button.svelte'
 	import ResourceGen from './copilot/ResourceGen.svelte'
 	import SyncResourceTypes from './SyncResourceTypes.svelte'
 	import Label from './Label.svelte'
 	import ResourcePathHint from './ResourcePathHint.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		path: string
@@ -84,9 +84,8 @@
 		onCredentialStored
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
-	let editDescription = $state(false)
 	let rawCode: string | undefined = $state(undefined)
 	let textFileContent: string = $state('')
 
@@ -193,36 +192,7 @@
 	</Label>
 {/if}
 
-<div class="flex flex-col gap-1">
-	<h4 class="inline-flex items-center gap-2 text-xs text-emphasis font-semibold"
-		>Resource description <Required required={false} />
-		{#if can_write}
-			<Button
-				variant="subtle"
-				unifiedSize="xs"
-				btnClasses={editDescription ? 'bg-surface-hover' : ''}
-				startIcon={{ icon: Pen }}
-				on:click={() => (editDescription = !editDescription)}
-			/>
-		{/if}
-	</h4>
-	{#if can_write && editDescription}
-		<div class="relative">
-			<div class="text-2xs text-primary absolute -top-4 right-0">GH Markdown</div>
-			<textarea
-				class="text-xs text-primary font-normal"
-				disabled={!can_write}
-				use:autosize
-				bind:value={description}
-				placeholder="Describe what this resource is for"
-			></textarea>
-		</div>
-	{:else if description == undefined || description == ''}
-		<div class="text-xs text-secondary font-normal">No description provided</div>
-	{:else}
-		<GfmMarkdown md={description} prose="sm" noPadding />
-	{/if}
-</div>
+<ResourceDescriptionField bind:description canWrite={can_write} />
 
 <div class="flex flex-col gap-1">
 	<div class="w-full flex gap-4 flex-row-reverse items-center">
diff --git a/frontend/src/lib/components/ResourcePathHint.svelte b/frontend/src/lib/components/ResourcePathHint.svelte
index 527a2aed2e..ba92f17d99 100644
--- a/frontend/src/lib/components/ResourcePathHint.svelte
+++ b/frontend/src/lib/components/ResourcePathHint.svelte
@@ -1,5 +1,6 @@
-<!-- Shown above the Path input wherever a resource is created: the resource form and the
-	connect drawer's last step. One component so the two screens cannot drift apart. -->
+<!-- Shown above the Path input wherever a resource is created: the resource form, the
+	connect drawer's last step, and the save-as-reusable-agent drawer. One component so
+	those screens cannot drift apart. -->
 <div class="text-xs text-secondary font-normal mb-1">
 	The path sets who can access this resource: a <code>u/</code> path is private to that user, an
 	<code>f/</code> path follows the folder's permissions — read access lets people use the resource, write
diff --git a/frontend/src/lib/components/ResourcePicker.svelte b/frontend/src/lib/components/ResourcePicker.svelte
index 06023b1bb4..778c1d2614 100644
--- a/frontend/src/lib/components/ResourcePicker.svelte
+++ b/frontend/src/lib/components/ResourcePicker.svelte
@@ -1,6 +1,5 @@
 <script lang="ts">
 	import { ResourceService, WorkspaceService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { onMount, untrack } from 'svelte'
 	import AppConnect from './AppConnectDrawer.svelte'
 	import ResourceEditorDrawer from './ResourceEditorDrawer.svelte'
@@ -12,6 +11,9 @@
 	import ExploreAssetButton, { assetCanBeExplored } from './ExploreAssetButton.svelte'
 	import DropdownV2 from './DropdownV2.svelte'
 	import { appIconComponent } from './icons'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		initialValue?: string | undefined
@@ -62,7 +64,7 @@
 		onValueChange = undefined
 	}: Props = $props()
 
-	let effectiveWorkspace = $derived(workspace ?? $workspaceStore!)
+	let effectiveWorkspace = $derived(workspace ?? $operatingWorkspace!)
 
 	if (initialValue && value == undefined) {
 		value = initialValue
diff --git a/frontend/src/lib/components/ResourceTypePicker.svelte b/frontend/src/lib/components/ResourceTypePicker.svelte
index 35d6593635..b03723bf0d 100644
--- a/frontend/src/lib/components/ResourceTypePicker.svelte
+++ b/frontend/src/lib/components/ResourceTypePicker.svelte
@@ -2,7 +2,6 @@
 	import { createEventDispatcher } from 'svelte'
 
 	import { ResourceService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import IconedResourceType from './IconedResourceType.svelte'
 	import { Button, ClearableInput } from './common'
 	import Label from './Label.svelte'
@@ -14,6 +13,9 @@
 		setResourceTypeDisplayNames,
 		sortResourceTypesByMatch
 	} from './resourceTypeDisplay'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 	interface Props {
 		value: string | undefined
 		notPickable?: boolean
@@ -25,7 +27,7 @@
 	let resources: { name: string; description?: string; searchText: string }[] = $state([])
 
 	async function loadResources() {
-		const types = await ResourceService.listResourceType({ workspace: $workspaceStore! })
+		const types = await ResourceService.listResourceType({ workspace: $operatingWorkspace! })
 		setResourceTypeDisplayNames(types)
 		resources = types.map((t) => ({
 			name: t.name,
@@ -42,7 +44,7 @@
 	}
 
 	$effect(() => {
-		if ($workspaceStore) {
+		if ($operatingWorkspace) {
 			untrack(() => {
 				loadResources()
 			})
diff --git a/frontend/src/lib/components/ResourceVersionHistory.svelte b/frontend/src/lib/components/ResourceVersionHistory.svelte
index 9f73e7dda1..383ab93a5e 100644
--- a/frontend/src/lib/components/ResourceVersionHistory.svelte
+++ b/frontend/src/lib/components/ResourceVersionHistory.svelte
@@ -1,7 +1,6 @@
 <script lang="ts">
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import { ResourceService, type ResourceVersion } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { Skeleton } from '$lib/components/common'
 	import Button from './common/button/Button.svelte'
 	import HighlightCode from './HighlightCode.svelte'
@@ -12,6 +11,9 @@
 	import VersionListItem from './VersionListItem.svelte'
 	import { displayDate } from '$lib/utils'
 	import { sendUserToast } from '$lib/toast'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let {
 		path,
@@ -27,7 +29,7 @@
 		onRestore?: () => void
 	} = $props()
 
-	let effectiveWorkspace = $derived(workspace ?? $workspaceStore!)
+	let effectiveWorkspace = $derived(workspace ?? $operatingWorkspace!)
 
 	let versions = $state<ResourceVersion[] | undefined>(undefined)
 	// Which row is highlighted, updated on click. `loaded` is dropped the moment the selection
diff --git a/frontend/src/lib/components/S3FilePicker.svelte b/frontend/src/lib/components/S3FilePicker.svelte
index 5006e2df0b..ce1af47118 100644
--- a/frontend/src/lib/components/S3FilePicker.svelte
+++ b/frontend/src/lib/components/S3FilePicker.svelte
@@ -7,7 +7,9 @@
 	import Select from './select/Select.svelte'
 	import { FileUp } from 'lucide-svelte'
 	import { SettingService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 	import { resource } from 'runed'
 
 	interface Props {
@@ -54,7 +56,7 @@
 	 * asset lives in a different workspace than this picker was mounted for. */
 	let workspaceOverride: string | undefined = $state(undefined)
 	let effectiveWorkspace = $derived(workspaceOverride ?? workspace)
-	let ws = $derived(effectiveWorkspace ?? $workspaceStore)
+	let ws = $derived(effectiveWorkspace ?? $operatingWorkspace)
 	let uploadModalOpen = $state(false)
 
 	let allFilesByKey: Record<
diff --git a/frontend/src/lib/components/S3FilePickerInner.svelte b/frontend/src/lib/components/S3FilePickerInner.svelte
index 5737744034..1bf1b4358a 100644
--- a/frontend/src/lib/components/S3FilePickerInner.svelte
+++ b/frontend/src/lib/components/S3FilePickerInner.svelte
@@ -10,7 +10,6 @@
 		Trash,
 		MoveRight
 	} from 'lucide-svelte'
-	import { workspaceStore } from '$lib/stores'
 	import {
 		CancelablePromise,
 		HelpersService,
@@ -48,6 +47,9 @@
 	import FileUploadModal from './common/fileUpload/FileUploadModal.svelte'
 	import S3FilePreview from './S3FilePreview.svelte'
 	import { twMerge } from 'tailwind-merge'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let deletionModalOpen = $state(false)
 	let fileDeletionInProgress = $state(false)
@@ -137,7 +139,7 @@
 		testConnectionRequest = HelpersService.datasetStorageTestConnection
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	let rootPath = $state(initialRootPath)
 	let rootPathNestingLevel = $derived(1 * (rootPath.split('/').length - 1))
diff --git a/frontend/src/lib/components/S3FilePreview.svelte b/frontend/src/lib/components/S3FilePreview.svelte
index 62c95581e7..411592b936 100644
--- a/frontend/src/lib/components/S3FilePreview.svelte
+++ b/frontend/src/lib/components/S3FilePreview.svelte
@@ -8,7 +8,6 @@
 	// need to hand it a `fileKey`. CSV separator/header are local state so
 	// the user can re-preview the same file with different parsing flags.
 	import { FileX2, Loader2 } from 'lucide-svelte'
-	import { workspaceStore } from '$lib/stores'
 	import {
 		HelpersService,
 		type CancelablePromise,
@@ -20,6 +19,9 @@
 	import { displayDate, displaySize, emptyString } from '$lib/utils'
 	import { twMerge } from 'tailwind-merge'
 	import ExpandableImage from '$lib/components/common/image/ExpandableImage.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		fileKey: string | undefined
@@ -115,7 +117,7 @@
 	// existence after an upstream run completes — moving from the
 	// "not yet materialized" empty state to the actual preview without
 	// requiring the user to re-click the asset.
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	$effect(() => {
 		const key = fileKey
diff --git a/frontend/src/lib/components/SaveInputsButton.svelte b/frontend/src/lib/components/SaveInputsButton.svelte
index a1966dd034..8d32b01163 100644
--- a/frontend/src/lib/components/SaveInputsButton.svelte
+++ b/frontend/src/lib/components/SaveInputsButton.svelte
@@ -1,15 +1,14 @@
 <script lang="ts">
 	import { displayDate } from '$lib/utils.js'
 	import { InputService, type CreateInput, type RunnableType } from '$lib/gen/index.js'
-	import { workspaceStore } from '$lib/stores.js'
 	import { Button } from '$lib/components/common'
 	import { Save } from 'lucide-svelte'
 	import { sendUserToast } from '$lib/utils.js'
 	import { createEventDispatcher } from 'svelte'
 	import Tooltip from '$lib/components/Tooltip.svelte'
-	import { getDetailWorkspace } from '$lib/components/details/detailWorkspace'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
-	const detailWs = getDetailWorkspace()
+	const operatingWorkspace = useOperatingWorkspace()
 
 	const dispatch = createEventDispatcher()
 
@@ -33,7 +32,7 @@
 		workspace = undefined
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? detailWs?.() ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	let savingInputs = $state(false)
 
diff --git a/frontend/src/lib/components/SavedInputsPicker.svelte b/frontend/src/lib/components/SavedInputsPicker.svelte
index 3a84c04ade..4749c6745f 100644
--- a/frontend/src/lib/components/SavedInputsPicker.svelte
+++ b/frontend/src/lib/components/SavedInputsPicker.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
 	import { Button } from '$lib/components/common'
 	import { InputService, type Input, type RunnableType } from '$lib/gen/index.js'
-	import { userStore, workspaceStore } from '$lib/stores.js'
+	import { userStore } from '$lib/stores.js'
 	import { sendUserToast } from '$lib/utils.js'
 	import { createEventDispatcher, onDestroy, untrack } from 'svelte'
 	import { Trash2, Save, Pencil } from 'lucide-svelte'
@@ -12,9 +12,14 @@
 	import InfiniteList from './InfiniteList.svelte'
 	import { twMerge } from 'tailwind-merge'
 	import SavedInputsPickerViewer from './SavedInputsPickerViewer.svelte'
-	import { getDetailWorkspace } from '$lib/components/details/detailWorkspace'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
 
-	const detailWs = getDetailWorkspace()
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	interface Props {
 		previewArgs?: any
@@ -39,7 +44,7 @@
 		workspace = undefined
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? detailWs?.() ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	interface EditableInput extends Input {
 		isEditing?: boolean
@@ -257,8 +262,8 @@
 				{#snippet children({ item, hover })}
 					{@const editOptions =
 						item.created_by == $userStore?.username ||
-						$userStore?.is_admin ||
-						$userStore?.is_super_admin}
+						actingUser?.is_admin ||
+						actingUser?.is_super_admin}
 					<Cell>
 						<div class="center-center">
 							<Save size={12} />
diff --git a/frontend/src/lib/components/SchemaForm.svelte b/frontend/src/lib/components/SchemaForm.svelte
index ddc2f182bc..872ed9711e 100644
--- a/frontend/src/lib/components/SchemaForm.svelte
+++ b/frontend/src/lib/components/SchemaForm.svelte
@@ -4,7 +4,6 @@
 	const bubble = createBubbler()
 	import type { Schema } from '$lib/common'
 	import { VariableService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { allTrue, computeShow, type DynamicInput } from '$lib/utils'
 	import { Button } from './common'
 	import ItemPicker from './ItemPicker.svelte'
@@ -26,6 +25,9 @@
 	import type { ComponentCustomCSS } from './apps/types'
 	import ResizeTransitionWrapper from './common/ResizeTransitionWrapper.svelte'
 	import { twMerge } from 'tailwind-merge'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		schema: Schema | any
@@ -122,7 +124,7 @@
 		actions: actions_render = undefined
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	const dispatch = createEventDispatcher()
 
diff --git a/frontend/src/lib/components/ScriptBuilder.svelte b/frontend/src/lib/components/ScriptBuilder.svelte
index ea0d8c724a..d4c1e05a0a 100644
--- a/frontend/src/lib/components/ScriptBuilder.svelte
+++ b/frontend/src/lib/components/ScriptBuilder.svelte
@@ -13,6 +13,7 @@
 		WorkerService
 	} from '$lib/gen'
 	import { inferArgs } from '$lib/infer'
+	import { VERSION_PAGE_SIZE } from '$lib/components/diff_drawer'
 	import {
 		initialCode,
 		canHavePreprocessor,
@@ -30,6 +31,10 @@
 		workerTags,
 		workspaceStore
 	} from '$lib/stores'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
 	import {
 		emptySchema,
 		emptyString,
@@ -87,7 +92,7 @@
 	import { writable } from 'svelte/store'
 	import { defaultScriptLanguages, processLangs } from '$lib/scripts'
 	import DefaultScripts from './DefaultScripts.svelte'
-	import { getContext, onMount, setContext, tick, untrack } from 'svelte'
+	import { getContext, onDestroy, onMount, setContext, tick, untrack } from 'svelte'
 	import EditorHeader from './EditorHeader.svelte'
 	import ScriptSettingsBadges from './ScriptSettingsBadges.svelte'
 	import Badge from './common/badge/Badge.svelte'
@@ -119,6 +124,8 @@
 		fullyLoaded = true,
 		initialPath = $bindable(''),
 		userDraftPath = '',
+		onTakeLatest = undefined,
+		draftBaseHash = undefined,
 		autosaveWorkspace = undefined,
 		autosavePath = undefined,
 		template = $bindable('script'),
@@ -189,7 +196,10 @@
 	// (forked) workspace, so an embedded editor acts on the session's fork rather
 	// than the navigation workspace ($workspaceStore, which stays put). indicatorPath
 	// is the matching draft path (URL path full-page, session target in preview).
-	const opWorkspace = $derived(autosaveWorkspace ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	const opWorkspace = $derived(autosaveWorkspace ?? $operatingWorkspace)
 	const indicatorPath = $derived(autosavePath ?? userDraftPath)
 
 	// The shared `workerTags` store caches tags for the navigation workspace. A
@@ -223,8 +233,8 @@
 	let preserveOnBehalfOf = $state(false)
 
 	const WM_DEPLOYERS_GROUP = 'wm_deployers'
-	let isDeployer = $derived($userStore?.groups?.includes(WM_DEPLOYERS_GROUP) ?? false)
-	let canPreserve = $derived(!!$userStore?.is_admin || !!$userStore?.is_super_admin || isDeployer)
+	let isDeployer = $derived(actingUser?.groups?.includes(WM_DEPLOYERS_GROUP) ?? false)
+	let canPreserve = $derived(!!actingUser?.is_admin || !!actingUser?.is_super_admin || isDeployer)
 	let originalOnBehalfOfEmail = $derived(savedScript?.on_behalf_of_email)
 	let originalOnBehalfOfPermissionedAs = $derived(savedScript?.on_behalf_of)
 	let onBehalfOfChoice: OnBehalfOfChoice = $state(undefined)
@@ -558,10 +568,13 @@
 
 		try {
 			if (initialPath && initialPath != '') {
+				// The row's path, not `initialPath`: that is the typed path, where a
+				// staged rename has nothing deployed, and a missing head would deploy
+				// on a base that already has a child.
 				actual_parent_hash = (
 					await ScriptService.getScriptLatestVersion({
 						workspace: opWorkspace!,
-						path: initialPath
+						path: userDraftPath || initialPath
 					})
 				)?.script_hash
 			}
@@ -573,9 +586,15 @@
 		// But if we specify parent_hash that is already used, than we get error
 		// In order to fix it we make sure that client's understanding of parent_hash
 		// is aligns with understanding of backend.
-		if (actual_parent_hash == undefined || script.parent_hash == actual_parent_hash) {
+		//
+		// A draft with no base (one predating `draft.base`) is compared on the head this
+		// editor loaded, as the flow and raw-app guards are: comparing `undefined` would
+		// open the confirmation on every deploy, telling the user a version landed while
+		// they were editing when none had.
+		const baseHash = script.parent_hash ?? deployedScriptHash
+		if (actual_parent_hash == undefined || baseHash == actual_parent_hash) {
 			// Handle directly
-			await editScript(stay, script.parent_hash!, deployMsg)
+			await editScript(stay, (script.parent_hash ?? actual_parent_hash)!, deployMsg)
 		} else {
 			// Fetch entire script, since we need it to show Diff
 			await syncWithDeployed()
@@ -605,13 +624,20 @@
 		}
 	}
 
-	async function syncWithDeployed() {
+	async function syncWithDeployed(opening?: number) {
 		const latestScript = await ScriptService.getScriptByPath({
 			workspace: opWorkspace!,
-			path: initialPath,
+			// The draft row's own path, not `initialPath` — that one tracks the path
+			// the user has typed, so after someone renames the item it still names
+			// the old location and this would compare against the archived row left
+			// there. Resolving by the row is what lets the diff show the rename.
+			path: userDraftPath || initialPath,
 			withStarredInfo: true
 		})
 
+		// A superseded opening must not write these: the current one would then render
+		// and offer Take latest against the older head.
+		if (opening != null && !diffDrawer?.ownsOpening(opening)) return
 		deployedValue = replaceFalseWithUndefined({
 			...latestScript,
 			workspace_id: undefined,
@@ -740,7 +766,7 @@
 				await deployTriggers(
 					triggersToDeploy,
 					opWorkspace,
-					!!$userStore?.is_admin || !!$userStore?.is_super_admin,
+					!!actingUser?.is_admin || !!actingUser?.is_super_admin,
 					usedTriggerKinds,
 					script.path,
 					true
@@ -782,7 +808,7 @@
 	// + `tick()` first so the last keystrokes reach the bindable before the
 	// syncer flushes. No toast — the AutosaveIndicator narrates the result, and
 	// `flush` never rejects (postSave routes errors to the failures map).
-	async function saveDraft(): Promise<void> {
+	export async function saveDraft(): Promise<void> {
 		if (!opWorkspace || !userDraftPath) return
 		editor?.flushPendingChanges()
 		await tick()
@@ -812,11 +838,90 @@
 	// as a standalone top-bar button (rendered independently of the pane), not here.
 	const inSessionPane = !!getContext('aiChatManager')
 
-	async function openDiffDrawer() {
+	/** Names the version on the deployed side of the diff. Without it the reader is
+	 *  shown two panes and told nothing about what the left one is — which matters
+	 *  most in the stale-draft case, where the whole question is "whose version am I
+	 *  about to overwrite". */
+	function deployedVersionLabel(deployed: any): string | undefined {
+		if (!deployed?.hash) return undefined
+		// `deployedBy` is captured in `syncWithDeployed` before it strips `created_by`.
+		// Only used when the version list is unavailable; otherwise the picker labels it.
+		return `Deployed${deployedBy ? ` by ${deployedBy}` : ''} · latest`
+	}
+
+	/** Deployed versions to offer in the diff picker, newest first. Best-effort: a
+	 *  failure here costs the picker, not the diff, so the drawer still opens on the
+	 *  head. `deployment_msg` is all the history endpoint carries besides the hash. */
+	/** Throws: the drawer says so and lets the reader ask for the same page again. */
+	async function fetchVersionPage(headHash: string | undefined, page: number) {
+		if (!opWorkspace || !userDraftPath) return undefined
+		{
+			const history = await ScriptService.getScriptHistoryByPath({
+				workspace: opWorkspace,
+				path: userDraftPath,
+				page,
+				perPage: VERSION_PAGE_SIZE
+			})
+			// The hash identifies the version — it is what the API and the CLI speak — and
+			// who deployed it drops to the subtitle. No ordinal: the list arrives a page at
+			// a time, so a number counted within one would rename versions as more load.
+			return history.map((h) => {
+				const isHead = h.script_hash === headHash
+				const detail = [
+					h.created_by,
+					h.created_at ? new Date(h.created_at).toLocaleString() : undefined,
+					h.deployment_msg
+				].filter(Boolean)
+				return {
+					id: h.script_hash,
+					label: `${h.script_hash.slice(0, 8)}${isHead ? ' · latest' : ''}`,
+					subtitle: detail.length ? detail.join(' · ') : undefined,
+					isHead
+				}
+			})
+		}
+	}
+
+	/** The first page, best-effort: losing it costs the picker, not the diff. */
+	async function deployedVersionOptions(headHash: string | undefined) {
+		try {
+			return await fetchVersionPage(headHash, 1)
+		} catch {
+			return undefined
+		}
+	}
+
+	/** Hands the drawer the next page each time the reader asks for one. The page number
+	 *  belongs to this item's history, so it lives here — and only moves once a page has
+	 *  actually arrived, or a failed request would skip it. */
+	function moreVersionsLoader(headHash: string | undefined) {
+		let loaded = 1
+		return async () => {
+			const page = await fetchVersionPage(headHash, loaded + 1)
+			loaded += 1
+			return page
+		}
+	}
+
+	/** The opening this editor claimed last. A path change remounts this editor while the
+	 *  drawer stays mounted, so its teardown hands that opening back rather than leaving
+	 *  the drawer on the item the user left. */
+	let lastOpening: number | undefined = undefined
+	onDestroy(() => {
+		if (lastOpening != null) diffDrawer?.abandonOpening(lastOpening)
+	})
+
+	export async function openDiffDrawer() {
 		if (!savedScript) {
 			return
 		}
-		await syncWithDeployed()
+		// The fetches below are awaited, so a reopen (or a path change, which remounts
+		// this editor but not the drawer) while they run must not have the older one
+		// land last. The drawer counts the openings for that reason.
+		const opening = diffDrawer?.beginOpening()
+		lastOpening = opening
+		if (opening == null) return
+		await syncWithDeployed(opening)
 
 		const currentDraftTriggers = structuredClone(triggersState.getDraftTriggersSnapshot())
 
@@ -833,13 +938,40 @@
 		}
 		if (current.assets && !current.assets.length) delete current.assets
 
-		diffDrawer?.openDrawer()
-		diffDrawer?.setDiff({
-			mode: 'normal',
-			deployed,
-			draft: savedScript['draft'],
-			current
-		})
+		// Blanking the drawer belongs to the opening that will fill it.
+		if (!diffDrawer?.ownsOpening(opening)) return
+		diffDrawer.openDrawer(opening)
+		const headHash = (deployed as { hash?: string } | undefined)?.hash
+		const versions = await deployedVersionOptions(headHash)
+		if (!diffDrawer?.ownsOpening(opening)) return
+		diffDrawer.setDiff(
+			{
+				mode: 'normal',
+				deployed,
+				deployedLabel: deployedVersionLabel(deployed),
+				versions,
+				loadMoreVersions: moreVersionsLoader(headHash),
+				onTakeLatest,
+				draftBase: draftBaseHash,
+				deployedHead: headHash,
+				loadVersion: async (hash) => {
+					const v = await ScriptService.getScriptByHash({ workspace: opWorkspace!, hash })
+					return replaceFalseWithUndefined({
+						...v,
+						workspace_id: undefined,
+						created_at: undefined,
+						created_by: undefined,
+						extra_perms: undefined,
+						lock: undefined,
+						lock_error_logs: undefined,
+						parent_hashes: undefined
+					})
+				},
+				draft: savedScript['draft'],
+				current
+			},
+			opening
+		)
 	}
 
 	function computeDropdownItems(
@@ -1143,6 +1275,7 @@
 	{confirmCallback}
 	bind:open
 	{diffDrawer}
+	claimOpening={() => (lastOpening = diffDrawer?.beginOpening())}
 	bind:deployedValue
 	currentValue={script}
 />
@@ -1156,7 +1289,7 @@
 	on:confirmed={handleDraftTriggersConfirmed}
 />
 
-{#if !$userStore?.operator}
+{#if !actingUser?.operator}
 	<Drawer
 		placement="right"
 		bind:open={metadataOpen}
@@ -2039,7 +2172,7 @@
 									args={hasPreprocessor && selectedInputTab !== 'preprocessor' ? {} : args}
 									isDeployed={savedScript && savedScript?.no_deployed !== true}
 									schema={script.schema}
-									runnableVersion={script.parent_hash}
+									runnableVersion={deployedScriptHash}
 									onDeployTrigger={handleDeployTrigger}
 								/>
 
diff --git a/frontend/src/lib/components/ScriptEditor.svelte b/frontend/src/lib/components/ScriptEditor.svelte
index f8028aeb1f..06c8a77d20 100644
--- a/frontend/src/lib/components/ScriptEditor.svelte
+++ b/frontend/src/lib/components/ScriptEditor.svelte
@@ -11,7 +11,7 @@
 		type ScriptLang,
 		type ScriptModule
 	} from '$lib/gen'
-	import { enterpriseLicense, userStore, workspaceStore } from '$lib/stores'
+	import { enterpriseLicense, userStore } from '$lib/stores'
 	import { copyToClipboard, emptySchema, sendUserToast } from '$lib/utils'
 	import Editor from './Editor.svelte'
 	import { inferArgs, inferAssets, inferAnsibleExecutionMode } from '$lib/infer'
@@ -129,6 +129,9 @@
 	import { resource, watch } from 'runed'
 	import { buildScriptRecording, downloadRecordingJson } from './recording/runRecording'
 	import DropdownV2 from './DropdownV2.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		// Exported
@@ -226,10 +229,8 @@
 		// built by the pipeline page from the resolved graph. Absent outside the
 		// pipeline editor — the check still runs, just without suppression.
 		schemaContractContext?: SchemaContractGraphContext
-		// Workspace to scope this editor's calls to. Defaults to the nav
-		// `$workspaceStore`; an AI-session live editor passes the session's
-		// acting workspace (a fork) so tests, captures and toolbar lookups hit
-		// the right workspace instead of the nav one.
+		// Workspace to scope this editor's calls to (tests, captures, toolbar lookups).
+		// Defaults to the operating workspace (see `useOperatingWorkspace`).
 		workspaceOverride?: string
 	}
 
@@ -278,7 +279,7 @@
 		workspaceOverride = undefined
 	}: Props = $props()
 
-	let opWs = $derived(workspaceOverride ?? $workspaceStore)
+	let opWs = $derived(workspaceOverride ?? $operatingWorkspace)
 
 	// Publish this editor's hand-off for AI entry points below it (the preview
 	// panel's "AI Fix"), withheld under `disableAi` so an embed that turned AI off
diff --git a/frontend/src/lib/components/ScriptPicker.svelte b/frontend/src/lib/components/ScriptPicker.svelte
index ccc3f04be7..781cb5155e 100644
--- a/frontend/src/lib/components/ScriptPicker.svelte
+++ b/frontend/src/lib/components/ScriptPicker.svelte
@@ -1,7 +1,6 @@
 <script lang="ts">
 	import { ScriptService, FlowService, type Script, AppService } from '$lib/gen'
 
-	import { workspaceStore } from '$lib/stores'
 	import { base } from '$lib/base'
 	import { createEventDispatcher, untrack } from 'svelte'
 
@@ -13,11 +12,16 @@
 	import FlowPathViewer from './flows/content/FlowPathViewer.svelte'
 	import ToggleButton from './common/toggleButton-v2/ToggleButton.svelte'
 	import ToggleButtonGroup from './common/toggleButton-v2/ToggleButtonGroup.svelte'
-	import { Code, Code2, ExternalLink, Pen, RefreshCw } from 'lucide-svelte'
+	import { Code, Code2, ExternalLink, Globe2, Pen, RefreshCw } from 'lucide-svelte'
+	import PickHubScript from './flows/pickers/PickHubScript.svelte'
+	import { disableHubStore } from '$lib/stores'
 	import type { SupportedLanguage } from '$lib/common'
 	import FlowIcon from './home/FlowIcon.svelte'
 	import DarkModeObserver from './DarkModeObserver.svelte'
 	import { truncate } from '$lib/utils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		initialPath?: string | undefined
@@ -30,9 +34,11 @@
 		allowEdit?: boolean
 		allowView?: boolean
 		clearable?: boolean
-		/** Workspace to list runnables from. Defaults to the navigation
-		 * `$workspaceStore`; pass the session's acting workspace so a forked
-		 * session lists its own scripts/flows/apps rather than the parent's. */
+		/** Offer picking a script from the Hub; the picked path is `hub/...`. Browses plain
+		 * scripts only, whatever `kinds` is. */
+		allowHub?: boolean
+		/** Workspace to list runnables from. Defaults to the operating workspace (see
+		 * `useOperatingWorkspace`). */
 		workspace?: string
 	}
 
@@ -47,13 +53,20 @@
 		allowEdit = true,
 		allowView = true,
 		clearable = false,
+		allowHub = false,
 		workspace = undefined
 	}: Props = $props()
 
-	let effectiveWorkspace = $derived(workspace ?? $workspaceStore)
-	// Only carry the workspace onto Edit/View routes when an explicit override
-	// was passed, so existing callers' links are unchanged.
-	let wsParam = $derived(workspace ? `?workspace=${encodeURIComponent(workspace)}` : '')
+	let isHubPath = $derived(itemKind == 'script' && !!scriptPath?.startsWith('hub/'))
+	let drawerHub: Drawer | undefined = $state()
+	let filterText = $state('')
+	let hubFilter = $state('')
+
+	let effectiveWorkspace = $derived(workspace ?? $operatingWorkspace)
+	// Edit/View routes open in the workspace listed here, not wherever the tab lands.
+	let wsParam = $derived(
+		effectiveWorkspace ? `?workspace=${encodeURIComponent(effectiveWorkspace)}` : ''
+	)
 
 	let items: { value: string; label: string }[] = $state([])
 	let drawerViewer: Drawer | undefined = $state()
@@ -113,6 +126,21 @@
 	</DrawerContent>
 </Drawer>
 
+{#if allowHub}
+	<Drawer bind:this={drawerHub} size="900px">
+		<DrawerContent title="Pick a Hub script" on:close={drawerHub.closeDrawer}>
+			<PickHubScript
+				bind:filter={hubFilter}
+				on:pick={(e) => {
+					scriptPath = e.detail.path
+					dispatch('select', { path: e.detail.path, itemKind })
+					drawerHub?.closeDrawer()
+				}}
+			/>
+		</DrawerContent>
+	</Drawer>
+{/if}
+
 <div class="flex flex-row items-center gap-1 w-full">
 	{#if options.length > 1}
 		<div>
@@ -143,9 +171,11 @@
 				}
 			}
 			class="grow shrink max-w-full"
-			{items}
+			items={isHubPath ? [{ value: scriptPath!, label: scriptPath! }, ...items] : items}
 			{clearable}
+			bind:filterText
 			placeholder="Pick {itemKind === 'app' ? 'an' : 'a'} {itemKind}"
+			bottomSnippet={allowHub && itemKind == 'script' && !$disableHubStore ? hubHint : undefined}
 		/>
 	{/if}
 
@@ -210,7 +240,7 @@
 			</div>
 		{:else}
 			<div class="flex gap-2">
-				{#if allowEdit}
+				{#if allowEdit && !isHubPath}
 					<Button
 						startIcon={{ icon: Pen }}
 						target="_blank"
@@ -243,3 +273,21 @@
 		{/if}
 	{/if}
 </div>
+
+{#snippet hubHint({ close }: { close: () => void })}
+	<Button
+		variant="subtle"
+		size="xs2"
+		startIcon={{ icon: Globe2 }}
+		wrapperClasses="w-full border-t border-border-light"
+		btnClasses="w-full rounded-none font-normal"
+		onClick={() => {
+			// Read before close(): Select clears its filter text when the list closes.
+			hubFilter = filterText
+			close()
+			drawerHub?.openDrawer()
+		}}
+	>
+		Browse Hub scripts
+	</Button>
+{/snippet}
diff --git a/frontend/src/lib/components/ScriptVersionHistory.svelte b/frontend/src/lib/components/ScriptVersionHistory.svelte
index a7ecb97fd9..f780b32d97 100644
--- a/frontend/src/lib/components/ScriptVersionHistory.svelte
+++ b/frontend/src/lib/components/ScriptVersionHistory.svelte
@@ -2,7 +2,6 @@
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import { emptyString } from '$lib/utils'
 	import { ScriptService, type ScriptHistory } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { Skeleton } from '$lib/components/common'
 	import FlowModuleScript from './flows/content/FlowModuleScript.svelte'
 	import { createEventDispatcher } from 'svelte'
@@ -11,13 +10,12 @@
 	import ToggleButtonGroup from './common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from './common/toggleButton-v2/ToggleButton.svelte'
 	import VersionListItem from './VersionListItem.svelte'
-	import { getDetailWorkspace } from '$lib/components/details/detailWorkspace'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	const dispatch = createEventDispatcher()
 
-	const detailWs = getDetailWorkspace()
-	let ws = $derived(detailWs?.() ?? $workspaceStore)
-
 	let { openDetails = false, scriptPath }: { openDetails?: boolean; scriptPath: string } = $props()
 
 	let deploymentMsgUpdateMode = $state(false)
@@ -31,7 +29,7 @@
 	async function loadVersions() {
 		loading = true
 		versions = await ScriptService.getScriptHistoryByPath({
-			workspace: ws!,
+			workspace: $operatingWorkspace!,
 			path: scriptPath
 		})
 		loading = false
@@ -46,7 +44,7 @@
 			return
 		}
 		await ScriptService.updateScriptHistory({
-			workspace: ws!,
+			workspace: $operatingWorkspace!,
 			path: scriptPath,
 			hash: scriptHash,
 			requestBody: {
diff --git a/frontend/src/lib/components/ScrollFade.svelte b/frontend/src/lib/components/ScrollFade.svelte
new file mode 100644
index 0000000000..8726ea95ab
--- /dev/null
+++ b/frontend/src/lib/components/ScrollFade.svelte
@@ -0,0 +1,66 @@
+<script lang="ts">
+	/**
+	 * A soft edge on a scroller, so content scrolling out of view fades instead of being
+	 * cut against whatever borders it.
+	 *
+	 * Rendered as an overlay in the scroller's positioned ancestor rather than inside the
+	 * scroller: `sticky` would resolve against the scroller's padding box and leave the
+	 * first few pixels unfaded. It shows only when there is something hidden in that
+	 * direction, so a transcript that fits shows no edge at all.
+	 */
+	import { twMerge } from 'tailwind-merge'
+
+	interface Props {
+		/** The scrolling element this masks. */
+		scroller: HTMLElement | undefined
+		edge?: 'top' | 'bottom'
+		/** Tailwind colour stop to fade from — the surface the scroller sits on. */
+		from?: string
+		/** Tailwind height of the fade band. */
+		height?: string
+		class?: string
+	}
+
+	let {
+		scroller,
+		edge = 'top',
+		from = 'from-surface',
+		height = 'h-4',
+		class: className = ''
+	}: Props = $props()
+
+	let hidden = $state(true)
+
+	$effect(() => {
+		const el = scroller
+		if (!el) return
+		const update = () => {
+			// A pixel of slack: fractional scroll offsets otherwise leave the bottom edge
+			// showing on a scroller that is already at its end.
+			hidden =
+				edge === 'top' ? el.scrollTop <= 1 : el.scrollTop + el.clientHeight >= el.scrollHeight - 1
+		}
+		update()
+		el.addEventListener('scroll', update, { passive: true })
+		// Content arriving or the pane resizing changes what is hidden without a scroll.
+		const observer = new ResizeObserver(update)
+		observer.observe(el)
+		if (el.firstElementChild) observer.observe(el.firstElementChild)
+		return () => {
+			el.removeEventListener('scroll', update)
+			observer.disconnect()
+		}
+	})
+</script>
+
+<div
+	class={twMerge(
+		'pointer-events-none absolute inset-x-0 transition-opacity duration-150',
+		edge === 'top' ? 'top-0 bg-gradient-to-b' : 'bottom-0 bg-gradient-to-t',
+		from,
+		'to-transparent',
+		height,
+		hidden ? 'opacity-0' : 'opacity-100',
+		className
+	)}
+></div>
diff --git a/frontend/src/lib/components/ShareModal.svelte b/frontend/src/lib/components/ShareModal.svelte
index 7f3e3d2a3e..da6cc9a674 100644
--- a/frontend/src/lib/components/ShareModal.svelte
+++ b/frontend/src/lib/components/ShareModal.svelte
@@ -10,7 +10,7 @@
 	} from '$lib/gen'
 	import type { Folder } from '$lib/gen/types.gen'
 	import { createEventDispatcher } from 'svelte'
-	import { userStore, workspaceStore } from '$lib/stores'
+
 	import { Alert, Button, Drawer } from './common'
 	import DrawerContent from './common/drawer/DrawerContent.svelte'
 	import { sendUserToast } from '$lib/toast'
@@ -22,15 +22,22 @@
 	import Toggle from './Toggle.svelte'
 	import { Trash } from 'lucide-svelte'
 	import { DEMO_RESTRICTION_HINT, isDemoWorkspaceRestricted } from '$lib/cloud'
-	import { getDetailWorkspace } from '$lib/components/details/detailWorkspace'
+	import {
+		useOperatingWorkspace,
+		useOperatingUser
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
 
 	const dispatch = createEventDispatcher()
 
-	const detailWs = getDetailWorkspace()
-	let ws = $derived(detailWs?.() ?? $workspaceStore)
-
 	let restricted = $derived(
-		isDemoWorkspaceRestricted(ws, $userStore?.is_admin, $userStore?.is_super_admin)
+		isDemoWorkspaceRestricted(
+			$operatingWorkspace,
+			operatingUser.current?.is_admin,
+			operatingUser.current?.is_super_admin
+		)
 	)
 
 	type Kind =
@@ -85,7 +92,7 @@
 			defaultPermsLabel = `Folder f/${folderName} permissions`
 			try {
 				const folder: Folder = await FolderService.getFolder({
-					workspace: ws!,
+					workspace: $operatingWorkspace!,
 					name: folderName
 				})
 				if (path !== currentPath) return
@@ -138,7 +145,7 @@
 		const currentPath = path
 		try {
 			const resource = await ResourceService.getResource({
-				workspace: ws!,
+				workspace: $operatingWorkspace!,
 				path: currentPath
 			})
 			if (path !== currentPath) return
@@ -168,25 +175,27 @@
 	}
 
 	async function loadOwner() {
-		own = isOwner(path, $userStore!, ws!)
+		own = isOwner(path, operatingUser.current!, $operatingWorkspace!)
 	}
 
 	async function loadAcls() {
-		acls = Object.entries(await GranularAclService.getGranularAcls({ workspace: ws!, path, kind }))
+		acls = Object.entries(
+			await GranularAclService.getGranularAcls({ workspace: $operatingWorkspace!, path, kind })
+		)
 	}
 
 	async function loadGroups(): Promise<void> {
-		groups = await GroupService.listGroupNames({ workspace: ws! })
+		groups = await GroupService.listGroupNames({ workspace: $operatingWorkspace! })
 	}
 
 	async function loadUsernames(): Promise<void> {
-		usernames = await UserService.listUsernames({ workspace: ws! })
+		usernames = await UserService.listUsernames({ workspace: $operatingWorkspace! })
 	}
 
 	async function deleteAcl(owner: string) {
 		try {
 			await GranularAclService.removeGranularAcls({
-				workspace: ws!,
+				workspace: $operatingWorkspace!,
 				path,
 				kind,
 				requestBody: { owner }
@@ -195,7 +204,7 @@
 				for (const varPath of linkedVarPaths) {
 					try {
 						await GranularAclService.removeGranularAcls({
-							workspace: ws!,
+							workspace: $operatingWorkspace!,
 							path: varPath,
 							kind: 'variable',
 							requestBody: { owner }
@@ -214,7 +223,7 @@
 
 	async function addAcl(owner: string, write: boolean) {
 		await GranularAclService.addGranularAcls({
-			workspace: ws!,
+			workspace: $operatingWorkspace!,
 			path,
 			kind,
 			requestBody: { owner, write }
@@ -223,7 +232,7 @@
 			for (const varPath of linkedVarPaths) {
 				try {
 					await GranularAclService.addGranularAcls({
-						workspace: ws!,
+						workspace: $operatingWorkspace!,
 						path: varPath,
 						kind: 'variable',
 						requestBody: { owner, write }
diff --git a/frontend/src/lib/components/SqlRepl.svelte b/frontend/src/lib/components/SqlRepl.svelte
index e19da629bd..d58ac65898 100644
--- a/frontend/src/lib/components/SqlRepl.svelte
+++ b/frontend/src/lib/components/SqlRepl.svelte
@@ -3,7 +3,6 @@
 	import Button from './common/button/Button.svelte'
 	import { runScriptAndPollResult } from './jobs/utils'
 	import { writingJobOptions } from './jobs/writingJob'
-	import { workspaceStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
 	import { untrack } from 'svelte'
 	import { getLanguageByResourceType } from './apps/components/display/dbtable/utils'
@@ -14,6 +13,9 @@
 	import { wrapDucklakeQuery } from './ducklake'
 	import { splitSqlStatements, pruneComments } from './sqlDdl'
 	import DdlMigrationGuard from './DdlMigrationGuard.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	type Props = {
 		input: DbInput
@@ -39,7 +41,7 @@
 		workspace = undefined,
 		tag = undefined
 	}: Props = $props()
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 	let dbType = $derived(getDbType(input))
 
 	// A datatable REPL targets `datatable://<name>`; surface DDL statements as
@@ -103,14 +105,21 @@
 			// We don't always put the fix by default for row ordering concerns
 			let transformedCode = code
 			if (doPostgresRowToJsonFix) {
-				transformedCode = statements
-					.map((statement) => {
-						if (READ_OPS.some((op) => statement.trim().toUpperCase().startsWith(op))) {
-							return `SELECT row_to_json(__t__) FROM (${statement}) __t__`
-						}
-						return statement
-					})
-					.join(';')
+				// Rebuilt from the pruned statements, which drops the leading comment block — and
+				// with it the `-- role <name>` annotation that decides which login the query runs
+				// as. Carry it over, or the retry connects as the data table's default role and a
+				// query the first attempt was denied succeeds on the second.
+				const leadingAnnotations = code.match(/^(?:[^\S\n]*\n|[^\S\n]*--[^\n]*\n)*/)?.[0] ?? ''
+				transformedCode =
+					leadingAnnotations +
+					statements
+						.map((statement) => {
+							if (READ_OPS.some((op) => statement.trim().toUpperCase().startsWith(op))) {
+								return `SELECT row_to_json(__t__) FROM (${statement}) __t__`
+							}
+							return statement
+						})
+						.join(';')
 			}
 			const dbArg = getDatabaseArg(input)
 
@@ -216,5 +225,10 @@
 </Splitpanes>
 
 {#if datatableName && ws}
-	<DdlMigrationGuard bind:this={ddlGuard} workspace={ws} datatable={datatableName} />
+	<DdlMigrationGuard
+		bind:this={ddlGuard}
+		workspace={ws}
+		datatable={datatableName}
+		role={input.type === 'database' ? (input.role ?? input.migrationRole) : undefined}
+	/>
 {/if}
diff --git a/frontend/src/lib/components/Star.svelte b/frontend/src/lib/components/Star.svelte
index dd91f671c8..4f0f169109 100644
--- a/frontend/src/lib/components/Star.svelte
+++ b/frontend/src/lib/components/Star.svelte
@@ -9,9 +9,10 @@
 		kind: FavoriteKind
 		summary?: string
 		workspaceId?: string
+		size?: number
 	}
 
-	let { path, kind, workspaceId, summary }: Props = $props()
+	let { path, kind, workspaceId, summary, size = 16 }: Props = $props()
 
 	let buttonHover = $state(false)
 	let starred = $derived(favoriteManager.isStarred(path, kind))
@@ -31,14 +32,14 @@
 >
 	{#if starred}
 		{#if buttonHover}
-			<StarOff size={16} fill="currentcolor" />
+			<StarOff {size} fill="currentcolor" />
 		{:else}
-			<Star size={16} fill="currentcolor" />
+			<Star {size} fill="currentcolor" />
 		{/if}
 	{:else}
 		<Star
 			class={!buttonHover ? 'opacity-60' : ''}
-			size={16}
+			{size}
 			fill={buttonHover ? 'currentcolor' : 'none'}
 		/>
 	{/if}
diff --git a/frontend/src/lib/components/SummaryPathDisplay.svelte b/frontend/src/lib/components/SummaryPathDisplay.svelte
index 790ca5b0f8..22925e98e7 100644
--- a/frontend/src/lib/components/SummaryPathDisplay.svelte
+++ b/frontend/src/lib/components/SummaryPathDisplay.svelte
@@ -4,13 +4,21 @@
 	import Popover from '$lib/components/meltComponents/Popover.svelte'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
 	import Path from '$lib/components/Path.svelte'
-	import { userStore, workspaceStore } from '$lib/stores'
+	import { userStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
 	import { updateItemPathAndSummary, checkFlowOnBehalfOf } from './moveRenameManager'
 	import Label from './Label.svelte'
 	import LabelsInput from './LabelsInput.svelte'
 	import InheritedLabels from './InheritedLabels.svelte'
 	import Badge from './common/badge/Badge.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	interface Props {
 		summary?: string
@@ -36,7 +44,11 @@
 	let editPath = $state('')
 	let dirtyPath = $state(false)
 	let popoverOpen = $state(false)
-	let own = $state(false)
+	let ownPath = $state<string | undefined>(undefined)
+	// Derived: ownership answers about the operating workspace, whose user resolves asynchronously.
+	const own = $derived(
+		ownPath === undefined ? false : isOwner(ownPath, actingUser, $operatingWorkspace)
+	)
 	let onBehalfOfEmail = $state<string | undefined>(undefined)
 	let summaryInput: ReturnType<typeof TextInput> | undefined = $state()
 	let labelsDirty = $state(false)
@@ -47,10 +59,10 @@
 			editSummary = summary ?? ''
 			editPath = path ?? ''
 			labelsDirty = false
-			own = isOwner(path ?? '', $userStore, $workspaceStore)
+			ownPath = path ?? ''
 			onBehalfOfEmail = undefined
-			if (kind === 'flow' && $workspaceStore && path) {
-				checkFlowOnBehalfOf($workspaceStore, path).then((email) => {
+			if (kind === 'flow' && $operatingWorkspace && path) {
+				checkFlowOnBehalfOf($operatingWorkspace, path).then((email) => {
 					onBehalfOfEmail = email
 				})
 			}
@@ -63,7 +75,7 @@
 
 		try {
 			await updateItemPathAndSummary({
-				workspace: $workspaceStore!,
+				workspace: $operatingWorkspace!,
 				kind,
 				initialPath,
 				newPath,
diff --git a/frontend/src/lib/components/SupabaseConnect.svelte b/frontend/src/lib/components/SupabaseConnect.svelte
index e44399ee84..0b457e2aec 100644
--- a/frontend/src/lib/components/SupabaseConnect.svelte
+++ b/frontend/src/lib/components/SupabaseConnect.svelte
@@ -12,10 +12,13 @@
 
 	import autosize from '$lib/autosize'
 	import { ResourceService, VariableService } from '$lib/gen'
-	import { oauthStore, workspaceStore } from '$lib/stores'
+	import { oauthStore } from '$lib/stores'
 	import Password from './Password.svelte'
 	import { createEventDispatcher } from 'svelte'
 	import HighlightTheme from './HighlightTheme.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let drawer: Drawer | undefined = $state()
 	let token: undefined | string = $state(undefined)
@@ -78,7 +81,7 @@
 	async function save() {
 		if (!path) return
 		await VariableService.createVariable({
-			workspace: $workspaceStore!,
+			workspace: $operatingWorkspace!,
 			requestBody: {
 				path,
 				value: password,
@@ -89,7 +92,7 @@
 		})
 
 		await ResourceService.createResource({
-			workspace: $workspaceStore!,
+			workspace: $operatingWorkspace!,
 			requestBody: {
 				resource_type: 'postgresql',
 				path,
diff --git a/frontend/src/lib/components/TestConnection.svelte b/frontend/src/lib/components/TestConnection.svelte
index 80ec59d206..105d594ce8 100644
--- a/frontend/src/lib/components/TestConnection.svelte
+++ b/frontend/src/lib/components/TestConnection.svelte
@@ -13,7 +13,9 @@
 	import Button from './common/button/Button.svelte'
 	import Tooltip from './meltComponents/Tooltip.svelte'
 	import { sendUserToast } from '$lib/toast'
-	import { workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 	import { tryEvery } from '$lib/utils'
 
 	interface Props {
@@ -268,7 +270,7 @@ export async function main(bucket: any, api_token: string) {
 		loading = true
 
 		const resourceScript = scripts[resourceType]
-		const workspace = workspaceOverride ?? $workspaceStore!
+		const workspace = workspaceOverride ?? $operatingWorkspace!
 		const objectStorageArgs: Record<string, any> | undefined =
 			resourceType in objectStorageBody ? objectStorageBody[resourceType](args) : undefined
 
diff --git a/frontend/src/lib/components/Toggle.svelte b/frontend/src/lib/components/Toggle.svelte
index 16e1086a94..200b449ee7 100644
--- a/frontend/src/lib/components/Toggle.svelte
+++ b/frontend/src/lib/components/Toggle.svelte
@@ -93,6 +93,8 @@
 
 		<!-- svelte-ignore a11y_click_events_have_key_events -->
 		<!-- svelte-ignore a11y_no_static_element_interactions -->
+		<!-- Keeps the sr-only checkbox's absolute box on the toggle; it does not size the knob,
+		     which resolves against the track. -->
 		<div
 			class="relative"
 			onclick={stopPropagation(bubble('click'))}
@@ -116,21 +118,25 @@
 					dispatch('change', !!checked)
 				})}
 			/>
+			<!-- Knob offsets resolve against the track's padding box, so the track stays
+			     relative. Whole px and 2px of inset: at 1x a track on a fractional x blurs its
+			     edge over a whole pixel, which swallows a thinner gap.
+			     knob = h - 6, checked translate = w - h. -->
 			<div
 				class={classNames(
-					"transition-all bg-surface-sunken rounded-full peer peer-checked:after:translate-x-full peer-checked:after:border-white after:content-[''] after:absolute  after:bg-surface after:border-white after:border after:rounded-full after:transition-all items-center",
+					"relative transition-all bg-surface-sunken rounded-full peer peer-checked:after:border-white after:content-[''] after:absolute after:top-[2px] after:left-[2px] after:bg-surface after:border-white after:border after:rounded-full after:transition-all items-center",
 					color == 'red'
 						? 'peer-checked:bg-red-600'
 						: color == 'blue'
 							? 'peer-checked:bg-blue-400 '
 							: 'peer-checked:bg-nord-950 dark:peer-checked:bg-nord-900',
 					size === 'md'
-						? 'w-11 h-6 after:top-0.5 after:left-[2px] after:h-5 after:w-5'
+						? 'w-[44px] h-[24px] after:h-[18px] after:w-[18px] peer-checked:after:translate-x-[20px]'
 						: size === 'sm'
-							? 'w-9 h-5 after:top-0.5 after:left-[2px] after:h-4 after:w-4'
+							? 'w-[36px] h-[20px] after:h-[14px] after:w-[14px] peer-checked:after:translate-x-[16px]'
 							: size === '2xs'
-								? 'w-5 h-3 after:top-0.5 after:left-[2px] after:h-2 after:w-2'
-								: 'w-7 h-4 after:top-0.5 after:left-[2px] after:h-3 after:w-3',
+								? 'w-[20px] h-[12px] after:h-[6px] after:w-[6px] peer-checked:after:translate-x-[8px]'
+								: 'w-[28px] h-[16px] after:h-[10px] after:w-[10px] peer-checked:after:translate-x-[12px]',
 					inputBorderClass()
 				)}
 			></div>
diff --git a/frontend/src/lib/components/VariableEditor.svelte b/frontend/src/lib/components/VariableEditor.svelte
index 7c935be45c..fe6ccd1f27 100644
--- a/frontend/src/lib/components/VariableEditor.svelte
+++ b/frontend/src/lib/components/VariableEditor.svelte
@@ -1,7 +1,6 @@
 <script lang="ts">
 	import { VariableService, WorkspaceService } from '$lib/gen'
-	import { createEventDispatcher, untrack } from 'svelte'
-	import { workspaceStore } from '$lib/stores'
+	import { createEventDispatcher, onDestroy, untrack } from 'svelte'
 	import { Button } from './common'
 	import Drawer from './common/drawer/Drawer.svelte'
 	import DrawerContent from './common/drawer/DrawerContent.svelte'
@@ -23,8 +22,14 @@
 	import { useActingUser } from '$lib/actingUser.svelte'
 	import { UserDraft, draftValuesEqual, type UserDraftHandle } from '$lib/userDraft.svelte'
 	import LocalDraftBanner from './LocalDraftBanner.svelte'
+	import DraftConflictAlert from './DraftConflictAlert.svelte'
+	import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
+	import { useDraftConflictSession } from '$lib/draftConflictSession.svelte'
 	import { isEncryptedDraftValue } from '$lib/encryptedDraft'
 	import { setLocalDraftHint } from '$lib/localDraftHints.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	const dispatch = createEventDispatcher()
 
@@ -38,10 +43,25 @@
 	// The "current" workspace this editor defaults New/Edit actions to. Session
 	// editors pass their acting workspace so secrets are created/updated there
 	// rather than in the navigation workspace.
-	let { workspace = undefined }: { workspace?: string } = $props()
+	let {
+		workspace = undefined,
+		inline = false,
+		onClose = undefined,
+		onSaved = undefined
+	}: {
+		workspace?: string
+		/** Render in place, filling the parent, with no drawer or close button — for a host
+		 * that gives the editor a whole pane. */
+		inline?: boolean
+		/** With `inline`, closes whatever hosts the editor; the header has a close button only when set. */
+		onClose?: () => void
+		/** Fires once a save lands, with the path the variable now lives at in `workspace` —
+		 * not in the workspace-specific version selected, which can be another's. */
+		onSaved?: (path: string) => void
+	} = $props()
 	// Sole ambient read in this file: the acting workspace is an input, and only its
 	// default comes from the navigation store.
-	let curWs = $derived(workspace ?? $workspaceStore)
+	let curWs = $derived(workspace ?? $operatingWorkspace)
 
 	let editPath: string | undefined = $state(undefined)
 
@@ -123,6 +143,126 @@
 		Object.keys(states).filter((ws) => !draftValuesEqual(states[ws].draft, initialStates[ws]))
 	)
 
+	/** Scoped by `selected` so switching workspace-specific versions is a new session. Ended on top
+	 *  of that by every entry point and by the teardown, since reopening the same variable reuses
+	 *  this component. */
+	const conflictSession = useDraftConflictSession(() => selected)
+	function endEditingSession(): void {
+		conflictSession.end()
+	}
+	onDestroy(endEditingSession)
+	const resolvingConflict = $derived(conflictSession.busy)
+	/** The server refused this tab's autosave because the row moved under it: another tab, or the
+	 *  AI chat, which writes these drafts too. Nothing typed here reaches the server until the user
+	 *  picks a version, and the unsaved-changes banner says the opposite — that the edits are held
+	 *  as a draft — so without this they are told their work is safe while it is being dropped. */
+	const draftConflict = $derived(
+		edit && selected && editPath
+			? UserDraftDbSyncer.getConflict({
+					workspace: selected,
+					itemKind: 'variable',
+					path: editPath
+				}).conflict
+			: undefined
+	)
+
+	async function resolveDraftConflict(keepMine: boolean): Promise<void> {
+		const ws = selected
+		const p = editPath
+		if (!ws || !p || resolvingConflict) return
+		const query = { workspace: ws, itemKind: 'variable' as const, path: p }
+		const token = conflictSession.start()
+		const stillOurs = () => conflictSession.holds(token) && selected === ws
+		try {
+			if (keepMine) {
+				// Settle the key first: an ordinary autosave still queued would displace the forced
+				// write below, and being conditional it would be refused — so "Keep mine" would
+				// finish without keeping anything and leave the alert standing.
+				await UserDraftDbSyncer.quiesce(query)
+				// A resolution belongs to the session that started it. One that outlives its editor
+				// stops here rather than writing on: whatever replaced it — another session on the
+				// same draft, or its own resolution — owns the key now, and the edit this one was
+				// keeping is still parked for a later flush either way.
+				if (!stillOurs()) return
+				// A parked `null` is this tab's "no draft any more" — a discard, or an edit that
+				// landed back on the deployed value. Keeping that means removing the row, not
+				// writing the baseline back as a draft with no dirty banner to discard it through.
+				const parked = UserDraftDbSyncer.peekPending(query)
+				const mine = parked?.value === null ? null : $state.snapshot(states[ws]?.draft)
+				// Forced, so it goes over the row that refused us, and its response reseeds
+				// `last_sync` so the next ordinary save is conditional again.
+				if (mine !== undefined) await UserDraftDbSyncer.overwrite({ ...query, value: mine })
+				// Say so rather than leave the alert up with no explanation: a write displaced by
+				// something typed meanwhile can still lose the race.
+				if (UserDraftDbSyncer.getConflict(query).conflict) {
+					sendUserToast('Could not keep your version — try again', true)
+				}
+				return
+			}
+			// Settle the key BEFORE reading, so what comes back is the version the server is left
+			// holding: a write this tab started can still be in flight — a forced one it walked
+			// away from included — and a response fetched past it describes a version about to be
+			// replaced, which would then be seeded along with its already-stale `last_sync`.
+			// Nothing is given up by waiting; `quiesce` only stops the pipeline.
+			await UserDraftDbSyncer.quiesce(query)
+			if (!stillOurs()) return
+			// Read BEFORE giving anything up: until the server has answered, the refused payload is
+			// still the only copy of this tab's edit, and the conflict is still true.
+			const v = await VariableService.getVariable({
+				workspace: ws,
+				path: p,
+				decryptSecret: false,
+				getDraft: true
+			})
+			const deployedState: VariableState = {
+				path: v.path,
+				variable: {
+					value: v.value ?? '',
+					is_secret: v.is_secret,
+					description: v.description ?? ''
+				},
+				labels: v.labels ?? undefined,
+				wsSpecific: v.ws_specific ?? false
+			}
+			// Everything below writes shared editor state, so first make sure it is still this
+			// variable's: the drawer stays closable while the read is out, and another variable
+			// opened meanwhile would otherwise get this one's baseline — and with it this one's
+			// path as its save target.
+			if (!stillOurs()) return
+			// Again, because the form stayed editable while the read was out: `quiesce` settles what
+			// is running when it is called, not the key for the rest of the resolution, so a
+			// keystroke since can have started a save of its own. Left running, its rejection lands
+			// after the baseline below and raises the conflict this just resolved.
+			await UserDraftDbSyncer.quiesce(query)
+			if (!stillOurs()) return
+			// Now, and not in `quiesce`: the refused payload belongs to the version being replaced,
+			// but until this point it was still the only copy of the edit, and a resolution that
+			// gave up before here has to leave it behind.
+			UserDraftDbSyncer.dropPending(query)
+			UserDraftDbSyncer.clearConflict(query)
+			initialStates[ws] = structuredClone(deployedState)
+			// Everything else the load path takes from this same response. The variable can have
+			// been deleted, recreated, or had its permissions changed while the conflict stood,
+			// and these decide create-vs-update and write access — so refreshing only what is
+			// displayed would leave those deciding on the version the user just replaced.
+			existedInitially[ws] = !(v as any).no_deployed
+			extraPerms[ws] = v.extra_perms ?? {}
+			UserDraftDbSyncer.recordRemoteSync(query, (v as any).draft_saved_at)
+			UserDraft.seed(
+				'variable',
+				p,
+				((v as any).draft as VariableState | undefined) ?? deployedState,
+				{ workspace: ws }
+			)
+		} catch (e) {
+			// Nothing was given up above, so the conflict stands and the edit is still here to
+			// resolve again — which is the whole point of reading first.
+			sendUserToast(`Could not load the other version: ${e}`, true)
+		} finally {
+			conflictSession.finish(token)
+		}
+	}
+
 	// The list-page `*` hint is owned by UserDraftDbSyncer (set on save, cleared
 	// on delete). The editor only CLEARS it — a workspace at the deployed
 	// baseline has no draft, so drop any stale hint (this is how a draft
@@ -192,8 +332,21 @@
 					labels: v.labels ?? undefined,
 					wsSpecific: v.ws_specific ?? false
 				}
-				// Open with the saved draft if present, else the deployed.
-				const s: VariableState = savedDraftState ?? deployedState
+				// A refused save leaves this tab's own version parked. `.draft` is the version
+				// that refused it, so opening on that would quietly drop the edit the alert is
+				// about and leave "Keep mine" offering to keep the other one.
+				const conflictQuery = { workspace: ws, itemKind: 'variable' as const, path: p }
+				const refused = UserDraftDbSyncer.getConflict(conflictQuery).conflict
+					? UserDraftDbSyncer.peekPending(conflictQuery)
+					: undefined
+				// A parked `null` is this tab's "no draft any more", which on screen is the
+				// deployed value.
+				const refusedDraft = (refused?.value ?? undefined) as VariableState | undefined
+				// Open with this tab's refused version if there is one, else the saved draft,
+				// else the deployed.
+				const s: VariableState = refused
+					? (refusedDraft ?? deployedState)
+					: (savedDraftState ?? deployedState)
 				ensureHandle(ws, s)
 				initialStates[ws] = structuredClone(deployedState)
 				// Draft-only paths (`no_deployed`) have no row — saving must
@@ -205,6 +358,8 @@
 	})
 
 	function reset() {
+		// A new session starts here, so anything still running for the last one is spent.
+		endEditingSession()
 		// Clearing workspaceSpecs triggers useMany's reconcile to release
 		// every acquired entry. The $derived `states` then collapses to {}.
 		workspaceSpecs = []
@@ -256,6 +411,7 @@
 
 	async function save(): Promise<void> {
 		const dirty = dirtyWorkspaces
+		const savedPath = (curWs ? states[curWs]?.draft?.path : undefined) ?? editPath ?? ''
 		try {
 			for (const ws of dirty) {
 				const s = states[ws].draft!
@@ -303,6 +459,7 @@
 			}
 			sendUserToast(edit ? `Updated variable in ${dirty.length} workspace(s)` : `Created variable`)
 			dispatch('create')
+			onSaved?.(savedPath)
 			drawer?.closeDrawer()
 		} catch (err) {
 			sendUserToast(`Could not save variable: ${err.body}`, true)
@@ -310,13 +467,45 @@
 	}
 </script>
 
-<Drawer bind:this={drawer} size="50rem" on:close={() => clearPageDrawerAnchor(VARIABLES_PATH)}>
+{#if inline}
+	{@render content()}
+{:else}
+	<Drawer
+		bind:this={drawer}
+		size="50rem"
+		on:close={() => {
+			endEditingSession()
+			clearPageDrawerAnchor(VARIABLES_PATH)
+		}}
+	>
+		{@render content()}
+	</Drawer>
+{/if}
+
+{#snippet content()}
 	<DrawerContent
 		title={edit ? `Update variable at ${initialPath}` : 'Add a variable'}
 		bannerReserved={edit}
-		on:close={drawer?.closeDrawer}
+		hideClose={inline && !onClose}
+		fullScreen={!inline}
+		on:close={() => {
+			// Inline has no drawer to emit a close, so the session ends here instead.
+			if (inline) {
+				endEditingSession()
+				onClose?.()
+			} else {
+				drawer?.closeDrawer()
+			}
+		}}
 	>
 		{#snippet banner()}
+			{#if draftConflict}
+				<DraftConflictAlert
+					busy={resolvingConflict}
+					onReload={() => void resolveDraftConflict(false)}
+					onOverwrite={() => void resolveDraftConflict(true)}
+				/>
+			{/if}
 			<LocalDraftBanner
 				show={edit && selectedDirty}
 				reserveSpace={edit}
@@ -382,4 +571,4 @@
 			</Button>
 		{/snippet}
 	</DrawerContent>
-</Drawer>
+{/snippet}
diff --git a/frontend/src/lib/components/VariableForm.svelte b/frontend/src/lib/components/VariableForm.svelte
index 61945eef08..63fdbf7425 100644
--- a/frontend/src/lib/components/VariableForm.svelte
+++ b/frontend/src/lib/components/VariableForm.svelte
@@ -10,10 +10,13 @@
 	import ToggleButton from './common/toggleButton-v2/ToggleButton.svelte'
 	import { Loader2, RotateCcw } from 'lucide-svelte'
 	import autosize from '$lib/autosize'
-	import { workspaceStore, type UserExt } from '$lib/stores'
+	import { type UserExt } from '$lib/stores'
 	import { isOwner } from '$lib/utils'
 	import { isEncryptedDraftValue } from '$lib/encryptedDraft'
 	import EncryptedDraftField from './EncryptedDraftField.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Variable {
 		value: string
@@ -56,7 +59,7 @@
 		actingUser
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	// Loading the deployed secret overwrites the draft row this form shares with the AI
 	// chat, so every path that would trigger it has to be blocked while that row stages a
diff --git a/frontend/src/lib/components/WorkerTagPicker.svelte b/frontend/src/lib/components/WorkerTagPicker.svelte
index ccc3266ced..dae4967e05 100644
--- a/frontend/src/lib/components/WorkerTagPicker.svelte
+++ b/frontend/src/lib/components/WorkerTagPicker.svelte
@@ -2,6 +2,7 @@
 	import { Button } from '$lib/components/common'
 	import { ExternalLink, RotateCw, Loader2 } from 'lucide-svelte'
 	import { workerTags, workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 	import AssignableTags from './AssignableTags.svelte'
 	import { WorkerService } from '$lib/gen'
 	import WorkerTagSelect from './WorkerTagSelect.svelte'
@@ -11,8 +12,8 @@
 		popupPlacement?: 'bottom-end' | 'top-end'
 		disabled?: boolean
 		placeholder?: string
-		// Workspace to read tags from; defaults to $workspaceStore. A fork-scoped
-		// session passes its effective workspace so the picker matches the deploy target.
+		// Workspace to read tags from; defaults to the operating workspace (see
+		// `useOperatingWorkspace`).
 		workspaceId?: string
 	}
 
@@ -26,8 +27,11 @@
 
 	// See WorkerTagSelect: the shared `workerTags` cache is navigation-scoped, so a
 	// different target workspace reads/writes a local list to avoid clobbering it.
-	let effectiveWorkspace = $derived(workspaceId ?? $workspaceStore)
-	let usesLocal = $derived(workspaceId != undefined && workspaceId !== $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	let effectiveWorkspace = $derived(workspaceId ?? $operatingWorkspace)
+	let usesLocal = $derived(
+		effectiveWorkspace != undefined && effectiveWorkspace !== $workspaceStore
+	)
 	let localWorkerTags = $state<string[] | undefined>(undefined)
 	let currentTags = $derived(usesLocal ? localWorkerTags : $workerTags)
 
diff --git a/frontend/src/lib/components/WorkerTagSelect.svelte b/frontend/src/lib/components/WorkerTagSelect.svelte
index fe00f07f9d..503c8f7f66 100644
--- a/frontend/src/lib/components/WorkerTagSelect.svelte
+++ b/frontend/src/lib/components/WorkerTagSelect.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
 	import { workerTags, workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 	import { WorkerService } from '$lib/gen'
 
 	import { createEventDispatcher, onDestroy, onMount } from 'svelte'
@@ -31,10 +32,8 @@
 		/** Forwarded to the underlying Select — controls the input height. The
 		 * condensed session top bar passes `sm` to match its smaller buttons. */
 		size?: 'sm' | 'md' | 'lg'
-		// Workspace to read custom tags and worker availability from. Defaults to
-		// $workspaceStore. Session editors act on a workspace that differs from the
-		// navigation one, so they pass their effective workspace to keep the tag
-		// list and availability dots matching the deploy target.
+		// Workspace to read custom tags and worker availability from. Defaults to the
+		// operating workspace (see `useOperatingWorkspace`).
 		workspaceId?: string
 	} = $props()
 
@@ -46,8 +45,11 @@
 	// The shared `workerTags` store caches tags for the navigation workspace. When
 	// this select targets a different workspace, read/write a local list instead so
 	// it neither shows the navigation workspace's tags nor clobbers the shared cache.
-	let effectiveWorkspace = $derived(workspaceId ?? $workspaceStore)
-	let usesLocal = $derived(workspaceId != undefined && workspaceId !== $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	let effectiveWorkspace = $derived(workspaceId ?? $operatingWorkspace)
+	let usesLocal = $derived(
+		effectiveWorkspace != undefined && effectiveWorkspace !== $workspaceStore
+	)
 	let localWorkerTags = $state<string[] | undefined>(undefined)
 	let currentTags = $derived(usesLocal ? localWorkerTags : $workerTags)
 
@@ -90,6 +92,8 @@
 		}
 		loading = false
 	}
+	// A dynamic tag is filled in when the job runs, so no worker can be looked up for its text.
+	const dynamicTagRegex = /\$(workspace|args\[|flow_expr\[)/
 	let items = $derived([
 		// ...(tag ? ['reset to default'] : [nullTag ? `default: ${nullTag}` : '']),
 		...(tag && tag != '' && !(currentTags ?? []).includes(tag) ? [tag] : []),
@@ -97,23 +101,25 @@
 	])
 
 	let lastCheck: number | undefined = undefined
-	async function loadTagsToWorkerExists(tags: string[]) {
-		if (lastCheck && Date.now() - lastCheck < 5000) {
-			return
-		}
+	// Each run reads the list as it is then, so a tag typed in since the last run is looked up
+	// too, and a run too soon after the last one is deferred rather than dropped.
+	async function loadTagsToWorkerExists() {
 		if (timeout) {
 			clearTimeout(timeout)
 		}
+		const wait = lastCheck ? 5000 - (Date.now() - lastCheck) : 0
+		if (wait > 0) {
+			timeout = setTimeout(loadTagsToWorkerExists, wait)
+			return
+		}
 		if (open) {
 			tagsToWorkerExists = await WorkerService.existsWorkersWithTags({
-				tags: tags.join(','),
+				tags: items.filter((t) => !dynamicTagRegex.test(t)).join(','),
 				workspace: effectiveWorkspace
 			})
 			lastCheck = Date.now()
 			if (visible) {
-				timeout = setTimeout(() => {
-					loadTagsToWorkerExists(tags)
-				}, 5000)
+				timeout = setTimeout(loadTagsToWorkerExists, 5000)
 			}
 		}
 	}
@@ -134,7 +140,7 @@
 
 	$effect(() => {
 		if (currentTags && open) {
-			loadTagsToWorkerExists(currentTags)
+			loadTagsToWorkerExists()
 		}
 	})
 
@@ -142,7 +148,8 @@
 </script>
 
 {#snippet startSnippet({ item })}
-	{#if tagsToWorkerExists}
+	<!-- A tag nothing was looked up for, like a dynamic one, gets no dot rather than a red one. -->
+	{#if tagsToWorkerExists && !item.__is_create && item.value in tagsToWorkerExists}
 		{#if tagsToWorkerExists[item.value]}
 			<Popover>
 				{#snippet text()}
@@ -160,7 +167,7 @@
 		{/if}
 	{/if}
 {/snippet}
-<div class="flex gap-1 items-center relative">
+<div class="flex gap-1 items-center relative" title={tag || undefined}>
 	{#if !noLabel}
 		<div class="text-primary text-xs">{placeholder ?? 'tag'}</div>
 	{/if}
@@ -174,22 +181,30 @@
 		placeholder={nullTag ? nullTag : (placeholder ?? 'lang default')}
 		items={safeSelectItems(items)}
 		bind:value={() => tag, (value) => ((tag = value), dispatch('change', value))}
+		onCreateItem={(value) => ((tag = value), dispatch('change', value))}
+		createText="Press Enter to use this tag"
 		{startSnippet}
 		bottomSnippet={refreshAll}
 	/>
 </div>
 
 {#snippet refreshAll()}
-	<Button
-		iconOnly
-		variant="subtle"
-		unifiedSize="sm"
-		startIcon={{ icon: RotateCw, classes: loading ? 'animate-spin' : '' }}
-		on:click={async () => {
-			loadWorkerGroups(true)
-			open = true
-		}}
-		btnClasses="rounded-none"
-		title="Refresh worker groups"
-	></Button>
+	<div class="flex items-center justify-between gap-2 border-t border-border-light">
+		<span class="max-w-64 px-4 py-1 text-2xs text-secondary">
+			<code>$workspace</code>, <code>$args[…]</code> and <code>$flow_expr[…]</code> are filled in when
+			the job runs, and must land on an allowed tag
+		</span>
+		<Button
+			iconOnly
+			variant="subtle"
+			unifiedSize="sm"
+			startIcon={{ icon: RotateCw, classes: loading ? 'animate-spin' : '' }}
+			on:click={async () => {
+				loadWorkerGroups(true)
+				open = true
+			}}
+			btnClasses="rounded-none"
+			title="Refresh worker groups"
+		></Button>
+	</div>
 {/snippet}
diff --git a/frontend/src/lib/components/WorkflowTimeline.svelte b/frontend/src/lib/components/WorkflowTimeline.svelte
index 2ea5ebba50..868f215c20 100644
--- a/frontend/src/lib/components/WorkflowTimeline.svelte
+++ b/frontend/src/lib/components/WorkflowTimeline.svelte
@@ -9,11 +9,19 @@
 	import ObjectViewer from './propertyPicker/ObjectViewer.svelte'
 	import { CheckCircle2, XCircle } from 'lucide-svelte'
 	import { JobService, type Job, type WorkflowStatus } from '$lib/gen'
-	import { enterpriseLicense, userStore, workspaceStore } from '$lib/stores'
+	import { enterpriseLicense } from '$lib/stores'
 	import { Button } from '$lib/components/common'
 	import { Alert } from '$lib/components/common'
 	import SchemaForm from '$lib/components/SchemaForm.svelte'
 	import { sendUserToast } from '$lib/toast'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	interface Props {
 		flow_status: Record<string, WorkflowStatus>
@@ -97,7 +105,7 @@
 	}
 
 	async function fetchChildJob(id: string) {
-		const ws = $workspaceStore
+		const ws = $operatingWorkspace
 		if (!ws) return
 		loadingJobs[id] = true
 		try {
@@ -126,7 +134,7 @@
 	let approvalFormArgs: Record<string, Record<string, any>> = $state({})
 
 	async function handleApprove(key: string, formSchema: any) {
-		const ws = $workspaceStore
+		const ws = $operatingWorkspace
 		if (!ws || !jobId) return
 		approvalLoading[key] = true
 		try {
@@ -147,7 +155,7 @@
 
 	let cancelLoading = $state(false)
 	async function handleCancel() {
-		const ws = $workspaceStore
+		const ws = $operatingWorkspace
 		if (!ws || !jobId) return
 		cancelLoading = true
 		try {
@@ -260,7 +268,7 @@
 								<span class="text-tertiary">{msToSec(v.duration_ms ?? 0)}s</span>
 							{/if}
 						</div>
-						{#if canApprove && selfApprovalDisabled && $userStore?.is_admin}
+						{#if canApprove && selfApprovalDisabled && actingUser?.is_admin}
 							<div class="mt-1 ml-5 text-yellow-600 text-2xs">
 								Self-approval is disabled but allowed because you are an admin/owner
 							</div>
diff --git a/frontend/src/lib/components/WorkspaceItemDrillPicker.svelte b/frontend/src/lib/components/WorkspaceItemDrillPicker.svelte
index 39724265a9..ec285ce4dd 100644
--- a/frontend/src/lib/components/WorkspaceItemDrillPicker.svelte
+++ b/frontend/src/lib/components/WorkspaceItemDrillPicker.svelte
@@ -5,15 +5,15 @@ the workspace-specific public API (kinds, scope = `{ kind, dir? }`,
 currentItem, leaf/branch icons) so callers (BreadcrumbSegment, EditorHeader)
 don't need to know about the generic tree model underneath.
 
-Surfaces AI-created localStorage drafts (via `listGlobalDrafts`) as extra
-items alongside the backend-loaded list, so chat-scaffolded scripts/flows/
-apps that haven't been deployed yet are still navigable. Gated on
+Surfaces the session's drafts (via `listGlobalDrafts`: backend draft rows
+overlaid with live editor cells) as extra items alongside the backend-loaded
+list, so drafts the listing does not show yet (unsaved cells, a rename typed
+in a live editor) are still navigable. Gated on
 `isGlobalAiEnabled()` — without sessions, the only UserDrafts present are
 standalone editor autosaves and surfacing those in the breadcrumb picker
 would be surprising.
 -->
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
 	import { untrack } from 'svelte'
 	import {
@@ -31,6 +31,9 @@ would be surprising.
 	} from '$lib/components/copilot/chat/global/userDraftAdapter'
 	import { isGlobalAiEnabled } from '$lib/components/copilot/chat/global/gate'
 	import { resource } from 'runed'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	type Kind = WorkspaceItemKind
 	type ScopeKind = Kind | 'all'
@@ -51,9 +54,8 @@ would be surprising.
 		externalFilter?: string
 		autoFocus?: boolean
 		flush?: boolean
-		// Load items and drafts from this workspace instead of the navigation
-		// workspace. Set by session live editors, whose acting workspace can
-		// differ from $workspaceStore; falls back to $workspaceStore otherwise.
+		// Load items and drafts from this workspace; defaults to the operating workspace
+		// (see `useOperatingWorkspace`).
 		workspaceId?: string
 	}
 
@@ -69,7 +71,7 @@ would be surprising.
 		workspaceId
 	}: Props = $props()
 
-	const effectiveWorkspace = $derived(workspaceId ?? $workspaceStore)
+	const effectiveWorkspace = $derived(workspaceId ?? $operatingWorkspace)
 
 	let inner = $state<DrillPickerHandle | undefined>(undefined)
 
diff --git a/frontend/src/lib/components/agentScroll.ts b/frontend/src/lib/components/agentScroll.ts
new file mode 100644
index 0000000000..c82638e9f3
--- /dev/null
+++ b/frontend/src/lib/components/agentScroll.ts
@@ -0,0 +1,17 @@
+/**
+ * The pane an agent run is rendered in. Selected on `overflow-y` alone, never on
+ * whether the element currently overflows: a pane that fits its content is still
+ * the pane, and an overflow test walks past it into `#content`, which overflows
+ * merely because the document scrolls — scrolling that drops the whole page.
+ */
+export function runPane(node: HTMLElement | undefined | null): HTMLElement | undefined {
+	let current = node?.parentElement
+	while (current && current !== document.body && current.id !== 'content') {
+		const overflowY = getComputedStyle(current).overflowY
+		if (overflowY === 'auto' || overflowY === 'scroll') {
+			return current
+		}
+		current = current.parentElement
+	}
+	return undefined
+}
diff --git a/frontend/src/lib/components/agentTrace.test.ts b/frontend/src/lib/components/agentTrace.test.ts
new file mode 100644
index 0000000000..7d1dcf3429
--- /dev/null
+++ b/frontend/src/lib/components/agentTrace.test.ts
@@ -0,0 +1,183 @@
+import { describe, expect, it } from 'vitest'
+import { buildAgentTrace, splitFinalAnswer } from './agentTrace'
+import { parseAgentErrorMessages } from './aiAgentResult'
+import type { AgentMessage } from './aiAgentResult'
+
+// The worker splits one tool call across two messages: the assistant message
+// carries the arguments and no action tag, the `tool` message answering it
+// carries the result and the `tool_call` tag naming the job. Joining them on
+// `tool_call_id` is the whole contract, and reading it off the wrong message
+// yields a row with no parameters.
+const messages: AgentMessage[] = [
+	{ role: 'system', content: 'You are an SRE assistant.' },
+	{ role: 'user', content: 'Which region is broken?' },
+	{
+		role: 'assistant',
+		tool_calls: [
+			{
+				id: 'call_1',
+				type: 'function',
+				function: { name: 'query_metrics', arguments: '{"w":"30m"}' }
+			}
+		]
+	},
+	{
+		role: 'tool',
+		tool_call_id: 'call_1',
+		content: '{"eu-central-1":0.184}',
+		agent_action: {
+			type: 'tool_call',
+			job_id: '0199-job',
+			module_id: 'b',
+			function_name: 'query_metrics'
+		}
+	},
+	{ role: 'assistant', content: 'eu-central-1 is down.', agent_action: { type: 'message' } }
+]
+
+describe('buildAgentTrace', () => {
+	it('joins a tool call to the arguments on the message that requested it', () => {
+		expect(buildAgentTrace(messages)).toEqual([
+			{
+				kind: 'tool',
+				name: 'query_metrics',
+				args: '{"w":"30m"}',
+				result: '{"eu-central-1":0.184}',
+				jobId: '0199-job'
+			},
+			{ kind: 'assistant', content: 'eu-central-1 is down.' }
+		])
+	})
+
+	it('keeps an MCP call, whose arguments live on the action itself', () => {
+		const entries = buildAgentTrace([
+			{
+				role: 'tool',
+				content: 'sunny',
+				agent_action: {
+					type: 'mcp_tool_call',
+					call_id: 'c1',
+					function_name: 'get_weather',
+					resource_path: 'f/mcp/weather',
+					arguments: { city: 'Paris' }
+				}
+			}
+		])
+		expect(entries).toEqual([
+			{
+				kind: 'tool',
+				name: 'get_weather',
+				args: '{\n  "city": "Paris"\n}',
+				result: 'sunny',
+				resourcePath: 'f/mcp/weather'
+			}
+		])
+	})
+
+	// The worker splits a search the same way: a `tool` message tagged web_search
+	// carrying a constant sentence, then the assistant turn that carries the
+	// citations, which move onto the search so it shows what it found.
+	it('puts the citations of the turn that follows on the search', () => {
+		const entries = buildAgentTrace([
+			{
+				role: 'tool',
+				content: 'Used websearch tool successfully',
+				agent_action: { type: 'web_search' }
+			},
+			{
+				role: 'assistant',
+				content: 'Postgres 17 changed the default.',
+				annotations: [{ url: 'https://postgresql.org/docs', title: 'Release notes' }],
+				agent_action: { type: 'message' }
+			}
+		])
+		expect(entries).toEqual([
+			{
+				kind: 'search',
+				sources: [{ url: 'https://postgresql.org/docs', title: 'Release notes' }]
+			},
+			{ kind: 'assistant', content: 'Postgres 17 changed the default.' }
+		])
+	})
+
+	// The prompt and the question are the step's inputs, shown as inputs. A replayed
+	// turn comes back from memory without its tag, and crediting this run with an
+	// answer a previous one gave would be a lie about what happened.
+	it('traces only what this run did', () => {
+		expect(
+			buildAgentTrace([
+				{ role: 'system', content: 'You are an SRE assistant.' },
+				{ role: 'user', content: 'Which region is broken?' },
+				{ role: 'assistant', content: 'Answered in an earlier turn, replayed from memory.' },
+				{ role: 'assistant', tool_calls: [{ id: 'c1', function: { name: 'x', arguments: '{}' } }] },
+				{ role: 'assistant', content: '', agent_action: { type: 'message' } }
+			])
+		).toEqual([])
+	})
+})
+
+describe('splitFinalAnswer', () => {
+	it('moves the answering turn out of the trace, leaving its citations on the search', () => {
+		const entries = buildAgentTrace([
+			{ role: 'tool', content: 'Used websearch tool', agent_action: { type: 'web_search' } },
+			{
+				role: 'assistant',
+				content: 'Postgres 17 changed the default.',
+				annotations: [{ url: 'https://postgresql.org/docs', title: 'Release notes' }],
+				agent_action: { type: 'message' }
+			}
+		])
+		expect(splitFinalAnswer(entries, 'Postgres 17 changed the default.')).toEqual([
+			{
+				kind: 'search',
+				sources: [{ url: 'https://postgresql.org/docs', title: 'Release notes' }]
+			}
+		])
+	})
+
+	// A run whose last turn returned a tool call and no text leaves its answer
+	// mid-trace. Looking only at the final entry finds nothing to move and prints
+	// that answer as a row and again under the output.
+	it('finds the answering turn even when it is not the last one', () => {
+		const entries = buildAgentTrace([
+			{ role: 'assistant', content: 'Let me check.', agent_action: { type: 'message' } },
+			{
+				role: 'tool',
+				tool_call_id: 'call_1',
+				content: '{}',
+				agent_action: {
+					type: 'tool_call',
+					job_id: '0199-job',
+					module_id: 'b',
+					function_name: 'query_metrics'
+				}
+			}
+		])
+		expect(splitFinalAnswer(entries, 'Let me check.')).toEqual([entries[1]])
+	})
+
+	it('leaves the trace whole when the output is not a turn of its own', () => {
+		const entries = buildAgentTrace(messages)
+		expect(splitFinalAnswer(entries, { rows: 3 })).toEqual(entries)
+	})
+})
+
+// A run stopped by max_iterations serializes its partial messages itself rather
+// than reusing the success envelope's writer. `agent_action` is `skip_serializing`
+// on `OpenAIMessage`, so if that path ever stops wrapping them the tags vanish and
+// this trace silently empties — which is the one run worth reading.
+describe('the max-iterations path', () => {
+	it('traces the partial messages the error carries', () => {
+		const partial = parseAgentErrorMessages({
+			error: {
+				name: 'ExecutionErr',
+				message: 'AI agent reached max iterations (10)',
+				step_id: 'd',
+				result: { messages }
+			}
+		})
+		// The trace itself is `buildAgentTrace`'s, pinned above; what this path can
+		// lose is the tags it reads, and an untagged conversation traces to nothing.
+		expect(buildAgentTrace(partial ?? [])).toHaveLength(2)
+	})
+})
diff --git a/frontend/src/lib/components/agentTrace.ts b/frontend/src/lib/components/agentTrace.ts
new file mode 100644
index 0000000000..392e8b00c9
--- /dev/null
+++ b/frontend/src/lib/components/agentTrace.ts
@@ -0,0 +1,134 @@
+import type { WebSearchSource } from './copilot/chat/shared'
+import type { AgentMessage } from './aiAgentResult'
+
+/**
+ * One entry in the trace of an agent run, built from the envelope alone so it
+ * renders without waiting on any request; a tool's child job is enrichment. The
+ * prompt and the question are deliberately absent: they are the step's inputs and
+ * are shown as inputs, while the trace is what the agent did with them.
+ */
+export type AgentTraceEntry =
+	| { kind: 'assistant'; content: string }
+	/** The worker records only that a search happened. Its citations ride on the assistant
+	 *  turn that follows, and are moved here so the search shows what it found. */
+	| { kind: 'search'; sources?: WebSearchSource[] }
+	| {
+			kind: 'tool'
+			name: string
+			args?: string
+			result: string
+			/** Present for a flow-module tool, which runs as its own job. */
+			jobId?: string
+			/** An MCP tool runs in the worker, so it names its server instead. */
+			resourcePath?: string
+	  }
+
+/** `content` is a string for text messages and a part list once images are involved. */
+function contentText(content: unknown): string {
+	if (typeof content === 'string') {
+		return content
+	}
+	if (Array.isArray(content)) {
+		return content
+			.map((part) =>
+				part && typeof part === 'object' && typeof (part as { text?: unknown }).text === 'string'
+					? (part as { text: string }).text
+					: ''
+			)
+			.join('')
+	}
+	return ''
+}
+
+function sourcesOf(message: AgentMessage): WebSearchSource[] | undefined {
+	const annotations = message.annotations
+	if (!annotations?.length) {
+		return undefined
+	}
+	return annotations.map((a) => ({ url: a.url, title: a.title }))
+}
+
+export function buildAgentTrace(messages: AgentMessage[]): AgentTraceEntry[] {
+	// The arguments live on the assistant message that requested the call, while
+	// the action tag and the result live on the `tool` message answering it, so
+	// the two are joined by `tool_call_id`.
+	const argsByCallId = new Map<string, string>()
+	for (const message of messages) {
+		for (const call of message.tool_calls ?? []) {
+			if (call.id && typeof call.function?.arguments === 'string') {
+				argsByCallId.set(call.id, call.function.arguments)
+			}
+		}
+	}
+
+	const entries: AgentTraceEntry[] = []
+	for (const message of messages) {
+		const action = message.agent_action
+		if (action?.type === 'tool_call') {
+			entries.push({
+				kind: 'tool',
+				name: action.function_name,
+				args: message.tool_call_id ? argsByCallId.get(message.tool_call_id) : undefined,
+				result: contentText(message.content),
+				jobId: action.job_id
+			})
+			continue
+		}
+		if (action?.type === 'mcp_tool_call') {
+			entries.push({
+				kind: 'tool',
+				name: action.function_name,
+				// An MCP call records its arguments on the action itself: it never
+				// became a job, so there is nowhere else for them to live.
+				args: action.arguments ? JSON.stringify(action.arguments, null, 2) : undefined,
+				result: contentText(message.content),
+				resourcePath: action.resource_path
+			})
+			continue
+		}
+		if (action?.type === 'web_search') {
+			entries.push({ kind: 'search' })
+			continue
+		}
+		// Every message this run produced is tagged, including the agent narrating
+		// its next move and its final answer. Untagged ones are the prompt, the
+		// question, or a previous turn replayed out of memory — history loses its
+		// tags on the way back, and attributing it to this run would credit it with
+		// answers it never gave.
+		if (action?.type !== 'message') {
+			continue
+		}
+		const content = contentText(message.content)
+		// The worker writes a provider call's search right before that call's answer, and
+		// only a call that searched carries annotations.
+		const previous = entries[entries.length - 1]
+		if (message.role === 'assistant' && previous?.kind === 'search' && !previous.sources) {
+			previous.sources = sourcesOf(message)
+		}
+		if (message.role === 'assistant' && content !== '') {
+			entries.push({ kind: 'assistant', content })
+		}
+	}
+	return entries
+}
+
+/**
+ * Separates the turn that produced the output from the rest of the trace, so the
+ * answer is rendered once. Found by content and searched from the end: a run whose
+ * last turn returned a tool call leaves its answer mid-trace, where inspecting only
+ * the final entry prints it twice.
+ */
+export function splitFinalAnswer(entries: AgentTraceEntry[], output: unknown): AgentTraceEntry[] {
+	if (typeof output !== 'string') {
+		// A schema-shaped output is rendered by the result viewer itself and matches
+		// no turn, so the whole trace stands.
+		return entries
+	}
+	for (let i = entries.length - 1; i >= 0; i--) {
+		const entry = entries[i]
+		if (entry.kind === 'assistant' && entry.content === output) {
+			return [...entries.slice(0, i), ...entries.slice(i + 1)]
+		}
+	}
+	return entries
+}
diff --git a/frontend/src/lib/components/aiAgentResult.test.ts b/frontend/src/lib/components/aiAgentResult.test.ts
new file mode 100644
index 0000000000..6757104055
--- /dev/null
+++ b/frontend/src/lib/components/aiAgentResult.test.ts
@@ -0,0 +1,257 @@
+import { describe, expect, it } from 'vitest'
+import { buildAgentTrace } from './agentTrace'
+import {
+	advanceAgentStream,
+	emptyAgentStreamProgress,
+	formatTokenCount,
+	isAgentStream,
+	parseAgentResult,
+	summarizeAgentResult
+} from './aiAgentResult'
+
+const envelope = {
+	output: 'the answer',
+	messages: [
+		{ role: 'user', content: 'ask' },
+		{ role: 'assistant', content: 'the answer', agent_action: { type: 'message' } }
+	],
+	usage: { input_tokens: 10, output_tokens: 2, total_tokens: 12 }
+}
+
+describe('parseAgentResult', () => {
+	it('accepts the envelope with and without its optional keys', () => {
+		expect(parseAgentResult(envelope)?.output).toBe('the answer')
+		expect(parseAgentResult({ output: 1, messages: [{ role: 'user' }] })?.messages).toHaveLength(1)
+		// A key the worker serializes and the signature does not know costs every run
+		// carrying it the pretty display, so each one is pinned here.
+		expect(parseAgentResult({ ...envelope, reasoning: 'let me think' })?.reasoning).toBe(
+			'let me think'
+		)
+	})
+
+	// The signature is the only thing separating an agent result from any other
+	// object, so each of these near-misses has to stay a miss.
+	it.each([
+		['a key outside the envelope', { ...envelope, retries: 2 }],
+		['no output', { messages: envelope.messages }],
+		['messages that are not a list', { output: 'a', messages: { role: 'user' } }],
+		['no messages at all', { output: 'a', messages: [] }],
+		['a message without a role', { output: 'a', messages: [{ content: 'ask' }] }],
+		['null', null]
+	])('rejects %s', (_label, value) => {
+		expect(parseAgentResult(value)).toBeUndefined()
+	})
+})
+
+describe('summarizeAgentResult', () => {
+	it('counts the actions and falls back to the parts when no total is reported', () => {
+		const summary = summarizeAgentResult({
+			output: '',
+			messages: [
+				{ role: 'user' },
+				{ role: 'assistant', agent_action: { type: 'tool_call' } as any },
+				{ role: 'assistant', agent_action: { type: 'mcp_tool_call' } as any },
+				{ role: 'assistant', agent_action: { type: 'web_search' } },
+				{ role: 'assistant', agent_action: { type: 'message' } }
+			],
+			usage: { input_tokens: 8421, output_tokens: 512, cache_read_input_tokens: 6144 }
+		})
+		expect(summary).toEqual({
+			toolCalls: 2,
+			webSearches: 1,
+			tokens: 8933,
+			cachedTokens: 6144
+		})
+	})
+})
+
+describe('agent stream', () => {
+	const lines = [
+		'{"type":"tool_call","call_id":"c1","function_name":"query_metrics"}',
+		'{"type":"tool_result","call_id":"c1","function_name":"query_metrics","result":"{}","success":true}',
+		'{"type":"reasoning_token_delta","content":"checking"}',
+		'{"type":"token_delta","content":"eu-central-1"}',
+		'{"type":"token_delta","content":" is down"}'
+	]
+	const events = lines.join('\n') + '\n'
+
+	it('recognises an agent stream from its first line only', () => {
+		expect(isAgentStream(events)).toBe(true)
+		expect(isAgentStream('processing row 1\nprocessing row 2\n')).toBe(false)
+		expect(isAgentStream('{"level":"info","msg":"hello"}\n')).toBe(false)
+		// No newline yet, so the first line may still be half-written.
+		expect(isAgentStream('{"type":"token_delta","content":"a"}')).toBe(false)
+		// A provider that does not filter its empty deltas opens with one, and the
+		// run is an agent's all the same.
+		expect(isAgentStream('{"type":"token_delta","content":""}\n')).toBe(true)
+		// What the fold cannot use must not claim the pane either, or the script's
+		// own output is replaced by a view with nothing to draw.
+		expect(isAgentStream('{"type":"tool_call","function_name":"q"}\n')).toBe(false)
+	})
+
+	// The stream only grows, so each poll must fold in the new lines and re-read
+	// none of the old ones — the reason this is incremental at all.
+	it('resumes where the previous poll stopped', () => {
+		const firstPoll = advanceAgentStream(
+			lines.slice(0, 3).join('\n') + '\n',
+			emptyAgentStreamProgress()
+		)
+		const secondPoll = advanceAgentStream(events, firstPoll)
+		expect(secondPoll.consumed).toBe(events.length)
+		expect(secondPoll.stream.current).toBe('eu-central-1 is down')
+		expect(secondPoll.stream.reasoning).toBe('checking')
+	})
+
+	it('leaves a half-written trailing line for the next poll', () => {
+		const partial = advanceAgentStream(`${events}{"type":"token_de`, emptyAgentStreamProgress())
+		expect(partial.stream.current).toBe('eu-central-1 is down')
+		const completed = advanceAgentStream(`${events}{"type":"token_delta","content":"!"}\n`, partial)
+		expect(completed.stream.current).toBe('eu-central-1 is down!')
+	})
+
+	it('marks a tool still running, and a failed one', () => {
+		const started = '{"type":"tool_execution","call_id":"c1","function_name":"fetch"}\n'
+		const running = advanceAgentStream(started, emptyAgentStreamProgress())
+		expect(running.stream.entries).toEqual([
+			{ kind: 'tool', callId: 'c1', name: 'fetch', running: true, success: undefined }
+		])
+		const failed = advanceAgentStream(
+			started +
+				'{"type":"tool_result","call_id":"c1","function_name":"fetch","result":"boom","success":false}\n',
+			running
+		)
+		// One row for the call, not one per event about it.
+		expect(failed.stream.entries).toEqual([
+			{ kind: 'tool', callId: 'c1', name: 'fetch', running: false, success: false }
+		])
+	})
+})
+
+describe('formatTokenCount', () => {
+	it('keeps small counts exact and rounds the rest', () => {
+		expect(formatTokenCount(940)).toBe('940')
+		expect(formatTokenCount(8933)).toBe('8.9k')
+		expect(formatTokenCount(48211)).toBe('48k')
+	})
+})
+
+// The worker streams every iteration's text, and a turn may narrate and call a
+// tool at once. Appending across that boundary makes the live answer read
+// "I'll checkThe issue is..." and never converge on the finished output.
+describe('a stream that narrates before calling a tool', () => {
+	it('turns the narration into a row and starts the answer fresh', () => {
+		const raw = [
+			'{"type":"token_delta","content":"Let me check the metrics."}',
+			'{"type":"tool_call","call_id":"c1","function_name":"query_metrics"}',
+			'{"type":"tool_result","call_id":"c1","function_name":"query_metrics","result":"{}","success":true}',
+			'{"type":"token_delta","content":"eu-central-1 is down."}',
+			''
+		].join('\n')
+		const { stream } = advanceAgentStream(raw, emptyAgentStreamProgress())
+		expect(stream.current).toBe('eu-central-1 is down.')
+		// The narration became a row rather than disappearing.
+		expect(stream.entries[0]).toEqual({ kind: 'assistant', content: 'Let me check the metrics.' })
+	})
+
+	it('closes the turn at the boundary even when polls split it', () => {
+		const first = '{"type":"token_delta","content":"Let me check."}\n'
+		const afterCall = first + '{"type":"tool_call","call_id":"c1","function_name":"q"}\n'
+		const poll1 = advanceAgentStream(first, emptyAgentStreamProgress())
+		expect(poll1.stream.current).toBe('Let me check.')
+		const poll2 = advanceAgentStream(afterCall, poll1)
+		expect(poll2.stream.current).toBe('')
+		expect(poll2.stream.entries[0]).toEqual({ kind: 'assistant', content: 'Let me check.' })
+		const poll3 = advanceAgentStream(
+			afterCall + '{"type":"token_delta","content":"Done."}\n',
+			poll2
+		)
+		expect(poll3.stream.current).toBe('Done.')
+	})
+
+	// Extended thinking emits reasoning with no narration before the tool call, so
+	// the turn boundary is the only thing that can end it.
+	it('ends a turn that thought without narrating', () => {
+		const raw = [
+			'{"type":"reasoning_token_delta","content":"The user wants the metrics."}',
+			'{"type":"tool_call","call_id":"c1","function_name":"q"}',
+			'{"type":"tool_result","call_id":"c1","function_name":"q","result":"{}","success":true}',
+			'{"type":"reasoning_token_delta","content":"eu-central-1 looks down."}',
+			''
+		].join('\n')
+		const { stream } = advanceAgentStream(raw, emptyAgentStreamProgress())
+		expect(stream.reasoning).toBe('eu-central-1 looks down.')
+	})
+
+	// Bedrock has its own streaming implementation rather than the shared SSE
+	// parsers, and never announces `tool_call` — only the arguments, then the
+	// worker's `tool_execution`. Keying the reset on `tool_call` alone leaves the
+	// narration in place for that provider.
+	it('resets on a provider that never announces the call itself', () => {
+		const raw = [
+			'{"type":"token_delta","content":"Let me check the metrics."}',
+			'{"type":"tool_call_arguments","call_id":"c1","function_name":"q","arguments":"{}"}',
+			'{"type":"tool_execution","call_id":"c1","function_name":"q"}',
+			'{"type":"tool_result","call_id":"c1","function_name":"q","result":"{}","success":true}',
+			'{"type":"token_delta","content":"eu-central-1 is down."}',
+			''
+		].join('\n')
+		const { stream } = advanceAgentStream(raw, emptyAgentStreamProgress())
+		expect(stream.current).toBe('eu-central-1 is down.')
+		// The narration became a row rather than disappearing.
+		expect(stream.entries[0]).toEqual({ kind: 'assistant', content: 'Let me check the metrics.' })
+	})
+
+	// A script can write anything to `result_stream`, so an event is not guaranteed
+	// the fields its type declares.
+	it('ignores an event with nothing to key a row by, or no text to add', () => {
+		const raw =
+			'{"type":"token_delta","content":"Hi."}\n{"type":"token_delta"}\n{"type":"tool_call"}\n'
+		const { stream } = advanceAgentStream(raw, emptyAgentStreamProgress())
+		expect(stream.entries).toEqual([])
+		expect(stream.current).toBe('Hi.')
+	})
+})
+
+// A result is whatever a script returned, so a message that has a `role` still has
+// arbitrary anything underneath. Coercing once here is what lets every reader
+// treat `AgentMessage` as true; a bad value reaching them throws mid-render and
+// takes the result viewer down, including the plain error it usually rides on.
+describe('coercing messages at the boundary', () => {
+	function messagesOf(raw: unknown) {
+		return parseAgentResult({ output: '', messages: raw })?.messages
+	}
+
+	it.each([
+		['tool_calls that are not a list', { role: 'assistant', tool_calls: {} }],
+		['a null entry inside tool_calls', { role: 'assistant', tool_calls: [null] }],
+		[
+			'a tool call whose function is a string',
+			{ role: 'assistant', tool_calls: [{ id: 'c1', function: 'q' }] }
+		],
+		[
+			'non-string arguments',
+			{ role: 'assistant', tool_calls: [{ id: 'c1', function: { arguments: 3 } }] }
+		],
+		['annotations that are not a list', { role: 'assistant', annotations: 'abc' }],
+		['a null entry inside annotations', { role: 'assistant', annotations: [null] }],
+		['an annotation with no url', { role: 'assistant', annotations: [{ title: 'x' }] }],
+		['an agent_action that is not an object', { role: 'tool', agent_action: 'tool_call' }],
+		['an agent_action with no type', { role: 'tool', agent_action: {} }]
+	])('survives %s', (_label, message) => {
+		const parsed = messagesOf([message])
+		expect(parsed).toHaveLength(1)
+		expect(() => buildAgentTrace(parsed!)).not.toThrow()
+	})
+
+	it('keeps a well-formed call intact', () => {
+		const parsed = messagesOf([
+			{
+				role: 'assistant',
+				tool_calls: [{ id: 'c1', type: 'function', function: { name: 'q', arguments: '{}' } }]
+			}
+		])
+		expect(parsed?.[0].tool_calls).toEqual([
+			{ id: 'c1', type: 'function', function: { name: 'q', arguments: '{}' } }
+		])
+	})
+})
diff --git a/frontend/src/lib/components/aiAgentResult.ts b/frontend/src/lib/components/aiAgentResult.ts
new file mode 100644
index 0000000000..563d9b7292
--- /dev/null
+++ b/frontend/src/lib/components/aiAgentResult.ts
@@ -0,0 +1,341 @@
+import type { FlowStatusModule } from '$lib/gen'
+import { parseStreamEvents, type AgentStreamEvent } from 'windmill-chat'
+
+/** The `agent_action` tag the worker puts on every message it records. */
+export type AgentAction = NonNullable<FlowStatusModule['agent_actions']>[number]
+
+export type AgentTokenUsage = {
+	input_tokens?: number
+	output_tokens?: number
+	total_tokens?: number
+	cache_read_input_tokens?: number
+	cache_write_input_tokens?: number
+}
+
+export type AgentMessage = {
+	role: string
+	content?: unknown
+	tool_calls?: Array<{
+		id?: string
+		type?: string
+		function?: { name?: string; arguments?: string }
+	}>
+	tool_call_id?: string
+	agent_action?: AgentAction
+	annotations?: Array<{ url: string; title?: string; start_index?: number; end_index?: number }>
+}
+
+/** The envelope every AI agent step returns, built by `AIAgentResult`. */
+export type AgentResult = {
+	output: unknown
+	messages: AgentMessage[]
+	usage?: AgentTokenUsage
+	wm_stream?: string
+	/** The model's thinking across every iteration, blank-line separated. */
+	reasoning?: string
+}
+
+/**
+ * Every key `AIAgentResult` can serialize; the optional ones are skipped when
+ * empty. The signature below is closed, so a key the worker gains and this list
+ * does not makes every run carrying it fall back to the raw JSON.
+ */
+const ENVELOPE_KEYS = ['output', 'messages', 'usage', 'wm_stream', 'reasoning']
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function hasRole(message: unknown): boolean {
+	return isRecord(message) && typeof message.role === 'string'
+}
+
+/**
+ * A job result is whatever its script returned, so a message that passed the shape
+ * check still has anything underneath. Coerced once here rather than guarded at
+ * each reader: a wrong type reaching one throws mid-render and takes the whole
+ * result viewer down, including the plain error it usually rides on.
+ */
+function toAgentMessage(raw: Record<string, unknown>): AgentMessage {
+	const toolCalls = Array.isArray(raw.tool_calls)
+		? raw.tool_calls.filter(isRecord).map((call) => ({
+				id: typeof call.id === 'string' ? call.id : undefined,
+				type: typeof call.type === 'string' ? call.type : undefined,
+				function: isRecord(call.function)
+					? {
+							name: typeof call.function.name === 'string' ? call.function.name : undefined,
+							arguments:
+								typeof call.function.arguments === 'string' ? call.function.arguments : undefined
+						}
+					: undefined
+			}))
+		: undefined
+	const annotations = Array.isArray(raw.annotations)
+		? raw.annotations.filter(
+				(a): a is Record<string, unknown> => isRecord(a) && typeof a.url === 'string'
+			)
+		: undefined
+	return {
+		role: raw.role as string,
+		content: raw.content,
+		tool_calls: toolCalls,
+		tool_call_id: typeof raw.tool_call_id === 'string' ? raw.tool_call_id : undefined,
+		// The union is discriminated on `type`; an action without a string one
+		// matches no branch and is treated as untagged.
+		agent_action:
+			isRecord(raw.agent_action) && typeof raw.agent_action.type === 'string'
+				? (raw.agent_action as unknown as AgentAction)
+				: undefined,
+		annotations: annotations as AgentMessage['annotations']
+	}
+}
+
+function toAgentMessages(raw: unknown[]): AgentMessage[] {
+	return raw.map((message) => toAgentMessage(message as Record<string, unknown>))
+}
+
+/**
+ * Recognised by shape, not a marker key: sniffing works on completed runs, and an
+ * added key would travel into a parent agent's conversation. Deliberately not also
+ * requiring a tagged `agent_action` — a run answering through a structured-output
+ * tool tags nothing, and hiding a real answer costs more than claiming a lookalike.
+ */
+export function parseAgentResult(result: unknown): AgentResult | undefined {
+	if (!isRecord(result)) {
+		return undefined
+	}
+	const keys = Object.keys(result)
+	if (!keys.every((key) => ENVELOPE_KEYS.includes(key))) {
+		return undefined
+	}
+	if (!('output' in result) || !Array.isArray(result.messages)) {
+		return undefined
+	}
+	// An agent always records at least the message it was asked, so an empty list
+	// is someone else's result rather than a run that did nothing.
+	if (result.messages.length === 0 || !result.messages.every(hasRole)) {
+		return undefined
+	}
+	return {
+		output: result.output,
+		messages: toAgentMessages(result.messages),
+		usage: isRecord(result.usage) ? (result.usage as AgentTokenUsage) : undefined,
+		wm_stream: typeof result.wm_stream === 'string' ? result.wm_stream : undefined,
+		reasoning: typeof result.reasoning === 'string' ? result.reasoning : undefined
+	}
+}
+
+/**
+ * A run stopped by `max_iterations` fails, so it returns an error rather than an
+ * envelope — but the worker attaches the conversation so far to it. That partial
+ * transcript is the whole reason to look at a run that hit the cap.
+ */
+export function parseAgentErrorMessages(result: unknown): AgentMessage[] | undefined {
+	if (!isRecord(result) || !isRecord(result.error)) {
+		return undefined
+	}
+	const inner = result.error.result
+	if (!isRecord(inner) || !Array.isArray(inner.messages)) {
+		return undefined
+	}
+	if (inner.messages.length === 0 || !inner.messages.every(hasRole)) {
+		return undefined
+	}
+	return toAgentMessages(inner.messages)
+}
+
+export type AgentResultSummary = {
+	toolCalls: number
+	webSearches: number
+	tokens: number | undefined
+	cachedTokens: number | undefined
+}
+
+function actionType(message: AgentMessage): string | undefined {
+	return message.agent_action?.type
+}
+
+export function summarizeAgentResult(result: AgentResult): AgentResultSummary {
+	let toolCalls = 0
+	let webSearches = 0
+	for (const message of result.messages) {
+		const type = actionType(message)
+		if (type === 'tool_call' || type === 'mcp_tool_call') {
+			toolCalls++
+		} else if (type === 'web_search') {
+			webSearches++
+		}
+	}
+	const usage = result.usage
+	// `total_tokens` is what providers report when they report anything; fall back
+	// to the parts so a provider that only sends the split still shows a count.
+	const tokens =
+		usage?.total_tokens ??
+		(usage?.input_tokens !== undefined || usage?.output_tokens !== undefined
+			? (usage?.input_tokens ?? 0) + (usage?.output_tokens ?? 0)
+			: undefined)
+	return {
+		toolCalls,
+		webSearches,
+		tokens,
+		cachedTokens: usage?.cache_read_input_tokens
+	}
+}
+
+export type AgentStreamEntry =
+	| { kind: 'assistant'; content: string }
+	| { kind: 'tool'; callId: string; name: string; running: boolean; success?: boolean }
+
+export type AgentStream = {
+	/**
+	 * What the run has finished doing, in order — the same rows the completed
+	 * trace will show, so nothing on screen moves when the result lands.
+	 */
+	entries: AgentStreamEntry[]
+	/**
+	 * The text of the turn being written. It is not yet the output: a turn that
+	 * goes on to call a tool was narration, and only the run ending decides which
+	 * this was. So it stays unlabelled here and becomes one or the other.
+	 */
+	current: string
+	reasoning: string
+}
+
+/** How much of the stream has been folded in, so the next poll starts there. */
+export type AgentStreamProgress = { consumed: number; stream: AgentStream }
+
+export function emptyAgentStreamProgress(): AgentStreamProgress {
+	return { consumed: 0, stream: { entries: [], current: '', reasoning: '' } }
+}
+
+/**
+ * Any of these means a tool call is beginning, and which one arrives depends on
+ * the provider: the SSE parsers announce `tool_call`, while Bedrock streams only
+ * the arguments and the worker follows with `tool_execution`. Resetting on all
+ * three is idempotent and keeps the rule provider-independent.
+ */
+const TOOL_TURN_STARTED: AgentStreamEvent['type'][] = [
+	'tool_call',
+	'tool_call_arguments',
+	'tool_execution'
+]
+
+/**
+ * Whether an event carries what its type declares: a delta its text, a tool event
+ * the `call_id` its row is keyed on and the name that labels it. `result_stream` is
+ * whatever the job wrote, so detection and the fold ask the same question — were
+ * they to differ, a stream would be claimed and then render nothing.
+ */
+function isWellFormedEvent(event: AgentStreamEvent): boolean {
+	if (event.type === 'token_delta' || event.type === 'reasoning_token_delta') {
+		return typeof event.content === 'string'
+	}
+	return (
+		typeof event.call_id === 'string' &&
+		event.call_id !== '' &&
+		typeof event.function_name === 'string' &&
+		event.function_name !== ''
+	)
+}
+
+/**
+ * Whether `result_stream` is an agent's event stream rather than something a
+ * script printed. Reads only the first complete line, because it runs on every
+ * poll of a running job.
+ */
+export function isAgentStream(raw: string): boolean {
+	let start = 0
+	while (start < raw.length) {
+		const end = raw.indexOf('\n', start)
+		if (end === -1) {
+			// Only a partial first line so far; wait for the poll that completes it.
+			return false
+		}
+		const line = raw.slice(start, end)
+		if (line.trim() !== '') {
+			return parseStreamEvents(line).some(isWellFormedEvent)
+		}
+		start = end + 1
+	}
+	return false
+}
+
+/**
+ * Fold the events that arrived since `previous` into the answer so far. Incremental
+ * rather than a parse of the whole buffer: the stream only grows, a poll can arrive
+ * every 50ms, and a `tool_result` carries the tool's entire output, so re-reading it
+ * all each tick is quadratic with a large constant.
+ */
+export function advanceAgentStream(
+	raw: string,
+	previous: AgentStreamProgress
+): AgentStreamProgress {
+	// A trailing line with no newline yet is still being written, so it stays
+	// unconsumed until the poll that completes it.
+	const complete = raw.lastIndexOf('\n') + 1
+	if (complete <= previous.consumed) {
+		return previous
+	}
+	const stream: AgentStream = { ...previous.stream, entries: [...previous.stream.entries] }
+	for (const event of parseStreamEvents(raw.slice(previous.consumed, complete))) {
+		if (!isWellFormedEvent(event)) {
+			continue
+		}
+		if (event.type === 'token_delta') {
+			stream.current += event.content
+			continue
+		}
+		if (event.type === 'reasoning_token_delta') {
+			stream.reasoning += event.content
+			continue
+		}
+		if (TOOL_TURN_STARTED.includes(event.type)) {
+			if (stream.current !== '') {
+				// A model can narrate and request a tool in the same turn. The call
+				// settles what that text was: narration, not the output. It becomes a
+				// row rather than being dropped, so nothing vanishes from the screen
+				// only to reappear when the result lands.
+				stream.entries.push({ kind: 'assistant', content: stream.current })
+				stream.current = ''
+			}
+			// Thinking belongs to the turn that produced it, and a turn can think
+			// without narrating — extended thinking before a tool call is exactly
+			// that shape. So this clears on the boundary itself, not with the
+			// narration, or one turn's thoughts run into the next turn's.
+			stream.reasoning = ''
+		}
+		// The same call is announced, then argued, then executed, then answered.
+		// Keyed on `call_id` so those four events are one row rather than four.
+		const existing = stream.entries.find(
+			(e): e is Extract<AgentStreamEntry, { kind: 'tool' }> =>
+				e.kind === 'tool' && e.callId === event.call_id
+		)
+		const settled = event.type === 'tool_result'
+		if (existing) {
+			existing.running = !settled
+			existing.success = settled ? event.success === true : existing.success
+		} else {
+			stream.entries.push({
+				kind: 'tool',
+				callId: event.call_id,
+				name: event.function_name,
+				running: !settled,
+				success: settled ? event.success === true : undefined
+			})
+		}
+	}
+	return { consumed: complete, stream }
+}
+
+/**
+ * Token counts run to five and six figures, where the exact digit is noise. The
+ * millions branch is not decoration: usage accumulates over every loop
+ * iteration, and each one re-sends the whole context.
+ */
+export function formatTokenCount(count: number): string {
+	if (count < 1000) {
+		return String(count)
+	}
+	const [scaled, unit] = count < 1_000_000 ? [count / 1000, 'k'] : [count / 1_000_000, 'M']
+	return `${scaled < 10 ? scaled.toFixed(1) : Math.round(scaled)}${unit}`
+}
diff --git a/frontend/src/lib/components/aiEvals/EvalsPane.svelte b/frontend/src/lib/components/aiEvals/EvalsPane.svelte
index 568d4302cd..db765607e5 100644
--- a/frontend/src/lib/components/aiEvals/EvalsPane.svelte
+++ b/frontend/src/lib/components/aiEvals/EvalsPane.svelte
@@ -22,7 +22,6 @@
 		type Scorer,
 		type ScorerMean
 	} from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
 	import { onDestroy, onMount, untrack } from 'svelte'
 	import {
@@ -52,6 +51,9 @@
 		subjectLabel,
 		type EvalsLocation
 	} from './evalUtils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	/** A dataset is capped at this many cases, so one page holds the whole set. */
 	const CASE_PAGE_SIZE = 1000
@@ -84,7 +86,7 @@
 		active?: boolean
 	} = $props()
 
-	let ws = $derived(opWorkspace ?? $workspaceStore)
+	let ws = $derived(opWorkspace ?? $operatingWorkspace)
 	let datasets = $state<EvalDataset[]>([])
 	let dataset = $state<EvalDataset | undefined>(undefined)
 	let selectedDataset = $state<string | undefined>(undefined)
diff --git a/frontend/src/lib/components/apps/components/display/dbtable/utils.ts b/frontend/src/lib/components/apps/components/display/dbtable/utils.ts
index c0477e8408..f2337d699b 100644
--- a/frontend/src/lib/components/apps/components/display/dbtable/utils.ts
+++ b/frontend/src/lib/components/apps/components/display/dbtable/utils.ts
@@ -282,7 +282,8 @@ const scriptsV2: typeof legacyScripts = {
 		...legacyScripts.postgresql,
 		code: `
 SELECT table_name, column_name, udt_name, column_default, is_nullable, nsp.nspname AS table_schema FROM information_schema.columns
-RIGHT JOIN pg_namespace nsp ON table_schema = nsp.nspname WHERE nsp.nspname NOT IN ('information_schema', 'pg_toast', 'pg_catalog')`
+RIGHT JOIN pg_namespace nsp ON table_schema = nsp.nspname WHERE nsp.nspname NOT IN ('information_schema', 'pg_toast', 'pg_catalog')
+AND NOT starts_with(nsp.nspname, 'pg_') AND has_schema_privilege(nsp.oid, 'USAGE')`
 	}
 }
 
diff --git a/frontend/src/lib/components/apps/components/display/table/utils.dom.test.ts b/frontend/src/lib/components/apps/components/display/table/utils.dom.test.ts
new file mode 100644
index 0000000000..0e039139b0
--- /dev/null
+++ b/frontend/src/lib/components/apps/components/display/table/utils.dom.test.ts
@@ -0,0 +1,29 @@
+import { describe, expect, it } from 'vitest'
+import type { ICellRendererParams } from 'ag-grid-community'
+import { defaultCellRenderer } from './utils'
+
+function render(value: unknown) {
+	const renderer = defaultCellRenderer('link')!
+	return renderer({ value } as ICellRendererParams) as HTMLElement
+}
+
+// AG Grid writes a renderer's string output to innerHTML, and link cells hold run results.
+describe('link cell renderer', () => {
+	it('renders a link without parsing its label or href as markup', () => {
+		const el = render({ href: 'https://x.test/"><img src=x onerror=alert(1)>', label: '<b>hi</b>' })
+		expect(el.tagName).toBe('A')
+		expect(el.textContent).toBe('<b>hi</b>')
+		expect(el.getAttribute('href')).toBe('https://x.test/"><img src=x onerror=alert(1)>')
+		expect(el.children).toHaveLength(0)
+	})
+
+	it.each([
+		{ href: 'javascript:alert(1)', label: 'click' },
+		'javascript:alert(1)',
+		{ href: 'data:text/html,<script>alert(1)</script>', label: 'click' }
+	])('renders a non-navigating href %j as plain text', (value) => {
+		const el = render(value)
+		expect(el.tagName).toBe('SPAN')
+		expect(el.hasAttribute('href')).toBe(false)
+	})
+})
diff --git a/frontend/src/lib/components/apps/components/display/table/utils.ts b/frontend/src/lib/components/apps/components/display/table/utils.ts
index 015cdc54db..8b85a5894c 100644
--- a/frontend/src/lib/components/apps/components/display/table/utils.ts
+++ b/frontend/src/lib/components/apps/components/display/table/utils.ts
@@ -8,6 +8,7 @@ import type { TableAction } from '$lib/components/apps/editor/component'
 import { mount, unmount } from 'svelte'
 import { Button } from '$lib/components/common'
 import { Trash2 } from 'lucide-svelte'
+import { safeHref } from '$lib/utils/safeHref'
 
 export type WindmillColumnDef = ColDef & {
 	_isActionsColumn?: boolean
@@ -110,15 +111,25 @@ export function isLinkObject(value: any): value is LinkObject {
 
 export function defaultCellRenderer(cellRendererType: string) {
 	if (cellRendererType === 'link') {
+		// AG Grid assigns a string returned by a cell renderer to innerHTML, and cell values are
+		// run results, so the link is built as a DOM node that never parses them as markup.
 		return (params: ICellRendererParams) => {
-			if (isLinkObject(params.value)) {
-				const value = params.value
-				return `<a href=${value.href} class="underline" target="_blank">${value.label}</a>`
-			} else if (params.value) {
-				return `<a href=${params.value} class="underline" target="_blank">${params.value}</a>`
-			} else {
+			if (!params.value) {
 				return params.value
 			}
+			const { href, label } = isLinkObject(params.value)
+				? params.value
+				: { href: params.value, label: params.value }
+			const allowedHref = safeHref(String(href), window.location.href)
+			const el = document.createElement(allowedHref ? 'a' : 'span')
+			el.textContent = String(label)
+			if (allowedHref) {
+				el.setAttribute('href', allowedHref)
+				el.setAttribute('target', '_blank')
+				el.setAttribute('rel', 'noopener noreferrer')
+				el.className = 'underline'
+			}
+			return el
 		}
 	} else {
 		return undefined
diff --git a/frontend/src/lib/components/apps/components/inputs/AppQuillEditor.svelte b/frontend/src/lib/components/apps/components/inputs/AppQuillEditor.svelte
index 9d1302233f..83976a3ecd 100644
--- a/frontend/src/lib/components/apps/components/inputs/AppQuillEditor.svelte
+++ b/frontend/src/lib/components/apps/components/inputs/AppQuillEditor.svelte
@@ -8,7 +8,7 @@
 	import InputValue from '../helpers/InputValue.svelte'
 	import InitializeComponent from '../helpers/InitializeComponent.svelte'
 
-	let editor = $state()
+	let editor: HTMLElement | undefined = $state()
 	let quill: any = $state()
 	interface Props {
 		id: string
@@ -24,7 +24,7 @@
 		toolbarOptions = [
 			[{ header: 1 }, { header: 2 }, 'blockquote', 'link', 'image', 'video'],
 			['bold', 'italic', 'underline', 'strike'],
-			[{ list: 'ordered' }, { list: 'ordered' }],
+			[{ list: 'ordered' }, { list: 'bullet' }],
 			[{ align: [] }],
 			['clean']
 		]
@@ -42,6 +42,7 @@
 
 	async function loadQuill() {
 		const { default: Quill } = await import('quill')
+		if (!editor) return
 
 		quill = new Quill(editor, {
 			modules: {
@@ -51,33 +52,73 @@
 			placeholder: placeholder
 		})
 
-		if (defaultValue) {
-			quill.root.innerHTML = defaultValue
-		}
-
 		quill.on('text-change', function (delta, oldDelta, source) {
 			setOutput()
 		})
+
+		if (defaultValue) {
+			setHtml(defaultValue)
+		}
+	}
+
+	// Load HTML through Quill's clipboard converter rather than assigning `root.innerHTML`:
+	// Quill only keeps markup it has a blot for, and writes to the DOM bypass that mapping.
+	// Quill 2 renders every list as `<ol>`, so a `<ul>` from stored content would be dropped
+	// outright instead of becoming a bullet list.
+	function setHtml(html: string | undefined) {
+		quill.setContents(quill.clipboard.convert({ html: html ?? '', text: '' }))
 	}
 
 	$componentControl[untrack(() => id)] = {
 		setValue(nvalue: string) {
 			if (quill) {
-				quill.root.innerHTML = nvalue
+				setHtml(nvalue)
 				setOutput()
 			}
 		}
 	}
 
+	// Quill 2 keeps every list in an `<ol>` and marks the kind with `data-list` on each
+	// item (`bullet`, `ordered`, `checked`, `unchecked`), plus a `span.ql-ui` that only its
+	// stylesheet renders. Consumers of the output (an HTML component, stored content) render
+	// it outside that stylesheet, where that markup reads as a numbered list. Emit the
+	// standard shape instead: `<ul>`/`<ol>` runs, checklists as `<ul data-checked>`, which
+	// is what the clipboard converter reads back on load (`matchList`).
+	function toStandardHtml(root: HTMLElement): string {
+		const clone = root.cloneNode(true) as HTMLElement
+		clone.querySelectorAll('span.ql-ui').forEach((s) => s.remove())
+		clone.querySelectorAll('ol').forEach((ol) => {
+			const lists: HTMLElement[] = []
+			for (const li of Array.from(ol.children)) {
+				const kind = li.getAttribute('data-list')
+				li.removeAttribute('data-list')
+				const tag = kind === 'ordered' ? 'ol' : 'ul'
+				const checked = kind === 'checked' ? 'true' : kind === 'unchecked' ? 'false' : null
+				const last = lists.at(-1)
+				if (
+					last?.tagName.toLowerCase() !== tag ||
+					last.getAttribute('data-checked') !== checked
+				) {
+					const list = document.createElement(tag)
+					if (checked !== null) list.setAttribute('data-checked', checked)
+					lists.push(list)
+				}
+				lists.at(-1)!.appendChild(li)
+			}
+			ol.replaceWith(...lists)
+		})
+		return clone.innerHTML
+	}
+
 	function setOutput() {
 		if (quill) {
-			outputs?.result.set(quill.root.innerHTML)
+			outputs?.result.set(toStandardHtml(quill.root))
 		}
 	}
 
 	function handleDefault(defaultValue: string | undefined) {
 		if (quill) {
-			quill.root.innerHTML = defaultValue
+			setHtml(defaultValue)
 			setOutput()
 		}
 	}
diff --git a/frontend/src/lib/components/apps/editor/AppEditor.svelte b/frontend/src/lib/components/apps/editor/AppEditor.svelte
index 565ac5d5d3..073d6c3e7d 100644
--- a/frontend/src/lib/components/apps/editor/AppEditor.svelte
+++ b/frontend/src/lib/components/apps/editor/AppEditor.svelte
@@ -85,7 +85,8 @@
 		loadedFromDraft = false,
 		othersDraftsCount = 0,
 		onOpenOthersDrafts,
-		onRestore
+		onRestore,
+		onDeploy
 	}: AppEditorProps = $props()
 
 	migrateApp(untrack(() => app))
@@ -893,6 +894,7 @@
 			{othersDraftsCount}
 			{onOpenOthersDrafts}
 			{onRestore}
+			{onDeploy}
 			{policy}
 			{fromHub}
 			bind:this={appEditorHeader}
diff --git a/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte b/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte
index ab043f81a1..8a0f11c5a1 100644
--- a/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte
+++ b/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte
@@ -32,7 +32,7 @@
 		Zap,
 		Globe
 	} from 'lucide-svelte'
-	import { getContext, untrack } from 'svelte'
+	import { getContext, onDestroy, untrack } from 'svelte'
 	import { orderedJsonStringify, type Value, replaceFalseWithUndefined } from '../../../utils'
 	import type { App, AppEditorContext, AppViewerContext } from '../types'
 	import { toStatic } from '../utils'
@@ -110,6 +110,10 @@
 		// (not `on:restore` forwarding): forwarding a `createEventDispatcher`
 		// event up through these runes-mode components silently drops it.
 		onRestore?: (restoredApp: any) => void
+		// Fired after a successful deploy, which keeps this editor open: `version` is what
+		// the deploy wrote, for the next draft's fork base, and `head` what is deployed
+		// now, with its author and time.
+		onDeploy?: (e: { version?: number; head?: number; headBy?: string; headAt?: string }) => void
 	}
 
 	let {
@@ -137,7 +141,8 @@
 		loadedFromDraft = false,
 		othersDraftsCount = 0,
 		onOpenOthersDrafts,
-		onRestore
+		onRestore,
+		onDeploy
 	}: Props = $props()
 
 	/** Mirror of the path the user is editing in the pen popover. Initialized
@@ -329,13 +334,24 @@
 		}
 	}
 
-	async function syncWithDeployed() {
+	/** The opening this editor claimed last. A path change remounts this editor while the
+	 *  drawer stays mounted, so its teardown hands that opening back rather than leaving
+	 *  the drawer on the app the user left. */
+	let lastOpening: number | undefined = undefined
+	onDestroy(() => {
+		if (lastOpening != null) diffDrawer?.abandonOpening(lastOpening)
+	})
+
+	async function syncWithDeployed(opening?: number) {
 		const deployedApp = await AppService.getAppByPath({
 			workspace: $workspaceStore!,
 			path: $appPath!,
 			withStarredInfo: true
 		})
 
+		// A superseded opening must not write these: the current one would then render
+		// against the older deployed value.
+		if (opening != null && !diffDrawer?.ownsOpening(opening)) return
 		deployedBy = deployedApp.created_by
 
 		// Strip off extra information
@@ -351,7 +367,7 @@
 
 	async function updateApp(npath: string) {
 		policy = await updatePolicy($app, policy)
-		await AppService.updateApp({
+		const deployed = await AppService.updateApp({
 			workspace: $workspaceStore!,
 			path: $appPath!,
 			requestBody: {
@@ -377,16 +393,26 @@
 			custom_path: customPath,
 			labels: $state.snapshot(labels)
 		}
-		const appHistory = await AppService.getAppHistoryByPath({
+		const head = await AppService.getAppLatestVersion({
 			workspace: $workspaceStore!,
 			path: npath
 		})
-		version = appHistory[0]?.version
-		// Re-pin the fork base to the just-deployed head: the editor stays open, so a
+		// `version` is what is deployed now, which is the deploy guard's fallback head; the
+		// deploy's own answer is the base, and the two differ when another landed beside it.
+		version = head?.version
+		// Re-pin the fork base to the version just written: the editor stays open, so a
 		// follow-up deploy (or a new edit) would otherwise compare against the now-
 		// superseded base and falsely warn. parent_version is in
 		// DRAFT_COMPARE_IGNORED_FIELDS, so this write can't spawn a spurious draft.
-		if ($app) $app.parent_version = version
+		if ($app) $app.parent_version = deployed.version
+		// The route owns the pair the out-of-date prompt reads, and this editor stays open
+		// across the deploy, so hand both over rather than leaving it on the old ones.
+		onDeploy?.({
+			version: deployed.version,
+			head: version,
+			headBy: head?.created_by,
+			headAt: head?.created_at
+		})
 
 		closeSaveDrawer()
 		sendUserToast('App deployed successfully')
@@ -430,6 +456,9 @@
 	}
 
 	let onLatest = $state(true)
+	/** The last comparison could not read the head, so the confirmation it raises is
+	 *  caution and not an observed deploy. Cleared by the next reading comparison. */
+	let headUnknown = $state(false)
 	async function compareVersions() {
 		// Compare the draft's pinned fork base (`$app.parent_version`) against the
 		// current head when editing a draft, else the load-time head. Catches both a
@@ -445,9 +474,14 @@
 				path: $appPath
 			})
 			onLatest = appVersion?.version === undefined || base === appVersion?.version
+			headUnknown = false
 		} catch (e) {
 			console.error('Error comparing versions', e)
-			onLatest = true
+			// The head is what this compares against, so an unanswered read is not
+			// evidence of being current: confirm, as an unclaimable deploy does, and say
+			// that is why rather than claiming a version that was never seen.
+			onLatest = false
+			headUnknown = true
 		}
 	}
 
@@ -624,23 +658,33 @@
 				if (!savedApp || newApp) {
 					return
 				}
+				// The fetch below is awaited, so a reopen (or a path change, which remounts
+				// this editor but not the drawer) while it runs must not have the older one
+				// land last. The drawer counts the openings for that reason.
+				const opening = diffDrawer?.beginOpening()
+				lastOpening = opening
+				if (opening == null) return
 
 				// deployedValue should be syncronized when we open Diff
-				await syncWithDeployed()
+				await syncWithDeployed(opening)
 
-				diffDrawer?.openDrawer()
-				diffDrawer?.setDiff({
-					mode: 'normal',
-					deployed: deployedValue ?? savedApp,
-					current: {
-						summary: $summary,
-						value: $app,
-						path: newEditedPath || savedApp.path,
-						policy,
-						custom_path: customPath,
-						labels
-					}
-				})
+				if (!diffDrawer?.ownsOpening(opening)) return
+				diffDrawer.openDrawer(opening)
+				diffDrawer.setDiff(
+					{
+						mode: 'normal',
+						deployed: deployedValue ?? savedApp,
+						current: {
+							summary: $summary,
+							value: $app,
+							path: newEditedPath || savedApp.path,
+							policy,
+							custom_path: customPath,
+							labels
+						}
+					},
+					opening
+				)
 			},
 			disabled: !savedApp || newApp
 		},
@@ -721,6 +765,8 @@
 	{confirmCallback}
 	bind:open
 	{diffDrawer}
+	claimOpening={() => (lastOpening = diffDrawer?.beginOpening())}
+	{headUnknown}
 	bind:deployedValue
 	currentValue={{
 		summary: $summary,
@@ -759,33 +805,41 @@
 						if (!savedApp || newApp) {
 							return
 						}
+						// The other entry point into the same drawer, so it takes an opening too.
+						const opening = diffDrawer?.beginOpening()
+						lastOpening = opening
+						if (opening == null) return
 						// deployedValue should be syncronized when we open Diff
-						await syncWithDeployed()
+						await syncWithDeployed(opening)
 
+						if (!diffDrawer?.ownsOpening(opening)) return
 						saveDrawerOpen = false
-						diffDrawer?.openDrawer()
-						diffDrawer?.setDiff({
-							mode: 'normal',
-							deployed: deployedValue ?? savedApp,
-							current: {
-								summary: $summary,
-								value: $app,
-								path: newEditedPath || savedApp.path,
-								policy,
-								custom_path: customPath,
-								labels
-							},
-							button: {
-								text: 'Looks good, deploy',
-								onClick: () => {
-									if (newApp) {
-										createApp(newEditedPath)
-									} else {
-										handleUpdateApp(newEditedPath)
+						diffDrawer.openDrawer(opening)
+						diffDrawer.setDiff(
+							{
+								mode: 'normal',
+								deployed: deployedValue ?? savedApp,
+								current: {
+									summary: $summary,
+									value: $app,
+									path: newEditedPath || savedApp.path,
+									policy,
+									custom_path: customPath,
+									labels
+								},
+								button: {
+									text: 'Looks good, deploy',
+									onClick: () => {
+										if (newApp) {
+											createApp(newEditedPath)
+										} else {
+											handleUpdateApp(newEditedPath)
+										}
 									}
 								}
-							}
-						})
+							},
+							opening
+						)
 					}}
 				>
 					<div class="flex flex-row gap-2 items-center">
@@ -818,6 +872,7 @@
 			{setPublishState}
 			appPath={$appPath}
 			{onLatest}
+			{headUnknown}
 			{savedApp}
 			bind:summary={$summary}
 			bind:customPath
diff --git a/frontend/src/lib/components/apps/editor/AppEditorHeaderDeploy.svelte b/frontend/src/lib/components/apps/editor/AppEditorHeaderDeploy.svelte
index 836af68db6..4f27eb6b26 100644
--- a/frontend/src/lib/components/apps/editor/AppEditorHeaderDeploy.svelte
+++ b/frontend/src/lib/components/apps/editor/AppEditorHeaderDeploy.svelte
@@ -2,7 +2,7 @@
 	import { Alert } from '$lib/components/common'
 	import Badge from '$lib/components/common/badge/Badge.svelte'
 	import Toggle from '$lib/components/Toggle.svelte'
-	import { enterpriseLicense, userStore, workspaceStore } from '$lib/stores'
+	import { enterpriseLicense, userStore } from '$lib/stores'
 	import { Loader2 } from 'lucide-svelte'
 
 	import Tooltip from '$lib/components/Tooltip.svelte'
@@ -26,6 +26,14 @@
 	import { canUserBypassRuleKind, protectionRulesState } from '$lib/workspaceProtectionRules.svelte'
 	import { FRONTEND_SDK_SCOPES } from '$lib/components/raw_apps/sdkScopes'
 	import { logFeatureUsage } from '$lib/utils/featureUsage'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspaceStore = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	const WM_DEPLOYERS_GROUP = 'wm_deployers'
 
@@ -35,6 +43,7 @@
 		appPath,
 		customPath = $bindable(),
 		onLatest,
+		headUnknown = false,
 		savedApp,
 		summary = $bindable(),
 		deploymentMsg = $bindable(),
@@ -54,6 +63,9 @@
 		appPath: string
 		customPath: string | undefined
 		onLatest: boolean
+		/** The comparison behind `onLatest` could not read the deployed head, so the warning
+		 *  is caution rather than an observed newer version. */
+		headUnknown?: boolean
 		savedApp: any
 		summary: string
 		deploymentMsg: string | undefined
@@ -74,29 +86,27 @@
 		 *  (`/secret_of/...` 404s with no `app` row) and renders a placeholder
 		 *  instead of the eternally-spinning link. */
 		newApp?: boolean
-		/** Workspace the app is deployed to — the session's acting workspace when
-		 *  embedded in a session preview, else the navigation `$workspaceStore`.
-		 *  The secret-URL / custom-path / folder / on-behalf-of lookups must target
-		 *  it, not `$workspaceStore` (which stays on the nav workspace in a session). */
+		/** Workspace the app is deployed to. The secret-URL / custom-path / folder /
+		 *  on-behalf-of lookups target it; defaults to the operating workspace. */
 		operatingWorkspace?: string
 	} = $props()
 
-	const opWs = $derived(operatingWorkspace ?? $workspaceStore)
+	const opWs = $derived(operatingWorkspace ?? $operatingWorkspaceStore)
 
-	let isDeployer = $derived($userStore?.groups?.includes(WM_DEPLOYERS_GROUP) ?? false)
+	let isDeployer = $derived(actingUser?.groups?.includes(WM_DEPLOYERS_GROUP) ?? false)
 	// Admins always pass the backend check. For everyone else, fail closed
 	// while the workspace protection rules are still loading so the toggle
 	// is never briefly enabled for a user the rules will end up restricting.
 	let rulesetsLoaded = $derived(protectionRulesState.rulesets !== undefined)
 	let canSetAnonymous = $derived(
-		!!$userStore?.is_admin ||
-			!!$userStore?.is_super_admin ||
+		!!actingUser?.is_admin ||
+			!!actingUser?.is_super_admin ||
 			(rulesetsLoaded &&
 				canUserBypassRuleKind('RestrictAnonymousAppDeployment', $userStore ?? undefined))
 	)
 	let canSetGuest = $derived(
-		!!$userStore?.is_admin ||
-			!!$userStore?.is_super_admin ||
+		!!actingUser?.is_admin ||
+			!!actingUser?.is_super_admin ||
 			(rulesetsLoaded &&
 				canUserBypassRuleKind('RestrictGuestAppDeployment', $userStore ?? undefined))
 	)
@@ -143,7 +153,7 @@
 			setPublishState()
 		}
 	}
-	let canPreserve = $derived(!!$userStore?.is_admin || !!$userStore?.is_super_admin || isDeployer)
+	let canPreserve = $derived(!!actingUser?.is_admin || !!actingUser?.is_super_admin || isDeployer)
 	let savedOnBehalfOfEmail = $derived(savedApp?.policy?.on_behalf_of_email)
 	let savedOnBehalfOf = $derived(savedApp?.policy?.on_behalf_of)
 	let onBehalfOfChoice: OnBehalfOfChoice = $state(undefined)
@@ -239,8 +249,15 @@
 </script>
 
 {#if !onLatest}
-	<Alert title="You're not on the latest app version. " type="warning">
-		By deploying, you may overwrite changes made by other users. Press 'Deploy' to see diff.
+	<Alert
+		title={headUnknown
+			? 'Could not check the deployed version. '
+			: "You're not on the latest app version. "}
+		type="warning"
+	>
+		{headUnknown
+			? "Deploying may overwrite changes made by other users. Press 'Deploy' to see diff."
+			: "By deploying, you may overwrite changes made by other users. Press 'Deploy' to see diff."}
 	</Alert>
 	<div class="py-2"></div>
 {/if}
@@ -596,7 +613,7 @@
 		{/if}
 
 		<div class="mt-4">
-			{#if !($userStore?.is_admin || $userStore?.is_super_admin)}
+			{#if !(actingUser?.is_admin || actingUser?.is_super_admin)}
 				<Alert type="warning" title="Admin only" size="xs">
 					Custom path can only be set by workspace admins
 				</Alert>
@@ -617,7 +634,7 @@
 				options={{
 					right: 'Use a custom URL'
 				}}
-				disabled={!$enterpriseLicense || !($userStore?.is_admin || $userStore?.is_super_admin)}
+				disabled={!$enterpriseLicense || !(actingUser?.is_admin || actingUser?.is_super_admin)}
 			/>
 
 			{#if customPath !== undefined}
@@ -625,7 +642,7 @@
 					<div>Custom path</div>
 				</div>
 				<input
-					disabled={!($userStore?.is_admin || $userStore?.is_super_admin)}
+					disabled={!(actingUser?.is_admin || actingUser?.is_super_admin)}
 					type="text"
 					autocomplete="off"
 					bind:value={customPath}
diff --git a/frontend/src/lib/components/apps/editor/AppJobsDrawer.svelte b/frontend/src/lib/components/apps/editor/AppJobsDrawer.svelte
index 39ecb51715..98d380bcb3 100644
--- a/frontend/src/lib/components/apps/editor/AppJobsDrawer.svelte
+++ b/frontend/src/lib/components/apps/editor/AppJobsDrawer.svelte
@@ -7,7 +7,6 @@
 	import JobArgs from '$lib/components/JobArgs.svelte'
 	import LogViewer from '$lib/components/LogViewer.svelte'
 
-	import { workspaceStore } from '$lib/stores'
 	import { BellOff, Loader2, RefreshCw } from 'lucide-svelte'
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import { classNames, truncateRev, isFlowPreview } from '../../../utils'
@@ -21,6 +20,9 @@
 	import type { Job } from '$lib/gen'
 	import type { JobById } from '../types'
 	import { createEventDispatcher, untrack } from 'svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		open?: boolean
@@ -163,7 +165,7 @@
 											<Pane size={90} minSize={10} class="text-sm text-secondary">
 												<div class="relative h-full px-2">
 													<DisplayResult
-														workspaceId={$workspaceStore}
+														workspaceId={$operatingWorkspace}
 														jobId={selectedJobId}
 														result={jobResult.result}
 													/>
@@ -192,7 +194,7 @@
 											<div class="p-2">
 												<JobArgs
 													id={job?.id}
-													workspace={job?.workspace_id ?? $workspaceStore ?? 'no_w'}
+													workspace={job?.workspace_id ?? $operatingWorkspace ?? 'no_w'}
 													args={job?.args}
 												/>
 											</div>
@@ -219,7 +221,7 @@
 													{#if job != undefined && 'result' in job && job?.result != undefined}<div
 															class="relative h-full px-2"
 															><DisplayResult
-																workspaceId={$workspaceStore}
+																workspaceId={$operatingWorkspace}
 																jobId={selectedJobId}
 																result={job?.result}
 															/></div
@@ -240,7 +242,7 @@
 														{#if job != undefined && 'result' in job && job?.result != undefined}
 															<div class="relative h-full px-2">
 																<DisplayResult
-																	workspaceId={$workspaceStore}
+																	workspaceId={$operatingWorkspace}
 																	jobId={selectedJobId}
 																	result={jobResult?.transformer}
 																/>
diff --git a/frontend/src/lib/components/apps/editor/DeploymentHistory.svelte b/frontend/src/lib/components/apps/editor/DeploymentHistory.svelte
index 614d1f4fa4..63bc17a8eb 100644
--- a/frontend/src/lib/components/apps/editor/DeploymentHistory.svelte
+++ b/frontend/src/lib/components/apps/editor/DeploymentHistory.svelte
@@ -14,12 +14,14 @@
 	} from '$lib/utils'
 	import { orderedYamlStringify } from '$lib/utils/orderedYaml'
 	import { AppService, type AppWithLastVersion, type AppHistory } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { Skeleton } from '$lib/components/common'
 	import Button from '$lib/components/common/button/Button.svelte'
 	import { createEventDispatcher, untrack } from 'svelte'
 	import { Pencil, ArrowRight, X, Loader2 } from 'lucide-svelte'
 	import Select from '$lib/components/select/Select.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		appPath: string | undefined
@@ -48,7 +50,7 @@
 			return cached
 		}
 
-		const app = await AppService.getAppByVersion({ workspace: $workspaceStore!, id: version })
+		const app = await AppService.getAppByVersion({ workspace: $operatingWorkspace!, id: version })
 		versionCache[version] = app
 		return app
 	}
@@ -60,7 +62,7 @@
 
 		loading = true
 		versions = await AppService.getAppHistoryByPath({
-			workspace: $workspaceStore!,
+			workspace: $operatingWorkspace!,
 			path: appPath
 		})
 		loading = false
@@ -90,7 +92,7 @@
 			return
 		}
 		await AppService.updateAppHistory({
-			workspace: $workspaceStore!,
+			workspace: $operatingWorkspace!,
 			id: appId,
 			version: appVersion,
 			requestBody: {
@@ -107,7 +109,9 @@
 	}
 
 	function toVersionLabel(version: AppHistory): string {
-		return emptyString(version.deployment_msg) ? `Version ${version.version}` : version.deployment_msg!
+		return emptyString(version.deployment_msg)
+			? `Version ${version.version}`
+			: version.deployment_msg!
 	}
 
 	let availableVersions = $derived(
diff --git a/frontend/src/lib/components/apps/editor/appDeploy.svelte.ts b/frontend/src/lib/components/apps/editor/appDeploy.svelte.ts
index 122c42bcf9..f799cb864a 100644
--- a/frontend/src/lib/components/apps/editor/appDeploy.svelte.ts
+++ b/frontend/src/lib/components/apps/editor/appDeploy.svelte.ts
@@ -1,7 +1,7 @@
-import { base } from "$lib/base"
-import { workspaceStore } from "$lib/stores"
-import { get } from "svelte/store"
+import { base } from '$lib/base'
+import { workspaceStore } from '$lib/stores'
+import { get } from 'svelte/store'
 
 export function computeSecretUrl(secretUrl: string) {
-    return `${window.location.origin}${base}/public/${get(workspaceStore)}/${secretUrl}`
+	return `${window.location.origin}${base}/public/${get(workspaceStore)}/${secretUrl}`
 }
diff --git a/frontend/src/lib/components/apps/editor/inlineScriptsPanel/InlineScriptRunnableByPath.svelte b/frontend/src/lib/components/apps/editor/inlineScriptsPanel/InlineScriptRunnableByPath.svelte
index 3089809f12..293d83b4ae 100644
--- a/frontend/src/lib/components/apps/editor/inlineScriptsPanel/InlineScriptRunnableByPath.svelte
+++ b/frontend/src/lib/components/apps/editor/inlineScriptsPanel/InlineScriptRunnableByPath.svelte
@@ -19,7 +19,6 @@
 		CtxAppInput
 	} from '../../inputType'
 	import type { AppViewerContext } from '../../types'
-	import { workspaceStore } from '$lib/stores'
 	import { createEventDispatcher } from 'svelte'
 	import { deepEqual } from 'fast-equals'
 	import { computeFields } from './utils'
@@ -35,6 +34,9 @@
 	import FlowEditorDrawer from '$lib/components/flows/content/FlowEditorDrawer.svelte'
 	import { FlowService, ScriptService, type OpenFlow } from '$lib/gen'
 	import { replaceScriptPlaceholderWithItsValues } from '$lib/hub'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		runnable: RunnableByPath
@@ -131,7 +133,7 @@
 				return
 			}
 
-			const loaded = await loadSchema($workspaceStore ?? '', runnable.path, 'flow')
+			const loaded = await loadSchema($operatingWorkspace ?? '', runnable.path, 'flow')
 			const schema = loaded?.schema ?? emptySchema()
 			if (!deepEqual(runnable.schema, schema)) {
 				runnable.schema = schema
@@ -167,7 +169,7 @@
 	async function openScriptEditor(path: string) {
 		try {
 			const script = await ScriptService.getScriptByPath({
-				workspace: $workspaceStore!,
+				workspace: $operatingWorkspace!,
 				path
 			})
 			scriptEditorDrawer?.openDrawer(script.hash, () => {
@@ -344,7 +346,7 @@
 					startIcon={{ icon: Eye }}
 					endIcon={{ icon: ExternalLink }}
 					target="_blank"
-					href="{base}/flows/get/{runnable.path}?workspace={$workspaceStore}"
+					href="{base}/flows/get/{runnable.path}?workspace={$operatingWorkspace}"
 				>
 					Details
 				</Button>
@@ -425,7 +427,7 @@
 					{#if runnable.runType == 'flow' && isHubFlowPath(runnable.path)}
 						Hub flow not found at {runnable.path}
 					{:else}
-						{runnable.runType} not found at {runnable.path} in workspace {$workspaceStore}
+						{runnable.runType} not found at {runnable.path} in workspace {$operatingWorkspace}
 					{/if}
 				</div>
 			{:else if runnable.runType == 'script' || runnable.runType == 'hubscript'}
diff --git a/frontend/src/lib/components/apps/editor/settingsPanel/mainInput/RunnableSelector.svelte b/frontend/src/lib/components/apps/editor/settingsPanel/mainInput/RunnableSelector.svelte
index 8543fc0683..08b8ac6219 100644
--- a/frontend/src/lib/components/apps/editor/settingsPanel/mainInput/RunnableSelector.svelte
+++ b/frontend/src/lib/components/apps/editor/settingsPanel/mainInput/RunnableSelector.svelte
@@ -11,15 +11,12 @@
 	import type { Schema } from '$lib/common'
 	import { emptySchema } from '$lib/utils'
 	import { loadSchema } from '$lib/infer'
-	import { workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 	import { buildPathRunnableSelection } from './runnableSelectorUtils'
 
-	type TabType =
-		| 'hubscripts'
-		| 'hubflows'
-		| 'workspacescripts'
-		| 'workspaceflows'
-		| 'inlinescripts'
+	type TabType = 'hubscripts' | 'hubflows' | 'workspacescripts' | 'workspaceflows' | 'inlinescripts'
 
 	interface Props {
 		defaultUserInput?: boolean
@@ -60,7 +57,7 @@
 		path: string,
 		runType: 'script' | 'flow' | 'hubscript'
 	): Promise<{ schema: Schema; summary: string | undefined }> {
-		const schema = await loadSchema($workspaceStore!, path, runType)
+		const schema = await loadSchema($operatingWorkspace!, path, runType)
 		if (!schema.schema.order) {
 			schema.schema.order = Object.keys(schema.schema.properties ?? {})
 		}
diff --git a/frontend/src/lib/components/apps/editor/settingsPanel/mainInput/WorkspaceFlowList.svelte b/frontend/src/lib/components/apps/editor/settingsPanel/mainInput/WorkspaceFlowList.svelte
index b2cc91fc01..7831e83458 100644
--- a/frontend/src/lib/components/apps/editor/settingsPanel/mainInput/WorkspaceFlowList.svelte
+++ b/frontend/src/lib/components/apps/editor/settingsPanel/mainInput/WorkspaceFlowList.svelte
@@ -7,9 +7,11 @@
 	import NoItemFound from '$lib/components/home/NoItemFound.svelte'
 	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
 	import { FlowService, type Flow } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { emptyString } from '$lib/utils'
 	import { Skeleton } from '$lib/components/common'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		filter?: string
@@ -26,7 +28,7 @@
 
 	async function loadFlow(): Promise<void> {
 		const loadedFlows = await FlowService.listFlows({
-			workspace: $workspaceStore!,
+			workspace: $operatingWorkspace!,
 			perPage: 300,
 			withoutDescription: true
 		})
diff --git a/frontend/src/lib/components/apps/editor/settingsPanel/mainInput/WorkspaceScriptList.svelte b/frontend/src/lib/components/apps/editor/settingsPanel/mainInput/WorkspaceScriptList.svelte
index be261ca5e8..13447c4787 100644
--- a/frontend/src/lib/components/apps/editor/settingsPanel/mainInput/WorkspaceScriptList.svelte
+++ b/frontend/src/lib/components/apps/editor/settingsPanel/mainInput/WorkspaceScriptList.svelte
@@ -7,9 +7,11 @@
 	import NoItemFound from '$lib/components/home/NoItemFound.svelte'
 	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
 	import { type Script, ScriptService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { emptyString } from '$lib/utils'
 	import { Skeleton } from '$lib/components/common'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		filter?: string
@@ -26,7 +28,7 @@
 
 	async function loadScripts(): Promise<void> {
 		const loadedScripts = await ScriptService.listScripts({
-			workspace: $workspaceStore!,
+			workspace: $operatingWorkspace!,
 			perPage: 300,
 			withoutDescription: true
 		})
diff --git a/frontend/src/lib/components/apps/types.ts b/frontend/src/lib/components/apps/types.ts
index 960e273ac3..75de2d7faf 100644
--- a/frontend/src/lib/components/apps/types.ts
+++ b/frontend/src/lib/components/apps/types.ts
@@ -183,6 +183,11 @@ export interface AppEditorProps {
 	// AppEditorHeader as a callback prop rather than `on:restore` forwarding,
 	// which does not propagate through these runes-mode components.
 	onRestore?: (restoredApp: any) => void
+	// Fired after a successful deploy, which keeps this editor open: `version` is what
+	// the deploy wrote, for the next draft's fork base, and `head` what is deployed now,
+	// with its author and time. `version` and `head` differ when another deploy landed
+	// beside this one, which is when the out-of-date prompt has something to say.
+	onDeploy?: (e: { version?: number; head?: number; headBy?: string; headAt?: string }) => void
 }
 
 export type App = {
diff --git a/frontend/src/lib/components/assets/AssetGraph/AssetGraphDetailsPane.svelte b/frontend/src/lib/components/assets/AssetGraph/AssetGraphDetailsPane.svelte
index 4b252b9338..6050c2d1cd 100644
--- a/frontend/src/lib/components/assets/AssetGraph/AssetGraphDetailsPane.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/AssetGraphDetailsPane.svelte
@@ -48,7 +48,10 @@
 	import AssetRunsPanel from './AssetRunsPanel.svelte'
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import { fade } from 'svelte/transition'
-	import { userStore } from '$lib/stores'
+	import { useOperatingUser } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	interface Props {
 		// Regular selection — loads the script by path for inline editing.
@@ -662,7 +665,7 @@
 	// hand-rolled here because we need *two* confirm buttons, not one.
 	let removeOpen = $state(false)
 	let removing = $state(false)
-	let canHardDelete = $derived(!!($userStore?.is_admin || $userStore?.is_super_admin))
+	let canHardDelete = $derived(!!(actingUser?.is_admin || actingUser?.is_super_admin))
 
 	// React to the parent's remove-signal counter and pop the same modal
 	// the in-pane trash button uses. Skipped for drafts (the parent calls
diff --git a/frontend/src/lib/components/assets/AssetGraph/AssetNode.svelte b/frontend/src/lib/components/assets/AssetGraph/AssetNode.svelte
index 815db36b18..e719bfe2bd 100644
--- a/frontend/src/lib/components/assets/AssetGraph/AssetNode.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/AssetNode.svelte
@@ -19,12 +19,15 @@
 		XCircle
 	} from 'lucide-svelte'
 	import type { ScriptLang } from '$lib/gen'
-	import { enterpriseLicense, workspaceStore } from '$lib/stores'
+	import { enterpriseLicense } from '$lib/stores'
 	import { sendUserToast } from '$lib/utils'
 	import { PIPELINE_LANGUAGES } from './pipelineLanguages'
 	import type { PipelineOutputKind } from './pipelineTemplates'
 	import type { DbtAssetProvenance } from './types'
 	import DbtIcon from '$lib/components/icons/DbtIcon.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	// Shape used for both the data prop and the run callback. Drafts carry
 	// `content` / `language` so the page-level run handler can dispatch to
@@ -118,7 +121,7 @@
 
 	async function runProducers(e: MouseEvent) {
 		e.stopPropagation()
-		if (!$workspaceStore || running || !data.onRunProducer) return
+		if (!$operatingWorkspace || running || !data.onRunProducer) return
 		if (scriptProducers.length === 0) return
 		running = true
 		const handler = data.onRunProducer
@@ -170,14 +173,14 @@
 		}
 		const cols = Object.entries(d.columns ?? {})
 		if (cols.length) {
-			lines.push(
-				`columns: ${cols.map(([c, desc]) => (desc ? `${c} (${desc})` : c)).join(', ')}`
-			)
+			lines.push(`columns: ${cols.map(([c, desc]) => (desc ? `${c} (${desc})` : c)).join(', ')}`)
 		}
 		if (d.freshness) {
 			const f = d.freshness as Record<string, { count?: number; period?: string }>
 			const window = (k: string) =>
-				f[k]?.count != null ? `${k.replace('_after', '')} after ${f[k].count}${f[k].period?.[0] ?? ''}` : ''
+				f[k]?.count != null
+					? `${k.replace('_after', '')} after ${f[k].count}${f[k].period?.[0] ?? ''}`
+					: ''
 			const windows = ['warn_after', 'error_after'].map(window).filter(Boolean)
 			if (windows.length) lines.push(`freshness: ${windows.join(', ')}`)
 		}
diff --git a/frontend/src/lib/components/assets/AssetGraph/AssetRunsPanel.svelte b/frontend/src/lib/components/assets/AssetGraph/AssetRunsPanel.svelte
index f43259b561..7cee1deb76 100644
--- a/frontend/src/lib/components/assets/AssetGraph/AssetRunsPanel.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/AssetRunsPanel.svelte
@@ -8,7 +8,6 @@
 	// seconds so the user sees status transitions without refreshing —
 	// JobLoader handles streaming for the *selected* job.
 	import { JobService, type Job } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { onDestroy, untrack } from 'svelte'
 	import { displayDate } from '$lib/utils'
 	import { CheckCircle2, Clock, History, Loader2, XCircle, Ban } from 'lucide-svelte'
@@ -21,6 +20,9 @@
 	import { Popover } from '$lib/components/meltComponents'
 	import { twMerge } from 'tailwind-merge'
 	import DispatchEventsButton from '$lib/components/runs/DispatchEventsButton.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		// Producers of this asset. Each contributes its own listExtendedJobs
@@ -88,7 +90,7 @@
 		// Run only when the *content* of the producer set changes (string
 		// key) or when the parent explicitly bumps `refreshKey` after
 		// dispatching a new run. The producerKey debounce alone isn't
-		// enough: refresh() synchronously reads $workspaceStore and
+		// enough: refresh() synchronously reads $operatingWorkspace and
 		// runnableProducers before the first await, and Svelte 5 records
 		// those as deps of the surrounding $effect — which would then
 		// re-fire whenever the parent re-derives `producers` (i.e. on
@@ -174,11 +176,11 @@
 
 	async function refresh(): Promise<void> {
 		if (refreshInFlight) return refreshInFlight
-		if (!$workspaceStore || runnableProducers.length === 0) {
+		if (!$operatingWorkspace || runnableProducers.length === 0) {
 			jobs = []
 			return
 		}
-		const ws = $workspaceStore
+		const ws = $operatingWorkspace
 		// Capture the producer paths *now* — using runnableProducers
 		// directly inside the await would re-read after the array
 		// identity churned, defeating the in-flight guard.
@@ -286,12 +288,12 @@
 			</span>
 			<a
 				class="text-3xs text-blue-600 hover:underline shrink-0"
-				href={`${base}/run/${selectedJob.id}?workspace=${$workspaceStore}`}
+				href={`${base}/run/${selectedJob.id}?workspace=${$operatingWorkspace}`}
 				target="_blank">Open ↗</a
 			>
-			{#if $workspaceStore}
+			{#if $operatingWorkspace}
 				<DispatchEventsButton
-					workspace={selectedJob.workspace_id ?? $workspaceStore}
+					workspace={selectedJob.workspace_id ?? $operatingWorkspace}
 					jobId={selectedJob.id}
 				/>
 			{/if}
@@ -397,7 +399,7 @@
 			<div class="flex flex-col gap-3 p-3">
 				<JobArgs
 					id={selectedJob.id}
-					workspace={selectedJob.workspace_id ?? $workspaceStore ?? ''}
+					workspace={selectedJob.workspace_id ?? $operatingWorkspace ?? ''}
 					args={selectedJob.args}
 				/>
 				<div class="flex flex-col gap-1">
diff --git a/frontend/src/lib/components/assets/AssetGraph/DataTablePreview.svelte b/frontend/src/lib/components/assets/AssetGraph/DataTablePreview.svelte
index 1b86fa6853..5f5dc98b60 100644
--- a/frontend/src/lib/components/assets/AssetGraph/DataTablePreview.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/DataTablePreview.svelte
@@ -9,7 +9,6 @@
 	// just be noise.
 	import DBTable from '$lib/components/DBTable.svelte'
 	import { resource } from 'runed'
-	import { workspaceStore } from '$lib/stores'
 	import { loadAllTablesMetaData } from '$lib/components/apps/components/display/dbtable/metadata'
 	import { dbTableOpsWithPreviewScripts } from '$lib/components/dbOps'
 	import { WorkspaceService } from '$lib/gen'
@@ -19,6 +18,9 @@
 	import Button from '$lib/components/common/button/Button.svelte'
 	import { base } from '$lib/base'
 	import { twMerge } from 'tailwind-merge'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		// Asset path as parsed from `datatable://<datatable>/<table>` —
@@ -71,7 +73,7 @@
 	// query, and the user needs to configure it before pipeline scripts
 	// can write to it.
 	let datatables = resource(
-		() => $workspaceStore,
+		() => $operatingWorkspace,
 		async (ws) => {
 			if (!ws) return [] as string[]
 			try {
@@ -117,9 +119,9 @@
 		() => [input, refreshKey],
 		async ([_input]) => {
 			colDefsError = undefined
-			if (!_input || !$workspaceStore) return undefined
+			if (!_input || !$operatingWorkspace) return undefined
 			try {
-				return await loadAllTablesMetaData($workspaceStore, _input)
+				return await loadAllTablesMetaData($operatingWorkspace, _input)
 			} catch (e) {
 				colDefsError = (e as Error)?.message || String(e)
 				return undefined
@@ -138,12 +140,12 @@
 	})
 
 	let dbTableOps = $derived(
-		input && tableColDefs && parsed.table && $workspaceStore
+		input && tableColDefs && parsed.table && $operatingWorkspace
 			? dbTableOpsWithPreviewScripts({
 					input,
 					tableKey: parsed.table,
 					colDefs: tableColDefs,
-					workspace: $workspaceStore
+					workspace: $operatingWorkspace
 				})
 			: undefined
 	)
diff --git a/frontend/src/lib/components/assets/AssetGraph/DucklakeResultPreview.svelte b/frontend/src/lib/components/assets/AssetGraph/DucklakeResultPreview.svelte
index f21ca486af..d2d3c03b8a 100644
--- a/frontend/src/lib/components/assets/AssetGraph/DucklakeResultPreview.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/DucklakeResultPreview.svelte
@@ -9,7 +9,6 @@
 	// ("This partition") or show the full table ("Whole table") via a toggle.
 	import DBTable from '$lib/components/DBTable.svelte'
 	import { resource } from 'runed'
-	import { workspaceStore } from '$lib/stores'
 	import { loadAllTablesMetaData } from '$lib/components/apps/components/display/dbtable/metadata'
 	import { dbTableOpsWithPreviewScripts } from '$lib/components/dbOps'
 	import type { DbInput } from '$lib/components/dbTypes'
@@ -18,6 +17,9 @@
 	import { twMerge } from 'tailwind-merge'
 	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		// Full asset URI, e.g. `ducklake://main/orders_daily`.
@@ -61,9 +63,9 @@
 		() => [input, refreshKey] as const,
 		async ([_input]) => {
 			colDefsError = undefined
-			if (!_input || !$workspaceStore) return undefined
+			if (!_input || !$operatingWorkspace) return undefined
 			try {
-				return await loadAllTablesMetaData($workspaceStore, _input)
+				return await loadAllTablesMetaData($operatingWorkspace, _input)
 			} catch (e) {
 				colDefsError = (e as Error)?.message || String(e)
 				return undefined
@@ -89,12 +91,12 @@
 	})
 
 	let dbTableOps = $derived.by(() => {
-		if (!(input && tableColDefs && tableKey && $workspaceStore)) return undefined
+		if (!(input && tableColDefs && tableKey && $operatingWorkspace)) return undefined
 		const ops = dbTableOpsWithPreviewScripts({
 			input,
 			tableKey,
 			colDefs: tableColDefs,
-			workspace: $workspaceStore,
+			workspace: $operatingWorkspace,
 			whereClause
 		})
 		// Read-only preview: drop the mutation handlers so DBTable hides its
diff --git a/frontend/src/lib/components/assets/AssetGraph/DucklakeVersionPreview.svelte b/frontend/src/lib/components/assets/AssetGraph/DucklakeVersionPreview.svelte
index 5afb51fe66..35eff3beae 100644
--- a/frontend/src/lib/components/assets/AssetGraph/DucklakeVersionPreview.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/DucklakeVersionPreview.svelte
@@ -7,7 +7,6 @@
 	// hand is shown above the grid so the affordance is self-documenting.
 	import DBTable from '$lib/components/DBTable.svelte'
 	import { resource } from 'runed'
-	import { workspaceStore } from '$lib/stores'
 	import {
 		fetchDucklakeColumnsAtVersion,
 		dbTableOpsWithPreviewScripts
@@ -17,6 +16,9 @@
 	import { AlertTriangle, Loader2, ClipboardCopy } from 'lucide-svelte'
 	import { Button } from '$lib/components/common'
 	import { twMerge } from 'tailwind-merge'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		// Full asset URI, e.g. `ducklake://main/orders_daily`.
@@ -56,9 +58,10 @@
 	let columns = resource(
 		() => [ducklake, tableKey, version] as const,
 		async ([_ducklake, _tableKey, _version]) => {
-			if (!_ducklake || !_tableKey || _version == undefined || !$workspaceStore) return undefined
+			if (!_ducklake || !_tableKey || _version == undefined || !$operatingWorkspace)
+				return undefined
 			const colDefs = await fetchDucklakeColumnsAtVersion({
-				workspace: $workspaceStore,
+				workspace: $operatingWorkspace,
 				ducklake: _ducklake,
 				tableKey: _tableKey,
 				version: _version
@@ -73,13 +76,13 @@
 	let tableColDefs = $derived(ready ? columns.current!.colDefs : undefined)
 
 	let dbTableOps = $derived.by(() => {
-		if (!(input && tableColDefs && tableKey && $workspaceStore && version != undefined))
+		if (!(input && tableColDefs && tableKey && $operatingWorkspace && version != undefined))
 			return undefined
 		const ops = dbTableOpsWithPreviewScripts({
 			input,
 			tableKey,
 			colDefs: tableColDefs,
-			workspace: $workspaceStore,
+			workspace: $operatingWorkspace,
 			version
 		})
 		// Historical reads are immutable: drop every mutation handler so DBTable
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineScriptView.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineScriptView.svelte
index 79a1cf6d47..2450595b6d 100644
--- a/frontend/src/lib/components/assets/AssetGraph/PipelineScriptView.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/PipelineScriptView.svelte
@@ -6,7 +6,9 @@
 	import PipelineRunForm from './PipelineRunForm.svelte'
 	import AssetRunsPanel from './AssetRunsPanel.svelte'
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
-	import { workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 	import { parsePipelineAnnotations } from './parsePipelineAnnotations'
 
 	interface Props {
@@ -201,7 +203,7 @@
 								bind:args
 								bind:isValid
 								{partitionSpec}
-								workspace={$workspaceStore ?? ''}
+								workspace={$operatingWorkspace ?? ''}
 								{materializeTarget}
 								{upstreamAssets}
 							/>
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineTriggerEditors.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineTriggerEditors.svelte
index e364b29883..4f97039a1c 100644
--- a/frontend/src/lib/components/assets/AssetGraph/PipelineTriggerEditors.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/PipelineTriggerEditors.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/utils'
 	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
 	import type { NativeTriggerKind } from './types'
@@ -24,7 +23,10 @@
 	import EmailTriggerEditor from '$lib/components/triggers/email/EmailTriggerEditor.svelte'
 	import ScheduleEditor from '$lib/components/triggers/schedules/ScheduleEditor.svelte'
 	import WebhookEditor from '$lib/components/triggers/webhook/WebhookEditor.svelte'
-	import { setTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+	import { setOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	// Owns the native-trigger drawer wiring for the pipeline canvas: the nine
 	// editor instances, the create/edit dispatch by kind, and the delete
@@ -40,9 +42,8 @@
 	type Props = { onUpdate: () => void; mountTriggerEditors: boolean; workspace?: string }
 	let { onUpdate, mountTriggerEditors, workspace: triggerWorkspace }: Props = $props()
 
-	// Register the trigger-workspace resolver for the whole editor subtree (the
-	// nine editors + the delete handler below). See triggerWorkspace.ts.
-	setTriggerWorkspace(() => triggerWorkspace ?? $workspaceStore)
+	// The nine editors below act on this workspace (see operatingWorkspace.svelte.ts).
+	setOperatingWorkspace(() => triggerWorkspace)
 
 	let kafkaEditor: KafkaTriggerEditor | undefined = $state()
 	let mqttEditor: MqttTriggerEditor | undefined = $state()
@@ -127,7 +128,7 @@
 	}
 
 	async function confirmDeleteAttachedTrigger() {
-		const workspace = triggerWorkspace ?? $workspaceStore
+		const workspace = triggerWorkspace ?? $operatingWorkspace
 		if (!triggerDeleteTarget || !workspace) return
 		const { kind, path: triggerPath } = triggerDeleteTarget
 		triggerDeleteLoading = true
diff --git a/frontend/src/lib/components/assets/AssetGraph/RunnableNode.svelte b/frontend/src/lib/components/assets/AssetGraph/RunnableNode.svelte
index c260bc2e5b..c4cb5ca998 100644
--- a/frontend/src/lib/components/assets/AssetGraph/RunnableNode.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/RunnableNode.svelte
@@ -28,7 +28,9 @@
 	import DropdownV2 from '$lib/components/DropdownV2.svelte'
 	import Popover from '$lib/components/meltComponents/Popover.svelte'
 	import type { Item } from '$lib/utils'
-	import { workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 	import { sendUserToast, msToReadableTimeShort } from '$lib/utils'
 
 	interface Props {
@@ -129,7 +131,7 @@
 
 	async function runSelf(e: MouseEvent, cascade?: boolean) {
 		e.stopPropagation()
-		if (!$workspaceStore || running || !data.onRunSelf) return
+		if (!$operatingWorkspace || running || !data.onRunSelf) return
 		running = true
 		try {
 			await data.onRunSelf(cascade != undefined ? { cascade } : undefined)
diff --git a/frontend/src/lib/components/assets/AssetsDropdownButton.svelte b/frontend/src/lib/components/assets/AssetsDropdownButton.svelte
index 3ed8690079..d701ec9d4f 100644
--- a/frontend/src/lib/components/assets/AssetsDropdownButton.svelte
+++ b/frontend/src/lib/components/assets/AssetsDropdownButton.svelte
@@ -14,7 +14,6 @@
 	} from './lib'
 	import { untrack } from 'svelte'
 	import { ResourceService, WorkspaceService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import Tooltip from '../meltComponents/Tooltip.svelte'
 	import Tooltip2 from '../Tooltip.svelte'
 	import ResourceEditorDrawer from '../ResourceEditorDrawer.svelte'
@@ -23,6 +22,9 @@
 	import ToggleButtonGroup from '../common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '../common/toggleButton-v2/ToggleButton.svelte'
 	import { resource } from 'runed'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let {
 		assets,
@@ -61,12 +63,12 @@
 	})
 
 	let datatables = resource([], () =>
-		WorkspaceService.listDataTables({ workspace: $workspaceStore ?? '' }).then((d) =>
+		WorkspaceService.listDataTables({ workspace: $operatingWorkspace ?? '' }).then((d) =>
 			d.map((d) => d.name)
 		)
 	)
 	let ducklakes = resource([], () =>
-		WorkspaceService.listDucklakes({ workspace: $workspaceStore ?? '' })
+		WorkspaceService.listDucklakes({ workspace: $operatingWorkspace ?? '' })
 	)
 
 	$effect(() => {
@@ -88,7 +90,7 @@
 					let truncatedPath = asset.path.split('?table=')[0]
 					if (truncatedPath in resourceDataCache) continue
 					resourceDataCache[truncatedPath] = undefined // avoid fetching multiple times because of async
-					ResourceService.getResource({ path: truncatedPath, workspace: $workspaceStore! })
+					ResourceService.getResource({ path: truncatedPath, workspace: $operatingWorkspace! })
 						.then((r) => (resourceDataCache[truncatedPath] = r.resource_type))
 						.catch((err) => console.error("Couldn't fetch resource", truncatedPath, err))
 				}
diff --git a/frontend/src/lib/components/assets/JobAssetsViewer.svelte b/frontend/src/lib/components/assets/JobAssetsViewer.svelte
index 45bc4cd70f..8b99cadbd1 100644
--- a/frontend/src/lib/components/assets/JobAssetsViewer.svelte
+++ b/frontend/src/lib/components/assets/JobAssetsViewer.svelte
@@ -1,7 +1,6 @@
 <script lang="ts">
 	import { JobService, ResourceService, ScriptService, type Job } from '$lib/gen'
 	import { inferAssets } from '$lib/infer'
-	import { workspaceStore } from '$lib/stores'
 	import { usePromise } from '$lib/svelte5Utils.svelte'
 	import { pruneNullishArray, uniqueBy } from '$lib/utils'
 	import { Skeleton } from '../common'
@@ -15,6 +14,9 @@
 		parseInputArgsAssets,
 		type AssetWithAccessType
 	} from './lib'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	type Props = {
 		job: Job
@@ -56,9 +58,9 @@
 	async function fetchRuntimeAssets(
 		job: Job
 	): Promise<{ assets: AssetWithAccessType[]; truncated: boolean }> {
-		if (!$workspaceStore) return { assets: [], truncated: false }
+		if (!$operatingWorkspace) return { assets: [], truncated: false }
 		return await JobService.listRunAssets({
-			workspace: $workspaceStore,
+			workspace: $operatingWorkspace,
 			id: job.id
 		}).catch((err) => {
 			console.error("Couldn't fetch runtime assets of job", job.id, err)
@@ -83,9 +85,9 @@
 
 		if (job.job_kind === 'script') {
 			let code = job.raw_code
-			if (!code && job.script_hash && $workspaceStore) {
+			if (!code && job.script_hash && $operatingWorkspace) {
 				const script = await ScriptService.getScriptByHash({
-					workspace: $workspaceStore,
+					workspace: $operatingWorkspace,
 					hash: job.script_hash
 				})
 				code = script.content
@@ -100,7 +102,7 @@
 	let assets = usePromise(() => extractAssets(job), { loadInit: false })
 	$effect(() => {
 		job.id
-		$workspaceStore
+		$operatingWorkspace
 		assets.refresh()
 	})
 
@@ -111,7 +113,7 @@
 				let truncatedPath = asset.path.split('?table=')[0]
 				if (truncatedPath in resourceDataCache) continue
 				resourceDataCache[truncatedPath] = undefined // avoid fetching multiple times because of async
-				ResourceService.getResource({ path: truncatedPath, workspace: $workspaceStore! })
+				ResourceService.getResource({ path: truncatedPath, workspace: $operatingWorkspace! })
 					.then((r) => (resourceDataCache[truncatedPath] = r.resource_type))
 					.catch((err) => console.error("Couldn't fetch resource", truncatedPath, err))
 			}
diff --git a/frontend/src/lib/components/auditLogs/AuditLogsFilters.svelte b/frontend/src/lib/components/auditLogs/AuditLogsFilters.svelte
index 96d341dc72..4090a39dbb 100644
--- a/frontend/src/lib/components/auditLogs/AuditLogsFilters.svelte
+++ b/frontend/src/lib/components/auditLogs/AuditLogsFilters.svelte
@@ -149,6 +149,7 @@
 		JOBS: 'jobs',
 		JOBS_CANCEL: 'jobs.cancel',
 		JOBS_FORCE_CANCEL: 'jobs.force_cancel',
+		JOBS_RUN_NOW: 'jobs.run_now',
 		JOBS_DISAPPROVAL: 'jobs.disapproval',
 		JOBS_DELETE: 'jobs.delete',
 		JOBS_SHARE_PUBLICLY: 'jobs.share_publicly',
diff --git a/frontend/src/lib/components/common/actionRow/ActionRow.svelte b/frontend/src/lib/components/common/actionRow/ActionRow.svelte
index 811137d5dd..5a38513028 100644
--- a/frontend/src/lib/components/common/actionRow/ActionRow.svelte
+++ b/frontend/src/lib/components/common/actionRow/ActionRow.svelte
@@ -42,7 +42,7 @@
 				{@render middle?.()}
 			{/if}
 		</div>
-		<div class="flex flex-wrap items-center gap-2 lg:gap-4">
+		<div class="flex flex-wrap items-center gap-2">
 			{#if right}
 				{@render right?.()}
 			{/if}
diff --git a/frontend/src/lib/components/common/alert/Alert.svelte b/frontend/src/lib/components/common/alert/Alert.svelte
index c3d86693be..e4cdd7bd7d 100644
--- a/frontend/src/lib/components/common/alert/Alert.svelte
+++ b/frontend/src/lib/components/common/alert/Alert.svelte
@@ -71,7 +71,9 @@
 	style={bgStyle}
 >
 	<div class="flex flex-row items-center">
-		<div class="flex h-8 w-8 items-center justify-center rounded-full">
+		<!-- shrink-0: the badge's min-content width is the 16px icon, so without it a
+		     narrow container squeezes the circle into an oval. -->
+		<div class="flex h-8 w-8 shrink-0 items-center justify-center rounded-full">
 			<SvelteComponent
 				class={twMerge(classes[type].iconClass, iconClass)}
 				style={iconStyle}
diff --git a/frontend/src/lib/components/common/confirmationModal/ConfirmationModal.svelte b/frontend/src/lib/components/common/confirmationModal/ConfirmationModal.svelte
index c858f9f08f..524817ba34 100644
--- a/frontend/src/lib/components/common/confirmationModal/ConfirmationModal.svelte
+++ b/frontend/src/lib/components/common/confirmationModal/ConfirmationModal.svelte
@@ -172,7 +172,11 @@
 				<div class="flex min-h-full items-center justify-center p-4">
 					<div
 						class={classNames(
-							'relative transform overflow-hidden rounded-lg bg-surface px-4 pt-5 pb-4 text-left shadow-xl transition-all sm:my-8 sm:w-full sm:max-w-lg sm:p-6',
+							// `w-full max-w-lg` unprefixed, not `sm:`-only: below 640px the panel would
+							// otherwise be sized by its content's min-content width, and since the
+							// wrapper centres it without scrolling, anything wider than the viewport
+							// gets clipped on both sides with the left half unreachable.
+							'relative transform overflow-hidden rounded-lg bg-surface px-4 pt-5 pb-4 text-left shadow-xl transition-all w-full max-w-lg sm:my-8 sm:p-6',
 							open
 								? 'ease-out duration-300 opacity-100 translate-y-0 sm:scale-100'
 								: 'ease-in duration-200 opacity-0 translate-y-4 sm:translate-y-0 sm:scale-95'
@@ -180,13 +184,21 @@
 					>
 						<div class="flex">
 							{#if showIcon}
+								<!-- shrink-0: the badge is a flex item whose min-content width is the
+								     24px icon, so without it a narrow dialog squeezes the circle into a
+								     24x48 oval instead of wrapping the text beside it. -->
 								<div
-									class={`flex h-12 w-12 items-center justify-center rounded-full ${theme[type].classes.iconWrapper}`}
+									class={`flex h-12 w-12 shrink-0 items-center justify-center rounded-full ${theme[type].classes.iconWrapper}`}
 								>
 									<Icon class={theme[type].classes.icon} />
 								</div>
 							{/if}
-							<div class={twMerge('ml-0 text-left flex-1 ', showIcon ? 'ml-4' : '')}>
+							<!-- min-w-0: `flex-1` alone keeps `min-width: auto`, so a body containing
+							     one long unbreakable string (a path list, a URL) sizes this column by
+							     that string and pushes it out of the panel — and any `truncate` inside
+							     never engages. -->
+
+							<div class={twMerge('ml-0 text-left flex-1 min-w-0', showIcon ? 'ml-4' : '')}>
 								<h3 class="text-lg font-medium text-primary">
 									{title}
 								</h3>
diff --git a/frontend/src/lib/components/common/confirmationModal/DeployOverrideConfirmationModal.svelte b/frontend/src/lib/components/common/confirmationModal/DeployOverrideConfirmationModal.svelte
index 8d41fff902..bd830de1b7 100644
--- a/frontend/src/lib/components/common/confirmationModal/DeployOverrideConfirmationModal.svelte
+++ b/frontend/src/lib/components/common/confirmationModal/DeployOverrideConfirmationModal.svelte
@@ -11,6 +11,15 @@
 		confirmCallback: () => void
 		deployedBy?: string | undefined
 		open?: boolean
+		/** Takes a drawer opening on the host editor's behalf, so the diff below is one the
+		 *  editor can take back down. Override anyway deploys that editor's content: without
+		 *  this the drawer would outlive it (a relocation remounts the editor) and deploy it
+		 *  at a path it has left. Omit where the host cannot be remounted under the drawer. */
+		claimOpening?: () => number | undefined
+		/** The host could not read the deployed head, so this confirmation is caution rather
+		 *  than an observed newer version: nobody may have deployed over the user, and
+		 *  `deployedBy` is then whoever wrote the head, possibly themselves. */
+		headUnknown?: boolean
 	}
 
 	let {
@@ -19,13 +28,15 @@
 		diffDrawer = undefined,
 		confirmCallback,
 		deployedBy = undefined,
-		open = $bindable(false)
+		open = $bindable(false),
+		claimOpening = undefined,
+		headUnknown = false
 	}: Props = $props()
 </script>
 
 <ConfirmationModal
 	{open}
-	title={'New version deployed by ' + deployedBy}
+	title={headUnknown ? 'Deploy anyway?' : 'New version deployed by ' + deployedBy}
 	confirmationText="Override"
 	on:canceled={() => {
 		open = false
@@ -33,7 +44,11 @@
 	on:confirmed={() => confirmCallback()}
 >
 	<div class="flex flex-col w-full space-y-4">
-		<span>A new version was deployed while you were editing this one.</span>
+		<span>
+			{headUnknown
+				? 'This editor could not check whether a newer version is deployed, so it cannot tell whether this overwrites newer work.'
+				: 'A new version was deployed while you were editing this one.'}
+		</span>
 		{#if diffDrawer}
 			<Button
 				wrapperClasses="self-start"
@@ -44,17 +59,21 @@
 						return
 					}
 					open = false
-					diffDrawer?.openDrawer()
-					diffDrawer?.setDiff({
-						mode: 'simple',
-						original: deployedValue,
-						current: currentValue,
-						title: 'Deployed <> Current',
-						button: {
-							text: 'Override anyway',
-							onClick: () => confirmCallback()
-						}
-					})
+					const opening = claimOpening?.()
+					diffDrawer?.openDrawer(opening)
+					diffDrawer?.setDiff(
+						{
+							mode: 'simple',
+							original: deployedValue,
+							current: currentValue,
+							title: 'Deployed <> Current',
+							button: {
+								text: 'Override anyway',
+								onClick: () => confirmCallback()
+							}
+						},
+						opening
+					)
 				}}
 				>Show diff
 			</Button>
diff --git a/frontend/src/lib/components/common/confirmationModal/DraftChangesConfirmationModal.svelte b/frontend/src/lib/components/common/confirmationModal/DraftChangesConfirmationModal.svelte
index dadf814a80..5a51b4cfba 100644
--- a/frontend/src/lib/components/common/confirmationModal/DraftChangesConfirmationModal.svelte
+++ b/frontend/src/lib/components/common/confirmationModal/DraftChangesConfirmationModal.svelte
@@ -9,9 +9,12 @@
 	import { Bot, Star } from 'lucide-svelte'
 	import ToggleButtonGroup from '../toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '../toggleButton-v2/ToggleButton.svelte'
-	import { userStore } from '$lib/stores'
 	import Badge from '../badge/Badge.svelte'
 	import type { LinkedAgentDraft } from '$lib/components/flows/linkedAgentDrafts'
+	import { useOperatingUser } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	interface Props {
 		open?: boolean
@@ -80,8 +83,8 @@
 		// Creating http trigger is forbidden for non-admin users
 		const adminOnly =
 			trigger.type === 'http' &&
-			!$userStore?.is_admin &&
-			!$userStore?.is_super_admin &&
+			!actingUser?.is_admin &&
+			!actingUser?.is_super_admin &&
 			trigger.isDraft
 
 		const invalidConfig = !trigger.draftConfig?.canSave
diff --git a/frontend/src/lib/components/common/confirmationModal/DraftEditorModals.svelte b/frontend/src/lib/components/common/confirmationModal/DraftEditorModals.svelte
index 26366325b5..20c29286b5 100644
--- a/frontend/src/lib/components/common/confirmationModal/DraftEditorModals.svelte
+++ b/frontend/src/lib/components/common/confirmationModal/DraftEditorModals.svelte
@@ -13,6 +13,10 @@
 	import type { UserDraftItemKind } from '$lib/gen'
 	import DraftSyncConflictModal from './DraftSyncConflictModal.svelte'
 	import OtherUsersDraftsModal, { type OtherDraftUser } from './OtherUsersDraftsModal.svelte'
+	import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
+	import { sendUserToast } from '$lib/toast'
+	import { base } from '$app/paths'
+	import { goto } from '$app/navigation'
 	import StaleDraftModal from './StaleDraftModal.svelte'
 	import ConfirmationModal from './ConfirmationModal.svelte'
 	import { OtherUserDraftLoad } from '$lib/components/otherUserDraftLoad.svelte'
@@ -38,15 +42,27 @@
 		draftSavedAt?: string | undefined
 		/** ISO timestamp of the latest deploy at this path. */
 		deployedAt?: string | undefined
-		/** Precise staleness inputs (flows/apps): the deployed version the draft was
-		 *  forked from, and the current deployed head. When both are set they drive
-		 *  `isStale` and the dedup key instead of the timestamps — exact, and stable
-		 *  across autosaves (the timestamp drifts past `deployedAt` as you keep
-		 *  editing). Absent (pre-feature drafts, scripts) ⇒ timestamp fallback. */
-		draftBaseVersion?: number | undefined
-		deployedHeadVersion?: number | undefined
+		/** Precise staleness inputs: the deployed version the draft forked from
+		 *  (`draft_base` on the get-by-path response) and the current deployed head,
+		 *  both as text whatever the kind. When both are set they drive `isStale` and
+		 *  the dedup key instead of the timestamps, which drift past `deployedAt` as
+		 *  you keep editing. Absent (a draft never forked from a deploy) ⇒ timestamp
+		 *  fallback. */
+		draftBaseVersion?: string | undefined
+		deployedHeadVersion?: string | undefined
+		/** Who deployed the head, named in the stale prompt. */
+		deployedBy?: string | undefined
 		/** Discard the draft and reload deployed (same as "Reset to deployed"). */
 		onLoadLatestDeploy?: () => void | Promise<void>
+		/** Opens the editor's Deployed↔Current diff from the stale prompt, so the
+		 *  choice between keeping and discarding is informed. Omit where the editor
+		 *  has no diff drawer; the action is then not rendered. */
+		onViewDiff?: () => void | Promise<void>
+		/** Runs before this editor follows its draft to the item's new path: the
+		 *  editor's own draft save, which materializes text the code editor still
+		 *  holds. Without it, keystrokes typed since the relocating save are lost
+		 *  to the navigation. */
+		onBeforeRelocate?: () => void | Promise<void>
 		/** Defaults to true; set to false to suppress all modals. */
 		enabled?: boolean
 	}
@@ -65,7 +81,10 @@
 		deployedAt = undefined,
 		draftBaseVersion = undefined,
 		deployedHeadVersion = undefined,
+		deployedBy = undefined,
 		onLoadLatestDeploy,
+		onViewDiff,
+		onBeforeRelocate,
 		enabled = true
 	}: Props = $props()
 
@@ -74,9 +93,9 @@
 	let staleAlertKey = $state<string | undefined>(undefined)
 	let staleModalOpen = $state(false)
 
-	// Prefer the exact version comparison (flows/apps) over the timestamp: the
-	// draft's pinned fork base never drifts, whereas `draftSavedAt` advances past
-	// `deployedAt` once you keep editing a stale draft, hiding the staleness.
+	// Prefer the version comparison over the timestamp for every kind that supplies
+	// one: `draftSavedAt` advances past `deployedAt` as you keep editing, hiding the
+	// staleness outright.
 	const useVersion = $derived(draftBaseVersion != null && deployedHeadVersion != null)
 	const isStale = $derived(
 		!!onLoadLatestDeploy &&
@@ -105,6 +124,48 @@
 			}
 		})
 	})
+
+	const EDITOR_SEGMENT: Partial<Record<UserDraftItemKind, string>> = {
+		script: 'scripts/edit',
+		flow: 'flows/edit',
+		app: 'apps/edit',
+		raw_app: 'apps_raw/edit'
+	}
+
+	// The item was moved while this editor was open: the draft row followed it
+	// and the save just landed there. Follow it too — the route reloads the item
+	// at its new path, and the stale prompt above then says what changed. Edits
+	// typed since that save are flushed first, so leaving this path drops none.
+	$effect(() => {
+		if (!enabled || !workspace || !path) return
+		const seg = EDITOR_SEGMENT[itemKind]
+		if (!seg) return
+		const query = { workspace, itemKind, path }
+		// The flush below saves again and can land here a second time, and a second move
+		// can land while it runs: the last destination reported is the one to follow.
+		let relocating = false
+		let destination: string | undefined = undefined
+		return UserDraftDbSyncer.onRelocated(query, async (newPath) => {
+			destination = newPath
+			if (relocating) return
+			relocating = true
+			await onBeforeRelocate?.()
+			await UserDraftDbSyncer.flush(query)
+			// `flush` resolves on a failed or rejected save as well, and leaving the
+			// route drops what it was carrying: stay, so the editor keeps the edits
+			// and its own failure indicator.
+			if (
+				UserDraftDbSyncer.getState(query).failureMessage ||
+				UserDraftDbSyncer.getConflict(query).conflict
+			) {
+				relocating = false
+				return
+			}
+			const target = destination ?? newPath
+			sendUserToast(`This item was moved to ${target}. You are now editing it there.`)
+			await goto(`${base}/${seg}/${target}`)
+		})
+	})
 </script>
 
 {#if enabled && workspace && path}
@@ -130,9 +191,14 @@
 	{#if onLoadLatestDeploy}
 		<StaleDraftModal
 			bind:isOpen={staleModalOpen}
+			{itemKind}
 			{draftSavedAt}
 			{deployedAt}
+			{draftBaseVersion}
+			{deployedHeadVersion}
+			{deployedBy}
 			{onLoadLatestDeploy}
+			{onViewDiff}
 		/>
 	{/if}
 	<ConfirmationModal
diff --git a/frontend/src/lib/components/common/confirmationModal/StaleDraftModal.svelte b/frontend/src/lib/components/common/confirmationModal/StaleDraftModal.svelte
index cc027c6f12..9f4939eb2b 100644
--- a/frontend/src/lib/components/common/confirmationModal/StaleDraftModal.svelte
+++ b/frontend/src/lib/components/common/confirmationModal/StaleDraftModal.svelte
@@ -1,41 +1,66 @@
 <script lang="ts">
 	/**
-	 * Modal opened on editor mount when the authed user's per-user draft
-	 * is older than the latest deployed version at the same path — i.e.
-	 * someone else deployed a new version while the draft was sitting
-	 * around. The user is asked to either pick up the latest deploy
-	 * (discards the stale draft) or keep editing what they had.
-	 *
-	 * The parent threads `draftSavedAt` and `deployedAt` raw and the
-	 * modal computes staleness internally; this keeps each route from
-	 * re-implementing the comparison and the threshold (we treat a
-	 * draft as stale only when it's strictly older — a deploy at the
-	 * exact same instant is treated as not stale).
+	 * The prompt for a draft that is behind: someone deployed a newer version
+	 * of the item after the draft forked from it. Opened on every load while
+	 * that holds (the parent computes it; see DraftEditorModals), it names the
+	 * two versions and offers two ways out: look at the diff, or drop the draft
+	 * for the latest deploy. Closing it is "keep editing". Taking the latest as
+	 * the new base while keeping the edits lives in the diff drawer, where the
+	 * user can see what they are taking.
 	 *
 	 * Open-state is bindable so the parent can dismiss programmatically
 	 * (e.g. after the load-latest-deploy callback completes).
 	 */
 	import Modal2 from '$lib/components/common/modal/Modal2.svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
-	import { AlertTriangle } from 'lucide-svelte'
+	import { AlertTriangle, GitCompare } from 'lucide-svelte'
 	import { sendUserToast } from '$lib/toast'
+	import type { UserDraftItemKind } from '$lib/gen'
 
 	type Props = {
 		isOpen: boolean
-		/** ISO timestamp the authed user's draft was saved. */
+		itemKind: UserDraftItemKind
+		/** ISO timestamp the authed user's draft was saved. Shown only when the
+		 *  versions below are unknown (a draft that predates the base). */
 		draftSavedAt: string | undefined
 		/** ISO timestamp the latest deploy at this path landed. */
 		deployedAt: string | undefined
+		/** The version the draft forked from and the deployed head, as text. */
+		draftBaseVersion?: string | undefined
+		deployedHeadVersion?: string | undefined
+		/** Who deployed the head. */
+		deployedBy?: string | undefined
 		/** Discards the draft and reloads the deployed payload — the route
 		 *  already has this callback for the AutosaveIndicator's "Reset to
 		 *  deployed" button; pass the same function in. */
 		onLoadLatestDeploy: () => void | Promise<void>
+		/** Opens the editor's own Deployed↔Current diff. Without it the user is
+		 *  asked to choose between keeping and discarding their draft with no way
+		 *  to see what actually differs — and after a rename the difference is
+		 *  often only the path. Omitted where the editor has no diff drawer. */
+		onViewDiff?: () => void | Promise<void>
 	}
 
-	let { isOpen = $bindable(), draftSavedAt, deployedAt, onLoadLatestDeploy }: Props = $props()
+	let {
+		isOpen = $bindable(),
+		itemKind,
+		draftSavedAt,
+		deployedAt,
+		draftBaseVersion = undefined,
+		deployedHeadVersion = undefined,
+		deployedBy = undefined,
+		onLoadLatestDeploy,
+		onViewDiff
+	}: Props = $props()
 
 	let loading = $state(false)
 
+	// Scripts are versioned by hash, the other kinds by a numeric version id;
+	// the diff picker renders them the same way.
+	function formatVersion(v: string): string {
+		return itemKind === 'script' ? v.slice(0, 8) : v
+	}
+
 	async function loadLatestDeploy() {
 		if (loading) return
 		loading = true
@@ -49,6 +74,13 @@
 		}
 	}
 
+	// Dismisses on the way out: the diff drawer opens behind this modal, so
+	// leaving it up would cover the thing the user asked to see.
+	async function viewDiff() {
+		isOpen = false
+		await onViewDiff?.()
+	}
+
 	function formatTs(ts: string | undefined): string {
 		if (!ts) return ''
 		try {
@@ -64,22 +96,38 @@
 		<div class="flex gap-3 items-start">
 			<AlertTriangle size={20} class="text-amber-500 shrink-0 mt-0.5" />
 			<div class="flex flex-col gap-1 text-sm text-primary">
-				<p>
-					A newer version was deployed after you started editing. Your draft is based on the older
-					deploy.
-				</p>
-				<p class="text-xs text-secondary">
-					Draft saved {formatTs(draftSavedAt)} · Deployed {formatTs(deployedAt)}
-				</p>
+				<p>A newer version was deployed after you started editing.</p>
+				{#if draftBaseVersion && deployedHeadVersion}
+					<p class="text-xs text-secondary">
+						Your draft is based on <span class="font-mono">{formatVersion(draftBaseVersion)}</span>
+						· latest is <span class="font-mono">{formatVersion(deployedHeadVersion)}</span>
+						{#if deployedBy}by {deployedBy}{/if}{#if deployedAt}, {formatTs(deployedAt)}{/if}
+					</p>
+				{:else}
+					<p class="text-xs text-secondary">
+						Draft saved {formatTs(draftSavedAt)} · Deployed {formatTs(deployedAt)}
+					</p>
+				{/if}
 			</div>
 		</div>
 
-		<div class="flex justify-end gap-2 mt-2">
-			<Button variant="default" size="sm" on:click={() => (isOpen = false)}>
-				Keep editing my draft
-			</Button>
-			<Button variant="contained" color="dark" size="sm" {loading} on:click={loadLatestDeploy}>
-				Load latest deploy
+		<div class="flex justify-between items-center gap-2 mt-2">
+			{#if onViewDiff}
+				<Button
+					variant="subtle"
+					unifiedSize="sm"
+					startIcon={{ icon: GitCompare }}
+					on:click={viewDiff}
+				>
+					See what changed
+				</Button>
+			{:else}
+				<div></div>
+			{/if}
+			<!-- Red: this replaces the draft with the latest deploy. Closing the modal
+			     is "keep editing", so it needs no button of its own. -->
+			<Button variant="accent" destructive unifiedSize="sm" {loading} on:click={loadLatestDeploy}>
+				Use latest
 			</Button>
 		</div>
 	</div>
diff --git a/frontend/src/lib/components/common/drawer/Disposable.svelte b/frontend/src/lib/components/common/drawer/Disposable.svelte
index 642d1366f6..886c14042b 100644
--- a/frontend/src/lib/components/common/drawer/Disposable.svelte
+++ b/frontend/src/lib/components/common/drawer/Disposable.svelte
@@ -71,6 +71,16 @@
 		}
 	}
 
+	// The entry follows the prop for as long as the overlay is open: a dialog opened before
+	// the AI chat still has to rise above it when the chat is opened underneath it.
+	$effect(() => {
+		const wanted = open && minZIndex > 0 ? minZIndex : undefined
+		untrack(() => {
+			if (wanted !== undefined) minZIndexEntries[id] = wanted
+			else delete minZIndexEntries[id]
+		})
+	})
+
 	// A disposable can be unmounted while still open, by an ancestor that tears its whole
 	// subtree down. Its id would then sit on the stack forever, and since the topmost entry
 	// arbitrates Escape, every overlay opened afterwards would stop answering it.
@@ -84,10 +94,10 @@
 		offset = initialOffset
 		if (stack.val.includes(id)) {
 			stack.val = stack.val.filter((drawer) => drawer !== id)
-			if (minZIndex > 0) {
-				delete minZIndexEntries[id]
-			}
 		}
+		// Unconditionally: `minZIndex` may have fallen to 0 since the entry was written (the
+		// chat closed), and a leftover entry keeps every later overlay elevated for good.
+		delete minZIndexEntries[id]
 	}
 
 	export function isOpen() {
diff --git a/frontend/src/lib/components/common/drawer/DrawerContent.svelte b/frontend/src/lib/components/common/drawer/DrawerContent.svelte
index ed2ed68519..9664f3a27e 100644
--- a/frontend/src/lib/components/common/drawer/DrawerContent.svelte
+++ b/frontend/src/lib/components/common/drawer/DrawerContent.svelte
@@ -30,6 +30,8 @@
 		 * the content hug it with tight top padding; new entities keep normal padding.
 		 */
 		bannerReserved?: boolean
+		/** For content rendered in place of a drawer, which has nothing to close. */
+		hideClose?: boolean
 		children?: import('svelte').Snippet
 	}
 
@@ -50,6 +52,7 @@
 		titleExtra,
 		banner,
 		bannerReserved = false,
+		hideClose = false,
 		children
 	}: Props = $props()
 
@@ -69,19 +72,26 @@
 	)}
 	{id}
 >
-	<div class="flex justify-between w-full items-center pl-2 pr-4 py-2 gap-2">
+	<div
+		class={classNames(
+			'flex justify-between w-full items-center pr-4 py-2 gap-2',
+			hideClose ? 'pl-4' : 'pl-2'
+		)}
+	>
 		<div class="flex items-center gap-2 w-full truncate">
-			<div
-				use:triggerableByAI={{
-					id: `close-${aiId}`,
-					description: `Close ${aiDescription}`,
-					callback: () => {
-						dispatch('close')
-					}
-				}}
-			>
-				<CloseButton on:close Icon={CloseIcon} id="{id}-close-btn" />
-			</div>
+			{#if !hideClose}
+				<div
+					use:triggerableByAI={{
+						id: `close-${aiId}`,
+						description: `Close ${aiDescription}`,
+						callback: () => {
+							dispatch('close')
+						}
+					}}
+				>
+					<CloseButton on:close Icon={CloseIcon} id="{id}-close-btn" />
+				</div>
+			{/if}
 			<span class="font-semibold text-emphasis truncate text-lg max-w-sm"
 				>{title ?? ''}
 				{#if tooltip != '' || documentationLink}
diff --git a/frontend/src/lib/components/common/fileDownload/FileDownload.svelte b/frontend/src/lib/components/common/fileDownload/FileDownload.svelte
index 8d6529764b..c1a29fae70 100644
--- a/frontend/src/lib/components/common/fileDownload/FileDownload.svelte
+++ b/frontend/src/lib/components/common/fileDownload/FileDownload.svelte
@@ -1,8 +1,10 @@
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import { Download } from 'lucide-svelte'
 	import { base } from '$lib/base'
 	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		s3object: any
@@ -12,7 +14,7 @@
 
 	let { s3object, workspaceId = undefined, appPath = undefined }: Props = $props()
 
-	let workspace = $derived(workspaceId ?? $workspaceStore)
+	let workspace = $derived(workspaceId ?? $operatingWorkspace)
 	let filename = $derived(s3object?.s3?.split?.('/')?.pop() ?? 'unnamed_download.file')
 
 	let apiPath = $derived(
diff --git a/frontend/src/lib/components/common/fileUpload/FileUpload.svelte b/frontend/src/lib/components/common/fileUpload/FileUpload.svelte
index dfe5c158cc..0a25745ac9 100644
--- a/frontend/src/lib/components/common/fileUpload/FileUpload.svelte
+++ b/frontend/src/lib/components/common/fileUpload/FileUpload.svelte
@@ -4,7 +4,6 @@
 
 	import Button from '$lib/components/common/button/Button.svelte'
 	import { sendUserToast } from '$lib/toast'
-	import { workspaceStore } from '$lib/stores'
 	import { AppService, HelpersService } from '$lib/gen'
 	import { OpenAPI } from '$lib/gen/core/OpenAPI'
 	import { writable, type Writable } from 'svelte/store'
@@ -12,6 +11,9 @@
 	import { twMerge } from 'tailwind-merge'
 	import { createEventDispatcher, onDestroy } from 'svelte'
 	import { emptyString } from '$lib/utils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		acceptedFileTypes?: string[] | undefined
@@ -237,7 +239,7 @@
 
 		try {
 			// const response = await HelpersService.multipartFileUpload({
-			// 	workspace: $workspaceStore!,
+			// 	workspace: $operatingWorkspace!,
 			// 	fileKey: path,
 			// 	fileExtension: fileExtension,
 			// 	s3ResourcePath: customS3ResourcePath?.split(':')[1],
@@ -280,7 +282,7 @@
 			}
 
 			// let response = await fetch(
-			// 	`/api/w/${$workspaceStore}/job_helpers/multipart_upload_s3_file?${params.toString()}`,
+			// 	`/api/w/${$operatingWorkspace}/job_helpers/multipart_upload_s3_file?${params.toString()}`,
 			// 	{
 			// 		method: 'POST',
 			// 		headers: {
@@ -327,10 +329,10 @@
 					'POST',
 					appPath
 						? `/api/w/${
-								workspace ?? $workspaceStore
+								workspace ?? $operatingWorkspace
 							}/apps_u/upload_s3_file/${appPath}?${params.toString()}`
 						: `/api/w/${
-								workspace ?? $workspaceStore
+								workspace ?? $operatingWorkspace
 							}/job_helpers/upload_s3_file?${params.toString()}`,
 					true
 				)
@@ -376,12 +378,12 @@
 		try {
 			if (deleteToken) {
 				await AppService.deleteS3FileFromApp({
-					workspace: workspace ?? $workspaceStore!,
+					workspace: workspace ?? $operatingWorkspace!,
 					deleteToken: deleteToken
 				})
 			} else {
 				await HelpersService.deleteS3File({
-					workspace: workspace ?? $workspaceStore!,
+					workspace: workspace ?? $operatingWorkspace!,
 					fileKey: fileKey
 				})
 			}
diff --git a/frontend/src/lib/components/common/modal/Modal2.svelte b/frontend/src/lib/components/common/modal/Modal2.svelte
index b9e57740b9..6d7c8fdd0f 100644
--- a/frontend/src/lib/components/common/modal/Modal2.svelte
+++ b/frontend/src/lib/components/common/modal/Modal2.svelte
@@ -10,6 +10,9 @@
 	import { fade } from 'svelte/transition'
 	import { zIndexes } from '$lib/zIndexes'
 	import { chatState } from '$lib/components/copilot/chat/sharedChatState.svelte'
+	import Disposable from '../drawer/Disposable.svelte'
+	import { overlayHostActive, setTopmostSurface } from '../overlayHost.svelte'
+	import { untrack } from 'svelte'
 
 	interface Props {
 		title: string
@@ -30,6 +33,9 @@
 		 * window, so a stacked pair would both close on one press; set it
 		 * false on the underlying modal while its child is up. */
 		closeOnEscape?: boolean
+		/** Blocks every way out — the header ✕, Escape and an outside click — for a dialog
+		 * holding work in flight that a dismissal would orphan. */
+		preventDismiss?: boolean
 		/** Wider side padding and a lighter title, for a dialog whose body is a form rather
 		 *  than a list. Opt-in: every other Modal2 keeps the padding and heading it had. */
 		formStyling?: boolean
@@ -51,10 +57,11 @@
 		contentClasses = '',
 		closeOnOutsideClick = true,
 		closeOnEscape = true,
+		preventDismiss = false,
 		formStyling = false,
 		headerLeft,
 		headerRight,
-		children
+		children: body
 	}: Props = $props()
 
 	const widthMap = {
@@ -84,8 +91,30 @@
 		isOpen = true
 	}
 
+	// Registered in the disposable stack so a drawer opened from inside the dialog (a
+	// resource picker's editor) stacks above it, and so Escape and outside clicks aimed
+	// at that drawer do not close the dialog underneath.
+	let disposable: Disposable | undefined = $state(undefined)
+	const hostActive = overlayHostActive()
+	setTopmostSurface(() => disposable?.isTopmost() ?? true)
+	$effect(() => {
+		isOpen
+		untrack(() => (isOpen ? disposable?.openDrawer() : disposable?.closeDrawer()))
+	})
+
+	/** Whether this dialog was the overlay on top when the interaction started. `clickOutside`
+	 * awaits its async `exclude` before reporting, and an overlay above closes itself in that
+	 * gap — by the time the report lands, the dialog looks topmost and would close with it. */
+	let topmostAtPress = true
+	function snapshotTopmost() {
+		topmostAtPress = disposable?.isTopmost() ?? true
+	}
+
 	function handleKeyDown(event: KeyboardEvent) {
-		if (!isOpen || !closeOnEscape) return
+		if (!isOpen || !closeOnEscape || preventDismiss) return
+		// Hidden hosts stay mounted and still receive window keys — see overlayHost.
+		if (!hostActive()) return
+		if (!(disposable?.isTopmost() ?? true)) return
 		if (event.key === 'Escape') {
 			event.preventDefault()
 			event.stopPropagation()
@@ -97,79 +126,94 @@
 		return fade(node, { duration: 200 })
 	}
 
-	// Elevate above the AI chat panel (zIndexes.aiChat) while chat is open so
-	// the dialog isn't hidden behind it; otherwise keep the default modal
-	// stacking just above disposables (zIndexes.disposables).
-	const overlayZIndex = $derived(
-		chatState.size > 0 ? zIndexes.aiChat + 1 : zIndexes.disposables + 10
-	)
+	// Elevate above the AI chat panel while chat is open so the dialog isn't hidden behind it.
+	const minZIndex = $derived(chatState.size > 0 ? zIndexes.aiChat + 1 : 0)
 </script>
 
-<svelte:window onkeydown={handleKeyDown} />
+<svelte:window
+	onkeydown={handleKeyDown}
+	onpointerdowncapture={snapshotTopmost}
+	onclickcapture={(e) => {
+		// A keyboard-activated control emits a click with no pointer event before it (`detail`
+		// 0), so the pointerdown snapshot would be whatever a previous interaction left.
+		if (e.detail === 0) snapshotTopmost()
+	}}
+/>
 
-{#if isOpen}
-	<Portal name="always-mounted" {target}>
-		<div
-			class={'fixed top-0 bottom-0 left-0 right-0 transition-all overflow-auto bg-black bg-opacity-60 w-full h-full'}
-			style="z-index: {overlayZIndex}"
-			transition:fadeFast|local
-		>
-			<div class="flex min-h-full items-center justify-center p-8">
+<Disposable bind:open={isOpen} bind:this={disposable} preventEscape {minZIndex}>
+	{#snippet children({ zIndex })}
+		{#if isOpen}
+			<Portal name="always-mounted" {target}>
 				<div
-					style={`width: ${widthMap[fixedWidth]}; ${
-						heightMap[fixedHeight] ? `height: ${heightMap[fixedHeight]}; ` : ''
-					}${css?.popup?.style || ''}`}
-					class={twMerge(
-						'max-h-screen-80 max-w-screen-80 rounded-lg relative bg-surface',
-						formStyling ? 'py-4 px-6' : 'p-4',
-						css?.popup?.class,
-						'wm-modal-form-popup'
-					)}
-					use:clickOutside={{
-						onClickOutside: () => closeOnOutsideClick && close()
-					}}
+					class={'fixed top-0 bottom-0 left-0 right-0 transition-all overflow-auto bg-black bg-opacity-60 w-full h-full'}
+					style="z-index: {zIndex}"
+					transition:fadeFast|local
 				>
-					<List gap="md">
-						<div class="flex w-full">
-							<List horizontal justify="between">
-								<h3 class={formStyling ? 'font-semibold' : undefined}>{title}</h3>
-								<div class="grow w-min-0">
+					<div class="flex min-h-full items-center justify-center p-8">
+						<div
+							style={`width: ${widthMap[fixedWidth]}; ${
+								heightMap[fixedHeight] ? `height: ${heightMap[fixedHeight]}; ` : ''
+							}${css?.popup?.style || ''}`}
+							class={twMerge(
+								'max-h-screen-80 max-w-screen-80 rounded-lg relative bg-surface',
+								formStyling ? 'py-4 px-6' : 'p-4',
+								css?.popup?.class,
+								'wm-modal-form-popup'
+							)}
+							use:clickOutside={{
+								onClickOutside: () =>
+									closeOnOutsideClick && !preventDismiss && topmostAtPress && close(),
+								// A dropdown opened from inside the dialog portals its menu out of it, so a
+								// click on one of its items lands outside this node and would close the
+								// dialog under the menu.
+								exclude: async () =>
+									Array.from(document.querySelectorAll('[data-menu]')) as HTMLElement[]
+							}}
+						>
+							<List gap="md">
+								<div class="flex w-full">
 									<List horizontal justify="between">
-										<div class="min-w-0 grow">
-											{@render headerLeft?.()}
-										</div>
-										<div class="min-w-0 grow-0 justify-end">
-											<List horizontal justify="end">
-												{@render headerRight?.()}
-												<div class="w-8">
-													<button
-														id="modal-close-button"
-														onclick={() => {
-															close()
-														}}
-														class="hover:bg-surface-hover rounded-full w-8 h-8 flex items-center justify-center transition-all"
-													>
-														<X class="text-primary " />
-													</button>
+										<h3 class={formStyling ? 'font-semibold' : undefined}>{title}</h3>
+										<div class="grow w-min-0">
+											<List horizontal justify="between">
+												<div class="min-w-0 grow">
+													{@render headerLeft?.()}
+												</div>
+												<div class="min-w-0 grow-0 justify-end">
+													<List horizontal justify="end">
+														{@render headerRight?.()}
+														<div class="w-8">
+															<button
+																id="modal-close-button"
+																disabled={preventDismiss}
+																onclick={() => {
+																	close()
+																}}
+																class="hover:bg-surface-hover rounded-full w-8 h-8 flex items-center justify-center transition-all disabled:opacity-40 disabled:cursor-not-allowed disabled:hover:bg-transparent"
+															>
+																<X class="text-primary " />
+															</button>
+														</div>
+													</List>
 												</div>
 											</List>
 										</div>
 									</List>
 								</div>
+
+								<!-- svelte-ignore a11y_click_events_have_key_events -->
+								<!-- svelte-ignore a11y_no_static_element_interactions -->
+								<div
+									class="w-full flex grow min-h-0 {contentClasses}"
+									onclick={stopPropagation(() => {})}
+								>
+									{@render body?.()}
+								</div>
 							</List>
 						</div>
-
-						<!-- svelte-ignore a11y_click_events_have_key_events -->
-						<!-- svelte-ignore a11y_no_static_element_interactions -->
-						<div
-							class="w-full flex grow min-h-0 {contentClasses}"
-							onclick={stopPropagation(() => {})}
-						>
-							{@render children?.()}
-						</div>
-					</List>
+					</div>
 				</div>
-			</div>
-		</div>
-	</Portal>
-{/if}
+			</Portal>
+		{/if}
+	{/snippet}
+</Disposable>
diff --git a/frontend/src/lib/components/common/stepper/Stepper.svelte b/frontend/src/lib/components/common/stepper/Stepper.svelte
index de6303cedc..5b13d9ddfc 100644
--- a/frontend/src/lib/components/common/stepper/Stepper.svelte
+++ b/frontend/src/lib/components/common/stepper/Stepper.svelte
@@ -12,6 +12,9 @@
 		allowStepNavigation?: boolean
 		/** Compact variant, for steering a dialog rather than a full page. */
 		small?: boolean
+		/** Steps this run does not go through, greyed out and not clickable — a step the
+		 *  chosen path skips rather than one not reached yet. */
+		disabledIndices?: number[]
 	}
 
 	let {
@@ -21,7 +24,8 @@
 		statusByStep = [],
 		hasValidations = false,
 		allowStepNavigation = false,
-		small = false
+		small = false,
+		disabledIndices = []
 	}: Props = $props()
 
 	const dispatch = createEventDispatcher()
@@ -75,15 +79,20 @@
 		{#each tabs ?? [] as step, index}
 			<!-- svelte-ignore a11y_click_events_have_key_events -->
 			<!-- svelte-ignore a11y_no_noninteractive_element_interactions -->
+			{@const disabled = disabledIndices.includes(index)}
 			<li
 				class={classNames(
 					small
 						? 'flex items-center gap-1.5 px-1.5 py-0.5 hover:bg-gray-1200 rounded-md m-0.5'
 						: 'flex items-center gap-2 px-2 py-1 hover:bg-gray-1200 rounded-md m-0.5',
-					index <= maxReachedIndex || allowStepNavigation ? 'cursor-pointer' : 'cursor-not-allowed'
+					disabled
+						? 'cursor-not-allowed opacity-50'
+						: index <= maxReachedIndex || allowStepNavigation
+							? 'cursor-pointer'
+							: 'cursor-not-allowed'
 				)}
 				onclick={() => {
-					dispatch('click', { index })
+					if (!disabled) dispatch('click', { index })
 				}}
 			>
 				{#if statusByStep[index] === 'pending'}
@@ -94,7 +103,9 @@
 							small
 								? 'h-4 w-4 rounded-full flex items-center justify-center text-2xs'
 								: 'h-6 w-6 rounded-full flex items-center justify-center text-xs',
-							getStepColor(index, selectedIndex, statusByStep, maxReachedIndex)
+							disabled
+								? 'bg-gray-200'
+								: getStepColor(index, selectedIndex, statusByStep, maxReachedIndex)
 						)}
 						class:font-bold={selectedIndex === index}
 					>
@@ -105,7 +116,11 @@
 				<span
 					class={classNames(
 						'hidden sm:block',
-						selectedIndex === index ? 'font-semibold text-primary' : 'font-normal text-primary'
+						disabled
+							? 'font-normal text-disabled'
+							: selectedIndex === index
+								? 'font-semibold text-primary'
+								: 'font-normal text-primary'
 					)}
 				>
 					{step}
diff --git a/frontend/src/lib/components/common/table/AppRow.svelte b/frontend/src/lib/components/common/table/AppRow.svelte
index 1059a986ce..bd881a31b7 100644
--- a/frontend/src/lib/components/common/table/AppRow.svelte
+++ b/frontend/src/lib/components/common/table/AppRow.svelte
@@ -11,7 +11,7 @@
 	import { createEventDispatcher } from 'svelte'
 	import Button from '../button/Button.svelte'
 	import Row from './Row.svelte'
-	import type { RowSelection } from './rowSelection'
+	import { selectMenuItems, type RowSelection } from './rowSelection'
 	import InheritedLabels from '$lib/components/InheritedLabels.svelte'
 	import Badge from '../badge/Badge.svelte'
 	import {
@@ -188,6 +188,21 @@
 				const canEdit = canWrite && showEditButton
 				if (draft_only) {
 					return [
+						...selectMenuItems(rowSelection),
+						{
+							displayName: 'Move/Rename',
+							icon: FolderOpen,
+							action: () => {
+								// Addressed by the generated path its draft row sits at, but
+								// named by the path typed in the editor.
+								moveDrawer.openDrawer((app as any).draft_path ?? path, summary, 'app', {
+									storagePath: path,
+									rawApp: !!app.raw_app
+								})
+							},
+							disabled: !showEditButton,
+							hide: $userStore?.operator
+						},
 						{
 							displayName: 'Delete',
 							icon: Trash,
@@ -221,6 +236,7 @@
 					]
 				}
 				return [
+					...selectMenuItems(rowSelection),
 					{
 						displayName: 'Duplicate/Fork',
 						icon: GitFork,
diff --git a/frontend/src/lib/components/common/table/FlowRow.svelte b/frontend/src/lib/components/common/table/FlowRow.svelte
index 1eb0d35878..f9af803694 100644
--- a/frontend/src/lib/components/common/table/FlowRow.svelte
+++ b/frontend/src/lib/components/common/table/FlowRow.svelte
@@ -14,7 +14,7 @@
 	import Badge from '../badge/Badge.svelte'
 	import Button from '../button/Button.svelte'
 	import Row from './Row.svelte'
-	import type { RowSelection } from './rowSelection'
+	import { selectMenuItems, type RowSelection } from './rowSelection'
 	import { sendUserToast } from '$lib/toast'
 	import { copyToClipboard, isOwner } from '$lib/utils'
 	import { isDeployable } from '$lib/utils_deployable'
@@ -219,6 +219,20 @@
 				const canEdit = flow.canWrite && showEditButton
 				if (draft_only) {
 					return [
+						...selectMenuItems(rowSelection),
+						{
+							displayName: 'Move/Rename',
+							icon: FolderOpen,
+							action: () => {
+								// Addressed by the generated path its draft row sits at, but
+								// named by the path typed in the editor.
+								moveDrawer.openDrawer((flow as any).draft_path ?? path, flow.summary, 'flow', {
+									storagePath: path
+								})
+							},
+							disabled: !showEditButton,
+							hide: $userStore?.operator
+						},
 						{
 							displayName: 'Delete',
 							icon: Trash,
@@ -242,6 +256,7 @@
 					]
 				}
 				return [
+					...selectMenuItems(rowSelection),
 					{
 						displayName: 'View runs',
 						icon: List,
diff --git a/frontend/src/lib/components/common/table/ScriptRow.svelte b/frontend/src/lib/components/common/table/ScriptRow.svelte
index ab5a460a5e..938086a0e8 100644
--- a/frontend/src/lib/components/common/table/ScriptRow.svelte
+++ b/frontend/src/lib/components/common/table/ScriptRow.svelte
@@ -23,7 +23,7 @@
 	import Badge from '../badge/Badge.svelte'
 	import Button from '../button/Button.svelte'
 	import Row from './Row.svelte'
-	import type { RowSelection } from './rowSelection'
+	import { selectMenuItems, type RowSelection } from './rowSelection'
 	import { sendUserToast } from '$lib/toast'
 	import { capitalize, copyToClipboard, isOwner } from '$lib/utils'
 	import { isDeployable } from '$lib/utils_deployable'
@@ -281,6 +281,7 @@
 				const canEdit = script.canWrite && showEditButton
 				if (script.draft_only) {
 					return [
+						...selectMenuItems(rowSelection),
 						{
 							displayName: 'View code',
 							icon: Code,
@@ -288,6 +289,19 @@
 								showCode(script.path, script.summary)
 							}
 						},
+						{
+							displayName: 'Move/Rename',
+							icon: FolderOpen,
+							action: () => {
+								// Addressed by the generated path its draft row sits at, but
+								// named by the path typed in the editor.
+								moveDrawer.openDrawer(script.draft_path ?? script.path, script.summary, 'script', {
+									storagePath: script.path
+								})
+							},
+							disabled: !showEditButton,
+							hide: $userStore?.operator
+						},
 						{
 							displayName: 'Delete',
 							icon: Trash,
@@ -311,6 +325,7 @@
 					]
 				}
 				return [
+					...selectMenuItems(rowSelection),
 					{
 						displayName: 'View code',
 						icon: Code,
diff --git a/frontend/src/lib/components/common/table/rowSelection.ts b/frontend/src/lib/components/common/table/rowSelection.ts
index 081f29addc..a78fe0aa1d 100644
--- a/frontend/src/lib/components/common/table/rowSelection.ts
+++ b/frontend/src/lib/components/common/table/rowSelection.ts
@@ -1,3 +1,6 @@
+import { SquareCheckBig } from 'lucide-svelte'
+import type { Item } from '$lib/utils'
+
 /**
  * Wiring for a row whose kind icon doubles as a selection control: the icon
  * swaps to a checkbox on hover, and stays one while a selection is active.
@@ -14,3 +17,19 @@ export type RowSelection = {
 	active: boolean
 	onToggle: (e: MouseEvent | KeyboardEvent) => void
 }
+
+/**
+ * The row menu's way into a selection, for the rows that offer one. The icon
+ * checkbox is the fast path but only appears on hover; this is the one a user
+ * can find by looking.
+ */
+export function selectMenuItems(rowSelection: RowSelection | undefined): Item[] {
+	if (!rowSelection) return []
+	return [
+		{
+			displayName: rowSelection.selected ? 'Deselect' : 'Select',
+			icon: SquareCheckBig,
+			action: (e) => rowSelection.onToggle(e)
+		}
+	]
+}
diff --git a/frontend/src/lib/components/copilot/StepGenQuick.svelte b/frontend/src/lib/components/copilot/StepGenQuick.svelte
index 0be2fecb4c..3890cacd58 100644
--- a/frontend/src/lib/components/copilot/StepGenQuick.svelte
+++ b/frontend/src/lib/components/copilot/StepGenQuick.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import { copilotInfo } from '$lib/aiStore'
 	import { ScriptService, type Script } from '$lib/gen'
 
@@ -8,6 +7,9 @@
 	import { emptyString } from '$lib/utils'
 	import { createEventDispatcher, onMount, untrack } from 'svelte'
 	import TextInput from '../text_input/TextInput.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let scripts: Script[] | undefined = $state(undefined)
 	interface Props {
@@ -34,7 +36,7 @@
 
 	async function loadScripts(): Promise<void> {
 		const loadedScripts = await ScriptService.listScripts({
-			workspace: $workspaceStore!,
+			workspace: $operatingWorkspace!,
 			perPage: 300,
 			kinds: trigger ? 'trigger' : 'script'
 		})
diff --git a/frontend/src/lib/components/copilot/autocomplete/Autocompletor.ts b/frontend/src/lib/components/copilot/autocomplete/Autocompletor.ts
index 0ee2ad3f78..5c9519ba1e 100644
--- a/frontend/src/lib/components/copilot/autocomplete/Autocompletor.ts
+++ b/frontend/src/lib/components/copilot/autocomplete/Autocompletor.ts
@@ -4,7 +4,7 @@ import { editor as meditor, Position, languages, type IDisposable } from 'monaco
 import { LRUCache } from 'lru-cache'
 import { autocompleteRequest } from './request'
 import { FIM_MAX_TOKENS } from '../lib'
-import { getModelContextWindow } from '../modelConfig'
+import { ASSUMED_CONTEXT_WINDOW, getEffectiveModelContextWindow } from '../modelConfig'
 import { setGlobalCSS } from '../shared'
 import { supportsAutocomplete } from '../utils'
 import { get } from 'svelte/store'
@@ -94,8 +94,14 @@ export class Autocompletor {
 
 		const deletionsCues = editor.createDecorationsCollection()
 
-		const completionModel = get(copilotInfo).codeCompletionModel
-		this.#contextWindow = getModelContextWindow(completionModel?.model ?? '')
+		const { codeCompletionModel: completionModel, contextWindowPerModel } = get(copilotInfo)
+		this.#contextWindow = completionModel
+			? getEffectiveModelContextWindow(
+					completionModel.provider,
+					completionModel.model,
+					contextWindowPerModel
+				)
+			: ASSUMED_CONTEXT_WINDOW
 
 		this.#completionDisposable = languages.registerInlineCompletionsProvider(
 			{ pattern: '**' },
diff --git a/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte b/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte
index 0085ca701f..2d88d1deb7 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte
@@ -1,7 +1,9 @@
 <script lang="ts">
+	import { createBottomSticker } from '$lib/components/stickToBottom'
 	import AIChatMessage from './AIChatMessage.svelte'
 	import AppAvailableContextList from './AppAvailableContextList.svelte'
 	import ChatContextPicker from './ChatContextPicker.svelte'
+	import WorkspaceMentionPicker from './WorkspaceMentionPicker.svelte'
 	import { type Snippet } from 'svelte'
 	import {
 		AlertTriangle,
@@ -35,6 +37,7 @@
 	import ChatQuickActions from './ChatQuickActions.svelte'
 	import ContextUsageIndicator from './ContextUsageIndicator.svelte'
 	import AIChatModelSettings from './AIChatModelSettings.svelte'
+	import ScrollFade from '$lib/components/ScrollFade.svelte'
 	import AssistantSettingsModal from './AssistantSettingsModal.svelte'
 	import { SkillsMenu } from './skills/skillsMenu.svelte'
 	import { McpMenu } from '$lib/components/mcp/mcpMenu.svelte'
@@ -265,21 +268,38 @@
 		return () => window.removeEventListener('keydown', onWindowKeydownCapture, true)
 	})
 
-	// Programmatic-scroll guard. `scrollDown()` triggers an async `scroll`
-	// event; if a token-append between the scrollTo and the dispatch makes
-	// scrollHeight grow, the gap can briefly exceed STICK_TO_BOTTOM_PX and
-	// disengage auto-scroll mid-stream. A short cooldown after our own
-	// scroll swallows that spurious event without affecting genuine user
-	// scrolls (wheel/touch/keyboard are reaction-time orders of magnitude
-	// slower than the cooldown).
-	const PROGRAMMATIC_SCROLL_COOLDOWN_MS = 120
-	let programmaticScrollAt: number | undefined
-	// Instant scroll — smooth would animate every token append, racing with
-	// the next scrollDown and confusing the onscroll bottom-detection below.
+	// Shared with the agent run viewer, which needs the same programmatic-scroll
+	// guard for the same reason.
+	const sticker = createBottomSticker()
+
+	// Per message: whether it is the last answer of its turn — per flow step run, since each
+	// run's last answer carries the only link to that run. Keyed on the answer's own job (a step
+	// label repeats when a step runs in a loop), and on answers rather than the next row: a
+	// flow's tool rows have their own job, and a stopped turn can end on a tool row.
+	// None in a turn still running, paused on the user included (their reply lands as a tool
+	// result, so a row shown during the pause would vanish again): which answer ends the turn is
+	// unknown until it does, and one followed by a tool call would leave the row's blank gap above
+	// it. A manual compaction loads without a turn of its own, so the last turn keeps its row.
+	const showsAnswerActions = $derived.by(() => {
+		const shows: boolean[] = new Array(messages.length).fill(false)
+		const answeredLater = new Set<string | undefined>()
+		let inRunningTurn = chatHost.loading && !chatHost.compacting
+		for (let i = messages.length - 1; i >= 0; i--) {
+			const message = messages[i]
+			if (message.role === 'user' || message.role === 'summary') {
+				answeredLater.clear()
+				inRunningTurn = false
+			} else if (message.role === 'assistant' && message.content) {
+				const run = message.jobId ?? message.stepName
+				shows[i] = !inRunningTurn && !answeredLater.has(run)
+				answeredLater.add(run)
+			}
+		}
+		return shows
+	})
+
 	function scrollDown() {
-		if (!scrollElement) return
-		programmaticScrollAt = Date.now()
-		scrollElement.scrollTo({ top: scrollElement.scrollHeight, behavior: 'auto' })
+		sticker.scrollToEnd(scrollElement)
 	}
 
 	let height = $state(0)
@@ -298,10 +318,6 @@
 		}
 	})
 
-	// Pixel distance from the bottom under which we treat the user as
-	// "stuck to the bottom" and re-enable automatic scroll. 8px allows for
-	// sub-pixel rounding from scrollTo + the occasional overscroll bounce.
-	const STICK_TO_BOTTOM_PX = 8
 	// Show the "scroll to latest" arrow only once the user has scrolled
 	// meaningfully away from the tail — a couple of message-heights up. Avoids
 	// flicker when the auto-scroll lags by a few px during streaming.
@@ -316,13 +332,10 @@
 		// whose only event would otherwise be swallowed, leaving the arrow
 		// stuck visible after we already reached the bottom.
 		showScrollToLatest = distance > SCROLL_TO_LATEST_THRESHOLD_PX
-		if (
-			programmaticScrollAt !== undefined &&
-			Date.now() - programmaticScrollAt < PROGRAMMATIC_SCROLL_COOLDOWN_MS
-		) {
+		if (sticker.isOwnScroll()) {
 			return
 		}
-		if (distance <= STICK_TO_BOTTOM_PX) {
+		if (sticker.isAtEnd(scrollElement)) {
 			chatHost.enableAutomaticScroll()
 		} else {
 			chatHost.disableAutomaticScroll()
@@ -563,6 +576,11 @@
 		await imageWork
 	}
 
+	function mentionWorkspaceItem(element: ContextElement) {
+		void aiChatInput?.addContextToSelection(element)
+		aiChatInput?.insertMention(element.title)
+	}
+
 	function onFolderInputChange(e: Event) {
 		const input = e.currentTarget as HTMLInputElement
 		// webkitdirectory files carry webkitRelativePath (`folder/sub/file`); addFiles groups
@@ -591,6 +609,15 @@
 	// The typing-dots indicator implies the AI is busy, which is misleading while
 	// the loop is parked on the user; surface a text pill instead so users know to
 	// act on the tool above.
+	// A step name hangs its icon in the column's left padding (see AssistantMessage), so a
+	// transcript carrying one widens the padding, on both sides to keep the column centred.
+	const agentGutter = $derived(messages.some((m) => m.role === 'assistant' && m.stepName))
+	const columnClass = $derived(
+		wideLayout
+			? `w-full max-w-3xl mx-auto ${agentGutter ? 'px-8' : 'px-7'}`
+			: `w-full max-w-2xl mx-auto ${agentGutter ? 'px-8' : 'px-3'}`
+	)
+
 	const waitingForUserAction = $derived(chatHost.loading && !!pendingUserAction(messages))
 
 	// Gated on `loading` because a card restored from history still looks parked:
@@ -823,12 +850,7 @@ the panel, or the Escape-to-stop focus check would wrongly reject them. -->
 				bind:this={scrollElement}
 				onscroll={onScroll}
 			>
-				<div
-					class={wideLayout
-						? 'w-full max-w-3xl mx-auto px-7 flex flex-col pb-2'
-						: 'w-full max-w-2xl mx-auto px-3 flex flex-col pb-2'}
-					bind:clientHeight={height}
-				>
+				<div class="{columnClass} flex flex-col pb-2" bind:clientHeight={height}>
 					{#each messages as message, messageIndex (messageIndex)}
 						<AIChatMessage
 							{message}
@@ -836,6 +858,7 @@ the panel, or the Escape-to-stop focus check would wrongly reject them. -->
 							{availableContext}
 							bind:editingMessageIndex
 							isLast={messageIndex === messages.length - 1}
+							showAnswerActions={showsAnswerActions[messageIndex]}
 						/>
 					{/each}
 					{#if freeTierExhausted}
@@ -867,6 +890,8 @@ the panel, or the Escape-to-stop focus check would wrongly reject them. -->
 					{/if}
 				</div>
 			</div>
+			<!-- Sits below the scroll-to-latest button, which carries z-10. -->
+			<ScrollFade scroller={scrollElement} />
 			{#if showScrollToLatest}
 				<div
 					transition:fade={{ duration: 120 }}
@@ -892,11 +917,9 @@ the panel, or the Escape-to-stop focus check would wrongly reject them. -->
 		</div>
 	{/if}
 
-	<div
-		class={wideLayout
-			? 'relative w-full max-w-3xl mx-auto px-6 pb-2'
-			: 'relative w-full max-w-2xl mx-auto px-2 pb-2'}
-	>
+	<!-- Same horizontal padding as the transcript above: the composer's edges line up with
+	     the messages rather than sitting closer to the panel edge. -->
+	<div class="relative {columnClass} pb-2">
 		{#if showFlowPendingActionControls}
 			<div class="absolute -top-10 w-full flex flex-row justify-center gap-2">
 				<Button
@@ -1066,6 +1089,19 @@ the panel, or the Escape-to-stop focus check would wrongly reject them. -->
 													}
 												]
 											: []),
+										...(inGlobal
+											? [
+													{
+														displayName: 'Mention file',
+														icon: AtSign,
+														customSubmenu: WorkspaceMentionPicker,
+														customSubmenuProps: {
+															onSelect: mentionWorkspaceItem,
+															onAfterClose: () => aiChatInput?.focusInput()
+														}
+													}
+												]
+											: []),
 										...(skillItems
 											? [
 													{
diff --git a/frontend/src/lib/components/copilot/chat/AIChatInput.svelte b/frontend/src/lib/components/copilot/chat/AIChatInput.svelte
index d3cc2c8bd9..bcea3a26d6 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatInput.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChatInput.svelte
@@ -14,7 +14,7 @@
 	import { CHAT_INPUT_PADDING, getAiChatManager } from './aiChatManagerContext'
 	import { getChatViewHost } from './chatViewHost'
 	import { composerBoxClass, COMPOSER_FIELD_RESET } from './composerBox'
-	import { formatMention } from './mention'
+	import { formatMention, hasMention, removeMentionFromText } from './mention'
 	import { twMerge } from 'tailwind-merge'
 	import { tick, untrack, type Snippet } from 'svelte'
 	import Portal from '$lib/components/Portal.svelte'
@@ -378,6 +378,16 @@
 	)
 	$effect(() => {
 		chatHost.setComposerStaged(composerKey, editingMessageIndex, stagedBytes)
+		chatHost.setComposerHasDraft(
+			composerKey,
+			!draft.isEmpty ||
+				(chatHost.mode === AIMode.GLOBAL && selectedContext.length > 0) ||
+				pendingFiles > 0 ||
+				pendingFileBytes > 0 ||
+				pendingImages > 0 ||
+				pendingBlobs > 0 ||
+				ingestionHolds > 0
+		)
 	})
 	$effect(() => () => chatHost.clearComposerStaged(composerKey))
 
@@ -578,40 +588,33 @@
 
 	const contextKey = contextElementKey
 
-	/** Append `@title` to the textarea so the button-picker path stays in
-	 * sync with the inline `@<word>` mention path — both leave a visible
-	 * token tied to the selectedContext entry, which the textarea diffs on
-	 * to auto-remove items when the user deletes them. No-op when the
-	 * mention is already present so re-picking the same item doesn't
-	 * leave duplicate tokens. */
+	/** Insert `@title` so button/menu picker paths stay in sync with
+	 * the inline `@<word>` mention path — both leave a visible token tied
+	 * to the selectedContext entry, which the textarea diffs on to
+	 * auto-remove items when the user deletes them. No-op when the same
+	 * standalone mention is already present, so picking the same item
+	 * again doesn't leave duplicate tokens. */
 	export function insertMention(title: string) {
-		const target = `@${title}`
-		if (draft.text.split(/\s+/).includes(target)) return
+		if (hasMention(draft.text, title)) return
+		if (contextTextareaComponent) {
+			void contextTextareaComponent.insertMention(title)
+			return
+		}
 		const sep = draft.text.length === 0 || /\s$/.test(draft.text) ? '' : ' '
-		draft.text = `${draft.text}${sep}${target} `
+		draft.text = `${draft.text}${sep}${formatMention(title)} `
 	}
 
 	/** Strip every `@title` token from the textarea — used when the user
 	 * deletes the corresponding badge so the badge X-button mirrors the
-	 * inverse (text-delete-to-badge-remove) sync. Only matches `@title` as a
-	 * standalone token (boundary on both sides) so substring matches don't
-	 * bleed into other words; only the whitespace adjacent to the removed
-	 * mention is collapsed so unrelated double-spaces stay intact. */
+	 * inverse (text-delete-to-badge-remove) sync. Only matches tokens whose
+	 * `@` starts a word, so embedded text like `owner@app.ts` is left alone
+	 * while punctuation and non-spacing text after the token still work. */
 	export function removeMention(title: string) {
 		// Pre-zap the textarea's mention diff snapshot so the upcoming strip
 		// doesn't refire the removal effect on a same-title sibling — the host
 		// has already mutated `selectedContext` to drop the targeted entry.
 		contextTextareaComponent?.unsyncMention(title)
-		const escaped = title.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
-		const re = new RegExp(`(^|\\s)@${escaped}(\\s|$)`, 'g')
-		draft.text = draft.text.replace(re, (_m, lead, trail) => {
-			// Boundary on at least one side → drop the mention entirely.
-			if (!lead || !trail) return ''
-			// Middle of text: keep ONE of the bracketing whitespace chars so
-			// the surviving tokens are still separated; preserve the leading
-			// one verbatim so newlines/tabs aren't downgraded to spaces.
-			return lead
-		})
+		draft.text = removeMentionFromText(draft.text, title)
 	}
 
 	export function focusInput() {
@@ -889,7 +892,7 @@
 			contextTextareaComponent?.clearForSend()
 			return
 		}
-		if (chatHost.loading) {
+		if (chatHost.loading || chatHost.sendInFlight || chatHost.sendPending) {
 			// Queue the message instead of silently discarding it — it is
 			// auto-sent when the streaming turn completes successfully.
 			// Editing-while-loading keeps the old discard behavior. Paste
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
index acfcc305e0..6e51f80601 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
@@ -55,7 +55,7 @@ import { sendUserToast } from '$lib/toast'
 import { workspaceAIClients, getNonStreamingCompletion } from '../lib'
 import { logFeatureUsage } from '$lib/utils/featureUsage'
 import { modelSupportsVision } from '../modelConfig'
-import { getModelContextWindow } from '../modelConfig'
+import { getEffectiveModelContextWindow } from '../modelConfig'
 import {
 	getCompactionSummaryPrompt,
 	formatCompactSummary,
@@ -95,7 +95,7 @@ import { copilotInfo } from '$lib/aiStore'
 import { copilotWorkspaceRequested, loadCopilot } from '$lib/components/copilot/loadCopilot'
 import { askTools, prepareAskSystemMessage, prepareAskUserMessage } from './ask/core'
 import { readDocsPageTool, searchDocsTool } from './docs/core'
-import { TypewriterReveal } from './typewriterReveal'
+import { prefersInstantReveal, TypewriterReveal } from './typewriterReveal'
 import { chatState, DEFAULT_SIZE, triggerablesByAi } from './sharedChatState.svelte'
 import {
 	createAppBackendRunnableContextElement,
@@ -110,6 +110,7 @@ import type { Selection } from 'monaco-editor'
 import type AIChatInput from './AIChatInput.svelte'
 import { prepareApiSystemMessage, prepareApiUserMessage } from './api/core'
 import { closeInterruptedToolBatch, runChatLoop, truncateToToolPairedPrefix } from './chatLoop'
+import { FREE_TIER_OUTPUT_TOKEN_LIMIT_MESSAGE, OutputTokenLimitError } from './outputTokenLimit'
 import { sanitizeToolCallArguments } from './toolCallArguments'
 import { billedTokens, normalizeContextUsage, type ChatTokenUsage } from './tokenUsage'
 import { logAiUsage } from '$lib/utils/aiUsageReporter'
@@ -124,28 +125,34 @@ import {
 	isWebSearchEnabledForProvider
 } from '$lib/aiStore'
 import type { WorkspaceMutationTarget } from './workspaceTools'
+import { resolveSessionAccess } from './global/sessionAccess'
+import type { SessionAccess } from './sessionCapabilities'
+import { filterSessionTools } from './global/sessionToolset'
+import {
+	listFolderInstructions,
+	type FolderInstruction,
+	type FolderInstructionsDelivery
+} from './folderInstructions'
 import {
-	globalToolsFor,
 	loadWorkspaceSkills,
-	prepareGlobalSystemMessage,
 	resolveGlobalPromptIdentity,
 	type GlobalPromptIdentity,
 	prepareGlobalUserMessage,
 	type AiSkillListItem,
 	type ChatCommandItem,
 	type SessionPromptContext,
-	getSessionContextPromptSection,
 	type GlobalToolHelpers,
 	type GlobalActivePreviewContext
 } from './global/core'
+import {
+	assembleGlobalSystemMessage,
+	assembleGlobalTools,
+	type GlobalAssemblyOpts
+} from './global/globalAssembly'
 import { formatChatJobCompletion } from './datatableTools'
 import { isGlobalAiEnabled } from './global/gate'
-import { createMcpTools, loadMcpServers, type McpServer } from './global/mcpTools'
-import {
-	pipelineTools,
-	getPipelinePromptSection,
-	type PipelineAIChatHelpers
-} from './pipeline/core'
+import { loadMcpServers, type McpServer } from './global/mcpTools'
+import type { PipelineAIChatHelpers } from './pipeline/core'
 import { scopedKey, onUserChange, migrateLegacyLocalStorage } from '$lib/userScopedStorage'
 import { getLocalSetting, storeLocalSetting } from '$lib/utils'
 import { AttachedFilesStore } from './files/attachedFiles.svelte'
@@ -155,11 +162,6 @@ import { appendAttachedFilesRoster } from './files/fileTools'
 import { ENTER_PLAN_MODE_TOOL, EXIT_PLAN_MODE_TOOL } from './planMode'
 import { PlanModeController, type PlanModeHost } from './planModeController.svelte'
 
-// SSR and users who prefer reduced motion get no typewriter pacing.
-function prefersInstantReveal(): boolean {
-	return !BROWSER || (window.matchMedia?.('(prefers-reduced-motion: reduce)').matches ?? false)
-}
-
 // Compaction of the stored history: once the projected request size
 // (contextTokens — the provider's report when current, a fresh chars/4
 // estimate otherwise — plus the new user message) reaches the trigger ratio of
@@ -382,6 +384,10 @@ function isImageRejection(err: unknown, models: (string | undefined)[] = []): bo
 }
 
 function getSendRequestErrorMessage(err: unknown, webSearchUnavailable: boolean): string {
+	// The request went through; only its response was cut short.
+	if (err instanceof OutputTokenLimitError) {
+		return get(copilotInfo).freeTier ? FREE_TIER_OUTPUT_TOKEN_LIMIT_MESSAGE : err.message
+	}
 	const errorMessage =
 		err instanceof Error ? err.message : typeof err === 'string' ? err : undefined
 	const message = errorMessage
@@ -698,6 +704,10 @@ export class AIChatManager implements ChatViewHost {
 	// needs the preview pane; the global side-panel chat leaves it false. Reactive because
 	// `planModeAvailable` derives from it.
 	isSessionChat = $state(false)
+	// Undefined until a send or the assistant settings modal resolves it. Reactive: both
+	// tool views derive from it.
+	private sessionAccess = $state<SessionAccess | undefined>(undefined)
+	private sessionAccessGeneration = 0
 	autoAcceptEditsAvailable = $derived(supportsAutoAcceptEdits(this.mode))
 	autoAcceptEditsActive = $derived(
 		this.autoAcceptEditsAvailable &&
@@ -719,7 +729,23 @@ export class AIChatManager implements ChatViewHost {
 		role: 'system',
 		content: ''
 	})
-	tools = $state<Tool<any>[]>([])
+	/** The sources the current mode assembled, concatenated. Private, because neither view
+	 * over it is this list: a consumer reading it would advertise a tool set no request ever
+	 * carries. Raw: every write replaces the list, and a deep proxy would reach the tool
+	 * defs, which the session filter copies with `structuredClone` — that throws on a proxy. */
+	#assembledTools = $state.raw<Tool<any>[]>([])
+	/** Both views narrow the same way — concatenate every source, then filter — so a tool
+	 * reaching either one can never arrive unfiltered. A session withholds what its user's
+	 * capabilities do not cover; elsewhere `sessionAccess` is unset and nothing is dropped. */
+	#shipped = (planTools: Tool<any>[]): Tool<any>[] =>
+		filterSessionTools([...this.#assembledTools, ...planTools], this.sessionAccess)
+	/** What the request carries: the assembled tools plus the plan-mode transition the current
+	 * posture offers. Read by the request path and by the YOLO disclosure. */
+	tools: Tool<any>[] = $derived(this.#shipped(this.planMode.tools))
+	/** What the assistant can call in this session, posture-independent: both plan-mode
+	 * transitions, whichever one is offered right now. A reference answer, so flipping the
+	 * autonomy picker must not change it. */
+	availableTools: Tool<any>[] = $derived(this.#shipped(this.planMode.availableTools))
 	helpers = $state<any | undefined>(undefined)
 
 	scriptEditorOptions = $state<ScriptOptions | undefined>(undefined)
@@ -737,12 +763,14 @@ export class AIChatManager implements ChatViewHost {
 	/** Every mounted flow editor. */
 	#flowEditors = new Set<FlowAIChatHelpers>()
 	appAiChatHelpers = $state<AppAIChatHelpers | undefined>(undefined)
-	/** Datatable creation policy: enabled flag, datatable name, and optional schema */
+	/** Datatable creation policy: enabled flag, datatable name, optional schema, and the role the
+	 * app uses each data table through */
 	datatableCreationPolicy = $state<{
 		enabled: boolean
 		datatable: string | undefined
 		schema: string | undefined
-	}>({ enabled: false, datatable: undefined, schema: undefined })
+		roles?: Record<string, string>
+	}>({ enabled: false, datatable: undefined, schema: undefined, roles: undefined })
 	pendingNewCode = $state<string | undefined>(undefined)
 	apiTools = $state<Tool<any>[]>([])
 	aiChatInput = $state<AIChatInput | null>(null)
@@ -1326,6 +1354,13 @@ export class AIChatManager implements ChatViewHost {
 	globalSkills = $state<AiSkillListItem[]>([])
 	private globalSkillsRefreshId = 0
 
+	// The `ai_instruction` resources readable in the operating workspace, loaded
+	// alongside skills. The prompt names their folders; the tool loop delivers each
+	// one's body the first time a call touches its folder, recording which call did.
+	private globalFolderInstructions: FolderInstruction[] = []
+	private globalFolderInstructionsRefreshId = 0
+	private folderInstructionsDeliveredBy = new Map<string, FolderInstructionsDelivery>()
+
 	// External MCP servers the user connected (resources of type `mcp`). Loaded
 	// asynchronously alongside skills; the MCP tools are only registered when
 	// this is non-empty, so a workspace with no connection pays no schema cost
@@ -1417,10 +1452,12 @@ export class AIChatManager implements ChatViewHost {
 			typeof this.systemMessage.content === 'string'
 				? this.systemMessage.content.length / tokenPerCharacter
 				: 0
+		const tools = this.tools
+		// Counts each tool's shared `def`, not the per-chat one `schemaFor` builds at send time,
+		// so a flow's input schema is missed. Accepted: the estimate only stands in until the
+		// provider reports usage, and the compaction trigger's headroom absorbs the gap.
 		const toolTokens =
-			this.tools.length > 0
-				? JSON.stringify(this.tools.map((t) => t.def)).length / tokenPerCharacter
-				: 0
+			tools.length > 0 ? JSON.stringify(tools.map((t) => t.def)).length / tokenPerCharacter : 0
 		return systemTokens + toolTokens
 	}
 
@@ -1764,7 +1801,7 @@ export class AIChatManager implements ChatViewHost {
 		try {
 			this.apiTools = await loadApiTools()
 			if (this.mode === AIMode.API) {
-				this.tools = [searchDocsTool, readDocsPageTool, ...this.apiTools]
+				this.#assembledTools = [searchDocsTool, readDocsPageTool, ...this.apiTools]
 			}
 		} catch (err) {
 			console.error('Error loading api tools', err)
@@ -2227,7 +2264,7 @@ export class AIChatManager implements ChatViewHost {
 	 * Gated on `sendInFlight` as well as `loading`: `loading` only rises after a
 	 * send's attachment upkeep, so between the two a click would slip past. */
 	sendOrQueue(text: string) {
-		if (this.loading || this.sendInFlight) {
+		if (this.loading || this.sendInFlight || this.sendPending) {
 			this.queueMessage(text)
 			return
 		}
@@ -2322,8 +2359,9 @@ export class AIChatManager implements ChatViewHost {
 		}
 	) {
 		if (!isAIModeVisible(mode)) return
-		// A session chat is GLOBAL for its whole life, and the plan gate reads that mode: moving
-		// it lifts the gate on a session the user still has set to Plan.
+		// A session chat is GLOBAL for its whole life, and two things read that mode: moving it
+		// lifts the plan gate on a session the user still has set to Plan, and hands the
+		// capability filter tools that declare no `requires`, so it fails closed to nothing.
 		if (this.isSessionChat && mode !== AIMode.GLOBAL) {
 			console.error(`Refusing to move a session chat to ${mode} mode: sessions are GLOBAL-only.`)
 			return
@@ -2346,7 +2384,7 @@ export class AIChatManager implements ChatViewHost {
 				customPrompt
 			)
 			this.systemMessage.content = this.systemMessage.content
-			this.tools = [...prepareScriptTools(currentModel, lang, context)]
+			this.#assembledTools = [...prepareScriptTools(currentModel, lang, context)]
 			this.helpers = {
 				getScriptOptions: () => {
 					return {
@@ -2378,7 +2416,7 @@ export class AIChatManager implements ChatViewHost {
 			this.systemMessage = prepareFlowSystemMessage(customPrompt)
 			this.systemMessage.content = this.systemMessage.content
 			this.appendFlowAiAgentProviders(this.systemMessage)
-			this.tools = [...flowTools]
+			this.#assembledTools = [...flowTools]
 			this.helpers = {
 				...(this.flowAiChatHelpers ?? {}),
 				getWorkspaceMutationTarget: this.getFlowWorkspaceMutationTarget
@@ -2386,52 +2424,37 @@ export class AIChatManager implements ChatViewHost {
 		} else if (mode === AIMode.NAVIGATOR) {
 			const customPrompt = getCombinedCustomPrompt(mode)
 			this.systemMessage = prepareNavigatorSystemMessage(customPrompt)
-			this.tools = [this.changeModeTool, ...navigatorTools]
+			this.#assembledTools = [this.changeModeTool, ...navigatorTools]
 			this.helpers = {}
 		} else if (mode === AIMode.ASK) {
 			const customPrompt = getCombinedCustomPrompt(mode)
 			this.systemMessage = prepareAskSystemMessage(customPrompt)
-			this.tools = [...askTools]
+			this.#assembledTools = [...askTools]
 			this.helpers = {}
 		} else if (mode === AIMode.API) {
 			const customPrompt = getCombinedCustomPrompt(mode)
 			this.systemMessage = prepareApiSystemMessage(customPrompt)
-			this.tools = [searchDocsTool, readDocsPageTool, ...this.apiTools]
+			this.#assembledTools = [searchDocsTool, readDocsPageTool, ...this.apiTools]
 			this.helpers = {}
 		} else if (mode === AIMode.GLOBAL) {
 			this.configureGlobalMode()
 			void this.refreshGlobalIdentity()
 			void this.refreshGlobalSkills()
+			void this.refreshGlobalFolderInstructions()
 			void this.refreshMcpServers()
 		} else if (mode === AIMode.APP) {
 			const customPrompt = getCombinedCustomPrompt(mode)
 			this.systemMessage = prepareAppSystemMessage(customPrompt)
-			this.tools = [...getAppTools()]
+			this.#assembledTools = [...getAppTools()]
 			this.helpers = this.appAiChatHelpers
 		}
 	}
 
-	// Fetch the workspace's AI skills and, if GLOBAL mode is still active, rebuild
-	// the system message so the next chat-loop iteration advertises them. Ignore
-	// stale resolves so workspace changes cannot overwrite newer skills.
-	// Build the global-mode system message, tools, and helpers, layering on the
-	// pipeline surface when a /pipeline editor has registered helpers. Centralized
-	// so changeMode, refreshGlobalSkills, and setPipelineHelpers stay consistent —
-	// each rebuild would otherwise drop the pipeline augmentation the others added.
-	//
 	// Public because it is purely local, unlike `changeMode(GLOBAL)`, which also
 	// fires the three network refreshes.
 	configureGlobalMode = () => {
-		const systemMessage = prepareGlobalSystemMessage(getCustomPromptParts(AIMode.GLOBAL), {
-			previewTools: this.isSessionChat,
-			user: this.globalIdentity,
-			skills: this.globalSkills,
-			mcpServers: this.mcpServers
-		})
-		const sessionCtx = this.sessionContextResolver?.()
-		if (sessionCtx) {
-			systemMessage.content += getSessionContextPromptSection(sessionCtx)
-		}
+		const pipeline = this.pipelineAiChatHelpers
+		const opts = this.globalAssemblyOpts()
 		const baseHelpers: GlobalToolHelpers = {
 			// A session targets its own fixed (possibly forked) workspace, so capture it for
 			// permission gating. The global side-panel chat follows the live navigation
@@ -2441,13 +2464,13 @@ export class AIChatManager implements ChatViewHost {
 						sessionId: this.sessionId,
 						operatingWorkspace: this.operatingWorkspace,
 						artifacts: this.artifacts,
+						access: this.sessionAccess,
 						getChatId: () => this.historyManager.getCurrentChatId(),
 						openArtifact: this.openArtifact
 					}
 				: {}),
 			testActiveFlow: async (storagePath: string, args?: Record<string, any>, memoryId?: string) =>
 				this.flowEditorFor(storagePath)?.testFlow(args, memoryId),
-			getModifiedItems: () => (this.modifiedItems ? [...this.modifiedItems] : undefined),
 			attachedFiles: this.attachedFiles,
 			getUserInstructions: () => getUserCustomPrompts()[AIMode.GLOBAL] ?? '',
 			setUserInstructions: (instructions: string) => {
@@ -2461,24 +2484,26 @@ export class AIChatManager implements ChatViewHost {
 				this.rebuildGlobalSystemMessage()
 			}
 		}
-		const pipeline = this.pipelineAiChatHelpers
-		const mcpTools = createMcpTools(this.mcpServers)
-		if (pipeline) {
-			systemMessage.content += getPipelinePromptSection(pipeline.getPipelineContext())
-			this.tools = [
-				...globalToolsFor({ sessionPreview: this.isSessionChat }),
-				...pipelineTools,
-				...mcpTools
-			]
-			this.helpers = { ...baseHelpers, pipeline }
-		} else {
-			this.tools = [...globalToolsFor({ sessionPreview: this.isSessionChat }), ...mcpTools]
-			this.helpers = baseHelpers
-		}
-		this.systemMessage = systemMessage
+		this.#assembledTools = assembleGlobalTools(opts)
+		this.helpers = pipeline ? { ...baseHelpers, pipeline } : baseHelpers
+		this.systemMessage = assembleGlobalSystemMessage(getCustomPromptParts(AIMode.GLOBAL), opts)
 		this.syncArtifactsSession()
 	}
 
+	private globalAssemblyOpts = (): GlobalAssemblyOpts => ({
+		previewTools: this.isSessionChat,
+		user: this.globalIdentity,
+		skills: this.globalSkills,
+		folderInstructions: this.globalFolderInstructions,
+		mcpServers: this.mcpServers,
+		access: this.sessionAccess,
+		sessionContext: this.sessionContextResolver?.(),
+		pipelineContext: this.pipelineAiChatHelpers?.getPipelineContext()
+	})
+
+	// Fetch the workspace's AI skills and, if GLOBAL mode is still active, rebuild
+	// the system message so the next chat-loop iteration advertises them. Ignore
+	// stale resolves so workspace changes cannot overwrite newer skills.
 	refreshGlobalSkills = async (workspace = this.operatingWorkspace ?? '') => {
 		const refreshId = ++this.globalSkillsRefreshId
 		const skills = await loadWorkspaceSkills(workspace)
@@ -2495,6 +2520,25 @@ export class AIChatManager implements ChatViewHost {
 		}
 	}
 
+	// Same shape as refreshGlobalSkills.
+	refreshGlobalFolderInstructions = async (workspace = this.operatingWorkspace ?? '') => {
+		const refreshId = ++this.globalFolderInstructionsRefreshId
+		let instructions: FolderInstruction[] = []
+		try {
+			instructions = await listFolderInstructions(workspace)
+		} catch (e) {
+			console.error('Failed to load folder instructions', e)
+		}
+		if (refreshId !== this.globalFolderInstructionsRefreshId) {
+			return
+		}
+		this.globalFolderInstructions =
+			workspace === (this.operatingWorkspace ?? '') ? instructions : []
+		if (this.mode === AIMode.GLOBAL) {
+			this.configureGlobalMode()
+		}
+	}
+
 	// Same shape as refreshGlobalSkills. An identity that resolves after the operating
 	// workspace moved describes the workspace left behind, so it is dropped, not installed.
 	refreshGlobalIdentity = async (workspace = this.operatingWorkspace ?? '') => {
@@ -2546,6 +2590,23 @@ export class AIChatManager implements ChatViewHost {
 		this.systemMessage = { ...target, content: `${target.content}\n\n${section}` }
 	}
 
+	// Same shape as refreshGlobalSkills. Re-resolved per send rather than once for the
+	// session's life: the operating workspace can change between sends, and a transient
+	// failure resolves fail-open, so the next message re-asks rather than keeping that answer.
+	refreshSessionAccess = async (workspace = this.operatingWorkspace ?? '') => {
+		if (!this.isSessionChat || !workspace) {
+			this.sessionAccess = undefined
+			return
+		}
+		const generation = ++this.sessionAccessGeneration
+		const access = await resolveSessionAccess(workspace)
+		if (generation !== this.sessionAccessGeneration) return
+		this.sessionAccess = workspace === (this.operatingWorkspace ?? '') ? access : undefined
+		if (this.mode === AIMode.GLOBAL) {
+			this.configureGlobalMode()
+		}
+	}
+
 	// Rebuild the GLOBAL system message in place so an updated user instruction (persisted by
 	// the update_user_instructions tool) is picked up on the next chat-loop iteration, which
 	// re-reads this.systemMessage via a getter.
@@ -2553,24 +2614,10 @@ export class AIChatManager implements ChatViewHost {
 		if (this.mode !== AIMode.GLOBAL) {
 			return
 		}
-		const systemMessage = prepareGlobalSystemMessage(getCustomPromptParts(AIMode.GLOBAL), {
-			previewTools: this.isSessionChat,
-			user: this.globalIdentity,
-			skills: this.globalSkills,
-			mcpServers: this.mcpServers
-		})
-		// Preserve the session-state and active pipeline-editor augmentations that
-		// configureGlobalMode adds — otherwise update_user_instructions (which calls
-		// this) would drop them mid-session.
-		const sessionCtx = this.sessionContextResolver?.()
-		if (sessionCtx) {
-			systemMessage.content += getSessionContextPromptSection(sessionCtx)
-		}
-		const pipeline = this.pipelineAiChatHelpers
-		if (pipeline) {
-			systemMessage.content += getPipelinePromptSection(pipeline.getPipelineContext())
-		}
-		this.systemMessage = systemMessage
+		this.systemMessage = assembleGlobalSystemMessage(
+			getCustomPromptParts(AIMode.GLOBAL),
+			this.globalAssemblyOpts()
+		)
 	}
 
 	private expandGlobalSkillCommand = (instructions: string): string => {
@@ -2822,6 +2869,23 @@ export class AIChatManager implements ChatViewHost {
 
 	clearComposerStaged(key: string) {
 		this.#composerStaged.delete(key)
+		this.#composersWithDraft.delete(key)
+	}
+
+	// Composers whose draft is non-empty. The draft itself is component-local, so
+	// this is the only way to know an unmount would lose unsent input.
+	#composersWithDraft = new SvelteSet<string>()
+
+	setComposerHasDraft(key: string, hasDraft: boolean) {
+		if (hasDraft) this.#composersWithDraft.add(key)
+		else this.#composersWithDraft.delete(key)
+	}
+
+	/** Unsent input an unmount of this chat would lose: a composer draft, or a
+	 *  queued message (whose text may be empty when it carries only attachments
+	 *  or context). */
+	get hasUnsentInput(): boolean {
+		return this.#composersWithDraft.size > 0 || this.#hasQueuedMessage()
 	}
 
 	/** Release the outgoing-files reservation identified by `key` (a per-send token).
@@ -2954,7 +3018,7 @@ export class AIChatManager implements ChatViewHost {
 		try {
 			// Use JS getters so runChatLoop re-reads tools/helpers/systemMessage/modelProvider
 			// on each iteration. This is critical for changeModeTool (Navigator → Script/Flow)
-			// which reassigns this.tools, this.helpers, this.systemMessage mid-loop.
+			// which reassigns #assembledTools, this.helpers, this.systemMessage mid-loop.
 			const self = this
 			// Pinned for the whole turn, like the `workspace` the loop routes through:
 			// the global chat's operating workspace follows workspaceStore, so a switch
@@ -2979,7 +3043,7 @@ export class AIChatManager implements ChatViewHost {
 					return base
 				},
 				get tools() {
-					return [...self.tools, ...self.planMode.tools]
+					return self.tools
 				},
 				get helpers() {
 					return self.helpers
@@ -3046,13 +3110,8 @@ export class AIChatManager implements ChatViewHost {
 						console.error('Failed to record AI usage', e)
 					}
 				},
-				onBeforeIteration: async (tools, _helpers, modelProvider) => {
+				onBeforeIteration: async (modelProvider) => {
 					this.lastIterationModel = modelProvider
-					for (const tool of tools) {
-						if (tool.setSchema) {
-							await tool.setSchema(this.helpers)
-						}
-					}
 				}
 			})
 			if (this.isSessionChat && this.sessionId && result.tokenUsage.total > 0) {
@@ -3177,7 +3236,39 @@ export class AIChatManager implements ChatViewHost {
 		return this.#sendsInFlight > 0
 	}
 
+	// Resolves once this chat's stored transcript has been restored. A session
+	// runtime hands its manager out before that finishes, and `loadPastChat`
+	// refuses to swap a transcript under a send, so a turn started first lands in
+	// a chat of its own and is lost when the session's real one loads.
+	//
+	// Cleared once awaited, and only awaited when set: every later send — and
+	// every send of the chats that have no gate — reaches the `sendInFlight`
+	// counter below synchronously, which is what makes a second Enter queue
+	// behind the first instead of starting a turn of its own.
+	#ready: Promise<unknown> | undefined
+	setReadyGate(ready: Promise<unknown> | undefined) {
+		this.#ready = ready
+	}
+
+	#sendsAwaitingReady = $state(0)
+	/** A send parked on the gate above. It has not reached `sendInFlight` yet —
+	 * and must not, since `loadPastChat` reads that flag and would then skip the
+	 * restore this send is waiting for — so every guard that decides between
+	 * sending and queueing tests this as well. */
+	get sendPending(): boolean {
+		return this.#sendsAwaitingReady > 0
+	}
+
 	sendRequest = async (options: Parameters<typeof this.sendRequestImpl>[0] = {}) => {
+		if (this.#ready) {
+			this.#sendsAwaitingReady++
+			try {
+				await this.#ready
+			} finally {
+				this.#sendsAwaitingReady--
+				this.#ready = undefined
+			}
+		}
 		// A turn with nowhere to render still streams, spends tokens and applies
 		// tool calls — entirely off-screen. Refuse instead. `sendInlineRequest` is
 		// exempt: the ⌘K widget renders its own composer inside Monaco.
@@ -3524,15 +3615,18 @@ export class AIChatManager implements ChatViewHost {
 				return false
 			}
 		}
-		// Session chats commit their workspace in beforeSend; the identity, skills and
-		// MCP servers must all match the committed workspace before the system prompt is
-		// sent. Settling them here rather than mid-turn also keeps the prompt — the
-		// cached prefix of every iteration — stable for the whole request.
+		// Session chats commit their workspace in beforeSend; the identity, skills, folder
+		// instructions, MCP servers and capabilities must all match the committed workspace
+		// before the system prompt is sent. Settling them here rather than mid-turn also
+		// keeps the prompt — the cached prefix of every iteration — stable for the whole
+		// request.
 		if (this.mode === AIMode.GLOBAL) {
 			await Promise.all([
 				this.refreshGlobalIdentity(this.operatingWorkspace ?? ''),
 				this.refreshGlobalSkills(this.operatingWorkspace ?? ''),
-				this.refreshMcpServers(this.operatingWorkspace ?? '')
+				this.refreshGlobalFolderInstructions(this.operatingWorkspace ?? ''),
+				this.refreshMcpServers(this.operatingWorkspace ?? ''),
+				this.refreshSessionAccess(this.operatingWorkspace ?? '')
 			])
 		}
 		// Stop/Escape during the beforeSend pre-flight aborted this send before any
@@ -3860,7 +3954,13 @@ export class AIChatManager implements ChatViewHost {
 			// assumed window rather than no limit: without one the context grows
 			// unbounded until the provider (or a proxy in front of it) times out.
 			// Guessing low only compacts earlier, which is always recoverable.
-			const contextWindow = model ? getModelContextWindow(model.model) : undefined
+			const contextWindow = model
+				? getEffectiveModelContextWindow(
+						model.provider,
+						model.model,
+						get(copilotInfo).contextWindowPerModel
+					)
+				: undefined
 			if (
 				contextWindow !== undefined &&
 				projectedContextTokens >= contextWindow * COMPACTION_TRIGGER_RATIO
@@ -3959,6 +4059,9 @@ export class AIChatManager implements ChatViewHost {
 								{
 									role: 'assistant',
 									content: this.currentReply,
+									// Stamped as it lands. A chat restored from history predates this and
+									// simply shows no time rather than a made-up one.
+									createdAt: new Date().toISOString(),
 									...(this.currentReasoning
 										? { reasoning: this.currentReasoning, reasoningDurationMs }
 										: {}),
@@ -3981,7 +4084,11 @@ export class AIChatManager implements ChatViewHost {
 						? {
 								onJobStarted: (job) => this.registerJob(job),
 								onJobStatus: (jobId, update) => this.updateJob(jobId, update),
-								onJobDetached: (jobId) => this.markJobDetached(jobId)
+								onJobDetached: (jobId) => this.markJobDetached(jobId),
+								folderInstructions: {
+									list: () => this.globalFolderInstructions,
+									deliveredBy: this.folderInstructionsDeliveredBy
+								}
 							}
 						: {}),
 					removeToolStatus: (id) => {
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
index 35ac65253c..3b8470fc2e 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
@@ -1,4 +1,4 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, onTestFinished, vi } from 'vitest'
 import { writable } from 'svelte/store'
 import type { FlowAIChatHelpers } from './flow/core'
 import type { PipelineAIChatHelpers } from './pipeline/core'
@@ -514,6 +514,25 @@ describe('AIChatManager.sendOrQueue', () => {
 		releaseUpkeep?.()
 		await sending
 	})
+
+	// A session's chat is restored after its manager is handed out, so the first
+	// send waits on that restore — before `sendInFlight`, which the restore reads
+	// to decide whether to bail.
+	it('queues while a send waits on the chat restore gate', async () => {
+		const manager = new AIChatManager()
+		let openGate: (() => void) | undefined
+		manager.setReadyGate(new Promise<void>((resolve) => (openGate = resolve)))
+		manager.instructions = 'first turn'
+		const sending = manager.sendRequest()
+		await vi.waitFor(() => expect(manager.sendPending).toBe(true))
+		expect(manager.sendInFlight).toBe(false)
+
+		manager.sendOrQueue('fix the failing run')
+		expect(manager.queuedMessage).toBe('fix the failing run')
+
+		openGate?.()
+		await sending
+	})
 })
 
 describe('AIChatManager request errors', () => {
@@ -1660,7 +1679,7 @@ describe('AIChatManager queued messages', () => {
 		mocks.tryGetCurrentModel.mockReturnValue(a)
 		mocks.runChatLoop.mockImplementation(async (config: any) => {
 			// an iteration starts on B...
-			await config.onBeforeIteration?.([], config.helpers, b)
+			await config.onBeforeIteration?.(b)
 			// ...the user switches to C while B's request is in flight...
 			mocks.getCurrentModel.mockReturnValue(c)
 			mocks.tryGetCurrentModel.mockReturnValue(c)
@@ -1773,7 +1792,7 @@ describe('AIChatManager queued messages', () => {
 			// mid-loop switch to a model the deny-list doesn't know...
 			mocks.getCurrentModel.mockReturnValue(unlistedBlind)
 			mocks.tryGetCurrentModel.mockReturnValue(unlistedBlind)
-			await config.onBeforeIteration?.([], config.helpers, unlistedBlind)
+			await config.onBeforeIteration?.(unlistedBlind)
 			// ...its request carries the images and the provider rejects them
 			throw new Error('400 this model does not support image input')
 		})
@@ -4540,3 +4559,113 @@ describe('AIChatManager cross-tab run seams', () => {
 		expect(manager.queuedMessage).toBe('')
 	})
 })
+
+describe('AIChatManager tool views', () => {
+	beforeEach(() => {
+		vi.clearAllMocks()
+		mocks.getCurrentModel.mockReturnValue({ provider: 'openai', model: 'gpt-4o' })
+		mocks.tryGetCurrentModel.mockReturnValue({ provider: 'openai', model: 'gpt-4o' })
+		clearWorkspaceRoleCache()
+	})
+
+	// Every mode assigns the private base separately. A missed site leaves it empty on a fresh
+	// manager, which is what these catch — silently, since nothing throws on an empty tool set.
+	it.each([
+		AIMode.SCRIPT,
+		AIMode.FLOW,
+		AIMode.NAVIGATOR,
+		AIMode.ASK,
+		AIMode.API,
+		AIMode.GLOBAL,
+		AIMode.APP
+	])('assembles tools for %s', async (mode) => {
+		const manager = new AIChatManager()
+		await manager.changeMode(mode)
+		expect(manager.tools.length).toBeGreaterThan(0)
+		expect(manager.availableTools.length).toBeGreaterThan(0)
+	})
+
+	const OPERATOR_WHOAMI = {
+		username: 'op',
+		email: 'admin@test',
+		is_admin: false,
+		is_super_admin: false,
+		operator: true,
+		groups: [],
+		folders: [],
+		folders_read: []
+	}
+
+	// The capability filter is unit-tested against a profile handed to it directly; what is
+	// untested there is that the manager ever hands it one. This drives a real send and reads
+	// the toolset off the request, so moving the resolve out of the pre-flight, or dropping
+	// the rebuild when it lands, fails here rather than shipping an operator write tools.
+	it('withholds write and preview tools from an operator for the whole request', async () => {
+		onTestFinished(() => mocks.whoami.mockReset())
+		mocks.whoami.mockResolvedValue(OPERATOR_WHOAMI)
+		let sent: { tools: string[]; prompt: string; deployKinds: string[] } | undefined
+		mocks.runChatLoop.mockImplementation(async (config: any) => {
+			const deploy = config.tools.find((t: any) => t.def.function.name === 'deploy_workspace_item')
+			sent = {
+				tools: config.tools.map((t: any) => t.def.function.name),
+				prompt: config.systemMessage.content,
+				deployKinds: deploy?.def.function.parameters.properties.type.enum ?? []
+			}
+			return {
+				addedMessages: [],
+				tokenUsage: { prompt: 0, completion: 0, total: 0 },
+				hitMaxIterations: false
+			}
+		})
+
+		const manager = new AIChatManager()
+		manager.isSessionChat = true
+		await manager.sendRequest({ instructions: 'add a script', mode: AIMode.GLOBAL })
+
+		expect(sent?.tools).toEqual(expect.arrayContaining(['list_workspace_items', 'run_script']))
+		// Deploying ships — a draft can predate the role change — but only for the kinds an
+		// operator's token can land.
+		expect(sent?.deployKinds).toContain('schedule')
+		expect(sent?.deployKinds).not.toContain('script')
+		for (const withheld of ['write_script', 'test_run_script']) {
+			expect(sent?.tools).not.toContain(withheld)
+			// The prompt ships beside the tools, so the rebuild must have run after the
+			// profile landed — otherwise it still instructs the model to call these.
+			expect(sent?.prompt).not.toContain(withheld)
+		}
+	})
+
+	// The assistant settings modal resolves the profile on open, before any send, so the
+	// list it shows is the one the first request will carry, prompt included.
+	it('narrows the toolset and prompt when the profile resolves outside a send', async () => {
+		onTestFinished(() => mocks.whoami.mockReset())
+		mocks.whoami.mockResolvedValue(OPERATOR_WHOAMI)
+		const manager = new AIChatManager()
+		manager.mode = AIMode.GLOBAL
+		manager.isSessionChat = true
+		manager.configureGlobalMode()
+		expect(manager.availableTools.map((t) => t.def.function.name)).toContain('write_script')
+
+		await manager.refreshSessionAccess()
+
+		expect(manager.availableTools.map((t) => t.def.function.name)).not.toContain('write_script')
+		expect(manager.systemMessage.content).not.toContain('write_script')
+	})
+
+	// Which transition each posture offers is planModeController.test.ts's; what this pins is
+	// that only `tools` follows the picker. `isSessionChat` is what offers plan mode at all.
+	it('holds availableTools steady across the autonomy picker', async () => {
+		const manager = new AIChatManager()
+		manager.isSessionChat = true
+		await manager.changeMode(AIMode.GLOBAL)
+
+		const names = (tools: { def: { function: { name: string } } }[]) =>
+			tools.map((t) => t.def.function.name)
+		const before = names(manager.availableTools)
+		expect(before).toEqual(expect.arrayContaining(['enter_plan_mode', 'exit_plan_mode']))
+
+		manager.setAutonomyMode(AIAutonomyMode.YOLO)
+		expect(names(manager.tools)).not.toContain('enter_plan_mode')
+		expect(names(manager.availableTools)).toEqual(before)
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/AIChatMessage.svelte b/frontend/src/lib/components/copilot/chat/AIChatMessage.svelte
index afcffbb400..d639255c93 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatMessage.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChatMessage.svelte
@@ -13,7 +13,9 @@
 	import { messageDraft, segments } from './chatDraft'
 	import { lineCountLabel } from './pasteTokens'
 	import ExpandableImage from '$lib/components/common/image/ExpandableImage.svelte'
-	import { workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	const chatHost = getChatViewHost()
 
@@ -23,8 +25,8 @@
 	// to a different copy.
 	const messageWorkspace = $derived.by(() => {
 		// Registers the dependency that `operatingWorkspace`'s own untracked
-		// `get(workspaceStore)` cannot.
-		void $workspaceStore
+		// `get(operatingWorkspace)` cannot.
+		void $operatingWorkspace
 		return chatHost.operatingWorkspace
 	})
 
@@ -44,6 +46,7 @@
 		messageIndex: number
 		editingMessageIndex: number | null
 		isLast?: boolean
+		showAnswerActions?: boolean
 	}
 
 	let {
@@ -51,7 +54,8 @@
 		messageIndex,
 		availableContext,
 		editingMessageIndex = $bindable(null),
-		isLast = false
+		isLast = false,
+		showAnswerActions = true
 	}: Props = $props()
 
 	// The edit box edits a copy of THIS message's original context, not the live
@@ -80,8 +84,8 @@
 {:else}
 	<div
 		class={twMerge(
-			'mb-2 min-w-0',
-			message.role === 'tool' && 'mb-1',
+			'mb-1 min-w-0',
+			message.role === 'user' && 'mb-2',
 			message.role === 'user' && messageIndex > 0 && 'mt-4 mb-6',
 			isLast && '!mb-12',
 			message.role !== 'user' || !chatHost.supportsMessageEditing
@@ -136,9 +140,23 @@
 				/>
 			</div>
 		{:else}
-			<div class={twMerge('text-sm py-1 px-2', message.role === 'tool' && 'text-primary py-0')}>
+			<!-- Assistant and tool rows carry their own 4px above and below their text, so every
+			     pair of consecutive rows sits the same distance apart. -->
+			<div
+				class={twMerge(
+					'text-sm px-2',
+					message.role === 'user' && 'py-1',
+					message.role === 'tool' && 'text-primary'
+				)}
+			>
 				{#if message.role === 'assistant'}
-					<div class="px-[1px]"><AssistantMessage {message} workspace={messageWorkspace} /></div>
+					<div class="px-[1px] group/answer"
+						><AssistantMessage
+							{message}
+							workspace={messageWorkspace}
+							showActions={showAnswerActions}
+						/></div
+					>
 				{:else if message.role === 'tool'}
 					<div class="px-[1px]"
 						><ToolExecutionDisplay message={message as ToolDisplayMessage} /></div
diff --git a/frontend/src/lib/components/copilot/chat/AIChatModelSettings.svelte b/frontend/src/lib/components/copilot/chat/AIChatModelSettings.svelte
index 914ad51bc9..c9c786ccbc 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatModelSettings.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChatModelSettings.svelte
@@ -10,9 +10,7 @@
 	import {
 		COPILOT_SESSION_MODEL_SETTING_NAME,
 		COPILOT_SESSION_PROVIDER_SETTING_NAME,
-		COPILOT_SESSION_REASONING_SETTING_NAME,
-		userStore,
-		workspaceStore
+		COPILOT_SESSION_REASONING_SETTING_NAME
 	} from '$lib/stores'
 	import { storeLocalSetting, type Item } from '$lib/utils'
 	import {
@@ -33,6 +31,14 @@
 		REASONING_OFF,
 		type ReasoningProviderModel
 	} from '../reasoningRegistry'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	let {
 		/** Whether this dropdown carries the custom-prompt entries. Off where the surface
@@ -97,7 +103,7 @@
 	// operations must key off this snapshot, not the reactive `mode`.
 	let activeMode = $state(aiChatManager.mode)
 
-	let isAdmin = $derived(Boolean($userStore?.is_admin || $userStore?.is_super_admin))
+	let isAdmin = $derived(Boolean(actingUser?.is_admin || actingUser?.is_super_admin))
 	// True when the workspace has no AI providers of its own (it uses instance defaults).
 	// In that case the backend never makes workspace custom_prompts effective, so a saved
 	// workspace prompt would be dead config — mirror the settings page and surface it read-only.
@@ -130,7 +136,7 @@
 		if (!isAdmin) {
 			initialPrompt = $copilotInfo.customPrompts?.[activeMode] ?? ''
 		} else {
-			const workspace = $workspaceStore
+			const workspace = $operatingWorkspace
 			try {
 				const settings = workspace ? await WorkspaceService.getSettings({ workspace }) : undefined
 				const providers = settings?.ai_config?.providers ?? {}
@@ -165,7 +171,7 @@
 			return
 		}
 
-		const workspace = $workspaceStore
+		const workspace = $operatingWorkspace
 		if (!workspace) return
 		try {
 			// Saving prompts requires a full ai_config round-trip; fetch the current
diff --git a/frontend/src/lib/components/copilot/chat/AssistantInstructionsSection.svelte b/frontend/src/lib/components/copilot/chat/AssistantInstructionsSection.svelte
index 47f25b6c09..5d825bd5c8 100644
--- a/frontend/src/lib/components/copilot/chat/AssistantInstructionsSection.svelte
+++ b/frontend/src/lib/components/copilot/chat/AssistantInstructionsSection.svelte
@@ -24,6 +24,10 @@ writes whichever of the two changed, including the tab that is not on screen.
 	import { Building2, ExternalLink, User } from 'lucide-svelte'
 	import { untrack } from 'svelte'
 	import { getAiChatManager } from './aiChatManagerContext'
+	import { useOperatingUser } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	let {
 		ws,
@@ -55,7 +59,7 @@ writes whichever of the two changed, including the tab that is not on screen.
 			? `Applies to everyone in ${ws}.`
 			: 'Stored in this browser and sent in every workspace, so they follow you rather than the workspace.'
 	)
-	// `$userStore.is_admin` is the role in the nav workspace, not necessarily in `ws`, so
+	// `actingUser?.is_admin` is the role in the nav workspace, not necessarily in `ws`, so
 	// the resolved role is keyed to the workspace it was read for, and an unresolved one
 	// reads as no admin: offering the field and taking it away on resolve would discard
 	// whatever was typed in between. Superadmin holds everywhere.
@@ -69,8 +73,8 @@ writes whichever of the two changed, including the tab that is not on screen.
 	let roleUnknown = $derived(roleRead !== undefined && !roleRead.user && !navIsTarget)
 	let isAdmin = $derived(
 		Boolean(
-			$userStore?.is_super_admin ||
-				(roleForTarget ? roleForTarget.is_admin : navIsTarget && $userStore?.is_admin)
+			actingUser?.is_super_admin ||
+				(roleForTarget ? roleForTarget.is_admin : navIsTarget && actingUser?.is_admin)
 		)
 	)
 
diff --git a/frontend/src/lib/components/copilot/chat/AssistantMessage.svelte b/frontend/src/lib/components/copilot/chat/AssistantMessage.svelte
index 44cedf323c..b6455980a3 100644
--- a/frontend/src/lib/components/copilot/chat/AssistantMessage.svelte
+++ b/frontend/src/lib/components/copilot/chat/AssistantMessage.svelte
@@ -13,15 +13,38 @@
 	} from './workspaceItems.svelte'
 	import { markdownProse } from '$lib/components/markdownProse'
 	import DisplayResult from '$lib/components/DisplayResult.svelte'
+	import { Bot, ExternalLink } from 'lucide-svelte'
+	import CopyButton from '$lib/components/common/button/CopyButton.svelte'
+	import { base } from '$lib/base'
+	import { displayDate, truncateRev } from '$lib/utils'
 
 	interface Props {
 		message: DisplayMessage
 		// Workspace the message's paths are resolved against: the one the chat
 		// operates on, which is not always the one being navigated.
 		workspace: string | undefined
+		// Only the last answer of a run (a copilot turn, or a flow step's run) gets the copy /
+		// timestamp / run row: it stays in the layout while invisible, so on an answer between
+		// tool calls it would double the gap below it.
+		showActions?: boolean
 	}
 
-	let { message, workspace }: Props = $props()
+	let { message, workspace, showActions = true }: Props = $props()
+
+	// The run this answer came out of. Only a flow chat has one — a copilot turn runs in
+	// the browser — so the job link is absent rather than empty elsewhere.
+	const jobId = $derived(message.role === 'assistant' ? message.jobId : undefined)
+	const createdAt = $derived(message.role === 'assistant' ? message.createdAt : undefined)
+	const runHref = $derived(jobId ? `${base}/run/${jobId}?workspace=${workspace}` : undefined)
+	// Today's answers show the time alone; the day earns its place only on a conversation
+	// read back later. Resolved at render, so a chat left open across midnight keeps
+	// yesterday's format until it is reopened.
+	const timestamp = $derived.by(() => {
+		if (!createdAt) return undefined
+		const at = new Date(createdAt)
+		const today = new Date().toDateString() === at.toDateString()
+		return displayDate(at, false, !today)
+	})
 
 	const reasoning = $derived(
 		message.role === 'assistant' ? message.reasoning?.trim() || undefined : undefined
@@ -113,9 +136,16 @@
 	})
 </script>
 
+<!-- An agent step's answer is headed by the agent's own icon, hung in the margin so the
+     answer itself stays on the same left edge as the reader's messages. The icon sits in
+     the padding the message column already carries. -->
 {#if stepName}
-	<div class="text-2xs text-tertiary font-medium mb-1 truncate" title="Answered by {stepName}">
-		{stepName}
+	<div
+		class="flex items-center gap-2 -ml-6 pt-1 text-2xs text-tertiary"
+		title="Answered by {stepName}"
+	>
+		<Bot size={16} class="shrink-0" />
+		<span class="font-mono truncate">{stepName}</span>
 	</div>
 {/if}
 
@@ -125,7 +155,7 @@
 		expanded={reasoningExpanded}
 		onToggle={() => (reasoningToggled = !reasoningExpanded)}
 		shimmer={reasoningStreaming}
-		class="mb-2"
+		class={message.content ? 'mb-1' : ''}
 		labelClass="truncate"
 		contentClass="font-main text-secondary {markdownProse.xs}"
 	>
@@ -134,9 +164,36 @@
 {/if}
 
 {#if s3Object}
-	<DisplayResult result={s3Object} workspaceId={workspace} noControls={true} />
+	<div class="py-1">
+		<DisplayResult result={s3Object} workspaceId={workspace} noControls={true} />
+	</div>
 {:else if message.content}
-	<div class="w-full space-y-2 {markdownProse.sm}">
+	<div class="w-full space-y-2 py-1 {markdownProse.sm}">
 		<Markdown md={message.content} {plugins} />
 	</div>
 {/if}
+
+{#if message.content && showActions}
+	<!-- Kept in flow while invisible, so revealing it on hover does not nudge the message
+	     below. A thinking-only row has no answer to copy, and its run's last answer links the run. -->
+	<div
+		class="flex items-center gap-2 text-2xs text-tertiary opacity-0 transition-opacity duration-150 group-hover/answer:opacity-100 focus-within:opacity-100"
+	>
+		<CopyButton value={message.content} title="Copy answer" class="-ml-1" />
+		{#if timestamp}
+			<span>{timestamp}</span>
+		{/if}
+		{#if runHref}
+			<a
+				href={runHref}
+				target="_blank"
+				rel="noopener noreferrer"
+				class="inline-flex items-center gap-1 hover:text-primary hover:underline"
+				title="Open this run"
+			>
+				<span>job <span class="font-mono">{truncateRev(jobId ?? '', 8)}</span></span>
+				<ExternalLink size={11} class="shrink-0" />
+			</a>
+		{/if}
+	</div>
+{/if}
diff --git a/frontend/src/lib/components/copilot/chat/AssistantSettingsModal.svelte b/frontend/src/lib/components/copilot/chat/AssistantSettingsModal.svelte
index 7694be3827..8e299a4d3e 100644
--- a/frontend/src/lib/components/copilot/chat/AssistantSettingsModal.svelte
+++ b/frontend/src/lib/components/copilot/chat/AssistantSettingsModal.svelte
@@ -19,7 +19,6 @@ callers that already know which section they mean, such as the "+" menu's Manage
 	import Modal2 from '$lib/components/common/modal/Modal2.svelte'
 	import SidebarNavigation from '$lib/components/common/sidebar/SidebarNavigation.svelte'
 	import Tooltip from '$lib/components/meltComponents/Tooltip.svelte'
-	import { workspaceStore } from '$lib/stores'
 	import { logFeatureUsage } from '$lib/utils/featureUsage'
 	import { getAiChatManager } from './aiChatManagerContext'
 	import { summarizeTools } from './agentContext'
@@ -28,6 +27,9 @@ callers that already know which section they mean, such as the "+" menu's Manage
 	import AssistantInstructionsSection from './AssistantInstructionsSection.svelte'
 	import AssistantMcpSection from './AssistantMcpSection.svelte'
 	import AssistantFilesSection from './AssistantFilesSection.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	const aiChatManager = getAiChatManager()
 
@@ -88,13 +90,13 @@ callers that already know which section they mean, such as the "+" menu's Manage
 	// unconditionally rather than behind `??`: short-circuiting it would leave this
 	// derived with no dependency at all, frozen on the workspace it first saw.
 	let ws = $derived.by(() => {
-		const active = $workspaceStore
+		const active = $operatingWorkspace
 		return aiChatManager.operatingWorkspace ?? active ?? ''
 	})
 
-	// Exactly what the chat loop sends — plan mode's transition tool is registered
-	// alongside `tools` there, so listing only `tools` would under-report.
-	let tools = $derived(summarizeTools([...aiChatManager.tools, ...aiChatManager.planMode.tools]))
+	// The session's capability surface, not this turn's: the heading answers what the
+	// assistant can call here, so it must not shift when the autonomy picker does.
+	let tools = $derived(summarizeTools(aiChatManager.availableTools))
 
 	// `SidebarNavigation`'s item shape, which is what the instance and workspace settings
 	// navs are built from too.
@@ -147,6 +149,7 @@ callers that already know which section they mean, such as the "+" menu's Manage
 		if (!aiChatManager.loading && !aiChatManager.sendInFlight) {
 			void aiChatManager.refreshGlobalSkills()
 			void aiChatManager.refreshMcpServers()
+			void aiChatManager.refreshSessionAccess()
 		}
 	}
 </script>
diff --git a/frontend/src/lib/components/copilot/chat/ChatContextPicker.svelte b/frontend/src/lib/components/copilot/chat/ChatContextPicker.svelte
index d2cf1dfee6..68a65d75fc 100644
--- a/frontend/src/lib/components/copilot/chat/ChatContextPicker.svelte
+++ b/frontend/src/lib/components/copilot/chat/ChatContextPicker.svelte
@@ -19,7 +19,6 @@ On a workspace-leaf pick, emits a reference-only `WorkspaceScriptElement` /
 Content is materialized at message-prep time by `AIChatManager` — see PR #9216.
 -->
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import { Database, Diff, FileText, Folder, Layers } from 'lucide-svelte'
 	import BarsStaggered from '$lib/components/icons/BarsStaggered.svelte'
 	import FlowModuleIcon from '$lib/components/flows/FlowModuleIcon.svelte'
@@ -45,6 +44,9 @@ Content is materialized at message-prep time by `AIChatManager` — see PR #9216
 		type WorkspaceFlowElement,
 		type WorkspaceScriptElement
 	} from './context'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		availableContext: ContextElement[]
@@ -105,7 +107,7 @@ Content is materialized at message-prep time by `AIChatManager` — see PR #9216
 		aiChatManager.mode === AIMode.GLOBAL ? ['flow', 'script', 'app'] : ['flow', 'script']
 	)
 	const loader = useWorkspaceItemsLoader(
-		() => $workspaceStore,
+		() => $operatingWorkspace,
 		() => WORKSPACE_KINDS
 	)
 
diff --git a/frontend/src/lib/components/copilot/chat/CompactionBoundary.svelte b/frontend/src/lib/components/copilot/chat/CompactionBoundary.svelte
index 3a04ebccf2..1cb87e61a9 100644
--- a/frontend/src/lib/components/copilot/chat/CompactionBoundary.svelte
+++ b/frontend/src/lib/components/copilot/chat/CompactionBoundary.svelte
@@ -2,6 +2,7 @@
 	import { Button } from '$lib/components/common'
 	import { ChevronDown, ChevronRight, History } from 'lucide-svelte'
 	import type { AttachedTextFile } from './textFileUtils'
+	import LabeledDivider from '$lib/components/LabeledDivider.svelte'
 
 	let { content, files }: { content: string; files?: AttachedTextFile[] } = $props()
 
@@ -9,8 +10,7 @@
 </script>
 
 <div class="my-4 px-2">
-	<div class="flex items-center gap-2">
-		<div class="h-px flex-1 bg-surface-selected"></div>
+	<LabeledDivider>
 		<Button
 			variant="subtle"
 			size="xs2"
@@ -22,8 +22,7 @@
 				Summarized earlier conversation
 			</span>
 		</Button>
-		<div class="h-px flex-1 bg-surface-selected"></div>
-	</div>
+	</LabeledDivider>
 	{#if expanded}
 		<div
 			class="mt-2 max-h-80 overflow-y-auto whitespace-pre-wrap rounded-md bg-surface-secondary p-3 text-xs text-secondary"
diff --git a/frontend/src/lib/components/copilot/chat/ContextTextarea.svelte b/frontend/src/lib/components/copilot/chat/ContextTextarea.svelte
index 976b969b3f..dd3a011da2 100644
--- a/frontend/src/lib/components/copilot/chat/ContextTextarea.svelte
+++ b/frontend/src/lib/components/copilot/chat/ContextTextarea.svelte
@@ -10,7 +10,13 @@
 	import { zIndexes } from '$lib/zIndexes'
 	import { twMerge } from 'tailwind-merge'
 	import { CHAT_INPUT_PADDING, getAiChatManager } from './aiChatManagerContext'
-	import { MENTION_RE, mentionTitle, formatMention } from './mention'
+	import {
+		MENTION_RE,
+		mentionTitle,
+		formatMention,
+		hasMentionLeadingBoundary,
+		mentionTitlesInText
+	} from './mention'
 	import { createFloatingActions, createVirtualElement } from 'svelte-floating-ui'
 	import { flip, offset, shift } from 'svelte-floating-ui/dom'
 	import {
@@ -65,17 +71,11 @@
 
 	const aiChatManager = getAiChatManager()
 
-	function extractMentions(text: string): Set<string> {
-		const out = new Set<string>()
-		for (const m of text.matchAll(MENTION_RE)) out.add(mentionTitle(m[0]))
-		return out
-	}
-
 	// Titles currently appearing as `@title` mentions in the textarea. Compared
 	// against the previous snapshot in a $effect (NOT inside handleInput —
 	// the picker mutates `value` programmatically via `updateInstructionsWithContext`,
 	// which doesn't fire `oninput`, so a handleInput-only diff goes stale).
-	const mentionedTitles = $derived(extractMentions(value))
+	const mentionedTitles = $derived(mentionTitlesInText(value))
 	let prevMentionedTitles = $state<Set<string>>(new Set())
 
 	let showContextTooltip = $state(false)
@@ -268,7 +268,11 @@
 			if (!att) return match
 			return `<span data-paste-id="${att.id}" class="rounded bg-surface-secondary text-secondary cursor-pointer pointer-events-auto">${match}</span>`
 		})
-		html = html.replace(MENTION_RE, (match) => {
+		html = html.replace(MENTION_RE, (match, ...args) => {
+			const offset = args[args.length - 2]
+			if (typeof offset !== 'number' || !hasMentionLeadingBoundary(html, offset)) {
+				return match
+			}
 			const title = unescapeHtml(mentionTitle(match))
 			const inContext =
 				availableContext.find((c) => c.title === title) ||
@@ -566,6 +570,23 @@
 		showContextTooltip = false
 	}
 
+	export async function insertMention(title: string) {
+		const token = formatMention(title)
+		const selectionStart = textarea?.selectionStart ?? value.length
+		const selectionEnd = textarea?.selectionEnd ?? selectionStart
+		const { from, to, ids } = tokensOverlapping(selectionStart, selectionEnd)
+		const before = value.slice(0, from)
+		const after = value.slice(to)
+		const prefix = before.length === 0 || /\s$/.test(before) ? '' : ' '
+		const suffix = after.length === 0 ? ' ' : /^\s/.test(after) ? '' : ' '
+		const inserted = `${prefix}${token}${suffix}`
+		replacePasteRange(from, to, ids, inserted)
+		await tick()
+		const pos = from + inserted.length
+		textarea?.setSelectionRange(pos, pos)
+		textarea?.focus()
+	}
+
 	function refreshCommandSkills() {
 		if (commandSkillsRefreshInFlight) return
 		commandSkillsRefreshInFlight = true
diff --git a/frontend/src/lib/components/copilot/chat/ContextUsageIndicator.svelte b/frontend/src/lib/components/copilot/chat/ContextUsageIndicator.svelte
index cd6c58b2a3..b49bc582ef 100644
--- a/frontend/src/lib/components/copilot/chat/ContextUsageIndicator.svelte
+++ b/frontend/src/lib/components/copilot/chat/ContextUsageIndicator.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
 	import { copilotInfo, copilotSessionModel } from '$lib/aiStore'
-	import { getKnownModelContextWindow, getModelContextWindow } from '../modelConfig'
+	import { getConfiguredModelContextWindow, getEffectiveModelContextWindow } from '../modelConfig'
 	import { getChatViewHost } from './chatViewHost'
 	import { AIMode } from './AIChatManager.svelte'
 	import UsageMeter from './UsageMeter.svelte'
@@ -15,14 +15,26 @@
 	let providerModel = $derived(
 		$copilotSessionModel ?? $copilotInfo.defaultModel ?? $copilotInfo.aiModels[0]
 	)
-	// The same number the compaction trigger uses: the known window when the
-	// model is listed, otherwise the conservative window the trigger assumes.
-	// The tooltip marks the assumed case so the guess never reads as a spec.
+	// The same number the compaction trigger uses: the workspace's override or
+	// the known window when there is one, otherwise the conservative window the
+	// trigger assumes. The tooltip marks the assumed case so the guess never
+	// reads as a spec.
 	let contextWindow = $derived(
-		providerModel ? getModelContextWindow(providerModel.model) : undefined
+		providerModel
+			? getEffectiveModelContextWindow(
+					providerModel.provider,
+					providerModel.model,
+					$copilotInfo.contextWindowPerModel
+				)
+			: undefined
 	)
 	let windowIsAssumed = $derived(
-		providerModel !== undefined && getKnownModelContextWindow(providerModel.model) === undefined
+		providerModel !== undefined &&
+			getConfiguredModelContextWindow(
+				providerModel.provider,
+				providerModel.model,
+				$copilotInfo.contextWindowPerModel
+			) === undefined
 	)
 	// The same number the compaction trigger uses: the provider's report when
 	// one describes the current history (one turn stale by nature), otherwise
diff --git a/frontend/src/lib/components/copilot/chat/DatatableCreationPolicy.svelte b/frontend/src/lib/components/copilot/chat/DatatableCreationPolicy.svelte
index 65abb0e1c5..6b4cbbd710 100644
--- a/frontend/src/lib/components/copilot/chat/DatatableCreationPolicy.svelte
+++ b/frontend/src/lib/components/copilot/chat/DatatableCreationPolicy.svelte
@@ -5,11 +5,13 @@
 
 	const aiChatManager = getAiChatManager()
 	import DefaultDatabaseSelector from '$lib/components/raw_apps/DefaultDatabaseSelector.svelte'
-	import { workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 	import { createDatatablesResource } from '$lib/components/raw_apps/datatableUtils.svelte'
 
 	// Load available datatables from workspace using shared utility
-	const datatables = createDatatablesResource(() => $workspaceStore)
+	const datatables = createDatatablesResource(() => $operatingWorkspace)
 
 	const hasNoDatatables = $derived((datatables.current?.length ?? 0) === 0)
 
@@ -67,6 +69,7 @@
 		<DefaultDatabaseSelector
 			datatable={aiChatManager.datatableCreationPolicy.datatable}
 			schema={aiChatManager.datatableCreationPolicy.schema}
+			roles={aiChatManager.datatableCreationPolicy.roles}
 			onChange={handleDefaultChange}
 			description="Set the default datatable and schema for new tables. When table creation is enabled, AI can create tables here if needed."
 		/>
diff --git a/frontend/src/lib/components/copilot/chat/HistoryManager.svelte.ts b/frontend/src/lib/components/copilot/chat/HistoryManager.svelte.ts
index d956b4c0c0..7843169dd9 100644
--- a/frontend/src/lib/components/copilot/chat/HistoryManager.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/HistoryManager.svelte.ts
@@ -394,7 +394,10 @@ export default class HistoryManager {
 			.sort((a, b) => b.lastModified - a.lastModified)
 	)
 
-	async init() {
+	/** With `session`, loads only that session's chats plus `session.chatId`, which
+	 *  may predate session tagging. Loading every chat instead costs one full copy
+	 *  of the user's history per session runtime. */
+	async init(session?: { id: string; chatId?: string }) {
 		// (Re)initializing adopts a new identity's history: drop the previous
 		// identity's cached blob ids with it.
 		this.imageIdByUrl.clear()
@@ -404,7 +407,16 @@ export default class HistoryManager {
 		const db = await this.dbh.whenReady()
 		if (!db) return
 		try {
-			const chats = await db.getAll('chats')
+			let chats: StoredChat[]
+			if (session) {
+				chats = await db.getAllFromIndex('chats', 'by-session', session.id)
+				if (session.chatId && !chats.some((c) => c.id === session.chatId)) {
+					const current = await db.get('chats', session.chatId)
+					if (current) chats.push(current)
+				}
+			} else {
+				chats = await db.getAll('chats')
+			}
 			this.savedChats = chats.reduce(
 				(acc, chat) => {
 					acc[chat.id] = chat
diff --git a/frontend/src/lib/components/copilot/chat/HistoryManager.test.ts b/frontend/src/lib/components/copilot/chat/HistoryManager.test.ts
index cdbf6f2020..3ee9edad39 100644
--- a/frontend/src/lib/components/copilot/chat/HistoryManager.test.ts
+++ b/frontend/src/lib/components/copilot/chat/HistoryManager.test.ts
@@ -816,3 +816,36 @@ describe('HistoryManager.reloadChat', () => {
 		expect(await hm.reloadChat(hm.getCurrentChatId())).toBe('unavailable')
 	})
 })
+
+describe('HistoryManager.init for a session', () => {
+	it("loads the session's chats and its current chat, not other sessions'", async () => {
+		const setup = new HistoryManager()
+		await setup.init()
+		setup.close()
+		const chat = (id: string, sessionId?: string) => ({
+			id,
+			actualMessages: [],
+			displayMessages: [],
+			title: id,
+			lastModified: 1,
+			...(sessionId ? { sessionId } : {})
+		})
+		const db = await openDB('copilot-chat-history::admin@test')
+		await db.put('chats' as never, chat('mine', 's1') as never)
+		await db.put('chats' as never, chat('other-session', 's2') as never)
+		await db.put('chats' as never, chat('untagged-current') as never)
+		await db.put('chats' as never, chat('untagged-other') as never)
+		db.close()
+
+		const hm = new HistoryManager()
+		await hm.init({ id: 's1', chatId: 'untagged-current' })
+
+		// The current chat can predate session tagging, so it is read by key.
+		expect(
+			hm
+				.getAllSavedChats()
+				.map((c) => c.id)
+				.sort()
+		).toEqual(['mine', 'untagged-current'])
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/LinkRenderer.svelte b/frontend/src/lib/components/copilot/chat/LinkRenderer.svelte
index 364e7fceaf..bce53625bb 100644
--- a/frontend/src/lib/components/copilot/chat/LinkRenderer.svelte
+++ b/frontend/src/lib/components/copilot/chat/LinkRenderer.svelte
@@ -13,7 +13,7 @@
 		type WindmillItemKind,
 		type WorkspaceItemTargetKind
 	} from './workspaceItems.svelte'
-	import { safeHref } from './safeHref'
+	import { safeHref } from '$lib/utils/safeHref'
 
 	type Props = {
 		href?: string
@@ -34,8 +34,8 @@
 		title
 	}: Props = $props()
 
-	// The drawers ride with the docked chat, so a surface can render this pill with nothing
-	// able to open one.
+	// The drawers ride with the docked chat and the session tabs with the sessions page, so a
+	// surface can render this pill with nothing able to open one.
 	const available = $derived.by(() => {
 		const action = workspaceItemAction(wmKind, wmPath, wmTargetKind, wmRawApp === 'true')
 		return action && hasToolDisplayActionHandler(action.type) ? action : undefined
@@ -113,8 +113,8 @@
 					variant="subtle"
 					iconOnly
 					startIcon={{ icon: PanelRight }}
-					title="Open in drawer"
-					aria-label="Open {wmPath} in drawer"
+					title="Open in editor"
+					aria-label="Open {wmPath} in editor"
 					wrapperClasses="ml-0.5 inline-flex self-center shrink-0 opacity-0 group-hover:opacity-100 transition-opacity"
 					btnClasses="!w-auto !rounded !p-0.5 !text-tertiary"
 					onClick={openDrawer}
diff --git a/frontend/src/lib/components/copilot/chat/RunScriptCard.svelte b/frontend/src/lib/components/copilot/chat/RunScriptCard.svelte
index edd1704bb2..4aff51d002 100644
--- a/frontend/src/lib/components/copilot/chat/RunScriptCard.svelte
+++ b/frontend/src/lib/components/copilot/chat/RunScriptCard.svelte
@@ -9,6 +9,7 @@
 	import DisplayResult from '$lib/components/DisplayResult.svelte'
 	import { msToReadableTime } from '$lib/utils'
 	import JobArgs from '$lib/components/JobArgs.svelte'
+	import { JobService, type CompletedJob, type Job } from '$lib/gen'
 	import { base } from '$lib/base'
 	import { getAiChatManager } from './aiChatManagerContext'
 	import ChatCollapsibleCard from './ChatCollapsibleCard.svelte'
@@ -16,51 +17,108 @@
 	import ToolContentDisplay from './ToolContentDisplay.svelte'
 	import ToolPreviewCard from './ToolPreviewCard.svelte'
 	import { scrollFades } from './scrollFades.svelte'
-	import { isActiveRunForm, MAX_LOG_LENGTH, type ToolDisplayMessage } from './shared'
+	import {
+		deriveChatJobStatus,
+		isActiveRunForm,
+		MAX_LOG_LENGTH,
+		type ToolDisplayMessage
+	} from './shared'
 
 	const aiChatManager = getAiChatManager()
 
+	const LOGS_UNREADABLE = { logs: '', logsFailed: true } as const
+
 	interface Props {
 		message: ToolDisplayMessage
 	}
 
 	let { message }: Props = $props()
 
-	const runForm = $derived(message.runForm!)
-	const runnableKind = $derived(runForm.runnableKind ?? 'script')
+	const runForm = $derived(message.runForm)
+	// The run this call inspected instead of starting. Exclusive with runForm: a call
+	// either ran something or looked at a run.
+	const inspected = $derived(message.inspectedRun)
 	// The loop is parked on the form and nothing has run yet: the card is the form.
 	const pending = $derived(isActiveRunForm(message))
 
+	// An inspected run is read from the job itself rather than from the tool result, which
+	// is the copy capped for the model. Fetched on first expand, and only then: a transcript
+	// of collapsed inspections must not fire a request per row.
+	let fetched = $state<
+		{ callId: string; job: Job; logs: string; logsFailed?: boolean } | undefined
+	>(undefined)
+	let fetchFailed = $state<string | undefined>(undefined)
+	// Keyed by call id like the rest of this card's state, not by the job it read: a summarized
+	// transcript hands a surviving instance a different row, and two rows can inspect one job
+	// at different moments, so a job-keyed snapshot would serve the earlier row's reading.
+	const inspectedJob = $derived(fetched?.callId === message.tool_call_id ? fetched : undefined)
+
+	const inspectedStatus = $derived(inspectedJob ? deriveChatJobStatus(inspectedJob.job) : undefined)
+
 	const chatJob = $derived(
 		aiChatManager.backgroundJobs.find((j) => j.toolCallId === message.tool_call_id)
 	)
+	// The run the card is about, whichever way it got here. The inspected one is known by
+	// id before it is read, which is what lets the preview chip work on a collapsed card.
+	const job = $derived(
+		chatJob ??
+			(inspected
+				? {
+						jobId: inspected.jobId,
+						workspace: inspected.workspace,
+						status: inspectedStatus
+					}
+				: undefined)
+	)
+	const runnableKind = $derived(
+		runForm?.runnableKind ??
+			(inspectedJob?.job.job_kind === 'flow' || inspectedJob?.job.job_kind === 'flowpreview'
+				? 'flow'
+				: 'script')
+	)
 	// Declining the form, stopping the turn and cancelling the job all land here, and none
 	// of them is a failure: the run stopped because someone said so.
 	const canceled = $derived(
-		Boolean(message.declinedByUser) || Boolean(runForm.canceled) || chatJob?.status === 'canceled'
+		Boolean(message.declinedByUser) || Boolean(runForm?.canceled) || job?.status === 'canceled'
+	)
+	const failed = $derived(
+		inspected ? inspectedStatus === 'failure' : Boolean(message.error) && !canceled
 	)
-	const failed = $derived(Boolean(message.error) && !canceled)
 	// A cancelled form never reached a job, so it has no logs and no outcome to offer.
 	const ran = $derived(
-		Boolean(runForm.started) || Boolean(message.logs) || message.result !== undefined || !!chatJob
+		Boolean(runForm?.started) || Boolean(message.logs) || message.result !== undefined || !!job
 	)
 	// A run can outlive the turn that started it, so "the tool call returned" is not
 	// "the run finished": a detached job keeps the card in its running state until
-	// the background poller lands an outcome on it or the tray sees the job end.
+	// the background poller lands an outcome on it or the tray sees the job end. An
+	// inspected run has no poller behind it — the status it was read at is the answer.
 	const settled = $derived(
-		!pending &&
-			!message.isLoading &&
-			(message.result !== undefined ||
-				failed ||
-				canceled ||
-				(chatJob !== undefined && ['success', 'failure', 'canceled'].includes(chatJob.status)))
+		inspected
+			? ['success', 'failure', 'canceled'].includes(inspectedStatus ?? '')
+			: !pending &&
+					!message.isLoading &&
+					(message.result !== undefined ||
+						failed ||
+						canceled ||
+						(chatJob !== undefined && ['success', 'failure', 'canceled'].includes(chatJob.status)))
 	)
 	const running = $derived(!pending && !settled)
+	// The job the card is about has not been read yet, or could not be: no pane has anything
+	// to show, but the call's own result still has.
+	const jobPending = $derived(Boolean(inspected) && !inspectedJob)
 
+	// An inspected run's panes come from the job: the tool's own parameters are the
+	// address it was called with, and its result is the model's abridged view.
 	const parameters = $derived(
-		message.parameters && typeof message.parameters === 'object' ? message.parameters : {}
+		inspected
+			? (inspectedJob?.job.args ?? {})
+			: message.parameters && typeof message.parameters === 'object'
+				? message.parameters
+				: {}
+	)
+	const logs = $derived(
+		inspected ? (inspectedJob?.logs ?? '') : typeof message.logs === 'string' ? message.logs : ''
 	)
-	const logs = $derived(typeof message.logs === 'string' ? message.logs : '')
 	const logLineCount = $derived(logs.trim() ? logs.trimEnd().split('\n').length : 0)
 	// What the job has streamed of its result so far. Only ever set while it runs: the
 	// terminal patch clears it, so a settled card reads its outcome off `result` alone.
@@ -74,6 +132,12 @@
 	// pretty view buys. A string that happens to be JSON parses back as JSON, and the
 	// text it was stored as is one toggle away in the raw view.
 	const resultValue = $derived.by(() => {
+		// Only a completed job carries a result; a queued or running one has none, and reading
+		// it off that job is a type error rather than an undefined.
+		if (inspected)
+			return inspectedJob && 'success' in inspectedJob.job
+				? (inspectedJob.job as CompletedJob).result
+				: undefined
 		if (message.result === undefined) return undefined
 		if (typeof message.result !== 'string') return message.result
 		try {
@@ -82,20 +146,32 @@
 			return message.result
 		}
 	})
-
 	// The row is the card's whole heading, in the tense the call is in: a run cancelled
 	// before it started never ran, so it is still the thing that was going to be run. A
 	// test says so, since what it ran is the draft rather than what is deployed.
 	const verbs = $derived(
-		runForm.kind === 'test'
+		runForm?.kind === 'test'
 			? { present: 'Testing', past: 'Tested', future: 'Test' }
 			: { present: 'Running', past: 'Ran', future: 'Run' }
 	)
+	// Where the runnable is filed, for the preview chip's title. An inspected preview run
+	// has no path at all, so the card falls back to naming the job.
+	const path = $derived(runForm?.path ?? inspectedJob?.job.script_path ?? '')
 	// What the script is called on its own page and in the picker, so the row names the thing
 	// that ran rather than where it is filed. Not every script has one, so the path stays the
 	// fallback — and stays on the preview chip either way, since two folders can hold one name.
-	const runnableName = $derived(runForm.summary || runForm.path)
-	const verb = $derived(running ? verbs.present : settled && ran ? verbs.past : verbs.future)
+	// An inspection names the run instead: it is about that run, the address is what the call
+	// was made with, and naming the runnable would rewrite the row once the job is read.
+	const runnableName = $derived(
+		inspected
+			? `${inspected.step ? `step ${inspected.step} of ` : ''}run ${inspected.runId}`
+			: runForm?.summary || runForm?.path || ''
+	)
+	// Inspecting is done the moment the tool returned, whatever the run it looked at is
+	// still doing — the tense belongs to the call, not to its subject.
+	const verb = $derived(
+		inspected ? 'Inspected' : running ? verbs.present : settled && ran ? verbs.past : verbs.future
+	)
 
 	// Being cancelled is an outcome like any other, and it is the one the card has to say out
 	// loud: nothing came back, so no other tab can carry it.
@@ -130,9 +206,63 @@
 	const activeTab = $derived(steered && tabs.some((t) => t.value === steered) ? steered : autoTab)
 
 	// Keyed by call id: a bare flag would carry one card's collapse onto the next message
-	// reusing this instance. Open by default, since the run is what was asked for.
+	// reusing this instance. Open by default, since the run is what was asked for —
+	// except for an inspection, which is usually a step in the reasoning rather than
+	// the answer, and which pays a fetch for being opened.
 	let toggled = $state<{ id: string; open: boolean } | undefined>(undefined)
-	const expanded = $derived(toggled?.id === message.tool_call_id ? toggled.open : true)
+	const expanded = $derived(toggled?.id === message.tool_call_id ? toggled.open : !inspected)
+
+	$effect(() => {
+		const target = inspected
+		// Collapsing clears a failure so reopening tries again, which is how the rest of the
+		// chat treats a load that did not land — a dropped connection must not be permanent.
+		if (!target || !expanded) {
+			fetchFailed = undefined
+			// A job whose logs did not land is dropped with it: the job itself is cached, so
+			// reopening would otherwise keep serving the unreadable logs for the session.
+			if (fetched?.logsFailed) fetched = undefined
+			return
+		}
+		const callId = message.tool_call_id
+		if (fetched?.callId === callId || fetchFailed === callId) return
+		const jobReq = JobService.getJob({
+			workspace: target.workspace,
+			id: target.jobId,
+			noCode: true,
+			noLogs: true
+		})
+		// The dedicated endpoint, as get_run uses it, and the whole log does come down for a
+		// 4000-char tail. The cheap reads cannot replace it: the job's own `logs` field is
+		// `right(job_logs.logs, 20000)`, and compaction leaves as few as 3000 characters in
+		// that column, so a large log would show less here than the model was given.
+		const logsReq = JobService.getJobLogs({
+			workspace: target.workspace,
+			id: target.jobId,
+			removeAnsiWarnings: true
+		})
+		let live = true
+		Promise.all([
+			// Something back is the success test, not "it did not throw": the generated client
+			// resolves nothing when it cannot read the body.
+			jobReq.then((j) => j ?? Promise.reject(new Error('job unreadable'))),
+			// Here an empty string is a real answer — a flow's own job prints nothing.
+			logsReq.then(
+				(l) => (typeof l === 'string' ? { logs: l.slice(-MAX_LOG_LENGTH) } : LOGS_UNREADABLE),
+				() => LOGS_UNREADABLE
+			)
+		])
+			.then(([j, l]) => {
+				if (live) fetched = { callId, job: j, ...l }
+			})
+			.catch(() => {
+				if (live) fetchFailed = callId
+			})
+		return () => {
+			live = false
+			jobReq.cancel()
+			logsReq.cancel()
+		}
+	})
 
 	// The panel mounts the chat's own form on this call, so the card must not mount a second
 	// one: two views binding the one draft would each reorder the schema SchemaForm edits in
@@ -217,7 +347,7 @@
 		if (canceled) return 'text-tertiary'
 		if (failed) return 'text-red-800 dark:text-red-300'
 		if (!ran) return 'text-tertiary'
-		switch (chatJob?.status) {
+		switch (job?.status) {
 			case 'running':
 				return 'text-blue-800 dark:text-blue-200'
 			case 'suspended':
@@ -248,16 +378,16 @@
 			? aiChatManager.openRunForm
 				? ('form' as const)
 				: undefined
-			: chatJob
+			: job
 				? ('run' as const)
 				: undefined
 	)
 	const previewTitle = $derived(
 		previewTarget === 'form'
-			? `Open this form in the preview panel: ${runForm.path}`
+			? `Open this form in the preview panel: ${path}`
 			: aiChatManager.openRunInPreview
-				? `Open this run in the preview panel: ${runForm.path}`
-				: `Open this run in a new tab: ${runForm.path}`
+				? `Open this run in the preview panel: ${path || runnableName}`
+				: `Open this run in a new tab: ${path || runnableName}`
 	)
 
 	function openPreview() {
@@ -266,16 +396,12 @@
 			aiChatManager.openRunForm?.({ toolCallId: message.tool_call_id, label })
 			return
 		}
-		if (!chatJob) return
+		if (!job) return
 		// Outside a session there is no panel, so the run opens where the jobs tray sends it.
 		if (aiChatManager.openRunInPreview) {
-			aiChatManager.openRunInPreview({ jobId: chatJob.jobId, workspace: chatJob.workspace, label })
+			aiChatManager.openRunInPreview({ jobId: job.jobId, workspace: job.workspace, label })
 		} else {
-			window.open(
-				`${base}/run/${chatJob.jobId}?workspace=${chatJob.workspace}`,
-				'_blank',
-				'noreferrer'
-			)
+			window.open(`${base}/run/${job.jobId}?workspace=${job.workspace}`, '_blank', 'noreferrer')
 		}
 	}
 </script>
@@ -285,7 +411,9 @@
      that number is still moving. `font-medium` because the row is a button and the base layer
      sets those semibold, which would leave this the one bold word in the header. -->
 {#snippet status()}
-	{#if !pending}
+	<!-- An inspection reports nothing here: the card is a snapshot the chat will never
+	     update, so a status on it would be frozen at whatever the run happened to be. -->
+	{#if !pending && !inspected}
 		<span class={twMerge('shrink-0 whitespace-nowrap text-2xs font-medium', statusClass)}>
 			{statusTime}
 		</span>
@@ -297,7 +425,7 @@
      tab it already opened. The row's only control, as on every other tool call. -->
 {#snippet previewChip()}
 	<ToolPreviewCard
-		card={{ kind: runnableKind, path: runForm.path }}
+		card={{ kind: runnableKind, path }}
 		title={previewTitle}
 		onOpen={openPreview}
 		kindIcon={false}
@@ -325,7 +453,7 @@
 		<div class="px-3 py-2 text-2xs leading-4 text-hint">
 			These inputs are open in the preview panel.
 		</div>
-	{:else if pending}
+	{:else if pending && runForm}
 		<RunArgsFormDisplay toolCallId={message.tool_call_id} {runForm} />
 	{:else}
 		<!-- One region holding the strip and the body, fixed so the card is the same size on every
@@ -333,7 +461,12 @@
 		     silently beats flex-grow. The raw view takes that height as a floor instead: its
 		     blocks scroll on their own, as an ordinary tool call's do, so a scroller around them
 		     would be one too many. -->
-		<div class={twMerge('relative flex flex-col', rawView ? 'min-h-[20rem]' : 'h-[20rem]')}>
+		<div
+			class={twMerge(
+				'relative flex flex-col',
+				rawView ? 'min-h-[20rem]' : jobPending ? '' : 'h-[20rem]'
+			)}
+		>
 			<!-- The tabs go in raw view — they name the parts of the body, and the raw call is not
 			     one of them — while the strip stays, since the JSON toggle lives there. Hence its
 			     fixed height: a row sized by its contents would step every time the tabs leave, and
@@ -345,7 +478,7 @@
 				wrapperClass="shrink-0"
 				slidingIndicator
 			>
-				{#if !rawView}
+				{#if !rawView && !jobPending}
 					{#each tabs as tab (tab.value)}
 						<!-- The tab widens in first and the bar follows it, because a run adds its tabs as
 						     it produces them: landing the selection on a tab in the frame it appears reads
@@ -388,7 +521,7 @@
 				class={twMerge(
 					'min-h-0 flex-1 px-3 py-2',
 					rawView ? '' : 'overflow-auto',
-					!rawView && activeTab === 'logs' ? 'bg-surface-secondary/50' : ''
+					!rawView && !jobPending && activeTab === 'logs' ? 'bg-surface-secondary/50' : ''
 				)}
 			>
 				<!-- min-h-full rather than h-full: the states that centre themselves need the height,
@@ -406,6 +539,20 @@
 								showFade
 							/>
 						</div>
+					{:else if jobPending}
+						<!-- The strip above stays whatever the job does: the call's own result is already
+						     in the transcript, and the JSON toggle is how it is read. -->
+						<div class="text-2xs leading-4 text-hint">
+							{#if fetchFailed === message.tool_call_id}
+								This run could not be read. It may have been deleted, or be in another workspace.
+								Its result is on the JSON toggle.
+							{:else}
+								<span class="inline-flex items-center gap-1.5">
+									<Loader2 class="h-3 w-3 animate-spin" />
+									Loading this run...
+								</span>
+							{/if}
+						</div>
 					{:else}
 						<!-- Keyed on the tab so the body arrives rather than cuts. One region serves every
 						     tab, so only the incoming pane moves: overlapping them would ask this scroller
@@ -418,8 +565,8 @@
 					     persisted with the card. -->
 									<JobArgs
 										args={parameters}
-										id={chatJob?.jobId}
-										workspace={chatJob?.workspace}
+										id={job?.jobId}
+										workspace={job?.workspace}
 										disableExpand
 									/>
 								{:else if activeTab === 'logs'}
@@ -433,15 +580,25 @@
 											>{logs}</pre
 										>
 									{:else}
-										<p class="text-2xs text-tertiary">No logs yet.</p>
+										<p class="text-2xs text-tertiary">
+											{inspectedJob?.logsFailed
+												? 'Logs could not be read.'
+												: running
+													? 'No logs yet.'
+													: 'No logs.'}
+										</p>
 									{/if}
-									{#if running}
+									{#if running && !inspected}
 										<div class="mt-1 flex items-center gap-1.5 text-2xs text-tertiary">
 											<Loader2 class="h-3 w-3 animate-spin" />
 											streaming
 										</div>
 									{/if}
-								{:else if failed}
+									<!-- A run the chat started reports its failure on the tool call; an inspected one
+					     carries it as its result, which the pane below renders the way the run page
+					     does. `failed` excludes a cancellation, which also leaves an error on the
+					     message but owns its own pane. -->
+								{:else if !inspected && failed}
 									<pre
 										class="whitespace-pre-wrap break-words font-mono text-2xs text-red-700 dark:text-red-300"
 										>{message.error}</pre
@@ -452,8 +609,8 @@
 									<DisplayResult
 										result={undefined}
 										result_stream={resultStream}
-										jobId={chatJob?.jobId}
-										workspaceId={chatJob?.workspace}
+										jobId={job?.jobId}
+										workspaceId={job?.workspace}
 										disableExpand
 										hideAsJson
 									/>
@@ -465,8 +622,8 @@
 					     which the row already owns. -->
 									<DisplayResult
 										result={resultValue}
-										jobId={chatJob?.jobId}
-										workspaceId={chatJob?.workspace}
+										jobId={job?.jobId}
+										workspaceId={job?.workspace}
 										disableExpand
 										hideAsJson
 									/>
diff --git a/frontend/src/lib/components/copilot/chat/ToolCodeDiffView.svelte b/frontend/src/lib/components/copilot/chat/ToolCodeDiffView.svelte
new file mode 100644
index 0000000000..6f74ff7a80
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/ToolCodeDiffView.svelte
@@ -0,0 +1,170 @@
+<script lang="ts">
+	import type { ToolCodeDiff } from './shared'
+	import {
+		toolDiffLines,
+		visibleToolDiffRows,
+		type CharacterRange,
+		type ToolDiffLine
+	} from './toolCodeDiff'
+	import { toolCodeDiffLanguage } from './toolCodeDiffLanguage'
+	import { highlightedSourceLines } from './toolCodeDiffHighlight'
+	import hljs from 'highlight.js/lib/core'
+	import HighlightTheme from '$lib/components/HighlightTheme.svelte'
+	import { Button } from '$lib/components/common'
+
+	interface Props {
+		diff: ToolCodeDiff
+		streaming?: boolean
+		diffLines?: ToolDiffLine[]
+	}
+
+	let { diff, streaming = false, diffLines }: Props = $props()
+
+	let expansions = $state<Map<string, number>>(new Map())
+	const diffRows = $derived(diffLines ?? toolDiffLines(diff, streaming))
+	const visibleRows = $derived(visibleToolDiffRows(diffRows, expansions))
+	const language = $derived(toolCodeDiffLanguage(diff.lang))
+	const lastLines = $derived.by(() => {
+		let old = 0
+		let current = 0
+		for (const row of diffRows) {
+			if (row.oldLine) old = Math.max(old, row.oldLine)
+			if (row.newLine) current = Math.max(current, row.newLine)
+		}
+		return { old, current }
+	})
+	// Both number columns fit the longest line number, so it never runs into the +/- column.
+	const lineNumberWidth = $derived(
+		`max(0.875rem, ${String(Math.max(lastLines.old, lastLines.current)).length}ch)`
+	)
+	const highlighted = $derived.by(() => {
+		if (!hljs.getLanguage(language.name)) hljs.registerLanguage(language.name, language.register)
+
+		return {
+			original: highlightedSourceLines(diff.before, language.name, lastLines.old),
+			modified: highlightedSourceLines(diff.after, language.name, lastLines.current)
+		}
+	})
+
+	function highlightedLine(row: ToolDiffLine): string {
+		const source = row.kind === 'removed' ? highlighted.original : highlighted.modified
+		const lineNumber = row.kind === 'removed' ? row.oldLine : row.newLine
+		return lineNumber === undefined ? '' : (source[lineNumber - 1] ?? '')
+	}
+
+	function expand(key: string): void {
+		expansions = new Map(expansions).set(key, (expansions.get(key) ?? 0) + 1)
+	}
+
+	// Tab stops are measured from the line start, so a range's width is its end column minus its
+	// start column, never the width of the range text on its own. Counts UTF-16 units, the unit
+	// of Monaco's ranges and of `slice`, so an emoji ahead of a change does not shift it.
+	function displayColumns(content: string): number {
+		let columns = 0
+		for (let index = 0; index < content.length; index++) {
+			columns += content[index] === '\t' ? 4 - (columns % 4) : 1
+		}
+		return columns
+	}
+
+	function rangeStyle(content: string, range: CharacterRange): string {
+		const left = displayColumns(content.slice(0, range.start))
+		const width = range.extendsToEnd
+			? 'calc(100% - ' + left + 'ch)'
+			: displayColumns(content.slice(0, range.start + range.length)) - left + 'ch'
+		return 'left: ' + left + 'ch; width: ' + width
+	}
+</script>
+
+<HighlightTheme />
+
+<div
+	class="tool-code-diff max-h-[400px] overflow-auto bg-surface-tertiary text-xs leading-[18px] text-primary"
+	style="--line-number: {lineNumberWidth}"
+>
+	{#each visibleRows as row, index ('key' in row ? `${row.kind}:${row.key}` : `line:${row.oldLine}:${row.newLine}:${index}`)}
+		{#if row.kind === 'collapsed' || row.kind === 'omitted'}
+			<Button
+				unifiedSize="2xs"
+				variant="subtle"
+				btnClasses="grid min-h-7 w-full grid-cols-[var(--line-number)_calc(2.0625rem_+_var(--line-number))_minmax(0,1fr)] items-center gap-0 rounded-none bg-surface-secondary px-0 py-1 text-left text-xs font-normal leading-[18px] text-hint hover:bg-surface-hover"
+				onclick={() => expand(row.key)}
+			>
+				<span class="text-right">...</span>
+				<span class="grid grid-cols-[1.125rem_var(--line-number)_0.9375rem]">
+					<span></span><span class="text-right">...</span><span>...</span>
+				</span>
+				<span>{row.count} {row.kind === 'collapsed' ? 'unchanged lines' : 'more lines'}</span>
+			</Button>
+		{:else}
+			<div
+				class="diff-line-{row.kind} grid grid-cols-[var(--line-number)_calc(2.0625rem_+_var(--line-number))_minmax(0,1fr)]"
+			>
+				<span class="text-right text-hint">{row.oldLine ?? ''}</span>
+				<span class="grid grid-cols-[1.125rem_var(--line-number)_0.9375rem] text-hint">
+					<span></span><span class="text-right">{row.newLine ?? ''}</span><span
+						>{row.kind === 'added' ? '+' : row.kind === 'removed' ? '-' : ''}</span
+					>
+				</span>
+				<span
+					class="relative min-w-0 whitespace-pre {row.kind === 'added'
+						? 'bg-green-500/20'
+						: row.kind === 'removed'
+							? 'bg-red-500/20'
+							: ''}"
+				>
+					{#each row.changedRanges ?? [] as range}
+						<span
+							class="pointer-events-none absolute top-0 z-0 h-[18px] {row.kind === 'added'
+								? 'bg-green-500/25'
+								: 'bg-red-500/20'}"
+							style={rangeStyle(row.content, range)}
+						></span>
+					{/each}
+					<span class="relative z-[1]">{@html highlightedLine(row) || '&nbsp;'}</span>
+				</span>
+			</div>
+		{/if}
+	{/each}
+</div>
+
+<style>
+	.tool-code-diff {
+		font-family: Menlo, Monaco, 'Courier New', monospace;
+		/* Must match the tab stops `displayColumns` uses to place intraline highlights. */
+		tab-size: 4;
+	}
+
+	.diff-line-added > span:nth-child(-n + 2),
+	.diff-line-removed > span:nth-child(-n + 2) {
+		@apply text-hint;
+	}
+
+	.tool-code-diff :global(.hljs-keyword),
+	.tool-code-diff :global(.hljs-literal),
+	.tool-code-diff :global(.hljs-built_in) {
+		@apply text-blue-700;
+	}
+
+	.tool-code-diff :global(.hljs-string) {
+		@apply text-red-700;
+	}
+
+	.tool-code-diff :global(.hljs-title.class_),
+	.tool-code-diff :global(.hljs-type) {
+		@apply text-cyan-800;
+	}
+
+	.tool-code-diff :global(.hljs-title.function_) {
+		@apply text-primary;
+	}
+
+	.tool-code-diff :global(.hljs-attr),
+	.tool-code-diff :global(.hljs-subst) {
+		@apply text-primary;
+	}
+
+	.tool-code-diff :global(.hljs-number) {
+		@apply text-green-700;
+	}
+</style>
diff --git a/frontend/src/lib/components/copilot/chat/ToolDiffCard.svelte b/frontend/src/lib/components/copilot/chat/ToolDiffCard.svelte
new file mode 100644
index 0000000000..a2ab9d341c
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/ToolDiffCard.svelte
@@ -0,0 +1,103 @@
+<script lang="ts">
+	import type { ToolDisplayMessage } from './shared'
+	import ChatCollapsibleCard from './ChatCollapsibleCard.svelte'
+	import ToolCodeDiffView from './ToolCodeDiffView.svelte'
+	import ToolPreviewCard from './ToolPreviewCard.svelte'
+	import {
+		argumentsCarryWholeFile,
+		diffLineCounts,
+		toolCodeDiff,
+		toolDiffLineCounts,
+		toolDiffLines
+	} from './toolCodeDiff'
+
+	interface Props {
+		message: ToolDisplayMessage
+	}
+
+	let { message }: Props = $props()
+
+	const diff = $derived(toolCodeDiff(message))
+	const isStreaming = $derived(Boolean(message.isStreamingArguments))
+	const hasDiff = $derived(Boolean(diff && (diff.before !== '' || diff.after !== '')))
+	// The card body is a bordered box: opened with nothing in it, it draws an empty line.
+	const hasBody = $derived(hasDiff || Boolean(message.error))
+
+	// Keyed by call id: a bare flag would carry the expansion onto the next message that
+	// reuses this instance. An active or failed call opens by itself, and remains open
+	// when it settles so the new diff does not disappear under the user. A call whose arguments
+	// are a whole file (`write_script`, full-code `edit_code`) opens only on failure. The key
+	// also changes on failure, so a collapse made while running cannot hide the error.
+	const toggleKey = $derived(`${message.tool_call_id}:${message.error ? 'error' : ''}`)
+	let toggled = $state<{ id: string; open: boolean } | undefined>(undefined)
+	const opensByDefault = $derived(
+		Boolean(
+			message.error ||
+				(hasDiff &&
+					!argumentsCarryWholeFile(message) &&
+					(message.isLoading || message.isQueued || message.isStreamingArguments))
+		)
+	)
+	$effect(() => {
+		if (opensByDefault && toggled?.id !== toggleKey) {
+			toggled = { id: toggleKey, open: true }
+		}
+	})
+	const expanded = $derived(
+		hasBody && (toggled?.id === toggleKey ? toggled.open : opensByDefault)
+	)
+	const lines = $derived(diff && expanded ? toolDiffLines(diff, isStreaming) : undefined)
+	const counts = $derived(
+		diff && expanded
+			? isStreaming
+				? diffLineCounts(diff, true)
+				: toolDiffLineCounts(lines ?? [])
+			: undefined
+	)
+
+	const isRunning = $derived(Boolean(message.isLoading && !message.needsConfirmation))
+	const showPreviewChip = $derived(
+		Boolean(message.previewCard && !message.isLoading && !message.error)
+	)
+</script>
+
+{#snippet headerRight()}
+	<div class="flex items-center gap-2 shrink-0">
+		{#if counts && (counts.added > 0 || counts.removed > 0)}
+			<span class="font-mono text-2xs">
+				<span class="text-green-600 dark:text-green-400">+{counts.added}</span>
+				<span class="text-red-600 dark:text-red-400">−{counts.removed}</span>
+			</span>
+		{/if}
+		{#if showPreviewChip && message.previewCard}
+			<ToolPreviewCard card={message.previewCard} />
+		{/if}
+	</div>
+{/snippet}
+
+<ChatCollapsibleCard
+	label={message.content}
+	{expanded}
+	onToggle={() => (toggled = { id: toggleKey, open: !expanded })}
+	toggleable={hasBody}
+	shimmer={isRunning}
+	class={message.isQueued && !message.error
+		? 'opacity-60 hover:opacity-100 transition-opacity'
+		: ''}
+	labelClass="truncate"
+	contentClass="p-0 overflow-hidden space-y-0"
+	{headerRight}
+>
+	{#if diff && hasDiff && expanded}
+		<ToolCodeDiffView {diff} diffLines={lines} streaming={isStreaming} />
+	{/if}
+	{#if message.error}
+		<div
+			class="px-3 py-2 text-2xs text-red-600 dark:text-red-400 whitespace-pre-wrap break-words {hasDiff
+				? 'border-t border-border-light'
+				: ''}"
+		>
+			{message.error}
+		</div>
+	{/if}
+</ChatCollapsibleCard>
diff --git a/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte b/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte
index a0d16043a4..aa8dc47cec 100644
--- a/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte
+++ b/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte
@@ -9,8 +9,12 @@
 		CircleMinus,
 		FileText,
 		PanelRight,
-		Lock
+		Lock,
+		ExternalLink,
+		BookOpen
 	} from 'lucide-svelte'
+	import { base } from '$lib/base'
+	import { truncateRev } from '$lib/utils'
 	import {
 		EXIT_PLAN_MODE_TOOL,
 		isPlanCardTool,
@@ -24,7 +28,7 @@
 	import { getChatViewHost } from './chatViewHost'
 
 	const chatHost = getChatViewHost()
-	import { isActiveUserQuestion, type ToolDisplayMessage } from './shared'
+	import { isActiveUserQuestion, webSearchResultOf, type ToolDisplayMessage } from './shared'
 	import ChatCollapsibleCard from './ChatCollapsibleCard.svelte'
 	import { twMerge } from 'tailwind-merge'
 	import { slide } from 'svelte/transition'
@@ -38,6 +42,8 @@
 	import ToolPreviewCard from './ToolPreviewCard.svelte'
 	import AskUserQuestionDisplay from './AskUserQuestionDisplay.svelte'
 	import RunScriptCard from './RunScriptCard.svelte'
+	import ToolDiffCard from './ToolDiffCard.svelte'
+	import { hasToolCodeDiff } from './toolCodeDiff'
 	import WebSearchSourcesDisplay from './WebSearchSourcesDisplay.svelte'
 	import ExpandableImage from '$lib/components/common/image/ExpandableImage.svelte'
 	import McpServerIcon from '$lib/components/mcp/McpServerIcon.svelte'
@@ -127,7 +133,10 @@
 
 	// The run card owns this call from the form to whatever settled it, cancelling included:
 	// the card is the call, and a run the user stopped is not a different kind of thing.
-	const isRunCard = $derived(Boolean(message.runForm))
+	// A call that inspected a run rather than starting one gets the same card, bound to
+	// the job it named — what happened in a run reads the same either way.
+	const isRunCard = $derived(Boolean(message.runForm || message.inspectedRun))
+	const isDiffCard = $derived(Boolean(message.codeDiff) || hasToolCodeDiff(message.toolName))
 
 	// The preview chip sits on the header row (to the right of the tool-call text);
 	// shown once the tool settled, never while loading/erroring/awaiting confirmation.
@@ -136,6 +145,18 @@
 			message.previewCard && !message.isLoading && !message.error && !message.needsConfirmation
 		)
 	)
+
+	// A provider-side search sets `webSearchSources` and words its own header; any other tool
+	// gets the same card by returning the web search result shape.
+	const searchResult = $derived(
+		message.webSearchSources || message.error ? undefined : webSearchResultOf(message.result)
+	)
+	const sources = $derived(message.webSearchSources ?? searchResult?.sources)
+	const label = $derived(
+		searchResult?.query !== undefined
+			? `${message.content} · "${searchResult.query}"`
+			: message.content
+	)
 </script>
 
 {#if activeUserQuestion}
@@ -152,8 +173,22 @@
 			<span class="text-2xs text-tertiary truncate">{message.toolName}</span>
 		{/if}
 	</div>
+{:else if message.heldForFolderInstructions}
+	<!-- The call never ran: the model gets the folder's instructions and calls it again.
+	     A diff or run card here would show a write that did not happen. -->
+	<div class="font-mono text-xs flex items-center gap-2 py-0.5 my-0.5 min-w-0">
+		<BookOpen class="w-3.5 h-3.5 text-tertiary shrink-0" />
+		<span class="font-medium text-2xs text-tertiary shrink-0">
+			{message.content}
+		</span>
+		{#if message.toolName}
+			<span class="text-2xs text-tertiary truncate">{message.toolName} held until read</span>
+		{/if}
+	</div>
 {:else if isRunCard}
 	<RunScriptCard {message} />
+{:else if isDiffCard}
+	<ToolDiffCard {message} />
 {:else if planState}
 	<!-- Same lean shape as a tool call below: a header row that collapses into the
 	     transcript, with everything else in one box under it. -->
@@ -249,6 +284,19 @@
 		{/if}
 	{/snippet}
 
+	{#snippet jobLink()}
+		<a
+			href="{base}/run/{message.jobId}?workspace={chatHost.operatingWorkspace}"
+			target="_blank"
+			rel="noopener noreferrer"
+			class="shrink-0 inline-flex items-center gap-1 font-main text-2xs text-tertiary hover:text-primary hover:underline"
+			title="Open this run"
+		>
+			<span>job <span class="font-mono">{truncateRev(message.jobId ?? '', 8)}</span></span>
+			<ExternalLink size={11} class="shrink-0" />
+		</a>
+	{/snippet}
+
 	<!-- Which system a call reaches is the first thing to know about it, so an MCP call
 	     is marked before its label. Awaited rather than drawn immediately: the MCP logo
 	     appearing first and being replaced would flicker on every row. -->
@@ -264,7 +312,7 @@
 	     weight alone: queued calls (waiting their turn behind the executing tool)
 	     are faded, the running one sweeps, a settled one is plain. -->
 	<ChatCollapsibleCard
-		label={message.content}
+		{label}
 		expanded={isExpanded}
 		onToggle={() => (isExpanded = !isExpanded)}
 		toggleable={detailsAvailable || message.isStreamingArguments === true}
@@ -275,7 +323,7 @@
 		headerClass={message.needsConfirmation ? 'opacity-80' : ''}
 		labelClass={showPreviewChip ? 'truncate' : ''}
 		contentClass="space-y-3"
-		headerRight={showPreviewChip ? previewChip : undefined}
+		headerRight={showPreviewChip ? previewChip : message.jobId ? jobLink : undefined}
 		headerLeft={mcpServer?.workspace ? serverMark : undefined}
 	>
 		<!-- Image a tool produced (e.g. take_screenshot) — shown inline, not gated on expand. -->
@@ -326,8 +374,8 @@
 
 			{#if visibleActions.length > 0}
 				<ToolMessageActions actions={visibleActions} />
-			{:else if message.webSearchSources?.length && !message.error}
-				<WebSearchSourcesDisplay sources={message.webSearchSources} />
+			{:else if sources?.length && !message.error}
+				<WebSearchSourcesDisplay {sources} favicons={message.webSearchSources !== undefined} />
 			{:else}
 				<ToolContentDisplay
 					title="Result"
diff --git a/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte b/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte
index db2a0e22c4..84ee04d06f 100644
--- a/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte
+++ b/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte
@@ -125,8 +125,9 @@
 					<div class="truncate text-xs font-semibold text-primary">{card.title}</div>
 					<div class="truncate text-2xs text-secondary">{card.subtitle}</div>
 				</div>
-				<!-- open_created_resource is serviced solely by the docked chat's drawers, so
-				     elsewhere the card stands alone as a record of what the tool created. -->
+				<!-- open_created_resource is serviced only by the docked chat's drawers and the
+				     sessions page's tabs, so elsewhere the card stands alone as a record of what the
+				     tool created. -->
 				{#if hasToolDisplayActionHandler(action.type)}
 					<Button
 						unifiedSize="sm"
diff --git a/frontend/src/lib/components/copilot/chat/WebSearchSourcesDisplay.svelte b/frontend/src/lib/components/copilot/chat/WebSearchSourcesDisplay.svelte
index ff71c44160..0808d6e172 100644
--- a/frontend/src/lib/components/copilot/chat/WebSearchSourcesDisplay.svelte
+++ b/frontend/src/lib/components/copilot/chat/WebSearchSourcesDisplay.svelte
@@ -1,30 +1,25 @@
 <script lang="ts">
 	import { Globe } from 'lucide-svelte'
 	import { SvelteSet } from 'svelte/reactivity'
-	import type { WebSearchSource } from './shared'
+	import { isRenderableSourceUrl, type WebSearchSource } from './shared'
+	import { isOfflineReplay } from '$lib/components/recording/offlineReplay.svelte'
 
 	interface Props {
 		sources: WebSearchSource[]
+		/** Whether a hostname may be sent to the favicon service. False for the sources a
+		 * workspace's own tool returned: those can name internal services, and disclosing
+		 * them to a third party is the tool author's call to make, not this card's. */
+		favicons?: boolean
 	}
 
-	let { sources }: Props = $props()
+	let { sources, favicons = true }: Props = $props()
 
-	// The URLs come from the provider's response: only render absolute http(s)
-	// ones — anything else (javascript:, data:, relative) must not become an
-	// href. Also dedupes; providers can surface the same page several times.
+	// The URLs come from the provider's response or from a tool's own result: only render
+	// absolute http(s) ones — anything else (javascript:, data:, relative) must not become
+	// an href. Also dedupes; providers can surface the same page several times.
 	const uniqueSources = $derived(
 		Array.from(
-			new Map(
-				sources
-					.filter((s) => {
-						try {
-							return ['http:', 'https:'].includes(new URL(s.url).protocol)
-						} catch {
-							return false
-						}
-					})
-					.map((s) => [s.url, s])
-			).values()
+			new Map(sources.filter((s) => isRenderableSourceUrl(s.url)).map((s) => [s.url, s])).values()
 		)
 	)
 
@@ -38,6 +33,12 @@
 
 	const failedFavicons = new SvelteSet<string>()
 
+	// The favicon is a request to a third party, and the public replay page promises
+	// to issue none — a recording comes from an arbitrary origin, so its cited
+	// hostnames must not leak from a viewer's browser either. Degrades to the same
+	// Globe the blocked/failed case already uses.
+	const noFavicons = $derived(!favicons || isOfflineReplay())
+
 	// Favicons come from Google's public favicon service, which discloses each
 	// consulted hostname to a third party from the user's browser — an accepted
 	// tradeoff for now (blocked/air-gapped environments degrade to the Globe
@@ -55,6 +56,9 @@
 	<div class="flex flex-col max-h-40 overflow-y-auto">
 		{#each uniqueSources as source (source.url)}
 			{@const hostname = hostnameOf(source.url)}
+			<!-- A blank title is a title the row cannot show, so it names the host instead of
+			     rendering a link with no text. -->
+			{@const title = source.title?.trim() || undefined}
 			<a
 				href={source.url}
 				target="_blank"
@@ -62,7 +66,7 @@
 				title={source.url}
 				class="flex items-center gap-2 py-1 px-1.5 rounded hover:bg-surface-hover min-w-0"
 			>
-				{#if failedFavicons.has(hostname)}
+				{#if noFavicons || failedFavicons.has(hostname)}
 					<Globe class="w-3.5 h-3.5 shrink-0 text-tertiary" />
 				{:else}
 					<img
@@ -73,8 +77,8 @@
 						onerror={() => failedFavicons.add(hostname)}
 					/>
 				{/if}
-				<span class="text-2xs text-primary truncate">{source.title ?? hostname}</span>
-				{#if source.title}
+				<span class="text-2xs text-primary truncate">{title ?? hostname}</span>
+				{#if title}
 					<span class="text-2xs text-tertiary truncate shrink-0 max-w-32">{hostname}</span>
 				{/if}
 			</a>
diff --git a/frontend/src/lib/components/copilot/chat/WorkspaceMentionPicker.svelte b/frontend/src/lib/components/copilot/chat/WorkspaceMentionPicker.svelte
new file mode 100644
index 0000000000..0fb21f684f
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/WorkspaceMentionPicker.svelte
@@ -0,0 +1,148 @@
+<!--
+@component
+Workspace-only picker for the AI session composer's `+ -> Mention file`
+submenu. It mirrors ChatContextPicker's workspace branch, but starts directly
+at the workspace root because the parent menu item already names the scope.
+-->
+<script lang="ts">
+	import { Folder } from 'lucide-svelte'
+	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
+	import DrillPicker from '$lib/components/DrillPicker.svelte'
+	import type { DrillBranch, DrillLeaf, DrillNode } from '$lib/components/drillPicker'
+	import {
+		workspaceItemDisplayPath,
+		type WorkspaceItem,
+		type WorkspaceItemKind
+	} from '$lib/components/workspacePicker'
+	import { useWorkspaceItemsLoader } from '$lib/components/workspaceItemsLoader.svelte'
+	import { buildWorkspaceTree, relativizeWorkspacePath } from '$lib/components/workspaceTree'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+	import type {
+		ContextElement,
+		WorkspaceAppElement,
+		WorkspaceFlowElement,
+		WorkspaceScriptElement
+	} from './context'
+
+	interface Props {
+		onSelect: (element: ContextElement) => void
+		onAfterClose?: () => void
+		close: (afterClose?: () => void) => void
+	}
+
+	type DrillPickerHandle = {
+		handleKeydown: (e: KeyboardEvent) => void
+	}
+
+	let { onSelect, onAfterClose, close }: Props = $props()
+	let picker: DrillPickerHandle | undefined = $state()
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const WORKSPACE_KINDS: WorkspaceItemKind[] = ['flow', 'script', 'app']
+	const loader = useWorkspaceItemsLoader(
+		() => $operatingWorkspace,
+		() => WORKSPACE_KINDS
+	)
+
+	const loadedForTree = $derived.by(() => {
+		const loaded = loader.loaded
+		if (!loaded.app) return loaded
+		return { ...loaded, app: loaded.app.filter((a) => a.raw_app) }
+	})
+
+	const tree = $derived<DrillNode<WorkspaceItem>[]>(
+		buildWorkspaceTree({
+			loaded: loadedForTree,
+			kinds: WORKSPACE_KINDS,
+			loadingKind: loader.loadingKind,
+			layout: 'flat'
+		}) as DrillNode<WorkspaceItem>[]
+	)
+
+	function workspaceElement(item: WorkspaceItem): ContextElement | undefined {
+		if (item.kind === 'script') {
+			return {
+				type: 'workspace_script',
+				path: item.path,
+				title: item.path,
+				summary: item.summary,
+				deletable: true
+			} satisfies WorkspaceScriptElement & { deletable: boolean }
+		}
+		if (item.kind === 'flow') {
+			return {
+				type: 'workspace_flow',
+				path: item.path,
+				title: item.path,
+				summary: item.summary,
+				deletable: true
+			} satisfies WorkspaceFlowElement & { deletable: boolean }
+		}
+		if (item.kind === 'app') {
+			return {
+				type: 'workspace_app',
+				path: item.path,
+				title: item.path,
+				summary: item.summary,
+				deletable: true
+			} satisfies WorkspaceAppElement & { deletable: boolean }
+		}
+	}
+
+	function handlePick(leaf: DrillLeaf<WorkspaceItem>) {
+		const element = workspaceElement(leaf.data)
+		if (!element) return
+		onSelect(element)
+		close(onAfterClose)
+	}
+
+	function handleScopeChange(_scope: string[]) {
+		loader.ensureAll()
+	}
+
+	const pickerKeys = new Set([
+		'ArrowDown',
+		'ArrowUp',
+		'ArrowLeft',
+		'ArrowRight',
+		'Backspace',
+		'Enter',
+		'Tab',
+		'Home',
+		'End'
+	])
+
+	function handleKeydownCapture(e: KeyboardEvent) {
+		if (!pickerKeys.has(e.key)) return
+		e.stopImmediatePropagation()
+		picker?.handleKeydown(e)
+	}
+</script>
+
+{#snippet leafIcon(leaf: DrillLeaf<WorkspaceItem>)}
+	<RowIcon kind={leaf.data.kind} size={12} />
+{/snippet}
+
+{#snippet branchIcon(branch: DrillBranch<WorkspaceItem>)}
+	{#if branch.icon}
+		{@const Icon = branch.icon}
+		<Icon size={12} class="shrink-0 text-tertiary" />
+	{:else}
+		<Folder size={12} class="shrink-0 text-tertiary" />
+	{/if}
+{/snippet}
+
+<!-- Capture picker-owned keys before Melt's submenu listener handles menu movement. -->
+<div onkeydowncapture={handleKeydownCapture}>
+	<DrillPicker
+		bind:this={picker}
+		{tree}
+		onPick={handlePick}
+		{leafIcon}
+		{branchIcon}
+		leafSecondary={(leaf, scope) => relativizeWorkspacePath(workspaceItemDisplayPath(leaf.data), scope)}
+		onScopeChange={handleScopeChange}
+		onFilterChange={loader.onFilterChange}
+		rootLoading={WORKSPACE_KINDS.some((k) => !loader.loaded[k] && loader.loadingKind[k])}
+	/>
+</div>
diff --git a/frontend/src/lib/components/copilot/chat/anthropic.test.ts b/frontend/src/lib/components/copilot/chat/anthropic.test.ts
index 1ac413973f..9f6b49a9e9 100644
--- a/frontend/src/lib/components/copilot/chat/anthropic.test.ts
+++ b/frontend/src/lib/components/copilot/chat/anthropic.test.ts
@@ -1,6 +1,11 @@
 import { describe, expect, it, vi } from 'vitest'
 import type { ChatCompletionMessageParam } from 'openai/resources/index.mjs'
-import { convertOpenAIToAnthropicMessages, partialWebSearchQuery } from './anthropic'
+import {
+	convertOpenAIToAnthropicMessages,
+	parseAnthropicCompletion,
+	partialWebSearchQuery
+} from './anthropic'
+import { OutputTokenLimitError } from './outputTokenLimit'
 
 // anthropic.ts pulls in the chat client/registry layer at import time; the
 // converter under test is pure, so stub those side-effecting modules away.
@@ -217,3 +222,28 @@ describe('partialWebSearchQuery', () => {
 		expect(partialWebSearchQuery('{"query": ')).toBeUndefined()
 	})
 })
+
+describe('parseAnthropicCompletion output token limit', () => {
+	it('fails a message that stopped at max_tokens instead of ending the turn', async () => {
+		const stream = {
+			on: () => undefined,
+			done: async () => undefined,
+			finalMessage: async () => ({
+				content: [{ type: 'thinking', thinking: 'I need to plan the flow so each' }],
+				stop_reason: 'max_tokens',
+				usage: { input_tokens: 20000, output_tokens: 64000 }
+			})
+		}
+
+		const parsed = parseAnthropicCompletion(
+			stream as any,
+			{ onNewToken: vi.fn(), onMessageEnd: vi.fn(), setToolStatus: vi.fn() } as any,
+			[],
+			[],
+			[],
+			{}
+		)
+
+		await expect(parsed).rejects.toBeInstanceOf(OutputTokenLimitError)
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/anthropic.ts b/frontend/src/lib/components/copilot/chat/anthropic.ts
index 8d38f10916..ab69d0b1a3 100644
--- a/frontend/src/lib/components/copilot/chat/anthropic.ts
+++ b/frontend/src/lib/components/copilot/chat/anthropic.ts
@@ -24,6 +24,7 @@ import {
 	type ToolCallbacks,
 	type WebSearchSource
 } from './shared'
+import { OutputTokenLimitError } from './outputTokenLimit'
 import { anthropicUsageToChatTokenUsage, type ChatTokenUsage } from './tokenUsage'
 import { parseImageDataUrl } from './imageUtils'
 
@@ -140,7 +141,8 @@ export async function getAnthropicCompletion(
 	const { provider, config } = getProviderAndCompletionConfig({
 		messages,
 		stream: true,
-		forceModelProvider: options?.forceModelProvider
+		forceModelProvider: options?.forceModelProvider,
+		reasoningEffort: options?.reasoningEffort
 	})
 	const { system, messages: anthropicMessages } = convertOpenAIToAnthropicMessages(messages)
 	let anthropicTools = convertOpenAIToolsToAnthropic(tools)
@@ -444,7 +446,8 @@ export async function parseAnthropicCompletion(
 				toolCall,
 				helpers,
 				toolCallbacks: callbacks,
-				workspace: options?.workspace
+				workspace: options?.workspace,
+				messages
 			})
 			messages.push(messageToAdd)
 			addedMessages.push(messageToAdd)
@@ -453,6 +456,9 @@ export async function parseAnthropicCompletion(
 		return { shouldContinue: true, tokenUsage }
 	}
 
+	if (finalMessage.stop_reason === 'max_tokens') {
+		throw new OutputTokenLimitError()
+	}
 	return { shouldContinue: false, tokenUsage }
 }
 
diff --git a/frontend/src/lib/components/copilot/chat/app/core.ts b/frontend/src/lib/components/copilot/chat/app/core.ts
index 5ab271cc6f..634341b966 100644
--- a/frontend/src/lib/components/copilot/chat/app/core.ts
+++ b/frontend/src/lib/components/copilot/chat/app/core.ts
@@ -18,6 +18,7 @@ import {
 	type AppCodeSelectionElement,
 	type AppDatatableElement
 } from '../context'
+import { appDatatableRole, sdkDatatableCall } from '$lib/components/raw_apps/dataTableRefUtils'
 
 // Backend runnable types
 export type BackendRunnableType = 'script' | 'flow' | 'hubscript' | 'inline'
@@ -921,9 +922,20 @@ export function prepareAppSystemMessage(customPrompt?: string): ChatCompletionSy
 	const policy = aiChatManager.datatableCreationPolicy
 	const datatableName = policy.datatable ?? 'main'
 	const schemaPrefix = policy.schema ? `${policy.schema}.` : ''
-	// Use wmill.datatable() for 'main' (default), otherwise wmill.datatable('name')
-	const datatableCall =
-		datatableName === 'main' ? 'wmill.datatable()' : `wmill.datatable('${datatableName}')`
+	// A role names the privileges the app's queries run with, so it has to be in the code the
+	// model writes.
+	const datatableRole = appDatatableRole(policy.roles, datatableName)
+	const tsDatatableCall = sdkDatatableCall(datatableName, datatableRole, 'typescript')
+	const pyDatatableCall = sdkDatatableCall(datatableName, datatableRole, 'python')
+	const roleEntries = Object.entries(policy.roles ?? {})
+	const rolesNote =
+		roleEntries.length > 0
+			? `\n\nThis app uses these data tables through a role: ${roleEntries
+					.map(([dt, role]) => `\`${dt}\` as \`${role}\``)
+					.join(
+						', '
+					)}. Always pass that role when calling \`wmill.datatable\` on them, as in the examples. The role only reaches what it was granted, so a query on a table it lacks privileges on fails with \`permission denied\`.`
+			: ''
 
 	let content = `You are a helpful assistant that creates and edits apps on the Windmill platform. Apps are defined as a collection of files that contains both the frontend and the backend.
 
@@ -1024,7 +1036,7 @@ Backend runnables should only perform **data operations** (SELECT, INSERT, UPDAT
 import * as wmill from 'windmill-client';
 
 export async function main(user_id: string) {
-  const sql = ${datatableCall};
+  const sql = ${tsDatatableCall};
   const user = await sql\`SELECT * FROM ${schemaPrefix}users WHERE id = \${user_id}\`.fetchOne();
   return user;
 }
@@ -1035,12 +1047,12 @@ export async function main(user_id: string) {
 import wmill
 
 def main(user_id: str):
-    db = ${datatableCall}
+    db = ${pyDatatableCall}
     user = db.query('SELECT * FROM ${schemaPrefix}users WHERE id = $1', user_id).fetch_one()
     return user
 \`\`\`
 
-Use these examples for normal datatable access.
+Use these examples for normal datatable access.${rolesNote}
 
 ### Schema Modifications (DDL) - Use exec_datatable_sql tool ONLY
 
diff --git a/frontend/src/lib/components/copilot/chat/artifacts/artifactTools.ts b/frontend/src/lib/components/copilot/chat/artifacts/artifactTools.ts
index f5ef707a7c..221c60b84f 100644
--- a/frontend/src/lib/components/copilot/chat/artifacts/artifactTools.ts
+++ b/frontend/src/lib/components/copilot/chat/artifacts/artifactTools.ts
@@ -1,5 +1,6 @@
 import { z } from 'zod'
-import { createToolDef, type Tool, type ToolCallbacks } from '../shared'
+import { createToolDef, type ToolCallbacks } from '../shared'
+import { NONE, type SessionTool } from '../sessionCapabilities'
 import { artifactOverflowBytes, MAX_ARTIFACT_BYTES, normalizeChangeNote } from './artifactLimits'
 import {
 	currentVersion,
@@ -98,8 +99,9 @@ function targetsPlan(args: unknown, h: ArtifactToolHelpers): boolean {
 	)
 }
 
-export const artifactTools: Tool<{}>[] = [
+export const artifactTools: SessionTool<{}>[] = [
 	{
+		requires: NONE,
 		def: createToolDef(
 			createArtifactSchema,
 			'create_artifact',
@@ -156,6 +158,7 @@ export const artifactTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: NONE,
 		def: createToolDef(
 			updateArtifactSchema,
 			'update_artifact',
@@ -208,6 +211,7 @@ export const artifactTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: NONE,
 		def: createToolDef(
 			listArtifactsSchema,
 			'list_artifacts',
@@ -242,6 +246,7 @@ export const artifactTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: NONE,
 		def: createToolDef(
 			readArtifactSchema,
 			'read_artifact',
@@ -303,6 +308,7 @@ export const artifactTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: NONE,
 		def: createToolDef(
 			listArtifactVersionsSchema,
 			'list_artifact_versions',
diff --git a/frontend/src/lib/components/copilot/chat/chatLoop.test.ts b/frontend/src/lib/components/copilot/chat/chatLoop.test.ts
index 251c2ff858..282e7e1aa6 100644
--- a/frontend/src/lib/components/copilot/chat/chatLoop.test.ts
+++ b/frontend/src/lib/components/copilot/chat/chatLoop.test.ts
@@ -8,6 +8,7 @@ import {
 	type ChatLoopConfig
 } from './chatLoop'
 import type { ReasoningProviderModel } from '../reasoningRegistry'
+import { OutputTokenLimitError } from './outputTokenLimit'
 
 const mocks = vi.hoisted(() => ({
 	getCompletion: vi.fn(),
@@ -540,6 +541,23 @@ describe('runChatLoop lastIterationUsage', () => {
 	})
 })
 
+describe('runChatLoop output token limit', () => {
+	beforeEach(() => {
+		vi.resetAllMocks()
+		mocks.resolveRequestReasoning.mockReturnValue(undefined)
+	})
+
+	it('fails a truncated Responses iteration instead of replaying it on the Completions API', async () => {
+		mocks.getOpenAIResponsesCompletion.mockResolvedValue({})
+		mocks.parseOpenAIResponsesCompletion.mockRejectedValue(new OutputTokenLimitError())
+
+		await expect(
+			runChatLoop(createConfig({ workspace: `workspace-${randomUUID()}` }))
+		).rejects.toBeInstanceOf(OutputTokenLimitError)
+		expect(mocks.getCompletion).not.toHaveBeenCalled()
+	})
+})
+
 // Builders for the message shapes the chat loop accumulates.
 const assistant = (content: string): ChatCompletionMessageParam => ({ role: 'assistant', content })
 const assistantTools = (...ids: string[]): ChatCompletionMessageParam => ({
@@ -551,6 +569,32 @@ const assistantTools = (...ids: string[]): ChatCompletionMessageParam => ({
 		function: { name: 'do_thing', arguments: '{}' }
 	}))
 })
+describe('runChatLoop per-chat tool schemas', () => {
+	beforeEach(() => {
+		vi.resetAllMocks()
+		mocks.resolveRequestReasoning.mockReturnValue(undefined)
+		mocks.getOpenAIResponsesCompletion.mockResolvedValue({})
+		mocks.parseOpenAIResponsesCompletion.mockResolvedValue({ shouldContinue: false, tokenUsage })
+	})
+
+	// The def `schemaFor` returns is the chat's own: it must be what the provider is sent and
+	// what the tool is dispatched with, while the shared tool object keeps its own.
+	it('sends and dispatches the def schemaFor returns, leaving the shared tool alone', async () => {
+		const base = { type: 'function', function: { name: 'dyn', parameters: {} } } as any
+		const perChat = {
+			type: 'function',
+			function: { name: 'dyn', parameters: { marked: 1 } }
+		} as any
+		const shared = { def: base, fn: async () => '', schemaFor: async () => perChat }
+
+		await runChatLoop({ ...createConfig({ workspace: `ws-${randomUUID()}` }), tools: [shared] })
+
+		expect(mocks.getOpenAIResponsesCompletion.mock.calls[0][2]).toEqual([perChat])
+		expect(mocks.parseOpenAIResponsesCompletion.mock.calls[0][4][0].def).toBe(perChat)
+		expect(shared.def).toBe(base)
+	})
+})
+
 const tool = (id: string): ChatCompletionMessageParam => ({
 	role: 'tool',
 	tool_call_id: id,
diff --git a/frontend/src/lib/components/copilot/chat/chatLoop.ts b/frontend/src/lib/components/copilot/chat/chatLoop.ts
index 110e4f1154..47159d205d 100644
--- a/frontend/src/lib/components/copilot/chat/chatLoop.ts
+++ b/frontend/src/lib/components/copilot/chat/chatLoop.ts
@@ -20,6 +20,7 @@ import {
 	parseOpenAIResponsesCompletion
 } from './openai-responses'
 import type { Tool, ToolCallbacks } from './shared'
+import { OutputTokenLimitError } from './outputTokenLimit'
 import { sanitizeToolCallArguments } from './toolCallArguments'
 import { addChatTokenUsage, emptyChatTokenUsage, type ChatTokenUsage } from './tokenUsage'
 
@@ -70,13 +71,8 @@ export interface ChatLoopConfig {
 	 * lets the caller recover partial output if the loop throws or is aborted.
 	 */
 	addedMessages?: ChatCompletionMessageParam[]
-	/** Called before each iteration (e.g. to refresh tool schemas, or to record
-	 * which model the iteration is about to use). */
-	onBeforeIteration?: (
-		tools: Tool<any>[],
-		helpers: any,
-		modelProvider: ReasoningProviderModel
-	) => Promise<void>
+	/** Called before each iteration (e.g. to record which model it is about to use). */
+	onBeforeIteration?: (modelProvider: ReasoningProviderModel) => Promise<void>
 	/** Fired for each completed provider response, before the loop continues. The
 	 * loop can fail or be aborted at any iteration, so spend has to be handed over
 	 * as it happens — a callback only at the end would discard everything the
@@ -398,7 +394,6 @@ export async function runChatLoop(config: ChatLoopConfig): Promise<ChatLoopResul
 		// Re-read these from config each iteration so that mode changes
 		// (e.g. changeModeTool in Navigator) take effect immediately.
 		// Callers can use JS getter properties to provide dynamic values.
-		const tools = config.tools
 		const helpers = config.helpers
 		const systemMessage = config.systemMessage
 		const modelProvider = config.modelProvider
@@ -410,8 +405,11 @@ export async function runChatLoop(config: ChatLoopConfig): Promise<ChatLoopResul
 			!unsupportedWebSearchCache.has(webSearchCacheKey)
 
 		if (onBeforeIteration) {
-			await onBeforeIteration(tools, helpers, modelProvider)
+			await onBeforeIteration(modelProvider)
 		}
+		const tools = await Promise.all(
+			config.tools.map(async (t) => (t.schemaFor ? { ...t, def: await t.schemaFor(helpers) } : t))
+		)
 
 		const pendingUserMessage = getPendingUserMessage?.()
 
@@ -501,6 +499,11 @@ export async function runChatLoop(config: ChatLoopConfig): Promise<ChatLoopResul
 					try {
 						outcome = (await runOpenAIResponses(useWebSearch)) ? 'continue' : 'break'
 					} catch (err) {
+						// The response streamed and was then cut off: retrying it on the
+						// Completions API would generate the whole iteration a second time.
+						if (err instanceof OutputTokenLimitError) {
+							throw err
+						}
 						if (reasoningSummary && shouldRetryWithoutReasoningSummary(err)) {
 							markReasoningSummaryUnsupported(
 								reasoningSummaryCacheKey,
diff --git a/frontend/src/lib/components/copilot/chat/chatViewHost.ts b/frontend/src/lib/components/copilot/chat/chatViewHost.ts
index 4af23337e2..bdacb57615 100644
--- a/frontend/src/lib/components/copilot/chat/chatViewHost.ts
+++ b/frontend/src/lib/components/copilot/chat/chatViewHost.ts
@@ -52,6 +52,8 @@ export interface ChatViewHost {
 	 * pins away from the navigated one. */
 	readonly operatingWorkspace: string | undefined
 	loading: boolean
+	/** A send waiting for the chat's transcript to be restored; queue behind it. */
+	sendPending: boolean
 	/** A turn this tab can neither follow nor stop, held by another tab on the same chat. */
 	readonly runHeldElsewhere: boolean
 	loadingLabel: string | undefined
@@ -85,6 +87,8 @@ export interface ChatViewHost {
 	) => void
 	dequeueMessage: () => void
 	setComposerStaged: (key: string, editingIndex: number | null, bytes: number) => void
+	/** Whether this composer holds anything unsent (text, pastes, attachments, reads in flight). */
+	setComposerHasDraft: (key: string, hasDraft: boolean) => void
 	clearComposerStaged: (key: string) => void
 	attachmentBytesExcluding: (selfKey: string) => number
 
@@ -143,7 +147,10 @@ export interface ChatViewHost {
 	 * True where the bytes are forwarded somewhere — object storage — rather than read
 	 * in the browser. */
 	attachmentsAsBlobs: boolean
-	tools: Tool<any>[]
+	/** What this chat's next request carries, the current posture's plan-mode transition
+	 * included. A consumer narrows it by tool metadata; assembling its own list from the
+	 * sources behind it is how the advertised set and the sent set drift apart. */
+	readonly tools: readonly Tool<any>[]
 	autonomyMode: AIAutonomyMode
 	setAutonomyMode: (mode: AIAutonomyMode) => void
 	readonly autoAcceptEditsActive: boolean
diff --git a/frontend/src/lib/components/copilot/chat/createdResourceActions.svelte.ts b/frontend/src/lib/components/copilot/chat/createdResourceActions.svelte.ts
index bd0f3b3d0e..c76e892cdf 100644
--- a/frontend/src/lib/components/copilot/chat/createdResourceActions.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/createdResourceActions.svelte.ts
@@ -5,6 +5,10 @@ type MaybePromise<T> = T | Promise<T>
 type ToolDisplayActionHandler = (action: ToolDisplayAction) => MaybePromise<void>
 
 const toolDisplayActionHandlers = $state<Record<string, ToolDisplayActionHandler | undefined>>({})
+// Every registration per type, latest last: a page that takes over a type from the layout
+// (the sessions page opens items in its panel rather than in drawers) hands it back on
+// unmount instead of leaving the type unhandled.
+const registrations: Record<string, ToolDisplayActionHandler[]> = {}
 
 function formatUnknownError(error: unknown): string {
 	if (error instanceof Error) {
@@ -17,11 +21,16 @@ export function registerToolDisplayActionHandler(
 	type: ToolDisplayAction['type'],
 	handler: ToolDisplayActionHandler
 ): () => void {
+	const stack = (registrations[type] ??= [])
+	stack.push(handler)
 	toolDisplayActionHandlers[type] = handler
 	return () => {
-		if (toolDisplayActionHandlers[type] === handler) {
-			delete toolDisplayActionHandlers[type]
-		}
+		const at = stack.lastIndexOf(handler)
+		if (at < 0) return
+		stack.splice(at, 1)
+		const current = stack[stack.length - 1]
+		if (current) toolDisplayActionHandlers[type] = current
+		else delete toolDisplayActionHandlers[type]
 	}
 }
 
diff --git a/frontend/src/lib/components/copilot/chat/datatableTools.ts b/frontend/src/lib/components/copilot/chat/datatableTools.ts
index 7232500898..0656bf43a9 100644
--- a/frontend/src/lib/components/copilot/chat/datatableTools.ts
+++ b/frontend/src/lib/components/copilot/chat/datatableTools.ts
@@ -2,22 +2,23 @@ import { z } from 'zod'
 import { WorkspaceService, type CompletedJob } from '$lib/gen'
 import type { DataTableTables } from '$lib/gen/types.gen'
 import { runScript } from '$lib/components/jobs/utils'
+import { datatableReference } from '$lib/components/dbTypes'
 import {
 	createToolDef,
 	executeTestRun,
-	type Tool,
 	type ToolDisplayMessage,
 	type ChatJobResultFormat
 } from './shared'
+import { NONE, RUN_PREVIEW, type SessionTool } from './sessionCapabilities'
 
 /**
  * Workspace-scoped datatable tools, with no app whitelist and no creation policy.
  *
  * Datatables are workspace-level managed PostgreSQL databases. The backend
  * endpoints used here (`list_datatable_tables`, `get_datatable_table_schema`)
- * and SQL execution (`datatable://<name>`) are gated only by workspace
- * membership, so these tools need no app context and operate directly on the
- * workspace. This is the unrestricted counterpart to the app-mode datatable
+ * and SQL execution (`datatable://<name>`) need no app context: the server
+ * decides what the caller reaches, as the datatable role they name or its
+ * default. This is the unrestricted counterpart to the app-mode datatable
  * tools in `app/core.ts`, which additionally filter by the app's whitelist.
  */
 
@@ -31,9 +32,19 @@ const memo = <T>(factory: () => T): (() => T) => {
 
 // ============= Pure workspace-scoped operations =============
 
-/** List all datatables configured in the workspace, with their schema/table names. */
-export async function listDatatables(workspace: string): Promise<DataTableTables[]> {
-	return await WorkspaceService.listDataTableTables({ workspace })
+/** List the datatables configured in the workspace, with their schema/table names: all of them as
+ * their default role, or only `datatableName`, as `role` when one is given. */
+export async function listDatatables(
+	workspace: string,
+	datatableName?: string,
+	role?: string
+): Promise<DataTableTables[]> {
+	if (datatableName === undefined) return await WorkspaceService.listDataTableTables({ workspace })
+	return await WorkspaceService.listDataTableTables({
+		workspace,
+		datatableName,
+		...(role !== undefined && { roleFor: datatableName, role })
+	})
 }
 
 /** Get the columns (column_name -> compact_type) of one datatable table. */
@@ -41,13 +52,15 @@ export async function getDatatableColumns(
 	workspace: string,
 	datatableName: string,
 	schemaName: string,
-	tableName: string
+	tableName: string,
+	role?: string
 ): Promise<Record<string, string>> {
 	const schema = await WorkspaceService.getDataTableTableSchema({
 		workspace,
 		datatableName,
 		schemaName,
-		tableName
+		tableName,
+		role
 	})
 	return schema.columns
 }
@@ -81,7 +94,26 @@ const NO_DATATABLES_CONFIGURED_MESSAGE =
 
 // ============= Tool definitions =============
 
-const getListDatatablesSchema = memo(() => z.object({}))
+// The same rule the server applies to `-- role <name>`; a name it would refuse fails here instead.
+const getRoleSchema = memo(() =>
+	z
+		.string()
+		.regex(/^[A-Za-z0-9_-]{1,63}$/)
+		.optional()
+		.describe(
+			"The datatable role to connect as, when the code you are working on uses one (an app's `data.roles` entry, or the `role` it passes to wmill.datatable). Omit for the datatable's default role."
+		)
+)
+
+const getListDatatablesSchema = memo(() =>
+	z.object({
+		datatable_name: z
+			.string()
+			.optional()
+			.describe('List only this datatable. Required with `role`.'),
+		role: getRoleSchema()
+	})
+)
 const getListDatatablesToolDef = memo(() =>
 	createToolDef(
 		getListDatatablesSchema(),
@@ -94,7 +126,8 @@ const getGetDatatableTableSchemaSchema = memo(() =>
 	z.object({
 		datatable_name: z.string().describe('The datatable name to inspect, e.g. "main".'),
 		schema_name: z.string().describe('The schema name, e.g. "public".'),
-		table_name: z.string().describe('The table name to inspect.')
+		table_name: z.string().describe('The table name to inspect.'),
+		role: getRoleSchema()
 	})
 )
 const getGetDatatableTableSchemaToolDef = memo(() =>
@@ -117,6 +150,7 @@ const getExecDatatableSqlSchema = memo(() =>
 			.describe(
 				'The SQL query to execute. Supports SELECT, INSERT, UPDATE, DELETE, CREATE TABLE, ALTER TABLE, DROP TABLE, etc. For SELECT queries, results are returned as an array of objects. A newly created table will appear in list_datatables automatically.'
 			),
+		role: getRoleSchema(),
 		background: z
 			.boolean()
 			.optional()
@@ -212,15 +246,24 @@ export function formatChatJobCompletion(
  * The unrestricted workspace datatable tools, for registration in global mode.
  * Helper-free: each tool reads `workspace` directly from the tool call params.
  */
-export function getDatatableTools(): Tool<{}>[] {
+export function getDatatableTools(): SessionTool<{}>[] {
 	return [
 		{
+			requires: NONE,
 			def: getListDatatablesToolDef(),
 			planModeSafe: true,
-			fn: async ({ workspace, toolId, toolCallbacks }) => {
+			fn: async ({ args, workspace, toolId, toolCallbacks }) => {
 				toolCallbacks.setToolStatus(toolId, { content: 'Listing datatables...' })
 				try {
-					const metadata = await listDatatables(workspace)
+					const parsedArgs = getListDatatablesSchema().parse(args ?? {})
+					if (parsedArgs.role !== undefined && parsedArgs.datatable_name === undefined) {
+						throw new Error('`role` needs `datatable_name`, the datatable it is a role of')
+					}
+					const metadata = await listDatatables(
+						workspace,
+						parsedArgs.datatable_name,
+						parsedArgs.role
+					)
 					if (metadata.length === 0) {
 						toolCallbacks.setToolStatus(toolId, {
 							content: 'No datatables configured — set one up in workspace settings'
@@ -236,7 +279,18 @@ export function getDatatableTools(): Tool<{}>[] {
 					toolCallbacks.setToolStatus(toolId, {
 						content: `Listed ${metadata.length} datatable(s) with ${totalTables} table(s)`
 					})
-					return JSON.stringify(metadata, null, 2)
+					// Only what the model acts on: the roles it may pass, not the creation privileges
+					// the manager's UI gates on.
+					return JSON.stringify(
+						metadata.map((d) => ({
+							datatable_name: d.datatable_name,
+							schemas: d.schemas,
+							...(d.error && { error: d.error }),
+							...(d.permissioned && { usable_roles: d.usable_roles, default_role: d.default_role })
+						})),
+						null,
+						2
+					)
 				} catch (e) {
 					const errorMsg = `Error listing datatables: ${e instanceof Error ? e.message : String(e)}`
 					toolCallbacks.setToolStatus(toolId, { content: errorMsg, error: errorMsg })
@@ -245,6 +299,7 @@ export function getDatatableTools(): Tool<{}>[] {
 			}
 		},
 		{
+			requires: NONE,
 			def: getGetDatatableTableSchemaToolDef(),
 			planModeSafe: true,
 			fn: async ({ args, workspace, toolId, toolCallbacks }) => {
@@ -257,7 +312,8 @@ export function getDatatableTools(): Tool<{}>[] {
 						workspace,
 						parsedArgs.datatable_name,
 						parsedArgs.schema_name,
-						parsedArgs.table_name
+						parsedArgs.table_name,
+						parsedArgs.role
 					)
 					toolCallbacks.setToolStatus(toolId, {
 						content: `Retrieved schema for ${parsedArgs.schema_name}.${parsedArgs.table_name}`
@@ -283,6 +339,8 @@ export function getDatatableTools(): Tool<{}>[] {
 			}
 		},
 		{
+			// `runScript` below goes through /jobs/run/preview, which jobs.rs refuses operators.
+			requires: RUN_PREVIEW,
 			def: getExecDatatableSqlToolDef(),
 			requiresConfirmation: true,
 			confirmationMessage: 'Execute SQL on datatable',
@@ -300,7 +358,7 @@ export function getDatatableTools(): Tool<{}>[] {
 							requestBody: {
 								language: 'postgresql',
 								content: parsedArgs.sql,
-								args: { database: `datatable://${name}` }
+								args: { database: datatableReference(name, parsedArgs.role) }
 							}
 						}),
 					workspace,
diff --git a/frontend/src/lib/components/copilot/chat/docs/core.ts b/frontend/src/lib/components/copilot/chat/docs/core.ts
index 9ae9d0c988..ee0c04983f 100644
--- a/frontend/src/lib/components/copilot/chat/docs/core.ts
+++ b/frontend/src/lib/components/copilot/chat/docs/core.ts
@@ -1,4 +1,4 @@
-import type { Tool } from '../shared'
+import { NONE, type SessionTool } from '../sessionCapabilities'
 import type { ChatCompletionTool } from 'openai/resources/index.mjs'
 import { DocumentationService } from '$lib/gen'
 
@@ -33,7 +33,8 @@ const READ_DOCS_PAGE_TOOL: ChatCompletionTool = {
 	}
 }
 
-export const readDocsPageTool: Tool<{}> = {
+export const readDocsPageTool: SessionTool<{}> = {
+	requires: NONE,
 	def: READ_DOCS_PAGE_TOOL,
 	planModeSafe: true,
 	fn: async ({ args, toolId, toolCallbacks }) => {
@@ -85,7 +86,8 @@ const SEARCH_DOCS_TOOL: ChatCompletionTool = {
 	}
 }
 
-export const searchDocsTool: Tool<{}> = {
+export const searchDocsTool: SessionTool<{}> = {
+	requires: NONE,
 	def: SEARCH_DOCS_TOOL,
 	planModeSafe: true,
 	fn: async ({ args, toolId, toolCallbacks }) => {
diff --git a/frontend/src/lib/components/copilot/chat/ducklakeTools.ts b/frontend/src/lib/components/copilot/chat/ducklakeTools.ts
index dfadc58db9..3e19789e96 100644
--- a/frontend/src/lib/components/copilot/chat/ducklakeTools.ts
+++ b/frontend/src/lib/components/copilot/chat/ducklakeTools.ts
@@ -1,6 +1,7 @@
 import { z } from 'zod'
 import { DataMetricService, WorkspaceService } from '$lib/gen'
-import { createToolDef, type Tool } from './shared'
+import { createToolDef } from './shared'
+import { NONE, type SessionTool } from './sessionCapabilities'
 
 /**
  * Workspace-scoped DuckLake tools, the pipeline counterpart to `list_datatables`
@@ -69,9 +70,10 @@ const NO_DATA_METRICS_NOTE =
 const DEFAULT_DATA_METRICS_LIMIT = 200
 
 /** The workspace DuckLake tools, for registration in global mode. */
-export function getDucklakeTools(): Tool<{}>[] {
+export function getDucklakeTools(): SessionTool<{}>[] {
 	return [
 		{
+			requires: NONE,
 			def: listDataMetricsToolDef,
 			planModeSafe: true,
 			showDetails: true,
@@ -106,6 +108,7 @@ export function getDucklakeTools(): Tool<{}>[] {
 			}
 		},
 		{
+			requires: NONE,
 			def: listDucklakesToolDef,
 			planModeSafe: true,
 			fn: async ({ workspace, toolId, toolCallbacks }) => {
diff --git a/frontend/src/lib/components/copilot/chat/files/fileTools.ts b/frontend/src/lib/components/copilot/chat/files/fileTools.ts
index 246bf814d6..b0d5554173 100644
--- a/frontend/src/lib/components/copilot/chat/files/fileTools.ts
+++ b/frontend/src/lib/components/copilot/chat/files/fileTools.ts
@@ -8,7 +8,8 @@
  */
 import { z } from 'zod'
 import type { ChatCompletionSystemMessageParam } from 'openai/resources/chat/completions.mjs'
-import { createToolDef, type Tool } from '../shared'
+import { createToolDef } from '../shared'
+import { NONE, type SessionTool } from '../sessionCapabilities'
 import {
 	readFile,
 	searchFilesInWorker,
@@ -95,7 +96,8 @@ const searchFilesToolDef = createToolDef(
 	'Search the user-attached files with a regular expression and return matching lines with their line numbers. Use this to locate content before reading a specific window with read_file.'
 )
 
-export const searchFilesTool: Tool<{}> = {
+export const searchFilesTool: SessionTool<{}> = {
+	requires: NONE,
 	def: searchFilesToolDef,
 	planModeSafe: true,
 	fn: async ({ args, helpers, toolId, toolCallbacks }) => {
@@ -164,7 +166,8 @@ const readFileToolDef = createToolDef(
 	'Read a bounded window of lines from a user-attached file. Returns each line prefixed with its 1-based number (`<n>→<content>`) plus a pagination note. Files are not in context, so use this to inspect their contents.'
 )
 
-export const readFileTool: Tool<{}> = {
+export const readFileTool: SessionTool<{}> = {
+	requires: NONE,
 	def: readFileToolDef,
 	planModeSafe: true,
 	fn: async ({ args, helpers, toolId, toolCallbacks }) => {
@@ -193,7 +196,7 @@ export const readFileTool: Tool<{}> = {
 	}
 }
 
-export const fileTools: Tool<{}>[] = [searchFilesTool, readFileTool]
+export const fileTools: SessionTool<{}>[] = [searchFilesTool, readFileTool]
 
 function rosterLine(f: AttachedFile): string {
 	// Message rows are addressed by their stable id (names may collide); session
diff --git a/frontend/src/lib/components/copilot/chat/flow/core.ts b/frontend/src/lib/components/copilot/chat/flow/core.ts
index 51fea34d58..96b2858957 100644
--- a/frontend/src/lib/components/copilot/chat/flow/core.ts
+++ b/frontend/src/lib/components/copilot/chat/flow/core.ts
@@ -302,7 +302,7 @@ const patchFlowJsonToolDef = createToolDef(
 	'patch_flow_json',
 	'Make a quick exact text edit in the current compact flow JSON. Prefer this for small localized changes; use set_flow_json for larger structural rewrites.'
 )
-// Will be overridden by setSchema
+// Replaced per chat by schemaFor
 const testRunFlowSchema = z.object({
 	args: z
 		.object({})
@@ -435,11 +435,10 @@ export const flowTools: Tool<FlowAIChatHelpers>[] = [
 				contextName: 'flow'
 			})
 		},
-		setSchema: async function (helpers: FlowAIChatHelpers) {
-			await buildSchemaForTool(this.def, async () => {
-				const flowInputsSchema = await helpers.getFlowInputsSchema()
-				return flowInputsSchema
-			})
+		schemaFor: async (helpers: FlowAIChatHelpers) => {
+			const def = structuredClone(testRunFlowToolDef)
+			await buildSchemaForTool(def, () => helpers.getFlowInputsSchema())
+			return def
 		},
 		requiresConfirmation: true,
 		confirmationMessage: 'Run a test of the current flow',
@@ -465,6 +464,18 @@ export const flowTools: Tool<FlowAIChatHelpers>[] = [
 			const stepId = args.stepId
 			const stepArgs = args.args || {}
 
+			// An agent step runs on the step's own configuration with this run's changes on top, which
+			// the global chat's run form assembles; this tool sends only what the model named.
+			if (findModuleInFlow(flow.value, stepId)?.value.type === 'aiagent') {
+				toolCallbacks.setToolStatus(toolId, {
+					content: `Step "${stepId}" is an AI agent step`,
+					error: 'AI agent steps cannot be tested from this chat'
+				})
+				throw new Error(
+					'AI agent steps cannot be tested from this chat. Test it from the step\'s "Test this step" tab.'
+				)
+			}
+
 			return executeFlowStepTestRun({
 				flowValue: flow.value,
 				stepId,
diff --git a/frontend/src/lib/components/copilot/chat/folderInstructions.ts b/frontend/src/lib/components/copilot/chat/folderInstructions.ts
new file mode 100644
index 0000000000..c07c85cbbd
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/folderInstructions.ts
@@ -0,0 +1,220 @@
+import { ResourceService } from '$lib/gen'
+import { truncateForPrompt } from './skills/skillResources'
+
+/**
+ * Folder instructions are resources of this type: a markdown file resource
+ * (`format_extension = 'md'`) whose `value.content` the assistant follows for
+ * every item under the directory the resource lives in, like an AGENTS.md.
+ */
+export const FOLDER_INSTRUCTIONS_RESOURCE_TYPE = 'ai_instruction'
+
+/** Bytes of one instruction body a tool result may carry. */
+export const MAX_FOLDER_INSTRUCTIONS_LENGTH = 32 * 1024
+/** Bytes all the bodies one tool result carries may add up to, so nested folders
+ * cannot stack several full-size bodies onto a single result. */
+export const MAX_FOLDER_INSTRUCTIONS_TOTAL = 48 * 1024
+
+/** Scopes the system prompt names. Past this the list is cut, not the delivery:
+ * a scope left out still has its instructions delivered on first touch. */
+export const MAX_LISTED_FOLDER_INSTRUCTIONS = 50
+
+export type FolderInstruction = {
+	/** The `ai_instruction` resource. */
+	path: string
+	/** The directory it covers, with a trailing `/`: `f/billing/AGENTS` covers `f/billing/`. */
+	scope: string
+}
+
+export function folderInstructionScope(path: string): string {
+	return path.slice(0, path.lastIndexOf('/') + 1)
+}
+
+const PAGE_SIZE = 100
+/** Guard against a paging bug looping forever, not a product cap. */
+const MAX_PAGES = 20
+
+/** Every folder instruction the user can read in the workspace. Read access is the
+ * resource's own ACL, so a folder's instructions reach exactly who can see them. */
+export async function listFolderInstructions(workspace: string): Promise<FolderInstruction[]> {
+	if (!workspace) return []
+	const rows: FolderInstruction[] = []
+	for (let page = 1; page <= MAX_PAGES; page++) {
+		const resources = await ResourceService.listResource({
+			workspace,
+			resourceType: FOLDER_INSTRUCTIONS_RESOURCE_TYPE,
+			page,
+			perPage: PAGE_SIZE
+		})
+		rows.push(...resources.map((r) => ({ path: r.path, scope: folderInstructionScope(r.path) })))
+		if (resources.length < PAGE_SIZE) break
+	}
+	return rows
+}
+
+/** Workspace paths a tool call names: every string argument called `path` or
+ * `*_path` that is a `u/`, `f/` or `g/` path, nested ones included — a trigger's target
+ * sits in `config.path`, and missing it would let that write through unheld. */
+export function workspacePathsInArgs(args: unknown, depth = 0): string[] {
+	if (!args || typeof args !== 'object' || depth > 4) return []
+	if (Array.isArray(args)) return args.flatMap((v) => workspacePathsInArgs(v, depth + 1))
+	return Object.entries(args as Record<string, unknown>).flatMap(([key, value]) =>
+		typeof value === 'string'
+			? (key === 'path' || key.endsWith('_path')) && /^[ufg]\/[^/]+/.test(value)
+				? [value]
+				: []
+			: workspacePathsInArgs(value, depth + 1)
+	)
+}
+
+/** The instructions covering any of `paths`, outermost scope first, so a nested
+ * folder's instructions come last and read as the more specific ones. A path naming
+ * the folder itself (`f/billing`, as a pipeline's is) is covered too. */
+export function instructionsCovering(
+	instructions: readonly FolderInstruction[],
+	paths: readonly string[]
+): FolderInstruction[] {
+	return instructions
+		.filter((i) => paths.some((p) => `${p}/`.startsWith(i.scope)))
+		.sort((a, b) => a.scope.length - b.scope.length || a.path.localeCompare(b.path))
+}
+
+/** What a chat hands the tool loop: the instructions in play, and which tool call
+ * delivered which of them.
+ *
+ * A delivery counts only while its tool message is still in the conversation and
+ * carries the text: the id is recorded because a script quoting the tag in a result
+ * must not pass for a delivery, and nothing is marked on the message object because
+ * the completions path sends that to the provider verbatim. So compaction or a
+ * restored chat gets the instructions again. */
+export type FolderInstructionsContext = {
+	list: () => readonly FolderInstruction[]
+	deliveredBy: Map<string, FolderInstructionsDelivery>
+}
+
+/** Keyed by workspace too: the chat keeps its conversation across a switch of
+ * operating workspace, and the same path there can hold different instructions. */
+export type FolderInstructionsDelivery = { workspace: string; paths: readonly string[] }
+
+/** Instructions delivered by the tool results in `messages`, split by whether the
+ * model has read them. Results after the latest assistant message answer the batch
+ * still being processed: the model has not seen those yet, so a delivery there
+ * must not let a change later in the same batch through. */
+function deliveredIn(
+	ctx: FolderInstructionsContext,
+	messages: readonly unknown[],
+	workspace: string
+): { read: Set<string>; thisBatch: Set<string> } {
+	const read = new Set<string>()
+	const thisBatch = new Set<string>()
+	let lastAssistant = -1
+	messages.forEach((m, i) => {
+		if ((m as { role?: unknown } | undefined)?.role === 'assistant') lastAssistant = i
+	})
+	messages.forEach((m, i) => {
+		const { tool_call_id: id, content } = (m ?? {}) as { tool_call_id?: unknown; content?: unknown }
+		if (typeof id !== 'string' || typeof content !== 'string') return
+		const delivery = ctx.deliveredBy.get(id)
+		if (delivery?.workspace !== workspace) return
+		for (const p of delivery.paths) {
+			// The id alone is not enough: a call stopped mid-run is answered with a
+			// placeholder under the same id, which carries no instructions.
+			if (content.includes(openingTag(p))) (i < lastAssistant ? read : thisBatch).add(p)
+		}
+	})
+	return { read, thisBatch }
+}
+
+/** The instructions covering the paths a tool call names that the model has not
+ * read yet, as the text to hand it, or undefined when there are none. `paths` are
+ * the bodies the text carries; one already carried earlier in the same batch is
+ * pointed to rather than repeated. A body that no longer reads (deleted or moved
+ * since the listing) is left out rather than failing the call it rides on. */
+export async function pendingFolderInstructions(
+	ctx: FolderInstructionsContext | undefined,
+	messages: readonly unknown[],
+	args: unknown,
+	workspace: string
+): Promise<{ paths: string[]; text: string } | undefined> {
+	if (!ctx || !workspace) return undefined
+	const paths = workspacePathsInArgs(args)
+	if (paths.length === 0) return undefined
+	const { read, thisBatch } = deliveredIn(ctx, messages, workspace)
+	const pending = instructionsCovering(ctx.list(), paths).filter((i) => !read.has(i.path))
+	const inBatch = pending.filter((i) => thisBatch.has(i.path))
+	const blocks = (
+		await Promise.all(
+			pending
+				.filter((i) => !thisBatch.has(i.path))
+				.map(async (instruction) => {
+					try {
+						return {
+							instruction,
+							body: await readFolderInstructionBody(workspace, instruction.path)
+						}
+					} catch (e) {
+						console.error(`Failed to read folder instructions ${instruction.path}`, e)
+						return undefined
+					}
+				})
+		)
+	).filter((b) => b !== undefined)
+	if (blocks.length === 0 && inBatch.length === 0) return undefined
+	const pointers = inBatch.map(
+		(i) =>
+			`The instructions for \`${i.scope}\` (${i.path}) are in an earlier result of this same batch of tool calls.`
+	)
+	return {
+		paths: blocks.map((b) => b.instruction.path),
+		text: [formatFolderInstructions(blocks), ...pointers].filter(Boolean).join('\n\n')
+	}
+}
+
+export async function readFolderInstructionBody(workspace: string, path: string): Promise<string> {
+	const value = (await ResourceService.getResourceValue({ workspace, path })) as
+		| { content?: unknown }
+		| undefined
+	if (typeof value?.content !== 'string') {
+		throw new Error(`resource ${path} has no string "content"`)
+	}
+	return value.content
+}
+
+function openingTag(path: string): string {
+	return `<folder_instructions path="${path}"`
+}
+
+export function formatFolderInstructions(
+	blocks: readonly { instruction: FolderInstruction; body: string }[]
+): string {
+	// The budget goes innermost first: the most specific instructions are the last to
+	// be cut. An outer body the budget no longer reaches keeps its tag, so it still
+	// counts as delivered, with the cut marked.
+	let remaining = MAX_FOLDER_INSTRUCTIONS_TOTAL
+	const bodies = [...blocks].reverse().map(({ body }) => {
+		const cut = truncateForPrompt(body, Math.min(MAX_FOLDER_INSTRUCTIONS_LENGTH, remaining))
+		remaining = Math.max(0, remaining - new TextEncoder().encode(cut).byteLength)
+		return cut
+	})
+	bodies.reverse()
+	return blocks
+		.map(
+			({ instruction }, i) =>
+				`${openingTag(instruction.path)} scope="${instruction.scope}">\n${bodies[i]}\n</folder_instructions>`
+		)
+		.join('\n\n')
+}
+
+/** The system prompt section naming the scopes that carry instructions. */
+export function getFolderInstructionsPromptSection(
+	instructions: readonly FolderInstruction[]
+): string {
+	if (instructions.length === 0) return ''
+	const scopes = [...new Set(instructions.map((i) => i.scope))].sort()
+	const listed = scopes.slice(0, MAX_LISTED_FOLDER_INSTRUCTIONS)
+	const more = scopes.length > listed.length ? ` (and ${scopes.length - listed.length} more)` : ''
+	return `\n\nFOLDER INSTRUCTIONS:
+These folders carry instructions (ai_instruction resources) for every item under them: ${listed.map((s) => `\`${s}\``).join(', ')}${more}.
+- The first time a tool call names a path under one of them, its instructions are delivered in a <folder_instructions> block of the tool result. A call that would change something is held back until you have them: read them, then make the call again.
+- Follow them for all work under that folder, together with any WORKSPACE INSTRUCTIONS and USER INSTRUCTIONS above: they add to those, they do not replace them.
+- Only where two of them conflict on the same point, the more specific one wins: a nested folder's instructions over its parent folder's, a folder's over the WORKSPACE INSTRUCTIONS, and both over the USER INSTRUCTIONS, which are personal preferences. The user's explicit requests in this chat come before all of them.`
+}
diff --git a/frontend/src/lib/components/copilot/chat/global/apiCatalogTools.test.ts b/frontend/src/lib/components/copilot/chat/global/apiCatalogTools.test.ts
deleted file mode 100644
index 06109708de..0000000000
--- a/frontend/src/lib/components/copilot/chat/global/apiCatalogTools.test.ts
+++ /dev/null
@@ -1,350 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest'
-
-const { listMcpToolsMock } = vi.hoisted(() => ({
-	listMcpToolsMock: vi.fn()
-}))
-
-vi.mock('../shared', () => ({
-	createToolDef: (_schema: unknown, name: string, description: string) => ({
-		type: 'function',
-		function: { name, description, parameters: {} }
-	})
-}))
-
-vi.mock('$lib/gen', () => ({
-	McpService: {
-		listMcpTools: listMcpToolsMock
-	}
-}))
-
-import { apiCatalogTools, clearApiCatalogCache } from './apiCatalogTools'
-
-const CATALOG = [
-	{
-		name: 'listWorkers',
-		description: 'List workers',
-		instructions: 'List all workers with their ping status',
-		path: '/workers/list',
-		method: 'GET',
-		query_params_schema: {
-			type: 'object',
-			properties: { page: { type: 'integer' }, per_page: { type: 'integer' } }
-		}
-	},
-	{
-		name: 'listDataMetrics',
-		description: 'List declared measures and dimensions',
-		instructions: '',
-		path: '/w/{workspace}/data_metrics/list',
-		method: 'GET'
-	},
-	{
-		name: 'listQueue',
-		description: 'List queued jobs',
-		instructions: 'List the jobs waiting in the queue',
-		path: '/w/{workspace}/jobs/queue/list',
-		method: 'GET',
-		query_params_schema: {
-			type: 'object',
-			properties: { running: { type: 'boolean' }, per_page: { type: 'integer' } }
-		}
-	},
-	{
-		name: 'getJobUpdates',
-		description: 'Get job updates',
-		instructions: '',
-		path: '/w/{workspace}/jobs_u/getupdate/{id}',
-		method: 'GET',
-		path_params_schema: {
-			type: 'object',
-			properties: { workspace: { type: 'string' }, id: { type: 'string' } },
-			required: ['workspace', 'id']
-		}
-	},
-	{
-		name: 'getJob',
-		description: 'Get job details',
-		instructions: '',
-		path: '/w/{workspace}/jobs_u/get/{id}',
-		method: 'GET',
-		path_params_schema: {
-			type: 'object',
-			properties: { workspace: { type: 'string' }, id: { type: 'string' } },
-			required: ['workspace', 'id']
-		}
-	},
-	{
-		name: 'deleteSchedule',
-		description: 'Delete a schedule',
-		instructions: '',
-		path: '/w/{workspace}/schedules/delete/{path}',
-		method: 'DELETE',
-		path_params_schema: {
-			type: 'object',
-			properties: { workspace: { type: 'string' }, path: { type: 'string' } },
-			required: ['workspace', 'path']
-		}
-	},
-	{
-		name: 'createFlow',
-		description: 'Create a flow',
-		instructions: '',
-		path: '/w/{workspace}/flows/create',
-		method: 'POST'
-	},
-	{
-		name: 'getVariable',
-		description: 'Get variable',
-		instructions: '',
-		path: '/w/{workspace}/variables/get/{path}',
-		method: 'GET'
-	},
-	{
-		name: 'getScriptByPath',
-		description: 'Get script by path',
-		instructions: '',
-		path: '/w/{workspace}/scripts/get/p/{path}',
-		method: 'GET'
-	},
-	{
-		name: 'deleteScriptByHash',
-		description: 'Delete a script by hash',
-		instructions: '',
-		path: '/w/{workspace}/scripts/delete/h/{hash}',
-		method: 'POST',
-		path_params_schema: {
-			type: 'object',
-			properties: { workspace: { type: 'string' }, hash: { type: 'string' } },
-			required: ['workspace', 'hash']
-		}
-	},
-	{
-		name: 'runScriptByPath',
-		description: 'Run script by path',
-		instructions: 'Trigger a run of a deployed script',
-		path: '/w/{workspace}/jobs/run/p/{path}',
-		method: 'POST',
-		path_params_schema: {
-			type: 'object',
-			properties: { workspace: { type: 'string' }, path: { type: 'string' } },
-			required: ['workspace', 'path']
-		},
-		body_schema: { type: 'object', additionalProperties: true }
-	},
-	{
-		name: 'cancelQueuedJob',
-		description: 'Cancel a queued job',
-		instructions: '',
-		path: '/w/{workspace}/jobs_u/queue/cancel/{id}',
-		method: 'POST',
-		path_params_schema: {
-			type: 'object',
-			properties: { workspace: { type: 'string' }, id: { type: 'string' } },
-			required: ['workspace', 'id']
-		},
-		body_schema: { type: 'object', additionalProperties: true }
-	},
-	{
-		name: 'runFlowByPath',
-		description: 'Run flow by path',
-		instructions: 'Trigger a run of a deployed flow',
-		path: '/w/{workspace}/jobs/run/f/{path}',
-		method: 'POST',
-		path_params_schema: {
-			type: 'object',
-			properties: { workspace: { type: 'string' }, path: { type: 'string' } },
-			required: ['workspace', 'path']
-		},
-		body_schema: {
-			type: 'object',
-			properties: { args: { type: 'object' } }
-		}
-	}
-]
-
-function createToolCallbacks() {
-	return {
-		setToolStatus: vi.fn(),
-		removeToolStatus: vi.fn()
-	} as any
-}
-
-function getTool(name: string) {
-	const tool = apiCatalogTools.find((entry) => entry.def.function.name === name)
-	if (!tool) throw new Error(`${name} tool not found`)
-	return tool
-}
-
-async function run(name: string, args: Record<string, unknown>) {
-	const raw = await getTool(name).fn({
-		args,
-		workspace: 'test-ws',
-		helpers: {},
-		toolCallbacks: createToolCallbacks(),
-		toolId: 'tool-1'
-	})
-	return JSON.parse(raw)
-}
-
-beforeEach(() => {
-	vi.clearAllMocks()
-	clearApiCatalogCache()
-	listMcpToolsMock.mockResolvedValue(CATALOG)
-	vi.unstubAllGlobals()
-})
-
-describe('search_api_endpoints', () => {
-	it('matches on name/path tokens, plural-insensitively, and excludes covered endpoints', async () => {
-		// Singular "job" matches the plural "jobs" path segment.
-		const result = await run('search_api_endpoints', { query: 'list queued job' })
-		expect(result.matches[0].name).toBe('listQueue')
-		expect(result.matches[0].endpoint).toBe('GET /w/{workspace}/jobs/queue/list')
-		expect(result.matches[0].params).toEqual(['running', 'per_page'])
-		expect(result.matches[0].instructions).toContain('waiting in the queue')
-
-		const flows = await run('search_api_endpoints', { query: 'create flow' })
-		expect(flows.matches.map((m: any) => m.name)).not.toContain('createFlow')
-		expect(flows.covered_by_dedicated_tools).toContain('createFlow → use write_flow')
-	})
-
-	it('returns endpoint categories when nothing matches', async () => {
-		const result = await run('search_api_endpoints', { query: 'kubernetes' })
-		expect(result.matches).toEqual([])
-		expect(result.hint).toContain('jobs_u')
-		// Categories are built from the uncovered endpoints only, so a covered one
-		// must not be advertised as somewhere to retry.
-		expect(result.hint).not.toContain('workers')
-		expect(result.hint).not.toContain('data_metrics')
-	})
-})
-
-describe('call_api_get', () => {
-	it('rejects covered, unknown, and non-GET endpoints with a pointer', async () => {
-		const covered = await run('call_api_get', { name: 'createFlow' })
-		expect(covered.error).toContain('write_flow')
-
-		const unknown = await run('call_api_get', { name: 'nope' })
-		expect(unknown.error).toContain('search_api_endpoints')
-
-		const mutating = await run('call_api_get', { name: 'cancelQueuedJob' })
-		expect(mutating.error).toContain('call_api_endpoint')
-
-		const job = await run('call_api_get', { name: 'getJob' })
-		expect(job.error).toContain('get_run')
-
-		const deleting = await run('call_api_endpoint', { name: 'deleteSchedule' })
-		expect(deleting.error).toContain('delete_workspace_item')
-
-		const byHash = await run('call_api_endpoint', { name: 'deleteScriptByHash' })
-		expect(byHash.error).toContain('delete_workspace_item')
-		const search = await run('search_api_endpoints', { query: 'delete script' })
-		expect(search.matches.map((m: any) => m.name)).not.toContain('deleteScriptByHash')
-	})
-
-	// Left reachable, these endpoints are the way around the argument form: they run the
-	// deployed runnable on the model's arguments, unstripped and unshown.
-	it('refuses a deployed run, pointing at run_script and run_flow', async () => {
-		for (const [name, tool, query] of [
-			['runScriptByPath', 'run_script', 'run deployed script'],
-			['runFlowByPath', 'run_flow', 'run deployed flow']
-		]) {
-			const called = await run('call_api_endpoint', { name })
-			expect(called.error).toContain(tool)
-			expect(called.success).toBe(false)
-
-			// And it is gone from search, so the model is redirected before it ever calls.
-			const search = await run('search_api_endpoints', { query })
-			expect(search.matches.map((m: any) => m.name)).not.toContain(name)
-			expect(search.covered_by_dedicated_tools?.join(' ')).toContain(tool)
-		}
-	})
-
-	it('refuses draft-blind item reads and lists, pointing at the draft-aware tools', async () => {
-		for (const name of ['getScriptByPath', 'getResource', 'getSchedule']) {
-			const result = await run('call_api_get', { name })
-			expect(result.success).toBe(false)
-			expect(result.error).toContain('read_workspace_item')
-		}
-		for (const name of ['listScripts', 'listFlows', 'listResource', 'listSchedules']) {
-			const result = await run('call_api_get', { name })
-			expect(result.success).toBe(false)
-			expect(result.error).toContain('list_workspace_items')
-		}
-
-		const search = await run('search_api_endpoints', { query: 'get script' })
-		expect(search.matches.map((m: any) => m.name)).not.toContain('getScriptByPath')
-	})
-
-	it('refuses the worker and data-metric reads, pointing at their dedicated tools', async () => {
-		for (const [name, tool, query] of [
-			['listWorkers', 'list_workers', 'workers'],
-			['listDataMetrics', 'list_data_metrics', 'data metrics']
-		]) {
-			const result = await run('call_api_get', { name })
-			expect(result.success).toBe(false)
-			expect(result.error).toContain(tool)
-
-			const search = await run('search_api_endpoints', { query })
-			expect(search.matches.map((m: any) => m.name)).not.toContain(name)
-			expect(search.covered_by_dedicated_tools?.join(' ')).toContain(tool)
-		}
-	})
-
-	it('refuses variable reads so variable values never reach the model', async () => {
-		const result = await run('call_api_get', { name: 'getVariable' })
-		expect(result.success).toBe(false)
-		expect(result.error).toContain('never readable')
-
-		const search = await run('search_api_endpoints', { query: 'variable' })
-		expect(search.matches.map((m: any) => m.name)).not.toContain('getVariable')
-	})
-
-	it('returns the endpoint schema when a required path param is missing', async () => {
-		const result = await run('call_api_get', { name: 'getJobUpdates' })
-		expect(result.success).toBe(false)
-		expect(result.error).toContain('id')
-		expect(result.schema.path_params_schema.required).toContain('id')
-	})
-
-	it('substitutes path params and sends the rest as query params', async () => {
-		const fetchMock = vi.fn().mockResolvedValue({
-			ok: true,
-			headers: new Headers({ 'content-type': 'application/json' }),
-			json: async () => [{ id: 'job-1' }]
-		})
-		vi.stubGlobal('fetch', fetchMock)
-		const result = await run('call_api_get', { name: 'listQueue', params: { running: true } })
-		expect(fetchMock).toHaveBeenCalledWith('/api/w/test-ws/jobs/queue/list?running=true', {
-			method: 'GET'
-		})
-		expect(result).toEqual({ success: true, data: [{ id: 'job-1' }] })
-	})
-})
-
-describe('call_api_endpoint', () => {
-	it('requires confirmation and executes mutating endpoints with a body', async () => {
-		expect(getTool('call_api_endpoint').requiresConfirmation).toBe(true)
-		const fetchMock = vi.fn().mockResolvedValue({
-			ok: true,
-			headers: new Headers({ 'content-type': 'text/plain' }),
-			text: async () => 'job-id-1'
-		})
-		vi.stubGlobal('fetch', fetchMock)
-		const result = await run('call_api_endpoint', {
-			name: 'cancelQueuedJob',
-			params: { id: 'job/1' },
-			body: { args: { n: 1 } }
-		})
-		expect(fetchMock).toHaveBeenCalledWith('/api/w/test-ws/jobs_u/queue/cancel/job%2F1', {
-			method: 'POST',
-			headers: { 'Content-Type': 'application/json' },
-			body: JSON.stringify({ args: { n: 1 } })
-		})
-		expect(result).toEqual({ success: true, data: 'job-id-1' })
-	})
-
-	it('redirects GET endpoints to call_api_get', async () => {
-		const result = await run('call_api_endpoint', { name: 'listQueue' })
-		expect(result.error).toContain('call_api_get')
-	})
-})
diff --git a/frontend/src/lib/components/copilot/chat/global/apiCatalogTools.ts b/frontend/src/lib/components/copilot/chat/global/apiCatalogTools.ts
deleted file mode 100644
index 42c68c6ebf..0000000000
--- a/frontend/src/lib/components/copilot/chat/global/apiCatalogTools.ts
+++ /dev/null
@@ -1,391 +0,0 @@
-import { z } from 'zod'
-import { McpService, type EndpointTool } from '$lib/gen'
-import { createToolDef, type Tool } from '../shared'
-
-/**
- * Generic access to the backend's MCP endpoint catalog (the endpoints marked
- * `x-mcp-tool` in openapi.yaml) as three small static tools — search, GET
- * call, mutating call — instead of one registered tool per endpoint. Search
- * results carry parameter names and usage instructions; full parameter schemas
- * enter the model's context only when a call fails validation. This keeps the
- * per-iteration tool-schema cost constant.
- */
-
-// Endpoints whose job a dedicated global tool already does, plus the variable
-// read endpoints. Hidden from search and refused at call time: the authoring
-// and delete ones would bypass the draft lifecycle (conflict detection,
-// explicit deploy, draft cleanup on delete), the variable reads would expose
-// variable values to the model (getVariable even decrypts secrets by default),
-// and the rest are exact duplicates that would fragment behavior across two
-// code paths.
-const COVERED_ENDPOINTS: Record<string, string> = {
-	getVariable: 'read_workspace_item (variable values are never readable in chat)',
-	listVariable: 'list_workspace_items (variable values are never readable in chat)',
-	// The item read/list endpoints return deployed state only, blind to the user's
-	// drafts; read_workspace_item / list_workspace_items merge drafts, and for
-	// flows return the compact JSON that patch_flow_json matches against.
-	getScriptByPath:
-		'read_workspace_item (reads your draft when one exists; pass version: "deployed" for the deployed state)',
-	getFlowByPath:
-		'read_workspace_item (reads your draft when one exists; pass version: "deployed" for the deployed state)',
-	getResource:
-		'read_workspace_item (reads your draft when one exists; pass version: "deployed" for the deployed state)',
-	getSchedule:
-		'read_workspace_item (reads your draft when one exists; pass version: "deployed" for the deployed state)',
-	listScripts: 'list_workspace_items (it includes your drafts)',
-	listFlows: 'list_workspace_items (it includes your drafts)',
-	listResource: 'list_workspace_items (it includes your drafts)',
-	listSchedules: 'list_workspace_items (it includes your drafts)',
-	runScriptByPath: 'run_script (it shows the user an argument form to confirm)',
-	runFlowByPath: 'run_flow (it shows the user an argument form to confirm)',
-	deleteScriptByPath: 'delete_workspace_item',
-	deleteScriptByHash: 'delete_workspace_item',
-	deleteFlowByPath: 'delete_workspace_item',
-	deleteSchedule: 'delete_workspace_item',
-	deleteVariable: 'delete_workspace_item',
-	deleteResource: 'delete_workspace_item',
-	createScript: 'write_script',
-	createFlow: 'write_flow',
-	updateFlow: 'patch_flow_json or write_flow',
-	createApp: 'init_app and the app draft tools',
-	updateApp: 'write_app_file / write_app_runnable',
-	createVariable: 'write_variable',
-	updateVariable: 'write_variable',
-	createResource: 'write_resource',
-	updateResource: 'write_resource',
-	createSchedule: 'write_schedule',
-	updateSchedule: 'write_schedule',
-	searchDocs: 'search_docs',
-	readDocsPage: 'read_docs_page',
-	listJobs: 'list_runs',
-	listWorkers: 'list_workers',
-	listDataMetrics: 'list_data_metrics',
-	getJob: 'get_run',
-	getJobLogs: 'get_run',
-	runScriptPreviewAndWaitResult: 'test_run_script'
-}
-
-const MAX_SEARCH_RESULTS = 10
-const MAX_DESCRIPTION_CHARS = 200
-const MAX_INSTRUCTIONS_CHARS = 400
-const MAX_RESULT_CHARS = 20_000
-
-let catalogCache: { workspace: string; endpoints: EndpointTool[] } | undefined
-
-async function loadCatalog(workspace: string): Promise<EndpointTool[]> {
-	if (catalogCache?.workspace !== workspace) {
-		const endpoints = await McpService.listMcpTools({ workspace })
-		catalogCache = { workspace, endpoints }
-	}
-	return catalogCache.endpoints
-}
-
-export function clearApiCatalogCache() {
-	catalogCache = undefined
-}
-
-function tokenize(text: string): string[] {
-	return text
-		.replace(/([a-z0-9])([A-Z])/g, '$1 $2')
-		.toLowerCase()
-		.split(/[^a-z0-9]+/)
-		.filter((t) => t.length > 1)
-}
-
-// Cheap plural-insensitive comparison so "workers" matches "worker" and vice versa.
-function tokenMatches(token: string, queryToken: string): boolean {
-	const strip = (t: string) => (t.length > 3 && t.endsWith('s') ? t.slice(0, -1) : t)
-	return strip(token) === strip(queryToken)
-}
-
-function pathSegments(path: string): string[] {
-	return path.split('/').filter((seg) => seg && seg !== 'w' && !seg.startsWith('{'))
-}
-
-// Name and path tokens identify the operation; description tokens only support it.
-function scoreEndpoint(endpoint: EndpointTool, queryTokens: string[]): number {
-	const nameTokens = [...tokenize(endpoint.name), ...pathSegments(endpoint.path).flatMap(tokenize)]
-	const descTokens = tokenize(`${endpoint.description} ${endpoint.instructions}`)
-	let score = 0
-	for (const qt of queryTokens) {
-		if (nameTokens.some((t) => tokenMatches(t, qt))) score += 3
-		else if (descTokens.some((t) => tokenMatches(t, qt))) score += 1
-	}
-	return score
-}
-
-function schemaPropertyNames(schema: unknown): string[] {
-	const properties = (schema as { properties?: Record<string, unknown> } | null | undefined)
-		?.properties
-	return properties ? Object.keys(properties).filter((k) => k !== 'workspace') : []
-}
-
-function truncate(text: string, max: number): string {
-	return text.length > max ? text.slice(0, max) + '…' : text
-}
-
-function summarizeEndpoint(endpoint: EndpointTool) {
-	const params = [
-		...schemaPropertyNames(endpoint.path_params_schema),
-		...schemaPropertyNames(endpoint.query_params_schema)
-	]
-	const bodyParams = schemaPropertyNames(endpoint.body_schema)
-	const instructions = endpoint.instructions.trim()
-	return {
-		name: endpoint.name,
-		endpoint: `${endpoint.method.toUpperCase()} ${endpoint.path}`,
-		description: truncate(endpoint.description, MAX_DESCRIPTION_CHARS),
-		...(instructions ? { instructions: truncate(instructions, MAX_INSTRUCTIONS_CHARS) } : {}),
-		...(params.length > 0 ? { params } : {}),
-		...(bodyParams.length > 0 ? { body_params: bodyParams } : {})
-	}
-}
-
-function endpointSchemaHelp(endpoint: EndpointTool) {
-	return {
-		name: endpoint.name,
-		endpoint: `${endpoint.method.toUpperCase()} ${endpoint.path}`,
-		path_params_schema: endpoint.path_params_schema ?? undefined,
-		query_params_schema: endpoint.query_params_schema ?? undefined,
-		body_schema: endpoint.body_schema ?? undefined
-	}
-}
-
-async function resolveEndpoint(
-	workspace: string,
-	name: string
-): Promise<{ endpoint: EndpointTool } | { error: string }> {
-	const covered = COVERED_ENDPOINTS[name]
-	if (covered) {
-		return { error: `"${name}" is covered by the dedicated ${covered} tool — use it instead.` }
-	}
-	const catalog = await loadCatalog(workspace)
-	const endpoint = catalog.find((e) => e.name === name)
-	if (!endpoint) {
-		return {
-			error: `Unknown endpoint "${name}". Use search_api_endpoints to find the endpoint name.`
-		}
-	}
-	return { endpoint }
-}
-
-async function executeEndpoint(
-	endpoint: EndpointTool,
-	workspace: string,
-	params: Record<string, unknown>,
-	body?: unknown
-): Promise<string> {
-	let url = `/api${endpoint.path.replace('{workspace}', encodeURIComponent(workspace))}`
-	const queryParams = new URLSearchParams()
-	for (const [key, value] of Object.entries(params)) {
-		if (value === undefined || value === null) continue
-		if (url.includes(`{${key}}`)) {
-			url = url.replace(`{${key}}`, encodeURIComponent(String(value)))
-		} else {
-			queryParams.append(key, String(value))
-		}
-	}
-	const unresolved = [...url.matchAll(/\{([^}]+)\}/g)].map((m) => m[1])
-	if (unresolved.length > 0) {
-		return JSON.stringify({
-			success: false,
-			error: `Missing required path parameter(s): ${unresolved.join(', ')}`,
-			schema: endpointSchemaHelp(endpoint)
-		})
-	}
-	const search = queryParams.toString()
-	if (search) url += `?${search}`
-
-	const method = endpoint.method.toUpperCase()
-	const fetchOptions: RequestInit = { method }
-	if (body !== undefined && method !== 'GET') {
-		fetchOptions.headers = { 'Content-Type': 'application/json' }
-		fetchOptions.body = JSON.stringify(body)
-	}
-
-	const response = await fetch(url, fetchOptions)
-	const raw = response.headers.get('content-type')?.includes('application/json')
-		? await response.json()
-		: await response.text()
-	if (!response.ok) {
-		return JSON.stringify({
-			success: false,
-			status: response.status,
-			error: typeof raw === 'string' ? raw : JSON.stringify(raw),
-			// 4xx usually means wrong arguments — echo the schema so the model can
-			// self-correct in the next call without a separate schema-fetch tool.
-			...(response.status >= 400 && response.status < 500
-				? { schema: endpointSchemaHelp(endpoint) }
-				: {})
-		})
-	}
-	const result = JSON.stringify({ success: true, data: raw })
-	if (result.length <= MAX_RESULT_CHARS) return result
-	return JSON.stringify({
-		success: true,
-		truncated: true,
-		data: (typeof raw === 'string' ? raw : JSON.stringify(raw)).slice(0, MAX_RESULT_CHARS),
-		note: `Result truncated to ${MAX_RESULT_CHARS} characters. Use filter or pagination parameters to narrow it.`
-	})
-}
-
-const searchApiEndpointsSchema = z.object({
-	query: z
-		.string()
-		.describe(
-			'Keywords matched against endpoint names, paths, and descriptions (e.g. "queue", "run flow", "audit log"). Jobs are called "runs" in the UI.'
-		)
-})
-
-const callApiGetSchema = z.object({
-	name: z.string().describe('Endpoint name as returned by search_api_endpoints'),
-	params: z
-		.record(z.string(), z.any())
-		.optional()
-		.describe(
-			'Path and query parameter values, keyed by parameter name. The workspace parameter is filled automatically.'
-		)
-})
-
-const callApiEndpointSchema = z.object({
-	name: z.string().describe('Endpoint name as returned by search_api_endpoints'),
-	params: z
-		.record(z.string(), z.any())
-		.optional()
-		.describe(
-			'Path and query parameter values, keyed by parameter name. The workspace parameter is filled automatically.'
-		),
-	body: z
-		.record(z.string(), z.any())
-		.optional()
-		.describe('JSON request body, when the endpoint takes one')
-})
-
-export const apiCatalogTools: Tool<{}>[] = [
-	{
-		def: createToolDef(
-			searchApiEndpointsSchema,
-			'search_api_endpoints',
-			'Search the Windmill REST API endpoint catalog for operations no dedicated tool covers (queue state, job details, running deployed items, deletions, ...). Returns endpoint names to pass to call_api_get or call_api_endpoint.'
-		),
-		planModeSafe: true,
-		fn: async ({ args, workspace, toolId, toolCallbacks }) => {
-			const parsed = searchApiEndpointsSchema.parse(args)
-			toolCallbacks.setToolStatus(toolId, { content: 'Searching API endpoints...' })
-			const catalog = await loadCatalog(workspace)
-			const queryTokens = tokenize(parsed.query)
-			const available = catalog.filter((e) => !COVERED_ENDPOINTS[e.name])
-			const scored = available
-				.map((endpoint) => ({ endpoint, score: scoreEndpoint(endpoint, queryTokens) }))
-				.filter((s) => s.score > 0)
-				.sort((a, b) => b.score - a.score || a.endpoint.name.localeCompare(b.endpoint.name))
-			const coveredHits = catalog
-				.filter((e) => COVERED_ENDPOINTS[e.name] && scoreEndpoint(e, queryTokens) > 0)
-				.map((e) => `${e.name} → use ${COVERED_ENDPOINTS[e.name]}`)
-
-			if (scored.length === 0) {
-				const categories = [...new Set(available.map((e) => pathSegments(e.path)[0]))].sort()
-				const result = JSON.stringify(
-					{
-						matches: [],
-						hint: `No endpoint matched. Available endpoint categories: ${categories.join(', ')}. Retry with different keywords, or use a dedicated tool if one covers the need.`,
-						...(coveredHits.length > 0 ? { covered_by_dedicated_tools: coveredHits } : {})
-					},
-					null,
-					2
-				)
-				toolCallbacks.setToolStatus(toolId, { content: 'No matching API endpoint', result })
-				return result
-			}
-			const top = scored.slice(0, MAX_SEARCH_RESULTS)
-			const result = JSON.stringify(
-				{
-					matches: top.map((s) => summarizeEndpoint(s.endpoint)),
-					...(scored.length > top.length
-						? {
-								note: `${scored.length - top.length} more match(es) — refine the query to see them.`
-							}
-						: {}),
-					...(coveredHits.length > 0 ? { covered_by_dedicated_tools: coveredHits } : {})
-				},
-				null,
-				2
-			)
-			toolCallbacks.setToolStatus(toolId, {
-				content: `Found ${top.length} API endpoint(s) for "${parsed.query}"`,
-				result
-			})
-			return result
-		}
-	},
-	{
-		def: createToolDef(
-			callApiGetSchema,
-			'call_api_get',
-			'Call a read-only GET endpoint from the API catalog by name. Use search_api_endpoints first to find the endpoint name; a failed call returns the parameter schema.'
-		),
-		// Readonly rests on the method check below plus the catalog only exposing
-		// side-effect-free GETs; never mark a mutating GET as an `x-mcp-tool`.
-		planModeSafe: true,
-		showDetails: true,
-		fn: async ({ args, workspace, toolId, toolCallbacks }) => {
-			const parsed = callApiGetSchema.parse(args)
-			const resolved = await resolveEndpoint(workspace, parsed.name)
-			if ('error' in resolved) {
-				toolCallbacks.setToolStatus(toolId, { content: resolved.error, error: resolved.error })
-				return JSON.stringify({ success: false, error: resolved.error })
-			}
-			if (resolved.endpoint.method.toUpperCase() !== 'GET') {
-				const error = `"${parsed.name}" is a ${resolved.endpoint.method.toUpperCase()} endpoint — use call_api_endpoint for mutating calls.`
-				toolCallbacks.setToolStatus(toolId, { content: error, error })
-				return JSON.stringify({ success: false, error })
-			}
-			toolCallbacks.setToolStatus(toolId, { content: `Calling ${parsed.name}...` })
-			const result = await executeEndpoint(resolved.endpoint, workspace, parsed.params ?? {})
-			const ok = JSON.parse(result).success === true
-			toolCallbacks.setToolStatus(toolId, {
-				content: ok ? `Called ${parsed.name}` : `Call to ${parsed.name} failed`,
-				result,
-				...(ok ? {} : { error: `Call to ${parsed.name} failed` })
-			})
-			return result
-		}
-	},
-	{
-		def: createToolDef(
-			callApiEndpointSchema,
-			'call_api_endpoint',
-			'Call a mutating (POST/PUT/PATCH/DELETE) endpoint from the API catalog by name; the user is asked to confirm. Use search_api_endpoints first to find the endpoint name; a failed call returns the parameter schema.'
-		),
-		requiresConfirmation: true,
-		confirmationMessage: (args) => `Call API endpoint ${args?.name ?? ''}`,
-		showDetails: true,
-		fn: async ({ args, workspace, toolId, toolCallbacks }) => {
-			const parsed = callApiEndpointSchema.parse(args)
-			const resolved = await resolveEndpoint(workspace, parsed.name)
-			if ('error' in resolved) {
-				toolCallbacks.setToolStatus(toolId, { content: resolved.error, error: resolved.error })
-				return JSON.stringify({ success: false, error: resolved.error })
-			}
-			if (resolved.endpoint.method.toUpperCase() === 'GET') {
-				const error = `"${parsed.name}" is a GET endpoint — use call_api_get (no confirmation needed).`
-				toolCallbacks.setToolStatus(toolId, { content: error, error })
-				return JSON.stringify({ success: false, error })
-			}
-			toolCallbacks.setToolStatus(toolId, { content: `Calling ${parsed.name}...` })
-			const result = await executeEndpoint(
-				resolved.endpoint,
-				workspace,
-				parsed.params ?? {},
-				parsed.body
-			)
-			const ok = JSON.parse(result).success === true
-			toolCallbacks.setToolStatus(toolId, {
-				content: ok ? `Called ${parsed.name}` : `Call to ${parsed.name} failed`,
-				result,
-				...(ok ? {} : { error: `Call to ${parsed.name} failed` })
-			})
-			return result
-		}
-	}
-]
diff --git a/frontend/src/lib/components/copilot/chat/global/core.test.ts b/frontend/src/lib/components/copilot/chat/global/core.test.ts
index 825fdd34c3..e0df5c4a98 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.test.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.test.ts
@@ -259,6 +259,11 @@ vi.mock('$lib/gen', async () => {
 		WorkerService: wrapService(actual.WorkerService, {
 			listWorkers: vi.fn(async () => [])
 		}),
+		// Guests off by default, as a fresh workspace has them.
+		WorkspaceService: wrapService(actual.WorkspaceService, {
+			getGuestUsage: vi.fn(async () => ({ available: false, instance_enabled: false })),
+			getPublicSettings: vi.fn(async () => ({ guest_access_enabled: false }))
+		}),
 		FolderService: wrapService(actual.FolderService, {
 			createFolder: vi.fn(async () => 'created')
 		}),
@@ -404,7 +409,8 @@ import {
 	ScriptService,
 	UserService,
 	VariableService,
-	WorkerService
+	WorkerService,
+	WorkspaceService
 } from '$lib/gen'
 import { devopsRole, superadmin, userStore, usersWorkspaceStore } from '$lib/stores'
 import { processSecretArgs } from '$lib/components/secretArgUtils'
@@ -875,6 +881,67 @@ describe('global AI tools', () => {
 		)
 	})
 
+	it('names the job the card renders, without changing what the model is handed', async () => {
+		const runResult = await callGlobalTool('get_run', { id: 'job-123' })
+		expect(toolCallbacks.setToolStatus).toHaveBeenLastCalledWith(
+			'test-get_run',
+			expect.objectContaining({
+				result: runResult,
+				inspectedRun: {
+					jobId: 'job-123',
+					workspace: WORKSPACE,
+					runId: 'job-123',
+					step: undefined
+				}
+			})
+		)
+
+		// A step is a job of its own, and the model's line of prose about it carries
+		// neither its arguments nor its logs — the card reads those from the job. The
+		// address travels with it, since a step job names neither the step nor its run.
+		vi.mocked(JobService.getFlowAllResults).mockResolvedValueOnce({
+			entries: [
+				{
+					job_id: 'step-job-1',
+					label: 'b',
+					kind: 'script',
+					depth: 1,
+					sibling_index: 1,
+					sibling_count: 1,
+					status: 'success',
+					success: true,
+					result_prefix: '{"ok":true}'
+				}
+			]
+		} as any)
+		const stepResult = await callGlobalTool('get_run', { id: 'job-123', step: 'b' })
+		expect(stepResult).toContain('(job step-job-1, success) result:')
+		expect(toolCallbacks.setToolStatus).toHaveBeenLastCalledWith(
+			'test-get_run',
+			expect.objectContaining({
+				result: stepResult,
+				inspectedRun: {
+					jobId: 'step-job-1',
+					workspace: WORKSPACE,
+					runId: 'job-123',
+					step: 'b'
+				}
+			})
+		)
+
+		// An address naming several jobs resolves to none of them, so there is
+		// nothing for the card to bind to and the call renders as an ordinary row.
+		vi.mocked(JobService.getFlowAllResults).mockResolvedValueOnce({
+			entries: [],
+			step_error: 'Step "b" ran 4 times (loop/branches) — pick one with "b[i]".'
+		} as any)
+		await callGlobalTool('get_run', { id: 'job-123', step: 'b' })
+		expect(toolCallbacks.setToolStatus).toHaveBeenLastCalledWith(
+			'test-get_run',
+			expect.not.objectContaining({ inspectedRun: expect.anything() })
+		)
+	})
+
 	it('reports when a run has no logs, and tells that apart from logs it could not read', async () => {
 		vi.mocked(JobService.getJobLogs).mockResolvedValueOnce('   ')
 		expect(JSON.parse(await callGlobalTool('get_run', { id: 'job-empty' })).run.logs).toBe(
@@ -1957,6 +2024,87 @@ describe('global AI tools', () => {
 		})
 	})
 
+	it('records a creation diff for a new script draft', async () => {
+		const statuses: any[] = []
+
+		await callGlobalTool(
+			'write_script',
+			{
+				path: 'f/scripts/new-script',
+				language: 'python3',
+				content: 'print("hello")'
+			},
+			{ ...toolCallbacks, setToolStatus: (_toolId, status) => statuses.push(status) }
+		)
+
+		expect(statuses).toContainEqual({
+			codeDiff: { before: '', after: 'print("hello")', lang: 'python' }
+		})
+	})
+
+	it('tells a code app from a drag-and-drop app', async () => {
+		vi.mocked(AppService.listApps).mockResolvedValueOnce([
+			{ path: 'f/apps/code', summary: 'Code app', raw_app: true },
+			{ path: 'f/apps/builder', summary: 'Builder app' }
+		] as any)
+		// An app draft is always a code app: the chat cannot address a
+		// drag-and-drop app's draft kind at all.
+		seedBackendDraft(
+			'raw_app',
+			'u/admin/draft_listed',
+			{ summary: 'Draft app' },
+			{ workspace: WORKSPACE }
+		)
+
+		const rows = JSON.parse(await callGlobalTool('list_workspace_items', { types: ['app'] }))
+
+		expect(rows.map((r: any) => [r.path, r.rawApp])).toEqual([
+			['f/apps/code', true],
+			['f/apps/builder', false],
+			['u/admin/draft_listed', true]
+		])
+	})
+
+	it('still says which kind of app it is when the app is read directly', async () => {
+		// The flag decides whether the app tools are offered at all, and the model
+		// reads an app before it edits one — a listing that knows is not enough.
+		vi.mocked(AppService.getAppByPath).mockResolvedValueOnce({
+			path: 'f/apps/builder',
+			summary: 'Builder app',
+			value: { grid: [] },
+			raw_app: false
+		} as any)
+
+		const read = JSON.parse(
+			await callGlobalTool('read_workspace_item', { type: 'app', path: 'f/apps/builder' })
+		)
+		expect(read.rawApp).toBe(false)
+	})
+
+	it('finds a staged app under the folder it was filed in, not its generated path', async () => {
+		// A never-deployed app the editor created lives at a generated path, so the
+		// folder the user filed it under exists only as its staged name. The server
+		// drops draft-only rows under any narrowing filter, leaving this pass the one
+		// that can answer a folder-scoped question about it.
+		seedBackendDraft(
+			'raw_app',
+			'u/admin/draft_7f21c9',
+			{ summary: '', draft_path: 'f/team/invoice_tracker' },
+			{ workspace: WORKSPACE }
+		)
+
+		const matched = JSON.parse(
+			await callGlobalTool('list_workspace_items', { types: ['app'], path_prefix: 'f/team/' })
+		)
+		expect(matched).toHaveLength(1)
+		expect(matched[0].draftPath).toBe('f/team/invoice_tracker')
+
+		const other = JSON.parse(
+			await callGlobalTool('list_workspace_items', { types: ['app'], path_prefix: 'f/other/' })
+		)
+		expect(other).toEqual([])
+	})
+
 	it('applies path_prefix to drafts before enforcing the result limit', async () => {
 		await callGlobalTool('write_script', {
 			path: 'f/other/outside',
@@ -2950,12 +3098,17 @@ describe('global AI tools', () => {
 			kind: 'script'
 		} as any)
 
-		await callGlobalTool('write_script', {
-			path: 'f/scripts/existing',
-			summary: 'new summary',
-			language: 'bun',
-			content: 'new content'
-		})
+		const statuses: any[] = []
+		await callGlobalTool(
+			'write_script',
+			{
+				path: 'f/scripts/existing',
+				summary: 'new summary',
+				language: 'bun',
+				content: 'new content'
+			},
+			{ ...toolCallbacks, setToolStatus: (_toolId, status) => statuses.push(status) }
+		)
 
 		expect(
 			getBackendDraft<any>('script', 'f/scripts/existing', { workspace: WORKSPACE })
@@ -2967,6 +3120,9 @@ describe('global AI tools', () => {
 			content: 'new content',
 			language: 'bun'
 		})
+		expect(statuses).toContainEqual({
+			codeDiff: { before: 'old deployed content', after: 'new content', lang: 'typescript' }
+		})
 	})
 
 	describe('stale-draft deploy guard and rebase', () => {
@@ -3466,6 +3622,26 @@ describe('global AI tools', () => {
 		})
 	})
 
+	// The draft carries the deployed policy from the fork, so nothing is fetched to answer.
+	it('reports exposure for an app that has a draft over it', async () => {
+		seedBackendDraft(
+			'raw_app',
+			'f/apps/drafted',
+			{
+				files: { '/src/App.tsx': 'x' },
+				runnables: {},
+				policy: { execution_mode: 'anonymous' }
+			} as any,
+			{ workspace: WORKSPACE }
+		)
+
+		const read = await callGlobalTool('read_workspace_item', {
+			type: 'app',
+			path: 'f/apps/drafted'
+		})
+		expect(JSON.parse(read)).toMatchObject({ isDraft: true, executionMode: 'anonymous' })
+	})
+
 	it('summarizes local raw app drafts in read_workspace_item', async () => {
 		seedBackendDraft(
 			'raw_app',
@@ -3581,6 +3757,90 @@ describe('global AI tools', () => {
 		expect(getBackendDraft('raw_app', 'f/apps/report', { workspace: WORKSPACE })).toBeUndefined()
 	})
 
+	// A low-code app has a grid, not files and runnables, so every app tool here would
+	// otherwise report it as empty rather than say it is the wrong kind of app.
+	it('reports a low-code app without its contents, and refuses to act on it', async () => {
+		const lowCode = {
+			path: 'f/apps/legacy',
+			summary: 'legacy app',
+			raw_app: false,
+			value: { grid: [{ id: 'a', data: { type: 'buttoncomponent' } }] }
+		} as any
+		// ...Once per call: a persistent implementation would outlive this test and
+		// disarm the factory's "mock not configured" guard for the rest of the file.
+		for (let i = 0; i < 3; i++) vi.mocked(AppService.getAppByPath).mockResolvedValueOnce(lowCode)
+
+		// The read answers "this app is drag-and-drop" rather than throwing — but it must not
+		// summarize a grid as a file/runnable list, which reads as an empty app.
+		const read = JSON.parse(
+			await callGlobalTool('read_workspace_item', { type: 'app', path: 'f/apps/legacy' })
+		)
+		expect(read).toMatchObject({ type: 'app', path: 'f/apps/legacy', rawApp: false })
+		expect(read).not.toHaveProperty('value')
+
+		// The tools that would convert it to files and runnables still refuse: a staged draft
+		// would answer every later read in place of the app itself.
+		for (const [tool, args] of [
+			['read_app_file', { path: 'f/apps/legacy', file_path: '/index.tsx' }],
+			['write_app_file', { path: 'f/apps/legacy', file_path: '/App.tsx', content: 'x' }]
+		] as [string, any][]) {
+			const raw = await callGlobalTool(tool, args).catch((e) => String(e))
+			expect(raw).toContain('low-code app')
+		}
+		expect(getBackendDraft('raw_app', 'f/apps/legacy', { workspace: WORKSPACE })).toBeUndefined()
+	})
+
+	// This read is the only way to ask who may open a deployed app. Both kinds answer: a
+	// drag-and-drop app can be anonymous too, and no other tool here can inspect one.
+	it('reports who may open an app, whichever kind it is', async () => {
+		const readMode = async (app: any) => {
+			vi.mocked(AppService.getAppByPath).mockResolvedValueOnce(app)
+			const read = await callGlobalTool('read_workspace_item', { type: 'app', path: app.path })
+			return JSON.parse(read).executionMode
+		}
+		const guestApp = {
+			path: 'f/apps/code',
+			summary: 'Code app',
+			raw_app: true,
+			value: { files: {}, runnables: {} },
+			policy: { execution_mode: 'guest' }
+		}
+
+		vi.mocked(WorkspaceService.getGuestUsage).mockResolvedValueOnce({
+			available: true,
+			instance_enabled: true
+		} as any)
+		vi.mocked(WorkspaceService.getPublicSettings).mockResolvedValueOnce({
+			guest_access_enabled: true
+		} as any)
+		expect(await readMode(guestApp)).toBe('guest')
+
+		expect(
+			await readMode({
+				path: 'f/apps/builder',
+				summary: 'Builder app',
+				raw_app: false,
+				value: { grid: [] },
+				policy: { execution_mode: 'anonymous' }
+			})
+		).toBe('anonymous')
+
+		// The same app, with each switch crossed in turn: either one alone admits nobody, so
+		// reporting the mode bare would name an exposure the server refuses. Both off needs
+		// no case of its own — whichever half of the check were dropped, one of these two
+		// still catches it.
+		vi.mocked(WorkspaceService.getPublicSettings).mockResolvedValueOnce({
+			guest_access_enabled: true
+		} as any)
+		expect(await readMode(guestApp)).toContain('inert')
+
+		vi.mocked(WorkspaceService.getGuestUsage).mockResolvedValueOnce({
+			available: true,
+			instance_enabled: true
+		} as any)
+		expect(await readMode(guestApp)).toContain('inert')
+	})
+
 	it('reads raw app files without creating a draft', async () => {
 		vi.mocked(AppService.getAppByPath).mockResolvedValueOnce({
 			path: 'f/apps/report',
@@ -4237,6 +4497,69 @@ describe('global AI tools', () => {
 		expect(getBackendDraft('raw_app', 'f/apps/report', { workspace: WORKSPACE })).toBeUndefined()
 	})
 
+	// Deploying is what makes an app's runnables reachable, so it is the one moment the
+	// exposure is both true and known.
+	it('discloses who can open an app after a deploy', async () => {
+		const deployApp = async (path: string, policy: Record<string, unknown>) => {
+			vi.mocked(AppService.existsApp).mockResolvedValueOnce(true)
+			vi.mocked(AppService.getAppByPath).mockResolvedValueOnce({} as any)
+			seedBackendDraft(
+				'raw_app',
+				path,
+				{
+					summary: 'App',
+					files: { '/index.tsx': 'x' },
+					runnables: {},
+					data: { tables: [] },
+					policy
+				},
+				{ workspace: WORKSPACE }
+			)
+			return JSON.parse(await callGlobalTool('deploy_workspace_item', { type: 'app', path }))
+		}
+
+		const open = await deployApp('f/apps/open', {
+			execution_mode: 'anonymous',
+			on_behalf_of: 'u/alice'
+		})
+		expect(open.success).toBe(true)
+		expect(open.message).toContain('anyone with the URL, without logging in')
+		// The server decides what a deployed app runs as — it overwrites on_behalf_of for
+		// anyone outside the deployers group — so the note must not name an identity.
+		expect(open.message).not.toContain('u/alice')
+
+		// Guest is a real widening only where the deployment, the instance and the
+		// workspace all admit guests; stored below that, it is inert.
+		vi.mocked(WorkspaceService.getGuestUsage).mockResolvedValueOnce({
+			available: true,
+			instance_enabled: true
+		} as any)
+		vi.mocked(WorkspaceService.getPublicSettings).mockResolvedValueOnce({
+			guest_access_enabled: true
+		} as any)
+		const guestOn = await deployApp('f/apps/guest', { execution_mode: 'guest' })
+		expect(guestOn.success).toBe(true)
+		expect(guestOn.message).toContain('identity provider authenticates')
+
+		// Each switch crossed in turn, because either one alone admits nobody and the note
+		// would then announce an exposure that does not exist. Both off needs no case of its
+		// own: whichever half of the check were dropped, one of these two still catches it.
+		vi.mocked(WorkspaceService.getPublicSettings).mockResolvedValueOnce({
+			guest_access_enabled: true
+		} as any)
+		const instanceOff = await deployApp('f/apps/guest_inst_off', { execution_mode: 'guest' })
+		expect(instanceOff.success).toBe(true)
+		expect(instanceOff.message).not.toContain('identity provider')
+
+		vi.mocked(WorkspaceService.getGuestUsage).mockResolvedValueOnce({
+			available: true,
+			instance_enabled: true
+		} as any)
+		const workspaceOff = await deployApp('f/apps/guest_ws_off', { execution_mode: 'guest' })
+		expect(workspaceOff.success).toBe(true)
+		expect(workspaceOff.message).not.toContain('identity provider')
+	})
+
 	it('forwards preserve_on_behalf_of when the deployed policy carries an on_behalf_of', async () => {
 		// Without the flag the backend resets the policy's on_behalf_of to the
 		// deploying user; this chat path has no on-behalf-of selector, so it must
@@ -5763,6 +6086,237 @@ describe('global AI tools', () => {
 		})
 	})
 
+	// An agent step has no job of its own, so it runs as a flow preview of itself alone, opened on
+	// the same rows and the same values as the flow editor's own step test. A setting the step
+	// leaves alone is not offered at all, so a mounted widget cannot invent a value for it: an
+	// `enabled_tools` the form synthesized empty would advertise none of the agent's tools.
+	it("test_run_step opens an aiagent step on the step's own configuration", async () => {
+		const providerValue = { kind: 'openai', resource: '$res:u/admin/openai', model: 'gpt-4o' }
+		let opened: RunFormDisplay | undefined
+		await callGlobalTool('write_flow', {
+			path: 'f/flows/agent-step',
+			summary: 'Flow with an agent step',
+			modules: JSON.stringify([
+				{
+					id: 'ask',
+					value: {
+						type: 'aiagent',
+						tools: [
+							{
+								id: 'b',
+								summary: 'get_code',
+								value: {
+									tool_type: 'flowmodule',
+									type: 'rawscript',
+									language: 'bun',
+									content: 'export async function main() { return 1 }',
+									input_transforms: {}
+								}
+							}
+						],
+						input_transforms: {
+							provider: { type: 'static', value: providerValue },
+							user_message: { type: 'static', value: 'authored question' }
+						}
+					}
+				}
+			])
+		})
+
+		await withCompletedTestJob(() =>
+			callGlobalTool(
+				'test_run_step',
+				{
+					path: 'f/flows/agent-step',
+					stepId: 'ask',
+					args: { user_message: 'What is the capital of France?' }
+				},
+				{
+					...toolCallbacks,
+					requestRunArgs: async (_toolId, form) => {
+						opened = form
+						return form.args
+					}
+				}
+			)
+		)
+
+		// The step configures these two, so the form offers them, filled in with what the step
+		// holds — and the model's own message wins over the authored one.
+		expect(opened?.args).toMatchObject({
+			provider: providerValue,
+			user_message: 'What is the capital of France?'
+		})
+		// Those two plus the rows the editor always shows, and nothing else the step is silent
+		// about: `enabled_tools` above all, whose synthesized empty value would advertise no tools.
+		expect(Object.keys(opened?.schema?.properties ?? {})).toEqual([
+			'provider',
+			'user_message',
+			'system_prompt'
+		])
+
+		expect(JobService.runFlowPreview).toHaveBeenCalledWith({
+			workspace: WORKSPACE,
+			requestBody: {
+				value: {
+					modules: [
+						{
+							id: 'ask',
+							value: expect.objectContaining({
+								type: 'aiagent',
+								input_transforms: {
+									provider: { type: 'javascript', expr: 'flow_input.provider' },
+									user_message: { type: 'javascript', expr: 'flow_input.user_message' },
+									// Every row of the form runs from it, the blank ones too.
+									system_prompt: { type: 'javascript', expr: 'flow_input.system_prompt' }
+								}
+							})
+						}
+					]
+				},
+				args: { provider: providerValue, user_message: 'What is the capital of France?' },
+				// Filed under the flow, as the editor's step test does: a managed memory keyed on a
+				// named memory id is found under it.
+				path: 'f/flows/agent-step'
+			}
+		})
+	})
+
+	// What the form submits is what runs, as in the editor's step test: a field cleared over the
+	// step's expression runs cleared rather than falling back to the expression, whether the
+	// mounted form sends it as the empty string or the bypass posture sends the form unchanged.
+	it.each([
+		{
+			answer: 'the mounted form',
+			// A field the form could not fill in comes back blank, never absent: text as the empty
+			// string, a list as `[]`.
+			callbacks: {
+				requestRunArgs: async (_toolId: string, form: any) => ({
+					...form.args,
+					user_message: '',
+					enabled_tools: form.args.enabled_tools ?? []
+				})
+			}
+		},
+		{
+			answer: 'the bypass posture',
+			callbacks: {
+				shouldAutoAcceptToolConfirmations: () => true,
+				requestRunArgs: async (_toolId: string, form: any) => form.args
+			}
+		}
+	])(
+		'test_run_step runs an aiagent field left blank by $answer as blank',
+		async ({ callbacks }) => {
+			await callGlobalTool('write_flow', {
+				path: 'f/flows/agent-expr',
+				summary: 'Agent fed by an earlier step',
+				modules: JSON.stringify([
+					{
+						id: 'first',
+						value: {
+							type: 'rawscript',
+							language: 'bun',
+							content: 'export async function main() { return { question: "hi" } }',
+							input_transforms: {}
+						}
+					},
+					{
+						id: 'ask',
+						value: {
+							type: 'aiagent',
+							tools: [],
+							input_transforms: {
+								provider: {
+									type: 'static',
+									value: { kind: 'openai', resource: '$res:u/admin/openai', model: 'gpt-4o' }
+								},
+								user_message: { type: 'javascript', expr: 'results.first.question' },
+								enabled_tools: { type: 'javascript', expr: 'results.first.tools' }
+							}
+						}
+					}
+				])
+			})
+
+			await withCompletedTestJob(() =>
+				callGlobalTool(
+					'test_run_step',
+					{ path: 'f/flows/agent-expr', stepId: 'ask', args: {} },
+					{ ...toolCallbacks, ...callbacks }
+				)
+			)
+
+			const body = vi.mocked(JobService.runFlowPreview).mock.calls.at(-1)?.[0].requestBody as any
+			expect(body.value.modules[0].value.input_transforms.user_message).toEqual({
+				type: 'javascript',
+				expr: 'flow_input.user_message'
+			})
+			expect(body.args.enabled_tools).toEqual([])
+		}
+	)
+
+	// The memory picker resets a value whose kind it does not offer to its first option, so a
+	// step saved with a legacy kind would run with its history switched off. And a tool name typed
+	// by hand that matches none silently narrows the run, so the roster is offered as in the editor.
+	it("test_run_step offers an aiagent step the editor's choices", async () => {
+		let opened: RunFormDisplay | undefined
+		await callGlobalTool('write_flow', {
+			path: 'f/flows/agent-legacy-memory',
+			summary: 'Agent with legacy memory',
+			modules: JSON.stringify([
+				{
+					id: 'ask',
+					value: {
+						type: 'aiagent',
+						tools: [
+							{
+								id: 'b',
+								summary: 'get_code',
+								value: {
+									tool_type: 'flowmodule',
+									type: 'rawscript',
+									language: 'bun',
+									content: 'export async function main() { return 1 }',
+									input_transforms: {}
+								}
+							}
+						],
+						input_transforms: {
+							provider: {
+								type: 'static',
+								value: { kind: 'openai', resource: '$res:u/admin/openai', model: 'gpt-4o' }
+							},
+							user_message: { type: 'static', value: 'hi' },
+							memory: { type: 'static', value: { kind: 'auto', context_length: 5 } },
+							enabled_tools: { type: 'static', value: ['get_code'] }
+						}
+					}
+				}
+			])
+		})
+
+		await withCompletedTestJob(() =>
+			callGlobalTool(
+				'test_run_step',
+				{ path: 'f/flows/agent-legacy-memory', stepId: 'ask', args: {} },
+				{
+					...toolCallbacks,
+					requestRunArgs: async (_toolId, form) => {
+						opened = form
+						return form.args
+					}
+				}
+			)
+		)
+
+		const kinds = opened?.schema.properties.memory.oneOf.map(
+			(variant: any) => variant.properties.kind.enum[0]
+		)
+		expect(kinds).toContain('auto')
+		expect(opened?.schema.properties.enabled_tools.items.enum).toEqual(['get_code'])
+	})
+
 	// A step is fed by its input transforms, so its arguments are its own and the flow's
 	// schema describes a different set entirely. Opening the form on the flow's would offer
 	// fields this job ignores and drop the ones it takes.
@@ -6831,8 +7385,7 @@ describe('session-only preview tools gating', () => {
 		expect(names).not.toContain('list_app_runs')
 		expect(names).not.toContain('search_dom')
 		expect(names).not.toContain('read_dom')
-		// Not withheld: without it the side panel's only route to a deployed run is the raw
-		// endpoint, which confirms an opaque request body instead of the arguments.
+		// Not withheld: without it the side panel has no route to a deployed run at all.
 		expect(names).toContain('run_script')
 		// other tools are still present
 		expect(names).toContain('write_script')
@@ -7294,36 +7847,14 @@ describe('buildOpenPageUrl runs filters', () => {
 	})
 })
 
-describe('buildOpenPageUrl compare selection', () => {
-	const itemsOf = (url: string) => new URL(url, 'http://x').searchParams.get('items')
-
-	it('explicit items win over the chat mask', () => {
-		const url = buildOpenPageUrl(
-			'compare',
-			{ page: 'compare', items: ['script:f/a/b'] },
-			{ workspaceId: 'ws', chatItems: ['flow:f/c/d'] }
-		)
-		expect(itemsOf(url)).toBe('script:f/a/b')
-	})
-
-	it('omitted items fall back to the chat-modified mask', () => {
-		const url = buildOpenPageUrl(
-			'compare',
-			{ page: 'compare' },
-			{ workspaceId: 'ws', chatItems: ['flow:f/c/d', 'script:f/a/b'] }
-		)
-		expect(itemsOf(url)).toBe('flow:f/c/d,script:f/a/b')
-	})
-
-	it('an empty or absent mask yields no items param (page select-all default)', () => {
-		expect(
-			itemsOf(
-				buildOpenPageUrl('compare', { page: 'compare' }, { workspaceId: 'ws', chatItems: [] })
-			)
-		).toBeNull()
-		expect(
-			itemsOf(buildOpenPageUrl('compare', { page: 'compare' }, { workspaceId: 'ws' }))
-		).toBeNull()
+describe('buildOpenPageUrl compare', () => {
+	// Without an explicit mode the page auto-picks, which is the draft view outside a fork.
+	it('always opens the fork comparison', () => {
+		const params = new URL(
+			buildOpenPageUrl('compare', { page: 'compare' }, { workspaceId: 'ws' }),
+			'http://x'
+		).searchParams
+		expect(params.get('mode')).toBe('fork')
 	})
 })
 
@@ -7333,9 +7864,9 @@ describe('open_page workspace gating', () => {
 	// A workspace the user belongs to but whose `whoami` never answers.
 	const FLAKY = 'flaky_ws'
 	const openPage = () => getGlobalTool('open_page')
-	const pageSchema = () => (openPage().def.function.parameters as any)?.properties?.page ?? {}
+	let def = openPage().def
+	const pageSchema = () => (def.function.parameters as any)?.properties?.page ?? {}
 	const advertisedPages = () => (pageSchema().enum ?? []) as string[]
-	const pristineDef = openPage().def
 
 	beforeEach(() => {
 		// Admin of the workspace being browsed, plain member of the one a session operates on.
@@ -7358,16 +7889,26 @@ describe('open_page workspace gating', () => {
 		superadmin.set(undefined)
 		whoamiByWorkspace.clear()
 		clearWorkspaceRoleCache()
-		openPage().def = pristineDef
+	})
+
+	// Every chat shares this tool object, so a schema written back to it would reach the
+	// other chats' requests.
+	it("never writes a chat's schema back to the shared tool", async () => {
+		const shared = openPage().def
+		const snapshot = structuredClone(shared)
+		def = await openPage().schemaFor!({ operatingWorkspace: SESSION })
+		expect(def).not.toBe(shared)
+		expect(openPage().def).toBe(shared)
+		expect(shared).toEqual(snapshot)
 	})
 
 	// Reading the ambient `userStore` instead offers a session the pages of the workspace
 	// the user happens to be browsing.
 	it('gates on the operating workspace, not the one userStore describes', async () => {
-		await openPage().setSchema?.({ operatingWorkspace: NAV })
+		def = await openPage().schemaFor!({ operatingWorkspace: NAV })
 		expect(advertisedPages()).toContain('workspace_settings')
 
-		await openPage().setSchema?.({ operatingWorkspace: SESSION })
+		def = await openPage().schemaFor!({ operatingWorkspace: SESSION })
 		expect(advertisedPages()).toContain('runs')
 		expect(advertisedPages()).not.toContain('workspace_settings')
 		await expect(
@@ -7382,7 +7923,7 @@ describe('open_page workspace gating', () => {
 	// Neither layer may read as a denial: the role was never established, and the model
 	// sees the schema before it can ever reach the handler's message.
 	it('advertises nothing and blames no denial when the role lookup fails', async () => {
-		await openPage().setSchema?.({ operatingWorkspace: FLAKY })
+		def = await openPage().schemaFor!({ operatingWorkspace: FLAKY })
 		expect(advertisedPages()).toEqual([])
 		expect(pageSchema().description).toContain("couldn't be checked")
 		const refusal = await callGlobalTool('open_page', { page: 'runs' }, toolCallbacks, {
@@ -7395,7 +7936,7 @@ describe('open_page workspace gating', () => {
 	// A workspace absent from `userWorkspaces` is settled, not unknown: inviting a retry
 	// would be false, and asking `whoami` at all only earns a 401 on every iteration.
 	it('reports a plain denial for a workspace the user is not a member of', async () => {
-		await openPage().setSchema?.({ operatingWorkspace: 'unreachable_ws' })
+		def = await openPage().schemaFor!({ operatingWorkspace: 'unreachable_ws' })
 		expect(advertisedPages()).toEqual([])
 		expect(pageSchema().description).not.toContain("couldn't be checked")
 		const refusal = await callGlobalTool('open_page', { page: 'runs' }, toolCallbacks, {
@@ -7412,7 +7953,7 @@ describe('open_page workspace gating', () => {
 	it('asks whoami while the workspace list is still unresolved', async () => {
 		usersWorkspaceStore.set(undefined)
 
-		await openPage().setSchema?.({ operatingWorkspace: SESSION })
+		def = await openPage().schemaFor!({ operatingWorkspace: SESSION })
 
 		expect(UserService.whoami).toHaveBeenCalledWith(expect.objectContaining({ workspace: SESSION }))
 		expect(advertisedPages()).not.toEqual([])
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index b9a2cc7a91..5664f2349d 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -19,7 +19,8 @@ import {
 	SqsTriggerService,
 	VariableService,
 	WebsocketTriggerService,
-	WorkerService
+	WorkerService,
+	WorkspaceService
 } from '$lib/gen'
 import { createTwoFilesPatch } from 'diff'
 import { deepEqual } from 'fast-equals'
@@ -42,6 +43,13 @@ import type {
 	Script,
 	ScriptLang
 } from '$lib/gen/types.gen'
+import { loadSchemaFromModule, memoryPropertyFor } from '$lib/components/flows/flowInfers'
+import { flowLocalAgentSchema } from '$lib/components/flows/agentResourceUtils'
+import { AGENT_FIELDS, initialVisibleAgentFields } from '$lib/components/flows/agentFormFields'
+import { withAgentDrafts } from '$lib/components/flows/linkedAgentDrafts'
+import { resolveLinkedAgentTools } from '$lib/components/flows/flowState'
+import { enabledToolNames, type AgentTool } from '$lib/components/flows/agentToolUtils'
+import { evalValue } from '$lib/components/flows/utils.svelte'
 import { updateRawAppPolicy } from '$lib/components/raw_apps/rawAppPolicy'
 import {
 	FRAMEWORK_TEMPLATES,
@@ -134,10 +142,11 @@ import {
 	type CreatedResourceTriggerKind,
 	type PreviewCardKind,
 	type RunFormDisplay,
-	type Tool,
 	type ToolCallbacks,
+	type ToolCodeDiff,
 	type ToolDisplayAction
 } from '../shared'
+import { scriptLangToEditorLang } from '$lib/scripts'
 import { searchDocsTool, readDocsPageTool } from '../docs/core'
 import { createDbSchemaTool } from '../script/core'
 import type { ContextElement } from '../context'
@@ -194,6 +203,15 @@ import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
 import { invalidateWorkspaceComparison } from '$lib/workspaceComparison'
 import type { UserDraftItemKind } from '$lib/gen'
 import { bundleRawAppDraft } from './rawAppBundlerBridge'
+import {
+	DEPLOY,
+	NONE,
+	RUN_PREVIEW,
+	WRITE_DRAFT,
+	type SessionAccess,
+	type SessionTool,
+	type SessionToolPolicy
+} from '../sessionCapabilities'
 import {
 	buildRunsUrl,
 	buildSchedulesUrl,
@@ -253,7 +271,6 @@ const VARIABLE_MASKED_NOTE =
 	'Note: variable values are never shown in chat — the diff marks whether the value changed without revealing it.\n\n'
 const SECRET_UNCOMPARABLE_NOTE =
 	'Note: this is a SECRET variable — its value is never shown and cannot be compared, so it may ALSO have changed beyond what this diff shows.\n\n'
-import { apiCatalogTools } from './apiCatalogTools'
 
 const ITEM_TYPES = [
 	'script',
@@ -308,8 +325,8 @@ export type GlobalActivePreviewContext = {
 	 * location: a tab can host a legacy app whose hash is app state, and a filter value
 	 * can be free text the user typed. Build it with `previewLocationContext`. */
 	location: string
-	/** The row whose drawer is open on that page. The list pages drop the anchor when
-	 * their drawer closes, so its absence means no row is open. */
+	/** The item open in its editor: a list page row whose drawer is open, or the item a
+	 * session tab edits. Its absence means no item is open. */
 	open?: string
 }
 
@@ -768,7 +785,7 @@ const deployWorkspaceItemSchema = z.object({
 		.boolean()
 		.optional()
 		.describe(
-			'Deploy even if the draft was started from an older deployed version, overwriting the version deployed since. Defaults to false; prefer calling rebase_draft first to keep the newer changes.'
+			'Deploy even if the draft was started from an older deployed version, overwriting the version deployed since. Defaults to false.'
 		)
 })
 
@@ -928,7 +945,7 @@ const runScriptSchema = z.object({
 const runScriptToolDef = createToolDef(
 	runScriptSchema,
 	'run_script',
-	'Run a DEPLOYED script for real, under the user\'s own permissions. Fill in every argument you can infer: the user gets an argument form prefilled with `args` and decides what runs. For a secret argument prefer `$var:<path>` naming an existing workspace variable; a literal is minted into a short-lived secret before the run, but stays in this call. A required file is the user\'s to attach, so call this even when you cannot supply one rather than asking in chat. Use only when the user names the deployed version ("the deployed X", "in production", "for real"); otherwise use test_run_script.',
+	'Run a DEPLOYED script for real, under the user\'s own permissions. Fill in every argument you can infer: the user gets an argument form prefilled with `args` and decides what runs. For a secret argument prefer `$var:<path>` naming an existing workspace variable; a literal is minted into a short-lived secret before the run, but stays in this call. A required file is the user\'s to attach, so call this even when you cannot supply one rather than asking in chat. Use only when the user names the deployed version ("the deployed X", "in production", "for real").',
 	{ strict: false }
 )
 
@@ -967,7 +984,7 @@ const runFlowSchema = z.object({
 const runFlowToolDef = createToolDef(
 	runFlowSchema,
 	'run_flow',
-	'Run a DEPLOYED flow for real, under the user\'s own permissions. Fill in every argument you can infer: the user gets an argument form prefilled with `args` and decides what runs. For a secret argument prefer `$var:<path>` naming an existing workspace variable; a literal is minted into a short-lived secret before the run, but stays in this call. A required file is the user\'s to attach, so call this even when you cannot supply one rather than asking in chat. Use only when the user names the deployed version ("the deployed X", "in production", "for real"); otherwise use test_run_flow.',
+	'Run a DEPLOYED flow for real, under the user\'s own permissions. Fill in every argument you can infer: the user gets an argument form prefilled with `args` and decides what runs. For a secret argument prefer `$var:<path>` naming an existing workspace variable; a literal is minted into a short-lived secret before the run, but stays in this call. A required file is the user\'s to attach, so call this even when you cannot supply one rather than asking in chat. Use only when the user names the deployed version ("the deployed X", "in production", "for real").',
 	{ strict: false }
 )
 
@@ -982,7 +999,7 @@ const testRunStepSchema = z.object({
 const testRunStepToolDef = createToolDef(
 	testRunStepSchema,
 	'test_run_step',
-	"Execute a test run of one step in a flow by path, preferring draft flow/script content when it exists. `args` are the step's OWN inputs, not the flow's: a step is normally fed by its input transforms, so send what that step's code takes, not what the flow takes. The user gets an argument form prefilled with `args` and may edit or dismiss it before it runs, so fill in every argument you can infer. For a secret argument prefer `$var:<path>` naming an existing workspace variable; a literal is minted into a short-lived secret before the run, but stays in this call.",
+	"Execute a test run of one step in a flow by path, preferring draft flow/script content when it exists. `args` are the step's OWN inputs, not the flow's: a step is normally fed by its input transforms, so send what that step's code takes, not what the flow takes. An AI agent step takes the inputs a run supplies rather than code arguments, `user_message` above all; its form opens on the step's own configuration, so send only what this run should change. The user gets an argument form prefilled with `args` and may edit or dismiss it before it runs, so fill in every argument you can infer. For a secret argument prefer `$var:<path>` naming an existing workspace variable; a literal is minted into a short-lived secret before the run, but stays in this call.",
 	{ strict: false }
 )
 
@@ -1137,7 +1154,7 @@ const openPreviewSchema = z.object({
 	kind: z
 		.enum(['script', 'flow', 'raw_app', 'pipeline'])
 		.describe(
-			'Item kind to preview. Use "raw_app" for code-based apps (created via init_app). Use "pipeline" to show the data-pipeline graph for a folder — here `path` is the folder name, not an item path. The legacy drag-and-drop app builder ("app") is not previewable in the session panel — don\'t pass it.'
+			'Item kind to preview. Use "raw_app" for code-based apps. Use "pipeline" to show the data-pipeline graph for a folder — here `path` is the folder name, not an item path. The legacy drag-and-drop app builder ("app") is not previewable in the session panel — don\'t pass it.'
 		),
 	path: z
 		.string()
@@ -1270,7 +1287,11 @@ type FolderPromptContext = { folders?: string[]; foldersRead?: string[]; isAdmin
 // non-exhaustive hint alongside permission-agnostic guidance (the complete set
 // needs a folder-listing tool — follow-up).
 // Capped so a folder-heavy workspace can't dominate the prompt.
-function buildFolderGuidance(username: string, ctx?: FolderPromptContext): string {
+function buildFolderGuidance(
+	username: string,
+	ctx: FolderPromptContext | undefined,
+	canCreateFolder: boolean
+): string {
 	if (!ctx) return ''
 	const MAX = 40
 	const writable = ctx.folders ?? []
@@ -1286,7 +1307,7 @@ function buildFolderGuidance(username: string, ctx?: FolderPromptContext): strin
 			writable.length > 0
 				? ` Folders here include ${fmt(writable)} (you can also write to others not listed).`
 				: ''
-		return `- As a workspace admin you can write to any existing folder.${known} If the user names a folder, use it; if they explicitly ask for a new folder, create it with \`create_folder\`; otherwise ask them which folder to use rather than guessing or creating one unprompted.`
+		return `- As a workspace admin you can write to any existing folder.${known} If the user names a folder, use it;${canCreateFolder ? ' if they explicitly ask for a new folder, create it with `create_folder`;' : ''} otherwise ask them which folder to use rather than guessing${canCreateFolder ? ' or creating one unprompted' : ''}.`
 	}
 	// Everything below states the writable set as fact, including the empty case, so an
 	// unresolved role has to say nothing at all: "you have no shared folders" is a claim,
@@ -1297,11 +1318,15 @@ function buildFolderGuidance(username: string, ctx?: FolderPromptContext): strin
 	const lines: string[] = []
 	if (writable.length > 0) {
 		lines.push(
-			`- Folders you can write to in this workspace: ${fmt(writable)}. For shared/team work, pick the one whose purpose matches the request; if none clearly fits, ask which folder to use (askUserQuestion) rather than inventing a path. Use \`create_folder\` only when the user explicitly asks for a new folder.`
+			`- Folders you can write to in this workspace: ${fmt(writable)}. For shared/team work, pick the one whose purpose matches the request; if none clearly fits, ask which folder to use (askUserQuestion) rather than inventing a path.${canCreateFolder ? ' Use `create_folder` only when the user explicitly asks for a new folder.' : ''}`
 		)
 	} else {
 		lines.push(
-			`- You have no shared folders you can write to in this workspace, so use \`u/${username}/<name>\`. If the user explicitly asks for a shared folder, create one with \`create_folder\` (you become an owner); otherwise ask before placing shared work rather than inventing an \`f/<folder>/...\` path.`
+			`- You have no shared folders you can write to in this workspace, so use \`u/${username}/<name>\`. ${
+				canCreateFolder
+					? 'If the user explicitly asks for a shared folder, create one with `create_folder` (you become an owner); otherwise ask'
+					: 'If the user explicitly asks for a shared folder, say plainly that you cannot create one here; otherwise ask'
+			} before placing shared work rather than inventing an \`f/<folder>/...\` path.`
 		)
 	}
 	if (readOnly.length > 0) {
@@ -1317,9 +1342,19 @@ const buildGlobalSystemPrompt = (
 	previewTools: boolean,
 	folderCtx?: FolderPromptContext,
 	skills: AiSkillListItem[] = [],
-	mcpServers: McpServer[] = []
+	mcpServers: McpServer[] = [],
+	access?: SessionAccess
 ) => {
-	const folderGuidance = buildFolderGuidance(username, folderCtx)
+	// Each `can*` mirrors the capability the matching tools declare in `requires`, so a
+	// rule cannot outlive the tool it describes. An unresolved profile keeps every block.
+	const canWriteDraft = !access || access.has('write_draft')
+	const canRunPreview = !access || access.has('run_preview')
+	// The deploy tools take their kind as an argument, so `deploy` gates only the folder text.
+	const canCreateFolder = !access || access.has('deploy')
+	// Each gated block carries its own leading newline, so dropping one leaves no blank
+	// line behind and a full-access prompt is byte-for-byte the ungated text.
+	const when = (cond: boolean, block: string) => (cond ? block : '')
+	const folderGuidance = buildFolderGuidance(username, folderCtx, canCreateFolder)
 	const folderGuidanceBlock = folderGuidance ? `\n${folderGuidance}` : ''
 	// `previewTools` doubles as "this is a session chat" — sessions are the only
 	// chats that get the preview tool set. The alpha heads-up only makes sense
@@ -1332,7 +1367,7 @@ const buildGlobalSystemPrompt = (
 	// right now: the system prompt is the cached prefix, so a line appearing and
 	// disappearing between turns costs more cache than the tool call it saves.
 	const activePreviewRule = previewTools
-		? '\n- If the user message includes an ACTIVE PREVIEW section, that is the page the side panel is showing — resolve "this page", "here" and "it" against it, and against `open` (the row the page is anchored at, whose drawer the user opened) when there is one. It already tells you what get_preview_status would, so do not call that tool to learn what is on screen; call it only to check the panel\'s *other* tabs.'
+		? '\n- If the user message includes an ACTIVE PREVIEW section, that is the page the side panel is showing — resolve "this page", "here" and "it" against it, and against `open` (the item the user has open in its editor) when there is one. It already tells you what get_preview_status would, so do not call that tool to learn what is on screen; call it only to check the panel\'s *other* tabs.'
 		: ''
 	const pipelineBullet = `- A "data pipeline" is NOT a flow: it is a DAG of independent scripts in one folder, wired by storage assets (DuckLake/data tables/S3) and triggers via top-of-file \`pipeline\` / \`on <ref>\` annotation comments written in each script's comment syntax (\`--\` for SQL, \`#\` for Python/Bash, \`//\` for TS — a \`//\` line in a SQL node is a syntax error). When the user asks for a data pipeline (or to ingest/transform/materialize data across steps), call get_instructions with subject "pipeline" and build annotated script drafts — do not build a flow.${pipelineAlphaNote}`
 	// Hosting and edition come from the hostname and a store the app populates at init, so
@@ -1351,49 +1386,85 @@ const buildGlobalSystemPrompt = (
 
 The current user's workspace username is "${username}".${instanceLine}
 
-Use tools to inspect workspace items and create per-user drafts (saved server-side, visible only to this user — not deployed) for scripts, flows, schedules, triggers, resources, variables, and raw apps.
+${
+	canWriteDraft
+		? 'Use tools to inspect workspace items and create per-user drafts (saved server-side, visible only to this user — not deployed) for scripts, flows, schedules, triggers, resources, variables, and raw apps.'
+		: "Use tools to inspect workspace items and the workspace's run history, and to run items that are already deployed. You cannot create or edit scripts, flows, apps, schedules, triggers, resources or variables here — this user's role does not allow it — so when they ask for such a change, say plainly that you cannot make it rather than describing steps as if you had. Their role is refused scripts, flows and apps outside this chat too, so for those suggest asking a workspace admin rather than creating them in the editor."
+}${when(
+		canWriteDraft,
+		`
 
 Path conventions:
 - A workspace path starts with one of two namespaces; its trailing <name> may itself contain "/", so a path has three or more segments:
   - \`u/${username}/<name>\` — your personal scope. Default for ad-hoc, exploratory, or scratch work.
   - \`f/<folder>/<name>\` — a shared folder scope; the <folder> must already exist (a bare \`f/<name>\` with no folder segment is INVALID and will fail).
 - If the user supplies a fully qualified \`f/<folder>/...\` path, use that exact path; they have already chosen the folder. Do not ask for folder confirmation or substitute a \`u/${username}/...\` path unless a tool rejects it.
-- Default a bare name with no namespace prefix (e.g. "create a flow called myflow") to \`u/${username}/<name>\`. Never invent an \`f/<folder>/...\` path for a folder that does not exist; create one with \`create_folder\` only when the user explicitly asks for a new folder.${folderGuidanceBlock}
+- Default a bare name with no namespace prefix (e.g. "create a flow called myflow") to \`u/${username}/<name>\`. Never invent an \`f/<folder>/...\` path for a folder that does not exist${when(
+			canCreateFolder,
+			'; create one with `create_folder` only when the user explicitly asks for a new folder'
+		)}.${folderGuidanceBlock}`
+	)}${when(
+		canCreateFolder && !canWriteDraft,
+		'\n- You can create a shared folder with `create_folder` when the user explicitly asks for one. You cannot create anything inside it here, so do not offer to.'
+	)}
 
-Rules:
-- Draft tools create or update drafts only; they do not deploy or mutate deployed workspace items.
+Rules:${when(
+		canWriteDraft,
+		`
+- Draft tools create or update drafts only; they do not deploy or mutate deployed workspace items.`
+	)}
 - Use list_workspace_items to find items and read_workspace_item before changing an existing item. For triggers, pass trigger_kind.
-- If the user message includes an ACTIVE EDITOR section, treat it as the currently open item and use it for references like "this", "current", or "open editor".${activePreviewRule}
+- If the user message includes an ACTIVE EDITOR section, treat it as the currently open item and use it for references like "this", "current", or "open editor".${activePreviewRule}${when(
+		canWriteDraft,
+		`
 - Use deploy_workspace_item only after the user explicitly asks to deploy. It persists a draft to the workspace.
-- To undo something you created or changed in this chat, use discard_local_draft: everything you write is a draft until it is explicitly deployed, so "delete it" / "never mind" / "remove that" about your own work means discarding the draft (it also clears the matching open editor draft). Use delete_workspace_item only to remove an item that is already deployed in the workspace; it mutates the workspace and fails if nothing is deployed at that path.
-- Use diff to review changes — before deploying, or when the user asks what changed. It is read-only: without arguments it lists every draft in the workspace with its change status; with type+path it returns that item's unified diff (for multi-file apps, pass file to read one file's diff). In a fork, pass against="parent_workspace" to compare the deployed fork with its parent workspace instead. Pass search to grep changed lines across all diffs.
+- To undo something you created or changed in this chat, use discard_local_draft: everything you write is a draft until it is explicitly deployed, so "delete it" / "never mind" / "remove that" about your own work means discarding the draft (it also clears the matching open editor draft). Use delete_workspace_item only to remove an item that is already deployed in the workspace; it mutates the workspace and fails if nothing is deployed at that path.`
+	)}${when(
+		!canWriteDraft,
+		`
+- Three changes are still open to you where the server allows them: discard_local_draft drops a draft this user left behind, deploy_workspace_item deploys one when the user asks, and delete_workspace_item removes an item already deployed in the workspace. You cannot create or edit one.`
+	)}
+- Use diff to review changes — before deploying, or when the user asks what changed. It is read-only: without arguments it lists every draft in the workspace with its change status; with type+path it returns that item's unified diff (for multi-file apps, pass file to read one file's diff). In a fork, pass against="parent_workspace" to compare the deployed fork with its parent workspace instead. Pass search to grep changed lines across all diffs.${when(
+		canWriteDraft,
+		`
 - You can never read a variable's value, secret or not, so never invent one: when editing an existing variable, omit value (and is_secret) from write_variable and pass only the fields you are actually changing. The user can reveal a value in the variable editor; you cannot, so never tell them a value is unreadable in general. "$var:path/to/variable" is how a resource value references a variable — it is never a variable's own value.
 - Use search_resource_types before write_resource, and get_trigger_schema before write_trigger: the trigger config fields differ per kind and are not listed in the write_trigger definition.
 - When script or raw app code needs an external npm package you are not fully familiar with, use search_npm_packages to find it and get its documentation and type definitions. Link the package documentation in your answer when you rely on it.
 - Hub scripts are prebuilt integrations for third-party services, hosted outside the workspace under \`hub/<version>/<app>/<name>\` paths. Use search_hub_scripts to find one before hand-writing an integration, then read_workspace_item with type "script" and the returned hub path to get its code, language, and input schema.
-- Use get_db_schema with a database resource path to fetch its tables and columns before writing SQL (or a script querying that database).
-- Use get_instructions before writing scripts, flows, resources, or apps. For scripts, pass the target language.
-${pipelineBullet}
+${when(canRunPreview, '- Use get_db_schema with a database resource path to fetch its tables and columns before writing SQL (or a script querying that database).\n')}- Use get_instructions before writing scripts, flows, resources, or apps. For scripts, pass the target language.
+${pipelineBullet}`
+	)}${when(
+		canRunPreview && canWriteDraft,
+		`
 - After creating or editing a script or flow draft, run test_run_script, test_run_flow, or test_run_step with representative args before reporting that it works. These tools prefer drafts, so testing does not require deployment.
-- Do the same for a raw app: run test_run_app_runnable on each backend runnable you wrote or changed before saying the app works. A bundle that compiles proves nothing about whether the runnables run. An inline runnable executes the app's draft code; a path runnable executes the DEPLOYED script/flow it names, so a path runnable aimed at something you have not deployed fails here — that failure is the point: report it and offer to deploy that one target. The app itself does not need deploying to be tested.
+- Do the same for a raw app: run test_run_app_runnable on each backend runnable you wrote or changed before saying the app works. A bundle that compiles proves nothing about whether the runnables run. An inline runnable executes the app's draft code; a path runnable executes the DEPLOYED script/flow it names, so a path runnable aimed at something you have not deployed fails here — that failure is the point: report it and offer to deploy that one target. The app itself does not need deploying to be tested.`
+	)}
 - Use list_runs to find recent runs (optionally filtered by path, creator, label, or status), then get_run with a returned id to see what that run was called with, what it returned and what it logged — without starting a new test run.
 - get_run also covers what a flow run did per step — statuses and results across the whole execution tree, subflow steps and loop iterations included — and works while the flow is still running. Pass step to read one step's result in full (capped at 12k chars).
 - Use open_page to show a workspace page with filters applied — Runs, Schedules, Variables, Resources, Assets, Audit logs, or Workspace settings on a specific tab (e.g. "open the failed runs of f/foo/bar", "open the schedule for X", "open the git sync settings"). Carry over every filter the user described — Runs takes the page's whole filter set (time window, path, user, folder, label, tag, worker, trigger kind, args/result, ...), so don't drop a criterion just because it wasn't in the request's main clause. Only the pages listed for this user in the tool are available; don't offer pages that aren't listed. Don't use it as a substitute for list_runs when you just need the data yourself.
-- Whenever you ask the user to perform a manual step in the UI — fill in a resource's credentials, set a secret variable's value, adjust a schedule or setting — call open_page in the same message, targeted at that item (pass open with its path to land in its edit drawer, or the page's filters otherwise). Never just describe where to click.
-- When the user is happy with the changes and wants to review or deploy them, use open_page with page "compare" — it opens the Compare & Deploy review page.${
-		previewTools
-			? ' By default it preselects the items this chat modified; pass items ("<kind>:<path>" entries) to control the selection'
-			: ' Pass items ("<kind>:<path>" entries naming the items you changed) so the review is scoped to them — omitting items preselects every pending change in the workspace'
-	}, or mode ("draft" or "fork") to force which comparison is shown. Prefer offering this review page over calling deploy_workspace_item directly when several items changed.
-- For a Windmill operation no other tool covers (queue state, a run's args, ...), use search_api_endpoints to find a REST endpoint, then call_api_get for reads or call_api_endpoint for mutations (the user is asked to confirm those). Always prefer a dedicated tool when one exists; endpoints for authoring or deleting scripts, flows, apps, schedules, resources, or variables are not available through the API catalog tools — use the draft tools and delete_workspace_item instead.
-- Default to test_run_script, test_run_flow, or test_run_step for any run request, an existing script included; they prefer drafts and need no deployment. Use run_script or run_flow only when the user names the deployed version ("the deployed X", "in production", "for real") — a bare "run X" is not that. For those two, read the item with read_workspace_item version: "deployed" first so the arguments match the deployed schema. test_run_script, test_run_flow, test_run_step, run_script and run_flow all show the user an argument form prefilled with what you sent, so fill in every argument you can infer rather than asking for it in chat. test_run_step's form is the step's own inputs, not the flow's.
+- Whenever you ask the user to perform a manual step in the UI — fill in a resource's credentials, set a secret variable's value, adjust a schedule or setting — call open_page in the same message, targeted at that item (pass open with its path to land in its editor, or the page's filters otherwise). Never just describe where to click.${when(
+		canWriteDraft,
+		`
+- Do not offer or open the Compare & Deploy page for normal draft review. Only use open_page with page "compare" when the user explicitly asks to deploy a forked workspace's changes to its parent workspace.`
+	)}${when(
+		canRunPreview,
+		`
+- Default to test_run_script, test_run_flow, or test_run_step for any run request, an existing script included; they prefer drafts and need no deployment. Use run_script or run_flow only when the user names the deployed version ("the deployed X", "in production", "for real") — a bare "run X" is not that. For those two, read the item with read_workspace_item version: "deployed" first so the arguments match the deployed schema. test_run_script, test_run_flow, test_run_step, run_script and run_flow all show the user an argument form prefilled with what you sent, so fill in every argument you can infer rather than asking for it in chat. test_run_step's form is the step's own inputs, not the flow's.`
+	)}${when(
+		!canRunPreview,
+		`
+- run_script and run_flow are how you run anything here: they run the DEPLOYED item under this user's own permissions, and show them an argument form prefilled with what you sent. Read the item with read_workspace_item version: "deployed" first so the arguments match the deployed schema, and fill in every argument you can infer rather than asking for it in chat.`
+	)}
 - When a required decision is ambiguous, use askUserQuestion with two to ten clear proposed answer strings instead of guessing. The user can also type a custom answer when none of the proposed answers fit. Set multiSelect: true only when the answers can genuinely co-apply and the user may pick several (not mutually exclusive).
 - When the user asks you to remember a lasting preference, always/never do something, or change/stop a behavior going forward, call update_user_instructions to persist it. It edits only the USER INSTRUCTIONS block (not WORKSPACE INSTRUCTIONS). Keep each instruction concise; do not use it for one-off requests scoped to the current task.
 - Keep context targeted.${
 		previewTools
-			? `
+			? `${when(
+					canWriteDraft,
+					`
 - After writing or substantially editing a script / flow / app draft, show it via open_preview(kind, path) so the user sees the editor and live preview right next to the chat. First check whether it is already shown: if unsure, call get_preview_status. Only call open_preview (or offer to) when no preview is open or it is showing a different item — don't re-open a preview already showing the item you just edited.
-- Building a data pipeline: call open_preview(kind="pipeline", path="<folder>") as the FIRST step, before creating any node — this opens the pipeline editor the user reviews in. path is the folder, not an item; an empty or not-yet-created folder is fine (create_folder first if needed, then open it). Opening it registers build_pipeline_node / edit_pipeline_node — use ONLY those to add or change pipeline nodes, never write_script for a pipeline node — they apply directly as unsaved drafts on the canvas (no separate accept/reject step) that the user reviews and deploys. Do not write pipeline scripts without first opening the editor.
+- Building a data pipeline: call open_preview(kind="pipeline", path="<folder>") as the FIRST step, before creating any node — this opens the pipeline editor the user reviews in. path is the folder, not an item; an empty ${when(canCreateFolder, 'or not-yet-created ')}folder is fine${when(canCreateFolder, ' (create_folder first if needed, then open it)')}. Opening it registers build_pipeline_node / edit_pipeline_node — use ONLY those to add or change pipeline nodes, never write_script for a pipeline node — they apply directly as unsaved drafts on the canvas (no separate accept/reject step) that the user reviews and deploys. Do not write pipeline scripts without first opening the editor.`
+				)}
 - When debugging a running raw app, call get_app_runtime_logs to read the live preview's browser console output. It needs the raw app preview open (open_preview kind="raw_app").
 - To inspect what actually rendered in a running raw app (verify an edit landed on screen, diagnose a blank/empty or wrong view, answer "what's showing"), use search_dom (regex over the live HTML) and read_dom (a line-numbered window). Pass a \`selector\` to scope to an element — prefer the selector from a DOM element chip the user attached — or omit it for the whole page. When a chip lists an \`app_path\`, pass it too so the RIGHT app is read (several previews can be open; a query without \`app_path\` hits the visible one). The DOM is read live and is never in context; no match means the element isn't rendered. Both need the raw app preview open.
 - get_app_runtime_logs only shows the app's browser console. For the server-side logs of a backend runnable the app invoked (a backend.<id> call), call list_app_runs to get that run's job_id from the live preview, then get_run with it. Use this when a backend call errors or returns something unexpected.
@@ -1417,22 +1488,41 @@ Documentation:
 
 Flows:
 - read_workspace_item returns compact flow JSON. Inline script bodies appear as "inline_script.<moduleId>".
-- Use read_flow_module_code and set_flow_module_code for inline script bodies.
-- Use patch_flow_json for structural flow edits and write_flow for full flow rewrites.
+- Use read_flow_module_code${when(canWriteDraft, ' and set_flow_module_code')} for inline script bodies.${when(
+		canWriteDraft,
+		`
+- Use patch_flow_json for structural flow edits and write_flow for full flow rewrites.`
+	)}
 
 Raw apps:
-- read_workspace_item returns app metadata only. Use read_app_file for file and inline runnable contents.
+- The app tools below only work on raw (code) apps. \`rawApp\` says which: false is a drag-and-drop app: you can list it and read its metadata, but not read its contents, edit it or deploy it. Check it before offering to change an app.
+- read_workspace_item returns app metadata only. Use read_app_file for file and inline runnable contents.${when(
+		canWriteDraft,
+		`
+- A draft app is reachable by nobody; deploying is what exposes its backend runnables. deploy_workspace_item says so when the deploy widens who may open the app: anonymous means anyone with the URL, without logging in; guest means anyone the instance's identity provider authenticates, member of this workspace or not. Relay that in plain words and carry on. This is disclosure, not a gate: do not stop and ask for permission, and do not refuse the deploy. You cannot change who may open an app from chat; it is set on the app's deploy settings.
 - Use write_app_file, patch_app_file, and delete_app_file for frontend files.
 - Use write_app_runnable and delete_app_runnable for backend runnables.
 - Use init_app only after confirming framework, path, and summary with the user.
-- Use deploy_workspace_item after explicit user deploy intent; raw app deploy bundles JS/CSS before saving.
+- Use deploy_workspace_item after explicit user deploy intent; raw app deploy bundles JS/CSS before saving.`
+	)}
 
 Data Tables:
 - Datatables are workspace-scoped managed PostgreSQL databases, shared across the workspace (not owned by any single app). They must be configured by the user in their workspace settings (Workspace settings → Data Tables); they cannot be created via SQL.
-- Use list_datatables to discover the available datatables and their tables. Reuse an existing table rather than creating a duplicate. If list_datatables reports none, this is a blocking prerequisite — tell the user to set up a datatable in their workspace settings and stop; do not assume a "main" datatable exists or call exec_datatable_sql.
-- Use get_datatable_table_schema only when you need a table's column names/types; list_datatables is enough for table-list or availability summaries.
-- Use exec_datatable_sql to explore data, run queries, mutate rows, or change schema (CREATE/ALTER/DROP). Creating a table is a normal CREATE TABLE statement — it appears in list_datatables afterward, with no registration step.
-- When writing runnable code (inline app runnables, scripts, flow modules) that reads or writes datatable data at runtime, it accesses a datatable via wmill.datatable(). Default to TypeScript (bun) unless the user asked for another language. Call get_instructions with subject "datatable" and language "bun" for the TypeScript SQL SDK reference (or language "python3" for Python) — it returns only that language so you get just what you need.${
+- Use list_datatables to discover the available datatables and their tables. Reuse an existing table rather than creating a duplicate. If list_datatables reports none, this is a blocking prerequisite — tell the user to set up a datatable in their workspace settings and stop; do not assume a "main" datatable exists${when(canRunPreview, ' or call exec_datatable_sql')}.
+- Use get_datatable_table_schema only when you need a table's column names/types; list_datatables is enough for table-list or availability summaries.${when(
+		canRunPreview,
+		`
+- Use exec_datatable_sql to explore data, run queries, mutate rows, or change schema (CREATE/ALTER/DROP). Creating a table is a normal CREATE TABLE statement — it appears in list_datatables afterward, with no registration step.`
+	)}${
+		isCloudHosted()
+			? ''
+			: `
+- A raw app may use a datatable through a role (\`data.roles\` in its raw_app.yaml). When working on such an app, pass that role to the datatable tools, and to wmill.datatable in its runnables, so you see and change only what the app itself can.`
+	}${when(
+		canWriteDraft,
+		`
+- When writing runnable code (inline app runnables, scripts, flow modules) that reads or writes datatable data at runtime, it accesses a datatable via wmill.datatable(). Default to TypeScript (bun) unless the user asked for another language. Call get_instructions with subject "datatable" and language "bun" for the TypeScript SQL SDK reference (or language "python3" for Python) — it returns only that language so you get just what you need.`
+	)}${
 		skills.length > 0
 			? `
 
@@ -1526,6 +1616,8 @@ function serializeWorkspaceItemForRead(item: WorkspaceItem): unknown {
 			path: item.path,
 			summary: item.summary,
 			value: summarizeAppValue(item.value as AppDraftValue),
+			rawApp: item.rawApp,
+			executionMode: item.executionMode,
 			isDraft: item.isDraft
 		}
 	}
@@ -1752,6 +1844,9 @@ function appToItem(app: ListableApp | AppWithLastVersion, includeValue: boolean)
 		path: app.path,
 		summary: app.summary,
 		value: includeValue ? ((app as AppWithLastVersion).value as AppDraftValue) : undefined,
+		// The server omits this flag rather than sending false, so its absence in the
+		// response is a known false — not a value this listing failed to fetch.
+		rawApp: app.raw_app ?? false,
 		isDraft: false
 	}
 }
@@ -1819,13 +1914,28 @@ function getInlineRunnableContent(
 	return { content: runnable.inlineScript?.content ?? '', runnable }
 }
 
+// appSourceToDraftValue drops a low-code app's `grid`, so converting one here would stage a
+// code-app draft at its path: a false picture of the app that every later read answers from,
+// and a deploy the server then refuses.
+async function getRawAppByPath(workspace: string, path: string): Promise<AppWithLastVersion> {
+	const app = await AppService.getAppByPath({ workspace, path })
+	// Only an explicit false: the draft-only branch of get_app carries no version, and so
+	// no `raw_app`, and must not read as low-code.
+	if (app.raw_app === false) {
+		throw new Error(
+			`"${path}" is a low-code app. This chat only edits code-based apps — open it in the app editor instead.`
+		)
+	}
+	return app
+}
+
 async function loadAppValueForRead(path: string, workspace: string): Promise<AppDraftValue> {
 	const draft = await getGlobalDraft(workspace, 'app', path)
 	if (draft && draft.value && typeof draft.value === 'object' && 'files' in draft.value) {
 		return draft.value as AppDraftValue
 	}
 
-	const app = await AppService.getAppByPath({ workspace, path })
+	const app = await getRawAppByPath(workspace, path)
 	return appSourceToDraftValue(app, app)
 }
 
@@ -1835,7 +1945,7 @@ async function loadAppDraftValue(path: string, workspace: string): Promise<Loade
 		return { value: draft.value as AppDraftValue }
 	}
 
-	const app = await AppService.getAppByPath({ workspace, path })
+	const app = await getRawAppByPath(workspace, path)
 	return { value: appSourceToDraftValue(app, app) }
 }
 
@@ -1969,6 +2079,35 @@ const triggerServices: Record<TriggerKind, TriggerService> = {
 	}
 }
 
+/** Whether the server would admit a guest here: the deployment has to support guests at
+ * all, and the instance and workspace switches both have to be on. `guest` is stored on
+ * an app even when none of that holds, so the mode alone never settles who can open it.
+ * `undefined` when a switch read fails — neither proven live nor proven inert. */
+async function guestAccessIsLive(workspace: string): Promise<boolean | undefined> {
+	const [usage, settings] = await Promise.all([
+		WorkspaceService.getGuestUsage({ workspace }).catch(() => undefined),
+		WorkspaceService.getPublicSettings({ workspace }).catch(() => undefined)
+	])
+	if (usage === undefined || settings === undefined) {
+		return undefined
+	}
+	return !!(usage.available && usage.instance_enabled && settings.guest_access_enabled)
+}
+
+/** Who may open an app, from the mode stored on it. An app sits in `guest` mode whether
+ * or not anyone is admitted by it, so reporting the mode bare would say strangers can
+ * open an app that admits members only. Say it is inert rather than hide it, as the
+ * app's deploy settings do. */
+async function describeAppExposure(
+	workspace: string,
+	mode: string | undefined
+): Promise<string | undefined> {
+	if (mode !== 'guest' || (await guestAccessIsLive(workspace)) !== false) {
+		return mode
+	}
+	return 'guest, but inert: the instance or workspace admits no guest, so this app admits members only'
+}
+
 async function readWorkspaceItem(
 	type: WorkspaceItemType,
 	path: string,
@@ -2031,6 +2170,19 @@ async function readWorkspaceItem(
 		case 'app': {
 			// Returns lightweight metadata only — file/runnable contents come via read_app_file.
 			const app = await AppService.getAppByPath({ workspace, path })
+			// A grid is not files and runnables: summarizing one reports an empty app. Name the
+			// kind instead.
+			const executionMode = await describeAppExposure(workspace, app.policy?.execution_mode)
+			if (app.raw_app === false) {
+				return {
+					type: 'app',
+					path: app.path,
+					summary: app.summary,
+					rawApp: false,
+					executionMode,
+					isDraft: false
+				}
+			}
 			const value = appSourceToDraftValue(app)
 			const metadata = summarizeAppValue(value)
 			return {
@@ -2038,6 +2190,8 @@ async function readWorkspaceItem(
 				path: app.path,
 				summary: value.summary,
 				value: metadata as unknown as AppDraftValue,
+				rawApp: app.raw_app,
+				executionMode,
 				isDraft: false
 			}
 		}
@@ -2265,7 +2419,7 @@ function getDatatableInstructions(language?: ScriptLang): string {
 	const lang = language ?? 'bun'
 	return `# Datatable SQL SDK reference
 
-Datatables are workspace-scoped managed PostgreSQL databases. In chat, explore and shape them with the \`list_datatables\`, \`get_datatable_table_schema\`, and \`exec_datatable_sql\` tools. The reference below is for code you author inside runnables (inline app runnables, scripts, or flow rawscript modules) that reads or writes datatable data at runtime.
+Datatables are workspace-scoped managed PostgreSQL databases. In chat, explore and shape them with the datatable tools you were given. The reference below is for code you author inside runnables (inline app runnables, scripts, or flow rawscript modules) that reads or writes datatable data at runtime.
 
 - A runnable accesses a datatable via \`wmill.datatable()\` (the default "main") or \`wmill.datatable('<name>')\`, referencing tables as \`schema.table\`.
 - Use parameterized queries (the tagged template in TypeScript, \`$1\`/\`$2\` placeholders in Python) — never interpolate untrusted values into SQL strings.
@@ -2328,12 +2482,23 @@ export type SessionPromptContext = {
 
 /** Session-state guidance appended to the global system prompt so the model
  * knows where its work lands (staged fork vs the live workspace). */
-export function getSessionContextPromptSection(ctx: SessionPromptContext): string {
+export function getSessionContextPromptSection(
+	ctx: SessionPromptContext,
+	access?: SessionAccess
+): string {
+	// Concatenated onto an already capability-gated prompt, so it has to honour the same
+	// profile rather than assume the gating happened upstream.
+	const canDeploy = !access || access.has('deploy')
+	const canWriteDraft = !access || access.has('write_draft')
+	const canRunPreview = !access || access.has('run_preview')
+	const targets = ['reads', canWriteDraft && 'drafts', canRunPreview && 'test runs', 'deploys']
+		.filter(Boolean)
+		.join(', ')
 	const lines = [
 		'',
 		'',
 		'Session state:',
-		'- This chat is a Windmill AI session with its own operating workspace: every tool call (reads, drafts, test runs, deploys) targets that workspace.'
+		`- This chat is a Windmill AI session with its own operating workspace: every tool call (${targets}) targets that workspace.`
 	]
 	if (ctx.pendingForkOf) {
 		lines.push(
@@ -2360,6 +2525,13 @@ export function getSessionContextPromptSection(ctx: SessionPromptContext): strin
 			'- No operating workspace is set yet; the user picks one (or a new staged fork) before the first message is sent.'
 		)
 	}
+	// The kind enum already withholds what the rules refuse; this says why, and where the user
+	// promotes the rest instead. The rules gate deletes too, so it is owed to every such profile.
+	if (!canDeploy) {
+		lines.push(
+			"- This workspace refuses direct deployment for this user, except for schedules and triggers — those are the only kinds deploy_workspace_item and delete_workspace_item can still act on. Scripts, flows, apps, resources and variables must be promoted from the session's deploy panel (fork or pull request); do not offer to deploy or delete them directly."
+		)
+	}
 	return lines.join('\n')
 }
 
@@ -2406,7 +2578,8 @@ const readSkillSchema = z.object({
 		.describe('The exact skill resource path as listed in the Skills section of the system prompt.')
 })
 
-export const readSkillTool: Tool<{}> = {
+export const readSkillTool: SessionTool<{}> = {
+	requires: NONE,
 	def: createToolDef(
 		readSkillSchema,
 		'read_skill',
@@ -2633,17 +2806,6 @@ function allowsAllWorkspacesRuns(workspaceId: string | undefined = get(workspace
 	return (!!get(superadmin) || !!get(devopsRole)) && workspaceId === 'admins'
 }
 
-// The advertised `items` description must match this chat's surface: only chats that
-// track their modified items (AI sessions) can honor "omitted = this chat's edits" —
-// on an untracked chat (the global side panel) an omitted mask falls through to the
-// page's select-all default, so the model is told to pass the items explicitly there.
-const COMPARE_ITEMS_DESCRIPTIONS = {
-	tracked:
-		"Compare: preselect exactly these changed items, each as '<kind>:<path>' where kind is script, flow, raw_app, app, resource, variable, or a trigger kind like trigger_schedule / trigger_http (e.g. 'script:f/foo/bar'). Omit to preselect the items modified in this chat (everything when this chat modified nothing).",
-	untracked:
-		"Compare: preselect exactly these changed items, each as '<kind>:<path>' where kind is script, flow, raw_app, app, resource, variable, or a trigger kind like trigger_schedule / trigger_http (e.g. 'script:f/foo/bar'). If omitted, the page preselects EVERY pending change in the workspace, not just this chat's — when you changed specific items, pass them so the review is scoped to them."
-} as const
-
 // The Runs filters the page accepts several values for, all encoded in one param: the
 // value is a comma-separated list, and for the negatable ones a leading `!` excludes
 // instead (the page rejects a list mixing included and excluded values).
@@ -2658,7 +2820,7 @@ const RUNS_TIMEFRAME_LABELS = runsTimeframes.map((tf) => tf.label) as [string, .
 // input_schema requires; a top-level oneOf would be rejected. Each per-page URL builder
 // drops any key that isn't one of its page's real query params, so a field that doesn't
 // apply to the chosen page is harmless. This full schema is used to PARSE tool args; the
-// advertised schema (what the model sees) is narrowed per-user in `setSchema`.
+// advertised schema (what the model sees) is narrowed per-user in `schemaFor`.
 const openPageFullSchema = z.object({
 	page: z.enum(OPEN_PAGE_NAMES).describe('Which page to open'),
 	path: z
@@ -2784,7 +2946,7 @@ const openPageFullSchema = z.object({
 		.string()
 		.optional()
 		.describe(
-			'Schedules/Triggers/Variables/Resources: exact item path to open in the edit drawer, e.g. f/foo/my_schedule. Use it whenever the user should act on one specific item (e.g. fill in credentials) so they land directly in its editor.'
+			'Schedules/Triggers/Variables/Resources: exact item path to open in its editor, e.g. f/foo/my_schedule — in a session, a preview tab of its own instead of the list page. Use it whenever the user should act on one specific item (e.g. fill in credentials) so they land directly in its editor.'
 		),
 	summary: z
 		.string()
@@ -2809,13 +2971,13 @@ const openPageFullSchema = z.object({
 		.enum([...WORKSPACE_SETTINGS_TABS] as [string, ...string[]])
 		.optional()
 		.describe('Workspace settings: which settings tab to open'),
-	mode: z
-		.enum(['draft', 'fork'])
+	items: z
+		.array(z.string())
+		.min(1)
 		.optional()
 		.describe(
-			"Compare: which comparison to show — 'draft' (deployed items vs their pending drafts) or 'fork' (this forked workspace vs its parent). Omit to auto-pick: the view containing the preselected items (draft whenever any of them is a pending draft); with nothing preselected, fork on a forked workspace and draft otherwise."
+			"Compare: preselect exactly these fork changes, each as '<kind>:<path>' where kind is script, flow, raw_app, app, resource, variable, or a trigger kind like trigger_schedule / trigger_http (e.g. 'script:f/foo/bar'). Omit to use the page's default selection; pass items only when the user asked to deploy specific ones."
 		),
-	items: z.array(z.string()).min(1).optional().describe(COMPARE_ITEMS_DESCRIPTIONS.tracked),
 	new_tab: z
 		.boolean()
 		.optional()
@@ -2859,7 +3021,6 @@ const OPEN_PAGE_FIELD_PAGES: Record<string, OpenPageName[]> = {
 	operation: ['audit_logs'],
 	resource: ['audit_logs'],
 	tab: ['workspace_settings'],
-	mode: ['compare'],
 	items: ['compare']
 }
 
@@ -2870,7 +3031,6 @@ const OPEN_PAGE_FIELD_PAGES: Record<string, OpenPageName[]> = {
 function buildOpenPageDefSchema(
 	pages: readonly OpenPageName[],
 	triggerKinds: readonly PageTriggerKind[],
-	chatEditsTracked: boolean,
 	allWorkspacesRuns: boolean,
 	roleUnverified = false
 ): z.ZodTypeAny {
@@ -2900,25 +3060,18 @@ function buildOpenPageDefSchema(
 						.enum([...triggerKinds] as [string, ...string[]])
 						.optional()
 						.describe('Triggers: which trigger kind page to open')
-				: field === 'items'
-					? z
-							.array(z.string())
-							.min(1)
-							.optional()
-							.describe(COMPARE_ITEMS_DESCRIPTIONS[chatEditsTracked ? 'tracked' : 'untracked'])
-					: full[field]
+				: full[field]
 	}
 	shape.new_tab = full.new_tab
 	return z.object(shape)
 }
 
 const OPEN_PAGE_DESCRIPTION =
-	'Open a Windmill page with filters applied — Runs, Schedules, Variables, Resources, Assets, Audit logs, Folders, Groups, Triggers (by kind), Workspace settings (on a specific tab), or the Compare & Deploy review page. Inside an AI session it opens as a tab in the side-panel preview next to the chat; elsewhere it offers a clickable link. Use after surfacing something the user likely wants to inspect (e.g. "show me the failed runs of X", "open the schedule for Y", "open the git sync settings", "open the kafka triggers"), and ALWAYS when asking the user to perform a manual step themselves (fill in a resource\'s credentials, set a variable\'s value — pass open with the item path so its edit drawer opens directly). Use page "compare" when the user wants to review and deploy pending changes (the items field controls which changes are preselected). This is the only way to show one of these pages in the session preview — open_preview only handles editable items (scripts, flows, raw apps, pipelines). Only pages listed for this user are available; do not offer others.'
+	'Open a Windmill page with filters applied — Runs, Schedules, Variables, Resources, Assets, Audit logs, Folders, Groups, Triggers (by kind), Workspace settings (on a specific tab), or the Compare & Deploy page. Inside an AI session it opens as a tab in the side-panel preview next to the chat; elsewhere it offers a clickable link. Use after surfacing something the user likely wants to inspect (e.g. "show me the failed runs of X", "open the schedule for Y", "open the git sync settings", "open the kafka triggers"), and ALWAYS when asking the user to perform a manual step themselves (fill in a resource\'s credentials, set a variable\'s value — pass open with the item path so its editor opens directly). Never offer page "compare" for draft review. Use it only when the user explicitly asks to deploy a forked workspace into its parent; it always opens the fork-vs-parent comparison. This is the only way to show one of these pages in the session preview — open_preview only handles editable items (scripts, flows, raw apps, pipelines). Only pages listed for this user are available; do not offer others.'
 
-// Non-arg inputs the URL builder needs: the chat's operating workspace (the compare
-// page cannot fall back to its own store default inside a session preview) and the
-// live modified-items mask backing the compare page's default preselection.
-type OpenPageUrlCtx = { workspaceId: string; chatItems?: readonly string[] }
+// Non-arg input the URL builder needs: the chat's operating workspace (the compare
+// page cannot fall back to its own store default inside a session preview).
+type OpenPageUrlCtx = { workspaceId: string }
 
 // The Runs page reads its two absolute bounds as `new Date(param)` and drops whatever
 // doesn't parse, so normalize to ISO here rather than passing a stamp the page will
@@ -3071,14 +3224,11 @@ export function buildOpenPageUrl(page: OpenPageName, a: OpenPageArgs, ctx: OpenP
 		case 'workspace_settings':
 			return buildWorkspaceSettingsUrl({ tab: a.tab })
 		case 'compare':
-			// Explicit `items` wins; otherwise preselect this chat's modified items. An
-			// empty mask (chat modified nothing) passes no items so the page keeps its
-			// select-all default instead of preselecting nothing.
-			return buildCompareUrl({
-				workspace_id: ctx.workspaceId,
-				mode: a.mode,
-				items: a.items ?? (ctx.chatItems?.length ? ctx.chatItems : undefined)
-			})
+			// Always fork: an omitted mode lets the page auto-pick the draft view. No
+			// chat-modified fallback for `items` either: a session's edits are usually
+			// undeployed drafts, which the fork comparison leaves out, so masking by them
+			// would open "deploy to parent" with nothing selected.
+			return buildCompareUrl({ workspace_id: ctx.workspaceId, mode: 'fork', items: a.items })
 	}
 }
 
@@ -3105,14 +3255,14 @@ function summarizeOpenPage(url: string, page: OpenPageName): string {
 	return parts.length ? parts.join(', ') : `all ${OPEN_PAGE_LABELS[page].toLowerCase()}`
 }
 
-export const openPageTool: Tool<{}> = {
-	// The initial def assumes an untracked chat and no resolved role; setSchema below
-	// rebuilds it with the caller's real surface before each iteration.
+export const openPageTool: SessionTool<{}> = {
+	requires: NONE,
+	// The initial def assumes no resolved role; schemaFor below rebuilds it with the
+	// caller's real surface before each iteration.
 	def: createToolDef(
 		buildOpenPageDefSchema(
 			restrictedOpenPages(get(workspaceStore)),
 			allowedTriggerKinds(),
-			false,
 			allowsAllWorkspacesRuns()
 		),
 		'open_page',
@@ -3125,13 +3275,12 @@ export const openPageTool: Tool<{}> = {
 	autoCollapseDetails: false,
 	// Re-narrow the advertised `page` enum to this user's permissions each iteration, so
 	// the model never sees (or suggests) a page the user can't reach.
-	setSchema: async function (helpers) {
+	schemaFor: async (helpers) => {
 		const access = await allowedOpenPages(operatingWorkspaceFromHelpers(helpers))
-		this.def = createToolDef(
+		return createToolDef(
 			buildOpenPageDefSchema(
 				access.pages,
 				allowedTriggerKinds(),
-				(helpers as GlobalToolHelpers | undefined)?.getModifiedItems?.() !== undefined,
 				allowsAllWorkspacesRuns(operatingWorkspaceFromHelpers(helpers)),
 				access.roleUnverified
 			),
@@ -3177,10 +3326,7 @@ export const openPageTool: Tool<{}> = {
 		if (!urlWorkspace) {
 			return 'Error: no workspace is selected, so no page can be opened.'
 		}
-		const url = buildOpenPageUrl(page, parsed, {
-			workspaceId: urlWorkspace,
-			chatItems: (ctx.helpers as GlobalToolHelpers | undefined)?.getModifiedItems?.()
-		})
+		const url = buildOpenPageUrl(page, parsed, { workspaceId: urlWorkspace })
 		const pageLabel = OPEN_PAGE_LABELS[page]
 		const summary = summarizeOpenPage(url, page)
 
@@ -3210,10 +3356,11 @@ export const openPageTool: Tool<{}> = {
 	}
 }
 
-export const globalTools: Tool<{}>[] = [
+export const globalTools: SessionTool<{}>[] = [
 	readSkillTool,
 	openPageTool,
 	{
+		requires: NONE,
 		def: createToolDef(
 			getInstructionsSchema,
 			'get_instructions',
@@ -3223,6 +3370,15 @@ export const globalTools: Tool<{}>[] = [
 		fn: async (ctx) => {
 			const { args, toolId, toolCallbacks } = ctx
 			const parsed = getInstructionsSchema.parse(args)
+			// Every subject is authoring guidance written around the draft tools by name, and a
+			// tool result is the one place the toolset filter cannot reach.
+			const access = (ctx.helpers as GlobalToolHelpers | undefined)?.access
+			if (access && !access.has('write_draft')) {
+				const message =
+					'This session cannot create or edit workspace items, so there is no authoring guidance to give. Tell the user plainly rather than describing how it would be done.'
+				toolCallbacks.setToolStatus(toolId, { content: 'No authoring guidance' })
+				return message
+			}
 			const label =
 				parsed.subject === 'script' && parsed.language
 					? `${parsed.subject} (${parsed.language})`
@@ -3236,6 +3392,7 @@ export const globalTools: Tool<{}>[] = [
 	searchDocsTool,
 	readDocsPageTool,
 	{
+		requires: NONE,
 		def: createToolDef(
 			askUserQuestionSchema,
 			'askUserQuestion',
@@ -3304,6 +3461,7 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: NONE,
 		def: createToolDef(
 			updateUserInstructionsSchema,
 			'update_user_instructions',
@@ -3377,6 +3535,7 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: NONE,
 		def: createToolDef(
 			listWorkspaceItemsSchema,
 			'list_workspace_items',
@@ -3408,9 +3567,16 @@ export const globalTools: Tool<{}>[] = [
 			// (it filters before the cap; query filters after).
 			if ((parsed.page ?? 1) === 1) {
 				const draftCountByType = new Map<string, number>()
+				const prefix = parsed.path_prefix
 				for (const draft of await listGlobalDrafts(workspace)) {
 					if (!types.includes(draft.type)) continue
-					if (parsed.path_prefix && !draft.path.startsWith(parsed.path_prefix)) continue
+					// A draft's staged name is often not where it is stored: the editor parks
+					// a new script, flow or app at a generated `draft_<uuid>` path, and a
+					// rename stages the new name over the old path. The server drops
+					// draft-only rows under any narrowing filter, leaving this pass their
+					// only source, so either name has to satisfy the prefix.
+					if (prefix && !draft.path.startsWith(prefix) && !draft.draftPath?.startsWith(prefix))
+						continue
 					const count = draftCountByType.get(draft.type) ?? 0
 					if (count >= limit) continue
 					draftCountByType.set(draft.type, count + 1)
@@ -3434,6 +3600,7 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: NONE,
 		def: createToolDef(
 			readWorkspaceItemSchema,
 			'read_workspace_item',
@@ -3455,7 +3622,17 @@ export const globalTools: Tool<{}>[] = [
 				toolCallbacks.setToolStatus(toolId, {
 					content: `Read draft ${parsed.type} "${parsed.path}"`
 				})
-				return JSON.stringify(serializeWorkspaceItemForRead(draft), null, 2)
+				// The mode reported is the draft's, which is what deploying it will write. The
+				// deployed app's own mode is a different question, asked with version:
+				// "deployed", and must not be fetched here.
+				const executionMode =
+					parsed.type === 'app'
+						? await describeAppExposure(
+								workspace,
+								(draft.value as AppDraftValue)?.policy?.execution_mode
+							)
+						: undefined
+				return JSON.stringify(serializeWorkspaceItemForRead({ ...draft, executionMode }), null, 2)
 			}
 
 			toolCallbacks.setToolStatus(toolId, {
@@ -3473,6 +3650,8 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		// folders.rs `create_folder` runs `check_deploy_rules` and has no operator check.
+		requires: DEPLOY,
 		def: createToolDef(
 			createFolderSchema,
 			'create_folder',
@@ -3515,6 +3694,7 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: WRITE_DRAFT,
 		def: createToolDef(writeScriptSchema, 'write_script', 'Create or overwrite a draft script.'),
 		showDetails: true,
 		streamArguments: true,
@@ -3525,6 +3705,7 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: WRITE_DRAFT,
 		def: createToolDef(writeFlowSchema, 'write_flow', 'Create or overwrite a draft flow.'),
 		showDetails: true,
 		streamArguments: true,
@@ -3566,6 +3747,7 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: WRITE_DRAFT,
 		def: createToolDef(
 			writeScheduleToolSchema,
 			'write_schedule',
@@ -3591,6 +3773,7 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: WRITE_DRAFT,
 		def: createToolDef(
 			writeTriggerSchema,
 			'write_trigger',
@@ -3618,10 +3801,11 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: NONE,
 		def: createToolDef(
 			getTriggerSchemaSchema,
 			'get_trigger_schema',
-			'Get the configuration schema for one trigger kind. Call before write_trigger.'
+			'Get the configuration schema for one trigger kind — its config fields differ per kind.'
 		),
 		planModeSafe: true,
 		fn: async (ctx) => {
@@ -3630,15 +3814,17 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: NONE,
 		def: createToolDef(
 			z.object({}),
 			'get_schedule_schema',
-			"Get the shape of write_schedule's `advanced` object: retry, pausing, tags, and error-handler tuning."
+			"Get the shape of a schedule's `advanced` object: retry, pausing, tags, and error-handler tuning."
 		),
 		planModeSafe: true,
 		fn: async () => JSON.stringify(advancedScheduleShape(), null, 2)
 	},
 	{
+		requires: WRITE_DRAFT,
 		def: createToolDef(
 			editScriptSchema,
 			'edit_script',
@@ -3653,6 +3839,7 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: WRITE_DRAFT,
 		def: createToolDef(
 			patchFlowJsonSchema,
 			'patch_flow_json',
@@ -3667,6 +3854,7 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: RUN_PREVIEW,
 		def: testRunScriptToolDef,
 		fn: async (ctx) => {
 			const parsed = testRunScriptSchema.parse(ctx.args)
@@ -3684,6 +3872,9 @@ export const globalTools: Tool<{}>[] = [
 		autoCollapseDetails: false
 	},
 	{
+		// Ungated, unlike the test runs: this executes the DEPLOYED item under the user's own
+		// permissions, the one run an operator's token allows. `run_flow` likewise.
+		requires: NONE,
 		def: runScriptToolDef,
 		fn: async (ctx) => {
 			const parsed = runScriptSchema.parse(ctx.args)
@@ -3698,6 +3889,7 @@ export const globalTools: Tool<{}>[] = [
 		autoCollapseDetails: false
 	},
 	{
+		requires: RUN_PREVIEW,
 		def: testRunFlowToolDef,
 		fn: async (ctx) => {
 			const parsed = testRunFlowSchema.parse(ctx.args)
@@ -3712,6 +3904,7 @@ export const globalTools: Tool<{}>[] = [
 		autoCollapseDetails: false
 	},
 	{
+		requires: NONE,
 		def: runFlowToolDef,
 		fn: async (ctx) => {
 			const parsed = runFlowSchema.parse(ctx.args)
@@ -3725,6 +3918,7 @@ export const globalTools: Tool<{}>[] = [
 		autoCollapseDetails: false
 	},
 	{
+		requires: RUN_PREVIEW,
 		def: testRunStepToolDef,
 		fn: async (ctx) => {
 			const parsed = testRunStepSchema.parse(ctx.args)
@@ -3739,6 +3933,7 @@ export const globalTools: Tool<{}>[] = [
 		autoCollapseDetails: false
 	},
 	{
+		requires: NONE,
 		def: createToolDef(
 			listRunsSchema,
 			'list_runs',
@@ -3768,6 +3963,7 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: NONE,
 		def: createToolDef(
 			z.object({}),
 			'list_workers',
@@ -3811,6 +4007,7 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: NONE,
 		def: createToolDef(
 			getRunSchema,
 			'get_run',
@@ -3825,17 +4022,22 @@ export const globalTools: Tool<{}>[] = [
 					? `Fetching result of step ${parsed.step} in run ${parsed.id}...`
 					: `Inspecting run ${parsed.id}...`
 			})
-			const result = await getRun(workspace, parsed.id, parsed.step)
+			const { text, jobId } = await getRun(workspace, parsed.id, parsed.step)
 			toolCallbacks.setToolStatus(toolId, {
 				content: parsed.step
 					? `Fetched result of step ${parsed.step} in run ${parsed.id}`
 					: `Inspected run ${parsed.id}`,
-				result
+				result: text,
+				// The card reads the run itself from here; the model only ever gets `text`.
+				...(jobId
+					? { inspectedRun: { jobId, workspace, runId: parsed.id, step: parsed.step } }
+					: {})
 			})
-			return result
+			return text
 		}
 	},
 	{
+		requires: NONE,
 		def: createToolDef(
 			cancelJobSchema,
 			'cancel_job',
@@ -3863,6 +4065,21 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		// Ungated as a whole: the draft may predate a role change, and what the server accepts
+		// turns on the kind. Each kind's handler, reached through `deployDraft`'s switch:
+		requires: NONE,
+		kindRequires: {
+			// scripts.rs `create_script_internal`, flows.rs `create_flow`/`update_flow` and
+			// apps.rs `create_app_raw`/`update_app_raw` refuse operators; all run the rules.
+			script: ['deploy', 'manage_code'],
+			flow: ['deploy', 'manage_code'],
+			app: ['deploy', 'manage_code'],
+			resource: DEPLOY,
+			variable: DEPLOY,
+			// The schedule and trigger handlers check neither.
+			schedule: NONE,
+			trigger: NONE
+		} satisfies Record<(typeof ITEM_TYPES)[number], SessionToolPolicy>,
 		def: createToolDef(
 			deployWorkspaceItemSchema,
 			'deploy_workspace_item',
@@ -3879,6 +4096,8 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		// Rebasing writes a fresh draft, so drafts.rs `require_can_write_path` applies.
+		requires: WRITE_DRAFT,
 		def: createToolDef(
 			rebaseDraftSchema,
 			'rebase_draft',
@@ -3893,6 +4112,7 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: NONE,
 		def: createToolDef(
 			diffSchema,
 			'diff',
@@ -3916,6 +4136,20 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		// Ungated as a whole, like deploying. Each kind's handler, reached through
+		// `deleteWorkspaceItem`'s switch:
+		requires: NONE,
+		kindRequires: {
+			// scripts.rs `delete_script_by_path` calls `require_admin`; a non-admin archives.
+			script: ['admin'],
+			// flows.rs `delete_flow_by_path` and apps.rs `delete_app` refuse operators.
+			flow: ['deploy', 'manage_code'],
+			app: ['deploy', 'manage_code'],
+			resource: DEPLOY,
+			variable: DEPLOY,
+			schedule: NONE,
+			trigger: NONE
+		} satisfies Record<(typeof ITEM_TYPES)[number], SessionToolPolicy>,
 		def: createToolDef(
 			deleteWorkspaceItemSchema,
 			'delete_workspace_item',
@@ -3932,6 +4166,9 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		// Ungated: discarding your OWN draft skips drafts.rs `require_can_write_path`, so a
+		// user who has LOST write access can still clean up.
+		requires: NONE,
 		def: createToolDef(
 			discardLocalDraftSchema,
 			'discard_local_draft',
@@ -3947,6 +4184,7 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: WRITE_DRAFT,
 		def: createToolDef(
 			writeResourceSchema,
 			'write_resource',
@@ -3962,6 +4200,7 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: WRITE_DRAFT,
 		def: createToolDef(
 			writeVariableSchema,
 			'write_variable',
@@ -3977,6 +4216,7 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: NONE,
 		def: createToolDef(
 			searchResourceTypesSchema,
 			'search_resource_types',
@@ -4012,6 +4252,7 @@ export const globalTools: Tool<{}>[] = [
 		updateEditorCache: false
 	}),
 	{
+		requires: NONE,
 		def: createToolDef(
 			readFlowModuleCodeSchema,
 			'read_flow_module_code',
@@ -4024,6 +4265,7 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: WRITE_DRAFT,
 		def: createToolDef(
 			setFlowModuleCodeSchema,
 			'set_flow_module_code',
@@ -4038,6 +4280,7 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: WRITE_DRAFT,
 		def: createToolDef(
 			initAppSchema,
 			'init_app',
@@ -4052,6 +4295,7 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: NONE,
 		def: createToolDef(
 			readAppFileSchema,
 			'read_app_file',
@@ -4064,6 +4308,7 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: NONE,
 		def: createToolDef(
 			searchAppSchema,
 			'search_app',
@@ -4076,6 +4321,7 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: WRITE_DRAFT,
 		def: createToolDef(
 			writeAppFileSchema,
 			'write_app_file',
@@ -4090,6 +4336,7 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: WRITE_DRAFT,
 		def: createToolDef(
 			deleteAppFileSchema,
 			'delete_app_file',
@@ -4101,6 +4348,7 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: WRITE_DRAFT,
 		def: createToolDef(
 			patchAppFileSchema,
 			'patch_app_file',
@@ -4115,6 +4363,7 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: WRITE_DRAFT,
 		def: createToolDef(
 			writeAppRunnableSchema,
 			'write_app_runnable',
@@ -4130,6 +4379,7 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: WRITE_DRAFT,
 		def: createToolDef(
 			deleteAppRunnableSchema,
 			'delete_app_runnable',
@@ -4141,6 +4391,9 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		// Reaches apps.rs `execute_component` rather than jobs.rs, but that handler refuses
+		// operators too once `force_viewer_static_fields` marks the call a preview.
+		requires: RUN_PREVIEW,
 		def: testRunAppRunnableToolDef,
 		fn: async (ctx) => {
 			const parsed = testRunAppRunnableSchema.parse(ctx.args)
@@ -4155,6 +4408,7 @@ export const globalTools: Tool<{}>[] = [
 	},
 	...artifactTools,
 	{
+		requires: NONE,
 		def: createToolDef(
 			openPreviewSchema,
 			'open_preview',
@@ -4166,6 +4420,7 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: NONE,
 		def: createToolDef(
 			getPreviewStatusSchema,
 			'get_preview_status',
@@ -4175,6 +4430,7 @@ export const globalTools: Tool<{}>[] = [
 		fn: async (ctx) => getSessionPreviewStatus(sessionIdFromCtx(ctx))
 	},
 	{
+		requires: NONE,
 		def: createToolDef(
 			closePageSchema,
 			'close_page',
@@ -4186,6 +4442,7 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: NONE,
 		def: createToolDef(
 			getRuntimeLogsSchema,
 			'get_app_runtime_logs',
@@ -4206,6 +4463,7 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: NONE,
 		def: createToolDef(
 			listAppRunsSchema,
 			'list_app_runs',
@@ -4225,6 +4483,7 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: NONE,
 		def: createToolDef(
 			searchDomSchema,
 			'search_dom',
@@ -4253,6 +4512,7 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: NONE,
 		def: createToolDef(
 			readDomSchema,
 			'read_dom',
@@ -4281,6 +4541,7 @@ export const globalTools: Tool<{}>[] = [
 		}
 	},
 	{
+		requires: NONE,
 		def: createToolDef(
 			takeScreenshotSchema,
 			'take_screenshot',
@@ -4334,10 +4595,7 @@ export const globalTools: Tool<{}>[] = [
 	// Workspace DuckLake: pipeline storage prerequisite, and declared measures
 	...getDucklakeTools(),
 	// Read-only tools over files the user attached to the conversation
-	...fileTools,
-	// Search + call access to the backend API endpoint catalog, for operations
-	// no dedicated tool covers
-	...apiCatalogTools
+	...fileTools
 ]
 
 // Tools that only make sense inside an AI session (they drive the session's
@@ -4364,7 +4622,7 @@ export const SESSION_PREVIEW_TOOL_NAMES = new Set([
  * chat, or `globalTools` minus the preview tools for the regular global
  * side-panel chat.
  */
-export function globalToolsFor({ sessionPreview }: { sessionPreview: boolean }): Tool<{}>[] {
+export function globalToolsFor({ sessionPreview }: { sessionPreview: boolean }): SessionTool<{}>[] {
 	const tools = sessionPreview
 		? globalTools
 		: globalTools.filter((t) => !SESSION_PREVIEW_TOOL_NAMES.has(t.def.function.name))
@@ -4403,6 +4661,9 @@ type WriteDraftCtx = {
 export type SessionToolHelpers = { sessionId?: string }
 
 export type GlobalToolHelpers = SessionToolHelpers & {
+	/** The session's capability profile. Undefined outside a session, or before the first
+	 * send resolves it. */
+	access?: SessionAccess
 	/** Runs the flow editor mounted on `storagePath`, if one is. `memoryId` names the
 	 * chat-mode conversation the turn belongs to. */
 	testActiveFlow?: (
@@ -4423,10 +4684,6 @@ export type GlobalToolHelpers = SessionToolHelpers & {
 	// Wired only for session chats (see AIChatManager): the artifact tools are session-gated.
 	artifacts?: SessionArtifactsStore
 	getChatId?: () => string | undefined
-	// Live snapshot of the items this chat modified (`kind:path` mask keys, see
-	// modifiedItemsMask.ts); undefined when the chat doesn't track them (the global
-	// side-panel chat). Backs open_page's compare-page default preselection.
-	getModifiedItems?: () => string[] | undefined
 	openArtifact?: (artifactId: string, name: string, version?: ArtifactVersionTarget) => void
 }
 
@@ -4941,10 +5198,12 @@ function finishAppDraftWrite(
 function finishDraftWrite(
 	result: DraftPersistResult,
 	existed: boolean,
-	ctx: WriteDraftCtx
+	ctx: WriteDraftCtx,
+	codeDiff?: ToolCodeDiff
 ): string {
 	const failure = draftWriteFailure(result, ctx)
 	if (failure) return failure
+	if (codeDiff) ctx.toolCallbacks.setToolStatus(ctx.toolId, { codeDiff })
 	ctx.toolCallbacks.onItemModified?.(result.itemKind, result.storagePath)
 	maybeAttachPreviewCard(ctx, result.itemKind, result.item.path)
 	const stored = result.item
@@ -4990,7 +5249,11 @@ async function writeDraft<T, A>(
 	path: string,
 	args: A,
 	ctx: WriteDraftCtx,
-	opts: { triggerKind?: TriggerKind; override?: boolean } = {}
+	opts: {
+		triggerKind?: TriggerKind
+		override?: boolean
+		codeDiff?: ToolCodeDiff | ((base: T | undefined, draft: T) => ToolCodeDiff | undefined)
+	} = {}
 ): Promise<string> {
 	const { workspace } = ctx
 	startDraftWrite(ctx, type, path)
@@ -5009,7 +5272,8 @@ async function writeDraft<T, A>(
 		triggerKind: opts.triggerKind,
 		force: opts.override
 	})
-	return finishDraftWrite(result, existed, ctx)
+	const codeDiff = typeof opts.codeDiff === 'function' ? opts.codeDiff(base, draft) : opts.codeDiff
+	return finishDraftWrite(result, existed, ctx, codeDiff)
 }
 
 type ScriptDraftArgs = {
@@ -5062,8 +5326,21 @@ const SCRIPT_SPEC: WriteSpec<NewScript, ScriptDraftArgs> = {
 	}
 }
 
-function writeScriptDraft(args: ScriptDraftArgs, ctx: WriteDraftCtx): Promise<string> {
-	return writeDraft(SCRIPT_SPEC, 'script', args.path, args, ctx, { override: args.override })
+function writeScriptDraft(
+	args: ScriptDraftArgs,
+	ctx: WriteDraftCtx,
+	codeDiff?: ToolCodeDiff
+): Promise<string> {
+	return writeDraft(SCRIPT_SPEC, 'script', args.path, args, ctx, {
+		override: args.override,
+		codeDiff:
+			codeDiff ??
+			((base, draft) => ({
+				before: base?.content ?? '',
+				after: draft.content,
+				lang: scriptLangToEditorLang(draft.language)
+			}))
+	})
 }
 
 type FlowDraftArgs = {
@@ -5280,7 +5557,8 @@ async function editScript(
 			language: base.language,
 			content: updated
 		},
-		ctx
+		ctx,
+		{ before: base.content, after: updated, lang: scriptLangToEditorLang(base.language) }
 	)
 }
 
@@ -5520,6 +5798,68 @@ async function loadSubflowForFlowStep(
 	}
 }
 
+/**
+ * The run form for an agent step: the rows the flow editor's own step test shows, opened on the
+ * values it opens them with, built from that form's helpers so the two cannot drift.
+ */
+async function agentStepRunForm(
+	module: FlowModule,
+	workspace: string,
+	proposed: Record<string, any> | null | undefined
+): Promise<{ schema: Record<string, any>; args: Record<string, any> }> {
+	const transforms = (module.value as { input_transforms?: Record<string, any> }).input_transforms
+	// A linked step's brain belongs to the resource rather than to this flow, so only the inputs
+	// this flow supplies are its to edit.
+	const full = (await loadSchemaFromModule(module, workspace)).schema
+	const schema = (module.value as { agent?: string }).agent ? flowLocalAgentSchema(full) : full
+
+	const visible = initialVisibleAgentFields(transforms, schema.properties)
+	// What the model asked to set, shown even where the step configures nothing: this form has no
+	// control for opening a row, so a field left out of it is one the chat cannot reach at all.
+	for (const key of Object.keys(proposed ?? {})) visible.add(key)
+	const position = new Map(AGENT_FIELDS.map((field, index) => [field.key, index]))
+	const keys = Object.keys(schema.properties ?? {})
+		// A key the field registry does not know is kept, so a new one is never silently dropped.
+		.filter((key) => !position.has(key) || visible.has(key))
+		.sort((a, b) => (position.get(a) ?? Infinity) - (position.get(b) ?? Infinity))
+
+	const evaluated: Record<string, any> = {}
+	for (const key of keys) {
+		const value = evalValue(key, module, undefined, false)
+		if (value !== undefined) evaluated[key] = value
+	}
+	const args = { ...evaluated, ...(proposed ?? {}) }
+	// A mounted form fills a blank list with `[]`, and the bypass posture submits the form unmounted.
+	// For `enabled_tools` the two mean opposite things: `[]` runs no tools, an absent key runs all.
+	if (keys.includes('enabled_tools')) args.enabled_tools ??= []
+
+	const properties = Object.fromEntries(keys.map((key) => [key, schema.properties[key]]))
+	if (properties.memory) properties.memory = memoryPropertyFor(properties.memory, args.memory)
+	// Picked from the agent's tools, as in the editor: a name typed by hand that matches none
+	// silently narrows the run to fewer tools.
+	const list = properties.enabled_tools
+	if (list) {
+		const { agent, tools } = module.value as { agent?: string; tools?: AgentTool[] }
+		const roster = agent ? await resolveLinkedAgentTools(agent, workspace, true) : (tools ?? [])
+		properties.enabled_tools = {
+			...list,
+			items: { ...(list.items ?? { type: 'string' }), enum: enabledToolNames(roster) }
+		}
+	}
+
+	return {
+		schema: {
+			...schema,
+			properties,
+			order: keys,
+			required: ((schema.required as string[] | undefined) ?? []).filter((key) =>
+				keys.includes(key)
+			)
+		},
+		args
+	}
+}
+
 // Leaf of a workspace path (last segment), for human-readable confirmation
 // prompts. Falls back to the full path, then a generic noun.
 function pathLeaf(path: unknown, fallback: string): string {
@@ -5977,7 +6317,9 @@ async function testRunFlowStepByPath(
 		toolCallbacks,
 		toolId,
 		loadScript: loadScriptForFlowStep,
-		loadSubflow: loadSubflowForFlowStep
+		loadSubflow: loadSubflowForFlowStep,
+		flowPath: args.path,
+		withAgentDrafts: (value) => withAgentDrafts(value, workspace)
 	})
 
 	// The module resolution landed on, not the id that was asked for: the job's entrypoint
@@ -5986,15 +6328,20 @@ async function testRunFlowStepByPath(
 	const isPreprocessor = resolved.module.id === SPECIAL_MODULE_IDS.PREPROCESSOR
 	// The step's own inputs, never the flow's: a step is fed by its input transforms, so the
 	// flow's schema names arguments this job would ignore and omits the ones it takes.
+	const agentForm =
+		resolved.module.value.type === 'aiagent'
+			? await agentStepRunForm(resolved.module, workspace, args.args)
+			: undefined
 	const schema =
-		resolved.code != undefined && resolved.lang
+		agentForm?.schema ??
+		(resolved.code != undefined && resolved.lang
 			? await schemaForTestRun({
 					content: resolved.code,
 					language: resolved.lang,
 					schema: resolved.schema,
 					entrypoint: isPreprocessor ? 'preprocessor' : undefined
 				})
-			: (resolved.schema ?? {})
+			: (resolved.schema ?? {}))
 
 	const stepSummary = resolved.module.summary
 	return runThroughForm(
@@ -6012,7 +6359,7 @@ async function testRunFlowStepByPath(
 			// itself be a draft.
 			schemaNoun: 'step',
 			toolName: 'test_run_step',
-			proposed: args.args,
+			proposed: agentForm?.args ?? args.args,
 			startMessage: resolved.startMessage,
 			contextName: resolved.runnableKind,
 			noun: 'step',
@@ -6021,7 +6368,9 @@ async function testRunFlowStepByPath(
 			autoAcceptable: true,
 			background: args.background,
 			detachAfterMs: waitSecondsToDetachMs(args.wait_seconds),
-			startJob: resolved.startJob
+			startJob: agentForm
+				? (submitted) => resolved.startJob(submitted, agentForm.schema.order)
+				: resolved.startJob
 		},
 		ctx
 	)
@@ -7973,6 +8322,27 @@ async function deployDraft(
 						`not working until they are.`
 				}
 
+				// `policy` is the mode being written, so the exposure is stated from the value in
+				// hand. What a runnable runs as is the server's to decide, so the note names who
+				// can reach the app and never an identity.
+				if (policy.execution_mode === 'anonymous') {
+					deployNote =
+						`${deployNote ? `${deployNote} ` : ''}This app is deployed as anonymous: its ` +
+						`backend runnables are now reachable by anyone with the URL, without logging in. ` +
+						`Tell the user plainly what is now reachable and by whom.`
+				} else if (policy.execution_mode === 'guest') {
+					// Only where the guest door actually opens: below that, silence — a false note
+					// is worse than none. The standing cap is a live count no read settles, so the
+					// note says the door is open, not that every newcomer gets in.
+					if (await guestAccessIsLive(workspace)) {
+						deployNote =
+							`${deployNote ? `${deployNote} ` : ''}This app is deployed as guest: anyone ` +
+							`the instance's identity provider authenticates can now open it and run its ` +
+							`backend runnables, member of this workspace or not. Tell the user plainly ` +
+							`what is now reachable and by whom.`
+					}
+				}
+
 				toolCallbacks.setToolStatus(toolId, {
 					content: `Bundling app "${path}"...`
 				})
@@ -8310,6 +8680,9 @@ export function prepareGlobalSystemMessage(
 		user?: GlobalPromptIdentity
 		skills?: AiSkillListItem[]
 		mcpServers?: McpServer[]
+		/** Capabilities of the chat's operating workspace; undefined keeps every block. Must
+		 * match the profile the toolset was filtered with, or the prompt names withheld tools. */
+		access?: SessionAccess
 	}
 ): ChatCompletionSystemMessageParam {
 	const user = opts?.user ?? get(userStore)
@@ -8326,7 +8699,8 @@ export function prepareGlobalSystemMessage(
 		opts?.previewTools ?? false,
 		folderCtx,
 		opts?.skills ?? [],
-		opts?.mcpServers ?? []
+		opts?.mcpServers ?? [],
+		opts?.access
 	)
 	if (instructions?.workspace?.trim()) {
 		content = `${content}\n\nWORKSPACE INSTRUCTIONS (configured by a workspace admin, shared by everyone in this workspace — you cannot modify these):\n${instructions.workspace.trim()}`
diff --git a/frontend/src/lib/components/copilot/chat/global/flowRunTree.ts b/frontend/src/lib/components/copilot/chat/global/flowRunTree.ts
index 7f63de373b..af203e2c8c 100644
--- a/frontend/src/lib/components/copilot/chat/global/flowRunTree.ts
+++ b/frontend/src/lib/components/copilot/chat/global/flowRunTree.ts
@@ -400,8 +400,7 @@ function shapeRunResult(job: Job): Record<string, unknown> {
 		: { result: cap(stringify(job.result)) }
 }
 
-/** Why a run ended badly. get_run is the only route to these — the catalog
- * refuses getJob. Kept out of summarizeRun, which list_runs pays per job. */
+/** Why a run ended badly. Kept out of summarizeRun, which list_runs pays per job. */
 function diagnoseRun(job: Job): Record<string, unknown> {
 	return {
 		...(job.canceled_by ? { canceled_by: job.canceled_by } : {}),
@@ -410,22 +409,25 @@ function diagnoseRun(job: Job): Record<string, unknown> {
 	}
 }
 
+/** What get_run answers with: the model's payload, and — when the call addresses one
+ * job — that job's id, which the card renders the run from. The two are separate
+ * audiences: `text` is capped for the model, `jobId` is how the user gets the whole
+ * thing. An address resolving to several jobs (a loop's `b`), an unfinished step or an
+ * unknown one carries no id, and the call renders as an ordinary tool row. */
+export type RunInspection = { text: string; jobId?: string }
+
 /** Entry point of the get_run tool. Without `step`: the run's summary, args,
  * result and logs, plus the per-step tree when the run has steps. With `step`:
  * that step's full (capped) result, resolved server-side. */
-export async function getRun(workspace: string, id: string, step?: string): Promise<string> {
+export async function getRun(workspace: string, id: string, step?: string): Promise<RunInspection> {
 	if (!step) {
 		// Only the job read is load-bearing: logs and the step tree each answer
 		// part of the question, so neither failing should cost the model the rest.
 		const [job, logs, results] = await Promise.all([
 			JobService.getJob({ workspace, id, noLogs: true, noCode: true }),
-			// The dedicated endpoint rather than the job's own `logs` field: that one
-			// is the last 20k still in the DB column, missing the head that log
-			// compaction flushed to object storage. This one stitches them back.
-			//
-			// It takes no length parameter, so unlike args and result the whole log
-			// does come into the tab before being capped. Only this job's own logs,
-			// though: a flow's are its orchestration lines, not its steps'.
+			// The dedicated endpoint rather than the job's own `logs` field, which holds too
+			// little to serve a tail — RunScriptCard's fetch has the mechanism. Only this
+			// job's own logs either way: a flow's are its orchestration lines, not its steps'.
 			JobService.getJobLogs({
 				workspace,
 				id,
@@ -452,15 +454,18 @@ export async function getRun(workspace: string, id: string, step?: string): Prom
 				: logs.trim()
 					? cap(logs, true)
 					: 'No logs for this run.'
-		return shapeFlowRunTree(results, {
-			...summary,
-			...diagnoseRun(job),
-			// A successful read always carries the job itself as the root entry, so
-			// no entries means the read failed — and nothing else would name the run.
-			...(results.entries.length === 0 ? { job_id: id, steps_unavailable: true } : {}),
-			...payloads,
-			logs: shapedLogs
-		})
+		return {
+			text: shapeFlowRunTree(results, {
+				...summary,
+				...diagnoseRun(job),
+				// A successful read always carries the job itself as the root entry, so
+				// no entries means the read failed — and nothing else would name the run.
+				...(results.entries.length === 0 ? { job_id: id, steps_unavailable: true } : {}),
+				...payloads,
+				logs: shapedLogs
+			}),
+			jobId: id
+		}
 	}
 
 	return getStepResult(workspace, id, step)
@@ -469,7 +474,7 @@ export async function getRun(workspace: string, id: string, step?: string): Prom
 /** One step's result in full, addressed by step path. The server resolves the
  * address directly (a few indexed lookups, no tree enumeration) and returns the
  * single job as an entry. */
-async function getStepResult(workspace: string, id: string, step: string): Promise<string> {
+async function getStepResult(workspace: string, id: string, step: string): Promise<RunInspection> {
 	const response = await JobService.getFlowAllResults({
 		workspace,
 		id,
@@ -477,27 +482,38 @@ async function getStepResult(workspace: string, id: string, step: string): Promi
 		step
 	})
 	if (response.step_error) {
-		return (
-			response.step_error +
-			(response.scope_filtered
-				? ' (Steps running on tags outside your token’s scope are hidden.)'
-				: '')
-		)
+		return {
+			text:
+				response.step_error +
+				(response.scope_filtered
+					? ' (Steps running on tags outside your token’s scope are hidden.)'
+					: '')
+		}
 	}
 	const entry = response.entries[0]
 	if (!entry) {
-		return 'No jobs found for this run.'
+		return { text: 'No jobs found for this run.' }
 	}
 	if (entry.status === 'running' || entry.status === 'queued' || entry.status === 'suspended') {
-		return `Step "${step}" (job ${entry.job_id}) has not completed yet — status: ${entry.status}.`
+		return {
+			text: `Step "${step}" (job ${entry.job_id}) has not completed yet — status: ${entry.status}.`
+		}
 	}
+	// Every completed step is a job of its own, so the card renders it from source —
+	// including a skipped one, whose inputs and logs are all there is to see.
 	if (entry.result_prefix === undefined || entry.result_prefix === null) {
-		return `Step "${step}" (job ${entry.job_id}, ${entry.status}) has no recorded result.`
+		return {
+			text: `Step "${step}" (job ${entry.job_id}, ${entry.status}) has no recorded result.`,
+			jobId: entry.job_id
+		}
 	}
 	const total = entry.result_length ?? countCodePoints(entry.result_prefix)
 	const capped =
 		total > countCodePoints(entry.result_prefix)
 			? entry.result_prefix + `\n… (result truncated: ${total} chars total)`
 			: entry.result_prefix
-	return `Step "${step}" (job ${entry.job_id}, ${entry.status}) result:\n${capped}`
+	return {
+		text: `Step "${step}" (job ${entry.job_id}, ${entry.status}) result:\n${capped}`,
+		jobId: entry.job_id
+	}
 }
diff --git a/frontend/src/lib/components/copilot/chat/global/globalAssembly.test.ts b/frontend/src/lib/components/copilot/chat/global/globalAssembly.test.ts
new file mode 100644
index 0000000000..feffda425e
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/global/globalAssembly.test.ts
@@ -0,0 +1,63 @@
+import { describe, expect, it, vi } from 'vitest'
+
+vi.mock('monaco-editor', () => ({
+	editor: {},
+	languages: {},
+	KeyCode: {},
+	Uri: { parse: (value: string) => ({ toString: () => value }) },
+	MarkerSeverity: { Error: 8, Warning: 4, Info: 2, Hint: 1 }
+}))
+vi.mock('@codingame/monaco-vscode-standalone-typescript-language-features', () => ({
+	getTypeScriptWorker: async () => async () => ({}),
+	typescriptVersion: 'test'
+}))
+vi.mock('@codingame/monaco-vscode-languages-service-override', () => ({ default: () => ({}) }))
+vi.mock('$lib/components/vscode', () => ({}))
+
+import { getSessionContextPromptSection, type SessionPromptContext } from './core'
+import { getPipelinePromptSection, type PipelineContext } from '../pipeline/core'
+import { assembleGlobalSystemMessage, assembleGlobalTools } from './globalAssembly'
+
+const sessionContext: SessionPromptContext = { workspaceId: 'ws', parentWorkspaceId: 'parent' }
+const pipelineContext: PipelineContext = {
+	folder: 'myfolder',
+	mode: 'edit',
+	nodes: [],
+	assets: []
+}
+
+describe('assembleGlobalTools', () => {
+	it('includes the pipeline tools only when a pipeline editor is active', () => {
+		const names = (opts: Parameters<typeof assembleGlobalTools>[0]) =>
+			assembleGlobalTools(opts).map((t) => t.def.function.name)
+		expect(names({ pipelineContext })).toContain('get_pipeline_graph')
+		expect(names({})).not.toContain('get_pipeline_graph')
+	})
+})
+
+describe('assembleGlobalSystemMessage', () => {
+	// The hazard this module exists to remove: every caller gets every section, so a
+	// mid-session rebuild (update_user_instructions) cannot silently drop one.
+	it('carries both optional sections when both contexts are given', () => {
+		const content = assembleGlobalSystemMessage(undefined, {
+			sessionContext,
+			pipelineContext
+		}).content as string
+		expect(content).toContain(getSessionContextPromptSection(sessionContext))
+		expect(content).toContain(getPipelinePromptSection(pipelineContext))
+		// Order is part of the assembled output, so it is pinned too.
+		expect(content.indexOf(getSessionContextPromptSection(sessionContext))).toBeLessThan(
+			content.indexOf(getPipelinePromptSection(pipelineContext))
+		)
+	})
+
+	it('omits them when the contexts are absent', () => {
+		const content = assembleGlobalSystemMessage(undefined, {}).content as string
+		// Each section's own heading, read from the code rather than retyped: a reword
+		// cannot quietly make these vacuous, and a heading is the one part every variant
+		// shares, so a stray section built from any other context still trips them.
+		const heading = (s: string) => s.trim().split('\n')[0]
+		expect(content).not.toContain(heading(getSessionContextPromptSection(sessionContext)))
+		expect(content).not.toContain(heading(getPipelinePromptSection(pipelineContext)))
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/global/globalAssembly.ts b/frontend/src/lib/components/copilot/chat/global/globalAssembly.ts
new file mode 100644
index 0000000000..a291e93ec7
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/global/globalAssembly.ts
@@ -0,0 +1,49 @@
+/**
+ * The whole assembled surface of a GLOBAL-mode chat — prompt sections and tools —
+ * in one place, so a new section cannot be added to one rebuild path and forgotten
+ * on another. Plan mode's decoration is not here: it is applied per request, later.
+ */
+import type { ChatCompletionSystemMessageParam } from 'openai/resources/index.mjs'
+import type { SessionTool } from '../sessionCapabilities'
+import {
+	getSessionContextPromptSection,
+	globalToolsFor,
+	prepareGlobalSystemMessage,
+	type SessionPromptContext
+} from './core'
+import { createMcpTools } from './mcpTools'
+import { getPipelinePromptSection, pipelineTools, type PipelineContext } from '../pipeline/core'
+import { getFolderInstructionsPromptSection, type FolderInstruction } from '../folderInstructions'
+
+// Derived, not retyped: an option added to prepareGlobalSystemMessage is reachable
+// here at once. Hand-listing the four would compile fine while leaving the new one
+// unreachable from this path, and only the eval harness — which calls the builder
+// directly — would get it.
+export type GlobalAssemblyOpts = NonNullable<Parameters<typeof prepareGlobalSystemMessage>[1]> & {
+	sessionContext?: SessionPromptContext
+	pipelineContext?: PipelineContext
+	folderInstructions?: readonly FolderInstruction[]
+}
+
+export function assembleGlobalSystemMessage(
+	instructions: Parameters<typeof prepareGlobalSystemMessage>[0],
+	opts: GlobalAssemblyOpts
+): ChatCompletionSystemMessageParam {
+	const systemMessage = prepareGlobalSystemMessage(instructions, opts)
+	systemMessage.content += getFolderInstructionsPromptSection(opts.folderInstructions ?? [])
+	if (opts.sessionContext) {
+		systemMessage.content += getSessionContextPromptSection(opts.sessionContext, opts.access)
+	}
+	if (opts.pipelineContext) {
+		systemMessage.content += getPipelinePromptSection(opts.pipelineContext, opts.access)
+	}
+	return systemMessage
+}
+
+export function assembleGlobalTools(opts: GlobalAssemblyOpts): SessionTool<any>[] {
+	return [
+		...globalToolsFor({ sessionPreview: opts.previewTools ?? false }),
+		...(opts.pipelineContext ? pipelineTools : []),
+		...createMcpTools(opts.mcpServers ?? [])
+	]
+}
diff --git a/frontend/src/lib/components/copilot/chat/global/mcpTools.ts b/frontend/src/lib/components/copilot/chat/global/mcpTools.ts
index 90afa0b04b..620e5a86ea 100644
--- a/frontend/src/lib/components/copilot/chat/global/mcpTools.ts
+++ b/frontend/src/lib/components/copilot/chat/global/mcpTools.ts
@@ -1,6 +1,7 @@
 import { z } from 'zod'
 import { ResourceService, type GetMcpToolsResponse } from '$lib/gen'
-import { createToolDef, type Tool } from '../shared'
+import { createToolDef } from '../shared'
+import { NONE, type SessionTool } from '../sessionCapabilities'
 import { enabledMcpPaths } from '$lib/components/mcp/enabledServers'
 import { isOwnOrSharedMcpPath, MCP_LIST_PER_PAGE, mcpViewer } from '$lib/components/mcp/ownServers'
 
@@ -349,9 +350,10 @@ const callMcpToolSchema = z.object({
  * mode and behind the user's confirmation — building both from one body keeps
  * them from drifting.
  */
-function createCallTool(servers: McpServer[], mode: 'read' | 'write'): Tool<{}> {
+function createCallTool(servers: McpServer[], mode: 'read' | 'write'): SessionTool<{}> {
 	const isRead = mode === 'read'
 	return {
+		requires: NONE,
 		def: createToolDef(
 			callMcpToolSchema,
 			isRead ? 'call_mcp_read_tool' : 'call_mcp_write_tool',
@@ -419,12 +421,13 @@ function createCallTool(servers: McpServer[], mode: 'read' | 'write'): Tool<{}>
  * are not registered at all, so a workspace without an MCP connection pays no
  * per-iteration schema cost for them.
  */
-export function createMcpTools(servers: McpServer[]): Tool<{}>[] {
+export function createMcpTools(servers: McpServer[]): SessionTool<{}>[] {
 	if (servers.length === 0) return []
 	const serverList = servers.map((s) => s.path).join(', ')
 
 	return [
 		{
+			requires: NONE,
 			def: createToolDef(
 				searchMcpToolsSchema,
 				'search_mcp_tools',
diff --git a/frontend/src/lib/components/copilot/chat/global/sessionAccess.test.ts b/frontend/src/lib/components/copilot/chat/global/sessionAccess.test.ts
new file mode 100644
index 0000000000..82ad8162d3
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/global/sessionAccess.test.ts
@@ -0,0 +1,91 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { whoami, deployRules } = vi.hoisted(() => ({
+	whoami: vi.fn(),
+	deployRules: vi.fn()
+}))
+
+vi.mock('$lib/gen', () => ({ UserService: { whoami } }))
+vi.mock('$lib/utils_workspace_deploy', () => ({ checkDeployRules: deployRules }))
+
+import { resolveSessionAccess } from './sessionAccess'
+import { clearWorkspaceRoleCache } from '$lib/user'
+
+type WhoamiOverrides = { is_admin?: boolean; is_super_admin?: boolean; operator?: boolean }
+
+function user(overrides: WhoamiOverrides) {
+	return {
+		email: 'u@windmill.dev',
+		username: 'u',
+		is_admin: false,
+		is_super_admin: false,
+		operator: false,
+		created_at: '',
+		disabled: false,
+		groups: [],
+		folders: [],
+		folders_read: [],
+		folders_owners: [],
+		...overrides
+	}
+}
+
+async function capabilitiesFor(overrides: WhoamiOverrides, workspace = 'ws') {
+	whoami.mockResolvedValueOnce(user(overrides))
+	return await resolveSessionAccess(workspace)
+}
+
+describe('resolveSessionAccess', () => {
+	beforeEach(() => {
+		vi.clearAllMocks()
+		deployRules.mockResolvedValue({ ok: true })
+		// The role memo is app-wide, so without this each case answers from the previous one.
+		clearWorkspaceRoleCache()
+	})
+
+	it('gives a developer every capability but admin', async () => {
+		const caps = await capabilitiesFor({})
+		expect([...caps].sort()).toEqual(['deploy', 'manage_code', 'run_preview', 'write_draft'])
+	})
+
+	// The folder, resource and variable handlers run the rules but have no operator check,
+	// so withholding `deploy` from an operator would be stricter than the server.
+	it('leaves an operator the deploy-rule capability, and nothing their token refuses', async () => {
+		const caps = await capabilitiesFor({ operator: true })
+		expect([...caps]).toEqual(['deploy'])
+	})
+
+	it('takes deploy from the rules alone, so a rule blocks an operator too', async () => {
+		deployRules.mockResolvedValue({ ok: false, refusedBy: 'DisableDirectDeployment' })
+		const caps = await capabilitiesFor({ operator: true })
+		expect([...caps]).toEqual([])
+	})
+
+	// Both spellings of `authed.is_admin`, which the draft path honours and the handlers
+	// refusing `authed.is_operator` do not — the session path never clears that flag.
+	it.each([{ is_admin: true }, { is_super_admin: true }])(
+		'lets an admin who is also an operator draft and deploy, but not preview or manage code (%o)',
+		async (role) => {
+			const caps = await capabilitiesFor({ ...role, operator: true })
+			expect([...caps].sort()).toEqual(['admin', 'deploy', 'write_draft'])
+		}
+	)
+
+	it('keeps drafting when a rule refuses deploy', async () => {
+		deployRules.mockResolvedValue({
+			ok: false,
+			reason: 'restricted to deployers',
+			refusedBy: 'RestrictDeployToDeployers'
+		})
+		const caps = await capabilitiesFor({})
+		expect(caps.has('deploy')).toBe(false)
+		expect(caps.has('write_draft')).toBe(true)
+	})
+
+	it('grants everything when the role cannot be resolved', async () => {
+		whoami.mockRejectedValueOnce(new Error('network'))
+		const access = await resolveSessionAccess('ws')
+		expect(access.has('write_draft')).toBe(true)
+		expect(access.has('deploy')).toBe(true)
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/global/sessionAccess.ts b/frontend/src/lib/components/copilot/chat/global/sessionAccess.ts
new file mode 100644
index 0000000000..1ac13136a4
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/global/sessionAccess.ts
@@ -0,0 +1,68 @@
+import { getWorkspaceRole } from '$lib/user'
+import { checkDeployRules } from '$lib/utils_workspace_deploy'
+import type { SessionAccess, SessionCapability } from '../sessionCapabilities'
+
+const ALL_CAPABILITIES: SessionCapability[] = [
+	'write_draft',
+	'run_preview',
+	'deploy',
+	'manage_code',
+	'admin'
+]
+
+/** Fail open, here and at every resolution failure below: blanking a toolset on a
+ * transient error tells a developer mid-session that they cannot author anything,
+ * which is worse and far less legible than the 403 they get by trying. Matches
+ * `checkDeployPermission`, which fails open for the same reason. */
+export function fullSessionAccess(): SessionAccess {
+	return new Set(ALL_CAPABILITIES)
+}
+
+/** Pure, so the profiles this can produce are enumerable rather than listed by hand.
+ * `isAdmin` is one field because the server's `authed.is_admin` is
+ * `usr.is_admin || super_admin` (auth.rs), which `whoami` reports as two. */
+export function capabilitiesForRole(role: {
+	isAdmin: boolean
+	operator: boolean
+	deployRulesPass: boolean
+}): SessionAccess {
+	const capabilities = new Set<SessionCapability>()
+	// Per-capability precedence, NOT a role ladder: drafts.rs `require_can_write_path`
+	// returns Ok on `authed.is_admin` BEFORE its operator branch, while jobs.rs
+	// `run_preview_*` and the script/flow/app handlers refuse `authed.is_operator` with no
+	// admin escape — and on the session path that flag is never cleared for an admin.
+	if (role.isAdmin || !role.operator) {
+		capabilities.add('write_draft')
+	}
+	if (!role.operator) {
+		capabilities.add('run_preview')
+		capabilities.add('manage_code')
+	}
+	// No operator term: the rules are their own gate, and the handlers that also refuse
+	// operators say so through `manage_code`. Admins bypass the rules inside the check.
+	if (role.deployRulesPass) {
+		capabilities.add('deploy')
+	}
+	if (role.isAdmin) {
+		capabilities.add('admin')
+	}
+	return capabilities
+}
+
+export async function resolveSessionAccess(workspace: string): Promise<SessionAccess> {
+	// Shares the 5-minute memo with the identity the same pre-flight resolves beside this
+	// one, so a send costs one `whoami` rather than two, at the cost of a role changed
+	// elsewhere landing within that window rather than on the very next message.
+	// `lookup_failed` covers a rejected request AND a body too malformed to map.
+	const lookup = await getWorkspaceRole(workspace)
+	if (lookup.kind !== 'resolved') {
+		return fullSessionAccess()
+	}
+	const me = lookup.user
+
+	return capabilitiesForRole({
+		isAdmin: !!me.is_admin || !!me.is_super_admin,
+		operator: !!me.operator,
+		deployRulesPass: (await checkDeployRules(workspace, me)).ok
+	})
+}
diff --git a/frontend/src/lib/components/copilot/chat/global/sessionToolset.test.ts b/frontend/src/lib/components/copilot/chat/global/sessionToolset.test.ts
new file mode 100644
index 0000000000..42136112c4
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/global/sessionToolset.test.ts
@@ -0,0 +1,219 @@
+import { describe, expect, it, vi } from 'vitest'
+
+// The toolset pulls in the script/flow editor tools, hence monaco. Same stand-ins as
+// global/core.test.ts; nothing here executes a tool, so bare shapes are enough.
+vi.mock('monaco-editor', () => ({
+	editor: {},
+	languages: {},
+	KeyCode: {},
+	Uri: { parse: (value: string) => ({ toString: () => value }) },
+	MarkerSeverity: { Error: 8, Warning: 4, Info: 2, Hint: 1 }
+}))
+vi.mock('@codingame/monaco-vscode-standalone-typescript-language-features', () => ({
+	getTypeScriptWorker: async () => async () => ({}),
+	typescriptVersion: 'test'
+}))
+vi.mock('@codingame/monaco-vscode-languages-service-override', () => ({ default: () => ({}) }))
+vi.mock('$lib/components/vscode', () => ({}))
+
+// `globalToolsFor` withholds take_screenshot off Blink, and node reports a `Node.js/<v>`
+// user agent — so without this the description sweep below silently skips a tool that
+// ships in every real Chromium session. Claim the maximal toolset instead.
+vi.stubGlobal('navigator', { userAgent: 'Mozilla/5.0 Chrome/120.0.0.0' })
+
+import { globalTools, prepareGlobalSystemMessage, type SessionPromptContext } from './core'
+import { appendPlanModeInstructions } from '../planMode'
+import { PlanModeController } from '../planModeController.svelte'
+import { pipelineTools } from '../pipeline/core'
+import { assembleGlobalSystemMessage, assembleGlobalTools } from './globalAssembly'
+import { filterSessionTools, sessionToolAllowed } from './sessionToolset'
+import { capabilitiesForRole, fullSessionAccess } from './sessionAccess'
+import type { SessionAccess, SessionCapability, SessionTool } from '../sessionCapabilities'
+
+const ASSEMBLY_OPTS = {
+	previewTools: true,
+	pipelineContext: { folder: 'my_pipeline', mode: 'edit', nodes: [], assets: [] },
+	mcpServers: [{ path: 'f/test/server' } as any]
+}
+
+/** Every tool that can reach a session toolset: what assembly builds, so a source added
+ * there needs no edit here, unioned with the static sources so the set cannot shrink if
+ * assembly stops reaching one, plus the plan tools the manager appends. */
+function sessionReachableTools(): SessionTool<any>[] {
+	const plan = new PlanModeController({ available: true } as any).availableTools
+	const byName = new Map<string, SessionTool<any>>()
+	for (const t of [
+		...assembleGlobalTools(ASSEMBLY_OPTS),
+		...globalTools,
+		...pipelineTools,
+		...plan
+	]) {
+		byName.set(t.def.function.name, t)
+	}
+	return [...byName.values()]
+}
+
+function withheldNames(access: SessionAccess): string[] {
+	return sessionReachableTools()
+		.filter((t) => !sessionToolAllowed(t, access))
+		.map((t) => t.def.function.name)
+}
+
+/** The tools a session actually ships, through the same assembly production uses. */
+function shippedSessionTools(access: SessionAccess) {
+	return filterSessionTools(assembleGlobalTools(ASSEMBLY_OPTS), access)
+}
+
+function accessWith(capabilities: SessionCapability[]): SessionAccess {
+	return new Set(capabilities)
+}
+
+/** The profiles a real session can hold, keyed for the test name, over every combination
+ * of the role facts `capabilitiesForRole` reads. */
+const REACHABLE_PROFILES = [
+	...new Map(
+		[false, true].flatMap((isAdmin) =>
+			[false, true].flatMap((operator) =>
+				// `checkDeployRules` bypasses on admin, so an admin has only the one outcome.
+				(isAdmin ? [true] : [false, true]).map((deployRulesPass) => {
+					const access = capabilitiesForRole({ isAdmin, operator, deployRulesPass })
+					return [[...access].sort().join(',') || 'none', access] as const
+				})
+			)
+		)
+	).entries()
+]
+
+/** One per branch of getSessionContextPromptSection — each words the deploy target
+ * differently, so a gate fixed in one branch can still leak in another. */
+const SESSION_CONTEXTS: SessionPromptContext[] = [
+	{ pendingForkOf: 'parent' },
+	{ workspaceId: 'dev', parentWorkspaceId: 'parent', isDevWorkspace: true },
+	{ workspaceId: 'fork', parentWorkspaceId: 'parent' },
+	{ workspaceId: 'fork', forkParentUnknown: true },
+	{ workspaceId: 'live' },
+	{}
+]
+
+describe('session tool policies', () => {
+	// Full access must be a no-op, or every existing session (and the ai_evals
+	// baseline measured against it) changes behaviour.
+	it('withholds nothing from a session with every capability', () => {
+		const tools = sessionReachableTools()
+		const filtered = filterSessionTools(tools, fullSessionAccess())
+		expect(filtered).toHaveLength(tools.length)
+		filtered.forEach((tool, i) => expect(tool).toBe(tools[i]))
+	})
+
+	it('withholds a tool that arrives without a policy', () => {
+		expect(sessionToolAllowed({ def: globalTools[0].def }, fullSessionAccess())).toBe(false)
+	})
+
+	it('passes the toolset through untouched when access is unresolved', () => {
+		const tools = globalTools.map((t) => ({ def: t.def }))
+		expect(filterSessionTools(tools, undefined)).toBe(tools)
+	})
+
+	// The kind is an argument, so its enum carries the permission, per the handler each kind
+	// reaches. Asserted on the shipped schema, since that is all the model sees.
+	it('offers the kind-taking tools only the kinds their handlers accept', () => {
+		const shipped = (name: string, access: SessionAccess) =>
+			shippedSessionTools(access).find((t) => t.def.function.name === name)!
+		const kindsOf = (name: string, access: SessionAccess) =>
+			(shipped(name, access).def.function.parameters as any).properties.type.enum
+
+		// A developer a protection rule refuses keeps the two kinds no rule reaches.
+		const refused = accessWith(['write_draft', 'run_preview', 'manage_code'])
+		expect(kindsOf('deploy_workspace_item', refused)).toEqual(['schedule', 'trigger'])
+		expect(kindsOf('delete_workspace_item', refused)).toEqual(['schedule', 'trigger'])
+
+		// An operator where no rule applies: only the code handlers refuse them.
+		const operator = accessWith(['deploy'])
+		expect(kindsOf('deploy_workspace_item', operator)).toEqual([
+			'schedule',
+			'trigger',
+			'resource',
+			'variable'
+		])
+
+		// Deleting a script is admin-only, where deploying one is not.
+		const developer = accessWith(['write_draft', 'run_preview', 'manage_code', 'deploy'])
+		expect(kindsOf('deploy_workspace_item', developer)).toContain('script')
+		expect(kindsOf('delete_workspace_item', developer)).not.toContain('script')
+
+		// Full access narrows nothing and ships the shared object itself, so the tool defs —
+		// part of every iteration's cached prefix — are byte for byte what they were.
+		const original = globalTools.find((t) => t.def.function.name === 'deploy_workspace_item')!
+		expect(shipped('deploy_workspace_item', fullSessionAccess())).toBe(original)
+		// And narrowing never writes through to it: the def is shared by every session, so a
+		// mutation here would strip one user's kinds from everyone else's schema.
+		expect((original.def.function.parameters as any).properties.type.enum).toContain('script')
+	})
+
+	// Naming a tool the model was not given produces invented calls. Asserted over the
+	// ASSEMBLED message: the session-state, pipeline and plan-mode sections are each
+	// appended by a different caller, and each can name a withheld tool.
+	it.each(REACHABLE_PROFILES)(
+		'never names a withheld tool in the assembled prompt (%s)',
+		(_label, access) => {
+			const withheld = withheldNames(access)
+			// The tool DEFINITIONS ship alongside the prompt, so a withheld name in a
+			// description is the same broken promise as one in the prompt.
+			const defs = JSON.stringify(shippedSessionTools(access).map((t) => t.def))
+			expect(withheld.filter((n) => defs.includes(n))).toEqual([])
+			for (const previewTools of [false, true]) {
+				for (const ctx of SESSION_CONTEXTS) {
+					const msg = assembleGlobalSystemMessage(undefined, {
+						previewTools,
+						user: { username: 'alex', folders: ['shared'], folders_read: ['shared'] },
+						access,
+						sessionContext: ctx,
+						pipelineContext: { folder: 'my_pipeline', mode: 'edit', nodes: [], assets: [] }
+					})
+					// Both decoration variants: the escalation one adds its own tool mentions.
+					for (const blocks of [0, 9]) {
+						const full = appendPlanModeInstructions(msg, blocks).content as string
+						expect(withheld.filter((n) => full.includes(n))).toEqual([])
+					}
+				}
+			}
+		}
+	)
+
+	// A tool result is the one place the sweep above cannot see, and `get_instructions`
+	// ships to every profile with guidance written around the draft tools by name.
+	it('does not hand authoring guidance naming withheld tools to a session that cannot draft', async () => {
+		const tool = globalTools.find((t) => t.def.function.name === 'get_instructions')!
+		const call = (access: SessionAccess) =>
+			tool.fn({
+				args: { subject: 'script', language: 'bun' },
+				workspace: 'ws',
+				helpers: { access },
+				toolId: 't1',
+				toolCallbacks: { setToolStatus: () => {} }
+			} as any) as Promise<string>
+
+		const readOnly = accessWith([])
+		const withheld = withheldNames(readOnly)
+		const restricted = await call(readOnly)
+		expect(withheld.filter((n) => restricted.includes(n))).toEqual([])
+		// The gate is the whole test, so pin that it is not simply refusing everyone.
+		expect(await call(fullSessionAccess())).toContain('write_script')
+	})
+
+	// A full-access profile must gate nothing at all: the text has to match the ungated
+	// build byte for byte, or every session's cached prefix and the ai_evals baseline
+	// move underneath us.
+	it('builds an unchanged prompt when every capability is present', () => {
+		const user = { username: 'alex', folders: ['shared'], folders_read: ['shared'] }
+		for (const previewTools of [false, true]) {
+			const ungated = prepareGlobalSystemMessage(undefined, { previewTools, user }).content
+			const full = prepareGlobalSystemMessage(undefined, {
+				previewTools,
+				user,
+				access: fullSessionAccess()
+			}).content
+			expect(full).toBe(ungated)
+		}
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/global/sessionToolset.ts b/frontend/src/lib/components/copilot/chat/global/sessionToolset.ts
new file mode 100644
index 0000000000..4789967a6d
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/global/sessionToolset.ts
@@ -0,0 +1,46 @@
+import type { ChatCompletionFunctionTool } from 'openai/resources/index.mjs'
+import type { SessionAccess, SessionToolPolicy } from '../sessionCapabilities'
+
+type FilterableTool = {
+	def: ChatCompletionFunctionTool
+	requires?: SessionToolPolicy
+	kindRequires?: Readonly<Partial<Record<string, SessionToolPolicy>>>
+}
+
+const satisfies = (policy: SessionToolPolicy, access: SessionAccess) =>
+	policy.every((c) => access.has(c))
+
+/** Fails closed: every array that feeds a session is typed to declare `requires`, so a tool
+ * without one arrived some other way, and leaking it is the worse of the two answers. */
+export function sessionToolAllowed(tool: FilterableTool, access: SessionAccess): boolean {
+	return tool.requires ? satisfies(tool.requires, access) : false
+}
+
+/** Filter an assembled toolset, and cut each kind-taking tool's `type` enum to the kinds
+ * `access` can land. `access` undefined means "not resolved yet, or not a session" — the
+ * toolset passes through untouched. */
+export function filterSessionTools<T extends FilterableTool>(
+	tools: T[],
+	access: SessionAccess | undefined
+): T[] {
+	if (!access) return tools
+	return tools.filter((t) => sessionToolAllowed(t, access)).map((t) => narrowKinds(t, access))
+}
+
+/** Returns the tool itself when every kind is allowed, so full access ships the same bytes:
+ * tool defs are part of every iteration's cached prefix. Builds new objects otherwise — the
+ * defs are module singletons shared by every session. */
+function narrowKinds<T extends FilterableTool>(tool: T, access: SessionAccess): T {
+	const kindRequires = tool.kindRequires
+	if (!kindRequires) return tool
+	const parameters = tool.def.function.parameters as {
+		properties: Record<string, { enum?: string[] }>
+	}
+	const kinds = parameters.properties.type.enum ?? []
+	// A kind with no entry is withheld, as a tool with no `requires` is.
+	const allowed = kinds.filter((k) => kindRequires[k] && satisfies(kindRequires[k], access))
+	if (allowed.length === kinds.length) return tool
+	const def = structuredClone(tool.def)
+	;(def.function.parameters as typeof parameters).properties.type.enum = allowed
+	return { ...tool, def }
+}
diff --git a/frontend/src/lib/components/copilot/chat/global/userDraftAdapter.ts b/frontend/src/lib/components/copilot/chat/global/userDraftAdapter.ts
index 7593546114..c53aa1b7d1 100644
--- a/frontend/src/lib/components/copilot/chat/global/userDraftAdapter.ts
+++ b/frontend/src/lib/components/copilot/chat/global/userDraftAdapter.ts
@@ -176,6 +176,9 @@ function appDraftToWorkspaceItem(path: string, draft: AppDraftValue): WorkspaceI
 		summary: value.summary,
 		parentVersionId: value.parent_version,
 		value,
+		// The chat only ever addresses the `raw_app` draft kind (see itemKindFor),
+		// so every app draft it can see is a code app.
+		rawApp: true,
 		isDraft: true
 	}
 }
@@ -541,6 +544,7 @@ function backendDraftRowToWorkspaceItem(
 		value: undefined,
 		isDraft: true,
 		triggerKind,
+		rawApp: row.kind === 'raw_app' ? true : undefined,
 		...(isLiveDraft ? { isLiveDraft: true } : {})
 	}
 }
diff --git a/frontend/src/lib/components/copilot/chat/global/workspaceItems.ts b/frontend/src/lib/components/copilot/chat/global/workspaceItems.ts
index a67eb48ac3..3d922a3b72 100644
--- a/frontend/src/lib/components/copilot/chat/global/workspaceItems.ts
+++ b/frontend/src/lib/components/copilot/chat/global/workspaceItems.ts
@@ -139,6 +139,18 @@ export type WorkspaceItem = {
 	 * without it a reader cannot tell a secret from a plain variable, since the
 	 * value is always redacted. */
 	isSecret?: boolean
+	/** Apps only. True for a code app, false for one built in the drag-and-drop
+	 * editor. The two are edited by disjoint tool sets, so the distinction has to
+	 * reach the model before it picks one. */
+	rawApp?: boolean
+	/** Apps only. Who may open the app — read from a draft, who may open it once
+	 * that draft is deployed: `anonymous` is anyone with the URL and no login,
+	 * `guest` anyone the identity provider authenticates, the rest a workspace
+	 * member. A `guest` app whose instance or workspace admits
+	 * no guest says so here, since the mode is stored either way. Reported per
+	 * app, not in listings — a listing carrying it would make absence read as
+	 * proof of no exposure. */
+	executionMode?: string
 	isDraft: boolean
 	isLiveDraft?: boolean
 }
diff --git a/frontend/src/lib/components/copilot/chat/mention.test.ts b/frontend/src/lib/components/copilot/chat/mention.test.ts
index 8d379ce3b4..ae021bf1de 100644
--- a/frontend/src/lib/components/copilot/chat/mention.test.ts
+++ b/frontend/src/lib/components/copilot/chat/mention.test.ts
@@ -1,5 +1,12 @@
 import { describe, expect, it } from 'vitest'
-import { MENTION_RE, mentionTitle, formatMention } from './mention'
+import {
+	MENTION_RE,
+	mentionTitle,
+	formatMention,
+	hasMention,
+	mentionTitlesInText,
+	removeMentionFromText
+} from './mention'
 
 describe('formatMention', () => {
 	it('leaves a simple name bare', () => {
@@ -52,3 +59,83 @@ describe('MENTION_RE', () => {
 		expect(mentionTitle(m[0])).toBe(name)
 	})
 })
+
+describe('removeMentionFromText', () => {
+	it('removes a bare mention and keeps neighboring words separated', () => {
+		expect(removeMentionFromText('before @app.ts after', 'app.ts')).toBe('before after')
+	})
+
+	it('removes a bracketed mention', () => {
+		expect(removeMentionFromText('before @[my folder/a b.ts] after', 'my folder/a b.ts')).toBe(
+			'before after'
+		)
+	})
+
+	it('removes an escaped bracketed mention', () => {
+		expect(removeMentionFromText('before @[notes \\] draft.md] after', 'notes ] draft.md')).toBe(
+			'before after'
+		)
+	})
+
+	it('removes edge mentions without leaving extra whitespace', () => {
+		expect(removeMentionFromText('@app.ts after', 'app.ts')).toBe('after')
+		expect(removeMentionFromText('before @app.ts', 'app.ts')).toBe('before')
+	})
+
+	it('keeps embedded mention-like text intact', () => {
+		expect(removeMentionFromText('Contact owner@app.ts about @app.ts', 'app.ts')).toBe(
+			'Contact owner@app.ts about'
+		)
+	})
+
+	it('keeps Unicode-prefixed embedded mention-like text intact', () => {
+		expect(removeMentionFromText('Contact 用户@app.ts about @app.ts', 'app.ts')).toBe(
+			'Contact 用户@app.ts about'
+		)
+		expect(removeMentionFromText('Contact हिंदी@app.ts about @app.ts', 'app.ts')).toBe(
+			'Contact हिंदी@app.ts about'
+		)
+		expect(removeMentionFromText('Contact 𐐀@app.ts about @app.ts', 'app.ts')).toBe(
+			'Contact 𐐀@app.ts about'
+		)
+	})
+})
+
+describe('hasMention', () => {
+	it('does not treat embedded mention-like text as a selected context mention', () => {
+		expect(hasMention('Contact owner@app.ts', 'app.ts')).toBe(false)
+		expect(hasMention('Contact owner@app.ts about @app.ts', 'app.ts')).toBe(true)
+	})
+
+	it('does not treat Unicode-prefixed embedded text as a mention', () => {
+		expect(hasMention('Contact 用户@app.ts', 'app.ts')).toBe(false)
+		expect(hasMention('Contact हिंदी@app.ts', 'app.ts')).toBe(false)
+		expect(hasMention('Contact 𐐀@app.ts', 'app.ts')).toBe(false)
+	})
+
+	it('treats punctuation next to a mention as a boundary', () => {
+		expect(hasMention('use @app.ts, then compare', 'app.ts')).toBe(true)
+		expect(hasMention('open (@app.ts)', 'app.ts')).toBe(true)
+	})
+})
+
+describe('mentionTitlesInText', () => {
+	it('extracts only standalone mentions for context synchronization', () => {
+		expect([...mentionTitlesInText('Contact owner@app.ts about @app.ts')]).toEqual(['app.ts'])
+		expect([...mentionTitlesInText('Contact owner@app.ts')]).toEqual([])
+	})
+
+	it('ignores Unicode-prefixed embedded text for context synchronization', () => {
+		expect([...mentionTitlesInText('Contact 用户@app.ts')]).toEqual([])
+	})
+
+	it('keeps punctuation-adjacent mentions synchronized', () => {
+		expect([...mentionTitlesInText('use @app.ts, then compare')]).toEqual(['app.ts'])
+		expect([...mentionTitlesInText('open (@app.ts)')]).toEqual(['app.ts'])
+	})
+
+	it('ignores combining-mark and astral-letter embedded text', () => {
+		expect([...mentionTitlesInText('Contact हिंदी@app.ts')]).toEqual([])
+		expect([...mentionTitlesInText('Contact 𐐀@app.ts')]).toEqual([])
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/mention.ts b/frontend/src/lib/components/copilot/chat/mention.ts
index 65a2b3b7c6..d1d42696b0 100644
--- a/frontend/src/lib/components/copilot/chat/mention.ts
+++ b/frontend/src/lib/components/copilot/chat/mention.ts
@@ -29,3 +29,59 @@ const BARE_SAFE = /^[\w/.\-]+$/
 export function formatMention(name: string): string {
 	return BARE_SAFE.test(name) ? `@${name}` : `@[${name.replace(/[\\\]]/g, '\\$&')}]`
 }
+
+function isWordChar(char: string | undefined): boolean {
+	return char !== undefined && /[\p{L}\p{N}\p{M}_]/u.test(char)
+}
+
+function codePointBefore(text: string, index: number): string | undefined {
+	if (index <= 0) return undefined
+	const prev = text.charCodeAt(index - 1)
+	if (prev >= 0xdc00 && prev <= 0xdfff && index > 1) return text.slice(index - 2, index)
+	return text[index - 1]
+}
+
+// A mention is owned by this parser when the `@` starts a token. The trailing side is
+// intentionally open: non-spacing scripts often continue immediately after a mention,
+// while embedded forms like `owner@app.ts` are rejected by the leading boundary.
+export function hasMentionLeadingBoundary(text: string, index: number): boolean {
+	return !isWordChar(codePointBefore(text, index))
+}
+
+export function isStandaloneMention(text: string, match: RegExpMatchArray): boolean {
+	if (match.index === undefined) return false
+	return hasMentionLeadingBoundary(text, match.index)
+}
+
+export function hasMention(text: string, title: string): boolean {
+	return [...text.matchAll(MENTION_RE)].some(
+		(m) => mentionTitle(m[0]) === title && isStandaloneMention(text, m)
+	)
+}
+
+export function mentionTitlesInText(text: string): Set<string> {
+	const out = new Set<string>()
+	for (const m of text.matchAll(MENTION_RE)) {
+		if (isStandaloneMention(text, m)) out.add(mentionTitle(m[0]))
+	}
+	return out
+}
+
+export function removeMentionFromText(text: string, title: string): string {
+	let out = ''
+	let last = 0
+	for (const m of text.matchAll(MENTION_RE)) {
+		if (m.index === undefined || mentionTitle(m[0]) !== title) continue
+		let start = m.index
+		let end = m.index + m[0].length
+		if (!isStandaloneMention(text, m)) continue
+		const hasLead = start > 0 && /\s/.test(text[start - 1])
+		const hasTrail = end < text.length && /\s/.test(text[end])
+		if (hasLead && !hasTrail) start -= 1
+		if (!hasLead && hasTrail) end += 1
+		if (hasLead && hasTrail) end += 1
+		out += text.slice(last, start)
+		last = end
+	}
+	return out + text.slice(last)
+}
diff --git a/frontend/src/lib/components/copilot/chat/openai-responses.test.ts b/frontend/src/lib/components/copilot/chat/openai-responses.test.ts
index 276084a171..951f8f0c77 100644
--- a/frontend/src/lib/components/copilot/chat/openai-responses.test.ts
+++ b/frontend/src/lib/components/copilot/chat/openai-responses.test.ts
@@ -3,8 +3,10 @@ import {
 	buildPromptCacheKey,
 	getOpenAIResponsesCompletion,
 	openAIWebSearchDetails,
+	parseOpenAIResponsesCompletion,
 	toResponsesContent
 } from './openai-responses'
+import { OutputTokenLimitError } from './outputTokenLimit'
 
 const mocks = vi.hoisted(() => ({
 	getProviderAndCompletionConfig: vi.fn(),
@@ -153,3 +155,34 @@ describe('openAIWebSearchDetails', () => {
 		).toEqual({ query: undefined, sources: [{ url: 'https://a.dev' }] })
 	})
 })
+
+describe('parseOpenAIResponsesCompletion output token limit', () => {
+	it('fails a response the stream reports incomplete at max_output_tokens', async () => {
+		const handlers: Record<string, (event: any) => void> = {}
+		// The SDK's final snapshot of an incomplete response still reads in_progress;
+		// only the response.incomplete event carries the reason.
+		const runner = {
+			on: (name: string, fn: (event: any) => void) => {
+				handlers[name] = fn
+			},
+			done: async () => {
+				handlers['response.incomplete']?.({
+					type: 'response.incomplete',
+					response: { incomplete_details: { reason: 'max_output_tokens' } }
+				})
+			},
+			finalResponse: async () => ({ status: 'in_progress', output: [] })
+		}
+
+		const parsed = parseOpenAIResponsesCompletion(
+			runner as any,
+			{ onNewToken: vi.fn(), onMessageEnd: vi.fn(), setToolStatus: vi.fn() } as any,
+			[],
+			[],
+			[],
+			{}
+		)
+
+		await expect(parsed).rejects.toBeInstanceOf(OutputTokenLimitError)
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/openai-responses.ts b/frontend/src/lib/components/copilot/chat/openai-responses.ts
index 4118eb492d..31d3b379ac 100644
--- a/frontend/src/lib/components/copilot/chat/openai-responses.ts
+++ b/frontend/src/lib/components/copilot/chat/openai-responses.ts
@@ -21,6 +21,7 @@ import {
 	type ToolCallbacks,
 	type WebSearchSource
 } from './shared'
+import { OutputTokenLimitError } from './outputTokenLimit'
 import type { ResponseStream } from 'openai/lib/responses/ResponseStream.mjs'
 import type { AIProviderModel } from '$lib/gen'
 import { openAIResponsesUsageToChatTokenUsage, type ChatTokenUsage } from './tokenUsage'
@@ -271,7 +272,8 @@ export async function getOpenAIResponsesCompletion(
 		messages,
 		stream: true,
 		tools,
-		forceModelProvider: options?.forceModelProvider
+		forceModelProvider: options?.forceModelProvider,
+		reasoningEffort: options?.reasoningEffort
 	})
 	const { instructions, input } = convertMessagesToResponsesInput(messages)
 	const responsesConfig = applyReasoningToConfig(
@@ -330,7 +332,8 @@ export async function* getOpenAIResponsesCompletionStream(
 		messages,
 		stream: true,
 		tools,
-		forceModelProvider: options?.forceModelProvider
+		forceModelProvider: options?.forceModelProvider,
+		reasoningEffort: options?.reasoningEffort
 	})
 	const { instructions, input } = convertMessagesToResponsesInput(messages)
 	// No prompt cache key here: a rejected key has to be retried without it, and this is
@@ -542,6 +545,13 @@ export async function parseOpenAIResponsesCompletion(
 		})
 	})
 
+	// The stream's final snapshot keeps the in-progress status, so an
+	// incomplete response is only visible through its own event.
+	let hitOutputTokenLimit = false
+	runner.on('response.incomplete', (event) => {
+		hitOutputTokenLimit = event.response.incomplete_details?.reason === 'max_output_tokens'
+	})
+
 	// Handle errors
 	runner.on('error', (err: OpenAIError | ResponseErrorEvent) => {
 		currentStreamingTool = undefined
@@ -591,7 +601,8 @@ export async function parseOpenAIResponsesCompletion(
 				toolCall,
 				helpers,
 				toolCallbacks: callbacks,
-				workspace: options?.workspace
+				workspace: options?.workspace,
+				messages
 			})
 			messages.push(messageToAdd)
 			addedMessages.push(messageToAdd)
@@ -600,6 +611,9 @@ export async function parseOpenAIResponsesCompletion(
 		return { shouldContinue: true, tokenUsage }
 	}
 
+	if (hitOutputTokenLimit) {
+		throw new OutputTokenLimitError()
+	}
 	return { shouldContinue: false, tokenUsage }
 }
 
diff --git a/frontend/src/lib/components/copilot/chat/outputTokenLimit.ts b/frontend/src/lib/components/copilot/chat/outputTokenLimit.ts
new file mode 100644
index 0000000000..19b74f0c68
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/outputTokenLimit.ts
@@ -0,0 +1,17 @@
+/** The provider ended the response at the request's output token cap. A turn
+ * cut off there must fail rather than end quietly: thinking counts toward the
+ * cap, so the stop often lands mid-thought and would read as the model giving
+ * up. Failing also keeps the turn's output so far for a follow-up. */
+export class OutputTokenLimitError extends Error {
+	constructor() {
+		super(
+			"The response was cut off at the model's output token limit. Ask it to continue, or raise the limit in the workspace AI settings under Model output limits."
+		)
+		this.name = 'OutputTokenLimitError'
+	}
+}
+
+/** Shown instead on Windmill's free tier, whose server clamps the output below any
+ * workspace setting: pointing at that setting would send the user to a no-op. */
+export const FREE_TIER_OUTPUT_TOKEN_LIMIT_MESSAGE =
+	"The response was cut off at the free tier's output token limit. Ask it to continue, or add your own API key in the workspace AI settings for a higher limit."
diff --git a/frontend/src/lib/components/copilot/chat/pipeline/core.ts b/frontend/src/lib/components/copilot/chat/pipeline/core.ts
index f696b1c869..a1a8f1ad6b 100644
--- a/frontend/src/lib/components/copilot/chat/pipeline/core.ts
+++ b/frontend/src/lib/components/copilot/chat/pipeline/core.ts
@@ -1,7 +1,14 @@
 import { z } from 'zod'
 import { $ScriptLang } from '$lib/gen/schemas.gen'
 import type { ScriptLang } from '$lib/gen'
-import { createToolDef, executeTestRun, findAndReplace, type Tool } from '../shared'
+import { createToolDef, executeTestRun, findAndReplace } from '../shared'
+import {
+	NONE,
+	RUN_PREVIEW,
+	WRITE_DRAFT,
+	type SessionAccess,
+	type SessionTool
+} from '../sessionCapabilities'
 import type { PipelineOutputKind } from '$lib/components/assets/AssetGraph/pipelineTemplates'
 
 // ============================================================================
@@ -113,7 +120,7 @@ const readPipelineNodeSchema = z.object({
 const readPipelineNodeToolDef = createToolDef(
 	readPipelineNodeSchema,
 	'read_pipeline_node',
-	'Read the full source of one pipeline node (its in-flight draft body if it has unsaved edits, otherwise the deployed body). Use before edit_pipeline_node so edits target the exact current text.'
+	'Read the full source of one pipeline node (its in-flight draft body if it has unsaved edits, otherwise the deployed body). Use before editing a node so edits target the exact current text.'
 )
 
 // ----------------------------------------------------------------------------
@@ -205,8 +212,9 @@ function inferredLineageNote(reads: string[], writes: string[]): string {
 	return ` Inferred lineage: ${parts.join('; ')}.`
 }
 
-export const pipelineTools: Tool<PipelineToolHelpers>[] = [
+export const pipelineTools: SessionTool<PipelineToolHelpers>[] = [
 	{
+		requires: NONE,
 		def: getPipelineGraphToolDef,
 		planModeSafe: true,
 		fn: async ({ helpers, toolId, toolCallbacks }) => {
@@ -221,6 +229,7 @@ export const pipelineTools: Tool<PipelineToolHelpers>[] = [
 		}
 	},
 	{
+		requires: NONE,
 		def: readPipelineNodeToolDef,
 		planModeSafe: true,
 		fn: async ({ args, helpers, toolId, toolCallbacks }) => {
@@ -236,6 +245,7 @@ export const pipelineTools: Tool<PipelineToolHelpers>[] = [
 		}
 	},
 	{
+		requires: WRITE_DRAFT,
 		def: buildPipelineNodeToolDef,
 		streamArguments: true,
 		showDetails: true,
@@ -258,6 +268,7 @@ export const pipelineTools: Tool<PipelineToolHelpers>[] = [
 		}
 	},
 	{
+		requires: WRITE_DRAFT,
 		def: editPipelineNodeToolDef,
 		streamArguments: true,
 		showDetails: true,
@@ -286,6 +297,7 @@ export const pipelineTools: Tool<PipelineToolHelpers>[] = [
 		}
 	},
 	{
+		requires: WRITE_DRAFT,
 		def: removePipelineNodeToolDef,
 		fn: async ({ args, helpers, toolId, toolCallbacks }) => {
 			const pipeline = requirePipeline(helpers)
@@ -300,6 +312,7 @@ export const pipelineTools: Tool<PipelineToolHelpers>[] = [
 		}
 	},
 	{
+		requires: RUN_PREVIEW,
 		def: testPipelineNodeToolDef,
 		requiresConfirmation: true,
 		confirmationMessage: 'Run pipeline node',
@@ -331,8 +344,14 @@ export const pipelineTools: Tool<PipelineToolHelpers>[] = [
  * /pipeline editor is open. Describes the annotation model and the direct-draft
  * workflow so the model uses the pipeline tools rather than the generic
  * write_script draft tools.
+ *
+ * `access` is the session's resolved capabilities (undefined outside a session, or
+ * before they resolve). The node-authoring guidance is dropped without `write_draft`,
+ * since the tools it names are withheld from that session; the annotation model stays,
+ * as it is what lets the model read and explain an existing pipeline.
  */
-export function getPipelinePromptSection(ctx: PipelineContext): string {
+export function getPipelinePromptSection(ctx: PipelineContext, access?: SessionAccess): string {
+	const canWriteDraft = !access || access.has('write_draft')
 	return `
 
 Data Pipeline editor (ACTIVE):
@@ -342,8 +361,12 @@ Data Pipeline editor (ACTIVE):
 - \`materialize\` (the managed output): a managed \`// materialize ducklake://<name>/<table>\` means the runtime writes the node's output table FOR you — write the body as a single SELECT and the runtime wraps it in the create/replace, so do NOT also write your own CREATE TABLE / INSERT. The \`dbt://\` target below is the opposite: the node writes its own DDL and none of the write strategies apply to it. IMPORTANT: a MANAGED \`// materialize\` is **DuckDB-only** and its target MUST be a DuckLake table (\`ducklake://<name>/<table>\`) — deploy rejects a \`ducklake://\` target on any other language. For a \`python3\`/\`bun\`/\`postgresql\` node writing the lake, do NOT use \`// materialize\`; write the output via the SDK instead (e.g. \`wmill.writeS3File(...)\`, a \`CREATE TABLE\` in postgresql, or \`wmill.databaseUrlFromResource\`/ducklake helpers) and let the output be inferred. Reach for \`duckdb\` when a node should materialize a DuckLake table. The one target any language BUT DBT'S OWN may declare (a dbt project's writes come from its manifest, so \`// materialize\` on a dbt script is rejected at deploy) is a WAREHOUSE RELATION: \`// materialize manual dbt://<warehouse>/<schema>/<name>\`, with \`<warehouse>\` a warehouse the workspace configures under Settings → dbt. \`manual\` is its only mode — nothing generates warehouse DDL, so the node issues its own write and the annotation records the outcome. Use it on an ingestion node a dbt project reads as a \`source\`: the declared relation and the dbt model become ONE graph node, and a downstream \`// on dbt://<warehouse>/<schema>/<name>\` fires when that node completes. Write strategy: with no option it REPLACES the whole table each run (full refresh; the only mode whose output columns may change); \`// materialize <uri> append\` INSERT-appends rows (incremental); \`// materialize <uri> key=<col>\` merges/upserts on \`<col>\`. \`// materialize manual <uri>\` opts OUT of managed writes — the script writes its own DDL and the annotation only records the output asset for lineage. \`materialize\` is paired with partitioning for incremental pipelines: a \`// partitioned <daily|hourly|weekly|monthly|dynamic>\` node runs once per partition (append/merge into a fixed-schema table), and the \`{partition}\` token — usable in any asset URI AND in the body SQL — is substituted with the current partition's IDENTITY string at run time. To filter the source to the active slice on a time grain, use the runtime-injected macro: \`WHERE wm_partition(<ts_col>) = {partition}\`. \`wm_partition(ts)\` buckets a timestamp with the exact identity format the runtime used (daily/hourly/weekly/monthly), so it always matches and you never hand-write a \`strftime\` format. Do NOT write \`= TIMESTAMP {partition}\`: the identity string is not a valid timestamp literal for hourly/weekly/monthly and errors at runtime. For \`dynamic\` partitioning the identity is your caller-supplied key (not a timestamp, no macro), so filter on it directly: \`WHERE <your_key_col> = {partition}\`. \`materialize\` is an output DECLARATION on the node — it is not a command; there is no "materialize run".
 - \`measure\` / \`dimension\` (declared metrics): on a node that materializes a DuckLake table, \`// measure <name> = <aggregate> [where <predicate>]\` names the canonical way to aggregate that table (e.g. \`// measure revenue = sum(amount) where not is_refund\`), and \`// dimension <name> = <expr>\` names a way to slice it (e.g. \`// dimension region = region\`, \`// dimension month = date_trunc('month', ordered_at)\`). They execute nothing: they are catalogued at deploy so the editor and other agents can reuse the definition instead of re-deriving it and silently disagreeing. Keep the predicate in the \`where\` clause rather than folding it into the aggregate: it is rendered as \`<agg> FILTER (WHERE <pred>)\`, which is what lets two measures with different predicates sit under one GROUP BY. DuckLake-only, and only meaningful next to \`// materialize\`. Declare one when a number carries a judgement call someone else would get wrong (refunds excluded, test rows dropped, which column is the amount); do NOT blanket every table with measures, an obvious \`count(*)\` earns nothing. To USE a metric another node declares, read that node with read_pipeline_node and reuse its exact expression rather than guessing it.
 - Use get_pipeline_graph to see the current nodes/assets/triggers, and read_pipeline_node before editing one.
-- Every node of this pipeline lives at \`f/${ctx.folder}/<node_name>\` — \`${ctx.folder}\` is the folder name and \`f/\` is the owner prefix every workspace path carries, so write it exactly once (never \`f/f/…\`, and never a bare \`<node_name>\`).
+- Every node of this pipeline lives at \`f/${ctx.folder}/<node_name>\` — \`${ctx.folder}\` is the folder name and \`f/\` is the owner prefix every workspace path carries, so write it exactly once (never \`f/f/…\`, and never a bare \`<node_name>\`).${
+		canWriteDraft
+			? `
 - Build new nodes with build_pipeline_node and edit existing ones with edit_pipeline_node. These apply directly as unsaved drafts on the canvas (like the flow/script editor applies AI edits) — they DO NOT deploy. There is no separate Accept/Reject step. Prefer these over the generic write_script/edit_script draft tools while a pipeline is open.
 - Reuse existing asset paths from the graph when wiring a downstream node to an upstream one (read the upstream's write asset, then \`// on\` that same URI).
 - Only deploy when the user explicitly asks; the user deploys drafts from the canvas.`
+			: ''
+	}`
 }
diff --git a/frontend/src/lib/components/copilot/chat/planModeController.svelte.ts b/frontend/src/lib/components/copilot/chat/planModeController.svelte.ts
index ab80dc3e88..01e5040040 100644
--- a/frontend/src/lib/components/copilot/chat/planModeController.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/planModeController.svelte.ts
@@ -1,6 +1,7 @@
 import type { ChatCompletionSystemMessageParam } from 'openai/resources/chat/completions.mjs'
 import type { ArtifactVersionTarget } from '$lib/components/sessions/previewRouter'
-import { createToolDef, type Tool, type ToolCallbacks } from './shared'
+import { createToolDef, type ToolCallbacks } from './shared'
+import { NONE, type SessionTool } from './sessionCapabilities'
 import {
 	appendPlanModeInstructions,
 	derivePlanTitle,
@@ -100,14 +101,24 @@ export class PlanModeController {
 
 	/** Only the transition the current posture allows; auto-accepting exposes neither, since
 	 * entering is the user's choice. */
-	get tools(): Tool<any>[] {
+	get tools(): SessionTool<any>[] {
 		if (!this.#host.available) return []
 		if (this.#host.autoAccepting) return []
 		return this.#host.active ? [this.exitTool] : [this.enterTool]
 	}
 
+	/** Both transitions, whichever posture is selected: what plan mode contributes to this
+	 * chat's capabilities, rather than to the turn it is about to send. */
+	get availableTools(): SessionTool<any>[] {
+		return this.#host.available ? [this.enterTool, this.exitTool] : []
+	}
+
 	// This safety tag is what keeps plan mode escapable through its handoff tool.
-	exitTool: Tool<any> = {
+	exitTool: SessionTool<any> = {
+		// Ungated even for a user who can change nothing: the posture is the USER's choice,
+		// and its instructions order this call to hand the plan over — withholding it
+		// strands the model in a round nothing else can end.
+		requires: NONE,
 		def: createToolDef(exitPlanModeArgs, EXIT_PLAN_MODE_TOOL, EXIT_PLAN_MODE_TOOL_DESCRIPTION),
 		planModeSafe: true,
 		requiresConfirmation: true,
@@ -156,7 +167,8 @@ export class PlanModeController {
 		}
 	}
 
-	enterTool: Tool<any> = {
+	enterTool: SessionTool<any> = {
+		requires: NONE,
 		def: createToolDef(enterPlanModeArgs, ENTER_PLAN_MODE_TOOL, ENTER_PLAN_MODE_TOOL_DESCRIPTION),
 		planModeSafe: true,
 		requiresConfirmation: true,
diff --git a/frontend/src/lib/components/copilot/chat/script/core.test.ts b/frontend/src/lib/components/copilot/chat/script/core.test.ts
new file mode 100644
index 0000000000..f235ae3796
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/script/core.test.ts
@@ -0,0 +1,50 @@
+import { describe, expect, it, vi } from 'vitest'
+
+vi.mock('monaco-editor', () => ({
+	editor: {},
+	languages: {},
+	KeyCode: {},
+	Uri: { parse: (value: string) => ({ toString: () => value }) },
+	MarkerSeverity: { Error: 8, Warning: 4, Info: 2, Hint: 1 }
+}))
+vi.mock('@codingame/monaco-vscode-standalone-typescript-language-features', () => ({
+	getTypeScriptWorker: async () => async () => ({}),
+	typescriptVersion: 'test'
+}))
+vi.mock('@codingame/monaco-vscode-languages-service-override', () => ({ default: () => ({}) }))
+vi.mock('$lib/components/vscode', () => ({}))
+
+import { editCodeToolWithDiff } from './core'
+
+describe('editCodeToolWithDiff', () => {
+	it('records the complete script diff after applying replacements', async () => {
+		const statuses: unknown[] = []
+		const applyCode = vi.fn(async () => {})
+
+		await editCodeToolWithDiff.fn({
+			args: { diffs: [{ old_string: 'return 1', new_string: 'return 2' }] },
+			helpers: {
+				getScriptOptions: () => ({
+					code: 'export function main() {\n\treturn 1\n}',
+					lang: 'bun',
+					path: 'f/example',
+					args: {}
+				}),
+				applyCode
+			},
+			toolCallbacks: {
+				setToolStatus: (_toolId, status) => statuses.push(status)
+			},
+			toolId: 'edit-1'
+		})
+
+		expect(applyCode).toHaveBeenCalledTimes(2)
+		expect(statuses.at(-1)).toMatchObject({
+			codeDiff: {
+				before: 'export function main() {\n\treturn 1\n}',
+				after: 'export function main() {\n\treturn 2\n}',
+				lang: 'typescript'
+			}
+		})
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/script/core.ts b/frontend/src/lib/components/copilot/chat/script/core.ts
index 35e6f5169a..92cb889b24 100644
--- a/frontend/src/lib/components/copilot/chat/script/core.ts
+++ b/frontend/src/lib/components/copilot/chat/script/core.ts
@@ -9,6 +9,7 @@ import type {
 } from 'openai/resources/index.mjs'
 import { type DBSchema, dbSchemas } from '$lib/stores'
 import type { ContextElement } from '../context'
+import { NONE, RUN_PREVIEW, type SessionTool } from '../sessionCapabilities'
 import {
 	createSearchHubScriptsTool,
 	type Tool,
@@ -22,10 +23,12 @@ import {
 } from '../shared'
 import { createWorkspaceMutationTools } from '../workspaceTools'
 import { setupTypeAcquisition, type DepsToGet } from '$lib/ata'
-import { getModelContextWindow } from '../../modelConfig'
+import { getEffectiveModelContextWindow } from '../../modelConfig'
 import type { ReviewChangesOpts } from '../monaco-adapter'
-import { getCurrentModel } from '$lib/aiStore'
+import { copilotInfo, getCurrentModel } from '$lib/aiStore'
+import { get } from 'svelte/store'
 import { getDbSchemas } from '$lib/components/apps/components/display/dbtable/metadata'
+import { scriptLangToEditorLang } from '$lib/scripts'
 import { getScriptPrompt, getWorkflowAsCodePrompt } from '$system_prompts'
 
 // Score threshold for npm packages search filtering
@@ -460,9 +463,12 @@ export const resourceTypeTool: Tool<ScriptChatHelpers> = {
 // Generic DB schema tool factory shared by the script, flow and global modes
 export function createDbSchemaTool<T>(
 	opts: { description?: string; updateEditorCache?: boolean } = {}
-): Tool<T> {
+): SessionTool<T> {
 	const { description, updateEditorCache = true } = opts
 	return {
+		// `getDbSchemas` below introspects by running a query job through /jobs/run/preview,
+		// which jobs.rs refuses operators — so this reads like a lookup but gates like a run.
+		requires: RUN_PREVIEW,
 		def: description
 			? {
 					...DB_SCHEMA_FUNCTION_DEF,
@@ -548,7 +554,11 @@ export async function searchExternalIntegrationResources(args: { query: string }
 		)
 
 		const model = getCurrentModel()
-		const modelContextWindow = getModelContextWindow(model.model)
+		const modelContextWindow = getEffectiveModelContextWindow(
+			model.provider,
+			model.model,
+			get(copilotInfo).contextWindowPerModel
+		)
 		const results: PackageSearchResult[] = await Promise.all(
 			filtered.map(async (r: PackageSearchQuery) => {
 				let documentation = ''
@@ -604,7 +614,8 @@ const SEARCH_NPM_PACKAGES_TOOL: ChatCompletionFunctionTool = {
 }
 
 // Helpers-agnostic so both script mode and global mode can offer it.
-export const searchNpmPackagesTool: Tool<{}> = {
+export const searchNpmPackagesTool: SessionTool<{}> = {
+	requires: NONE,
 	def: SEARCH_NPM_PACKAGES_TOOL,
 	planModeSafe: true,
 	fn: async ({ args, toolId, toolCallbacks }) => {
@@ -821,7 +832,12 @@ export const editCodeToolWithDiff: Tool<ScriptChatHelpers> = {
 
 			toolCallbacks.setToolStatus(toolId, {
 				content: `Code changes applied`,
-				result: 'Success'
+				result: 'Success',
+				codeDiff: {
+					before: oldCode,
+					after: updatedCode,
+					lang: scriptLangToEditorLang(scriptOptions.lang)
+				}
 			})
 			return `Applied changes to the script editor.`
 		} catch (error) {
@@ -873,7 +889,12 @@ export const editCodeTool: Tool<ScriptChatHelpers> = {
 
 			toolCallbacks.setToolStatus(toolId, {
 				content: 'Code changes applied',
-				result: 'Success'
+				result: 'Success',
+				codeDiff: {
+					before: oldCode,
+					after: args.code,
+					lang: scriptLangToEditorLang(scriptOptions.lang)
+				}
 			})
 			return 'Code has been applied to the script editor.'
 		} catch (error) {
diff --git a/frontend/src/lib/components/copilot/chat/sessionCapabilities.ts b/frontend/src/lib/components/copilot/chat/sessionCapabilities.ts
new file mode 100644
index 0000000000..fc77b3e1c4
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/sessionCapabilities.ts
@@ -0,0 +1,52 @@
+import type { Tool } from './shared'
+
+// A leaf on purpose: every module defining a session-reachable tool imports these
+// constants, so importing anything with side effects here drags it into all of them.
+
+/**
+ * What a user may do in ONE workspace, as an AI session's toolset needs to know it.
+ * Best-effort, not a boundary — the token is the enforcement point, so this narrows
+ * what the model is offered and guarantees nothing.
+ */
+export type SessionCapability =
+	/** Passes drafts.rs `require_can_write_path` — for a draft of any kind, schedules and
+	 * triggers included, though an operator may create those directly. */
+	| 'write_draft'
+	/** Passes the operator refusal jobs.rs `run_preview_*` makes before starting a job. */
+	| 'run_preview'
+	/** Passes `check_deploy_rules`. */
+	| 'deploy'
+	/** Passes the operator refusal the script, flow and app handlers make before creating or
+	 * deleting one. The same condition as `run_preview` today, but another handler family's
+	 * check, so each follows its own gate if the two ever diverge. */
+	| 'manage_code'
+	/** Passes `require_admin`. */
+	| 'admin'
+
+export type SessionAccess = ReadonlySet<SessionCapability>
+
+/**
+ * The capabilities without which a tool's call cannot succeed — usually because the
+ * backend refuses it, occasionally because only that capability produces the tool's
+ * input. Never a relevance judgement: a tool the server would accept ships, even when
+ * it is of little use to the session, because withholding it is a stricter answer than
+ * the one the user would get by trying.
+ */
+export type SessionToolPolicy = readonly SessionCapability[]
+
+export const NONE: SessionToolPolicy = []
+export const WRITE_DRAFT: SessionToolPolicy = ['write_draft']
+export const RUN_PREVIEW: SessionToolPolicy = ['run_preview']
+export const DEPLOY: SessionToolPolicy = ['deploy']
+
+/**
+ * A tool that can reach an AI session's toolset. `requires` is mandatory, and declared
+ * beside the `fn` whose call is what proves it right.
+ */
+export type SessionTool<T> = Tool<T> & {
+	requires: SessionToolPolicy
+	/** For a tool taking the item kind as its `type` argument, where one verdict for the whole
+	 * tool is either too strict or too loose: what each kind's handler needs. A session is
+	 * offered only the kinds it can land, and the rest never appear in the schema it sees. */
+	kindRequires?: Readonly<Partial<Record<string, SessionToolPolicy>>>
+}
diff --git a/frontend/src/lib/components/copilot/chat/shared.test.ts b/frontend/src/lib/components/copilot/chat/shared.test.ts
index 768b6d1b65..4574df7355 100644
--- a/frontend/src/lib/components/copilot/chat/shared.test.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.test.ts
@@ -1,7 +1,7 @@
 import { describe, expect, it, vi } from 'vitest'
 import { z } from 'zod'
 import type { DisplayMessage, ToolDisplayMessage } from './shared'
-import { openItemPreviewAction } from './shared'
+import { openItemPreviewAction, webSearchResultOf } from './shared'
 
 vi.mock('monaco-editor', () => ({
 	editor: {}
@@ -54,7 +54,10 @@ vi.mock('$lib/gen', () => ({
 	AzureTriggerService: { createAzureTrigger: vi.fn() },
 	AmqpTriggerService: { createAmqpTrigger: vi.fn() },
 	EmailTriggerService: { createEmailTrigger: vi.fn() },
-	SettingService: { getGlobal: vi.fn() }
+	SettingService: { getGlobal: vi.fn() },
+	ResourceService: {
+		getResourceValue: vi.fn(async ({ path }: { path: string }) => ({ content: `body of ${path}` }))
+	}
 }))
 
 vi.mock('$lib/utils', () => ({
@@ -205,6 +208,106 @@ describe('buildContextString', () => {
 })
 
 describe('processToolCall', () => {
+	it('delivers folder instructions once, holding back a change until they are read', async () => {
+		const { createToolDef, processToolCall } = await import('./shared')
+		const read = vi.fn(async () => 'read ok')
+		const write = vi.fn(async () => 'write ok')
+		const tools = [
+			{ def: createToolDef(z.object({}), 'read_item', 'Read'), planModeSafe: true, fn: read },
+			{ def: createToolDef(z.object({}), 'write_item', 'Write'), fn: write }
+		]
+		const folderInstructions = {
+			list: () => [
+				{ path: 'f/billing/AGENTS', scope: 'f/billing/' },
+				{ path: 'f/billing/eu/AGENTS', scope: 'f/billing/eu/' },
+				{ path: 'f/other/AGENTS', scope: 'f/other/' },
+				{ path: 'g/ops/AGENTS', scope: 'g/ops/' }
+			],
+			deliveredBy: new Map<string, { workspace: string; paths: readonly string[] }>()
+		}
+		const messages: any[] = []
+		const call = async (
+			id: string,
+			name: string,
+			path: string | object,
+			workspace = 'test-workspace'
+		) => {
+			const message = await processToolCall({
+				tools,
+				toolCall: {
+					id,
+					type: 'function',
+					function: {
+						name,
+						arguments: JSON.stringify(typeof path === 'string' ? { path } : path)
+					}
+				},
+				helpers: {},
+				workspace,
+				messages,
+				toolCallbacks: { setToolStatus: vi.fn(), removeToolStatus: vi.fn(), folderInstructions }
+			})
+			messages.push(message)
+			return message.content as string
+		}
+		const turn = () => messages.push({ role: 'assistant', content: '' })
+
+		turn()
+		const readResult = await call('c1', 'read_item', 'f/billing/eu/invoice')
+		expect(read).toHaveBeenCalledTimes(1)
+		expect(readResult.startsWith('read ok')).toBe(true)
+		// Outermost first, so the nested folder's instructions read as the specific ones.
+		expect(readResult.indexOf('body of f/billing/AGENTS')).toBeLessThan(
+			readResult.indexOf('body of f/billing/eu/AGENTS')
+		)
+		// Same batch: the model has not read c1's result yet, so the write still waits,
+		// pointed at that result rather than handed the bodies twice.
+		const sameBatch = await call('c2', 'write_item', 'f/billing/eu/invoice')
+		expect(write).not.toHaveBeenCalled()
+		expect(sameBatch).not.toContain('body of f/billing/AGENTS')
+		expect(sameBatch).toContain('earlier result of this same batch')
+
+		turn()
+		expect(await call('c3', 'write_item', 'f/billing/eu/invoice')).toBe('write ok')
+
+		const held = await call('c4', 'write_item', 'f/other/x')
+		expect(write).toHaveBeenCalledTimes(1)
+		expect(held).toContain('body of f/other/AGENTS')
+		expect(held).not.toContain('body of f/billing/AGENTS')
+
+		turn()
+		expect(await call('c5', 'write_item', 'f/other/x')).toBe('write ok')
+
+		expect(await call('g1', 'read_item', 'g/ops/runbook')).toContain('body of g/ops/AGENTS')
+
+		// The same path in another workspace is another resource, delivered afresh.
+		expect(await call('w1', 'read_item', 'f/other/x', 'other-workspace')).toContain(
+			'body of f/other/AGENTS'
+		)
+
+		// A delivery lost from the conversation (compaction) is made again.
+		messages.splice(0)
+		turn()
+		expect(await call('c6', 'read_item', 'f/billing/y')).toContain('body of f/billing/AGENTS')
+
+		// A trigger names its target inside its config.
+		messages.splice(0)
+		turn()
+		const nested = await call('t1', 'write_item', { kind: 'http', config: { path: 'f/other/t' } })
+		expect(nested).toContain('body of f/other/AGENTS')
+		expect(write).toHaveBeenCalledTimes(2)
+
+		// A call stopped mid-run is answered with a placeholder under its id: no delivery.
+		messages.splice(0)
+		folderInstructions.deliveredBy.set('stopped', {
+			workspace: 'test-workspace',
+			paths: ['f/billing/AGENTS']
+		})
+		messages.push({ role: 'tool', tool_call_id: 'stopped', content: 'Interrupted' })
+		turn()
+		expect(await call('c7', 'read_item', 'f/billing/y')).toContain('body of f/billing/AGENTS')
+	})
+
 	it('returns pre-confirmation validation errors without asking for confirmation', async () => {
 		const { createToolDef, processToolCall } = await import('./shared')
 		const error = 'the script needs to be deployed before doing this action'
@@ -1510,6 +1613,50 @@ describe('pollJobCompletion detach', () => {
 	})
 })
 
+describe('executeTestRun result note', () => {
+	// A failed run's card lands on the error, with the logs a tab away: the model must stay
+	// free to quote them, so only a success says the user already sees the run.
+	it('tells the model not to repeat a successful result, and not a failed one', async () => {
+		vi.useFakeTimers()
+		try {
+			const { executeTestRun } = await import('./shared')
+			const { JobService } = await import('$lib/gen')
+			const getJobUpdates = vi.mocked(JobService.getJobUpdates)
+			getJobUpdates.mockReset()
+			getJobUpdates.mockResolvedValue({ completed: true, running: false } as any)
+			const run = async (success: boolean) => {
+				vi.mocked(JobService.getJob).mockReset()
+				vi.mocked(JobService.getJob).mockResolvedValue({
+					type: 'CompletedJob',
+					success,
+					result: [1, 2],
+					logs: 'ran'
+				} as any)
+				const promise = executeTestRun({
+					jobStarter: async () => 'job1',
+					workspace: 'w',
+					toolId: 'tool1',
+					startMessage: 'Starting...',
+					contextName: 'script',
+					// The job hooks are what mark the global/sessions chat.
+					toolCallbacks: {
+						setToolStatus: vi.fn(),
+						removeToolStatus: vi.fn(),
+						onJobStatus: vi.fn(),
+						onJobStarted: vi.fn()
+					} as any
+				})
+				await vi.advanceTimersByTimeAsync(1000)
+				return promise
+			}
+			expect(await run(true)).toContain('Do not repeat')
+			expect(await run(false)).not.toContain('Do not repeat')
+		} finally {
+			vi.useRealTimers()
+		}
+	})
+})
+
 describe('deriveChatJobStatus', () => {
 	// CompletedJob is discriminated by the presence of a `success` key; the branch
 	// order deliberately mirrors JobStatusIcon so the badge and scalar never drift.
@@ -1825,3 +1972,38 @@ describe('processToolCall confirmation hooks', () => {
 		expect(tool.fn).toHaveBeenCalled()
 	})
 })
+
+// Any tool gets the web search card by returning this shape. The card renders urls and
+// titles only, so a result carrying anything more must keep its JSON pane.
+describe('webSearchResultOf', () => {
+	it('reads the shape, from the value or its JSON text', () => {
+		const result = { sources: [{ url: 'https://a.dev', title: 'A' }], query: 'a' }
+		expect(webSearchResultOf(result)).toEqual(result)
+		expect(webSearchResultOf(JSON.stringify(result))).toEqual(result)
+	})
+
+	// A Python tool serializes an absent optional as null, and the card has nothing to tell
+	// its author why an almost-right result fell back to JSON.
+	it('reads null on an optional field as absent', () => {
+		expect(
+			webSearchResultOf({ sources: [{ url: 'https://a.dev', title: null }], query: null })
+		).toEqual({
+			sources: [{ url: 'https://a.dev', title: undefined }],
+			query: undefined
+		})
+	})
+
+	it.each([
+		['an extra key', { sources: [{ url: 'https://a.dev' }], summary: 'x' }],
+		['an extra source field', { sources: [{ url: 'https://a.dev', snippet: 'x' }] }],
+		['a source without url', { sources: [{ title: 'A' }] }],
+		// The card renders no relative or javascript: link, so a result whose urls it would
+		// drop keeps its own JSON rather than showing an empty source list.
+		['a relative url', { sources: [{ url: '/docs/pg17', title: 'PG 17' }] }],
+		['a javascript: url', { sources: [{ url: 'javascript:alert(1)' }] }],
+		['no sources', { sources: [] }],
+		['a bare list of links', [{ url: 'https://a.dev' }]]
+	])('rejects %s', (_, result) => {
+		expect(webSearchResultOf(result)).toBeUndefined()
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/shared.ts b/frontend/src/lib/components/copilot/chat/shared.ts
index 13799cf09f..1e486c7d41 100644
--- a/frontend/src/lib/components/copilot/chat/shared.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.ts
@@ -7,6 +7,7 @@ import type { UserDraftItemKind } from '$lib/gen'
 // The gate's two refusals, from a module that holds prose and one size limit: under the
 // shallow-import rule below, the rest of plan mode is not reachable from here.
 import { PLAN_MODE_MESSAGES } from './planModeMessages'
+import { NONE } from './sessionCapabilities'
 // Import-free leaf, so it satisfies the shallow-import rule below.
 import {
 	openItemPreviewAction,
@@ -38,6 +39,7 @@ import type { CodePieceElement, ContextElement, FlowModuleCodePieceElement } fro
 import { workspaceStore } from '$lib/stores'
 import type { ExtendedOpenFlow } from '$lib/components/flows/types'
 import { findModuleInFlow, findModuleInModules } from '$lib/components/flows/flowTree'
+import { agentTestInputTransforms } from '$lib/components/flows/agentFormFields'
 import type { FunctionParameters } from 'openai/resources/shared.mjs'
 import { z } from 'zod'
 import {
@@ -59,6 +61,7 @@ import { forLater } from '$lib/forLater'
 import { scriptLangToEditorLang } from '$lib/scripts'
 import { getCurrentModel } from '$lib/aiStore'
 import { type editor as meditor } from 'monaco-editor'
+import { pendingFolderInstructions, type FolderInstructionsContext } from './folderInstructions'
 
 // Prettify function for code arguments - extracts and formats code from JSON
 function prettifyCodeArguments(content: string): string {
@@ -610,6 +613,84 @@ export type WebSearchSource = {
 	title?: string
 }
 
+export type ToolCodeDiff = {
+	before: string
+	after: string
+	/** Monaco language id. */
+	lang: string
+}
+
+/** The result shape any tool returns to have it rendered as a web search card. */
+export type WebSearchResult = {
+	sources: WebSearchSource[]
+	query?: string
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+/** A link the card can render: the source list drops everything else, so a result whose
+ * urls are relative or `javascript:` would show as an empty list in place of its own output. */
+export function isRenderableSourceUrl(url: string): boolean {
+	try {
+		return ['http:', 'https:'].includes(new URL(url).protocol)
+	} catch {
+		return false
+	}
+}
+
+/** An absent optional field reaches JSON as `null` from a Python tool and as nothing from a
+ * TypeScript one, so both read as absent. */
+function isOptionalString(value: unknown): boolean {
+	return value === null || typeof value === 'string'
+}
+
+function isWebSearchSource(value: unknown): value is { url: string; title?: unknown } {
+	return (
+		isRecord(value) &&
+		typeof value.url === 'string' &&
+		isRenderableSourceUrl(value.url) &&
+		Object.entries(value).every(
+			([key, v]) => key === 'url' || (key === 'title' && isOptionalString(v))
+		)
+	)
+}
+
+/**
+ * A tool result as a web search, or undefined when it is anything else. The keys must be
+ * exactly `sources` and an optional `query`: the card renders only urls and titles, so a
+ * result carrying more would lose it. Accepts the result as its JSON text too.
+ */
+export function webSearchResultOf(result: unknown): WebSearchResult | undefined {
+	if (typeof result === 'string') {
+		try {
+			result = JSON.parse(result)
+		} catch {
+			return undefined
+		}
+	}
+	if (!isRecord(result) || !Array.isArray(result.sources) || result.sources.length === 0) {
+		return undefined
+	}
+	const sources = result.sources
+	if (
+		!sources.every(isWebSearchSource) ||
+		!Object.entries(result).every(
+			([key, v]) => key === 'sources' || (key === 'query' && isOptionalString(v))
+		)
+	) {
+		return undefined
+	}
+	return {
+		sources: sources.map((source) => ({
+			url: source.url,
+			title: typeof source.title === 'string' ? source.title : undefined
+		})),
+		query: typeof result.query === 'string' ? result.query : undefined
+	}
+}
+
 export type ToolDisplayMessage = {
 	role: 'tool'
 	tool_call_id: string
@@ -634,10 +715,19 @@ export type ToolDisplayMessage = {
 	 * workspace rides along: a chat is readable from any workspace, and the same path names
 	 * a different server in each. */
 	mcpServer?: { workspace: string; path: string }
+	/** The run behind the call. Flow chats only: the card links to it. */
+	jobId?: string
 	showFade?: boolean
 	actions?: ToolDisplayAction[]
 	userQuestion?: UserQuestionDisplay
 	runForm?: RunFormDisplay
+	/** A run this call inspected rather than started, rendered by the same card. The card
+	 * reads its panes from this job, so the user sees its own args and result in full, and its
+	 * logs as a 4000-char tail, while the model keeps the capped envelope the tool returned.
+	 * `runId` and `step` are the address the call was made with, kept so the card can name what
+	 * was inspected the way the tool's own row did: a step job names neither the step nor the
+	 * run it belongs to. */
+	inspectedRun?: { jobId: string; workspace: string; runId: string; step?: string }
 	webSearchSources?: WebSearchSource[]
 	/** Data URL of an image the tool produced (e.g. take_screenshot), shown on the card. */
 	imageUrl?: string
@@ -645,6 +735,9 @@ export type ToolDisplayMessage = {
 	 * always-visible card that opens (or focuses) the item's preview in the
 	 * session side panel. Set only for session chats — the side panel is their surface. */
 	previewCard?: { kind: PreviewCardKind; path: string }
+	/** Whole text on both sides of an edit this call saved. Kept in full rather than as a
+	 * reference: drafts are overwritten in place, so the sides cannot be fetched back later. */
+	codeDiff?: ToolCodeDiff
 	planArtifactId?: string
 	/** The version this card's proposal wrote, so a card scrolled far up still opens the plan
 	 * it proposed rather than what the document became. */
@@ -652,6 +745,8 @@ export type ToolDisplayMessage = {
 	/** Refused by the plan-mode gate. Renders as its own lean row rather than a tool
 	 * error, so the transcript says the mode stopped it and not that the call failed. */
 	blockedByPlanMode?: boolean
+	/** Held back until the model has read the folder instructions it was handed. */
+	heldForFolderInstructions?: boolean
 	/** The user declined: the reject button, a Stop, or a posture switch. Set only there, so
 	 * a decision is distinguishable from every other way a call errors. */
 	declinedByUser?: boolean
@@ -677,7 +772,9 @@ export type AssistantDisplayMessage = BaseDisplayMessage & {
 	/** The run behind this answer. Flow chats only: a copilot turn happens in the
 	 * browser and has no job. */
 	jobId?: string
-	/** When the message was stored, as the server reports it. */
+	/** When the answer arrived: the server's time for a flow chat's stored row, the browser's
+	 * for a copilot answer, which is stamped as it lands. Absent on a copilot chat restored
+	 * from history, which predates the stamp. */
 	createdAt?: string
 }
 
@@ -773,11 +870,11 @@ export function pendingUserActionDetail(
 // the sessions page) react to mutating tools — refreshing previews — without
 // the tool layer knowing about the UI. Single slot; the consumer filters by name
 // and reads the tool args (e.g. the mutated item's `path`) to scope its refresh.
-let toolCompletionListener: ((toolName: string, args: any) => void) | undefined
+// `workspace` is the one the tool acted on: a path names an item only within it.
+export type ToolCompletionListener = (toolName: string, args: any, workspace: string) => void
+let toolCompletionListener: ToolCompletionListener | undefined
 
-export function setToolCompletionListener(
-	fn: ((toolName: string, args: any) => void) | undefined
-): void {
+export function setToolCompletionListener(fn: ToolCompletionListener | undefined): void {
 	toolCompletionListener = fn
 }
 
@@ -805,7 +902,7 @@ async function callTool<T>({
 		)
 	}
 	const result = await tool.fn({ args, workspace, helpers, toolCallbacks, toolId })
-	toolCompletionListener?.(functionName, args)
+	toolCompletionListener?.(functionName, args, workspace)
 	return result
 }
 
@@ -882,20 +979,29 @@ function stringifyErrorBody(body: unknown): string {
  * (tab closed while a tool polls) logs nothing, so the statuses sum to the calls that
  * finished, not to the calls made.
  */
-type ToolCallStatus = 'ok' | 'error' | 'declined' | 'rejected' | 'blocked_plan_mode'
+type ToolCallStatus =
+	| 'ok'
+	| 'error'
+	| 'declined'
+	| 'rejected'
+	| 'blocked_plan_mode'
+	| 'held_for_instructions'
 
 export async function processToolCall<T>({
 	tools,
 	toolCall,
 	helpers,
 	toolCallbacks,
-	workspace
+	workspace,
+	messages = []
 }: {
 	tools: Tool<T>[]
 	toolCall: ChatCompletionMessageFunctionToolCall
 	helpers: T
 	toolCallbacks: ToolCallbacks
 	workspace?: string
+	/** The conversation so far, for which folder instructions it already carries. */
+	messages?: readonly ChatCompletionMessageParam[]
 }): Promise<ChatCompletionMessageParam> {
 	const tool = tools.find((t) => t.def.function.name === toolCall.function.name)
 	const workspaceId = workspace ?? get(workspaceStore) ?? ''
@@ -979,6 +1085,43 @@ export async function processToolCall<T>({
 			}
 		}
 
+		// After the gates that refuse the call, so a refused call does not use up the
+		// delivery. A call that changes something is held back until the model has read
+		// the instructions: arriving with its result, they would be too late to shape it.
+		const folderInstructions = tool
+			? await pendingFolderInstructions(
+					toolCallbacks.folderInstructions,
+					messages,
+					args,
+					workspaceId
+				)
+			: undefined
+		if (folderInstructions?.paths.length) {
+			toolCallbacks.folderInstructions?.deliveredBy.set(toolCall.id, {
+				workspace: workspaceId,
+				paths: folderInstructions.paths
+			})
+		}
+		if (folderInstructions && tool?.planModeSafe !== true) {
+			logToolOutcome('held_for_instructions')
+			toolCallbacks.setToolStatus(toolCall.id, {
+				content: 'Read folder instructions',
+				heldForFolderInstructions: true,
+				parameters: args,
+				isLoading: false,
+				isQueued: false,
+				isStreamingArguments: false,
+				needsConfirmation: false,
+				showDetails: tool?.showDetails,
+				autoCollapseDetails: tool?.autoCollapseDetails
+			})
+			return {
+				role: 'tool' as const,
+				tool_call_id: toolCall.id,
+				content: `Not run: this call touches a folder whose instructions you had not read yet. Follow them, then make the call again (adjusted if they require it).\n\n${folderInstructions.text}`
+			}
+		}
+
 		const requiresConfirmation = tool?.requiresConfirmation === true
 		// By name: skipping the wait is itself an answer on the user's behalf, and one tool
 		// must not be answered for.
@@ -1083,7 +1226,7 @@ export async function processToolCall<T>({
 		const toAdd = {
 			role: 'tool' as const,
 			tool_call_id: toolCall.id,
-			content: result
+			content: folderInstructions ? `${result}\n\n${folderInstructions.text}` : result
 		}
 		return toAdd
 	} catch (err) {
@@ -1157,7 +1300,10 @@ export interface Tool<T> {
 		workspace: string
 		helpers: T
 	}) => MaybePromise<ToolRejection | undefined>
-	setSchema?: (helpers: any) => Promise<void>
+	/** This chat's definition of the tool, for a schema that depends on the chat (its workspace,
+	 * its open flow). Returns a new def: tools are module singletons shared by every chat, so
+	 * one written back leaks into the others. */
+	schemaFor?: (helpers: any) => Promise<ChatCompletionFunctionTool>
 	/** Safe to run while plan mode is active. Absence fails closed. */
 	planModeSafe?: boolean
 	/** The arguments a plan-mode-safe tool still refuses while the posture holds — for a tool
@@ -1358,6 +1504,9 @@ export interface ToolCallbacks {
 	attachToolImage?: (toolId: string, image: AttachedImage) => void
 	/** Drain every image buffered this batch (insertion order), clearing the buffer. */
 	takePendingToolImages?: () => AttachedImage[]
+	/** Wired only by the global/sessions chat: delivers the folder instructions
+	 * covering the paths a tool call names, once per conversation. */
+	folderInstructions?: FolderInstructionsContext
 }
 
 export function createToolDef(
@@ -1457,6 +1606,7 @@ export function isHubPath(path: string): boolean {
 }
 
 export const createSearchHubScriptsTool = (withContent: boolean = false) => ({
+	requires: NONE,
 	def: searchHubScriptsToolDef,
 	planModeSafe: true,
 	fn: async ({ args, toolId, toolCallbacks }) => {
@@ -1860,6 +2010,15 @@ export async function buildTestRunArgs(
 	return parsedArgs
 }
 
+// Said with the result rather than in the system prompt: there, models still copied a
+// result's table or JSON into the reply, under a card that already renders it. Only for
+// a successful run in the generic card completedJobToolStatus fills: a failed run's card
+// lands on the error with the logs a tab away, and a formatCompletion card shows its own.
+// Never on a background completion: its card can be far up the chat by then, so the
+// reply may be the only place the user reads the result.
+const RESULT_SHOWN_NOTE =
+	"The user already sees this run's result in its card. Do not repeat the result or logs in your reply: say what it shows, quoting only the values your conclusion rests on."
+
 // The string handed back to the model when a job is backgrounded. It carries the
 // job id so the model can pull status/args/result/logs on demand (get_run / list_runs),
 // and tells it the completion will be reported later (notify-only wake).
@@ -2004,7 +2163,12 @@ export async function executeTestRun(config: TestRunConfig): Promise<string> {
 			...(job.success ? {} : { error: getErrorMessage(job.result) })
 		})
 
-		const summary = formatResultSummary(job.result, job.logs, job.success)
+		// detachEnabled marks the global/sessions chat; the in-editor chats read the summary
+		// alone. The card opening on the result is up to each tool: a run card does, a
+		// generic one only with `autoCollapseDetails: false` at its registration.
+		const summary =
+			(detachEnabled && job.success ? `${RESULT_SHOWN_NOTE}\n` : '') +
+			formatResultSummary(job.result, job.logs, job.success)
 		// get_run only exists in the global/sessions chat (the same hosts that wire
 		// the job hooks) — don't advertise it to in-editor chats.
 		if (detachEnabled && config.contextName === 'flow' && !job.success) {
@@ -2049,6 +2213,13 @@ type FlowStepRunConfig = {
 	toolId: string
 	loadScript?: FlowStepScriptLoader
 	loadSubflow?: FlowStepSubflowLoader
+	/** The path of the flow the step belongs to. An agent step's preview carries it, as the flow
+	 * editor's own step test does: the run is filed under it, and a managed memory keyed on a
+	 * memory id someone named reads the flow's conversation rather than a stray one. */
+	flowPath?: string
+	/** The flow editor's substitution of a linked agent's unsaved draft, passed in because it
+	 * reaches the draft store, which this module's import list must not. */
+	withAgentDrafts?: (value: FlowValue) => Promise<FlowValue>
 }
 
 export type FlowStepTestRunConfig = FlowStepRunConfig & {
@@ -2073,8 +2244,9 @@ export type ResolvedFlowStepRun = {
 	startMessage: string
 	/** Takes the arguments as submitted. The preprocessor's entrypoint override is added
 	 * here rather than by the caller: it is declared by no schema, so anything that
-	 * conforms arguments to one would drop it. */
-	startJob: (args: Record<string, any>) => Promise<string>
+	 * conforms arguments to one would drop it. An agent step also takes the run form's rows:
+	 * each runs from its submitted value, including one the submission leaves out. */
+	startJob: (args: Record<string, any>, formKeys?: readonly string[]) => Promise<string>
 }
 
 function normalizeFlowStepArgs(args: Record<string, any> | null | undefined): Record<string, any> {
@@ -2118,7 +2290,9 @@ export async function resolveFlowStepRun({
 	toolCallbacks,
 	toolId,
 	loadScript = loadDeployedScriptForFlowStep,
-	loadSubflow
+	loadSubflow,
+	flowPath,
+	withAgentDrafts
 }: FlowStepRunConfig): Promise<ResolvedFlowStepRun> {
 	const targetModule = findModuleInFlow(flowValue, stepId) ?? undefined
 
@@ -2205,12 +2379,51 @@ export async function resolveFlowStepRun({
 		}
 	}
 
+	if (moduleValue.type === 'aiagent') {
+		return {
+			module: targetModule,
+			// The job started is a flow preview: an agent step has none of its own, and the tool
+			// calls it makes are that flow's steps.
+			runnableKind: 'flow',
+			startMessage: `Starting test run of agent step "${stepId}"...`,
+			startJob: async (args, formKeys) => {
+				// The step alone, stripped of the settings around it: a mock would answer for it
+				// and a suspend would hold the run for an approval nobody is watching for.
+				const value: FlowValue = {
+					modules: [
+						{
+							id: targetModule.id,
+							value: {
+								...moduleValue,
+								input_transforms: agentTestInputTransforms(
+									moduleValue.input_transforms,
+									args,
+									formKeys
+								)
+							}
+						}
+					]
+				}
+				return JobService.runFlowPreview({
+					workspace,
+					requestBody: {
+						// After the inputs are wired, as the flow editor's step test does: a linked agent's
+						// draft brings its own brain and tools, and the step's run inputs stay on top.
+						value: withAgentDrafts ? await withAgentDrafts(value) : value,
+						args,
+						path: flowPath
+					}
+				})
+			}
+		}
+	}
+
 	toolCallbacks.setToolStatus(toolId, {
 		content: `Step type "${moduleValue.type}" not supported for testing`,
 		error: `Cannot test step of type "${moduleValue.type}"`
 	})
 	throw new Error(
-		`Cannot test step of type "${moduleValue.type}". Supported types: rawscript, script, flow`
+		`Cannot test step of type "${moduleValue.type}". Supported types: rawscript, script, flow, aiagent`
 	)
 }
 
diff --git a/frontend/src/lib/components/copilot/chat/toolCodeDiff.test.ts b/frontend/src/lib/components/copilot/chat/toolCodeDiff.test.ts
new file mode 100644
index 0000000000..5077585a4f
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/toolCodeDiff.test.ts
@@ -0,0 +1,411 @@
+import { describe, expect, it } from 'vitest'
+import hljs from 'highlight.js/lib/core'
+import {
+	argumentsCarryWholeFile,
+	diffLineCounts,
+	hasToolCodeDiff,
+	toolCodeDiff,
+	toolDiffLines,
+	visibleToolDiffRows
+} from './toolCodeDiff'
+import { highlightedSourceLines } from './toolCodeDiffHighlight'
+import { TOOL_CODE_DIFF_LANGUAGES, toolCodeDiffLanguage } from './toolCodeDiffLanguage'
+import type { ToolDisplayMessage } from './shared'
+
+function message(overrides: Partial<ToolDisplayMessage>): ToolDisplayMessage {
+	return {
+		role: 'tool',
+		tool_call_id: 'call-1',
+		content: 'Updated script "f/example" as a draft',
+		...overrides
+	}
+}
+
+describe('toolCodeDiff', () => {
+	it('uses the saved full script sides after an edit succeeds', () => {
+		const codeDiff = {
+			before: 'const before = true\n',
+			after: 'const after = true\n',
+			lang: 'typescript'
+		}
+
+		expect(
+			toolCodeDiff(
+				message({
+					toolName: 'edit_script',
+					parameters: { old_string: 'before', new_string: 'after' },
+					codeDiff
+				})
+			)
+		).toBe(codeDiff)
+	})
+
+	it('uses edit arguments until the full script sides are available', () => {
+		expect(
+			toolCodeDiff(
+				message({
+					toolName: 'edit_script',
+					parameters: { old_string: 'before', new_string: 'after' }
+				})
+			)
+		).toEqual({ before: 'before', after: 'after', lang: 'plaintext' })
+	})
+
+	it('renders streamed edit arguments before their JSON object is complete', () => {
+		expect(
+			toolCodeDiff(
+				message({
+					toolName: 'edit_script',
+					parameters: '{"old_string":"before\\nline","new_string":"after'
+				})
+			)
+		).toEqual({ before: 'before\nline', after: 'after', lang: 'plaintext' })
+	})
+
+	it('uses each replacement from an in-editor edit while its arguments stream', () => {
+		expect(
+			toolCodeDiff(
+				message({
+					toolName: 'edit_code',
+					parameters: {
+						diffs: [
+							{ old_string: 'first old', new_string: 'first new' },
+							{ old_string: 'second old', new_string: 'second new' }
+						]
+					}
+				})
+			)
+		).toEqual({
+			before: 'first old\nsecond old',
+			after: 'first new\nsecond new',
+			lang: 'plaintext'
+		})
+	})
+
+	it('uses each replacement while in-editor edit arguments are incomplete', () => {
+		expect(
+			toolCodeDiff(
+				message({
+					toolName: 'edit_code',
+					parameters:
+						'{"diffs":[{"old_string":"first old","new_string":"first new"},{"old_string":"second old","new_string":"second new'
+				})
+			)
+		).toEqual({
+			before: 'first old\nsecond old',
+			after: 'first new\nsecond new',
+			lang: 'plaintext'
+		})
+	})
+
+	it('shows a streamed full-code editor update without replacements', () => {
+		expect(
+			toolCodeDiff(message({ toolName: 'edit_code', parameters: '{"code":"console.log(1)' }))
+		).toEqual({ before: '', after: 'console.log(1)', lang: 'plaintext' })
+	})
+
+	it('shows streamed full-script updates before the saved diff is available', () => {
+		expect(
+			toolCodeDiff(
+				message({ toolName: 'write_script', parameters: '{"content":"print(\\\"hello\\\")' })
+			)
+		).toEqual({ before: '', after: 'print("hello")', lang: 'plaintext' })
+	})
+
+	it('only marks tools with a defined argument diff as diff-capable', () => {
+		expect(hasToolCodeDiff('edit_script')).toBe(true)
+		expect(hasToolCodeDiff('edit_code')).toBe(true)
+		expect(hasToolCodeDiff('write_script')).toBe(true)
+		expect(hasToolCodeDiff('__proto__')).toBe(false)
+		expect(hasToolCodeDiff('toString')).toBe(false)
+		expect(hasToolCodeDiff(undefined)).toBe(false)
+	})
+
+	it('ignores tool names inherited from Object.prototype', () => {
+		expect(toolCodeDiff(message({ toolName: 'constructor', parameters: {} }))).toBeUndefined()
+	})
+
+	it('counts added and removed lines independently', () => {
+		expect(
+			diffLineCounts({
+				before: 'one\ntwo\nthree\n',
+				after: 'one\nnew\nthree\nfour\n',
+				lang: 'plaintext'
+			})
+		).toEqual({
+			added: 2,
+			removed: 1
+		})
+	})
+
+	it('keeps a final newline as a diffable line', () => {
+		expect(toolDiffLines({ before: 'one', after: 'one\n', lang: 'plaintext' })).toEqual([
+			{ kind: 'context', content: 'one', oldLine: 1, newLine: 1 },
+			{ kind: 'added', content: '', newLine: 2 }
+		])
+	})
+
+	it('does not add a final-newline row when creating or deleting a file', () => {
+		expect(toolDiffLines({ before: '', after: 'one\n', lang: 'plaintext' })).toEqual([
+			{ kind: 'added', content: 'one', newLine: 1, changedRanges: [{ start: 0, length: 3 }] }
+		])
+		expect(toolDiffLines({ before: 'one\n', after: '', lang: 'plaintext' })).toEqual([
+			{ kind: 'removed', content: 'one', oldLine: 1, changedRanges: [{ start: 0, length: 3 }] }
+		])
+	})
+
+	it('keeps both gutters correct across removed and added lines', () => {
+		expect(
+			toolDiffLines({
+				before: 'one\ntwo\nthree\n',
+				after: 'one\nnew\nthree\nfour\n',
+				lang: 'plaintext'
+			})
+		).toEqual([
+			{ kind: 'context', content: 'one', oldLine: 1, newLine: 1 },
+			{
+				kind: 'removed',
+				content: 'two',
+				oldLine: 2,
+				newLine: undefined,
+				changedRanges: [{ start: 0, length: 3 }]
+			},
+			{
+				kind: 'added',
+				content: 'new',
+				oldLine: undefined,
+				newLine: 2,
+				changedRanges: [{ start: 0, length: 3 }]
+			},
+			{ kind: 'context', content: 'three', oldLine: 3, newLine: 3 },
+			{
+				kind: 'added',
+				content: 'four',
+				oldLine: undefined,
+				newLine: 4,
+				changedRanges: [{ start: 0, length: 4 }]
+			}
+		])
+	})
+
+	it('keeps unchanged trailing lines out of the change counts', () => {
+		const diff = { before: 'one\ntwo\nthree', after: 'one\nnew\nthree', lang: 'plaintext' }
+
+		expect(diffLineCounts(diff)).toEqual({ added: 1, removed: 1 })
+		expect(toolDiffLines(diff).filter((line) => line.content === 'three')).toEqual([
+			{ kind: 'context', content: 'three', oldLine: 3, newLine: 3 }
+		])
+	})
+
+	it('does not report changes for identical files', () => {
+		const diff = { before: 'one\ntwo\nthree', after: 'one\ntwo\nthree', lang: 'plaintext' }
+
+		expect(diffLineCounts(diff)).toEqual({ added: 0, removed: 0 })
+		expect(toolDiffLines(diff)).toEqual([
+			{ kind: 'context', content: 'one', oldLine: 1, newLine: 1 },
+			{ kind: 'context', content: 'two', oldLine: 2, newLine: 2 },
+			{ kind: 'context', content: 'three', oldLine: 3, newLine: 3 }
+		])
+	})
+
+	it('renders a newly created file', () => {
+		expect(toolDiffLines({ before: '', after: 'print("hello")', lang: 'python' })).toEqual([
+			{
+				kind: 'added',
+				content: 'print("hello")',
+				oldLine: undefined,
+				newLine: 1,
+				changedRanges: [{ start: 0, length: 14 }]
+			}
+		])
+	})
+
+	it('renders a deleted file', () => {
+		expect(toolDiffLines({ before: 'print("goodbye")', after: '', lang: 'python' })).toEqual([
+			{
+				kind: 'removed',
+				content: 'print("goodbye")',
+				oldLine: 1,
+				newLine: undefined,
+				changedRanges: [{ start: 0, length: 16 }]
+			}
+		])
+	})
+
+	it('uses Monaco line alignment for reordered lines', () => {
+		expect(
+			toolDiffLines({
+				before: 'const a = 1\nconst b = 2',
+				after: 'const b = 2\nconst a = 1',
+				lang: 'typescript'
+			})
+		).toEqual([
+			{
+				kind: 'added',
+				content: 'const b = 2',
+				newLine: 1,
+				changedRanges: [{ start: 0, length: 11, extendsToEnd: true }]
+			},
+			{ kind: 'context', content: 'const a = 1', oldLine: 1, newLine: 2 },
+			{
+				kind: 'removed',
+				content: 'const b = 2',
+				oldLine: 2,
+				changedRanges: [{ start: 0, length: 11 }]
+			}
+		])
+	})
+
+	it('avoids expensive alignment while arguments stream', () => {
+		const before = Array.from({ length: 1_000 }, (_, index) => `before ${index}`).join('\n')
+		const after = Array.from({ length: 1_000 }, (_, index) => `after ${index}`).join('\n')
+
+		expect(toolDiffLines({ before, after, lang: 'plaintext' }, true)).toHaveLength(400)
+		expect(diffLineCounts({ before, after, lang: 'plaintext' }, true)).toEqual({
+			added: 1_000,
+			removed: 1_000
+		})
+	})
+
+	it('diffs a small edit in a large file', () => {
+		const beforeLines = Array.from({ length: 600 }, (_, index) => `line ${index}`)
+		const afterLines = beforeLines.map((line, index) => (index === 400 ? 'changed' : line))
+		const diff = { before: beforeLines.join('\n'), after: afterLines.join('\n'), lang: 'plaintext' }
+		const lines = toolDiffLines(diff)
+
+		expect(lines.filter((line) => line.kind !== 'context')).toMatchObject([
+			{ kind: 'removed', content: 'line 400', oldLine: 401 },
+			{ kind: 'added', content: 'changed', newLine: 401 }
+		])
+		expect(lines[399]).toEqual({ kind: 'context', content: 'line 399', oldLine: 400, newLine: 400 })
+		expect(diffLineCounts(diff)).toEqual({ added: 1, removed: 1 })
+	})
+
+	it('reports a large rewrite as a whole-file change', () => {
+		const before = Array.from({ length: 1_000 }, (_, index) => `before ${index}`).join('\n')
+		const after = Array.from({ length: 1_000 }, (_, index) => `after ${index}`).join('\n')
+
+		expect(diffLineCounts({ before, after, lang: 'plaintext' })).toEqual({
+			added: 1_000,
+			removed: 1_000
+		})
+	})
+
+	it('keeps an empty streamed replacement paired with its own edit', () => {
+		const parameters =
+			'{"diffs":[{"old_string":"a","new_string":""},{"old_string":"b","new_string":"c"}]}'
+
+		expect(toolCodeDiff(message({ toolName: 'edit_code', parameters }))).toEqual({
+			before: 'a\nb',
+			after: '\nc',
+			lang: 'plaintext'
+		})
+	})
+
+	it('recognizes calls whose arguments are a whole file', () => {
+		const call = (
+			toolName: string,
+			parameters: unknown,
+			codeDiff?: ToolDisplayMessage['codeDiff']
+		) => argumentsCarryWholeFile(message({ toolName, parameters, codeDiff }))
+
+		expect(call('write_script', { path: 'f/a', content: '' })).toBe(true)
+		expect(call('edit_code', '{"code":"x')).toBe(true)
+		expect(
+			call('edit_code', { code: 'x' }, { before: 'old', after: 'x', lang: 'typescript' })
+		).toBe(true)
+		expect(call('edit_code', { diffs: [{ old_string: 'a', new_string: 'b' }] })).toBe(false)
+		expect(call('edit_script', { old_string: 'a', new_string: 'b' })).toBe(false)
+	})
+
+	it('shows each row of a small edit once', () => {
+		const lines = toolDiffLines({ before: 'a\nb\nc\n', after: 'a\nB\nc\n', lang: 'plaintext' })
+
+		expect(visibleToolDiffRows(lines, new Map())).toEqual(lines)
+		expect(lines.map((line) => line.kind)).toEqual(['context', 'removed', 'added', 'context'])
+	})
+
+	it('bounds the rows of a large rewrite', () => {
+		const before = Array.from({ length: 1_000 }, (_, index) => `before ${index}`).join('\n')
+		const after = Array.from({ length: 1_000 }, (_, index) => `after ${index}`).join('\n')
+		const lines = toolDiffLines({ before, after, lang: 'plaintext' })
+		const rows = visibleToolDiffRows(lines, new Map())
+
+		expect(rows).toHaveLength(802)
+		expect(rows[400]).toEqual({ kind: 'omitted', key: 'removed:0', count: 600 })
+		expect(rows[401]).toMatchObject({ kind: 'added', newLine: 1 })
+		expect(rows[801]).toEqual({ kind: 'omitted', key: 'added:1000', count: 600 })
+
+		// One click on a run reveals 400 more rows; the overall cap still holds until `end` is clicked.
+		const expanded = visibleToolDiffRows(lines, new Map([['removed:0', 1]]))
+		expect(expanded).toHaveLength(1_001)
+		expect(expanded[800]).toEqual({ kind: 'omitted', key: 'removed:0', count: 200 })
+		expect(expanded[1_000]).toEqual({ kind: 'omitted', key: 'end', count: 801 })
+		expect(
+			visibleToolDiffRows(
+				lines,
+				new Map([
+					['removed:0', 1],
+					['end', 1]
+				])
+			)
+		).toHaveLength(1_202)
+	})
+
+	it('highlights each line within the scope of the whole source', () => {
+		const typescript = toolCodeDiffLanguage('typescript')
+		hljs.registerLanguage(typescript.name, typescript.register)
+		const code = 'const s = `a\nb`\nconst n = 1\n'
+
+		const lines = highlightedSourceLines(code, typescript.name)
+		expect(lines).toHaveLength(3)
+		expect(lines[0]).toBe(
+			'<span class="hljs-keyword">const</span> s = <span class="hljs-string">`a</span>'
+		)
+		expect(lines[1]).toMatch(/^<span class="hljs-string">b`<\/span>/)
+		expect(highlightedSourceLines(code, typescript.name, 2)).toEqual(lines.slice(0, 2))
+		expect(highlightedSourceLines('a\nb', typescript.name)).toEqual(['a', 'b'])
+		expect(highlightedSourceLines('a\nb\n', typescript.name)).toEqual(['a', 'b'])
+		expect(highlightedSourceLines('', typescript.name)).toEqual([])
+
+		const large = Array.from({ length: 2_001 }, () => 'const a = 1 < 2').join('\n') + '\n'
+		const plain = highlightedSourceLines(large, typescript.name)
+		expect(plain).toHaveLength(2_001)
+		expect(plain[0]).toBe('const a = 1 &lt; 2')
+
+		const minified = highlightedSourceLines('x'.repeat(100_001), typescript.name)
+		expect(minified).toEqual(['x'.repeat(10_000) + '…'])
+	})
+
+	it('has a highlighter for every supported editor language', () => {
+		expect(TOOL_CODE_DIFF_LANGUAGES).toEqual(
+			expect.arrayContaining([
+				'typescript',
+				'javascript',
+				'python',
+				'json',
+				'yaml',
+				'sql',
+				'shell',
+				'powershell',
+				'php',
+				'rust',
+				'graphql',
+				'csharp',
+				'nu',
+				'java',
+				'r',
+				'go',
+				'ruby',
+				'plaintext'
+			])
+		)
+		for (const language of TOOL_CODE_DIFF_LANGUAGES) {
+			const highlighter = toolCodeDiffLanguage(language)
+			hljs.registerLanguage(highlighter.name, highlighter.register)
+			expect(() =>
+				hljs.highlight('const changed = true', { language: highlighter.name })
+			).not.toThrow()
+		}
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/toolCodeDiff.ts b/frontend/src/lib/components/copilot/chat/toolCodeDiff.ts
new file mode 100644
index 0000000000..2e5d8bf13c
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/toolCodeDiff.ts
@@ -0,0 +1,381 @@
+// This is Monaco's advanced diff engine; it supplies the same multi-line inner ranges.
+import { DefaultLinesDiffComputer } from '@codingame/monaco-vscode-api/vscode/vs/editor/common/diff/defaultLinesDiffComputer/defaultLinesDiffComputer'
+import type { ToolCodeDiff, ToolDisplayMessage } from './shared'
+
+// Builds a diff from a call's own arguments, for the moments the saved `codeDiff` does not
+// exist: while the arguments stream, when the call failed, and for transcripts saved before
+// calls recorded one. Argument diffs have no language or surrounding lines.
+const ARGS_DIFF_BY_TOOL: Record<string, (params: unknown) => ToolCodeDiff | undefined> = {
+	edit_script: (params) => argumentDiff(streamingEditArguments(params)),
+	write_script: (params) => fullContentArgumentDiff(params, 'content'),
+	edit_code: (params) => {
+		if (
+			params &&
+			typeof params === 'object' &&
+			Array.isArray((params as { diffs?: unknown }).diffs)
+		) {
+			const diffs = (params as { diffs: unknown[] }).diffs
+			return argumentDiffs(diffs.map(streamingEditArguments))
+		}
+		if (typeof params === 'string') {
+			return (
+				argumentDiffs(streamingEditArgumentsArray(params)) ??
+				fullContentArgumentDiff(params, 'code')
+			)
+		}
+		return argumentDiff(streamingEditArguments(params)) ?? fullContentArgumentDiff(params, 'code')
+	}
+}
+
+function fullContentArgumentDiff(params: unknown, key: string): ToolCodeDiff | undefined {
+	const content =
+		params && typeof params === 'object'
+			? (params as Record<string, unknown>)[key]
+			: typeof params === 'string'
+				? partialJsonString(params, key)
+				: undefined
+	return typeof content === 'string' ? { before: '', after: content, lang: 'plaintext' } : undefined
+}
+
+function argumentDiff(
+	edit: { old_string?: string; new_string?: string } | undefined
+): ToolCodeDiff | undefined {
+	return typeof edit?.old_string === 'string' || typeof edit?.new_string === 'string'
+		? {
+				before: typeof edit.old_string === 'string' ? edit.old_string : '',
+				after: typeof edit.new_string === 'string' ? edit.new_string : '',
+				lang: 'plaintext'
+			}
+		: undefined
+}
+
+function argumentDiffs(
+	edits: ({ old_string?: string; new_string?: string } | undefined)[]
+): ToolCodeDiff | undefined {
+	const diffs = edits.map(argumentDiff).filter((diff): diff is ToolCodeDiff => diff !== undefined)
+	if (diffs.length === 0) return undefined
+	return {
+		before: diffs.map((diff) => diff.before).join('\n'),
+		after: diffs.map((diff) => diff.after).join('\n'),
+		lang: 'plaintext'
+	}
+}
+
+function streamingEditArguments(
+	params: unknown
+): { old_string?: string; new_string?: string } | undefined {
+	if (params && typeof params === 'object')
+		return params as { old_string?: string; new_string?: string }
+	if (typeof params !== 'string') return undefined
+
+	return {
+		old_string: partialJsonString(params, 'old_string'),
+		new_string: partialJsonString(params, 'new_string')
+	}
+}
+
+function streamingEditArgumentsArray(
+	partialJson: string
+): { old_string?: string; new_string?: string }[] {
+	const oldStrings = partialJsonStrings(partialJson, 'old_string')
+	const newStrings = partialJsonStrings(partialJson, 'new_string')
+	return Array.from({ length: Math.max(oldStrings.length, newStrings.length) }, (_, index) => ({
+		old_string: oldStrings[index],
+		new_string: newStrings[index]
+	}))
+}
+
+function partialJsonString(partialJson: string, key: string): string | undefined {
+	return partialJsonStrings(partialJson, key)[0]
+}
+
+function partialJsonStrings(partialJson: string, key: string): string[] {
+	const matches = partialJson.matchAll(new RegExp(`"${key}"\\s*:\\s*"((?:[^"\\\\]|\\\\.)*)`, 'g'))
+	const result: string[] = []
+	// An empty string is a real value (a deletion): skipping it would pair the next edit's
+	// `new_string` with this edit's `old_string`.
+	for (const match of matches) {
+		try {
+			result.push(JSON.parse(`"${match[1]}"`))
+		} catch {
+			continue
+		}
+	}
+	return result
+}
+
+export function hasToolCodeDiff(toolName: string | undefined): boolean {
+	return toolName !== undefined && Object.hasOwn(ARGS_DIFF_BY_TOOL, toolName)
+}
+
+export function toolCodeDiff(message: ToolDisplayMessage): ToolCodeDiff | undefined {
+	if (message.codeDiff) return message.codeDiff
+	if (!message.toolName) return undefined
+	return Object.hasOwn(ARGS_DIFF_BY_TOOL, message.toolName)
+		? ARGS_DIFF_BY_TOOL[message.toolName](message.parameters)
+		: undefined
+}
+
+// Decided by tool and argument shape, never by the saved `codeDiff`: an overwrite's saved diff
+// has a before side, and clearing a script leaves both argument sides empty, yet both calls sent
+// a whole file.
+export function argumentsCarryWholeFile(message: ToolDisplayMessage): boolean {
+	if (message.toolName === 'write_script') return true
+	if (message.toolName !== 'edit_code') return false
+	const params = message.parameters
+	if (typeof params === 'string') return /"code"\s*:/.test(params)
+	return Boolean(params && typeof params === 'object' && 'code' in params)
+}
+
+export function diffLineCounts(
+	diff: ToolCodeDiff,
+	streaming = false
+): { added: number; removed: number } {
+	if (streaming) {
+		return { added: lines(diff.after).length, removed: lines(diff.before).length }
+	}
+
+	return toolDiffLineCounts(toolDiffLines(diff))
+}
+
+export function toolDiffLineCounts(lines: ToolDiffLine[]): { added: number; removed: number } {
+	let added = 0
+	let removed = 0
+	for (const line of lines) {
+		if (line.kind === 'added') added++
+		else if (line.kind === 'removed') removed++
+	}
+	return { added, removed }
+}
+
+export type ToolDiffLine = {
+	kind: 'context' | 'added' | 'removed'
+	content: string
+	oldLine?: number
+	newLine?: number
+	changedRanges?: CharacterRange[]
+}
+
+export type CharacterRange = { start: number; length: number; extendsToEnd?: boolean }
+
+const STREAMING_PREVIEW_LINES = 200
+
+function lines(value: string): string[] {
+	const result = value.split('\n')
+	if (result.at(-1) === '') result.pop()
+	return result
+}
+
+function hasFinalNewline(value: string): boolean {
+	return value.endsWith('\n')
+}
+
+export function toolDiffLines(diff: ToolCodeDiff, streaming = false): ToolDiffLine[] {
+	const before = lines(diff.before)
+	const after = lines(diff.after)
+	if (streaming) return streamingDiffLines(before, after)
+
+	const result: ToolDiffLine[] = []
+	const monacoBefore = monacoLines(diff.before)
+	const monacoAfter = monacoLines(diff.after)
+	// Runs on the UI thread. Cost follows the amount changed, not file size: only a large
+	// rewrite reaches the cap, and Monaco then reports the whole file as one change.
+	const changes = new DefaultLinesDiffComputer().computeDiff(monacoBefore, monacoAfter, {
+		ignoreTrimWhitespace: false,
+		maxComputationTimeMs: 200,
+		computeMoves: false,
+		extendToSubwords: false
+	}).changes
+	const removedRanges = new Map<number, CharacterRange[]>()
+	const addedRanges = new Map<number, CharacterRange[]>()
+	for (const change of changes) {
+		for (const innerChange of change.innerChanges ?? []) {
+			addCharacterRanges(removedRanges, monacoBefore, innerChange.originalRange)
+			addCharacterRanges(addedRanges, monacoAfter, innerChange.modifiedRange)
+		}
+	}
+
+	let oldIndex = 0
+	let newIndex = 0
+	for (const change of changes) {
+		const oldStart = change.original.startLineNumber - 1
+		const newStart = change.modified.startLineNumber - 1
+		appendContextLines(
+			result,
+			before,
+			after,
+			oldIndex,
+			newIndex,
+			Math.min(oldStart - oldIndex, newStart - newIndex)
+		)
+		appendChangedLines(
+			result,
+			'removed',
+			before,
+			oldStart,
+			change.original.endLineNumberExclusive - 1,
+			removedRanges
+		)
+		appendChangedLines(
+			result,
+			'added',
+			after,
+			newStart,
+			change.modified.endLineNumberExclusive - 1,
+			addedRanges
+		)
+		oldIndex = Math.min(change.original.endLineNumberExclusive - 1, before.length)
+		newIndex = Math.min(change.modified.endLineNumberExclusive - 1, after.length)
+	}
+	const trailingContext = Math.max(0, Math.min(before.length - oldIndex, after.length - newIndex))
+	appendContextLines(result, before, after, oldIndex, newIndex, trailingContext)
+	oldIndex += trailingContext
+	newIndex += trailingContext
+	appendChangedLines(result, 'removed', before, oldIndex, before.length, removedRanges)
+	appendChangedLines(result, 'added', after, newIndex, after.length, addedRanges)
+	if (
+		diff.before !== '' &&
+		diff.after !== '' &&
+		hasFinalNewline(diff.before) !== hasFinalNewline(diff.after)
+	) {
+		result.push(
+			hasFinalNewline(diff.before)
+				? { kind: 'removed', content: '', oldLine: before.length + 1 }
+				: { kind: 'added', content: '', newLine: after.length + 1 }
+		)
+	}
+
+	return result
+}
+
+export type VisibleToolDiffRow =
+	| ToolDiffLine
+	| { kind: 'collapsed'; key: string; count: number }
+	| { kind: 'omitted'; key: string; count: number }
+
+const CONTEXT_LINES = 3
+// Every visible row is a DOM row with no virtualization, and only context collapses: a whole-file
+// rewrite would otherwise render every line of both sides. Two capped runs fit under the overall
+// cap, so a rewrite still shows its added side. Each expansion of an omitted row reveals one more
+// cap's worth, so no single click renders an unbounded number of rows.
+const MAX_CHANGED_RUN_ROWS = 400
+const MAX_VISIBLE_ROWS = 1_000
+
+// `expansions` counts the clicks on each collapsed or omitted row, by its key.
+export function visibleToolDiffRows(
+	lines: ToolDiffLine[],
+	expansions: ReadonlyMap<string, number>
+): VisibleToolDiffRow[] {
+	const result: VisibleToolDiffRow[] = []
+	for (let index = 0; index < lines.length; ) {
+		const start = index
+		const kind = lines[start].kind
+		while (index < lines.length && lines[index].kind === kind) index++
+		const count = index - start
+
+		if (kind !== 'context') {
+			const key = `${kind}:${start}`
+			const shown = MAX_CHANGED_RUN_ROWS * (1 + (expansions.get(key) ?? 0))
+			result.push(...lines.slice(start, Math.min(index, start + shown)))
+			if (count > shown) result.push({ kind: 'omitted', key, count: count - shown })
+			continue
+		}
+
+		const key = `${lines[start].oldLine}:${lines[start].newLine}:${count}`
+		if (count <= CONTEXT_LINES * 2 + 1 || expansions.has(key)) {
+			result.push(...lines.slice(start, index))
+			continue
+		}
+		result.push(...lines.slice(start, start + CONTEXT_LINES))
+		result.push({ kind: 'collapsed', key, count: count - CONTEXT_LINES * 2 })
+		result.push(...lines.slice(index - CONTEXT_LINES, index))
+	}
+
+	const maxRows = MAX_VISIBLE_ROWS * (1 + (expansions.get('end') ?? 0))
+	if (result.length <= maxRows) return result
+	const hidden = result
+		.slice(maxRows)
+		.reduce((total, row) => total + ('count' in row ? row.count : 1), 0)
+	return [...result.slice(0, maxRows), { kind: 'omitted', key: 'end', count: hidden }]
+}
+
+function streamingDiffLines(before: string[], after: string[]): ToolDiffLine[] {
+	return [
+		...before
+			.slice(0, STREAMING_PREVIEW_LINES)
+			.map((content, index) => ({ kind: 'removed' as const, content, oldLine: index + 1 })),
+		...after
+			.slice(0, STREAMING_PREVIEW_LINES)
+			.map((content, index) => ({ kind: 'added' as const, content, newLine: index + 1 }))
+	]
+}
+
+function monacoLines(value: string): string[] {
+	const result = lines(value)
+	return result.length ? result : ['']
+}
+
+function appendContextLines(
+	result: ToolDiffLine[],
+	before: string[],
+	after: string[],
+	oldStart: number,
+	newStart: number,
+	count: number
+): void {
+	for (let index = 0; index < count; index++) {
+		result.push({
+			kind: 'context',
+			content: before[oldStart + index],
+			oldLine: oldStart + index + 1,
+			newLine: newStart + index + 1
+		})
+	}
+}
+
+function appendChangedLines(
+	result: ToolDiffLine[],
+	kind: 'added' | 'removed',
+	source: string[],
+	start: number,
+	end: number,
+	ranges: Map<number, CharacterRange[]>
+): void {
+	for (let index = start; index < Math.min(end, source.length); index++) {
+		const changedRanges = ranges.get(index + 1)
+		result.push({
+			kind,
+			content: source[index],
+			...(kind === 'added' ? { newLine: index + 1 } : { oldLine: index + 1 }),
+			...(changedRanges?.length ? { changedRanges } : {})
+		})
+	}
+}
+
+function addCharacterRanges(
+	ranges: Map<number, CharacterRange[]>,
+	lines: string[],
+	range: {
+		startLineNumber: number
+		startColumn: number
+		endLineNumber: number
+		endColumn: number
+	}
+): void {
+	for (
+		let lineNumber = range.startLineNumber;
+		lineNumber <= Math.min(range.endLineNumber, lines.length);
+		lineNumber++
+	) {
+		const content = lines[lineNumber - 1]
+		const start = lineNumber === range.startLineNumber ? range.startColumn - 1 : 0
+		const extendsToEnd = lineNumber < range.endLineNumber
+		const end = extendsToEnd ? content.length : range.endColumn - 1
+		if (end > start) {
+			ranges.set(lineNumber, [
+				...(ranges.get(lineNumber) ?? []),
+				{ start, length: end - start, ...(extendsToEnd ? { extendsToEnd } : {}) }
+			])
+		}
+	}
+}
diff --git a/frontend/src/lib/components/copilot/chat/toolCodeDiffHighlight.ts b/frontend/src/lib/components/copilot/chat/toolCodeDiffHighlight.ts
new file mode 100644
index 0000000000..b63d002e9e
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/toolCodeDiffHighlight.ts
@@ -0,0 +1,57 @@
+import hljs from 'highlight.js/lib/core'
+import { escapeHtml } from '$lib/utils'
+
+// highlight.js runs on the UI thread at roughly 15 ms per 1,000 lines (50 KB), and must see the
+// whole source for multi-line strings and comments to scope correctly. Larger sides, including
+// minified one-line sources, render as plain text with each line cut at MAX_PLAIN_LINE_CHARS.
+const MAX_HIGHLIGHTED_LINES = 2_000
+const MAX_HIGHLIGHTED_CHARS = 100_000
+const MAX_PLAIN_LINE_CHARS = 10_000
+
+// Highlights the whole source before splitting it, so a line inside a multi-line string or
+// comment keeps that scope. Only the first `lineLimit` lines are highlighted: a streamed source
+// grows on every delta while the preview shows a bounded prefix.
+export function highlightedSourceLines(
+	code: string,
+	languageName: string,
+	lineLimit = Infinity
+): string[] {
+	if (code === '' || lineLimit <= 0) return []
+	const sourceLines = code.split('\n')
+	const truncated = sourceLines.length > lineLimit
+	const shownLines = truncated ? sourceLines.slice(0, lineLimit) : sourceLines
+	const source = truncated ? shownLines.join('\n') : code
+	if (shownLines.length > MAX_HIGHLIGHTED_LINES || source.length > MAX_HIGHLIGHTED_CHARS) {
+		const plain = shownLines.map((line) =>
+			escapeHtml(
+				line.length > MAX_PLAIN_LINE_CHARS ? line.slice(0, MAX_PLAIN_LINE_CHARS) + '…' : line
+			)
+		)
+		if (!truncated && code.endsWith('\n')) plain.pop()
+		return plain
+	}
+	const highlighted = hljs.highlight(source, { language: languageName }).value
+	return splitHighlightedLines(highlighted, !truncated && code.endsWith('\n'))
+}
+
+// Returns one entry per source line, closing the spans still open at each line end and
+// reopening them on the next line so every entry is balanced HTML.
+export function splitHighlightedLines(highlighted: string, hasFinalNewline: boolean): string[] {
+	const result: string[] = []
+	const openTags: string[] = []
+	let line = ''
+
+	for (const token of highlighted.split(/(<[^>]+>|\n)/)) {
+		if (token === '\n') {
+			result.push(line + '</span>'.repeat(openTags.length))
+			line = openTags.join('')
+		} else {
+			line += token
+			if (token.startsWith('<span')) openTags.push(token)
+			else if (token === '</span>') openTags.pop()
+		}
+	}
+
+	if (!hasFinalNewline) result.push(line)
+	return result
+}
diff --git a/frontend/src/lib/components/copilot/chat/toolCodeDiffLanguage.ts b/frontend/src/lib/components/copilot/chat/toolCodeDiffLanguage.ts
new file mode 100644
index 0000000000..ddf2464136
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/toolCodeDiffLanguage.ts
@@ -0,0 +1,43 @@
+import { csharp, go, java, json, plaintext, type LanguageType } from 'svelte-highlight/languages'
+import graphql from 'svelte-highlight/languages/graphql'
+import javascript from 'svelte-highlight/languages/javascript'
+import php from 'svelte-highlight/languages/php'
+import python from 'svelte-highlight/languages/python'
+import powershell from 'svelte-highlight/languages/powershell'
+import r from 'svelte-highlight/languages/r'
+import ruby from 'svelte-highlight/languages/ruby'
+import rust from 'svelte-highlight/languages/rust'
+import shell from 'svelte-highlight/languages/shell'
+import sql from 'svelte-highlight/languages/sql'
+import typescript from 'svelte-highlight/languages/typescript'
+import yaml from 'svelte-highlight/languages/yaml'
+
+// Keyed by the editor language `scriptLangToEditorLang` returns, not the script language.
+// for related places search: ADD_NEW_LANG
+const LANGUAGE_BY_MONACO: Record<string, LanguageType<string>> = {
+	typescript,
+	javascript,
+	python,
+	json,
+	yaml,
+	sql,
+	shell,
+	powershell,
+	php,
+	rust,
+	graphql,
+	csharp,
+	nu: python,
+	java,
+	r,
+	go,
+	ruby,
+	text: plaintext,
+	plaintext
+}
+
+export const TOOL_CODE_DIFF_LANGUAGES = Object.keys(LANGUAGE_BY_MONACO)
+
+export function toolCodeDiffLanguage(language: string): LanguageType<string> {
+	return LANGUAGE_BY_MONACO[language] ?? plaintext
+}
diff --git a/frontend/src/lib/components/copilot/chat/typewriterReveal.ts b/frontend/src/lib/components/copilot/chat/typewriterReveal.ts
index 0cc1d75ac3..93b33962ee 100644
--- a/frontend/src/lib/components/copilot/chat/typewriterReveal.ts
+++ b/frontend/src/lib/components/copilot/chat/typewriterReveal.ts
@@ -9,6 +9,13 @@
 // state is the `onReveal` callback — so the pacing is unit-testable with an
 // injected clock and scheduler.
 
+import { BROWSER } from 'esm-env'
+
+/** SSR and readers who prefer reduced motion get no pacing: text lands as it arrives. */
+export function prefersInstantReveal(): boolean {
+	return !BROWSER || (window.matchMedia?.('(prefers-reduced-motion: reduce)').matches ?? false)
+}
+
 type Schedule = (cb: () => void) => unknown
 type Cancel = (handle: unknown) => void
 
diff --git a/frontend/src/lib/components/copilot/lib.test.ts b/frontend/src/lib/components/copilot/lib.test.ts
index 964bf6e703..8e06e0e2b9 100644
--- a/frontend/src/lib/components/copilot/lib.test.ts
+++ b/frontend/src/lib/components/copilot/lib.test.ts
@@ -13,7 +13,7 @@ import {
 import { parseFimCompletionChoice } from './fim'
 import {
 	getKnownModelContextWindow,
-	getModelContextWindow,
+	getModelContextWindowFromTable,
 	modelSupportsVision,
 	requiresMaxCompletionTokens
 } from './modelConfig'
@@ -263,6 +263,7 @@ describe('model context windows', () => {
 		expect(getKnownModelContextWindow('gemini-3-flash')).toBe(1000000)
 		expect(getKnownModelContextWindow('gemini-2.5-flash')).toBe(1000000)
 		expect(getKnownModelContextWindow('deepseek-v4-pro')).toBe(1000000)
+		expect(getKnownModelContextWindow('deepseek-flash')).toBe(1000000)
 		expect(getKnownModelContextWindow('deepseek-chat')).toBe(1000000)
 		expect(getKnownModelContextWindow('deepseek-reasoner')).toBe(1000000)
 	})
@@ -289,12 +290,12 @@ describe('model context windows', () => {
 		// a version between "qwen3" and "-max" must not claim the 256K entry, and
 		// there is deliberately no qwen family entry (variant windows range 8K–1M)
 		expect(getKnownModelContextWindow('qwen3.8-max')).toBeUndefined()
-		expect(getModelContextWindow('qwen3.8-max')).toBe(128000)
+		expect(getModelContextWindowFromTable('qwen3.8-max')).toBe(128000)
 	})
 
 	it('returns undefined for unrecognized models, 128K via the defaulting wrapper', () => {
 		expect(getKnownModelContextWindow('some-custom-model')).toBeUndefined()
-		expect(getModelContextWindow('some-custom-model')).toBe(128000)
+		expect(getModelContextWindowFromTable('some-custom-model')).toBe(128000)
 	})
 })
 
diff --git a/frontend/src/lib/components/copilot/lib.toolCalls.test.ts b/frontend/src/lib/components/copilot/lib.toolCalls.test.ts
index c665cc964e..6966e018d1 100644
--- a/frontend/src/lib/components/copilot/lib.toolCalls.test.ts
+++ b/frontend/src/lib/components/copilot/lib.toolCalls.test.ts
@@ -285,3 +285,65 @@ describe('parseOpenAICompletion tool call arguments', () => {
 		expect(toolResult.content).toBe('tool ok')
 	})
 })
+
+describe('output token limit', () => {
+	it('follows the model through every host that serves it', async () => {
+		const { getModelMaxTokens } = await import('./lib')
+		expect(getModelMaxTokens('deepseek', 'deepseek-flash')).toBe(131072)
+		expect(getModelMaxTokens('azure_foundry', 'DeepSeek-V4-Pro')).toBe(131072)
+		expect(getModelMaxTokens('openrouter', 'deepseek/deepseek-v4-pro')).toBe(131072)
+		// gpt-oss reasons whether or not the chat sends an effort.
+		expect(getModelMaxTokens('groq', 'openai/gpt-oss-120b')).toBe(16000)
+		expect(getModelMaxTokens('openrouter', 'openai/o3')).toBe(100000)
+		// A legacy `/thinking` selection is its base model, not the `thinking` row.
+		expect(getModelMaxTokens('anthropic', 'claude-sonnet-4-5/thinking')).toBe(64000)
+	})
+
+	it('gives a model outside the table room to think only when the request asks it to', async () => {
+		const { getModelMaxTokens } = await import('./lib')
+		expect(getModelMaxTokens('openrouter', 'x-ai/grok-4.3', 'high')).toBe(32768)
+		expect(getModelMaxTokens('openrouter', 'x-ai/grok-4.3', 'none')).toBe(8192)
+		expect(getModelMaxTokens('openrouter', 'x-ai/grok-4.3')).toBe(8192)
+		// The registry does not know Custom AI models, so an effort says nothing about them.
+		expect(getModelMaxTokens('customai', 'local-model', 'high')).toBe(8192)
+		// A self-hosted open-weight model runs at its operator's context length, not the
+		// vendor's, while a Custom AI proxy in front of a hosted model keeps its row.
+		expect(getModelMaxTokens('customai', 'deepseek-v4-pro', 'high')).toBe(8192)
+		expect(getModelMaxTokens('customai', 'gpt-5')).toBe(128000)
+	})
+
+	it('sizes the budget from the effort the same request carries', async () => {
+		const { getCompletion } = await import('./lib')
+		const create = vi.fn()
+
+		await getCompletion([], new AbortController(), undefined, {
+			forceModelProvider: { provider: 'mistral', model: 'mistral-medium-latest' },
+			openaiClient: { chat: { completions: { create } } } as any,
+			reasoningEffort: 'high'
+		})
+
+		expect(create.mock.calls[0][0]).toMatchObject({ max_tokens: 32768, reasoning_effort: 'high' })
+	})
+
+	it('fails a response cut off at the output token limit instead of ending the turn', async () => {
+		const { parseOpenAICompletion } = await import('./lib')
+		const { OutputTokenLimitError } = await import('./chat/outputTokenLimit')
+
+		// Thinking counts toward max_tokens, so the cap can land before any answer.
+		const parsed = parseOpenAICompletion(
+			streamOf([
+				{ choices: [{ delta: { reasoning_content: 'I need to plan the flow so each' } }] },
+				{ choices: [{ delta: {}, finish_reason: 'length' }] }
+			]),
+			createCallbacks(),
+			[],
+			[],
+			[],
+			{},
+			undefined,
+			{ workspace: 'test' }
+		)
+
+		await expect(parsed).rejects.toBeInstanceOf(OutputTokenLimitError)
+	})
+})
diff --git a/frontend/src/lib/components/copilot/lib.ts b/frontend/src/lib/components/copilot/lib.ts
index 19f350a665..655a872f96 100644
--- a/frontend/src/lib/components/copilot/lib.ts
+++ b/frontend/src/lib/components/copilot/lib.ts
@@ -15,11 +15,17 @@ import { get, type Writable } from 'svelte/store'
 import { OpenAPI, ResourceService, type Script } from '../../gen'
 import { EDIT_CONFIG, FIX_CONFIG, GEN_CONFIG } from './prompts'
 import {
+	getKnownModelMaxOutputTokens,
 	requiresMaxCompletionTokens,
 	usesAnthropicMessagesApi,
 	usesOpenRouterPromptCaching
 } from './modelConfig'
-import { applyReasoningToConfig } from './reasoningRegistry'
+import {
+	applyReasoningToConfig,
+	requestsReasoning,
+	stripLegacyThinkingSuffix,
+	type ReasoningEffort
+} from './reasoningRegistry'
 import { formatResourceTypes } from './utils'
 import {
 	appendPendingToolImages,
@@ -28,6 +34,7 @@ import {
 	type Tool,
 	type ToolCallbacks
 } from './chat/shared'
+import { OutputTokenLimitError } from './chat/outputTokenLimit'
 import { hasValidToolCallArguments } from './chat/toolCallArguments'
 import {
 	getNonStreamingOpenAIResponsesCompletion,
@@ -116,7 +123,7 @@ export const AI_PROVIDERS: Record<AIProvider, AIProviderDetails> = {
 	},
 	deepseek: {
 		label: 'DeepSeek',
-		defaultModels: ['deepseek-v4-pro', 'deepseek-v4-flash']
+		defaultModels: ['deepseek-v4-pro', 'deepseek-flash']
 	},
 	groq: {
 		label: 'Groq',
@@ -309,40 +316,31 @@ export async function fetchAvailableModels(
 	return data?.data.map((m) => m.id) ?? []
 }
 
-export function getModelMaxTokens(provider: AIProvider, model: string) {
-	if (model.includes('gpt-5')) {
-		return 128000
-	} else if (
-		(provider === 'azure_openai' || provider === 'openai' || provider === 'azure_foundry') &&
-		model.startsWith('o')
-	) {
-		return 100000
-	} else if (
-		// Raising this further would also raise the worst case of the
-		// non-streaming completion path, which the Anthropic SDK refuses once
-		// the request could run past ~10 minutes.
-		model.includes('claude-sonnet') ||
-		model.includes('claude-haiku') ||
-		model.includes('claude-fable') ||
-		model.includes('claude-mythos') ||
-		// Opus only from 4.5 on. Opus 4.1 and older cap at 32K and fall through
-		// to the row below. Dots are normalized because OpenRouter writes
-		// `anthropic/claude-opus-4.5` where Anthropic writes `claude-opus-4-5`.
-		/claude-opus-(4-(5|6|7|8)|5)(?!\d)/.test(model.replace(/\./g, '-')) ||
-		model.includes('gemini-2.5') ||
-		model.includes('gemini-3')
-	) {
-		return 64000
-	} else if (model.includes('gpt-4.1')) {
-		return 32768
-	} else if (model.includes('claude-opus')) {
-		return 32000
-	} else if (model.includes('gpt-4o') || model.includes('codestral')) {
-		return 16384
-	} else if (model.includes('gpt-4-turbo') || model.includes('gpt-3.5')) {
-		return 4096
-	}
-	return 8192
+// Thinking counts toward max_tokens, so a model outside the table that is asked to
+// reason gets more room than the plain fallback. A host rejects a budget above the
+// model's cap, so the reasoning fallback must stay within the cap of every model it
+// reaches (true of every reasoning model OpenRouter serves outside the table). Custom
+// AI never gets it: the registry does not know its models, and the per-model override
+// is its way to a larger budget.
+const FALLBACK_MAX_TOKENS = 8192
+const REASONING_FALLBACK_MAX_TOKENS = 32768
+
+/**
+ * The output budget a request sends when the workspace sets no override. `reasoningEffort`
+ * is the effort the request carries, as `resolveRequestReasoning` resolves it.
+ */
+export function getModelMaxTokens(
+	provider: AIProvider,
+	model: string,
+	reasoningEffort?: ReasoningEffort
+): number {
+	const bareModel = stripLegacyThinkingSuffix(model)
+	return (
+		getKnownModelMaxOutputTokens(provider, bareModel) ??
+		(requestsReasoning(provider, bareModel, reasoningEffort)
+			? REASONING_FALLBACK_MAX_TOKENS
+			: FALLBACK_MAX_TOKENS)
+	)
 }
 
 // Resolves the completion token cap for a model: the workspace's per-model
@@ -350,8 +348,16 @@ export function getModelMaxTokens(provider: AIProvider, model: string) {
 // Anthropic request paths so both honor the same limit. `cap` bounds the result
 // (used by short metadata completions, see METADATA_MAX_TOKENS) — a hard ceiling
 // that wins over both the workspace override and the default.
-function resolveMaxTokens(modelProvider: AIProviderModel, cap?: number): number {
-	const defaultMaxTokens = getModelMaxTokens(modelProvider.provider, modelProvider.model)
+function resolveMaxTokens(
+	modelProvider: AIProviderModel,
+	cap?: number,
+	reasoningEffort?: ReasoningEffort
+): number {
+	const defaultMaxTokens = getModelMaxTokens(
+		modelProvider.provider,
+		modelProvider.model,
+		reasoningEffort
+	)
 	const modelKey = `${modelProvider.provider}:${modelProvider.model}`
 	let customMaxTokensStore: Record<string, number> | undefined
 	try {
@@ -373,9 +379,10 @@ export const METADATA_MAX_TOKENS = 4096
 function getModelSpecificConfig(
 	modelProvider: AIProviderModel,
 	tools?: OpenAI.Chat.Completions.ChatCompletionTool[],
-	maxTokensCap?: number
+	maxTokensCap?: number,
+	reasoningEffort?: ReasoningEffort
 ) {
-	const maxTokens = resolveMaxTokens(modelProvider, maxTokensCap)
+	const maxTokens = resolveMaxTokens(modelProvider, maxTokensCap, reasoningEffort)
 	if (
 		(modelProvider.provider === 'openai' ||
 			modelProvider.provider === 'azure_openai' ||
@@ -897,7 +904,8 @@ export function getProviderAndCompletionConfig<K extends boolean>({
 	tools,
 	forceModelProvider,
 	maxTokensCap,
-	promptCaching
+	promptCaching,
+	reasoningEffort
 }: {
 	messages: ChatCompletionMessageParam[]
 	stream: K
@@ -907,6 +915,9 @@ export function getProviderAndCompletionConfig<K extends boolean>({
 	// Opt-in: a cache write costs more than an uncached read, so it only pays off where
 	// the same prefix is sent again. True for the chat loop, false for one-shot calls.
 	promptCaching?: boolean
+	// The effort the caller will add with `applyReasoningToConfig`. Only sizes the
+	// output budget here: a request that reasons needs room for the thinking.
+	reasoningEffort?: ReasoningEffort
 }): {
 	provider: AIProvider
 	config: K extends true
@@ -923,7 +934,7 @@ export function getProviderAndCompletionConfig<K extends boolean>({
 		provider: modelProvider.provider,
 		config: {
 			...providerConfig,
-			...getModelSpecificConfig(modelProvider, tools, maxTokensCap),
+			...getModelSpecificConfig(modelProvider, tools, maxTokensCap, reasoningEffort),
 			messages: processedMessages,
 			stream
 		} as any
@@ -1129,7 +1140,8 @@ export async function getCompletion(
 		stream: true,
 		tools,
 		forceModelProvider: options?.forceModelProvider,
-		promptCaching: options?.promptCaching
+		promptCaching: options?.promptCaching,
+		reasoningEffort: options?.reasoningEffort
 	})
 
 	// Use Responses API for OpenAI and Azure OpenAI
@@ -1218,6 +1230,7 @@ export async function parseOpenAICompletion(
 	// to the next call, the previous one is demoted to queued.
 	let streamingToolCallId: string | undefined = undefined
 	let malformedFunctionCallError = false
+	let hitOutputTokenLimit = false
 	let tokenUsage = emptyChatTokenUsage()
 
 	let answer = ''
@@ -1244,6 +1257,9 @@ export async function parseOpenAICompletion(
 		) {
 			malformedFunctionCallError = true
 		}
+		if (finishReason === 'length') {
+			hitOutputTokenLimit = true
+		}
 
 		// Mistral nests reasoning inside structured content parts; split them out
 		// so a content delta never leaks "[object Object]" into the answer.
@@ -1417,7 +1433,8 @@ export async function parseOpenAICompletion(
 				toolCall,
 				helpers,
 				toolCallbacks: callbacks,
-				workspace: options?.workspace
+				workspace: options?.workspace,
+				messages
 			})
 			messages.push(messageToAdd)
 			addedMessages.push(messageToAdd)
@@ -1460,6 +1477,8 @@ export async function parseOpenAICompletion(
 		}
 		messages.push(toolResponse)
 		addedMessages.push(toolResponse)
+	} else if (hitOutputTokenLimit) {
+		throw new OutputTokenLimitError()
 	} else {
 		return { shouldContinue: false, tokenUsage }
 	}
diff --git a/frontend/src/lib/components/copilot/modelConfig.test.ts b/frontend/src/lib/components/copilot/modelConfig.test.ts
index 1788d9c365..4f54eb223a 100644
--- a/frontend/src/lib/components/copilot/modelConfig.test.ts
+++ b/frontend/src/lib/components/copilot/modelConfig.test.ts
@@ -1,5 +1,27 @@
 import { describe, expect, it } from 'vitest'
-import { usesAnthropicMessagesApi } from './modelConfig'
+import {
+	getConfiguredModelContextWindow,
+	getEffectiveModelContextWindow,
+	usesAnthropicMessagesApi
+} from './modelConfig'
+
+describe('workspace context window overrides', () => {
+	const overrides = { 'customai:qwen-local': 32_768, 'anthropic:claude-sonnet-5': 200_000 }
+
+	it('wins over the built-in table and the assumed window for its exact provider:model', () => {
+		expect(getEffectiveModelContextWindow('customai', 'qwen-local', overrides)).toBe(32_768)
+		expect(getConfiguredModelContextWindow('customai', 'qwen-local', overrides)).toBe(32_768)
+		expect(getEffectiveModelContextWindow('anthropic', 'claude-sonnet-5', overrides)).toBe(200_000)
+	})
+
+	it('does not apply to the same model id served by another provider', () => {
+		expect(getEffectiveModelContextWindow('openrouter', 'claude-sonnet-5', overrides)).toBe(
+			1_000_000
+		)
+		expect(getConfiguredModelContextWindow('openai', 'qwen-local', overrides)).toBeUndefined()
+		expect(getEffectiveModelContextWindow('openai', 'qwen-local', overrides)).toBe(128_000)
+	})
+})
 
 describe('usesAnthropicMessagesApi', () => {
 	it('routes the native Anthropic provider through the Messages API', () => {
diff --git a/frontend/src/lib/components/copilot/modelConfig.ts b/frontend/src/lib/components/copilot/modelConfig.ts
index cc45a23dac..77d0cf942a 100644
--- a/frontend/src/lib/components/copilot/modelConfig.ts
+++ b/frontend/src/lib/components/copilot/modelConfig.ts
@@ -66,9 +66,9 @@ export function requiresMaxCompletionTokens(model: string) {
 // ids (anthropic.claude-sonnet-4-6-...-v1:0, gpt-5.2-2026-01-01) still resolve.
 // Conservative family fallbacks sit below the explicit entries; models not
 // listed at all resolve to undefined. Consumers that need a number regardless
-// (trim/compaction, the usage indicator) go through getModelContextWindow,
-// whose conservative 128K fallback keeps a limit enforced and is surfaced to
-// the user as an assumed window.
+// (trim/compaction, the usage indicator) go through
+// getEffectiveModelContextWindow, whose conservative 128K fallback keeps a
+// limit enforced and is surfaced to the user as an assumed window.
 const MODEL_CONTEXT_WINDOWS: [name: string, contextWindow: number][] = [
 	// Anthropic — Sonnet/Opus 4.6+ ship a 1M window at standard pricing (GA);
 	// Haiku, older Claude models (3.x, 4.0, 4.1, 4.5) and date-suffixed Claude 4
@@ -96,10 +96,12 @@ const MODEL_CONTEXT_WINDOWS: [name: string, contextWindow: number][] = [
 	['gemini-3.1', 1_000_000],
 	['gemini-3', 1_000_000],
 	['gemini-2.5', 1_000_000],
-	// DeepSeek — the V4 family (pro / flash) is 1M. The deepseek-chat /
-	// deepseek-reasoner aliases were retired 2026-07-24 but can still sit in a
-	// saved selection, so they keep resolving to the window they had.
+	// DeepSeek — the V4 family (pro / flash) is 1M; V4.1 Flash is served as
+	// `deepseek-flash`. The deepseek-chat / deepseek-reasoner aliases were retired
+	// 2026-07-24 but can still sit in a saved selection, so they keep resolving to
+	// the window they had.
 	['deepseek-v4', 1_000_000],
+	['deepseek-flash', 1_000_000],
 	['deepseek-chat', 1_000_000],
 	['deepseek-reasoner', 1_000_000],
 	['deepseek', 128_000],
@@ -115,6 +117,58 @@ const MODEL_CONTEXT_WINDOWS: [name: string, contextWindow: number][] = [
 	['codestral', 32_000]
 ]
 
+// Output token budgets, matched like the context windows above so one row covers
+// every host of a model: native API, Azure AI Foundry, OpenRouter, Together, Bedrock.
+// A host rejects any request above its own limit, so each value is one every host of
+// the model accepts, not the vendor's maximum. Models not listed fall back in
+// `getModelMaxTokens`.
+const MODEL_MAX_OUTPUT_TOKENS: [name: string, maxOutputTokens: number][] = [
+	// Anthropic — the Anthropic SDK refuses a non-streaming request whose max_tokens
+	// implies more than ~10 minutes, so these stay below the models' own maximum.
+	// Opus caps at 32K before 4.5.
+	['claude-opus-4.5', 64_000],
+	['claude-opus-4.6', 64_000],
+	['claude-opus-4.7', 64_000],
+	['claude-opus-4.8', 64_000],
+	['claude-opus-5', 64_000],
+	['claude-opus', 32_000],
+	['claude-sonnet', 64_000],
+	['claude-haiku', 64_000],
+	['claude-fable', 64_000],
+	['claude-mythos', 64_000],
+	// OpenAI
+	['gpt-5', 128_000],
+	['gpt-4.1', 32_768],
+	['gpt-4o', 16_384],
+	['gpt-4-turbo', 4_096],
+	['gpt-3.5', 4_096],
+	['o1', 100_000],
+	['o3', 100_000],
+	['o4-mini', 100_000],
+	// Google
+	['gemini-3', 64_000],
+	['gemini-2.5', 64_000]
+]
+
+// Open-weight models, which a self-hosted server (Custom AI) caps at whatever context
+// length its operator set, often below these: vLLM rejects a request whose prompt plus
+// max_tokens exceeds it. So these rows only apply to the providers that host them.
+const OPEN_WEIGHT_MAX_OUTPUT_TOKENS: [name: string, maxOutputTokens: number][] = [
+	// gpt-oss reasons on every request. Bedrock documents 16K, where Groq takes 65536
+	['gpt-oss', 16_000],
+	// DeepSeek — thinks by default and counts the thinking toward max_tokens. 131072
+	// is DeepSeek's own default at the highest effort. R1 is capped by its OpenRouter
+	// host.
+	['deepseek-v4', 131_072],
+	['deepseek-flash', 131_072],
+	['deepseek-r1', 16_000],
+	// Mistral
+	['codestral', 16_384],
+	// Models named for thinking reason on every request, whether or not the chat sends
+	// an effort. Every one OpenRouter lists takes at least this much.
+	['thinking', 32_768]
+]
+
 // Version separators differ by route to the same model: Anthropic writes
 // `claude-opus-4-8`, OpenRouter writes `anthropic/claude-opus-4.8`. Collapsing
 // dots to dashes on both sides keeps one table entry covering every route —
@@ -162,9 +216,7 @@ export function buildModelMatchers<T>(
 			// separator is normalized. Only a short segment: a date is digits as well
 			// (`-20251101`) and stays a decoration.
 			strictVariants ? '(?!-\\d{1,3}(?:$|-))' : '',
-			strictVariants
-				? `(?!-(?!(?:v\\d|${DECORATIVE_SUFFIXES.join('|')})$)[a-z])`
-				: ''
+			strictVariants ? `(?!-(?!(?:v\\d|${DECORATIVE_SUFFIXES.join('|')})$)[a-z])` : ''
 		].join('')
 		return [new RegExp(pattern + guards), value]
 	})
@@ -172,8 +224,9 @@ export function buildModelMatchers<T>(
 
 /**
  * The `provider:model` key the workspace AI settings use for their per-model maps
- * (`max_tokens_per_model`, `model_pricing`). A bare model id is not enough: the
- * same id can be served by more than one provider at different rates.
+ * (`max_tokens_per_model`, `model_pricing`, `context_window_per_model`). A bare
+ * model id is not enough: the same id can be served by more than one provider at
+ * different rates.
  *
  * Matched exactly, unlike the fuzzy tables above. Those tables generalize across
  * every route to one model on purpose; a per-model *setting* must not, or an
@@ -196,9 +249,54 @@ export function getKnownModelContextWindow(model: string): number | undefined {
 	return matchModel(MODEL_CONTEXT_WINDOW_MATCHERS, model)
 }
 
-export function getModelContextWindow(model: string) {
-	// Trim/compaction logic needs a number; assume a conservative window when unknown.
-	return getKnownModelContextWindow(model) ?? 128000
+const MODEL_MAX_OUTPUT_TOKEN_MATCHERS = buildModelMatchers(MODEL_MAX_OUTPUT_TOKENS)
+const OPEN_WEIGHT_MAX_OUTPUT_TOKEN_MATCHERS = buildModelMatchers(OPEN_WEIGHT_MAX_OUTPUT_TOKENS)
+
+export function getKnownModelMaxOutputTokens(
+	provider: AIProvider,
+	model: string
+): number | undefined {
+	return (
+		matchModel(MODEL_MAX_OUTPUT_TOKEN_MATCHERS, model) ??
+		(provider === 'customai' ? undefined : matchModel(OPEN_WEIGHT_MAX_OUTPUT_TOKEN_MATCHERS, model))
+	)
+}
+
+/** Trim/compaction logic needs a number; assume a conservative window when unknown. */
+export const ASSUMED_CONTEXT_WINDOW = 128000
+
+/**
+ * What the built-in table states for a model, assuming a conservative window for one
+ * it does not list. Table only, so it ignores the workspace's `context_window_per_model`
+ * — deciding how much context to send goes through `getEffectiveModelContextWindow`
+ * instead. Named for the table because a plain `getModelContextWindow` is the obvious
+ * thing to reach for, and reaching for it here would silently skip the override.
+ */
+export function getModelContextWindowFromTable(model: string) {
+	return getKnownModelContextWindow(model) ?? ASSUMED_CONTEXT_WINDOW
+}
+
+/**
+ * The context window stated for a model: the workspace's override
+ * (`context_window_per_model`, passed in so this module stays free of stores)
+ * when one is set, otherwise the built-in table. Undefined only when neither
+ * knows the model, which is when a consumer falls back to an assumed window.
+ */
+export function getConfiguredModelContextWindow(
+	provider: AIProvider,
+	model: string,
+	overrides: Record<string, number> | undefined
+): number | undefined {
+	return overrides?.[modelKey(provider, model)] ?? getKnownModelContextWindow(model)
+}
+
+/** The window to budget against: the override, then the table, then the assumption. */
+export function getEffectiveModelContextWindow(
+	provider: AIProvider,
+	model: string,
+	overrides: Record<string, number> | undefined
+): number {
+	return getConfiguredModelContextWindow(provider, model, overrides) ?? ASSUMED_CONTEXT_WINDOW
 }
 
 /**
diff --git a/frontend/src/lib/components/copilot/reasoningRegistry.ts b/frontend/src/lib/components/copilot/reasoningRegistry.ts
index 242f6cb329..9915e9c42f 100644
--- a/frontend/src/lib/components/copilot/reasoningRegistry.ts
+++ b/frontend/src/lib/components/copilot/reasoningRegistry.ts
@@ -374,7 +374,8 @@ const ANTHROPIC_ALWAYS_THINKING = /fable|mythos/
 /**
  * Disable token to forward when the user explicitly turns reasoning off on a
  * model that reasons *by default* — omitting the field would silently keep
- * the default-on behavior. Undefined means omission is the correct off.
+ * the default-on behavior. Undefined means omission is the correct off. Every
+ * token is `'none'`: `requestsReasoning` reads that value as off.
  */
 export function explicitOffToken(provider: AIProvider, model: string): ReasoningEffort | undefined {
 	switch (reasoningProviderFamily(provider, model)) {
@@ -434,6 +435,20 @@ export function resolveRequestReasoning(
 	return undefined
 }
 
+/**
+ * Whether a request carrying `effort`, as `resolveRequestReasoning` resolves it,
+ * has the model reason. An effort sent to a model the registry does not mark as
+ * reasoning-capable answers no: an explicit choice is always sent, but that does
+ * not make the model think.
+ */
+export function requestsReasoning(
+	provider: AIProvider,
+	model: string,
+	effort: ReasoningEffort | undefined
+): boolean {
+	return !!effort && effort !== 'none' && supportsReasoning(provider, model)
+}
+
 export type ReasoningApiKind = 'anthropic' | 'responses' | 'completions' | 'deepseek' | 'mistral'
 
 /**
diff --git a/frontend/src/lib/components/datatableAcl/PgAclEditor.svelte b/frontend/src/lib/components/datatableAcl/PgAclEditor.svelte
new file mode 100644
index 0000000000..a3a765014a
--- /dev/null
+++ b/frontend/src/lib/components/datatableAcl/PgAclEditor.svelte
@@ -0,0 +1,288 @@
+<script lang="ts">
+	import { WorkspaceService, type AclChange, type AclTarget, type DatatableAclInfo } from '$lib/gen'
+	import { resource } from 'runed'
+	import { Trash2 } from 'lucide-svelte'
+	import { sendUserToast } from '$lib/toast'
+	import { Alert, Button } from '../common'
+	import ConfirmationModal from '../common/confirmationModal/ConfirmationModal.svelte'
+	import Select from '../select/Select.svelte'
+	import DataTable from '../table/DataTable.svelte'
+	import Head from '../table/Head.svelte'
+	import Row from '../table/Row.svelte'
+	import Cell from '../table/Cell.svelte'
+	import PgGrantBuilder from './PgGrantBuilder.svelte'
+	import {
+		ADMIN_ROLE,
+		blockingSources,
+		grantKey,
+		grantScopeLabel,
+		groupGrants,
+		revocablePrivileges,
+		revokeScopeOf,
+		uncoveredCreators
+	} from './aclScopes'
+
+	let {
+		workspace,
+		datatable,
+		target
+	}: {
+		workspace: string
+		datatable: string
+		/** What owner and grants are read and written for. */
+		target: AclTarget
+	} = $props()
+
+	const acl = resource(
+		() => [workspace, datatable, target] as const,
+		async ([ws, dt, t]) =>
+			await WorkspaceService.getDatatableAcl({
+				workspace: ws,
+				datatableName: dt,
+				kind: t.kind,
+				schema: t.kind === 'database' ? undefined : t.schema,
+				table: t.kind === 'table' ? t.table : undefined
+			})
+	)
+
+	// Nothing is written before its SQL has been shown, and the apply runs exactly that SQL: the
+	// server plans again and refuses if the result differs.
+	let pending = $state<
+		{ change: AclChange; statements: string[]; warnings: string[]; title: string } | undefined
+	>(undefined)
+	let planning = $state(false)
+	let applying = $state(false)
+
+	const info: DatatableAclInfo | undefined = $derived(acl.current)
+	const grantRows = $derived(groupGrants(info?.grants ?? []))
+	const ownerItems = $derived(
+		info
+			? (info.roles.includes(info.owner) ? info.roles : [info.owner, ...info.roles]).map((r) => ({
+					value: r,
+					label: r
+				}))
+			: []
+	)
+	/** A revoke listed per object takes them all: say that it does. */
+	const pendingCoversObjects = $derived(
+		pending?.change.type === 'revoke' && (pending.change.objects?.length ?? 0) > 1
+	)
+
+	function errorText(e: any): string {
+		return e?.body ?? e?.message ?? String(e)
+	}
+
+	async function confirm(change: AclChange, title: string) {
+		planning = true
+		try {
+			const plan = await WorkspaceService.planDatatableAcl({
+				workspace,
+				datatableName: datatable,
+				requestBody: { target, change }
+			})
+			pending = { change, statements: plan.statements, warnings: plan.warnings, title }
+		} catch (e) {
+			sendUserToast(errorText(e), true)
+		} finally {
+			planning = false
+		}
+	}
+
+	async function apply() {
+		if (!pending) return
+		applying = true
+		try {
+			await WorkspaceService.applyDatatableAcl({
+				workspace,
+				datatableName: datatable,
+				requestBody: { target, change: pending.change, statements: pending.statements }
+			})
+			sendUserToast(pending.title)
+			pending = undefined
+			await acl.refetch()
+		} catch (e) {
+			sendUserToast(errorText(e), true)
+		} finally {
+			applying = false
+		}
+	}
+</script>
+
+{#if acl.error}
+	<Alert type="error" title="Could not read access" size="xs">{errorText(acl.error)}</Alert>
+{:else if !info}
+	<span class="text-xs text-secondary">Loading…</span>
+{:else}
+	<div class="flex flex-col gap-4">
+		{#if info.clone}
+			<span class="text-xs text-secondary">
+				Read only: this data table is a clone, and its owners and grants stay as they were copied
+				from the data table it was cloned from.
+			</span>
+		{:else if !info.editable}
+			<span class="text-xs text-secondary">
+				Read only: access is changed by the admins of the workspace that governs this data table, on
+				Windmill Enterprise Edition.
+			</span>
+		{/if}
+
+		{#if target.kind !== 'database'}
+			<section class="flex flex-col gap-2">
+				<div class="flex flex-col gap-0.5">
+					<span class="text-xs font-semibold text-emphasis">Owner</span>
+					<span class="text-xs text-secondary">
+						{target.kind === 'schema'
+							? 'The role that owns the schema and everything already in it, except what belongs to an extension, which stays with the extension. Changing it also keeps the new owner in reach of what the current roles create here from then on; a role added afterwards is not covered.'
+							: 'The role that owns the table. Its owner may always read and write it, and is who ALTER and DROP answer to.'}
+					</span>
+				</div>
+				{#if info.editable}
+					<Select
+						items={ownerItems}
+						disabled={planning || applying}
+						size="sm"
+						class="w-64"
+						bind:value={
+							() => info.owner,
+							(role) => {
+								// The select shows what the database says; a pick is a request, and only the
+								// applied change moves it.
+								if (role && role !== info.owner) {
+									confirm({ type: 'set_owner', role }, `Ownership transferred to ${role}`)
+								}
+							}
+						}
+					/>
+				{:else}
+					<span class="font-mono text-xs">{info.owner}</span>
+				{/if}
+			</section>
+		{/if}
+
+		<section class="flex flex-col gap-2">
+			<div class="flex flex-col gap-0.5">
+				<span class="text-xs font-semibold text-emphasis">Grants</span>
+				<span class="text-xs text-secondary">
+					{target.kind === 'database'
+						? 'What each role may do on the database itself — CREATE is the right to create schemas in it — and what default privileges set database-wide give it on what is created later, in every schema. No schema can take those back.'
+						: 'What each role may do here, beyond what it owns.'}
+				</span>
+			</div>
+			{#if info.editable}
+				<PgGrantBuilder
+					{target}
+					roles={info.roles}
+					disabled={planning || applying}
+					supportsMaintain={info.supports_maintain}
+					dbname={info.dbname}
+					onAdd={({ role, privileges, scope }) =>
+						confirm(
+							{ type: 'grant', role, privileges, scope },
+							`Granted ${privileges.join(', ')} to ${role}`
+						)}
+				/>
+			{/if}
+			{#if grantRows.length === 0}
+				<span class="text-xs text-secondary">No grants yet.</span>
+			{:else}
+				<DataTable size="xs">
+					<Head>
+						<tr>
+							<Cell head first>Role</Cell>
+							<Cell head>Privileges</Cell>
+							<Cell head>On</Cell>
+							<Cell head last></Cell>
+						</tr>
+					</Head>
+					<tbody class="divide-y">
+						{#each grantRows as grant (grantKey(grant))}
+							{@const revokeScope = revokeScopeOf(grant)}
+							{@const revocable = revocablePrivileges(grant, target)}
+							{@const blocked = blockingSources(grant, revocable)}
+							{@const uncovered = uncoveredCreators(grant, info.roles)}
+							<Row>
+								<Cell first>{grant.grantee}</Cell>
+								<Cell wrap
+									><span class="font-mono text-2xs">{grant.privileges.join(', ')}</span></Cell
+								>
+								<Cell wrap>
+									{grantScopeLabel(grant)}
+									{#if blocked.length > 0}
+										<span
+											class="text-2xs text-secondary"
+											title="Only this role can take the grant back: Postgres revokes a grant through the role that made it"
+										>
+											from {blocked.join(', ')}
+										</span>
+									{/if}
+									{#if uncovered.length > 0}
+										<span
+											class="text-2xs text-secondary"
+											title="A default privilege covers only the roles it was granted for: grant it again to cover these"
+										>
+											· not for what {uncovered.join(', ')}
+											{uncovered.length === 1 ? 'creates' : 'create'}
+										</span>
+									{/if}
+								</Cell>
+								<Cell last>
+									<!-- What `admin` holds is what every role here connects through, so it is not
+									this editor's to take away. -->
+									{#if info.editable && revokeScope && revocable.length > 0 && blocked.length === 0 && info.roles.includes(grant.grantee) && grant.grantee !== ADMIN_ROLE}
+										<Button
+											unifiedSize="xs"
+											variant="subtle"
+											iconOnly
+											startIcon={{ icon: Trash2 }}
+											title="Revoke {revocable.join(', ')}"
+											disabled={planning || applying}
+											onClick={() =>
+												confirm(
+													{
+														type: 'revoke',
+														role: grant.grantee,
+														privileges: revocable,
+														scope: revokeScope,
+														objects: grant.objects
+													},
+													`Revoked ${revocable.join(', ')} from ${grant.grantee}`
+												)}
+										/>
+									{/if}
+								</Cell>
+							</Row>
+						{/each}
+					</tbody>
+				</DataTable>
+			{/if}
+		</section>
+	</div>
+{/if}
+
+<ConfirmationModal
+	open={!!pending}
+	title="Run the following?"
+	confirmationText="Run"
+	type="info"
+	alwaysPortal
+	loading={applying}
+	onConfirmed={apply}
+	onCanceled={() => (pending = undefined)}
+>
+	<div class="flex flex-col gap-3 min-w-0">
+		{#if pendingCoversObjects}
+			<Alert type="info" title="This covers every listed object" size="xs">
+				The same privileges on several objects read as one row, and are revoked together.
+			</Alert>
+		{/if}
+		{#each pending?.warnings ?? [] as warning (warning)}
+			<Alert type="warning" title="Warning" size="xs">{warning}</Alert>
+		{/each}
+		<span class="text-sm text-secondary">
+			Runs against <span class="font-mono">{datatable}</span> in a single transaction:
+		</span>
+		<pre class="overflow-auto text-xs bg-surface-secondary p-3 rounded select-all max-h-80"
+			>{(pending?.statements ?? []).join(';\n')};</pre
+		>
+	</div>
+</ConfirmationModal>
diff --git a/frontend/src/lib/components/datatableAcl/PgGrantBuilder.svelte b/frontend/src/lib/components/datatableAcl/PgGrantBuilder.svelte
new file mode 100644
index 0000000000..5e5119abb6
--- /dev/null
+++ b/frontend/src/lib/components/datatableAcl/PgGrantBuilder.svelte
@@ -0,0 +1,95 @@
+<script lang="ts">
+	import type { AclTarget } from '$lib/gen'
+	import { Plus } from 'lucide-svelte'
+	import { Button } from '../common'
+	import Select from '../select/Select.svelte'
+	import MultiSelect from '../select/MultiSelect.svelte'
+	import { privilegesOf, scopeSql, scopesOf, type AclScope } from './aclScopes'
+
+	let {
+		target,
+		roles,
+		supportsMaintain = false,
+		dbname,
+		disabled = false,
+		onAdd
+	}: {
+		target: AclTarget
+		/** Roles the grant can be handed to. */
+		roles: string[]
+		/** Postgres 17+, which has one more table privilege to offer. */
+		supportsMaintain?: boolean
+		/** Names the database in the statement a database target builds. */
+		dbname?: string
+		disabled?: boolean
+		onAdd: (grant: { role: string; privileges: string[]; scope: AclScope }) => void
+	} = $props()
+
+	let role = $state<string | undefined>(undefined)
+	let scope = $state<AclScope>('target')
+	let privileges = $state<string[]>([])
+
+	const available = $derived(privilegesOf(scope, target.kind, supportsMaintain))
+	const statement = $derived(
+		privileges.length && role
+			? `GRANT ${privileges.join(', ')} ON ${scopeSql(scope, target, dbname)} TO ${role}`
+			: undefined
+	)
+</script>
+
+<div class="flex flex-col gap-2 border rounded-md p-3">
+	<div class="flex flex-wrap items-center gap-2 text-xs text-secondary">
+		<span class="font-mono text-primary">GRANT</span>
+		<MultiSelect
+			bind:value={privileges}
+			items={available.map((p) => ({ value: p, label: p }))}
+			placeholder="privileges"
+			{disabled}
+			size="sm"
+			class="min-w-48"
+		/>
+		<span class="font-mono text-primary">ON</span>
+		<Select
+			bind:value={
+				() => scope,
+				(s) => {
+					if (!s) return
+					scope = s
+					// A privilege only exists for some objects — SELECT means nothing on a function —
+					// so drop what the new scope cannot carry rather than send it.
+					const allowed = privilegesOf(s, target.kind, supportsMaintain)
+					privileges = privileges.filter((p) => allowed.includes(p))
+				}
+			}
+			items={scopesOf(target.kind)}
+			{disabled}
+			size="sm"
+			class="w-52"
+		/>
+		<span class="font-mono text-primary">TO</span>
+		<Select
+			bind:value={role}
+			items={roles.map((r) => ({ value: r, label: r }))}
+			placeholder="role"
+			{disabled}
+			size="sm"
+			class="w-40"
+		/>
+		<Button
+			unifiedSize="sm"
+			variant="default"
+			startIcon={{ icon: Plus }}
+			disabled={disabled || !role || privileges.length === 0}
+			onClick={() => {
+				if (!role) return
+				onAdd({ role, privileges: [...privileges], scope })
+				privileges = []
+			}}
+		>
+			Add
+		</Button>
+	</div>
+	{#if statement}
+		<pre class="text-2xs text-tertiary overflow-x-auto">{statement}</pre>
+	{/if}
+</div>
diff --git a/frontend/src/lib/components/datatableAcl/aclScopes.test.ts b/frontend/src/lib/components/datatableAcl/aclScopes.test.ts
new file mode 100644
index 0000000000..7c01836e89
--- /dev/null
+++ b/frontend/src/lib/components/datatableAcl/aclScopes.test.ts
@@ -0,0 +1,178 @@
+import { describe, expect, it } from 'vitest'
+import type { AclGrant } from '$lib/gen'
+import {
+	blockingSources,
+	grantKey,
+	groupGrants,
+	revocablePrivileges,
+	revokeScopeOf,
+	uncoveredCreators
+} from './aclScopes'
+
+const table = (name: string) => ({ name, kind: 'TABLE' })
+const by = (role: string, privileges: string[], reachable = true) => ({
+	role,
+	privileges,
+	reachable
+})
+const byAdmin = (grant: Omit<AclGrant, 'sources'>): AclGrant => ({
+	...grant,
+	sources: [by('admin', grant.privileges)]
+})
+
+describe('grantKey', () => {
+	it('tells apart a table and a function of the same name', () => {
+		const row = (object: { name: string; kind: string; args?: string }) => ({
+			grantee: 'analytics',
+			privileges: ['SELECT'],
+			objects: [object],
+			sources: [by('admin', ['SELECT'])]
+		})
+		expect(grantKey(row(table('orders')))).not.toBe(
+			grantKey(row({ name: 'orders', kind: 'FUNCTION', args: '' }))
+		)
+	})
+})
+
+describe('groupGrants', () => {
+	// A row's revoke names every object in it, so a row must only hold what one revoke may take.
+	it('folds the same privileges on objects of one kind, and nothing else', () => {
+		const grants: AclGrant[] = [
+			{ grantee: 'analytics', privileges: ['SELECT'], object: table('orders') },
+			{ grantee: 'analytics', privileges: ['SELECT'], object: table('salaries') },
+			{ grantee: 'operator', privileges: ['SELECT'], object: table('orders') },
+			{ grantee: 'analytics', privileges: ['INSERT', 'SELECT'], object: table('events') },
+			{ grantee: 'analytics', privileges: ['SELECT'], object: { name: 's', kind: 'SEQUENCE' } },
+			{ grantee: 'analytics', privileges: ['SELECT'], future: 'TABLES' },
+			{ grantee: 'analytics', privileges: ['USAGE'] }
+		].map(byAdmin)
+		const rows = groupGrants(grants)
+		expect(rows.map((r) => [r.grantee, r.privileges, r.objects, r.future])).toEqual([
+			['analytics', ['SELECT'], [table('orders'), table('salaries')], undefined],
+			['operator', ['SELECT'], [table('orders')], undefined],
+			['analytics', ['INSERT', 'SELECT'], [table('events')], undefined],
+			['analytics', ['SELECT'], [{ name: 's', kind: 'SEQUENCE' }], undefined],
+			['analytics', ['SELECT'], [], 'TABLES'],
+			['analytics', ['USAGE'], [], undefined]
+		])
+	})
+
+	// A revoke takes the row back from every source, so the row must name them all, with what each
+	// gave.
+	it('keeps every source of the grants it folds', () => {
+		const grants: AclGrant[] = [
+			{
+				grantee: 'analytics',
+				privileges: ['SELECT'],
+				object: table('orders'),
+				sources: [by('admin', ['SELECT'])]
+			},
+			{
+				grantee: 'analytics',
+				privileges: ['SELECT'],
+				object: table('salaries'),
+				sources: [by('admin', ['SELECT']), by('operator', ['SELECT'])]
+			}
+		]
+		expect(groupGrants(grants)[0].sources).toEqual([
+			by('admin', ['SELECT']),
+			by('operator', ['SELECT'])
+		])
+	})
+})
+
+describe('revoke of a row', () => {
+	const row = (future?: string) => ({
+		grantee: 'analytics',
+		privileges: ['SELECT'],
+		objects: [],
+		future,
+		sources: [by('admin', ['SELECT'])]
+	})
+
+	it('takes back only what the editor may revoke on the database', () => {
+		const database = { ...row(), privileges: ['CONNECT', 'CREATE'] }
+		expect(revocablePrivileges(database, { kind: 'database' })).toEqual(['CREATE'])
+		expect(revocablePrivileges(database, { kind: 'schema', schema: 'public' })).toEqual([
+			'CONNECT',
+			'CREATE'
+		])
+		// Set database-wide, so not one a schema's revoke could take back either.
+		const schemasLater = { ...row('SCHEMAS'), privileges: ['CREATE'] }
+		expect(revocablePrivileges(schemasLater, { kind: 'database' })).toEqual([])
+	})
+
+	it('maps default privileges to their scope, and refuses the ones it has none for', () => {
+		expect(revokeScopeOf(row())).toBe('target')
+		expect(revokeScopeOf(row('TABLES'))).toBe('future_tables')
+		expect(revokeScopeOf(row('TYPES'))).toBeUndefined()
+		expect(revokeScopeOf({ ...row(), objects: [{ name: 'mood', kind: 'TYPE' }] })).toBeUndefined()
+	})
+
+	// Postgres takes a grant back only through its source: offering the revoke would promise what
+	// the plan then refuses. But only the sources of what is revoked count: the catalog's CONNECT
+	// on the database comes from its owner, out of reach, and must not hold back a CREATE the
+	// editor granted.
+	it('is held back only by a source out of reach for what it takes', () => {
+		const database = {
+			...row(),
+			privileges: ['CONNECT', 'CREATE'],
+			sources: [by('postgres', ['CONNECT'], false), by('admin', ['CREATE'])]
+		}
+		const revocable = revocablePrivileges(database, { kind: 'database' })
+		expect(blockingSources(database, revocable)).toEqual([])
+		expect(blockingSources(database, ['CONNECT'])).toEqual(['postgres'])
+		const partly = {
+			...row('TABLES'),
+			sources: [by('admin', ['SELECT']), by('postgres', ['SELECT'], false)]
+		}
+		expect(blockingSources(partly, ['SELECT'])).toEqual(['postgres'])
+	})
+
+	// Whether a grant can be taken back depends on its object, so a row folding several objects is
+	// only revocable if each of its grants is.
+	it('is held back by a source out of reach on any of the objects it folds', () => {
+		const grants: AclGrant[] = [
+			{
+				grantee: 'analytics',
+				privileges: ['SELECT'],
+				object: table('orders'),
+				sources: [by('admin', ['SELECT'])]
+			},
+			{
+				grantee: 'analytics',
+				privileges: ['SELECT'],
+				object: table('salaries'),
+				sources: [by('admin', ['SELECT'], false)]
+			}
+		]
+		const [folded] = groupGrants(grants)
+		expect(folded.objects).toHaveLength(2)
+		expect(blockingSources(folded, ['SELECT'])).toEqual(['admin'])
+		// Folding reads the grants, never rewrites them.
+		expect(grants[0].sources[0].reachable).toBe(true)
+	})
+})
+
+describe('uncoveredCreators', () => {
+	// A default privilege binds only the creating roles it was granted for: a role added since is
+	// left out until the grant is made again.
+	it('names the roles a created-later row leaves out', () => {
+		const future = {
+			grantee: 'analytics',
+			privileges: ['SELECT'],
+			objects: [],
+			future: 'TABLES',
+			sources: [by('admin', ['SELECT']), by('analytics', ['SELECT'])]
+		}
+		expect(uncoveredCreators(future, ['admin', 'analytics', 'late'])).toEqual(['late'])
+		expect(uncoveredCreators({ ...future, future: undefined }, ['late'])).toEqual([])
+		// Set by a role outside the catalog, it was never meant to cover the catalog's roles.
+		expect(
+			uncoveredCreators({ ...future, sources: [by('postgres', ['SELECT'], false)] }, [
+				'admin',
+				'late'
+			])
+		).toEqual([])
+	})
+})
diff --git a/frontend/src/lib/components/datatableAcl/aclScopes.ts b/frontend/src/lib/components/datatableAcl/aclScopes.ts
new file mode 100644
index 0000000000..d5b8ad9d20
--- /dev/null
+++ b/frontend/src/lib/components/datatableAcl/aclScopes.ts
@@ -0,0 +1,211 @@
+import type { AclGrant, AclSource, AclTarget } from '$lib/gen'
+
+/** The role a data table connects as without roles — `custom_instance_user` in Postgres. */
+export const ADMIN_ROLE = 'admin'
+
+/** Privileges Postgres accepts per kind of object. Mirrors the whitelist the backend validates
+ * against — a privilege missing here just cannot be built. */
+/** `CREATE` on a database is the right to create schemas in it, and the only database privilege
+ * handed out here: `CONNECT` is managed with the instance's role catalog. */
+export const DATABASE_PRIVILEGES = ['CREATE']
+export const SCHEMA_PRIVILEGES = ['USAGE', 'CREATE']
+export const TABLE_PRIVILEGES = [
+	'SELECT',
+	'INSERT',
+	'UPDATE',
+	'DELETE',
+	'TRUNCATE',
+	'REFERENCES',
+	'TRIGGER'
+]
+/** Postgres 17 and later only, so it is offered from what the server reports. */
+export const MAINTAIN_PRIVILEGE = 'MAINTAIN'
+export const SEQUENCE_PRIVILEGES = ['USAGE', 'SELECT', 'UPDATE']
+export const FUNCTION_PRIVILEGES = ['EXECUTE']
+
+export type AclScope =
+	| 'target'
+	| 'all_tables'
+	| 'all_sequences'
+	| 'all_functions'
+	| 'future_tables'
+	| 'future_sequences'
+	| 'future_functions'
+
+export type AclTargetKind = AclTarget['kind']
+
+/** The scopes a target can grant on, in the order the builder offers them. */
+export function scopesOf(kind: AclTargetKind): { value: AclScope; label: string }[] {
+	if (kind === 'database') return [{ value: 'target', label: 'the database itself' }]
+	if (kind === 'table') return [{ value: 'target', label: 'this table' }]
+	return [
+		{ value: 'target', label: 'the schema itself' },
+		{ value: 'all_tables', label: 'all tables in it' },
+		{ value: 'all_sequences', label: 'all sequences in it' },
+		{ value: 'all_functions', label: 'all functions in it' },
+		{ value: 'future_tables', label: 'tables created later' },
+		{ value: 'future_sequences', label: 'sequences created later' },
+		{ value: 'future_functions', label: 'functions created later' }
+	]
+}
+
+export function privilegesOf(
+	scope: AclScope,
+	kind: AclTargetKind,
+	supportsMaintain = false
+): string[] {
+	const tablePrivileges = supportsMaintain
+		? [...TABLE_PRIVILEGES, MAINTAIN_PRIVILEGE]
+		: TABLE_PRIVILEGES
+	switch (scope) {
+		case 'target':
+			if (kind === 'database') return DATABASE_PRIVILEGES
+			return kind === 'schema' ? SCHEMA_PRIVILEGES : tablePrivileges
+		case 'all_tables':
+		case 'future_tables':
+			return tablePrivileges
+		case 'all_sequences':
+		case 'future_sequences':
+			return SEQUENCE_PRIVILEGES
+		case 'all_functions':
+		case 'future_functions':
+			return FUNCTION_PRIVILEGES
+	}
+}
+
+/** What a statement built at this scope reads as, for the builder's own preview. */
+export function scopeSql(scope: AclScope, target: AclTarget, dbname?: string): string {
+	if (target.kind === 'database') return `DATABASE ${dbname ?? ''}`.trim()
+	const schema = target.schema
+	switch (scope) {
+		case 'target':
+			return target.kind === 'schema' ? `SCHEMA ${schema}` : `TABLE ${schema}.${target.table}`
+		case 'all_tables':
+			return `ALL TABLES IN SCHEMA ${schema}`
+		case 'all_sequences':
+			return `ALL SEQUENCES IN SCHEMA ${schema}`
+		case 'all_functions':
+			return `ALL FUNCTIONS IN SCHEMA ${schema}`
+		case 'future_tables':
+			return `TABLES (default privileges in ${schema})`
+		case 'future_sequences':
+			return `SEQUENCES (default privileges in ${schema})`
+		case 'future_functions':
+			return `FUNCTIONS (default privileges in ${schema})`
+	}
+}
+
+/** One row of the grants table: the same privileges on several objects read as one line, since
+ * granting them per object is what `ON ALL TABLES` does. */
+export type GroupedGrant = {
+	grantee: string
+	privileges: string[]
+	objects: NonNullable<AclGrant['object']>[]
+	future?: string
+	/** Every role the row's grants come from, each once, with what it gave. */
+	sources: AclSource[]
+}
+
+export function groupGrants(grants: AclGrant[]): GroupedGrant[] {
+	const rows: GroupedGrant[] = []
+	for (const grant of grants) {
+		const existing = grant.object
+			? rows.find(
+					(r) =>
+						r.grantee === grant.grantee &&
+						r.future === grant.future &&
+						r.objects[0]?.kind === grant.object?.kind &&
+						r.privileges.join() === grant.privileges.join()
+				)
+			: undefined
+		if (existing) {
+			existing.objects.push(grant.object!)
+			for (const source of grant.sources) {
+				const known = existing.sources.find((s) => s.role === source.role)
+				// Whether a role's grant can be taken back depends on the object it is on, so a row
+				// holds a source as reachable only if it is on every object the row folds.
+				if (known) {
+					known.reachable &&= source.reachable
+					known.privileges = [...new Set([...known.privileges, ...source.privileges])].sort()
+				} else {
+					existing.sources.push({ ...source, privileges: [...source.privileges] })
+				}
+			}
+		} else {
+			rows.push({
+				grantee: grant.grantee,
+				privileges: grant.privileges,
+				objects: grant.object ? [grant.object] : [],
+				future: grant.future,
+				sources: grant.sources.map((s) => ({ ...s, privileges: [...s.privileges] }))
+			})
+		}
+	}
+	return rows
+}
+
+/** The roles that gave some of `privileges` and that this data table's connection cannot act for.
+ * Only they can take those grants back, so a revoke of `privileges` is not offered. */
+export function blockingSources(grant: GroupedGrant, privileges: string[]): string[] {
+	return grant.sources
+		.filter((s) => !s.reachable && s.privileges.some((p) => privileges.includes(p)))
+		.map((s) => s.role)
+}
+
+/** Which of `roles` a "created later" row granted for some of them does not cover. A default
+ * privilege binds only the creating roles it was granted for, so what the others create stays out
+ * of it. A row none of `roles` set — the instance's own, say — was never meant to cover them, and
+ * names none. */
+export function uncoveredCreators(grant: GroupedGrant, roles: string[]): string[] {
+	if (!grant.future || !grant.sources.some((s) => roles.includes(s.role))) return []
+	return roles.filter((r) => !grant.sources.some((s) => s.role === r))
+}
+
+/** A row's identity. Two rows may share a grantee and an object name — a table `orders` and a
+ * function `orders()` — so the kind and the privileges are part of it too. */
+export function grantKey(grant: GroupedGrant): string {
+	return [
+		grant.grantee,
+		grant.future ?? '',
+		grant.privileges.join(','),
+		...grant.objects.map((o) => `${o.kind}:${o.name}(${o.args ?? ''})`)
+	].join('|')
+}
+
+/** The scope a revoke of this row takes, or `undefined` when the builder cannot express it —
+ * Postgres also records privileges on types, present and default, which nothing here grants and
+ * the API has no scope for. */
+export function revokeScopeOf(grant: GroupedGrant): AclScope | undefined {
+	if (!grant.future) return grant.objects.some((o) => o.kind === 'TYPE') ? undefined : 'target'
+	const scope = `future_${grant.future.toLowerCase()}`
+	return (['future_tables', 'future_sequences', 'future_functions'] as const).find(
+		(s) => s === scope
+	)
+}
+
+/** The privileges of a row a revoke may take back. On the database that is `CREATE` alone:
+ * `CONNECT` belongs to the role catalog, which would grant it again, and `TEMPORARY` is not one
+ * the editor hands out — a row holding only those has nothing to revoke here. A database's rows
+ * "created later" are default privileges set database-wide, which nothing here revokes. */
+export function revocablePrivileges(grant: GroupedGrant, target: AclTarget): string[] {
+	if (target.kind === 'database' && grant.objects.length === 0) {
+		if (grant.future) return []
+		return grant.privileges.filter((p) => DATABASE_PRIVILEGES.includes(p))
+	}
+	return grant.privileges
+}
+
+/** How a row reads back: what it covers, in one phrase. */
+export function grantScopeLabel(grant: GroupedGrant): string {
+	if (grant.future) return `${grant.future.toLowerCase()} created later`
+	if (grant.objects.length === 1) {
+		const object = grant.objects[0]
+		// A routine's arguments are part of what it is, so two of the same name would otherwise
+		// read as one row twice.
+		const args = object.args !== undefined ? `(${object.args})` : ''
+		return `${object.kind.toLowerCase()} ${object.name}${args}`
+	}
+	if (grant.objects.length > 1)
+		return `${grant.objects.length} ${grant.objects[0].kind.toLowerCase()}s`
+	return 'itself'
+}
diff --git a/frontend/src/lib/components/datatableMigrationRole.test.ts b/frontend/src/lib/components/datatableMigrationRole.test.ts
new file mode 100644
index 0000000000..6d136b8371
--- /dev/null
+++ b/frontend/src/lib/components/datatableMigrationRole.test.ts
@@ -0,0 +1,60 @@
+import { describe, test, expect } from 'vitest'
+import { parseMigrationRole, withMigrationRole } from './datatableMigrationRole'
+
+describe('parseMigrationRole', () => {
+	test('reads every spelling the server accepts from the leading comment block', () => {
+		for (const line of [
+			'-- role analyst',
+			'-- Role: analyst',
+			'-- role=analyst',
+			'-- role analyst;'
+		]) {
+			expect(parseMigrationRole(`\n${line}\nBEGIN;\nEND;`)).toEqual({
+				kind: 'role',
+				role: 'analyst'
+			})
+		}
+	})
+
+	test('an annotation below BEGIN is not one', () => {
+		expect(parseMigrationRole('BEGIN;\n-- role analyst\nEND;')).toEqual({ kind: 'none' })
+	})
+
+	test('a malformed attempt is an error, not the default', () => {
+		for (const line of [
+			'-- role based access below',
+			'-- role',
+			'-- role:',
+			'-- role an;alytics'
+		]) {
+			expect(parseMigrationRole(`${line}\nBEGIN;`)).toEqual({ kind: 'malformed', line })
+		}
+	})
+
+	test('comments that do not start with the word role are ignored', () => {
+		expect(parseMigrationRole('-- roles analyst\n-- rolex\nBEGIN;')).toEqual({ kind: 'none' })
+	})
+})
+
+describe('withMigrationRole', () => {
+	test('leads above BEGIN, so the server reads it', () => {
+		const out = withMigrationRole('BEGIN;\nSELECT 1;\nEND;', 'analyst')
+		expect(out).toBe('-- role analyst\nBEGIN;\nSELECT 1;\nEND;')
+	})
+
+	test('replaces any attempt rather than stacking, malformed ones included', () => {
+		const out = withMigrationRole(
+			'-- Role: auditor\n-- role oops no\n-- keep me\nBEGIN;',
+			'analyst'
+		)
+		expect(out).toBe('-- role analyst\n-- keep me\nBEGIN;')
+	})
+
+	test('undefined strips the annotation, so it runs as admin', () => {
+		expect(withMigrationRole('-- role analyst\n\nBEGIN;\nEND;', undefined)).toBe('BEGIN;\nEND;')
+	})
+
+	test('refuses a name the server would refuse', () => {
+		expect(() => withMigrationRole('BEGIN;', 'bad;name')).toThrow()
+	})
+})
diff --git a/frontend/src/lib/components/datatableMigrationRole.ts b/frontend/src/lib/components/datatableMigrationRole.ts
new file mode 100644
index 0000000000..5475bf2fd7
--- /dev/null
+++ b/frontend/src/lib/components/datatableMigrationRole.ts
@@ -0,0 +1,70 @@
+import { isDatatableRoleName } from './dbTypes'
+
+/**
+ * A migration carries the data table role it runs as in its own SQL, as a `-- role <name>`
+ * annotation. There is no separate field: the annotation is what the server reads, and keeping
+ * it in the SQL is what lets it survive a `wmill sync` round-trip.
+ *
+ * Mirrors `SqlAnnotations::datatable_role` on the backend. It is only read from the leading
+ * comment block, so an annotation below `BEGIN;` is ignored and the migration runs as admin. A
+ * leading comment whose first word is `role` is an annotation attempt, and a malformed one is an
+ * error there, so it is one here too.
+ */
+
+export type MigrationRole =
+	| { kind: 'none' }
+	| { kind: 'role'; role: string }
+	| { kind: 'malformed'; line: string }
+
+/** The body of a leading comment line that attempts a role annotation, or undefined. */
+function roleAttempt(line: string): string | undefined {
+	if (!line.startsWith('--')) return undefined
+	const body = line.slice(2).trimStart()
+	if (body.slice(0, 4).toLowerCase() !== 'role') return undefined
+	const after = body.slice(4)
+	if (after !== '' && !/^[\s:=]/.test(after)) return undefined
+	return after
+}
+
+function parseAttempt(after: string): string | undefined {
+	let rest = after.trimStart()
+	if (rest.startsWith(':') || rest.startsWith('=')) rest = rest.slice(1)
+	const tokens = rest.split(/\s+/).filter((t) => t !== '')
+	if (tokens.length !== 1) return undefined
+	const role = tokens[0].endsWith(';') ? tokens[0].slice(0, -1) : tokens[0]
+	return isDatatableRoleName(role) ? role : undefined
+}
+
+export function parseMigrationRole(sql: string): MigrationRole {
+	for (const raw of sql.split('\n')) {
+		const line = raw.trim()
+		if (line === '') continue
+		if (!line.startsWith('--')) break
+		const after = roleAttempt(line)
+		if (after === undefined) continue
+		const role = parseAttempt(after)
+		return role === undefined ? { kind: 'malformed', line } : { kind: 'role', role }
+	}
+	return { kind: 'none' }
+}
+
+/**
+ * `sql` declaring `role`: any role annotation attempt in the leading comment block is removed,
+ * and `-- role <role>` is prepended above everything, or nothing when `role` is undefined.
+ */
+export function withMigrationRole(sql: string, role: string | undefined): string {
+	if (role !== undefined && !isDatatableRoleName(role)) {
+		throw new Error(`Invalid data table role '${role}'`)
+	}
+	const lines = sql.split('\n')
+	const kept: string[] = []
+	let i = 0
+	for (; i < lines.length; i++) {
+		const line = lines[i].trim()
+		if (line !== '' && !line.startsWith('--')) break
+		if (roleAttempt(line) === undefined) kept.push(lines[i])
+	}
+	const rest = [...kept, ...lines.slice(i)]
+	while (rest.length > 0 && rest[0].trim() === '') rest.shift()
+	return role === undefined ? rest.join('\n') : [`-- role ${role}`, ...rest].join('\n')
+}
diff --git a/frontend/src/lib/components/datatableUsableRoles.test.ts b/frontend/src/lib/components/datatableUsableRoles.test.ts
new file mode 100644
index 0000000000..cca4ab7607
--- /dev/null
+++ b/frontend/src/lib/components/datatableUsableRoles.test.ts
@@ -0,0 +1,29 @@
+import { describe, expect, it, vi } from 'vitest'
+
+const request = vi.fn()
+vi.mock('$lib/gen/core/request', () => ({ request: (...args: unknown[]) => request(...args) }))
+vi.mock('$lib/gen', () => ({ OpenAPI: {} }))
+vi.mock('$lib/cloud', () => ({ isCloudHosted: () => false }))
+
+import { listUsableDatatableRoles } from './datatableUsableRoles'
+
+const refuse = (body: string) => () =>
+	Promise.reject(Object.assign(new Error('Bad Request'), { body }))
+
+describe('listUsableDatatableRoles', () => {
+	// The refusal is recognised by its sentence, so rewording it on one side alone would turn every
+	// data table on a build without the Enterprise Edition into a failed lookup rather than one
+	// that is not under roles.
+	it('reads the enterprise refusal as not under roles, and rethrows anything else', async () => {
+		request.mockImplementation(refuse('Data table roles are a Windmill Enterprise Edition feature'))
+		expect(await listUsableDatatableRoles('ws', 'main')).toEqual({
+			permissioned: false,
+			roles: [],
+			default_role: 'admin'
+		})
+
+		request.mockImplementation(refuse('Data table not found'))
+		const rethrown = await listUsableDatatableRoles('ws', 'main').catch((e) => e)
+		expect(rethrown).toBeInstanceOf(Error)
+	})
+})
diff --git a/frontend/src/lib/components/datatableUsableRoles.ts b/frontend/src/lib/components/datatableUsableRoles.ts
new file mode 100644
index 0000000000..84e52f29a8
--- /dev/null
+++ b/frontend/src/lib/components/datatableUsableRoles.ts
@@ -0,0 +1,44 @@
+import { OpenAPI, type ListUsableDatatableRolesResponse } from '$lib/gen'
+import { request } from '$lib/gen/core/request'
+import { isCloudHosted } from '$lib/cloud'
+import { ADMIN_DATATABLE_ROLE } from './dbTypes'
+
+// `datatable_roles_unavailable` on the server, which is a plain 400: rewording it there without
+// here makes every role picker on a non-Enterprise build fail instead of reading "not under roles".
+const ROLES_UNAVAILABLE = 'Data table roles are a Windmill Enterprise Edition feature'
+
+const NOT_UNDER_ROLES: ListUsableDatatableRolesResponse = {
+	permissioned: false,
+	roles: [],
+	default_role: ADMIN_DATATABLE_ROLE
+}
+
+/**
+ * The roles the caller may connect as on a data table. Cloud has no instance database, so no data
+ * table there is under roles, and none of the role pickers show. Without the Enterprise Edition
+ * every roles route refuses, which reads the same way: the data table is then used the way it was
+ * before roles, and one that is under roles is refused when something connects to it.
+ */
+export async function listUsableDatatableRoles(
+	workspace: string,
+	datatableName: string
+): Promise<ListUsableDatatableRolesResponse> {
+	if (isCloudHosted()) return NOT_UNDER_ROLES
+	try {
+		// The generated client encodes path params with `encodeURI`, which leaves a '?' in a
+		// data table name created before names were restricted to cut the path short.
+		return await request(
+			{ ...OpenAPI, ENCODE_PATH: encodeURIComponent },
+			{
+				method: 'GET',
+				url: '/w/{workspace}/workspaces/datatable_usable_roles/{datatable_name}',
+				path: { workspace, datatable_name: datatableName }
+			}
+		)
+	} catch (e) {
+		const body = (e as { body?: unknown })?.body
+		const detail = `${typeof body === 'string' ? body : JSON.stringify(body ?? '')} ${(e as Error)?.message ?? e}`
+		if (detail.includes(ROLES_UNAVAILABLE)) return NOT_UNDER_ROLES
+		throw e
+	}
+}
diff --git a/frontend/src/lib/components/dbManagerDrawerModel.svelte.ts b/frontend/src/lib/components/dbManagerDrawerModel.svelte.ts
index 59345c6ae7..890635dcf8 100644
--- a/frontend/src/lib/components/dbManagerDrawerModel.svelte.ts
+++ b/frontend/src/lib/components/dbManagerDrawerModel.svelte.ts
@@ -5,7 +5,7 @@ import { isDbType } from './dbTypes'
 
 /**
  * Single URL param `dbm` encodes the full DB manager state:
- *   firstSegment~path~schema.table
+ *   firstSegment~path~schema.table~role=name
  *
  * firstSegment:
  *   datatable              – database with datatable:// resource (resourceType always postgresql)
@@ -26,28 +26,46 @@ import { isDbType } from './dbTypes'
  *   datatable~main~.customers          (schema "public" implied)
  *   ducklake~main~.orders              (schema "main" implied)
  *   postgresql~$res:u/user/my_pg~public.customers
+ *   datatable~main~.customers~role=analyst
+ *   datatable~main~role=analyst        (no schema/table selected)
+ *
+ * role=name (last segment, optional, data tables only): the data table role to connect as.
+ * Omitted means the data table's default role. A trailing segment starting with `role=` is always
+ * the role, whatever follows. The name is kept as written, even when invalid (a `.` included), so
+ * the connection refuses it visibly instead of falling back to the default.
  */
 
 const dbManagerSchema = z.object({
 	dbm: z.string().nullable()
 })
 
-interface ParsedDbm {
+export interface ParsedDbm {
 	type: 'database' | 'datatable' | 'ducklake'
 	path: string
 	resType?: string
 	schema?: string
 	table?: string
+	role?: string
 }
 
-function parseDbm(raw: unknown): ParsedDbm | null {
+const ROLE_SEGMENT_PREFIX = 'role='
+
+function isRoleSegment(segment: string | undefined): segment is string {
+	return !!segment && segment.startsWith(ROLE_SEGMENT_PREFIX)
+}
+
+export function parseDbm(raw: unknown): ParsedDbm | null {
 	if (!raw || typeof raw !== 'string') return null
 	const parts = raw.split('~')
 	if (parts.length < 2 || !parts[1]) return null
 
 	const firstSeg = parts[0]
 	const path = parts[1]
-	const schemaTable = parts[2] ?? ''
+	const rest = parts.slice(2)
+	const role = isRoleSegment(rest.at(-1))
+		? rest.pop()!.slice(ROLE_SEGMENT_PREFIX.length)
+		: undefined
+	const schemaTable = rest[0] ?? ''
 
 	let type: ParsedDbm['type']
 	let resType: string | undefined
@@ -81,12 +99,12 @@ function parseDbm(raw: unknown): ParsedDbm | null {
 		schema = defaultSchemas[type]
 	}
 
-	return { type, path, resType, schema, table }
+	return { type, path, resType, schema, table, role: type === 'datatable' ? role : undefined }
 }
 
 const defaultSchemas: Record<string, string> = { datatable: 'public', ducklake: 'main' }
 
-function buildDbm(p: ParsedDbm): string {
+export function buildDbm(p: ParsedDbm): string {
 	const firstSeg = p.type === 'database' ? p.resType! : p.type
 	const schema = p.schema === defaultSchemas[p.type] ? undefined : p.schema
 	let schemaTable = ''
@@ -97,7 +115,12 @@ function buildDbm(p: ParsedDbm): string {
 	} else if (schema) {
 		schemaTable = `${schema}.`
 	}
-	return schemaTable ? `${firstSeg}~${p.path}~${schemaTable}` : `${firstSeg}~${p.path}`
+	const segments = [firstSeg, p.path]
+	if (schemaTable) segments.push(schemaTable)
+	if (p.type === 'datatable' && p.role !== undefined) {
+		segments.push(`${ROLE_SEGMENT_PREFIX}${p.role}`)
+	}
+	return segments.join('~')
 }
 
 export interface DbManagerUriState {
@@ -105,6 +128,8 @@ export interface DbManagerUriState {
 	readonly effectiveInput: DbInput | undefined
 	readonly isDatatableInput: boolean
 	selectedDatatable: string | undefined
+	/** The data table role the drawer connects as; undefined means its default. */
+	selectedRole: string | undefined
 	selectedSchema: string | undefined
 	selectedTable: string | undefined
 	readonly open: boolean
@@ -137,6 +162,7 @@ export function useDbManagerUriState(): DbManagerUriState {
 			type: 'database' as const,
 			resourceType: resType as DbType,
 			resourcePath: parsed.type === 'datatable' ? `datatable://${parsed.path}` : parsed.path,
+			role: parsed.role,
 			specificSchema: parsed.schema,
 			specificTable: parsed.table
 		}
@@ -163,6 +189,7 @@ export function useDbManagerUriState(): DbManagerUriState {
 				type: isDatatable ? 'datatable' : 'database',
 				path: isDatatable ? nInput.resourcePath.slice('datatable://'.length) : nInput.resourcePath,
 				resType: isDatatable ? undefined : nInput.resourceType,
+				role: isDatatable ? nInput.role : undefined,
 				schema: nInput.specificSchema,
 				table: nInput.specificTable
 			})
@@ -194,7 +221,14 @@ export function useDbManagerUriState(): DbManagerUriState {
 			return parsed?.type === 'datatable' ? parsed.path : undefined
 		},
 		set selectedDatatable(v: string | undefined) {
-			if (v) updateField({ path: v })
+			// A role belongs to one data table, so it cannot carry over to another.
+			if (v) updateField({ path: v, role: undefined })
+		},
+		get selectedRole() {
+			return parsed?.role
+		},
+		set selectedRole(v: string | undefined) {
+			updateField({ role: v })
 		},
 		get selectedSchema() {
 			return parsed?.schema
diff --git a/frontend/src/lib/components/dbManagerRole.test.ts b/frontend/src/lib/components/dbManagerRole.test.ts
new file mode 100644
index 0000000000..6c45d0ed30
--- /dev/null
+++ b/frontend/src/lib/components/dbManagerRole.test.ts
@@ -0,0 +1,67 @@
+import { describe, expect, it } from 'vitest'
+import { buildDbm, parseDbm } from './dbManagerDrawerModel.svelte'
+import { schemaCacheKey } from './dbSchemaCache'
+import { datatableReference, type DbInput } from './dbTypes'
+
+describe('dbm role segment', () => {
+	it('round-trips a role, with and without a table', () => {
+		for (const dbm of ['datatable~main~.orders~role=p4_analytics', 'datatable~main~role=p4-op']) {
+			expect(buildDbm(parseDbm(dbm)!)).toBe(dbm)
+		}
+		expect(parseDbm('datatable~main~sales.orders~role=analyst')).toMatchObject({
+			path: 'main',
+			schema: 'sales',
+			table: 'orders',
+			role: 'analyst'
+		})
+	})
+
+	it('reads a link without a role as the default role', () => {
+		const parsed = parseDbm('datatable~main~.orders')!
+		expect(parsed.role).toBeUndefined()
+		expect(parsed).toMatchObject({ schema: 'public', table: 'orders' })
+		expect(buildDbm(parsed)).toBe('datatable~main~.orders')
+	})
+
+	it('keeps an invalid role as written, so the connection refuses it', () => {
+		expect(parseDbm('datatable~main~role=a;b')?.role).toBe('a;b')
+		// A dot does not turn it into a schema.table selection read as the default role.
+		expect(parseDbm('datatable~main~role=bad.name')).toMatchObject({
+			role: 'bad.name',
+			schema: undefined,
+			table: undefined
+		})
+	})
+})
+
+describe('connecting as a role', () => {
+	const input = (role?: string): DbInput => ({
+		type: 'database',
+		resourceType: 'postgresql',
+		resourcePath: 'datatable://main',
+		role
+	})
+
+	// What `getDatabaseArg` builds every DB manager connection from.
+	it('appends the role to the data table reference', () => {
+		expect(datatableReference('main', 'p4_analytics')).toBe('datatable://main?role=p4_analytics')
+		expect(datatableReference('main', undefined)).toBe('datatable://main')
+	})
+
+	it('never appends a role to a name containing ?', () => {
+		// The server reads such a whole reference as the stored name first, so `?role=` would
+		// be taken as part of the name or refused instead of picking the role.
+		expect(datatableReference('legacy?x', undefined)).toBe('datatable://legacy?x')
+		expect(() => datatableReference('sales?role=analytics', 'admin')).toThrow(/'\?' in its name/)
+	})
+
+	it('refuses a role name the server would not accept', () => {
+		expect(() => datatableReference('main', 'a&role=admin')).toThrow(/Invalid data table role/)
+		expect(() => datatableReference('main', '')).toThrow(/Invalid data table role/)
+	})
+
+	it('keys the schema cache by role', () => {
+		expect(schemaCacheKey('ws', input('a'))).not.toBe(schemaCacheKey('ws', input('b')))
+		expect(schemaCacheKey('ws', input('a'))).not.toBe(schemaCacheKey('ws', input()))
+	})
+})
diff --git a/frontend/src/lib/components/dbOps.ts b/frontend/src/lib/components/dbOps.ts
index 5005cc931c..dbe507d13f 100644
--- a/frontend/src/lib/components/dbOps.ts
+++ b/frontend/src/lib/components/dbOps.ts
@@ -8,7 +8,8 @@ import { runScriptAndPollResult } from './jobs/utils'
 import { writingJobOptions } from './jobs/writingJob'
 import type { DBSchema, SQLSchema } from '$lib/stores'
 import { stringifySchema } from './copilot/lib'
-import type { DbInput, DbType } from './dbTypes'
+import { datatableReference, type DbInput, type DbType } from './dbTypes'
+import { withMigrationRole } from './datatableMigrationRole'
 import { assert } from '$lib/utils'
 import { WorkspaceService } from '$lib/gen'
 import { pendingMigrations } from './workspaceSettings/datatableMigrationUtils'
@@ -23,6 +24,7 @@ import {
 	transformSnowflakeForeignKeys,
 	type RawForeignKey
 } from './apps/components/display/dbtable/queries/relationalKeys'
+import { groupForeignKeyRows, type DbRelation, type RawAllForeignKeyRow } from './dbRelations'
 
 export type IDbTableOps = {
 	dbType: DbType
@@ -70,7 +72,9 @@ export function dbTableOpsWithPreviewScripts({
 }): IDbTableOps {
 	const dbType = getDbType(input)
 	const language = getLanguageByResourceType(dbType)
-	const dbArg = getDatabaseArg(input)
+	// Built per call: an invalid role throws there, as that operation's error, rather than while
+	// the manager renders.
+	const dbArg = () => getDatabaseArg(input)
 	const ducklake = input.type === 'ducklake' ? input.ducklake : undefined
 
 	function makeMarker(op: string, payload: Record<string, unknown>): string {
@@ -91,7 +95,7 @@ export function dbTableOpsWithPreviewScripts({
 			})
 			const result = await runScriptAndPollResult({
 				workspace,
-				requestBody: { args: { ...dbArg, quicksearch }, language, content, tag }
+				requestBody: { args: { ...dbArg(), quicksearch }, language, content, tag }
 			})
 			const count = result?.[0].count as number
 			return count
@@ -106,7 +110,7 @@ export function dbTableOpsWithPreviewScripts({
 			})
 			let items = (await runScriptAndPollResult({
 				workspace,
-				requestBody: { args: { ...dbArg, ...params }, language, content, tag }
+				requestBody: { args: { ...dbArg(), ...params }, language, content, tag }
 			})) as unknown[]
 			if (!items || !Array.isArray(items)) {
 				throw 'items is not an array'
@@ -123,7 +127,7 @@ export function dbTableOpsWithPreviewScripts({
 				{
 					workspace,
 					requestBody: {
-						args: { ...dbArg, value_to_update: newValue, ...values },
+						args: { ...dbArg(), value_to_update: newValue, ...values },
 						language,
 						content,
 						tag
@@ -135,14 +139,14 @@ export function dbTableOpsWithPreviewScripts({
 		onDelete: async ({ values }) => {
 			const content = makeMarker('DELETE', { table: tableKey, columns: colDefs })
 			await runScriptAndPollResult(
-				{ workspace, requestBody: { args: { ...dbArg, ...values }, language, content, tag } },
+				{ workspace, requestBody: { args: { ...dbArg(), ...values }, language, content, tag } },
 				writingJobOptions
 			)
 		},
 		onInsert: async ({ values }) => {
 			const content = makeMarker('INSERT', { table: tableKey, columns: colDefs })
 			await runScriptAndPollResult(
-				{ workspace, requestBody: { args: { ...dbArg, ...values }, language, content, tag } },
+				{ workspace, requestBody: { args: { ...dbArg(), ...values }, language, content, tag } },
 				writingJobOptions
 			)
 		}
@@ -246,6 +250,7 @@ export type IDbSchemaOps = {
 	previewAlterSql: (params: { values: AlterTableValues; schema?: string }) => Promise<string>
 	onCreateSchema: (params: { schema: string }) => Promise<void>
 	onDeleteSchema: (params: { schema: string }) => Promise<void>
+	onRenameSchema: (params: { schema: string; newSchema: string }) => Promise<void>
 	onFetchTableEditorDefinition: (params: {
 		table: string
 		schema?: string
@@ -255,6 +260,10 @@ export type IDbSchemaOps = {
 		table: string
 		schema?: string
 	}) => Promise<TableEditorForeignKey[]>
+	/** Every foreign key of the database in one query, for the schema diagram.
+	 * PostgreSQL only — the other databases either don't expose foreign keys or
+	 * can only be asked one table at a time. */
+	onFetchAllForeignKeys: () => Promise<DbRelation[]>
 }
 
 /** Thrown by a schema op when the user declines the out-of-order run warning.
@@ -283,7 +292,8 @@ export function dbSchemaOpsWithPreviewScripts({
 	tag?: string
 }): IDbSchemaOps {
 	const dbType = getDbType(input)
-	const dbArg = getDatabaseArg(input)
+	// Built per call, for the same reason as in the table ops above.
+	const dbArg = () => getDatabaseArg(input)
 	const language = getLanguageByResourceType(dbType)
 	const ducklake = input.type === 'ducklake' ? input.ducklake : undefined
 
@@ -293,6 +303,8 @@ export function dbSchemaOpsWithPreviewScripts({
 		input.type === 'database' && input.resourcePath.startsWith('datatable://')
 			? input.resourcePath.slice('datatable://'.length)
 			: undefined
+	// A migration declaring no role runs as admin, whatever role the manager connects as.
+	const migrationRole = input.type === 'database' ? (input.role ?? input.migrationRole) : undefined
 
 	function makeMarker(op: string, payload: Record<string, unknown>): string {
 		if (ducklake) payload.ducklake = ducklake
@@ -359,7 +371,7 @@ export function dbSchemaOpsWithPreviewScripts({
 			: undefined
 		if (!datatableName || !status?.enabled) {
 			await runScriptAndPollResult(
-				{ workspace, requestBody: { args: dbArg, content, language, tag } },
+				{ workspace, requestBody: { args: dbArg(), content, language, tag } },
 				writingJobOptions
 			)
 			return
@@ -373,12 +385,16 @@ export function dbSchemaOpsWithPreviewScripts({
 				throw new MigrationRunCancelled()
 			}
 		}
-		const codeUp = wrapMigration(await expandMarker(workspace, language, content))
+		// Wrapped before annotating: the annotation must lead, above `BEGIN;`.
+		const codeUp = withMigrationRole(
+			wrapMigration(await expandMarker(workspace, language, content)),
+			migrationRole
+		)
 		// Down migrations are only generated for Postgres for now.
 		let codeDown: string | undefined
 		if (downContent && dbType === 'postgresql') {
 			const downSql = (await expandMarker(workspace, language, downContent)).trim()
-			if (downSql) codeDown = wrapMigration(downSql)
+			if (downSql) codeDown = withMigrationRole(wrapMigration(downSql), migrationRole)
 		}
 		const created = await WorkspaceService.createDatatableMigration({
 			workspace,
@@ -415,7 +431,7 @@ export function dbSchemaOpsWithPreviewScripts({
 			const fkContent = makeMarker('FOREIGN_KEYS', { table, schema })
 			const fkResult = await runScriptAndPollResult({
 				workspace,
-				requestBody: { args: dbArg, content: fkContent, language, tag }
+				requestBody: { args: dbArg(), content: fkContent, language, tag }
 			})
 
 			let rawForeignKeys: RawForeignKey[]
@@ -443,6 +459,16 @@ export function dbSchemaOpsWithPreviewScripts({
 		return []
 	}
 
+	async function fetchAllForeignKeys(): Promise<DbRelation[]> {
+		if (dbType !== 'postgresql') return []
+		const content = makeMarker('ALL_FOREIGN_KEYS', {})
+		const rows = (await runScriptAndPollResult({
+			workspace,
+			requestBody: { args: dbArg(), content, language, tag }
+		})) as RawAllForeignKeyRow[]
+		return Array.isArray(rows) ? groupForeignKeyRows(rows) : []
+	}
+
 	return {
 		onDelete: async ({ tableKey, schema }) => {
 			const content = makeMarker('DROP_TABLE', { table: tableKey, schema })
@@ -501,7 +527,13 @@ export function dbSchemaOpsWithPreviewScripts({
 			const downContent = makeMarker('CREATE_SCHEMA', { schema })
 			await applyDdl(migrationName('drop_schema', schema), content, downContent)
 		},
+		onRenameSchema: async ({ schema, newSchema }) => {
+			const content = makeMarker('RENAME_SCHEMA', { schema, new_schema: newSchema })
+			const downContent = makeMarker('RENAME_SCHEMA', { schema: newSchema, new_schema: schema })
+			await applyDdl(migrationName('rename_schema', schema), content, downContent)
+		},
 		onFetchForeignKeys: fetchForeignKeys,
+		onFetchAllForeignKeys: fetchAllForeignKeys,
 		onFetchTableEditorDefinition: async ({ table, schema, colDefs }) => {
 			const foreignKeys = await fetchForeignKeys({ table, schema })
 			let pk_constraint_name: string | undefined
@@ -512,7 +544,7 @@ export function dbSchemaOpsWithPreviewScripts({
 					const pkContent = makeMarker('PRIMARY_KEY_CONSTRAINT', { table, schema })
 					const pkResult = (await runScriptAndPollResult({
 						workspace,
-						requestBody: { args: dbArg, content: pkContent, language, tag }
+						requestBody: { args: dbArg(), content: pkContent, language, tag }
 					})) as { constraint_name?: string; CONSTRAINT_NAME?: string }[]
 
 					if (pkResult && Array.isArray(pkResult) && pkResult.length > 0) {
@@ -611,7 +643,9 @@ export function getDefaultDbTag(input: DbInput): string {
 export function getDatabaseArg(input: DbInput | undefined) {
 	if (input?.type === 'database') {
 		if (input.resourcePath.startsWith('datatable://')) {
-			return { database: input.resourcePath }
+			return {
+				database: datatableReference(input.resourcePath.slice('datatable://'.length), input.role)
+			}
 		} else {
 			return { database: '$res:' + input.resourcePath }
 		}
diff --git a/frontend/src/lib/components/dbRelations.test.ts b/frontend/src/lib/components/dbRelations.test.ts
new file mode 100644
index 0000000000..ad5d63a43e
--- /dev/null
+++ b/frontend/src/lib/components/dbRelations.test.ts
@@ -0,0 +1,81 @@
+import { describe, expect, it } from 'vitest'
+import { buildRelationIndex, groupForeignKeyRows, type RawAllForeignKeyRow } from './dbRelations'
+
+function row(over: Partial<RawAllForeignKeyRow>): RawAllForeignKeyRow {
+	return {
+		fk_constraint_name: 'fk',
+		source_schema: 'shop',
+		source_table: 'orders',
+		source_column: 'customer_id',
+		target_schema: 'shop',
+		target_table: 'customers',
+		target_column: 'id',
+		ordinal: 1,
+		...over
+	}
+}
+
+describe('groupForeignKeyRows', () => {
+	it('pairs a composite key by ordinal, whatever order the rows arrive in', () => {
+		const relations = groupForeignKeyRows([
+			row({
+				fk_constraint_name: 'returns_order_item_fkey',
+				source_table: 'returns',
+				source_column: 'sku',
+				target_table: 'order_items',
+				target_column: 'sku',
+				ordinal: 2
+			}),
+			row({
+				fk_constraint_name: 'returns_order_item_fkey',
+				source_table: 'returns',
+				source_column: 'order_id',
+				target_table: 'order_items',
+				target_column: 'order_id',
+				ordinal: 1
+			})
+		])
+
+		expect(relations).toHaveLength(1)
+		expect(relations[0].from.columns).toEqual(['order_id', 'sku'])
+		expect(relations[0].to.columns).toEqual(['order_id', 'sku'])
+	})
+
+	it('keeps same-named constraints on different tables apart', () => {
+		const relations = groupForeignKeyRows([
+			row({ fk_constraint_name: 'owner_fkey', source_table: 'orders' }),
+			row({ fk_constraint_name: 'owner_fkey', source_table: 'addresses' })
+		])
+		expect(relations.map((r) => r.from.table).sort()).toEqual(['addresses', 'orders'])
+	})
+})
+
+describe('buildRelationIndex', () => {
+	const index = buildRelationIndex(
+		groupForeignKeyRows([
+			row({ source_table: 'orders', source_column: 'customer_id', target_column: 'id' }),
+			row({
+				fk_constraint_name: 'items_order_fkey',
+				source_table: 'order_items',
+				source_column: 'order_id',
+				target_table: 'orders',
+				target_column: 'id'
+			})
+		])
+	)
+
+	it('links a column only to the column it is actually paired with', () => {
+		// `order_items.order_id` points at `orders.id`, not at the same-named
+		// column of every other table taking part in a relation.
+		expect([...(index.linkedColumns.get('shop.order_items.order_id') ?? [])]).toEqual([
+			'shop.orders.id'
+		])
+	})
+
+	it('relates tables in both directions', () => {
+		expect([...(index.relatedTables.get('shop.orders') ?? [])].sort()).toEqual([
+			'shop.customers',
+			'shop.order_items'
+		])
+	})
+})
diff --git a/frontend/src/lib/components/dbRelations.ts b/frontend/src/lib/components/dbRelations.ts
new file mode 100644
index 0000000000..eb6451057e
--- /dev/null
+++ b/frontend/src/lib/components/dbRelations.ts
@@ -0,0 +1,137 @@
+/** One row of the `ALL_FOREIGN_KEYS` marker: a single referencing column. */
+export type RawAllForeignKeyRow = {
+	fk_constraint_name: string
+	source_schema: string
+	source_table: string
+	source_column: string
+	target_schema: string
+	target_table: string
+	target_column: string
+	ordinal: number | string
+}
+
+export type DbTableRef = { schema: string; table: string }
+
+/** A foreign key, with its columns paired to the ones they point at by index. */
+export type DbRelation = {
+	constraint: string
+	from: DbTableRef & { columns: string[] }
+	to: DbTableRef & { columns: string[] }
+}
+
+export function tableKeyOf(ref: DbTableRef): string {
+	return `${ref.schema}.${ref.table}`
+}
+
+export function columnKeyOf(ref: DbTableRef, column: string): string {
+	return columnKeyIn(tableKeyOf(ref), column)
+}
+
+export function columnKeyIn(tableKey: string, column: string): string {
+	return `${tableKey}.${column}`
+}
+
+/** Groups the flat rows into one relation per constraint, keeping the column
+ * pairs in the constraint's declaration order (the query's `ordinal`). */
+export function groupForeignKeyRows(rows: RawAllForeignKeyRow[]): DbRelation[] {
+	const byConstraint = new Map<string, { relation: DbRelation; pairs: RawAllForeignKeyRow[] }>()
+
+	for (const raw of rows) {
+		const row = lowercaseKeys(raw)
+		if (!row.source_table || !row.target_table) continue
+		const key = `${row.source_schema}.${row.source_table}.${row.fk_constraint_name}`
+		let entry = byConstraint.get(key)
+		if (!entry) {
+			entry = {
+				relation: {
+					constraint: row.fk_constraint_name,
+					from: { schema: row.source_schema, table: row.source_table, columns: [] },
+					to: { schema: row.target_schema, table: row.target_table, columns: [] }
+				},
+				pairs: []
+			}
+			byConstraint.set(key, entry)
+		}
+		entry.pairs.push(row)
+	}
+
+	return Array.from(byConstraint.values()).map(({ relation, pairs }) => {
+		pairs.sort((a, b) => Number(a.ordinal) - Number(b.ordinal))
+		relation.from.columns = pairs.map((p) => p.source_column)
+		relation.to.columns = pairs.map((p) => p.target_column)
+		return relation
+	})
+}
+
+function lowercaseKeys(row: RawAllForeignKeyRow): RawAllForeignKeyRow {
+	const out: any = {}
+	for (const key of Object.keys(row)) out[key.toLowerCase()] = (row as any)[key]
+	return out as RawAllForeignKeyRow
+}
+
+/** Everything the diagram needs to answer "what lights up when this is hovered".
+ * Built once per fetched relation set, then read on every hover. */
+export type RelationIndex = {
+	/** Tables reachable from a table by one foreign key, either direction. */
+	relatedTables: Map<string, Set<string>>
+	/** Columns a column is paired with by a foreign key, either direction. */
+	linkedColumns: Map<string, Set<string>>
+	/** Every column taking part in a relation of a table, keyed by table. Both
+	 * the table's own referencing/referenced columns and the far ends. */
+	relatedColumns: Map<string, Set<string>>
+	/** Columns that reference another table — rendered with a link marker. */
+	referencingColumns: Set<string>
+	/** Columns another table points at. */
+	referencedColumns: Set<string>
+	/** The table a column key belongs to. Both parts are dot-joined names, so
+	 * splitting a column key back apart is not safe. */
+	columnTable: Map<string, string>
+}
+
+export function buildRelationIndex(relations: DbRelation[]): RelationIndex {
+	const index: RelationIndex = {
+		relatedTables: new Map(),
+		linkedColumns: new Map(),
+		relatedColumns: new Map(),
+		referencingColumns: new Set(),
+		referencedColumns: new Set(),
+		columnTable: new Map()
+	}
+
+	for (const relation of relations) {
+		const fromTable = tableKeyOf(relation.from)
+		const toTable = tableKeyOf(relation.to)
+
+		add(index.relatedTables, fromTable, toTable)
+		add(index.relatedTables, toTable, fromTable)
+
+		const pairCount = Math.min(relation.from.columns.length, relation.to.columns.length)
+		for (let i = 0; i < pairCount; i++) {
+			const fromColumn = columnKeyOf(relation.from, relation.from.columns[i])
+			const toColumn = columnKeyOf(relation.to, relation.to.columns[i])
+
+			index.referencingColumns.add(fromColumn)
+			index.referencedColumns.add(toColumn)
+			index.columnTable.set(fromColumn, fromTable)
+			index.columnTable.set(toColumn, toTable)
+
+			add(index.linkedColumns, fromColumn, toColumn)
+			add(index.linkedColumns, toColumn, fromColumn)
+
+			// Both ends of the pair under both tables: hovering either table has to
+			// light its own column and the one it is paired with.
+			for (const table of [fromTable, toTable]) {
+				add(index.relatedColumns, table, fromColumn)
+				add(index.relatedColumns, table, toColumn)
+			}
+		}
+	}
+
+	return index
+}
+
+function add(map: Map<string, Set<string>>, key: string, value: string) {
+	let set = map.get(key)
+	if (!set) map.set(key, (set = new Set()))
+	set.add(value)
+}
diff --git a/frontend/src/lib/components/dbSchemaCache.ts b/frontend/src/lib/components/dbSchemaCache.ts
new file mode 100644
index 0000000000..0421c0c033
--- /dev/null
+++ b/frontend/src/lib/components/dbSchemaCache.ts
@@ -0,0 +1,21 @@
+import type { DbInput } from './dbTypes'
+
+/** What identifies a database's schema, role included: two roles on one data table may reach
+ * different schemas, so they cannot share a cache entry. Never throws, since it keys derived
+ * state; the connection itself is what refuses an invalid role. */
+export function getDbSchemasPath(input: DbInput): string {
+	switch (input.type) {
+		case 'database':
+			return input.role !== undefined && input.resourcePath.startsWith('datatable://')
+				? `${input.resourcePath}?role=${input.role}`
+				: input.resourcePath
+		case 'ducklake':
+			return 'ducklake://' + input.ducklake
+	}
+}
+
+/** Scoped by the acting workspace: a data table of the same name can exist in both the nav and
+ * the acting workspace, and one's schema must not be reused for the other. */
+export function schemaCacheKey(workspace: string | undefined, input: DbInput): string {
+	return `${workspace}:${getDbSchemasPath(input)}`
+}
diff --git a/frontend/src/lib/components/dbTypes.ts b/frontend/src/lib/components/dbTypes.ts
index 6a85617110..e6d3af12e8 100644
--- a/frontend/src/lib/components/dbTypes.ts
+++ b/frontend/src/lib/components/dbTypes.ts
@@ -3,6 +3,12 @@ export type DbInput =
 			type: 'database'
 			resourceType: DbType
 			resourcePath: string
+			/** The data table role to connect as; the data table's default when unset. Only
+			 * meaningful for a `datatable://` path. */
+			role?: string
+			/** The role migrations written through this input declare when `role` is unset. A
+			 * migration declaring none runs as admin, not as the role the manager connects as. */
+			migrationRole?: string
 			specificSchema?: string
 			specificTable?: string
 	  }
@@ -23,3 +29,47 @@ export const dbTypes = [
 	'duckdb'
 ] as const
 export const isDbType = (str?: string): str is DbType => !!str && dbTypes.includes(str as DbType)
+
+/** The role every data table has: the one it connects as when it is not under roles. */
+export const ADMIN_DATATABLE_ROLE = 'admin'
+
+/** What the server accepts in `-- role <name>` and `?role=<name>`. */
+export function isDatatableRoleName(name: string): boolean {
+	return /^[A-Za-z0-9_-]{1,63}$/.test(name)
+}
+
+/** Whether a role can be named in a reference to this data table. A name stored before names were
+ * restricted may contain `?`, and the server reads such a whole reference as that name first, so
+ * `?role=` after it would be taken as part of the name or refused. */
+export function datatableNameTakesRole(name: string): boolean {
+	return !name.includes('?')
+}
+
+/** The `migrationRole` of a data table that cannot name a role in its reference: it connects as
+ * its default role, which its migrations must then declare. */
+export function defaultMigrationRole(
+	name: string,
+	permissioned: boolean | undefined,
+	defaultRole: string | undefined
+): string | undefined {
+	return permissioned && !datatableNameTakesRole(name) ? defaultRole : undefined
+}
+
+/** `datatable://<name>`, with `?role=<role>` when a role is named. Throws rather than build a
+ * reference the executor would refuse, or one that would silently mean another role. */
+export function datatableReference(name: string, role: string | undefined): string {
+	if (role === undefined) return `datatable://${name}`
+	if (!isDatatableRoleName(role)) {
+		throw new Error(
+			`Invalid data table role '${role}': only letters, digits, '_' and '-' are allowed`
+		)
+	}
+	if (!datatableNameTakesRole(name)) {
+		throw new Error(
+			`Data table '${name}' has a '?' in its name, so it can only be used here as its default role. Rename it to connect as role '${role}'.`
+		)
+	}
+	return `datatable://${name}?role=${role}`
+}
+
+export type DatatableRowAction = 'migrations' | 'roles' | 'export' | 'import'
diff --git a/frontend/src/lib/components/dbdiagram/DbSchemaDiagram.svelte b/frontend/src/lib/components/dbdiagram/DbSchemaDiagram.svelte
new file mode 100644
index 0000000000..d9b2752374
--- /dev/null
+++ b/frontend/src/lib/components/dbdiagram/DbSchemaDiagram.svelte
@@ -0,0 +1,171 @@
+<script lang="ts">
+	import { SvelteFlow, Controls, SvelteFlowProvider, type Node } from '@xyflow/svelte'
+	import '@xyflow/svelte/dist/base.css'
+	import { SvelteSet } from 'svelte/reactivity'
+	import { Loader2 } from 'lucide-svelte'
+	import Alert from '../common/alert/Alert.svelte'
+	import GraphZoomControls from '../graph/GraphZoomControls.svelte'
+	import DbTableNode from './DbTableNode.svelte'
+	import DiagramAutoFit from './DiagramAutoFit.svelte'
+	import { buildRelationIndex, type DbRelation } from '../dbRelations'
+	import { DbDiagramHighlight, setDbDiagramHighlight } from './dbDiagramHighlight.svelte'
+	import {
+		buildDiagramTables,
+		cardHeight,
+		layoutTables,
+		visibleColumns,
+		CARD_WIDTH
+	} from './dbDiagramModel'
+	import type { DBSchema } from '$lib/stores'
+	import type { ColumnDef } from '../apps/components/display/dbtable/utils'
+	import type { SelectedTable } from '../DBManager.svelte'
+
+	interface Props {
+		dbSchema: DBSchema
+		colDefs: Record<string, ColumnDef[]> | undefined
+		selectedTables: SelectedTable[]
+		relations: DbRelation[]
+		loading?: boolean
+		error?: string | undefined
+		/** Opens a table in the data view. */
+		onOpenTable?: (table: SelectedTable) => void
+	}
+
+	let {
+		dbSchema,
+		colDefs,
+		selectedTables,
+		relations,
+		loading = false,
+		error = undefined,
+		onOpenTable
+	}: Props = $props()
+
+	let index = $derived(buildRelationIndex(relations))
+	const highlight = new DbDiagramHighlight(() => index)
+	setDbDiagramHighlight(highlight)
+
+	let expanded = new SvelteSet<string>()
+
+	let tables = $derived(buildDiagramTables(dbSchema, colDefs, selectedTables))
+
+	// Laid out from scratch on every change to the selection or to a card's
+	// height. There are no edges to keep stable, so a fresh packing reads better
+	// than leaving holes where deselected tables were — and cards are not draggable,
+	// since a moved card would snap back at the next layout.
+	let nodes = $state.raw<Node[]>([])
+	$effect(() => {
+		const positions = layoutTables(tables, expanded)
+		nodes = tables.map((table) => ({
+			id: table.key,
+			type: 'dbTable',
+			position: positions[table.key],
+			width: CARD_WIDTH,
+			height: cardHeight(table, expanded.has(table.key)),
+			data: {
+				table,
+				expanded: expanded.has(table.key),
+				index,
+				onToggleExpand: () => {
+					if (!expanded.delete(table.key)) expanded.add(table.key)
+				},
+				onOpenTable: () => onOpenTable?.({ schema: table.schema, table: table.table })
+			}
+		}))
+	})
+
+	// A pin whose table was unchecked, or whose column was folded away by
+	// collapsing its card, would leave the canvas dimmed around nothing on screen.
+	$effect(() => {
+		const pinned = highlight.pinned
+		if (!pinned) return
+		const table = tables.find((t) => t.key === pinned.table)
+		const shown =
+			!!table &&
+			(!pinned.column ||
+				visibleColumns(table, expanded.has(table.key)).some((c) => c.name === pinned.column))
+		if (!shown) highlight.pinned = undefined
+	})
+
+	let fitKey = $derived(tables.map((t) => t.key).join('\n'))
+
+	const nodeTypes = { dbTable: DbTableNode }
+</script>
+
+<div class="h-full w-full relative">
+	{#if error}
+		<div class="absolute inset-x-0 top-0 z-10 p-2">
+			<Alert type="error" title="Could not load the relationships" size="xs">{error}</Alert>
+		</div>
+	{/if}
+	{#if tables.length === 0}
+		<div class="h-full w-full center-center">
+			<span class="text-sm text-hint">Check tables in the sidebar to draw them here</span>
+		</div>
+	{:else}
+		<SvelteFlowProvider>
+			<SvelteFlow
+				bind:nodes
+				edges={[]}
+				{nodeTypes}
+				minZoom={0.1}
+				maxZoom={1.6}
+				proOptions={{ hideAttribution: true }}
+				elementsSelectable={false}
+				nodesDraggable={false}
+				zoomOnDoubleClick={false}
+				deleteKey={null}
+				onpaneclick={() => highlight.clear()}
+			>
+				<div class="absolute inset-0 !bg-surface-secondary h-full"></div>
+				<DiagramAutoFit key={fitKey} />
+				<Controls
+					class="wm-db-diagram-controls"
+					position="bottom-right"
+					orientation="horizontal"
+					showLock={false}
+					showZoom={false}
+					showFitView={false}
+				>
+					<GraphZoomControls />
+				</Controls>
+			</SvelteFlow>
+		</SvelteFlowProvider>
+	{/if}
+	{#if loading}
+		<div
+			class="absolute top-2 left-2 z-10 flex items-center gap-2 text-xs text-tertiary bg-surface-secondary rounded px-2 py-1"
+		>
+			<Loader2 size={12} class="animate-spin" />
+			Loading relationships
+		</div>
+	{/if}
+</div>
+
+<style lang="postcss">
+	/* xy-flow's own control rules are nested and match ours exactly, so scoping by
+	   the class passed to <Controls> outranks them rather than racing load order. */
+	:global(.svelte-flow__controls.wm-db-diagram-controls) {
+		@apply overflow-hidden rounded-md border border-border-light bg-surface;
+		box-shadow: none;
+	}
+	:global(.wm-db-diagram-controls .svelte-flow__controls-button) {
+		@apply bg-surface text-primary border-r border-border-light;
+		width: 32px;
+		height: 30px;
+		padding: 8px;
+	}
+	:global(.wm-db-diagram-controls .svelte-flow__controls-button:last-child) {
+		@apply border-r-0;
+	}
+	:global(.wm-db-diagram-controls .svelte-flow__controls-button:hover) {
+		@apply bg-surface-hover;
+	}
+	/* The glyphs are lucide, so undo xy-flow's `fill: currentColor` and its 12px cap. */
+	:global(.wm-db-diagram-controls .svelte-flow__controls-button svg) {
+		max-width: 16px;
+		max-height: 16px;
+		fill: none;
+		stroke: currentColor;
+	}
+</style>
diff --git a/frontend/src/lib/components/dbdiagram/DbTableNode.svelte b/frontend/src/lib/components/dbdiagram/DbTableNode.svelte
new file mode 100644
index 0000000000..d17faaa006
--- /dev/null
+++ b/frontend/src/lib/components/dbdiagram/DbTableNode.svelte
@@ -0,0 +1,118 @@
+<script lang="ts">
+	import { ChevronDown, ChevronUp, KeyRound, Link2, Table2 } from 'lucide-svelte'
+	import { twMerge } from 'tailwind-merge'
+	import { Button } from '$lib/components/common'
+	import { columnKeyIn, type RelationIndex } from '../dbRelations'
+	import { getDbDiagramHighlight } from './dbDiagramHighlight.svelte'
+	import {
+		CARD_WIDTH,
+		HEADER_HEIGHT,
+		ROW_HEIGHT,
+		hasExpandToggle,
+		hiddenColumnCount,
+		visibleColumns,
+		type DiagramTable
+	} from './dbDiagramModel'
+
+	interface Props {
+		data: {
+			table: DiagramTable
+			expanded: boolean
+			index: RelationIndex
+			onToggleExpand: () => void
+			onOpenTable: () => void
+		}
+	}
+
+	let { data }: Props = $props()
+
+	const highlight = getDbDiagramHighlight()
+
+	let table = $derived(data.table)
+	let columns = $derived(visibleColumns(table, data.expanded))
+	let hidden = $derived(hiddenColumnCount(table, data.expanded))
+
+	let isTarget = $derived(highlight.target?.table === table.key)
+	let lit = $derived(highlight.tables?.has(table.key) ?? true)
+	let dimmed = $derived(!!highlight.tables && !lit)
+</script>
+
+<!-- svelte-ignore a11y_no_static_element_interactions -->
+<div
+	class={twMerge(
+		'rounded-md border bg-surface-tertiary shadow-sm transition-opacity duration-150 overflow-hidden',
+		dimmed ? 'opacity-20' : 'opacity-100',
+		isTarget
+			? 'border-border-accent'
+			: lit && highlight.tables
+				? 'border-border-selected'
+				: 'border-border-light'
+	)}
+	style="width: {CARD_WIDTH}px"
+	onmouseenter={() => highlight.hover({ table: table.key })}
+	onmouseleave={() => highlight.hover(undefined)}
+	onclick={() => highlight.togglePin({ table: table.key })}
+	role="button"
+	tabindex="-1"
+>
+	<!-- Opening the table is the header's alone: the rows move under the pointer when
+	     the card expands, so a double-click on the expand control would land on one. -->
+	<!-- svelte-ignore a11y_no_static_element_interactions -->
+	<div
+		class={twMerge(
+			'flex items-center gap-1.5 px-2 border-b border-border-light',
+			isTarget ? 'bg-surface-accent-selected' : 'bg-surface-secondary'
+		)}
+		style="height: {HEADER_HEIGHT}px"
+		title={table.key}
+		ondblclick={data.onOpenTable}
+	>
+		<Table2 size={13} class="shrink-0 text-secondary" />
+		<span class="truncate text-xs font-semibold text-emphasis">{table.table}</span>
+		<span class="truncate text-2xs text-tertiary ml-auto">{table.schema}</span>
+	</div>
+
+	{#each columns as column (column.name)}
+		{@const columnKey = columnKeyIn(table.key, column.name)}
+		{@const isLit = highlight.columns?.has(columnKey)}
+		<!-- svelte-ignore a11y_no_static_element_interactions -->
+		<div
+			class={twMerge(
+				'flex items-center gap-1.5 px-2 text-2xs',
+				isLit ? 'bg-surface-accent-selected text-accent font-medium' : 'text-primary'
+			)}
+			style="height: {ROW_HEIGHT}px"
+			onmouseenter={() => highlight.hover({ table: table.key, column: column.name })}
+			onmouseleave={() => highlight.hover({ table: table.key })}
+			onclick={(e) => {
+				e.stopPropagation()
+				highlight.togglePin({ table: table.key, column: column.name })
+			}}
+		>
+			{#if column.isPrimaryKey}
+				<KeyRound size={11} class="shrink-0 text-yellow-500" />
+			{:else if data.index.referencingColumns.has(columnKey)}
+				<Link2 size={11} class="shrink-0 text-secondary" />
+			{:else}
+				<span class="shrink-0 w-[11px]"></span>
+			{/if}
+			<span class="truncate">{column.name}</span>
+			<span class="truncate text-hint ml-auto pl-2">{column.datatype}</span>
+		</div>
+	{/each}
+
+	{#if hasExpandToggle(table)}
+		<div class="flex items-center px-1" style="height: {ROW_HEIGHT}px">
+			<Button
+				variant="subtle"
+				unifiedSize="2xs"
+				startIcon={{ icon: data.expanded ? ChevronUp : ChevronDown }}
+				wrapperClasses="w-full"
+				btnClasses="w-full justify-start"
+				onClick={() => data.onToggleExpand()}
+			>
+				{data.expanded ? 'Show less' : `${hidden} more`}
+			</Button>
+		</div>
+	{/if}
+</div>
diff --git a/frontend/src/lib/components/dbdiagram/DiagramAutoFit.svelte b/frontend/src/lib/components/dbdiagram/DiagramAutoFit.svelte
new file mode 100644
index 0000000000..b271886abd
--- /dev/null
+++ b/frontend/src/lib/components/dbdiagram/DiagramAutoFit.svelte
@@ -0,0 +1,20 @@
+<script lang="ts">
+	import { useSvelteFlow } from '@xyflow/svelte'
+	import { tick } from 'svelte'
+
+	interface Props {
+		/** Refits whenever this changes — the set of drawn tables, not their
+		 * heights, so expanding a card doesn't move the view under the pointer. */
+		key: string
+	}
+
+	let { key }: Props = $props()
+
+	// Its own component so the hook runs inside the flow, as GraphZoomControls does.
+	const { fitView } = useSvelteFlow()
+
+	$effect(() => {
+		key
+		tick().then(() => fitView({ maxZoom: 1 }))
+	})
+</script>
diff --git a/frontend/src/lib/components/dbdiagram/dbDiagramHighlight.svelte.ts b/frontend/src/lib/components/dbdiagram/dbDiagramHighlight.svelte.ts
new file mode 100644
index 0000000000..54f52b85ca
--- /dev/null
+++ b/frontend/src/lib/components/dbdiagram/dbDiagramHighlight.svelte.ts
@@ -0,0 +1,80 @@
+import { getContext, setContext } from 'svelte'
+import { columnKeyIn, type RelationIndex } from '../dbRelations'
+
+/** What the pointer is on: a whole table, or one of its columns. */
+export type HighlightTarget = { table: string; column?: string }
+
+const EMPTY: ReadonlySet<string> = new Set()
+
+/**
+ * The diagram draws no edges, so the relationships only exist while something is
+ * highlighted. This owns that: what is hovered (or pinned by a click), and which
+ * tables and columns it lights up.
+ */
+export class DbDiagramHighlight {
+	#getIndex: () => RelationIndex
+
+	hovered = $state<HighlightTarget | undefined>(undefined)
+	/** Set by clicking, so the relations can be read without holding the pointer
+	 * still. A hover takes precedence while it lasts. */
+	pinned = $state<HighlightTarget | undefined>(undefined)
+
+	target = $derived(this.hovered ?? this.pinned)
+
+	/** Tables that stay lit. Undefined means nothing is highlighted and every
+	 * table renders at full strength. */
+	tables = $derived.by<ReadonlySet<string> | undefined>(() => {
+		const target = this.target
+		if (!target) return undefined
+		if (target.column) {
+			const columnTable = this.#getIndex().columnTable
+			const tables = new Set([target.table])
+			for (const column of this.columns ?? EMPTY) {
+				const table = columnTable.get(column)
+				if (table) tables.add(table)
+			}
+			return tables
+		}
+		return new Set([target.table, ...(this.#getIndex().relatedTables.get(target.table) ?? EMPTY)])
+	})
+
+	/** Columns that stay lit inside the highlighted tables. */
+	columns = $derived.by<ReadonlySet<string> | undefined>(() => {
+		const target = this.target
+		if (!target) return undefined
+		const index = this.#getIndex()
+		if (target.column) {
+			const key = columnKeyIn(target.table, target.column)
+			return new Set([key, ...(index.linkedColumns.get(key) ?? EMPTY)])
+		}
+		return index.relatedColumns.get(target.table) ?? EMPTY
+	})
+
+	constructor(getIndex: () => RelationIndex) {
+		this.#getIndex = getIndex
+	}
+
+	hover(target: HighlightTarget | undefined) {
+		this.hovered = target
+	}
+
+	/** Clicking the already-pinned target unpins it. */
+	togglePin(target: HighlightTarget) {
+		const current = this.pinned
+		this.pinned =
+			current && current.table === target.table && current.column === target.column
+				? undefined
+				: target
+	}
+
+	clear() {
+		this.hovered = undefined
+		this.pinned = undefined
+	}
+}
+
+const contextKey = 'DbDiagramHighlight'
+
+export const setDbDiagramHighlight = (highlight: DbDiagramHighlight) =>
+	setContext(contextKey, highlight)
+export const getDbDiagramHighlight = () => getContext<DbDiagramHighlight>(contextKey)
diff --git a/frontend/src/lib/components/dbdiagram/dbDiagramModel.test.ts b/frontend/src/lib/components/dbdiagram/dbDiagramModel.test.ts
new file mode 100644
index 0000000000..8b6b584860
--- /dev/null
+++ b/frontend/src/lib/components/dbdiagram/dbDiagramModel.test.ts
@@ -0,0 +1,45 @@
+import { describe, expect, it } from 'vitest'
+import { CARD_WIDTH, cardHeight, layoutTables, type DiagramTable } from './dbDiagramModel'
+
+function table(name: string, columnCount: number): DiagramTable {
+	return {
+		key: `shop.${name}`,
+		schema: 'shop',
+		table: name,
+		columns: Array.from({ length: columnCount }, (_, i) => ({
+			name: `c${i}`,
+			datatype: 'text',
+			isPrimaryKey: i === 0
+		}))
+	}
+}
+
+describe('layoutTables', () => {
+	// Runs again on every checkbox click, so cards must not land on top of each
+	// other for any mix of card heights.
+	it('never overlaps two cards', () => {
+		const tables = Array.from({ length: 40 }, (_, i) => table(`t${i}`, 1 + (i % 17)))
+		const expanded = new Set(['shop.t3', 'shop.t20'])
+		const positions = layoutTables(tables, expanded)
+
+		const boxes = tables.map((t) => ({
+			x: positions[t.key].x,
+			y: positions[t.key].y,
+			h: cardHeight(t, expanded.has(t.key))
+		}))
+		for (let i = 0; i < boxes.length; i++) {
+			for (let j = i + 1; j < boxes.length; j++) {
+				const a = boxes[i]
+				const b = boxes[j]
+				const apart =
+					a.x + CARD_WIDTH <= b.x || b.x + CARD_WIDTH <= a.x || a.y + a.h <= b.y || b.y + b.h <= a.y
+				expect(apart, `${tables[i].key} overlaps ${tables[j].key}`).toBe(true)
+			}
+		}
+	})
+
+	it('places the same tables in the same spots every time', () => {
+		const tables = Array.from({ length: 12 }, (_, i) => table(`t${i}`, 3 + i))
+		expect(layoutTables(tables, new Set())).toEqual(layoutTables(tables, new Set()))
+	})
+})
diff --git a/frontend/src/lib/components/dbdiagram/dbDiagramModel.ts b/frontend/src/lib/components/dbdiagram/dbDiagramModel.ts
new file mode 100644
index 0000000000..ccd32cdb22
--- /dev/null
+++ b/frontend/src/lib/components/dbdiagram/dbDiagramModel.ts
@@ -0,0 +1,131 @@
+import type { DBSchema } from '$lib/stores'
+import type { ColumnDef } from '../apps/components/display/dbtable/utils'
+import type { SelectedTable } from '../DBManager.svelte'
+import { tableKeyOf } from '../dbRelations'
+
+export type DiagramColumn = {
+	name: string
+	datatype: string
+	isPrimaryKey: boolean
+}
+
+export type DiagramTable = {
+	/** `schema.table`, the key relations and highlights are addressed by. */
+	key: string
+	schema: string
+	table: string
+	columns: DiagramColumn[]
+}
+
+/** Card geometry. The node component must render exactly the rows the layout
+ * budgeted for, or cards overlap. */
+export const CARD_WIDTH = 248
+export const HEADER_HEIGHT = 34
+export const ROW_HEIGHT = 22
+const CARD_PADDING = 6
+const GAP_X = 32
+const GAP_Y = 20
+/** Rows shown before a card collapses into a "+N more" row. */
+export const COLLAPSED_ROW_LIMIT = 12
+/** Cards are packed towards this width/height ratio, so the canvas opens on
+ * something screen-shaped rather than one very long column. */
+const TARGET_ASPECT = 1.7
+
+export function visibleColumns(table: DiagramTable, expanded: boolean): DiagramColumn[] {
+	return expanded ? table.columns : table.columns.slice(0, COLLAPSED_ROW_LIMIT)
+}
+
+export function hiddenColumnCount(table: DiagramTable, expanded: boolean): number {
+	return table.columns.length - visibleColumns(table, expanded).length
+}
+
+/** Whether the card carries a row to expand or collapse its column list. */
+export function hasExpandToggle(table: DiagramTable): boolean {
+	return table.columns.length > COLLAPSED_ROW_LIMIT
+}
+
+export function cardHeight(table: DiagramTable, expanded: boolean): number {
+	const rows = visibleColumns(table, expanded).length + (hasExpandToggle(table) ? 1 : 0)
+	return HEADER_HEIGHT + rows * ROW_HEIGHT + CARD_PADDING
+}
+
+/** The tables to draw, in the order they are laid out. */
+export function buildDiagramTables(
+	dbSchema: DBSchema,
+	colDefs: Record<string, ColumnDef[]> | undefined,
+	selected: SelectedTable[]
+): DiagramTable[] {
+	if (dbSchema.lang === 'graphql') return []
+	const tables: DiagramTable[] = []
+
+	for (const { schema, table } of selected) {
+		const key = tableKeyOf({ schema, table })
+		const fromColDefs = colDefs?.[key]
+		let columns: DiagramColumn[]
+		if (fromColDefs?.length) {
+			columns = fromColDefs.map((col) => ({
+				name: col.field ?? '',
+				datatype: col.datatype ?? '',
+				isPrimaryKey: !!col.isprimarykey
+			}))
+		} else {
+			// The cached schema has no primary-key flag; it only stands in until the
+			// column metadata query lands.
+			const schemaColumns = dbSchema.schema[schema]?.[table]
+			if (!schemaColumns) continue
+			columns = Object.entries(schemaColumns).map(([name, col]) => ({
+				name,
+				datatype: col.type,
+				isPrimaryKey: false
+			}))
+		}
+		tables.push({ key, schema, table, columns })
+	}
+
+	tables.sort((a, b) => a.schema.localeCompare(b.schema) || a.table.localeCompare(b.table))
+	return tables
+}
+
+/** Packs the cards into balanced columns, in reading order. Runs again on every
+ * change to the selection, so it must be deterministic: the same tables always
+ * land in the same place. */
+export function layoutTables(
+	tables: DiagramTable[],
+	expanded: Set<string>
+): Record<string, { x: number; y: number }> {
+	const heights = tables.map((t) => cardHeight(t, expanded.has(t.key)))
+	const stacked = heights.reduce((a, b) => a + b, 0) + GAP_Y * Math.max(0, tables.length - 1)
+
+	let columnCount = 1
+	let bestScore = Infinity
+	for (let c = 1; c <= tables.length; c++) {
+		const width = c * CARD_WIDTH + (c - 1) * GAP_X
+		const height = stacked / c
+		// Compared in log space so twice-too-wide and twice-too-tall score alike.
+		const score = Math.abs(Math.log(width / height / TARGET_ASPECT))
+		if (score < bestScore) {
+			bestScore = score
+			columnCount = c
+		}
+	}
+
+	const target = stacked / columnCount
+	const positions: Record<string, { x: number; y: number }> = {}
+	let column = 0
+	let columnHeight = 0
+
+	tables.forEach((table, i) => {
+		const height = heights[i]
+		// Overshooting the target by more than stopping short of it costs less in
+		// the next column.
+		const overshoot = columnHeight + height - target
+		if (column < columnCount - 1 && columnHeight > 0 && overshoot > target - columnHeight) {
+			column++
+			columnHeight = 0
+		}
+		positions[table.key] = { x: column * (CARD_WIDTH + GAP_X), y: columnHeight }
+		columnHeight += height + GAP_Y
+	})
+
+	return positions
+}
diff --git a/frontend/src/lib/components/dbt/DbtEditor.svelte b/frontend/src/lib/components/dbt/DbtEditor.svelte
index 4b30f8fa28..51a029c05a 100644
--- a/frontend/src/lib/components/dbt/DbtEditor.svelte
+++ b/frontend/src/lib/components/dbt/DbtEditor.svelte
@@ -11,7 +11,6 @@
 	import { createEventDispatcher, onDestroy, onMount } from 'svelte'
 	import type { Schema, SupportedLanguage } from '$lib/common'
 	import type { Preview, ScriptModule } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { emptySchema } from '$lib/utils'
 	import { inferArgs } from '$lib/infer'
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
@@ -54,6 +53,9 @@
 	import { ChevronDown, CornerDownLeft, Play, Plus } from 'lucide-svelte'
 	import type { ScriptEditorWhitelabelCustomUi } from '../custom_ui'
 	import { processSecretArgs } from '../secretArgUtils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let {
 		schema = $bindable(),
@@ -86,7 +88,7 @@
 	} = $props()
 
 	const dispatch = createEventDispatcher()
-	let opWs = $derived(workspaceOverride ?? $workspaceStore)
+	let opWs = $derived(workspaceOverride ?? $operatingWorkspace)
 
 	/** The open file, or `null` for the descriptor at the project root. */
 	let openFile = $state<string | null>(null)
diff --git a/frontend/src/lib/components/details/ErrorHandlerToggleButtonV2.svelte b/frontend/src/lib/components/details/ErrorHandlerToggleButtonV2.svelte
index 51cb389616..2aec483e32 100644
--- a/frontend/src/lib/components/details/ErrorHandlerToggleButtonV2.svelte
+++ b/frontend/src/lib/components/details/ErrorHandlerToggleButtonV2.svelte
@@ -3,7 +3,9 @@
 
 	import { FlowService, ScriptService } from '$lib/gen'
 	import { sendUserToast } from '$lib/toast'
-	import { workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		kind: 'script' | 'flow'
@@ -25,11 +27,11 @@
 
 	async function toggleErrorHandler(): Promise<void> {
 		toggleState = !toggleState
-		if ($workspaceStore !== undefined) {
+		if ($operatingWorkspace !== undefined) {
 			try {
 				if (kind === 'flow') {
 					await FlowService.toggleWorkspaceErrorHandlerForFlow({
-						workspace: $workspaceStore,
+						workspace: $operatingWorkspace,
 						path: scriptOrFlowPath,
 						requestBody: {
 							muted: !errorHandlerMuted
@@ -37,7 +39,7 @@
 					})
 				} else {
 					await ScriptService.toggleWorkspaceErrorHandlerForScript({
-						workspace: $workspaceStore,
+						workspace: $operatingWorkspace,
 						path: scriptOrFlowPath,
 						requestBody: {
 							muted: !errorHandlerMuted
diff --git a/frontend/src/lib/components/details/FlowDetail.svelte b/frontend/src/lib/components/details/FlowDetail.svelte
index cedf4298f6..0dc6536641 100644
--- a/frontend/src/lib/components/details/FlowDetail.svelte
+++ b/frontend/src/lib/components/details/FlowDetail.svelte
@@ -71,9 +71,8 @@
 	import FlowAssetsHandler, {
 		initFlowGraphAssetsCtx
 	} from '$lib/components/flows/FlowAssetsHandler.svelte'
-	import { setDetailWorkspace } from '$lib/components/details/detailWorkspace'
 	import { interceptNav } from '$lib/components/details/interceptNav'
-	import { setTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+	import { setOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 	import FlowChat from '$lib/components/flows/conversations/FlowChat.svelte'
 	import { slide } from 'svelte/transition'
 	import { twMerge } from 'tailwind-merge'
@@ -117,8 +116,7 @@
 
 	// Every workspace-scoped call below and in the drawers this page opens targets
 	// `workspace`, not the nav store: a session views a flow in its own workspace.
-	setDetailWorkspace(() => workspace)
-	setTriggerWorkspace(() => workspace)
+	setOperatingWorkspace(() => workspace)
 
 	let flow: Flow | undefined = $state()
 	let can_write = $state(false)
@@ -684,67 +682,78 @@
 					<div
 						class={twMerge(
 							'w-full flex flex-col',
-							chatInputEnabled ? 'p-3 h-full' : 'max-w-3xl p-6 min-h-[300px] justify-center',
+							chatInputEnabled ? 'h-full min-h-0' : 'max-w-3xl p-6 min-h-[300px] justify-center',
 							'mx-auto'
 						)}
 					>
-						{#if flow?.path}
-							<CiTestResults path={flow.path} kind="flow" />
-						{/if}
+						<!-- The chat reaches the edges of the pane, so the notices above it carry their
+						     own padding. `contents` leaves the form layout exactly as it was. -->
+						<!-- Top spacing hangs off the first notice, not the wrapper: `{#if}` leaves a
+						     comment anchor behind, so an empty wrapper is not `:empty` and its own
+						     padding would show as a gap above a chat with nothing to announce. -->
+						<div
+							class={chatInputEnabled ? 'flex flex-col px-3 [&>*:first-child]:mt-3' : 'contents'}
+						>
+							{#if flow?.path}
+								<CiTestResults path={flow.path} kind="flow" />
+							{/if}
 
-						{#if flow?.archived}
-							<Alert type="error" title="Archived">This flow was archived</Alert>
-							<div class="h-4"></div>
-						{/if}
+							{#if flow?.archived}
+								<Alert type="error" title="Archived">This flow was archived</Alert>
+								<div class="h-4"></div>
+							{/if}
 
-						{#if pinnedVersion !== undefined}
-							<Alert type="info" title="Viewing pinned version {pinnedVersion}">
-								This is a historical version of the flow, not the latest.
-								<a
-									class="underline"
-									href="/flows/get/{path}?workspace={workspace}"
-									onclick={interceptNav(onNavigate, `/flows/get/${path}`)}
-								>
-									View latest
-								</a>
-							</Alert>
-							<div class="h-4"></div>
-						{/if}
+							{#if pinnedVersion !== undefined}
+								<Alert type="info" title="Viewing pinned version {pinnedVersion}">
+									This is a historical version of the flow, not the latest.
+									<a
+										class="underline"
+										href="/flows/get/{path}?workspace={workspace}"
+										onclick={interceptNav(onNavigate, `/flows/get/${path}`)}
+									>
+										View latest
+									</a>
+								</Alert>
+								<div class="h-4"></div>
+							{/if}
 
-						{#if !emptyString(flow?.description)}
-							<div class="p-4 rounded-md bg-surface-secondary">
-								<GfmMarkdown
-									md={defaultIfEmptyString(flow?.description, 'No description')}
-									noPadding
-								/>
-							</div>
-							<div class="h-4"></div>
-						{/if}
+							<!-- In chat mode the description belongs to the chat, which shows it under the
+							     empty transcript. -->
+							{#if !chatInputEnabled && !emptyString(flow?.description)}
+								<div class="p-4 rounded-md bg-surface-secondary">
+									<GfmMarkdown
+										md={defaultIfEmptyString(flow?.description, 'No description')}
+										noPadding
+									/>
+								</div>
+								<div class="h-4"></div>
+							{/if}
 
-						{#if deploymentInProgress}
-							<div class="pb-4" transition:slide={{ duration: 150 }}>
-								<HeaderBadge color="yellow">
-									<Loader2 size={12} class="inline animate-spin mr-1" />
-									Deployment in progress
-									{#if deploymentJobId}
-										<a
-											href="/run/{deploymentJobId}?workspace={workspace}"
-											class="underline"
-											target="_blank">view job</a
-										>
-									{/if}
-								</HeaderBadge>
-							</div>
-						{/if}
-						{#if flow.lock_error_logs && flow.lock_error_logs != ''}
-							<Alert type="error" title="Deployment failed">
-								<p>
-									This flow has not been deployed successfully because of the following errors:
-								</p>
-								<LogViewer content={flow.lock_error_logs} isLoading={false} tag={undefined} />
-							</Alert>
-							<div class="h-4"></div>
-						{/if}
+							{#if deploymentInProgress}
+								<div class="pb-4" transition:slide={{ duration: 150 }}>
+									<HeaderBadge color="yellow">
+										<Loader2 size={12} class="inline animate-spin mr-1" />
+										Deployment in progress
+										{#if deploymentJobId}
+											<a
+												href="/run/{deploymentJobId}?workspace={workspace}"
+												class="underline"
+												target="_blank">view job</a
+											>
+										{/if}
+									</HeaderBadge>
+								</div>
+							{/if}
+							{#if flow.lock_error_logs && flow.lock_error_logs != ''}
+								<Alert type="error" title="Deployment failed">
+									<p>
+										This flow has not been deployed successfully because of the following errors:
+									</p>
+									<LogViewer content={flow.lock_error_logs} isLoading={false} tag={undefined} />
+								</Alert>
+								<div class="h-4"></div>
+							{/if}
+						</div>
 
 						{#if chatInputEnabled}
 							<!-- Chat Layout with Sidebar -->
@@ -756,6 +765,7 @@
 								inputSchema={flow?.schema}
 								flowModules={flow?.value?.modules}
 								wideLayout
+								frame="none"
 							/>
 						{:else}
 							{@const hasSchema =
diff --git a/frontend/src/lib/components/details/ScriptDetail.svelte b/frontend/src/lib/components/details/ScriptDetail.svelte
index 7880ba52ef..caa5ab3874 100644
--- a/frontend/src/lib/components/details/ScriptDetail.svelte
+++ b/frontend/src/lib/components/details/ScriptDetail.svelte
@@ -98,9 +98,8 @@
 	import TriggersBadge from '$lib/components/graph/renderers/triggers/TriggersBadge.svelte'
 	import TriggersEditor from '$lib/components/triggers/TriggersEditor.svelte'
 	import { Triggers } from '$lib/components/triggers/triggers.svelte'
-	import { setDetailWorkspace } from '$lib/components/details/detailWorkspace'
 	import { interceptNav } from '$lib/components/details/interceptNav'
-	import { setTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+	import { setOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 	import {
 		buildForkEditUrl,
 		editInForkAllowed,
@@ -145,8 +144,7 @@
 
 	// Every workspace-scoped call below and in the drawers this page opens targets
 	// `workspace`, not the nav store: a session views an item in its own workspace.
-	setDetailWorkspace(() => workspace)
-	setTriggerWorkspace(() => workspace)
+	setOperatingWorkspace(() => workspace)
 
 	let script: Script | undefined = $state()
 	let topHash: string | undefined = $state()
diff --git a/frontend/src/lib/components/details/detailWorkspace.test.ts b/frontend/src/lib/components/details/detailWorkspace.test.ts
deleted file mode 100644
index 5c18ecd1c0..0000000000
--- a/frontend/src/lib/components/details/detailWorkspace.test.ts
+++ /dev/null
@@ -1,61 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { dirname, resolve } from 'node:path'
-import { fileURLToPath } from 'node:url'
-import { describe, expect, it } from 'vitest'
-
-function read(relPath: string): string {
-	return readFileSync(resolve(dirname(fileURLToPath(import.meta.url)), relPath), 'utf-8')
-}
-
-function navStoreReads(source: string): string[] {
-	return source
-		.split('\n')
-		.map((text, i) => `${i + 1}:${text.trim()}`)
-		.filter((l) => l.includes('$workspaceStore'))
-}
-
-// The one line allowed to read the nav store: the resolver's fallback, which is what every
-// call site outside a detail page still takes.
-const FALLBACK =
-	/^\d+:let ws = \$derived\((?:workspace \?\? )?detailWs\?\.\(\) \?\? \$workspaceStore\)$/
-
-// A detail component operates on its `workspace` prop, which in an AI session is the session's
-// workspace and not the one the top nav points at. Any `$workspaceStore` reintroduced here aims
-// that call at the nav workspace, which still looks right on the workspace pages — the only
-// place the two coincide — and silently reads the wrong workspace everywhere else.
-describe.each(['./ScriptDetail.svelte', './FlowDetail.svelte'])('%s', (relPath) => {
-	const source = read(relPath)
-
-	it('never reads the nav workspace store', () => {
-		expect(navStoreReads(source)).toEqual([])
-	})
-
-	it('registers the resolver for the drawers it opens', () => {
-		expect(source).toContain('setDetailWorkspace(() => workspace)')
-		expect(source).toContain('setTriggerWorkspace(() => workspace)')
-	})
-})
-
-// The shared components a detail page opens. Each is mounted from many other places too, so it
-// resolves its workspace rather than taking it as a prop: the resolver when a detail page set
-// one, the nav store otherwise.
-describe.each([
-	'../ShareModal.svelte',
-	'../MoveDrawer.svelte',
-	'../PersistentScriptDrawer.svelte',
-	'../ScriptVersionHistory.svelte',
-	'../DeployWorkspace.svelte',
-	'../SavedInputsPicker.svelte',
-	'../HistoricInputs.svelte',
-	'../SaveInputsButton.svelte'
-])('%s', (relPath) => {
-	const source = read(relPath)
-
-	it('reads the nav workspace only as the resolver fallback', () => {
-		expect(navStoreReads(source).filter((l) => !FALLBACK.test(l))).toEqual([])
-	})
-
-	it('consults the resolver', () => {
-		expect(source).toContain('const detailWs = getDetailWorkspace()')
-	})
-})
diff --git a/frontend/src/lib/components/details/detailWorkspace.ts b/frontend/src/lib/components/details/detailWorkspace.ts
deleted file mode 100644
index 7cbdcfacfd..0000000000
--- a/frontend/src/lib/components/details/detailWorkspace.ts
+++ /dev/null
@@ -1,32 +0,0 @@
-import { getContext, setContext } from 'svelte'
-
-const DETAIL_WORKSPACE_KEY = 'detailWorkspace'
-
-/**
- * Context seam letting the script/flow detail pages and the drawers they open
- * operate on a workspace other than the globally-active `$workspaceStore`. An AI
- * session views an item in its own (possibly forked) workspace WITHOUT switching
- * `$workspaceStore`, which stays on whatever the top nav points at, so
- * `ScriptDetail`/`FlowDetail` register a resolver here from their `workspace` prop.
- *
- * Every workspace-scoped backend call inside the detail subtree — ShareModal,
- * DeployWorkspace, MoveDrawer, PersistentScriptDrawer, ScriptVersionHistory and the
- * saved-input components — reads its workspace via {@link getDetailWorkspace} and
- * falls back to `$workspaceStore` when no resolver is set. No resolver is set
- * anywhere outside a detail component, so every other call site of those shared
- * components is unchanged. Mirrors `triggerWorkspace` and `rawAppWorkspace`.
- *
- * A getter (not a value) so a live `$derived` is read reactively at each call site.
- */
-export function setDetailWorkspace(resolver: () => string | undefined): void {
-	setContext(DETAIL_WORKSPACE_KEY, resolver)
-}
-
-/**
- * The detail-workspace resolver set by an embedding detail component, or `undefined`
- * when none is set (fall back to `$workspaceStore`). Read once during component init;
- * use in a `$derived`: `const ws = $derived(detailWs?.() ?? $workspaceStore)`.
- */
-export function getDetailWorkspace(): (() => string | undefined) | undefined {
-	return getContext<(() => string | undefined) | undefined>(DETAIL_WORKSPACE_KEY)
-}
diff --git a/frontend/src/lib/components/diff_drawer.ts b/frontend/src/lib/components/diff_drawer.ts
index c6e9b5cdf8..c1e7e8980a 100644
--- a/frontend/src/lib/components/diff_drawer.ts
+++ b/frontend/src/lib/components/diff_drawer.ts
@@ -1,9 +1,53 @@
 import type { Value } from '$lib/utils'
 
+export type DiffVersionOption = {
+	/** Opaque to the drawer — a script hash, a flow version id, an app version id. */
+	id: string
+	/** Identifies the version: its number and hash. Carries the weight in the list. */
+	label: string
+	/** Who deployed it, and when — rendered under the label in secondary text, so the
+	 *  version reads first and the attribution second. */
+	subtitle?: string
+	/** The version currently deployed. */
+	isHead?: boolean
+}
+
+/** How many deployed versions the diff picker asks for at a time. The history endpoints
+ *  still answer whole when nobody asks — the panels and the CLI read them that way — so
+ *  this is the picker's own appetite, not their default. */
+export const VERSION_PAGE_SIZE = 20
+
 export type DiffDrawerDiff =
 	| {
 			mode: 'normal'
 			deployed: Value
+			/** Names the deployed side, e.g. `Deployed d2154d55 by bob`. The version
+			 *  identity is stripped from the displayed metadata, so without this the
+			 *  reader cannot tell what their draft is being compared against. */
+			deployedLabel?: string
+			/** Deployed versions the reader can compare against, newest first. The
+			 *  drawer only renders the picker; each editor supplies its own list and
+			 *  fetcher because scripts, flows and apps identify versions differently. */
+			versions?: DiffVersionOption[]
+			/** Loads one version's payload. Returning `undefined` leaves the current
+			 *  comparison in place rather than blanking the diff. */
+			loadVersion?: (id: string) => Promise<Value | undefined>
+			/** Fetches the next, older page of `versions`. `versions` holds one page so the
+			 *  drawer opens without waiting on a path a pipeline has deployed thousands of
+			 *  times; the reader asks for the rest. Returning nothing ends the list. */
+			loadMoreVersions?: () => Promise<DiffVersionOption[] | undefined>
+			/** Moves the draft's base to the head and keeps its content, rendered as a
+			 *  header action so the user takes the latest with the diff in front of them.
+			 *  Called with the version the drawer is showing as head (from `versions`), so
+			 *  the base adopted is the one the reader just looked at. */
+			onTakeLatest?: (head?: string) => void | Promise<void>
+			/** The version the draft forked from. The drawer offers `onTakeLatest` only
+			 *  while it differs from the head, and passes that head to it. */
+			draftBase?: string
+			/** The version the deployed payload passed here came from, used as the head when
+			 *  no `versions` list loaded. Without either, the drawer cannot tell whether the
+			 *  draft is behind and offers nothing. */
+			deployedHead?: string
 			draft?: Value | undefined
 			current: Value
 			defaultDiffType?: 'deployed' | 'draft'
@@ -18,7 +62,19 @@ export type DiffDrawerDiff =
 	  }
 
 export interface DiffDrawerI {
-	openDrawer: () => void
+	/** Pass the token from `beginOpening` to continue that opening; called without one,
+	 *  the drawer claims a fresh opening, so any reuse invalidates a fetch still in
+	 *  flight rather than being overwritten by it. */
+	openDrawer: (token?: number) => void
 	closeDrawer: () => void
-	setDiff: (diff: DiffDrawerDiff) => void
+	/** Takes the opening's token on the same terms as `openDrawer`. */
+	setDiff: (diff: DiffDrawerDiff, token?: number) => void
+	/** Claim the drawer for one opening. Filling it takes awaited fetches, and a path
+	 *  change remounts the editor while this drawer stays, so the token lives here: an
+	 *  editor checks `ownsOpening` before every write and drops the opening it started
+	 *  when it goes away. */
+	beginOpening: () => number
+	ownsOpening: (token: number) => boolean
+	/** Drop that opening and, when it still owns the drawer, what it put on screen. */
+	abandonOpening: (token: number) => void
 }
diff --git a/frontend/src/lib/components/flow_builder.ts b/frontend/src/lib/components/flow_builder.ts
index ce848c6f83..f763e92faa 100644
--- a/frontend/src/lib/components/flow_builder.ts
+++ b/frontend/src/lib/components/flow_builder.ts
@@ -10,6 +10,14 @@ import type { WorkspaceItem } from './workspacePicker'
 
 export type FlowBuilderProps = {
 	initialPath?: string
+	/** The draft row's own path (the URL path). `initialPath` is re-seeded from the
+	 *  draft's `draft_path` so the topbar shows the pending name, so it can't be used
+	 *  to resolve what is actually deployed. */
+	userDraftPath?: string
+	/** Moves the draft's base to the head and keeps its content; offered in the diff
+	 *  drawer while the draft is behind, and called with the version the drawer shows
+	 *  as head. */
+	onTakeLatest?: (head?: string) => void | Promise<void>
 	pathStoreInit?: string | undefined
 	newFlow: boolean
 	selectedId: string | undefined
@@ -24,9 +32,10 @@ export type FlowBuilderProps = {
 	disabledFlowInputs?: boolean
 	savedPrimarySchedule?: ScheduleTrigger | undefined // used to set the primary schedule in the legacy primaryScheduleStore
 	version?: number | undefined
-	/** flow_version the draft was forked from; when set, the deploy-time staleness
-	 *  check compares it (not the load-time head `version`) against the latest. */
-	draftBaseVersion?: number | undefined
+	/** flow_version the draft was forked from (as text, like `draft_base`); when
+	 *  set, the deploy-time staleness check compares it (not the load-time head
+	 *  `version`) against the latest. */
+	draftBaseVersion?: string | undefined
 	draftTriggersFromUrl?: Trigger[] | undefined
 	selectedTriggerIndexFromUrl?: number | undefined
 	children?: import('svelte').Snippet
diff --git a/frontend/src/lib/components/flows/FlowAssetsHandler.svelte b/frontend/src/lib/components/flows/FlowAssetsHandler.svelte
index 947eca1a67..86fff85437 100644
--- a/frontend/src/lib/components/flows/FlowAssetsHandler.svelte
+++ b/frontend/src/lib/components/flows/FlowAssetsHandler.svelte
@@ -43,11 +43,13 @@
 		type RawScript
 	} from '$lib/gen'
 	import { deepEqual } from 'fast-equals'
-	import { workspaceStore } from '$lib/stores'
 	import S3FilePicker from '../S3FilePicker.svelte'
 	import ResourceEditorDrawer from '../ResourceEditorDrawer.svelte'
 	import { watch } from 'runed'
 	import { sendUserToast } from '$lib/toast'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let {
 		modules,
@@ -63,7 +65,7 @@
 
 	const flowGraphAssetsCtx = getContext<FlowGraphAssetContext | undefined>('FlowGraphAssetContext')
 	const { selectionManager, opWorkspace } = getContext<FlowEditorContext>('FlowEditorContext') || {}
-	let opWs = $derived(opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(opWorkspace?.() ?? $operatingWorkspace)
 	// Expose the acting workspace to the asset explore controls (ExploreAssetButton
 	// reads it from this context; the DB manager / S3 picker act on it).
 	$effect(() => {
diff --git a/frontend/src/lib/components/flows/FlowEditor.svelte b/frontend/src/lib/components/flows/FlowEditor.svelte
index bf25a1dcda..a9c3a40e8a 100644
--- a/frontend/src/lib/components/flows/FlowEditor.svelte
+++ b/frontend/src/lib/components/flows/FlowEditor.svelte
@@ -40,14 +40,21 @@
 	import FlowPanelPlacementPicker from './common/FlowPanelPlacementPicker.svelte'
 	import { prefersSessionHandoff } from '../copilot/chat/global/gate'
 	import { openSourceInSession } from '$lib/components/sessions/sessionSwitch.svelte'
-	import { userStore, workspaceStore } from '$lib/stores'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 	const { flowStore, selectionManager, pathStore, opWorkspace } =
 		getContext<FlowEditorContext>('FlowEditorContext')
 	// Flow paths repeat across workspaces, and a session keeps every tab it has visited alive, so two
 	// editors can hold the same path at once. Both halves are needed to tell them apart.
-	let editorWorkspace = $derived(opWorkspace?.() ?? $workspaceStore)
+	let editorWorkspace = $derived(opWorkspace?.() ?? $operatingWorkspace)
 	function targetWorkspace(t: AgentEditorTarget): string | undefined {
-		return t.workspace ?? $workspaceStore
+		return t.workspace ?? $operatingWorkspace
 	}
 
 	const sessionScopedManager = getContext<AIChatManager>('aiChatManager')
@@ -404,7 +411,7 @@
 							if (
 								!sessionScopedManager &&
 								sessionOpen &&
-								prefersSessionHandoff($userStore?.operator)
+								prefersSessionHandoff(actingUser?.operator)
 							) {
 								void openSourceInSession(sessionOpen, {
 									previewParams: { selected: detail.moduleId },
diff --git a/frontend/src/lib/components/flows/FlowHistoryInner.svelte b/frontend/src/lib/components/flows/FlowHistoryInner.svelte
index 1f906c1e45..87c2306339 100644
--- a/frontend/src/lib/components/flows/FlowHistoryInner.svelte
+++ b/frontend/src/lib/components/flows/FlowHistoryInner.svelte
@@ -5,12 +5,14 @@
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import { classNames, displayDate, emptyString, sendUserToast } from '$lib/utils'
 	import { type Flow, FlowService, type FlowVersion } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { Skeleton } from '$lib/components/common'
 	import Button from '../common/button/Button.svelte'
 	import { ArrowRight, Loader2, Pencil, X } from 'lucide-svelte'
 	import { getContext } from 'svelte'
 	import type { FlowEditorContext } from './types'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		path: string
@@ -21,7 +23,7 @@
 	let { path, allowFork = false, onHistoryRestore }: Props = $props()
 
 	const flowEditorContext = getContext<FlowEditorContext>('FlowEditorContext')
-	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $operatingWorkspace)
 
 	let loading: boolean = $state(false)
 
diff --git a/frontend/src/lib/components/flows/FlowProgressBar.svelte b/frontend/src/lib/components/flows/FlowProgressBar.svelte
index d31c1cae97..5edf55b5de 100644
--- a/frontend/src/lib/components/flows/FlowProgressBar.svelte
+++ b/frontend/src/lib/components/flows/FlowProgressBar.svelte
@@ -2,6 +2,7 @@
 	import { type Job } from '$lib/gen'
 	import ProgressBar from '../progressBar/ProgressBar.svelte'
 	import { forLater } from '$lib/forLater'
+	import type { Snippet } from 'svelte'
 
 	interface Props {
 		job?: Job | undefined
@@ -11,6 +12,7 @@
 		textPosition?: 'top' | 'bottom'
 		// Prefer step ID over step index when both are available
 		showStepId?: boolean
+		errorAction?: Snippet
 	}
 
 	let {
@@ -19,7 +21,8 @@
 		class: className,
 		slim = false,
 		textPosition = 'top',
-		showStepId = false
+		showStepId = false,
+		errorAction
 	}: Props = $props()
 
 	let error: number | undefined = $state(undefined)
@@ -183,4 +186,5 @@
 	{isCanceled}
 	{isScheduled}
 	{isSkipped}
+	{errorAction}
 />
diff --git a/frontend/src/lib/components/flows/agentFormFields.test.ts b/frontend/src/lib/components/flows/agentFormFields.test.ts
index 311b48ade1..48b4c94d92 100644
--- a/frontend/src/lib/components/flows/agentFormFields.test.ts
+++ b/frontend/src/lib/components/flows/agentFormFields.test.ts
@@ -6,6 +6,7 @@ import {
 	agentMemoryMode,
 	historyInputApplies,
 	agentFieldIsSet,
+	agentTestInputTransforms,
 	initialVisibleAgentFields
 } from './agentFormFields'
 
@@ -147,3 +148,23 @@ describe('memoryPropertyFor', () => {
 		).toBeUndefined()
 	})
 })
+
+describe('agentTestInputTransforms', () => {
+	it('unsets a blank history input and feeds every other form key from flow_input', () => {
+		const authored = {
+			memory_id: { type: 'static' as const, value: 'thread-1' },
+			previous_messages: { type: 'static' as const, value: [{ role: 'user', content: 'hi' }] },
+			system_prompt: { type: 'javascript' as const, expr: 'results.a.prompt' }
+		}
+		expect(
+			agentTestInputTransforms(authored, { memory_id: '', previous_messages: [{ role: 'user' }] }, [
+				'memory_id',
+				'previous_messages',
+				'system_prompt'
+			])
+		).toEqual({
+			previous_messages: { type: 'javascript', expr: 'flow_input.previous_messages' },
+			system_prompt: { type: 'javascript', expr: 'flow_input.system_prompt' }
+		})
+	})
+})
diff --git a/frontend/src/lib/components/flows/agentFormFields.ts b/frontend/src/lib/components/flows/agentFormFields.ts
index 3d62497ba3..7f09afdf7e 100644
--- a/frontend/src/lib/components/flows/agentFormFields.ts
+++ b/frontend/src/lib/components/flows/agentFormFields.ts
@@ -30,6 +30,28 @@ export const AGENT_TOOLS_ROW = 'tools'
 export const AGENT_HISTORY_KEYS = ['memory_id', 'previous_messages'] as const
 export type AgentHistoryKey = (typeof AGENT_HISTORY_KEYS)[number]
 
+/** The input transforms a one-off test of an agent step runs with: each form key is fed from
+ *  `flow_input`, over the step's own transforms. A blank history input is unset, as on the step:
+ *  an expression evaluating to nothing reads as an empty memory id, and the step's transform is
+ *  stale. */
+export function agentTestInputTransforms(
+	stepTransforms: Record<string, InputTransform> | undefined,
+	args: Record<string, unknown>,
+	formKeys: readonly string[] = Object.keys(args)
+): Record<string, InputTransform> {
+	const isBlank = (v: unknown) => v == undefined || v === '' || (Array.isArray(v) && !v.length)
+	const kept = (key: string) =>
+		!(AGENT_HISTORY_KEYS as readonly string[]).includes(key) || !isBlank(args[key])
+	return {
+		...Object.fromEntries(Object.entries(stepTransforms ?? {}).filter(([key]) => kept(key))),
+		...Object.fromEntries(
+			formKeys
+				.filter(kept)
+				.map((key) => [key, { type: 'javascript' as const, expr: `flow_input.${key}` }])
+		)
+	}
+}
+
 /** What turning managed memory on writes. */
 export const DEFAULT_AGENT_MEMORY: MemoryConfig = { kind: 'window', context_length: 10 }
 
diff --git a/frontend/src/lib/components/flows/agentToolUtils.ts b/frontend/src/lib/components/flows/agentToolUtils.ts
index e9838f60e3..87c15bc66a 100644
--- a/frontend/src/lib/components/flows/agentToolUtils.ts
+++ b/frontend/src/lib/components/flows/agentToolUtils.ts
@@ -126,6 +126,11 @@ export function toolEnabledName(tool: AgentTool): string | undefined {
 	return toolDisplayName(tool)
 }
 
+/** The names `enabled_tools` can pick from: every tool in the roster that has one. */
+export function enabledToolNames(tools: AgentTool[]): string[] {
+	return tools.map((tool) => toolEnabledName(tool)).filter((name): name is string => !!name)
+}
+
 /**
  * Create an AI Agent tool (nested agent)
  */
diff --git a/frontend/src/lib/components/flows/common/FlowCardHeader.svelte b/frontend/src/lib/components/flows/common/FlowCardHeader.svelte
index 063367cc85..5776c88025 100644
--- a/frontend/src/lib/components/flows/common/FlowCardHeader.svelte
+++ b/frontend/src/lib/components/flows/common/FlowCardHeader.svelte
@@ -19,7 +19,7 @@
 	import FlowPanelChrome from './FlowPanelChrome.svelte'
 	import type { FlowBuilderWhitelabelCustomUi } from '$lib/components/custom_ui'
 	import DropdownV2 from '$lib/components/DropdownV2.svelte'
-	import { hubBaseUrlStore, workspaceStore } from '$lib/stores'
+	import { hubBaseUrlStore } from '$lib/stores'
 	import { DEFAULT_HUB_BASE_URL, PRIVATE_HUB_MIN_VERSION } from '$lib/hub'
 	import { getLatestHashForScript } from '$lib/scripts'
 	import { sendUserToast, type Item } from '$lib/utils'
@@ -27,6 +27,9 @@
 	import { getToolNameError } from '$lib/components/flows/agentToolUtils'
 	import { logFeatureUsage } from '$lib/utils/featureUsage'
 	import autosize from '$lib/autosize'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		flowModuleValue?: FlowModuleValue | undefined
@@ -65,7 +68,7 @@
 	const flowEditorContext = getContext<FlowEditorContext>('FlowEditorContext')
 	const { scriptEditorDrawer, workspaceScriptSettingsDrawer } = flowEditorContext
 
-	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $operatingWorkspace)
 	const scriptPath = $derived(flowModuleValue?.type === 'script' ? flowModuleValue.path : undefined)
 	const pinnedHash = $derived(flowModuleValue?.type === 'script' ? flowModuleValue.hash : undefined)
 	const isHub = $derived(scriptPath?.startsWith('hub/') ?? false)
diff --git a/frontend/src/lib/components/flows/content/AgentEditorHost.svelte b/frontend/src/lib/components/flows/content/AgentEditorHost.svelte
index b6a98160be..4f69d3a1a1 100644
--- a/frontend/src/lib/components/flows/content/AgentEditorHost.svelte
+++ b/frontend/src/lib/components/flows/content/AgentEditorHost.svelte
@@ -1,7 +1,16 @@
 <script lang="ts">
 	import { getContext, setContext, untrack } from 'svelte'
 	import { writable } from 'svelte/store'
-	import { Alert } from '$lib/components/common'
+	import { Info, MessageCircleOff } from 'lucide-svelte'
+	import { Alert, Button } from '$lib/components/common'
+	import FlowChat from '../conversations/FlowChat.svelte'
+	import {
+		AGENT_CHAT_SCHEMA,
+		agentChatFlow,
+		agentChatGap,
+		agentChatPath
+	} from '../conversations/agentEditorChat'
+	import { runFlowPreview } from '../utils.svelte'
 	import { deepEqual } from 'fast-equals'
 	import type { Flow, FlowModule, InputTransform, Job, OpenFlow } from '$lib/gen'
 	import { emptySchema, type StateStore } from '$lib/utils'
@@ -30,7 +39,12 @@
 		type AIAgentConfig
 	} from '../agentResourceUtils'
 	import { agentArgsToTransforms } from '../linkedAgentDrafts'
-	import { AGENT_EDITOR_RUN_INPUTS, AGENT_TOOLS_ROW } from '../agentFormFields'
+	import {
+		AGENT_EDITOR_RUN_INPUTS,
+		AGENT_TOOLS_ROW,
+		DEFAULT_AGENT_MEMORY,
+		keepsManagedMemory
+	} from '../agentFormFields'
 	import { toolDisplayName, type AgentTool } from '../agentToolUtils'
 	import { useAgentDraft } from '../agentDraft.svelte'
 	import Path from '$lib/components/Path.svelte'
@@ -199,6 +213,17 @@
 	// apart from the echo of their own write.
 	let lastArgs = $state<string | undefined>(undefined)
 
+	// Picked on the first load, after which it is the reader's: following the memory setting live
+	// would pull them out of a chat for switching memory off in the form.
+	let testMode = $state<'form' | 'chat' | undefined>(undefined)
+	// Mounted the first time it is shown, then only hidden: unmounting destroys the SDK chat,
+	// which stops following the turn in flight, and its answer would never show.
+	let chatMounted = $state(false)
+	function showTestMode(mode: 'form' | 'chat') {
+		testMode = mode
+		if (mode === 'chat') chatMounted = true
+	}
+
 	// draft.args -> module. Only when the draft moved on its own (a load, an external write, a
 	// discard); an edit made in the form arrives here as its own echo and is skipped.
 	$effect(() => {
@@ -217,6 +242,7 @@
 				} as any
 			}
 			flowStore.val.value.modules = [built]
+			if (testMode === undefined) showTestMode(keepsManagedMemory(args.memory) ? 'chat' : 'form')
 			// Caught rather than left to float: a tool whose shape the schema loader cannot read
 			// would otherwise reject into the global unhandled-rejection handler, which reports the
 			// bare message and no stack — saying nothing about which agent or tool caused it. The
@@ -294,6 +320,43 @@
 	let testIsLoading = $state(false)
 	let scriptProgress = $state(undefined)
 
+	let chatPath = $derived(agentChatPath(path))
+
+	/** One chat turn: the agent as edited, not as deployed, the same as a run from the form. */
+	async function runChatTurn(
+		userMessage: string,
+		conversationId: string,
+		inputs?: Record<string, any>
+	): Promise<string | undefined> {
+		if (!agentModule) return undefined
+		return await runFlowPreview(
+			{ ...(inputs ?? {}), user_message: userMessage },
+			agentChatFlow($state.snapshot(agentModule) as FlowModule),
+			chatPath,
+			undefined,
+			conversationId,
+			undefined,
+			workspace
+		)
+	}
+
+	// What the composer reads for its model button and paperclip.
+	let chatModules = $derived(agentModule ? agentChatFlow(agentModule).value.modules : undefined)
+	let chatGap = $derived(agentChatGap(agentValue?.input_transforms))
+
+	function turnOnMemory() {
+		if (!agentValue) return
+		agentValue.input_transforms.memory = {
+			type: 'static',
+			value: structuredClone(DEFAULT_AGENT_MEMORY)
+		}
+	}
+
+	function turnOnStreaming() {
+		if (!agentValue) return
+		agentValue.input_transforms.streaming = { type: 'static', value: true }
+	}
+
 	// Adding a tool goes straight into it: the editor has no graph to show the new node on, so the
 	// tool it just created is the only place the click can land.
 	async function addTool(detail: { kind: string; script?: any; flow?: any; inlineScript?: any }) {
@@ -341,6 +404,18 @@
 	export function draftHandle() {
 		return draft
 	}
+	/** The switch between the form and the chat, which the dialog's header holds. `mode` is
+	 *  undefined until the agent loads and picks the first one. */
+	export function testPaneHandle() {
+		return {
+			get mode() {
+				return testMode
+			},
+			set mode(mode: 'form' | 'chat' | undefined) {
+				if (mode) showTestMode(mode)
+			}
+		}
+	}
 </script>
 
 {#if draft.refusal}
@@ -359,7 +434,7 @@
 		<!-- Resizable as the step panel's config and test are: a long system prompt and a long
 		     answer want opposite splits, and only the reader knows which they are on. -->
 		<Splitpanes class="h-full">
-			<Pane size={66} minSize={30}>
+			<Pane size={55} minSize={30}>
 				<div class="h-full min-h-0 overflow-auto">
 					<div class="px-4 pt-4">
 						<Label label="Path">
@@ -410,37 +485,98 @@
 					</PropPickerWrapper>
 				</div>
 			</Pane>
-			<!-- Laid out as the script editor's preview column is: what a run takes above what it
-			     produced, both alongside what is being edited. -->
-			<Pane size={34} minSize={20}>
-				<Splitpanes horizontal class="h-full">
-					<Pane size={40} minSize={15}>
-						<div class="h-full overflow-auto">
-							<ModulePreview
-								mod={agentModule as FlowModule}
-								schema={flowLocalAgentSchema(schema)}
-								pickableProperties={stepPropPicker?.pickableProperties}
-								runInputKeys={AGENT_EDITOR_RUN_INPUTS}
-								bind:testJob
-								bind:testIsLoading
-								bind:scriptProgress
-							/>
+			<Pane size={45} minSize={20}>
+				<div class="h-full min-h-0 flex flex-col">
+					<!-- Laid out as the script editor's preview column is: what a run takes above what it
+					     produced, both alongside what is being edited. -->
+					<div class="flex-1 min-h-0 {testMode === 'chat' ? 'hidden' : ''}">
+						<Splitpanes horizontal class="h-full">
+							<Pane size={40} minSize={15}>
+								<div class="h-full overflow-auto">
+									<ModulePreview
+										mod={agentModule as FlowModule}
+										schema={flowLocalAgentSchema(schema)}
+										pickableProperties={stepPropPicker?.pickableProperties}
+										runInputKeys={AGENT_EDITOR_RUN_INPUTS}
+										bind:testJob
+										bind:testIsLoading
+										bind:scriptProgress
+									/>
+								</div>
+							</Pane>
+							<Pane size={60} minSize={20}>
+								<ModulePreviewResultViewer
+									lang="deno"
+									editor={undefined}
+									diffEditor={undefined}
+									mod={agentModule as FlowModule}
+									{testJob}
+									{testIsLoading}
+									{scriptProgress}
+									disableMock
+									disableHistory
+								/>
+							</Pane>
+						</Splitpanes>
+					</div>
+					{#if chatMounted}
+						<div class={testMode === 'chat' ? 'flex flex-col flex-1 min-h-0' : 'hidden'}>
+							{#if chatGap?.memory}
+								<div
+									class="flex-1 flex flex-col items-center justify-center gap-2 px-8 text-center"
+								>
+									<MessageCircleOff size={48} class="text-tertiary opacity-50 mb-2" />
+									<p class="text-sm font-semibold text-emphasis">Chat needs managed memory</p>
+									<p class="text-xs text-secondary max-w-xs">
+										{chatGap.memoryCanTurnOn
+											? 'Without it, every message would be answered without the ones before it.'
+											: 'This agent replays a fixed list of messages. Switch its memory to managed to chat with it.'}
+									</p>
+									{#if chatGap.memoryCanTurnOn && !readOnly}
+										<Button
+											unifiedSize="sm"
+											variant="default"
+											btnClasses="bg-surface mt-2"
+											onClick={turnOnMemory}
+										>
+											Turn on managed memory
+										</Button>
+									{/if}
+								</div>
+							{:else if chatGap?.noStream}
+								<div
+									class="shrink-0 flex items-center gap-2 px-4 py-1.5 border-b text-2xs text-secondary"
+								>
+									<Info size={12} class="shrink-0" />
+									<span class="flex-1">
+										{chatGap.noStream === 'image'
+											? 'Image answers do not stream: each one shows once its run ends.'
+											: 'Streaming is off: each answer shows once its run ends.'}
+									</span>
+									{#if chatGap.noStream === 'off' && !readOnly}
+										<Button unifiedSize="2xs" variant="subtle" onClick={turnOnStreaming}>
+											Turn on
+										</Button>
+									{/if}
+								</div>
+							{/if}
+							<!-- Hidden rather than unmounted while memory is off: switching it off mid-turn must
+							     not end the chat following that turn. Test chats, since what runs is the agent as
+							     edited. -->
+							<div class={chatGap?.memory ? 'hidden' : 'flex flex-col flex-1 min-h-0'}>
+								<FlowChat
+									onRunFlow={runChatTurn}
+									path={chatPath}
+									conversationKind="test"
+									subject="agent"
+									frame="none"
+									inputSchema={AGENT_CHAT_SCHEMA}
+									flowModules={chatModules}
+								/>
+							</div>
 						</div>
-					</Pane>
-					<Pane size={60} minSize={20}>
-						<ModulePreviewResultViewer
-							lang="deno"
-							editor={undefined}
-							diffEditor={undefined}
-							mod={agentModule as FlowModule}
-							{testJob}
-							{testIsLoading}
-							{scriptProgress}
-							disableMock
-							disableHistory
-						/>
-					</Pane>
-				</Splitpanes>
+					{/if}
+				</div>
 			</Pane>
 		</Splitpanes>
 	</div>
diff --git a/frontend/src/lib/components/flows/content/AgentEditorModal.svelte b/frontend/src/lib/components/flows/content/AgentEditorModal.svelte
index 11e59769fc..ea45761bf9 100644
--- a/frontend/src/lib/components/flows/content/AgentEditorModal.svelte
+++ b/frontend/src/lib/components/flows/content/AgentEditorModal.svelte
@@ -1,5 +1,7 @@
 <script lang="ts">
-	import { FlaskConical, History, Save } from 'lucide-svelte'
+	import { FlaskConical, FormInput, History, MessageSquare, Save } from 'lucide-svelte'
+	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
+	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
 	import { onDestroy, untrack } from 'svelte'
 	import { resource } from 'runed'
 	import Modal, { type ModalTrailSegment } from '$lib/components/common/modal/Modal.svelte'
@@ -12,7 +14,6 @@
 	import EvalsPane from '$lib/components/aiEvals/EvalsPane.svelte'
 	import type { EvalsLocation } from '$lib/components/aiEvals/evalUtils'
 	import { ResourceService, type AgentDraft } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import {
 		agentEditorTarget,
 		agentWriteCount,
@@ -27,6 +28,9 @@
 	import { publishLinkedAgentTools } from '../flowState'
 	import { linkedModulesForAgent, linkedToolsScope } from '../linkedAgentToolsStore.svelte'
 	import AgentEditorHost from './AgentEditorHost.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		enableAi?: boolean
@@ -61,7 +65,7 @@
 		if (p) untrack(() => (lastShownAgent = p))
 	})
 
-	let ws = $derived(target?.workspace ?? $workspaceStore)
+	let ws = $derived(target?.workspace ?? $operatingWorkspace)
 	let host = $state<ReturnType<typeof AgentEditorHost> | undefined>(undefined)
 	let versionDrawer: Drawer | undefined = $state(undefined)
 	let saving = $state(false)
@@ -91,6 +95,7 @@
 	})
 
 	let draft = $derived(host?.draftHandle())
+	let testPane = $derived(host?.testPaneHandle())
 	// The load refused this path, so there is no agent to deploy, evaluate or show a history of:
 	// the dialog carries only the refusal the host renders.
 	let refused = $derived(draft?.refusal != null)
@@ -266,6 +271,38 @@
 			{#snippet settings()}
 				<div class="flex flex-row items-center gap-2 shrink-0">
 					{#if !inEvals && !refused}
+						<!-- Switches the editor's right-hand pane, and is drawn only once the agent has
+						     loaded and the pane has picked its first mode. -->
+						{#if testPane?.mode}
+							<ToggleButtonGroup
+								bind:selected={
+									() => testPane?.mode,
+									(mode) => {
+										if (testPane) testPane.mode = mode
+									}
+								}
+								noWFull
+							>
+								{#snippet children({ item })}
+									<ToggleButton
+										size="sm"
+										value="chat"
+										label="Chat"
+										icon={MessageSquare}
+										tooltip="Chat with the agent: each message runs it, and it remembers the conversation"
+										{item}
+									/>
+									<ToggleButton
+										size="sm"
+										value="form"
+										label="Form"
+										icon={FormInput}
+										tooltip="Run the agent once, on the inputs in a form"
+										{item}
+									/>
+								{/snippet}
+							</ToggleButtonGroup>
+						{/if}
 						{#if readOnly}
 							<Badge
 								color="gray"
diff --git a/frontend/src/lib/components/flows/content/AgentResourceBar.svelte b/frontend/src/lib/components/flows/content/AgentResourceBar.svelte
index 2e760bb88c..83be7c876e 100644
--- a/frontend/src/lib/components/flows/content/AgentResourceBar.svelte
+++ b/frontend/src/lib/components/flows/content/AgentResourceBar.svelte
@@ -1,11 +1,12 @@
 <script lang="ts">
+	import ResourceDescriptionField from '$lib/components/ResourceDescriptionField.svelte'
 	import { Button, Drawer, DrawerContent } from '$lib/components/common'
 	import Alert from '$lib/components/common/alert/Alert.svelte'
 	import Badge from '$lib/components/common/badge/Badge.svelte'
 	import Path from '$lib/components/Path.svelte'
-	import TextInput from '$lib/components/text_input/TextInput.svelte'
+	import Label from '$lib/components/Label.svelte'
+	import ResourcePathHint from '$lib/components/ResourcePathHint.svelte'
 	import { ResourceService, type InputTransform, type Resource } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
 	import { Bot, ChevronDown, ChevronUp, Save, Unlink, Pencil } from 'lucide-svelte'
 	import {
@@ -44,6 +45,9 @@
 	import type { AgentTool as AgentToolStrict } from '../agentToolUtils'
 	import { resource } from 'runed'
 	import { untrack } from 'svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let {
 		agent = $bindable(),
@@ -63,7 +67,7 @@
 		toolInputs: Record<string, Record<string, InputTransform>>
 		moduleId: string
 		// The workspace the flow editor operates on (differs from the nav workspace in session/fork
-		// editors). All resource reads/writes must target it, not $workspaceStore.
+		// editors). All resource reads/writes must target it, not the navigation workspace.
 		opWorkspace?: string
 		// Scope for the linked-agent tools store (the flow path); must match what the graph reads.
 		flowPath?: string
@@ -78,7 +82,7 @@
 		linkedMemory?: { memory: unknown } | undefined
 	} = $props()
 
-	let ws = $derived(opWorkspace ?? $workspaceStore)
+	let ws = $derived(opWorkspace ?? $operatingWorkspace)
 
 	// How many times the linked agent has been written, from anywhere: this card's own save, or a
 	// deploy from the agent editor mounted alongside it. Both reads below key on it, so neither
@@ -700,27 +704,30 @@
 		<div class="flex flex-col gap-4">
 			<p class="text-xs text-secondary">
 				Save this AI agent's configuration and tools as a reusable resource. Other flows can then
-				link to it, updates propagate automatically, and it gains a dataset of eval cases of its
-				own.
+				link to it, and updates propagate automatically.
 			</p>
-			<Path
-				bind:path={newPath}
-				bind:error={pathError}
-				initialPath=""
-				namePlaceholder="my_agent"
-				kind="resource"
-				workspaceOverride={ws}
-			/>
-			<label class="flex flex-col gap-1 text-xs">
-				<span class="text-secondary">Description</span>
-				<TextInput
-					bind:value={description}
-					inputProps={{ placeholder: 'What this agent does' }}
-					size="sm"
+			<!-- The path and description are the resource form's, field for field: this
+			     drawer creates a resource too, and ResourcePathHint exists so the screens
+			     that do cannot drift apart. -->
+			<Label label="Path">
+				<ResourcePathHint />
+				<Path
+					bind:path={newPath}
+					bind:error={pathError}
+					initialPath=""
+					namePlaceholder="my_agent"
+					kind="resource"
+					workspaceOverride={ws}
 				/>
-			</label>
+			</Label>
+			<ResourceDescriptionField
+				bind:description
+				label="Description"
+				placeholder="Describe what this agent does"
+			/>
 			{#if providerSaveError ?? legacyMemorySaveError}
-				<p class="text-xs text-red-600 dark:text-red-400">
+				<!-- Validation is `text-2xs` per the guidelines; the red is the feedback colour. -->
+				<p class="text-2xs text-red-600 dark:text-red-400">
 					{providerSaveError ?? legacyMemorySaveError}
 				</p>
 			{/if}
diff --git a/frontend/src/lib/components/flows/content/AiAgentStepInputs.svelte b/frontend/src/lib/components/flows/content/AiAgentStepInputs.svelte
index 37fcfe8d1c..bb0f260a21 100644
--- a/frontend/src/lib/components/flows/content/AiAgentStepInputs.svelte
+++ b/frontend/src/lib/components/flows/content/AiAgentStepInputs.svelte
@@ -30,7 +30,6 @@
 	import type { Schema } from '$lib/common'
 	import { deepEqual } from 'fast-equals'
 	import { type InputTransform } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { allTrue, type DynamicInput as DynamicInputTypes } from '$lib/utils'
 	import { getContext, untrack, type Snippet } from 'svelte'
 	import { SvelteSet } from 'svelte/reactivity'
@@ -49,7 +48,7 @@
 	import { AlertTriangle, Plus, X } from 'lucide-svelte'
 	import type { PickableProperties } from '../previousResults'
 	import type { FlowCopilotContext } from '$lib/components/copilot/flow'
-	import { toolEnabledName, type AgentTool } from '../agentToolUtils'
+	import { enabledToolNames, type AgentTool } from '../agentToolUtils'
 	import {
 		AGENT_FIELDS,
 		AGENT_FIELD_BY_KEY,
@@ -69,6 +68,9 @@
 	import AgentToolRoster from './AgentToolRoster.svelte'
 	import AgentMemoryNotes from './AgentMemoryNotes.svelte'
 	import { memoryOptionLabel, memoryPropertyFor } from '../flowInfers'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		schema: Schema | { properties?: Record<string, any> }
@@ -148,7 +150,7 @@
 		linkedMemory = undefined
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	let inputCheck: { [id: string]: boolean } = $state({})
 
@@ -214,9 +216,7 @@
 		// By what each tool is named, not the summary alone: an MCP entry is added without one and is
 		// named by its resource path, so keying on `summary` would leave a whole server with no name
 		// to pick. `narrow_roster` matches that path for the same reason.
-		const names = tools
-			.map((tool) => toolEnabledName(tool))
-			.filter((name): name is string => !!name)
+		const names = enabledToolNames(tools)
 		const properties = schemaProperties
 		untrack(() => {
 			const list = properties['enabled_tools']
diff --git a/frontend/src/lib/components/flows/content/ExpandedSubflowStep.svelte b/frontend/src/lib/components/flows/content/ExpandedSubflowStep.svelte
index 4aede5e3d1..979717dae1 100644
--- a/frontend/src/lib/components/flows/content/ExpandedSubflowStep.svelte
+++ b/frontend/src/lib/components/flows/content/ExpandedSubflowStep.svelte
@@ -1,7 +1,6 @@
 <script lang="ts">
 	import { getContext, untrack } from 'svelte'
 	import { FlowService, type FlowModule } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import Badge from '$lib/components/common/badge/Badge.svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
 	import Skeleton from '$lib/components/common/skeleton/Skeleton.svelte'
@@ -16,6 +15,9 @@
 	import { parseExpandedSubflowId } from '$lib/components/restartFromStepPath'
 	import { base } from '$app/paths'
 	import FlowPanelChrome from '../common/FlowPanelChrome.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		/** Graph node id of the selected step, of the form `subflow:<step>[:<step>...]:<leaf>`. */
@@ -28,7 +30,7 @@
 
 	const { flowStore, flowEditorDrawer, opWorkspace } =
 		getContext<FlowEditorContext>('FlowEditorContext')
-	let opWs = $derived(opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(opWorkspace?.() ?? $operatingWorkspace)
 
 	let leafId = $derived(parseExpandedSubflowId(selectedId)?.leaf ?? selectedId)
 
diff --git a/frontend/src/lib/components/flows/content/FlowEditorDrawer.svelte b/frontend/src/lib/components/flows/content/FlowEditorDrawer.svelte
index 3103f310b4..6b4d73c6a0 100644
--- a/frontend/src/lib/components/flows/content/FlowEditorDrawer.svelte
+++ b/frontend/src/lib/components/flows/content/FlowEditorDrawer.svelte
@@ -3,7 +3,6 @@
 	import FlowBuilder from '$lib/components/FlowBuilder.svelte'
 	import DiffDrawer from '$lib/components/DiffDrawer.svelte'
 	import { FlowService, type Flow } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { ExternalLink, Loader2 } from 'lucide-svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
 	import { emptySchema, type StateStore } from '$lib/utils'
@@ -13,13 +12,16 @@
 	import type { FlowState } from '$lib/components/flows/flowState'
 	import type { FlowEditorContext } from '../types'
 	import { base } from '$app/paths'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let flowEditorDrawer: Drawer | undefined = $state()
 
 	const dispatch = createEventDispatcher()
 
 	const flowEditorContext = getContext<FlowEditorContext>('FlowEditorContext')
-	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $operatingWorkspace)
 
 	export async function openDrawer(path: string, cb: () => void, stepId?: string): Promise<void> {
 		flowPath = path
diff --git a/frontend/src/lib/components/flows/content/FlowEnvironmentVariables.svelte b/frontend/src/lib/components/flows/content/FlowEnvironmentVariables.svelte
index cc2f5ea808..1094d60227 100644
--- a/frontend/src/lib/components/flows/content/FlowEnvironmentVariables.svelte
+++ b/frontend/src/lib/components/flows/content/FlowEnvironmentVariables.svelte
@@ -14,7 +14,9 @@
 	import ItemPicker from '$lib/components/ItemPicker.svelte'
 	import ResourcePicker from '$lib/components/ResourcePicker.svelte'
 	import { VariableService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		noEditor: boolean
@@ -34,7 +36,7 @@
 	let { noEditor }: Props = $props()
 
 	const { flowStore, opWorkspace } = getContext<FlowEditorContext>('FlowEditorContext')
-	let opWs = $derived(opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(opWorkspace?.() ?? $operatingWorkspace)
 
 	if (!flowStore.val.value.flow_env) {
 		flowStore.val.value.flow_env = {}
diff --git a/frontend/src/lib/components/flows/content/FlowInput.svelte b/frontend/src/lib/components/flows/content/FlowInput.svelte
index 83b2065fcd..ca5c6d8073 100644
--- a/frontend/src/lib/components/flows/content/FlowInput.svelte
+++ b/frontend/src/lib/components/flows/content/FlowInput.svelte
@@ -8,7 +8,6 @@
 	import JsonInputs from '$lib/components/JsonInputs.svelte'
 	import { convert } from '@redocly/json-to-json-schema'
 	import { sendUserToast } from '$lib/toast'
-	import { workspaceStore } from '$lib/stores'
 	import EditableSchemaForm from '$lib/components/EditableSchemaForm.svelte'
 	import AddPropertyV2 from '$lib/components/schema/AddPropertyV2.svelte'
 	import FlowInputViewer from '$lib/components/FlowInputViewer.svelte'
@@ -57,6 +56,9 @@
 	import type { AIAgentConfig } from '../agentResourceUtils'
 	import FlowChat from '../conversations/FlowChat.svelte'
 	import { SPECIAL_MODULE_IDS } from '$lib/components/copilot/chat/shared'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		noEditor: boolean
@@ -84,7 +86,7 @@
 		opWorkspace
 	} = getContext<FlowEditorContext>('FlowEditorContext')
 	// Acting workspace when the flow editor runs in an AI session; else the nav workspace.
-	let opWs = $derived(opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(opWorkspace?.() ?? $operatingWorkspace)
 
 	// Get diffManager from the graph
 	const diffManager = $derived(flowModuleSchemaMap?.getDiffManager())
@@ -857,6 +859,7 @@
 						<FlowChat
 							onRunFlow={runFlowWithMessage}
 							path={$pathStore}
+							identity={$initialPathStore || fakeInitialPath}
 							conversationKind="test"
 							inputSchema={flowStore.val.schema}
 							flowModules={flowStore.val.value?.modules}
diff --git a/frontend/src/lib/components/flows/content/FlowInputsFlow.svelte b/frontend/src/lib/components/flows/content/FlowInputsFlow.svelte
index 4938b470af..2d4b124694 100644
--- a/frontend/src/lib/components/flows/content/FlowInputsFlow.svelte
+++ b/frontend/src/lib/components/flows/content/FlowInputsFlow.svelte
@@ -3,13 +3,15 @@
 	import NoItemFound from '$lib/components/home/NoItemFound.svelte'
 	import SearchItems from '$lib/components/SearchItems.svelte'
 	import { FlowService, type Flow } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { emptyString } from '$lib/utils'
 
 	import { createEventDispatcher, getContext, untrack } from 'svelte'
 	import type { FlowEditorContext } from '../types'
 	import { flip } from 'svelte/animate'
 	import { fade } from 'svelte/transition'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 	interface Props {
 		children?: import('svelte').Snippet
 	}
@@ -17,7 +19,7 @@
 	let { children }: Props = $props()
 
 	const flowEditorContext = getContext<FlowEditorContext>('FlowEditorContext')
-	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $operatingWorkspace)
 
 	// export let failureModule: boolean
 	const dispatch = createEventDispatcher()
diff --git a/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte b/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte
index eb875973dc..ae28a377c4 100644
--- a/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte
+++ b/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte
@@ -7,13 +7,7 @@
 	import { sendUserToast } from '$lib/toast'
 	import FlowScriptPickerQuick from '../pickers/FlowScriptPickerQuick.svelte'
 	import { defaultScriptLanguages, processInlineLangs } from '$lib/scripts'
-	import {
-		defaultScripts,
-		enterpriseLicense,
-		hubBaseUrlStore,
-		userStore,
-		workspaceStore
-	} from '$lib/stores'
+	import { defaultScripts, enterpriseLicense, hubBaseUrlStore } from '$lib/stores'
 	import type { SupportedLanguage } from '$lib/common'
 	import { createEventDispatcher, getContext, untrack } from 'svelte'
 	import type { FlowBuilderWhitelabelCustomUi } from '$lib/components/custom_ui'
@@ -34,6 +28,14 @@
 		canHaveApproval,
 		canHaveFailure
 	} from '$lib/script_helpers'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	const dispatch = createEventDispatcher()
 
@@ -65,8 +67,8 @@
 		refreshCount = 0
 	}: Props = $props()
 
-	if ($workspaceStore && cachedOwners?.[$workspaceStore]) {
-		owners = cachedOwners[$workspaceStore]
+	if ($operatingWorkspace && cachedOwners?.[$operatingWorkspace]) {
+		owners = cachedOwners[$operatingWorkspace]
 	}
 	type HubCompletion = {
 		path: string
@@ -400,7 +402,7 @@
 				<div class="text-2xs font-normal text-secondary ml-2"
 					>New {selectedKind != 'script' ? selectedKind + ' ' : ''}script</div
 				>
-				{#if $userStore?.is_admin || $userStore?.is_super_admin}
+				{#if actingUser?.is_admin || actingUser?.is_super_admin}
 					{#if !openScriptSettings}
 						<Button
 							onClick={() => (openScriptSettings = true)}
@@ -494,7 +496,7 @@
 					bind:owners={
 						() => owners,
 						(v) => {
-							$workspaceStore && (cachedOwners[$workspaceStore] = v)
+							$operatingWorkspace && (cachedOwners[$operatingWorkspace] = v)
 							owners = v
 						}
 					}
diff --git a/frontend/src/lib/components/flows/content/FlowModuleComponent.svelte b/frontend/src/lib/components/flows/content/FlowModuleComponent.svelte
index f51703dc22..0c87d6fb9e 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleComponent.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleComponent.svelte
@@ -39,7 +39,6 @@
 	import type { ButtonProp } from '$lib/components/diffEditorTypes'
 	import { loadSchemaFromModule } from '../flowInfers'
 	import { type Job } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { checkIfParentLoop } from '../utils.svelte'
 	import { useWorkspaceScriptSettings } from '../useWorkspaceScriptSettings.svelte'
 	import ScriptSettingsBadges from '$lib/components/ScriptSettingsBadges.svelte'
@@ -72,6 +71,9 @@
 	} from '$lib/components/debug'
 	import { Bug, Terminal } from 'lucide-svelte'
 	import { sendUserToast } from '$lib/utils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	const {
 		selectionManager,
@@ -103,7 +105,7 @@
 		return empty
 	}
 
-	let opWs = $derived(opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(opWorkspace?.() ?? $operatingWorkspace)
 
 	interface Props {
 		flowModule: FlowModule
@@ -1474,12 +1476,6 @@
 											{testJob}
 											{scriptProgress}
 											mod={flowModule}
-											linkedAgentTools={agentLinked
-												? getLinkedAgentTools(
-														linkedToolsScope(opWs, $pathStore),
-														linkedToolsModuleId
-													)
-												: undefined}
 											{testIsLoading}
 											disableMock={preprocessorModule || failureModule}
 											disableHistory={failureModule}
diff --git a/frontend/src/lib/components/flows/content/FlowModuleScript.svelte b/frontend/src/lib/components/flows/content/FlowModuleScript.svelte
index 021437d20a..ccb168cf75 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleScript.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleScript.svelte
@@ -18,10 +18,12 @@
 	import TimeAgo from '$lib/components/TimeAgo.svelte'
 	import { ScriptService, type ScriptLang } from '$lib/gen'
 	import { getScriptByPath, scriptLangToEditorLang } from '$lib/scripts'
-	import { workspaceStore } from '$lib/stores'
 	import { Loader2 } from 'lucide-svelte'
 	import { getContext, untrack } from 'svelte'
 	import type { FlowEditorContext } from '../types'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		path: string
@@ -46,7 +48,7 @@
 	}: Props = $props()
 
 	const flowEditorContext = getContext<FlowEditorContext>('FlowEditorContext')
-	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $operatingWorkspace)
 
 	let code: string | undefined = $state()
 	let previousCode: string | undefined = $state()
diff --git a/frontend/src/lib/components/flows/content/FlowModuleSuspend.svelte b/frontend/src/lib/components/flows/content/FlowModuleSuspend.svelte
index 1230de1b05..b4bb2538ae 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleSuspend.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleSuspend.svelte
@@ -8,7 +8,7 @@
 	import { Alert, Button, Tab, Tabs } from '$lib/components/common'
 	import { GroupService, type FlowModule } from '$lib/gen'
 	import { emptySchema, emptyString } from '$lib/utils'
-	import { enterpriseLicense, workspaceStore } from '$lib/stores.js'
+	import { enterpriseLicense } from '$lib/stores.js'
 	import { SecondsInput } from '../../common'
 	import PropPickerWrapper from '../propPicker/PropPickerWrapper.svelte'
 	import type { FlowEditorContext } from '../types'
@@ -21,12 +21,15 @@
 	import { Pen, Plus } from 'lucide-svelte'
 	import { slideDynamic } from '$lib/transitions'
 	import { logFeatureUsage } from '$lib/utils/featureUsage'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	type ApprovalSkin = NonNullable<NonNullable<FlowModule['suspend']>['skin']>
 
 	const { selectionManager, flowStateStore, opWorkspace } =
 		getContext<FlowEditorContext>('FlowEditorContext')
-	let opWs = $derived(opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(opWorkspace?.() ?? $operatingWorkspace)
 	const result = flowStateStore.val[selectionManager.getSelectedId()]?.previewResult ?? {}
 	let editor: SimpleEditor | undefined = $state(undefined)
 
@@ -56,7 +59,7 @@
 	}
 
 	$effect(() => {
-		if ($workspaceStore && allUserGroups.length === 0) {
+		if ($operatingWorkspace && allUserGroups.length === 0) {
 			untrack(() => {
 				loadGroups()
 			})
diff --git a/frontend/src/lib/components/flows/content/FlowModuleWorkerTagSelect.svelte b/frontend/src/lib/components/flows/content/FlowModuleWorkerTagSelect.svelte
index 620f0136dd..b319da9549 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleWorkerTagSelect.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleWorkerTagSelect.svelte
@@ -2,6 +2,7 @@
 	import { createEventDispatcher, getContext } from 'svelte'
 	import type { FlowEditorContext } from '../types'
 	import { workerTags, workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 	import { WorkerService } from '$lib/gen'
 	import WorkerTagSelect from '$lib/components/WorkerTagSelect.svelte'
 
@@ -25,7 +26,8 @@
 	// A fork-scoped session deploys to opWorkspace, not $workspaceStore. Keep a local
 	// tag list in that case so the gate reflects the fork without clobbering the
 	// shared, navigation-scoped `workerTags` cache.
-	let effectiveWorkspace = $derived(opWorkspace?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	let effectiveWorkspace = $derived(opWorkspace?.() ?? $operatingWorkspace)
 	let usesLocal = $derived(
 		effectiveWorkspace != undefined && effectiveWorkspace !== $workspaceStore
 	)
diff --git a/frontend/src/lib/components/flows/content/FlowPathViewer.svelte b/frontend/src/lib/components/flows/content/FlowPathViewer.svelte
index 8ef7b12dee..bf96d181af 100644
--- a/frontend/src/lib/components/flows/content/FlowPathViewer.svelte
+++ b/frontend/src/lib/components/flows/content/FlowPathViewer.svelte
@@ -6,24 +6,26 @@
 	import type { TriggerContext } from '$lib/components/triggers'
 	import { Triggers } from '$lib/components/triggers/triggers.svelte'
 	import { FlowService, type Flow, type TriggersCount } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { getContext, setContext } from 'svelte'
 	import type { FlowEditorContext } from '../types'
 	import { writable } from 'svelte/store'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		path: string
 		noSide?: boolean
 		fillAvailableHeight?: boolean
 		/** Explicit workspace override; takes precedence over the flow-editor
-		 * `opWorkspace` context and the nav `$workspaceStore`. */
+		 * `opWorkspace` context and the operating workspace. */
 		workspace?: string
 	}
 
 	let { path, noSide = false, fillAvailableHeight = false, workspace = undefined }: Props = $props()
 
 	const flowEditorContext = getContext<FlowEditorContext>('FlowEditorContext')
-	let opWs = $derived(workspace ?? flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(workspace ?? flowEditorContext?.opWorkspace?.() ?? $operatingWorkspace)
 
 	let flow: Flow | undefined = $state(undefined)
 
diff --git a/frontend/src/lib/components/flows/content/FlowSettings.svelte b/frontend/src/lib/components/flows/content/FlowSettings.svelte
index 8e78a04269..de3733d238 100644
--- a/frontend/src/lib/components/flows/content/FlowSettings.svelte
+++ b/frontend/src/lib/components/flows/content/FlowSettings.svelte
@@ -8,7 +8,7 @@
 	import { Alert, Button, SecondsInput } from '$lib/components/common'
 	import { getContext } from 'svelte'
 	import type { FlowEditorContext } from '../types'
-	import { enterpriseLicense, userStore, workspaceStore } from '$lib/stores'
+	import { enterpriseLicense, userStore } from '$lib/stores'
 	import { isCloudHosted } from '$lib/cloud'
 	import Tooltip from '$lib/components/Tooltip.svelte'
 	import SimpleEditor from '$lib/components/SimpleEditor.svelte'
@@ -31,6 +31,14 @@
 		type OnBehalfOfChoice
 	} from '$lib/components/OnBehalfOfSelector.svelte'
 	import { modulesWithRetryOrSleep, SAME_WORKER_INCOMPATIBLE_MSG } from '../utils.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	interface Props {
 		noEditor: boolean
@@ -52,8 +60,8 @@
 	} = getContext<FlowEditorContext>('FlowEditorContext')
 
 	const WM_DEPLOYERS_GROUP = 'wm_deployers'
-	let isDeployer = $derived($userStore?.groups?.includes(WM_DEPLOYERS_GROUP) ?? false)
-	let canPreserve = $derived(!!$userStore?.is_admin || !!$userStore?.is_super_admin || isDeployer)
+	let isDeployer = $derived(actingUser?.groups?.includes(WM_DEPLOYERS_GROUP) ?? false)
+	let canPreserve = $derived(!!actingUser?.is_admin || !!actingUser?.is_super_admin || isDeployer)
 	let onBehalfOfChoice: OnBehalfOfChoice = $state(undefined)
 	let customOnBehalfOfEmail: string = $state('')
 	let myPermissionedAs = $derived($userStore?.username ? `u/${$userStore.username}` : undefined)
@@ -475,7 +483,7 @@
 					/>
 					{#if flowStore.val.on_behalf_of_email && canPreserve}
 						&rarr; <OnBehalfOfSelector
-							targetWorkspace={opWorkspace?.() ?? $workspaceStore ?? ''}
+							targetWorkspace={opWorkspace?.() ?? $operatingWorkspace ?? ''}
 							targetValue={$savedOnBehalfOfEmail}
 							selected={onBehalfOfChoice}
 							onSelect={(choice, details) => {
diff --git a/frontend/src/lib/components/flows/content/McpToolEditor.svelte b/frontend/src/lib/components/flows/content/McpToolEditor.svelte
index ac5e0f3463..f69aa25d1d 100644
--- a/frontend/src/lib/components/flows/content/McpToolEditor.svelte
+++ b/frontend/src/lib/components/flows/content/McpToolEditor.svelte
@@ -30,6 +30,9 @@
 	import { getContext, untrack } from 'svelte'
 	import McpConnect from '$lib/components/mcp/McpConnect.svelte'
 	import type { FlowEditorContext } from '../types'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		tool: McpTool
@@ -39,7 +42,7 @@
 	let { tool = $bindable(), noEditor = false }: Props = $props()
 
 	const flowEditorContext = getContext<FlowEditorContext>('FlowEditorContext')
-	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $operatingWorkspace)
 
 	let refreshCount = $state(0)
 	let resourcePicker: ResourcePicker | undefined = $state()
diff --git a/frontend/src/lib/components/flows/content/ScriptEditorDrawer.svelte b/frontend/src/lib/components/flows/content/ScriptEditorDrawer.svelte
index 362b7bca37..ee9d646419 100644
--- a/frontend/src/lib/components/flows/content/ScriptEditorDrawer.svelte
+++ b/frontend/src/lib/components/flows/content/ScriptEditorDrawer.svelte
@@ -5,7 +5,6 @@
 	import ScriptEditor from '$lib/components/ScriptEditor.svelte'
 	import { ScriptService, type Preview, type Script } from '$lib/gen'
 	import { inferArgs } from '$lib/infer'
-	import { workspaceStore } from '$lib/stores'
 	import { Loader2, Save, DiffIcon, Settings } from 'lucide-svelte'
 	import ScriptAdvancedSettings from '$lib/components/ScriptAdvancedSettings.svelte'
 	import ScriptSettingsBadges from '$lib/components/ScriptSettingsBadges.svelte'
@@ -21,13 +20,16 @@
 	import { fade } from 'svelte/transition'
 	import WorkerTagSelect from '$lib/components/WorkerTagSelect.svelte'
 	import type { FlowEditorContext } from '../types'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let scriptEditorDrawer: Drawer | undefined = $state()
 
 	const dispatch = createEventDispatcher()
 
 	const flowEditorContext = getContext<FlowEditorContext>('FlowEditorContext')
-	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $operatingWorkspace)
 
 	export async function openDrawer(hash: string, cb: () => void): Promise<void> {
 		script = undefined
diff --git a/frontend/src/lib/components/flows/content/WorkspaceScriptSettingsDrawer.svelte b/frontend/src/lib/components/flows/content/WorkspaceScriptSettingsDrawer.svelte
index 3a88e6214a..f9ed5f671d 100644
--- a/frontend/src/lib/components/flows/content/WorkspaceScriptSettingsDrawer.svelte
+++ b/frontend/src/lib/components/flows/content/WorkspaceScriptSettingsDrawer.svelte
@@ -4,14 +4,16 @@
 	import ScriptAdvancedSettings from '$lib/components/ScriptAdvancedSettings.svelte'
 	import ScriptSettingsBadges from '$lib/components/ScriptSettingsBadges.svelte'
 	import { ScriptService, type Script } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { emptyString, sendUserToast } from '$lib/utils'
 	import { Loader2, Save } from 'lucide-svelte'
 	import { getContext } from 'svelte'
 	import type { FlowEditorContext } from '../types'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	const flowEditorContext = getContext<FlowEditorContext>('FlowEditorContext')
-	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $operatingWorkspace)
 
 	let drawer: Drawer | undefined = $state()
 	// cache_ignore_s3_path lives on NewScript but not the returned Script type;
diff --git a/frontend/src/lib/components/flows/conversations/FlowChat.svelte b/frontend/src/lib/components/flows/conversations/FlowChat.svelte
index 8608525241..01e2f60850 100644
--- a/frontend/src/lib/components/flows/conversations/FlowChat.svelte
+++ b/frontend/src/lib/components/flows/conversations/FlowChat.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-	import { enterpriseLicense, workspaceStore } from '$lib/stores'
+	import { enterpriseLicense } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
 	import { createChat, type Chat, type ChatState } from 'windmill-chat'
 	import FlowConversationsSidebar from './FlowConversationsSidebar.svelte'
@@ -7,6 +7,10 @@
 	import { getContext } from 'svelte'
 	import type { FlowEditorContext } from '../types'
 	import type { FlowModule } from '$lib/gen'
+	import { FRAME_CLASS, type ChatFrame } from './flowChatProps'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		/**
@@ -20,7 +24,15 @@
 			additionalInputs?: Record<string, any>
 		) => Promise<string | undefined>
 		deploymentInProgress?: boolean
+		/** The flow the chat runs and lists conversations for. Must be the path a run records,
+		 *  or a conversation is stored under one path and looked for under another. */
 		path: string
+		/**
+		 * What the chat's stored inputs are filed under, when that is not the path. An unsaved
+		 * flow's path changes as its author types, so the editor passes something that holds
+		 * still for the flow it is editing.
+		 */
+		identity?: string
 		hideSidebar?: boolean
 		inputSchema?: Record<string, any>
 		/** The flow's modules, read for the AI agent inputs the composer drives: the provider wiring
@@ -29,6 +41,7 @@
 		/** The flow's description, shown under the empty transcript's prompt. */
 		description?: string
 		wideLayout?: boolean
+		frame?: ChatFrame
 		/**
 		 * What this surface's own runs are: the editor runs previews and lists its test
 		 * chats, the flow page runs the deployed flow and lists only its users' chats.
@@ -36,23 +49,29 @@
 		 * users have no test chats to look at.
 		 */
 		conversationKind?: 'test' | 'deployed'
+		/** What a message runs, as the chat names it. An agent has no deployed chats, so its
+		 *  sidebar offers no filter between those and the test ones. */
+		subject?: 'flow' | 'agent'
 	}
 
 	let {
 		onRunFlow,
 		deploymentInProgress = false,
 		path,
+		identity = undefined,
 		hideSidebar = false,
 		inputSchema = undefined,
 		flowModules = undefined,
 		description = undefined,
 		wideLayout = false,
-		conversationKind = 'deployed'
+		frame = 'top',
+		conversationKind = 'deployed',
+		subject = 'flow'
 	}: Props = $props()
 
 	const flowEditorContext = getContext<FlowEditorContext>('FlowEditorContext')
 	// The editor may act on a workspace other than the nav store's (AI-session live editor).
-	const workspace = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
+	const workspace = $derived(flowEditorContext?.opWorkspace?.() ?? $operatingWorkspace)
 
 	let chat = $state<Chat | undefined>(undefined)
 	let chatState = $state<ChatState | undefined>(undefined)
@@ -72,13 +91,13 @@
 			pollDelayMs: $enterpriseLicense ? 50 : undefined,
 			run: async ({ user_message, ...inputs }, { conversationId }) => {
 				const jobId = await onRunFlow(String(user_message), conversationId, inputs)
-				if (!jobId) throw new Error('the flow did not start')
+				if (!jobId) throw new Error(`the ${subject} did not start`)
 				// The server creates the conversation with the run, so the sidebar can list
 				// it now, whatever becomes of the turn.
 				sidebar?.conversationStarted(conversationId)
 				return jobId
 			},
-			onError: (error) => sendUserToast('Failed to run flow: ' + error.message, true)
+			onError: (error) => sendUserToast(`Failed to run ${subject}: ${error.message}`, true)
 		})
 		const unsubscribe = created.subscribe((s) => (chatState = s))
 		chat = created
@@ -103,7 +122,7 @@
 	})
 </script>
 
-<div class="flex border border-gray-200 dark:border-gray-700 rounded-lg overflow-hidden flex-1">
+<div class="flex overflow-hidden flex-1 {FRAME_CLASS[frame]}">
 	{#if chat && chatState}
 		{#if !hideSidebar}
 			<FlowConversationsSidebar
@@ -111,23 +130,30 @@
 				{chat}
 				{chatState}
 				defaultKind={conversationKind}
-				canFilterKind={conversationKind !== 'deployed'}
+				canFilterKind={conversationKind !== 'deployed' && subject === 'flow'}
 			/>
 		{/if}
-		<!-- The interface's host subscribes to the chat it was given, so a replaced chat
-		     (another flow or workspace) mounts a fresh interface rather than a stale host. -->
-		{#key chat}
-			<FlowChatInterface
-				{chat}
-				{deploymentInProgress}
-				{additionalInputsSchema}
-				{flowModules}
-				{path}
-				{workspace}
-				{description}
-				{wideLayout}
-				{conversationKind}
-			/>
-		{/key}
+		<!-- pb-3 on the chat alone, not on the row: the transcript and composer stop short of
+		     the panel edge the way the session chat does, while the sidebar and the border
+		     dividing it from the chat still reach the bottom. -->
+		<div class="flex flex-1 min-w-0 min-h-0 pb-3">
+			<!-- The interface's host subscribes to the chat it was given, so a replaced chat
+			     (another flow or workspace) mounts a fresh interface rather than a stale host. -->
+			{#key chat}
+				<FlowChatInterface
+					{chat}
+					{deploymentInProgress}
+					{additionalInputsSchema}
+					{flowModules}
+					{path}
+					{identity}
+					{workspace}
+					{description}
+					{wideLayout}
+					{conversationKind}
+					{subject}
+				/>
+			{/key}
+		</div>
 	{/if}
 </div>
diff --git a/frontend/src/lib/components/flows/conversations/FlowChatInterface.svelte b/frontend/src/lib/components/flows/conversations/FlowChatInterface.svelte
index f4cdc64912..cad5688d89 100644
--- a/frontend/src/lib/components/flows/conversations/FlowChatInterface.svelte
+++ b/frontend/src/lib/components/flows/conversations/FlowChatInterface.svelte
@@ -10,6 +10,7 @@
 	import { emptyString, type DynamicInput } from '$lib/utils'
 	import { onDestroy, tick, untrack } from 'svelte'
 	import type { Chat } from 'windmill-chat'
+	import { chatFlowKey } from './flowChatProps'
 	import type { FlowModule } from '$lib/gen'
 	import { useWorkspaceStorageConfigured } from '$lib/components/inputTransformEnv.svelte'
 	import {
@@ -35,12 +36,16 @@
 		 * and the attachments input. */
 		flowModules?: FlowModule[]
 		path: string
+		/** What the stored inputs are filed under when the path is not steady (see FlowChat). */
+		identity?: string
 		workspace?: string
 		/** The flow's description, shown under the empty transcript's prompt. */
 		description?: string
 		wideLayout?: boolean
 		/** What this surface's runs create: previews in the editor, deployed runs on the flow page. */
 		conversationKind?: 'test' | 'deployed'
+		/** What a message runs, as the composer names it. */
+		subject?: 'flow' | 'agent'
 	}
 
 	let {
@@ -49,10 +54,12 @@
 		additionalInputsSchema,
 		flowModules,
 		path,
+		identity = undefined,
 		workspace = undefined,
 		description = undefined,
 		wideLayout = false,
-		conversationKind = 'deployed'
+		conversationKind = 'deployed',
+		subject = 'flow'
 	}: Props = $props()
 
 	// Derive helperScript for dynamic inputs from schema
@@ -87,7 +94,7 @@
 	const modelWiring = $derived(resolveAgentModelWiring(flowModules))
 	// An agent with nothing to call cannot answer, and the composer cannot fix it, so the
 	// chat says what to go and do instead of offering controls that write nowhere.
-	const modelGap = $derived(agentModelGap(modelWiring))
+	const modelGap = $derived(agentModelGap(modelWiring, subject))
 	const showModelButton = $derived(showsModelButton(modelWiring))
 
 	// LocalStorage helpers
@@ -122,7 +129,7 @@
 	const runInputs = $derived(withoutRejectedEffort(modelWiring, effectiveInputs))
 
 	function getStorageKey(): string {
-		return `${STORAGE_KEY_PREFIX}${path}`
+		return `${STORAGE_KEY_PREFIX}${chatFlowKey({ path, identity })}`
 	}
 
 	function loadInputsFromStorage(): Record<string, any> | null {
@@ -181,7 +188,10 @@
 					? undefined
 					: 'This workspace has no object storage, so files cannot be attached.',
 			workspace: () => workspace,
-			sendDisabled: () => deploymentInProgress || !!modelGap || !!wrongKindReason
+			sendDisabled: () => deploymentInProgress || !!modelGap || !!wrongKindReason,
+			// The model controls only: a retry changes model when the reader did, but replays
+			// the run's own attachments rather than whatever the composer holds now.
+			inputsShownInComposer: () => composerOwnedInputs(modelWiring, undefined)
 		}
 	)
 	setChatViewHost(chatHost)
@@ -266,7 +276,7 @@
 		{:else}
 			<MessageCircle size={48} class="mx-auto mb-4 opacity-50" />
 			<p class="text-lg font-medium">Start a conversation</p>
-			<p class="text-sm">Send a message to run the flow and see the results</p>
+			<p class="text-sm">Send a message to run the {subject} and see the results</p>
 			{#if !emptyString(description)}
 				<div class="mt-6 pt-4 border-t max-w-md text-left text-xs text-tertiary">
 					<GfmMarkdown md={description ?? ''} noPadding prose="sm" />
@@ -329,7 +339,7 @@
 		{wideLayout}
 		{emptyHint}
 		footerSettings={modalSchema || showModelButton ? footerSettings : undefined}
-		placeholder="Send a message to run the flow"
+		placeholder="Send a message to run the {subject}"
 		disabled={deploymentInProgress || !!modelGap || !!wrongKindReason}
 		disabledMessage={deploymentInProgress
 			? 'Deployment in progress'
diff --git a/frontend/src/lib/components/flows/conversations/FlowConversationsSidebar.svelte b/frontend/src/lib/components/flows/conversations/FlowConversationsSidebar.svelte
index 49efbbc1fa..d2ea5c5061 100644
--- a/frontend/src/lib/components/flows/conversations/FlowConversationsSidebar.svelte
+++ b/frontend/src/lib/components/flows/conversations/FlowConversationsSidebar.svelte
@@ -185,7 +185,7 @@
 		: 'w-[44px]'}"
 >
 	<!-- Header -->
-	<div class="flex-shrink-0 border-b">
+	<div class="flex-shrink-0">
 		<div class="flex flex-col gap-2 p-1">
 			<Button
 				unifiedSize="md"
diff --git a/frontend/src/lib/components/flows/conversations/agentChatInputs.ts b/frontend/src/lib/components/flows/conversations/agentChatInputs.ts
index 0ebaa9d918..1c178bde26 100644
--- a/frontend/src/lib/components/flows/conversations/agentChatInputs.ts
+++ b/frontend/src/lib/components/flows/conversations/agentChatInputs.ts
@@ -242,15 +242,19 @@ export function resolveAgentModelWiring(
  * about it, because no flow input feeds either field. Saying so beats a dead model button.
  * A field the flow exposes is never a gap: the reader picks it in the composer.
  */
-export function agentModelGap(wiring: AgentModelWiring | undefined): string | undefined {
+export function agentModelGap(
+	wiring: AgentModelWiring | undefined,
+	subject: 'flow' | 'agent' = 'flow'
+): string | undefined {
 	// No agent, several of them, or an expression we cannot read: not ours to judge.
 	if (!wiring || wiring.whole) return undefined
 	// Asked of each agent rather than of what they agree on: agents that merely disagree
 	// about the model all have one, and the message would be false — while an agent with
 	// an empty model still cannot run, however well the others are configured.
-	return wiring.someAgentCannotRun
-		? 'Pick a provider and model on the AI agent step to use this chat.'
-		: undefined
+	if (!wiring.someAgentCannotRun) return undefined
+	return subject === 'agent'
+		? 'Pick a provider and model for this agent to use this chat.'
+		: 'Pick a provider and model on the AI agent step to use this chat.'
 }
 
 /**
diff --git a/frontend/src/lib/components/flows/conversations/agentEditorChat.test.ts b/frontend/src/lib/components/flows/conversations/agentEditorChat.test.ts
new file mode 100644
index 0000000000..c00c1e4297
--- /dev/null
+++ b/frontend/src/lib/components/flows/conversations/agentEditorChat.test.ts
@@ -0,0 +1,76 @@
+import { describe, expect, it } from 'vitest'
+import type { FlowModule } from '$lib/gen'
+import { agentChatFlow, agentChatGap, agentChatPath } from './agentEditorChat'
+
+describe('agentChatPath', () => {
+	it('is a path no flow can take, so a same-path flow never shares its conversations', () => {
+		const flowPath = /^[ufg](\/[\w-]+){2,}$/
+		expect('f/support/agent').toMatch(flowPath)
+		expect(agentChatPath('f/support/agent')).not.toMatch(flowPath)
+	})
+})
+
+function agent(inputTransforms: Record<string, any>): FlowModule {
+	return {
+		id: '__wm_agent_root',
+		value: { type: 'aiagent', tools: [{ id: 't' }], input_transforms: inputTransforms }
+	} as unknown as FlowModule
+}
+
+describe('agentChatFlow', () => {
+	it('runs the agent in chat mode on the message and files, never on a step memory id', () => {
+		const flow = agentChatFlow(
+			agent({
+				system_prompt: { type: 'static', value: 'Be brief' },
+				user_message: { type: 'static', value: 'a default' },
+				memory_id: { type: 'static' },
+				previous_messages: { type: 'static' }
+			})
+		)
+		expect(flow.value.chat_input_enabled).toBe(true)
+		const step = flow.value.modules[0].value as any
+		expect(step.tools).toEqual([{ id: 't' }])
+		expect(step.input_transforms).toEqual({
+			system_prompt: { type: 'static', value: 'Be brief' },
+			user_message: { type: 'javascript', expr: 'flow_input.user_message' },
+			user_attachments: { type: 'javascript', expr: 'flow_input.user_attachments' }
+		})
+	})
+})
+
+describe('agentChatGap', () => {
+	it('is nothing to fix with managed memory and streaming left at its default', () => {
+		expect(
+			agentChatGap({ memory: { type: 'static', value: { kind: 'window', context_length: 10 } } })
+		).toBeUndefined()
+	})
+
+	it('reads an agent with no memory setting as off, and offers to turn it on', () => {
+		expect(agentChatGap({})).toEqual({ memory: true, memoryCanTurnOn: true, noStream: undefined })
+	})
+
+	it('flags memory off and streaming off', () => {
+		expect(
+			agentChatGap({
+				memory: { type: 'static', value: { kind: 'off' } },
+				streaming: { type: 'static', value: false }
+			})
+		).toEqual({ memory: true, memoryCanTurnOn: true, noStream: 'off' })
+	})
+
+	it('does not offer to replace a legacy manual memory', () => {
+		expect(
+			agentChatGap({ memory: { type: 'static', value: { kind: 'manual', messages: [] } } })
+		).toEqual({ memory: true, memoryCanTurnOn: false, noStream: undefined })
+	})
+
+	it('flags an image answer as never streaming, whatever the setting', () => {
+		expect(
+			agentChatGap({
+				memory: { type: 'static', value: { kind: 'window', context_length: 10 } },
+				output_type: { type: 'static', value: 'image' },
+				streaming: { type: 'static', value: true }
+			})
+		).toEqual({ memory: false, memoryCanTurnOn: false, noStream: 'image' })
+	})
+})
diff --git a/frontend/src/lib/components/flows/conversations/agentEditorChat.ts b/frontend/src/lib/components/flows/conversations/agentEditorChat.ts
new file mode 100644
index 0000000000..b754e04bb8
--- /dev/null
+++ b/frontend/src/lib/components/flows/conversations/agentEditorChat.ts
@@ -0,0 +1,101 @@
+import type { AiAgent, FlowModule, InputTransform, OpenFlow } from '$lib/gen'
+import { AGENT_FLOW_LOCAL_KEYS } from '../agentResourceUtils'
+import { agentMemoryMode, keepsManagedMemory } from '../agentFormFields'
+
+/**
+ * What an agent's chat runs, and files its conversations, under. Conversations are keyed by path
+ * alone, and a flow may share the agent's, so the suffix is one no flow path can carry (its
+ * segments are `[\w-]`): otherwise each would list the other's chats, and continuing one would run
+ * a step that never saw its memory. The first two segments, which the server checks a preview
+ * run's path against, stay the agent's.
+ */
+export function agentChatPath(agentPath: string): string {
+	return `${agentPath}.chat`
+}
+
+/**
+ * The inputs of the flow a saved agent is chatted with: the message, and the files the composer's
+ * paperclip uploads. `user_message` is the name the server requires of a chat-mode run.
+ */
+export const AGENT_CHAT_SCHEMA = {
+	$schema: 'https://json-schema.org/draft/2020-12/schema',
+	type: 'object',
+	properties: {
+		user_message: { type: 'string', description: 'Message from user' },
+		user_attachments: {
+			type: 'array',
+			items: { type: 'object', resourceType: 's3object' },
+			description: 'Images or PDFs for the agent to read'
+		}
+	},
+	required: ['user_message']
+}
+
+/**
+ * The chat-mode flow one turn of the agent editor's chat runs: the agent as edited, alone, reading
+ * the message and files from the chat. Every other flow-local input is dropped, `memory_id` above
+ * all: a step memory id, even an empty one, would replace the conversation's and the agent would
+ * not remember the turns before.
+ */
+export function agentChatFlow(agent: FlowModule): OpenFlow {
+	const value = agent.value as AiAgent
+	const brain = Object.fromEntries(
+		Object.entries(value.input_transforms ?? {}).filter(
+			([key]) => !(AGENT_FLOW_LOCAL_KEYS as readonly string[]).includes(key)
+		)
+	)
+	return {
+		summary: '',
+		value: {
+			chat_input_enabled: true,
+			modules: [
+				{
+					id: agent.id,
+					value: {
+						...value,
+						input_transforms: {
+							...brain,
+							user_message: { type: 'javascript', expr: 'flow_input.user_message' },
+							user_attachments: { type: 'javascript', expr: 'flow_input.user_attachments' }
+						} as AiAgent['input_transforms']
+					}
+				}
+			]
+		},
+		schema: AGENT_CHAT_SCHEMA
+	}
+}
+
+/** What the agent as configured takes away from a chat. */
+export type AgentChatGap = {
+	/** No managed memory: every message would be answered without the ones before it, so the
+	 *  chat is not offered at all. */
+	memory: boolean
+	/** Whether turning memory on is a plain switch, rather than replacing an older manual list. */
+	memoryCanTurnOn: boolean
+	/** Why a turn shows nothing until its run ends: streaming switched off, or an image answer,
+	 *  which the worker never streams whatever the setting. */
+	noStream: 'off' | 'image' | undefined
+}
+
+function staticValue(transform: InputTransform | undefined): unknown {
+	return transform?.type === 'static' ? transform.value : undefined
+}
+
+export function agentChatGap(
+	transforms: Record<string, InputTransform> | undefined
+): AgentChatGap | undefined {
+	const memory = staticValue(transforms?.['memory'])
+	const gap: AgentChatGap = {
+		memory: !keepsManagedMemory(memory),
+		memoryCanTurnOn: agentMemoryMode(memory) === 'off',
+		noStream:
+			staticValue(transforms?.['output_type']) === 'image'
+				? 'image'
+				: // Unset streams: it is on by default.
+					staticValue(transforms?.['streaming']) === false
+					? 'off'
+					: undefined
+	}
+	return gap.memory || gap.noStream ? gap : undefined
+}
diff --git a/frontend/src/lib/components/flows/conversations/flowChatProps.ts b/frontend/src/lib/components/flows/conversations/flowChatProps.ts
new file mode 100644
index 0000000000..73500b31bd
--- /dev/null
+++ b/frontend/src/lib/components/flows/conversations/flowChatProps.ts
@@ -0,0 +1,19 @@
+/** What separates the chat from what sits above it. `boxed` is its own panel, corners
+ *  clipped so the sidebar's edge follows them; `top` a dividing line under an enclosing
+ *  header; `none` for a surface where the chat is the whole pane. */
+export type ChatFrame = 'boxed' | 'top' | 'none'
+
+export const FRAME_CLASS: Record<ChatFrame, string> = {
+	boxed: 'border rounded-md',
+	top: 'border-t',
+	none: ''
+}
+
+/**
+ * Which flow a chat is for, as something that holds still: `identity` where a surface has
+ * one, since `path` follows the path field as its author types. `||`, not `??`: an empty
+ * identity is no identity.
+ */
+export function chatFlowKey(props: { path: string; identity?: string }): string {
+	return props.identity || props.path
+}
diff --git a/frontend/src/lib/components/flows/conversations/flowChatViewHost.svelte.ts b/frontend/src/lib/components/flows/conversations/flowChatViewHost.svelte.ts
index 008646e0e1..077090aba2 100644
--- a/frontend/src/lib/components/flows/conversations/flowChatViewHost.svelte.ts
+++ b/frontend/src/lib/components/flows/conversations/flowChatViewHost.svelte.ts
@@ -3,7 +3,7 @@ import type {
 	ChatSendRequestOptions,
 	ChatViewHost
 } from '$lib/components/copilot/chat/chatViewHost'
-import type { DisplayMessage } from '$lib/components/copilot/chat/shared'
+import type { DisplayMessage, WebSearchResult } from '$lib/components/copilot/chat/shared'
 import type { AIAutonomyMode } from '$lib/components/copilot/chat/AIChatManager.svelte'
 import { isPlanCardTool } from '$lib/components/copilot/chat/planMode'
 import { AttachedFilesStore } from '$lib/components/copilot/chat/files/attachedFiles.svelte'
@@ -11,7 +11,14 @@ import { SessionArtifactsStore } from '$lib/components/copilot/chat/artifacts/ar
 import type { AttachedBlob } from '$lib/components/copilot/chat/blobUtils'
 import type { AttachedImage } from '$lib/components/copilot/chat/imageUtils'
 import type { AttachedTextFile } from '$lib/components/copilot/chat/textFileUtils'
+import {
+	prefersInstantReveal,
+	TypewriterReveal,
+	type TypewriterRevealOptions
+} from '$lib/components/copilot/chat/typewriterReveal'
+import { JobService } from '$lib/gen'
 import { sendUserToast } from '$lib/toast'
+import { attachmentLanes } from './messageAttachments'
 import type { AttachmentsTarget } from './agentAttachmentInput'
 
 export type FlowChatViewHostOptions = {
@@ -23,12 +30,17 @@ export type FlowChatViewHostOptions = {
 	/** Why attaching is off despite the flow taking attachments — no object storage, say.
 	 * Undefined while the workspace has not answered: an explanation must not be a guess. */
 	attachmentsUnavailable?: () => string | undefined
-	/** The workspace the transcript's paths resolve against. */
+	/** The workspace the transcript's paths resolve against, and a retry reads its run from. */
 	workspace?: () => string | undefined
 	/** Whether sending is refused right now (a deployment in progress, say). The composer
 	 * is disabled on the same condition; this covers the sends the composer does not
 	 * make itself: a queued message going out, a retry. */
 	sendDisabled?: () => boolean
+	/** Flow inputs edited by a control beside the composer, such as the model button. A retry
+	 * takes their current value rather than the failed turn's. */
+	inputsShownInComposer?: () => string[]
+	/** Injectables for tests: the clock and scheduler behind the typewriter pacing. */
+	revealOptions?: Pick<TypewriterRevealOptions, 'instant' | 'now' | 'schedule' | 'cancel'>
 }
 
 function isBusy(status: ChatState['status']): boolean {
@@ -79,6 +91,27 @@ function lastTurnFailed(messages: readonly ChatMessage[]): boolean {
 	return false
 }
 
+/**
+ * The step name says which AI agent step wrote a message, so it only tells the reader
+ * anything once the conversation holds more than one. Counted over the transcript rather
+ * than over the flow's steps: a conversation outlives edits to the flow, so it can carry
+ * labels from a shape the flow no longer has.
+ */
+export function showsStepNames(messages: readonly ChatMessage[]): boolean {
+	return new Set(messages.map((m) => m.stepName).filter(Boolean)).size > 1
+}
+
+/** How much of a streaming message is on screen, per lane, in characters. */
+export type Revealed = { content: number; reasoning: number }
+
+/** What a display row can only learn beyond the message itself. Every lookup is optional. */
+export type DisplayLookups = {
+	/** The workspace an attachment's download link points into. */
+	workspace?: string
+	/** How much of a pending assistant row the pacing has put on screen. */
+	revealed?: (message: ChatMessage) => Revealed | undefined
+}
+
 /**
  * What a failed tool call returned, as the card's error: the card shows the error in place of
  * the result. A job failure is stored as `{ message, name, stack }`; an MCP failure as plain text.
@@ -92,6 +125,33 @@ function toolErrorText(result: unknown): string | undefined {
 	return undefined
 }
 
+/**
+ * The provider-side search's row as the web search result shape, or undefined for any other
+ * row. The worker words it like a tool named `websearch`, which an agent tool may also be
+ * called; what tells them apart is that every agent tool's row stores its arguments, and the
+ * search stores none, only the citations it produced.
+ */
+function builtInWebSearch(message: ChatMessage): WebSearchResult | undefined {
+	const tool = message.tool
+	if (tool?.name !== 'websearch' || tool.arguments !== undefined || message.pending) {
+		return undefined
+	}
+	const citations = parseToolPayload(tool.result)
+	if (citations === undefined) return { sources: [] }
+	if (
+		!Array.isArray(citations) ||
+		!citations.every((c) => c && typeof c === 'object' && typeof c.url === 'string')
+	) {
+		return undefined
+	}
+	return {
+		sources: citations.map((c: { url: string; title?: unknown }) => ({
+			url: c.url,
+			title: typeof c.title === 'string' ? c.title : undefined
+		}))
+	}
+}
+
 /** The name the worker gives the structured-output tool: suffixed when an agent tool already has it. */
 const STRUCTURED_OUTPUT_CALL = /^structured_output(_\d+)?$/
 
@@ -104,9 +164,11 @@ const STRUCTURED_OUTPUT_CALL = /^structured_output(_\d+)?$/
 export function toDisplayMessages(
 	messages: readonly ChatMessage[],
 	busy = false,
-	stopped: ReadonlySet<string> = new Set()
+	stopped: ReadonlySet<string> = new Set(),
+	lookups: DisplayLookups = {}
 ): DisplayMessage[] {
 	let userIndex = 0
+	const stepNames = showsStepNames(messages)
 	let latestUser = -1
 	for (let i = messages.length - 1; i >= 0 && latestUser < 0; i--) {
 		if (messages[i].role === 'user') latestUser = i
@@ -119,17 +181,42 @@ export function toDisplayMessages(
 					!(busy && i === latestUser) &&
 					!stopped.has(message.id) &&
 					!(message.serverId && stopped.has(message.serverId))
+				const { images, contextElements } = attachmentLanes(lookups.workspace, message.attachments)
 				return [
 					{
 						role: 'user',
 						index,
 						content: message.content,
 						// Drives the shared Retry button.
-						error: (settled && turnFailed(messages, i)) || undefined
+						error: (settled && turnFailed(messages, i)) || undefined,
+						images: images.length > 0 ? images : undefined,
+						contextElements: contextElements.length > 0 ? contextElements : undefined
 					}
 				]
 			}
 			case 'tool': {
+				const search = builtInWebSearch(message)
+				if (search) {
+					const found = search.sources.length > 0
+					// `autoCollapseDetails: false` opens it on its sources, as the session chat
+					// shows a search. A tool that returns the same shape stays collapsed like
+					// every other tool row, however many times the agent called it.
+					return [
+						{
+							role: 'tool',
+							tool_call_id: message.id,
+							content: 'Searched the web',
+							toolName: 'web_search',
+							webSearchSources: found ? search.sources : undefined,
+							showDetails: found,
+							autoCollapseDetails: false,
+							jobId: message.jobId
+						}
+					]
+				}
+				// The model's call and what the tool sent back, as the stream carried them or the
+				// worker stored them on the row. A row stored without them shows its name and job.
+				const toolName = message.tool?.name
 				const parameters = parseToolPayload(message.tool?.arguments)
 				const result = parseToolPayload(message.tool?.result)
 				const failed = message.success === false
@@ -148,17 +235,17 @@ export function toDisplayMessages(
 					tool_call_id: message.id,
 					// The card's header is the row's text, which the server only words once the
 					// tool has returned; until then the row says what is running.
-					content:
-						message.content || unfinished || (message.tool ? `Running ${message.tool.name}` : ''),
+					content: message.content || unfinished || (toolName ? `Running ${toolName}` : ''),
 					// Withheld for the copilot's two plan-mode names: `toolName` is what makes
 					// ToolExecutionDisplay render a plan card, and an agent tool that happened to
 					// share one would silently become one.
-					toolName: isPlanCardTool(message.tool?.name) ? undefined : message.tool?.name,
+					toolName: isPlanCardTool(toolName) ? undefined : toolName,
 					parameters,
 					result,
 					showDetails: parameters !== undefined || result !== undefined,
 					error: failed ? (toolErrorText(result) ?? message.content) : unfinished,
-					isLoading: message.pending && message.tool?.status === 'running'
+					isLoading: message.pending && message.tool?.status === 'running',
+					jobId: message.jobId
 				}
 				// The tool card has no thinking section: the thinking that led to the call reads
 				// as a card of its own, just before it.
@@ -168,7 +255,7 @@ export function toDisplayMessages(
 								role: 'assistant',
 								content: '',
 								reasoning: message.reasoning,
-								stepName: message.stepName,
+								stepName: stepNames ? message.stepName : undefined,
 								jobId: message.jobId,
 								createdAt: message.createdAt
 							},
@@ -176,24 +263,37 @@ export function toDisplayMessages(
 						]
 					: [call]
 			}
-			default:
+			default: {
+				// The pacing's prefix while the message streams; the whole text once it has
+				// settled, or the turn was stopped.
+				const revealed = message.pending ? lookups.revealed?.(message) : undefined
 				return [
 					{
 						role: 'assistant',
-						content: message.content,
+						content: revealed ? message.content.slice(0, revealed.content) : message.content,
 						// Only the message a turn is still writing: a finalized reasoning-only
 						// message must not look in progress.
 						streaming: message.pending || undefined,
-						reasoning: message.reasoning,
-						stepName: message.stepName,
+						reasoning: revealed
+							? message.reasoning?.slice(0, revealed.reasoning)
+							: message.reasoning,
+						stepName: stepNames ? message.stepName : undefined,
 						jobId: message.jobId,
 						createdAt: message.createdAt
 					}
 				]
+			}
 		}
 	})
 }
 
+/** The two paced lanes of one streaming message, and how much of each has been fed in. */
+type RevealLanes = {
+	content: TypewriterReveal
+	reasoning: TypewriterReveal
+	fed: Revealed
+}
+
 /**
  * Renders a flow run's conversation, as the `windmill-chat` SDK keeps it, through the
  * copilot's chat components. The turn is a flow job rather than an LLM call this host
@@ -224,6 +324,7 @@ export class FlowChatViewHost implements ChatViewHost {
 		this.#disposed = true
 		this.#queue = emptyQueue()
 		this.#unsubscribe()
+		for (const id of Object.keys(this.#reveals)) this.#dropReveal(id)
 	}
 
 	/** The latest `ChatState`, for what the interface reads beyond the seam (paging, loading). */
@@ -234,6 +335,7 @@ export class FlowChatViewHost implements ChatViewHost {
 	#onState(state: ChatState) {
 		const previous = this.#state
 		this.#state = state
+		this.#paceReveals(state.messages)
 		const landed = state.messages.filter(
 			(m) => m.serverId && this.#stoppedTurns.has(m.id) && !this.#stoppedTurns.has(m.serverId)
 		)
@@ -243,13 +345,12 @@ export class FlowChatViewHost implements ChatViewHost {
 		if (previous.conversationId !== state.conversationId) {
 			// A conversation opens at its end, whatever the reader was doing in the last one.
 			this.#automaticScroll = true
-			// A conversation reopened later comes back from the server under other message ids.
-			this.#sentAttachments.clear()
 			// The queue was typed into the conversation that just went away; a message sent
 			// after the switch would ride out of the wrong one, so it goes back to the composer.
 			this.dequeueMessage()
 			return
 		}
+		if (!isBusy(previous.status) && isBusy(state.status)) this.#turnsStarted++
 		if (isBusy(previous.status) && !isBusy(state.status)) {
 			// The turn settled. What was typed during it goes out once the turn is released,
 			// not now: the chat publishes `idle` from inside its own `sendMessage`, which still
@@ -263,9 +364,70 @@ export class FlowChatViewHost implements ChatViewHost {
 		}
 	}
 
+	// Smooth streaming. The chat appends each delta to the pending assistant message as it
+	// arrives, in the coarse bursts the provider sends; what is shown is a prefix that a
+	// typewriter advances per lane, so the bursts read as continuous typing. Plain fields
+	// for the pacers, reactive counts for what they have put on screen.
+	#reveals: Record<string, RevealLanes> = {}
+	#revealed = $state<Record<string, Revealed>>({})
+
+	#paceReveals(messages: readonly ChatMessage[]) {
+		const pending = new Set<string>()
+		for (let i = 0; i < messages.length; i++) {
+			const message = messages[i]
+			if (message.role !== 'assistant' || !message.pending) continue
+			pending.add(message.id)
+			const lanes = (this.#reveals[message.id] ??= this.#newLanes(message.id))
+			const content = message.content.slice(lanes.fed.content)
+			const reasoning = (message.reasoning ?? '').slice(lanes.fed.reasoning)
+			lanes.fed = { content: message.content.length, reasoning: (message.reasoning ?? '').length }
+			lanes.content.push(content)
+			lanes.reasoning.push(reasoning)
+			// A row the turn has moved past — a tool card now follows it — is shown whole:
+			// what the pacing still holds belongs above that card, not trickling in under it.
+			if (i < messages.length - 1) {
+				lanes.content.flush()
+				lanes.reasoning.flush()
+			}
+		}
+		for (const id of Object.keys(this.#reveals)) {
+			if (!pending.has(id)) this.#dropReveal(id)
+		}
+	}
+
+	#newLanes(id: string): RevealLanes {
+		const options = this.#options.revealOptions ?? {}
+		const instant = options.instant ?? prefersInstantReveal()
+		const lane = (kind: keyof Revealed) =>
+			new TypewriterReveal({
+				...options,
+				instant,
+				onReveal: (chunk) => {
+					const current = this.#revealed[id] ?? { content: 0, reasoning: 0 }
+					this.#revealed[id] = { ...current, [kind]: current[kind] + chunk.length }
+				}
+			})
+		this.#revealed[id] = { content: 0, reasoning: 0 }
+		return {
+			content: lane('content'),
+			reasoning: lane('reasoning'),
+			fed: { content: 0, reasoning: 0 }
+		}
+	}
+
+	#dropReveal(id: string) {
+		this.#reveals[id]?.content.reset()
+		this.#reveals[id]?.reasoning.reset()
+		delete this.#reveals[id]
+		delete this.#revealed[id]
+	}
+
 	// Transcript
 	displayMessages = $derived.by(() =>
-		toDisplayMessages(this.#state.messages, isBusy(this.#state.status), this.#stoppedTurns)
+		toDisplayMessages(this.#state.messages, isBusy(this.#state.status), this.#stoppedTurns, {
+			workspace: this.#options.workspace?.(),
+			revealed: (message) => this.#revealed[message.id]
+		})
 	)
 	/** The user message of each turn stopped in this view, by message id and, once the chat has
 	 * read its row, row id: a reopened conversation or an older page rebuilds messages from rows,
@@ -282,6 +444,8 @@ export class FlowChatViewHost implements ChatViewHost {
 	get loading(): boolean {
 		return isBusy(this.#state.status)
 	}
+	// No transcript restore to wait for: a flow chat renders from its rows.
+	sendPending = false
 	runHeldElsewhere = false
 	loadingLabel = undefined
 	compacting = false
@@ -305,7 +469,15 @@ export class FlowChatViewHost implements ChatViewHost {
 	instructions = ''
 	// The user message lands in the transcript before `sendMessage` awaits anything.
 	sendInFlight = false
-	sendRequest = async (options: ChatSendRequestOptions = {}): Promise<boolean> => {
+	/**
+	 * `replayInputs` are a failed turn's own run arguments, read back from its job. They
+	 * stand in for the composer's current inputs, so a retry runs the turn that failed
+	 * rather than a new one wearing its text.
+	 */
+	sendRequest = async (
+		options: ChatSendRequestOptions = {},
+		replayInputs?: Record<string, any>
+	): Promise<boolean> => {
 		const text = options.instructions?.trim() ?? ''
 		let images = options.images ?? []
 		let blobs = options.blobs ?? []
@@ -322,16 +494,18 @@ export class FlowChatViewHost implements ChatViewHost {
 			return false
 		}
 		const target = this.#options.attachmentsTarget?.()
-		// The inputs modal does not ask for this input, so a required one is enforced here.
-		if (target?.required && images.length === 0 && blobs.length === 0) {
+		// The inputs modal does not ask for this input, so a required one is enforced here. A
+		// replay carries the files its run already has, in `replayInputs`, and attaches none.
+		if (!replayInputs && target?.required && images.length === 0 && blobs.length === 0) {
 			sendUserToast('This chat needs a file with each message. Attach one to send.', true)
 			this.#aiChatInput?.prependText(text, images, [], blobs)
 			return false
 		}
-		const inputs = { ...(this.#options.additionalInputs?.() ?? {}) }
+		// A replay sends the arguments its run had, attachment references included.
+		const inputs = replayInputs ?? { ...(this.#options.additionalInputs?.() ?? {}) }
 		// The attachments are this input's only editor: a value stored for it in the inputs
 		// modal would otherwise ride along on every message.
-		if (target) delete inputs[target.name]
+		if (target && !replayInputs) delete inputs[target.name]
 		// The composer caps files as they are attached, but a queue merged over several turns
 		// arrives here as one send, and the chat refuses more than a single-file input holds.
 		const cap = this.maxMessageAttachments
@@ -359,44 +533,28 @@ export class FlowChatViewHost implements ChatViewHost {
 		// already running, an upload that failed, Stop pressed while it ran — and the draft
 		// is then handed back rather than dropped. The composer took it before calling, so
 		// nothing else would.
-		const sending = this.#chat.sendMessage(text, {
-			inputs: this.#options.additionalInputs?.() ? inputs : undefined,
-			attachments,
-			attachmentsInput: target
-		})
-		// `sendMessage` shows the user message before its first await, so the last one is this
-		// turn's. Its id is stable across the server sync, which lets Retry resend the files.
-		const last = this.#chat.getState().messages.at(-1)
-		const sentId =
-			last?.role === 'user' && last.pending && last.content === text ? last.id : undefined
-		if (sentId && (images.length > 0 || blobs.length > 0)) {
-			this.#sentAttachments.set(sentId, { images, blobs })
-		}
-		const turn = sending.catch((e) => {
-			if (sentId) this.#sentAttachments.delete(sentId)
-			if (this.#disposed) return
-			if (attachments.length > 0 && !isAbort(e)) {
-				sendUserToast(
-					`Could not upload the attachments: ${e instanceof Error ? e.message : String(e)}`,
-					true
-				)
-			}
-			// What was queued behind it comes back too, after it: the chat publishes `idle`
-			// when it withdraws the turn, and a queue left in place would be flushed as if
-			// the turn had run.
-			this.dequeueMessage()
-			this.#aiChatInput?.prependText(text, images, [], blobs)
-		})
+		const turn = this.#chat
+			.sendMessage(text, {
+				inputs: replayInputs ?? (this.#options.additionalInputs?.() ? inputs : undefined),
+				attachments,
+				attachmentsInput: target
+			})
+			.catch((e) => {
+				if (this.#disposed) return
+				if (attachments.length > 0 && !isAbort(e)) {
+					sendUserToast(
+						`Could not upload the attachments: ${e instanceof Error ? e.message : String(e)}`,
+						true
+					)
+				}
+				// What was queued behind it comes back too, after it: the chat publishes `idle`
+				// when it withdraws the turn, and a queue left in place would be flushed as if
+				// the turn had run.
+				this.dequeueMessage()
+				this.#aiChatInput?.prependText(text, images, [], blobs)
+			})
 		this.#turnDone = turn
 		await turn
-		// The files are kept only for a turn that failed, the one Retry is offered on: a base64
-		// payload per sent file would otherwise pile up for as long as the panel lives.
-		if (sentId) {
-			const index = this.#state.messages.findIndex((m) => m.id === sentId)
-			if (index === -1 || !turnFailed(this.#state.messages, index)) {
-				this.#sentAttachments.delete(sentId)
-			}
-		}
 		return true
 	}
 	/** Settles when the chat has released the last turn this host started. */
@@ -470,25 +628,68 @@ export class FlowChatViewHost implements ChatViewHost {
 		return taken
 	}
 	setComposerStaged = () => {}
+	setComposerHasDraft = () => {}
 	clearComposerStaged = () => {}
 	attachmentBytesExcluding = () => 0
 
 	// Per-message actions
 	storedImages = () => undefined
-	/** The files each user message of this session went out with, for Retry. A message loaded
-	 * from history has none recorded here and retries with its text alone. */
-	#sentAttachments = new Map<string, { images: AttachedImage[]; blobs: AttachedBlob[] }>()
-	/** Send the user message at this transcript position again. The position is in
-	 * `displayMessages`, which holds more entries than the chat's messages. */
-	retryRequest = (messageIndex: number) => {
-		const message = this.displayMessages[messageIndex]
-		if (!message || message.role !== 'user' || this.loading) return
-		// A display message counts user messages in `index`; the files are kept by chat message id.
-		const sent = this.#state.messages.filter((m) => m.role === 'user')[message.index]
-		void this.sendRequest({
-			instructions: message.content,
-			...(sent ? this.#sentAttachments.get(sent.id) : undefined)
-		})
+	/** A retry reading back the turn it is about to replay. Deliberately not part of
+	 * `loading`, which renders Stop: there is no run yet to stop. */
+	#readingReplayArgs = false
+	/** Turns this chat has started, so a retry can tell whether one ran while it read the
+	 * arguments, whether or not it is still running. */
+	#turnsStarted = 0
+	/**
+	 * Run the turn at this position again with the arguments its job ran with, not the
+	 * composer's current inputs (`inputsShownInComposer` aside). The position is in
+	 * `displayMessages`, which holds more entries than the chat's messages. A purged job falls
+	 * back to the current inputs.
+	 */
+	retryRequest = async (messageIndex: number) => {
+		const shown = this.displayMessages[messageIndex]
+		if (!shown || shown.role !== 'user' || this.loading || this.#readingReplayArgs) return
+		const message = this.#state.messages.filter((m) => m.role === 'user')[shown.index]
+		if (!message) return
+		const conversationId = this.#state.conversationId
+		const turnsStarted = this.#turnsStarted
+		const workspace = this.#options.workspace?.()
+		let replayInputs: Record<string, any> | undefined
+		if (message.jobId && workspace) {
+			this.#readingReplayArgs = true
+			try {
+				const original = (await JobService.getJobArgs({ workspace, id: message.jobId })) as
+					| Record<string, any>
+					| undefined
+				// `user_message` is the message itself, passed as the instructions below.
+				const { user_message: _sent, ...rest } = original ?? {}
+				const current = this.#options.additionalInputs?.() ?? {}
+				for (const name of this.#options.inputsShownInComposer?.() ?? []) {
+					if (name in current) rest[name] = current[name]
+					else delete rest[name]
+				}
+				replayInputs = rest
+			} catch (error) {
+				// Only a job that is gone justifies running with other inputs; after a blip or
+				// a 500 that would silently run a different turn.
+				if ((error as { status?: number })?.status !== 404) {
+					sendUserToast('Could not read what that turn ran with. Try again.', true)
+					return
+				}
+			} finally {
+				this.#readingReplayArgs = false
+			}
+		}
+		// The reader may have moved on while the arguments were read: to another conversation,
+		// where this turn does not belong, or by sending. Any turn started since counts, settled
+		// or not: they wrote the chat's latest message, and running this one now would answer
+		// something they have moved past.
+		if (this.#disposed || this.#state.conversationId !== conversationId) return
+		if (this.#turnsStarted !== turnsStarted) {
+			sendUserToast('That chat started another turn. Retry once it finishes.', true)
+			return
+		}
+		void this.sendRequest({ instructions: message.content }, replayInputs)
 	}
 	restartGeneration = () => {}
 	handleUserQuestionAnswer = () => false
diff --git a/frontend/src/lib/components/flows/conversations/flowChatViewHost.test.ts b/frontend/src/lib/components/flows/conversations/flowChatViewHost.test.ts
index d91abab3c4..a0ae4b8092 100644
--- a/frontend/src/lib/components/flows/conversations/flowChatViewHost.test.ts
+++ b/frontend/src/lib/components/flows/conversations/flowChatViewHost.test.ts
@@ -1,7 +1,23 @@
-import { describe, expect, it, vi } from 'vitest'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { Chat, ChatMessage, ChatState } from 'windmill-chat'
 import { FlowChatViewHost, toDisplayMessages } from './flowChatViewHost.svelte'
 
+vi.mock('$lib/gen', () => ({
+	JobService: { getJobArgs: vi.fn() }
+}))
+vi.mock('$lib/toast', () => ({ sendUserToast: vi.fn() }))
+
+import { JobService } from '$lib/gen'
+import { sendUserToast } from '$lib/toast'
+
+const getJobArgs = vi.mocked(JobService.getJobArgs)
+const toast = vi.mocked(sendUserToast)
+
+beforeEach(() => {
+	getJobArgs.mockReset()
+	toast.mockReset()
+})
+
 function message(partial: Partial<ChatMessage> & Pick<ChatMessage, 'role'>): ChatMessage {
 	return {
 		id: partial.id ?? `${partial.role}-${Math.random()}`,
@@ -31,6 +47,10 @@ function idleState(partial: Partial<ChatState> = {}): ChatState {
 function fakeChat(initial: ChatState = idleState()) {
 	let state = initial
 	const listeners = new Set<(s: ChatState) => void>()
+	const set = (patch: Partial<ChatState>) => {
+		state = { ...state, ...patch }
+		for (const listener of listeners) listener(state)
+	}
 	const chat = {
 		getState: () => state,
 		subscribe: (listener: (s: ChatState) => void) => {
@@ -45,15 +65,14 @@ function fakeChat(initial: ChatState = idleState()) {
 		loadConversations: vi.fn(async () => []),
 		deleteConversation: vi.fn(async () => {}),
 		loadOlderMessages: vi.fn(async () => {}),
+		renameConversation: vi.fn(async () => {}),
 		destroy: vi.fn()
 	} satisfies Chat
-	const set = (patch: Partial<ChatState>) => {
-		state = { ...state, ...patch }
-		for (const listener of listeners) listener(state)
-	}
 	return { chat, set }
 }
 
+const flush = () => new Promise((resolve) => setTimeout(resolve, 0))
+
 describe('toDisplayMessages', () => {
 	it('maps user, assistant and tool rows, marking the user message of a failed turn', () => {
 		const rows = [
@@ -77,17 +96,23 @@ describe('toDisplayMessages', () => {
 			message({ role: 'assistant', content: 'boom', success: false })
 		]
 		const display = toDisplayMessages(rows)
-		expect(display[0]).toEqual({ role: 'user', index: 0, content: 'hi', error: undefined })
+		expect(display[0]).toEqual({
+			role: 'user',
+			index: 0,
+			content: 'hi',
+			error: undefined,
+			images: undefined,
+			contextElements: undefined
+		})
 		expect(display[1]).toMatchObject({
 			role: 'assistant',
 			content: 'hello',
 			reasoning: 'thinking',
-			stepName: 'agent',
 			jobId: 'job-1',
 			createdAt: '2026-09-16T10:00:01Z',
 			streaming: undefined
 		})
-		expect(display[2]).toEqual({ role: 'user', index: 1, content: 'again', error: true })
+		expect(display[2]).toMatchObject({ role: 'user', index: 1, content: 'again', error: true })
 		expect(display[3]).toMatchObject({
 			role: 'tool',
 			tool_call_id: 'tool-row',
@@ -100,6 +125,42 @@ describe('toDisplayMessages', () => {
 		})
 	})
 
+	// The worker words the provider-side search like a tool named `websearch`, which an agent
+	// tool may also be called. The search stores no arguments, and an agent tool always does.
+	it('renders the provider-side search as a web search card, not an agent tool of that name', () => {
+		const citations = JSON.stringify([
+			{ start_index: 0, end_index: 4, url: 'https://postgresql.org/docs', title: 'Release notes' }
+		])
+		const [search, agentTool, notCitations] = toDisplayMessages([
+			message({
+				role: 'tool',
+				content: 'Used websearch tool',
+				tool: { name: 'websearch', status: 'success', result: citations }
+			}),
+			message({
+				role: 'tool',
+				content: 'Used websearch tool',
+				tool: { name: 'websearch', status: 'success', arguments: '{}', result: citations }
+			}),
+			// The safety valve of a name-based rule: a row that is not the provider's search
+			// keeps its result, whatever the tool is called.
+			message({
+				role: 'tool',
+				content: 'Used websearch tool',
+				tool: { name: 'websearch', status: 'success', result: '{"hits":3}' }
+			})
+		])
+		expect(search).toMatchObject({
+			content: 'Searched the web',
+			webSearchSources: [{ url: 'https://postgresql.org/docs', title: 'Release notes' }],
+			showDetails: true,
+			autoCollapseDetails: false
+		})
+		expect(agentTool).toMatchObject({ content: 'Used websearch tool', toolName: 'websearch' })
+		expect(agentTool).not.toHaveProperty('webSearchSources')
+		expect(notCitations).toMatchObject({ toolName: 'websearch', result: { hits: 3 } })
+	})
+
 	it('shows a call the turn finished without as an error, not as still running', () => {
 		const display = toDisplayMessages([
 			message({ role: 'user', content: 'hi' }),
@@ -229,6 +290,81 @@ describe('toDisplayMessages', () => {
 			isLoading: false
 		})
 	})
+
+	// A row stored before the worker kept the call has only its sentence: the card names the
+	// tool and links its job, and has no details to open.
+	it('builds a tool card from the row alone, with its job link', () => {
+		const display = toDisplayMessages([
+			message({
+				role: 'tool',
+				content: 'Used lookup tool',
+				jobId: 'tool-job',
+				tool: { name: 'lookup', status: 'success', arguments: '{"id":1}', result: '"ok"' }
+			}),
+			message({
+				role: 'tool',
+				content: 'Used search_docs tool',
+				jobId: 'older-job',
+				tool: { name: 'search_docs', status: 'success' }
+			})
+		])
+		expect(display[0]).toMatchObject({
+			toolName: 'lookup',
+			parameters: { id: 1 },
+			result: 'ok',
+			showDetails: true,
+			jobId: 'tool-job'
+		})
+		expect(display[1]).toMatchObject({
+			toolName: 'search_docs',
+			parameters: undefined,
+			result: undefined,
+			showDetails: false,
+			jobId: 'older-job'
+		})
+	})
+
+	it('labels answers with their step only once the transcript names more than one', () => {
+		const one = toDisplayMessages([
+			message({ role: 'assistant', content: 'a', stepName: 'agent' }),
+			message({ role: 'assistant', content: 'b', stepName: 'agent' })
+		])
+		expect(one.map((m) => (m.role === 'assistant' ? m.stepName : null))).toEqual([
+			undefined,
+			undefined
+		])
+		const two = toDisplayMessages([
+			message({ role: 'assistant', content: 'a', stepName: 'agent' }),
+			message({ role: 'assistant', content: 'b', stepName: 'reviewer' })
+		])
+		expect(two.map((m) => (m.role === 'assistant' ? m.stepName : null))).toEqual([
+			'agent',
+			'reviewer'
+		])
+	})
+
+	it('shows the files a user message carried, read from the message itself', () => {
+		const display = toDisplayMessages(
+			[
+				message({
+					role: 'user',
+					content: 'go',
+					attachments: [
+						{ input: 'user_attachments', s3: 'chat/u1/shot.png' },
+						{ input: 'user_attachments', s3: 'chat/u1/notes.pdf' }
+					]
+				})
+			],
+			false,
+			new Set(),
+			{ workspace: 'ws' }
+		)
+		expect(display[0]).toMatchObject({
+			role: 'user',
+			images: [{ name: 'shot.png' }],
+			contextElements: [{ title: 'notes.pdf' }]
+		})
+	})
 })
 
 describe('FlowChatViewHost', () => {
@@ -265,10 +401,10 @@ describe('FlowChatViewHost', () => {
 		host.queueMessage('second')
 		expect(host.queuedMessage).toBe('first\nsecond')
 		set({ status: 'idle' })
-		await new Promise((resolve) => setTimeout(resolve, 0))
+		await flush()
 		expect(chat.sendMessage).toHaveBeenCalledTimes(1)
 		releaseTurn()
-		await new Promise((resolve) => setTimeout(resolve, 0))
+		await flush()
 		expect(host.queuedMessage).toBe('')
 		expect(chat.sendMessage).toHaveBeenLastCalledWith('first\nsecond', {
 			inputs: undefined,
@@ -309,7 +445,7 @@ describe('FlowChatViewHost', () => {
 		// A deployment starts while the turn is still running; the composer is disabled.
 		deploying = true
 		set({ status: 'idle' })
-		await new Promise((resolve) => setTimeout(resolve, 0))
+		await flush()
 		expect(chat.sendMessage).not.toHaveBeenCalled()
 		expect(prependText).toHaveBeenCalledWith('after deploy', [], [], [])
 		expect(host.queuedMessage).toBe('')
@@ -329,7 +465,7 @@ describe('FlowChatViewHost', () => {
 		set({ status: 'idle' })
 		host.dispose()
 		releaseTurn()
-		await new Promise((resolve) => setTimeout(resolve, 0))
+		await flush()
 		expect(chat.sendMessage).toHaveBeenCalledTimes(1)
 	})
 
@@ -454,48 +590,30 @@ describe('FlowChatViewHost', () => {
 		host.dispose()
 	})
 
-	it('retries a failed turn with the files it was sent with', async () => {
-		const { chat, set } = fakeChat(idleState({ messages: [] }))
-		chat.sendMessage.mockImplementationOnce(async () => {
-			set({ messages: [message({ id: 'u1', role: 'user', content: 'read', pending: true })] })
+	it('retries a failed turn with the files its run had, uploading nothing', async () => {
+		const { chat } = fakeChat(
+			idleState({
+				messages: [
+					message({ role: 'user', content: 'read', jobId: 'flow-job' }),
+					message({ role: 'assistant', content: 'boom', success: false })
+				]
+			})
+		)
+		getJobArgs.mockResolvedValueOnce({
+			user_message: 'read',
+			user_attachments: [{ s3: 'chat/u1/contract.pdf', filename: 'contract.pdf' }]
+		} as any)
+		const host = new FlowChatViewHost(chat, {
+			workspace: () => 'ws',
+			attachmentsTarget: () => listInput
 		})
-		// The chat shows the user message before its first await.
-		chat.sendMessage.mockImplementationOnce(async () => {})
-		const host = new FlowChatViewHost(chat, { attachmentsTarget: () => listInput })
-		const sending = host.sendRequest({ instructions: 'read', images: [image], blobs: [pdf] })
-		set({
-			messages: [
-				message({ id: 'u1', role: 'user', content: 'read' }),
-				message({ role: 'assistant', content: 'boom', success: false })
-			]
-		})
-		await sending
-		host.retryRequest(0)
-		await new Promise((resolve) => setTimeout(resolve, 0))
-		const [text, options] = chat.sendMessage.mock.calls[1] as any
+		await host.retryRequest(0)
+		const [text, options] = chat.sendMessage.mock.calls[0] as any
 		expect(text).toBe('read')
-		expect(options.attachments.map((a: any) => a.name)).toEqual(['shot.webp', 'contract.pdf'])
-		host.dispose()
-	})
-
-	it('lets go of the files of a turn that succeeded', async () => {
-		const { chat, set } = fakeChat(idleState({ messages: [] }))
-		chat.sendMessage.mockImplementationOnce(async () => {
-			set({ messages: [message({ id: 'u1', role: 'user', content: 'read', pending: true })] })
+		// The references the run already has, so the files are not uploaded a second time.
+		expect(options.inputs).toEqual({
+			user_attachments: [{ s3: 'chat/u1/contract.pdf', filename: 'contract.pdf' }]
 		})
-		chat.sendMessage.mockImplementationOnce(async () => {})
-		const host = new FlowChatViewHost(chat, { attachmentsTarget: () => listInput })
-		const sending = host.sendRequest({ instructions: 'read', blobs: [pdf] })
-		set({
-			messages: [
-				message({ id: 'u1', role: 'user', content: 'read' }),
-				message({ role: 'assistant', content: 'done' })
-			]
-		})
-		await sending
-		host.retryRequest(0)
-		await new Promise((resolve) => setTimeout(resolve, 0))
-		const [, options] = chat.sendMessage.mock.calls[1] as any
 		expect(options.attachments).toEqual([])
 		host.dispose()
 	})
@@ -590,4 +708,163 @@ describe('FlowChatViewHost', () => {
 		set({ status: 'streaming' })
 		expect(host.loading).toBe(false)
 	})
+
+	describe('retry', () => {
+		const failedTurn = () =>
+			idleState({
+				messages: [
+					message({ role: 'user', content: 'go', jobId: 'flow-job' }),
+					message({ role: 'assistant', content: 'boom', success: false })
+				]
+			})
+
+		it("replays the turn with the inputs its run had, not the composer's", async () => {
+			const { chat } = fakeChat(failedTurn())
+			getJobArgs.mockResolvedValueOnce({ user_message: 'go', tone: 'terse', model: 'old' } as any)
+			const host = new FlowChatViewHost(chat, {
+				workspace: () => 'ws',
+				additionalInputs: () => ({ tone: 'brief', model: 'new' }),
+				inputsShownInComposer: () => ['model']
+			})
+			await host.retryRequest(0)
+			expect(getJobArgs).toHaveBeenCalledWith({ workspace: 'ws', id: 'flow-job' })
+			// The composer's own control wins for what it shows; everything else replays.
+			expect(chat.sendMessage).toHaveBeenCalledWith(
+				'go',
+				expect.objectContaining({ inputs: { tone: 'terse', model: 'new' } })
+			)
+			host.dispose()
+		})
+
+		it('falls back to a plain resend once the job is purged', async () => {
+			const { chat } = fakeChat(failedTurn())
+			getJobArgs.mockRejectedValueOnce(Object.assign(new Error('gone'), { status: 404 }))
+			const host = new FlowChatViewHost(chat, {
+				workspace: () => 'ws',
+				additionalInputs: () => ({ tone: 'brief' })
+			})
+			await host.retryRequest(0)
+			expect(chat.sendMessage).toHaveBeenCalledWith(
+				'go',
+				expect.objectContaining({ inputs: { tone: 'brief' } })
+			)
+			expect(toast).not.toHaveBeenCalled()
+			host.dispose()
+		})
+
+		it('does nothing but say so when the run cannot be read', async () => {
+			const { chat } = fakeChat(failedTurn())
+			getJobArgs.mockRejectedValueOnce(Object.assign(new Error('down'), { status: 500 }))
+			const host = new FlowChatViewHost(chat, { workspace: () => 'ws' })
+			await host.retryRequest(0)
+			expect(chat.sendMessage).not.toHaveBeenCalled()
+			expect(toast).toHaveBeenCalledWith('Could not read what that turn ran with. Try again.', true)
+			host.dispose()
+		})
+
+		it('refuses once a turn started while the run was being read', async () => {
+			const { chat, set } = fakeChat(failedTurn())
+			let answer = (_: unknown) => {}
+			getJobArgs.mockImplementationOnce(() => new Promise((resolve) => (answer = resolve)) as any)
+			const host = new FlowChatViewHost(chat, { workspace: () => 'ws' })
+			const retried = host.retryRequest(0)
+			set({ status: 'streaming' })
+			answer({ user_message: 'go' })
+			await retried
+			expect(chat.sendMessage).not.toHaveBeenCalled()
+			expect(toast).toHaveBeenCalledWith(
+				'That chat started another turn. Retry once it finishes.',
+				true
+			)
+			host.dispose()
+		})
+
+		// A quick turn can start and settle inside that read: the chat is idle again, but its
+		// latest message is not the one this retry was clicked on.
+		it('refuses once a turn ran and settled while the run was being read', async () => {
+			const { chat, set } = fakeChat(failedTurn())
+			let answer = (_: unknown) => {}
+			getJobArgs.mockImplementationOnce(() => new Promise((resolve) => (answer = resolve)) as any)
+			const host = new FlowChatViewHost(chat, { workspace: () => 'ws' })
+			const retried = host.retryRequest(0)
+			set({ status: 'streaming' })
+			set({ status: 'idle' })
+			answer({ user_message: 'go' })
+			await retried
+			expect(chat.sendMessage).not.toHaveBeenCalled()
+			expect(toast).toHaveBeenCalledWith(
+				'That chat started another turn. Retry once it finishes.',
+				true
+			)
+			host.dispose()
+		})
+	})
+
+	describe('streaming reveal', () => {
+		/** A scheduler the test steps by hand, and a clock it advances. */
+		function manualReveal() {
+			let time = 0
+			const queue: (() => void)[] = []
+			return {
+				options: {
+					instant: false,
+					now: () => time,
+					schedule: (cb: () => void) => (queue.push(cb), cb),
+					cancel: (handle: unknown) => {
+						const i = queue.indexOf(handle as () => void)
+						if (i >= 0) queue.splice(i, 1)
+					}
+				},
+				tick: (ms: number) => {
+					time += ms
+					const due = queue.splice(0)
+					for (const cb of due) cb()
+				}
+			}
+		}
+
+		it('paces a streaming answer and shows it whole once it settles', () => {
+			const { chat, set } = fakeChat(idleState({ status: 'streaming' }))
+			const reveal = manualReveal()
+			const host = new FlowChatViewHost(chat, { revealOptions: reveal.options })
+			const streaming = message({ role: 'assistant', id: 'a1', content: '', pending: true })
+			set({ messages: [{ ...streaming, content: 'The answer, in one burst of text.' }] })
+			const shown = () => (host.displayMessages[0] as { content: string }).content
+			// Nothing is revealed until the pacer's first frame, and that frame shows a slice.
+			expect(shown()).toBe('')
+			reveal.tick(16)
+			expect(shown().length).toBeGreaterThan(0)
+			expect(shown().length).toBeLessThan('The answer, in one burst of text.'.length)
+			expect('The answer, in one burst of text.'.startsWith(shown())).toBe(true)
+			// Settled: the whole text, whatever the pacer had got to.
+			set({
+				status: 'idle',
+				messages: [{ ...streaming, content: 'The answer, in one burst of text.', pending: false }]
+			})
+			expect(shown()).toBe('The answer, in one burst of text.')
+			host.dispose()
+		})
+
+		it('shows a paced row whole once a tool card follows it', () => {
+			const { chat, set } = fakeChat(idleState({ status: 'streaming' }))
+			const reveal = manualReveal()
+			const host = new FlowChatViewHost(chat, { revealOptions: reveal.options })
+			const answer = message({
+				role: 'assistant',
+				id: 'a1',
+				content: 'Let me look.',
+				pending: true
+			})
+			set({ messages: [answer] })
+			expect((host.displayMessages[0] as { content: string }).content).toBe('')
+			set({
+				messages: [
+					answer,
+					message({ role: 'tool', pending: true, tool: { name: 'lookup', status: 'running' } })
+				]
+			})
+			expect((host.displayMessages[0] as { content: string }).content).toBe('Let me look.')
+			host.dispose()
+		})
+	})
 })
diff --git a/frontend/src/lib/components/flows/conversations/messageAttachments.test.ts b/frontend/src/lib/components/flows/conversations/messageAttachments.test.ts
new file mode 100644
index 0000000000..2ea1d5e28b
--- /dev/null
+++ b/frontend/src/lib/components/flows/conversations/messageAttachments.test.ts
@@ -0,0 +1,25 @@
+import { describe, expect, it } from 'vitest'
+import { attachmentLanes } from './messageAttachments'
+
+describe('attachmentLanes', () => {
+	it('splits images into thumbnails and everything else into named file chips', () => {
+		const { images, contextElements } = attachmentLanes('ws', [
+			{ input: 'user_attachments', s3: 'chat/u1/shot.PNG', storage: 'secondary' },
+			{ input: 'user_attachments', s3: 'chat/u1/0/notes.pdf', filename: 'Q3 notes.pdf' },
+			{ input: 'report', s3: 'chat/u1/data.csv' }
+		])
+		expect(images.map((i) => i.name)).toEqual(['shot.PNG'])
+		expect(images[0].dataUrl).toContain('/api/w/ws/job_helpers/download_s3_file?')
+		expect(images[0].dataUrl).toContain('file_key=chat%2Fu1%2Fshot.PNG')
+		expect(images[0].dataUrl).toContain('storage=secondary')
+		expect(contextElements.map((c) => c.title)).toEqual(['Q3 notes.pdf', 'data.csv'])
+	})
+
+	it('shows an image as a file chip when there is no workspace to link it in', () => {
+		const { images, contextElements } = attachmentLanes(undefined, [
+			{ input: 'user_attachments', s3: 'chat/u1/shot.png' }
+		])
+		expect(images).toEqual([])
+		expect(contextElements.map((c) => c.title)).toEqual(['shot.png'])
+	})
+})
diff --git a/frontend/src/lib/components/flows/conversations/messageAttachments.ts b/frontend/src/lib/components/flows/conversations/messageAttachments.ts
new file mode 100644
index 0000000000..36c7d103c3
--- /dev/null
+++ b/frontend/src/lib/components/flows/conversations/messageAttachments.ts
@@ -0,0 +1,48 @@
+/** The files a user message carried, as the lanes its bubble renders: image thumbnails and file chips. */
+import type { ChatAttachment } from 'windmill-chat'
+import { base } from '$lib/base'
+import {
+	createAttachedFileContextElement,
+	type ContextElement
+} from '$lib/components/copilot/chat/context'
+import type { AttachedImage } from '$lib/components/copilot/chat/imageUtils'
+
+const IMAGE_EXTENSIONS = ['.png', '.jpg', '.jpeg', '.gif', '.webp', '.bmp', '.svg', '.avif']
+
+export type MessageAttachments = { images: AttachedImage[]; contextElements: ContextElement[] }
+
+function displayName(attachment: ChatAttachment): string {
+	return attachment.filename || attachment.s3.split('/').pop() || attachment.s3
+}
+
+function looksLikeImage(attachment: ChatAttachment): boolean {
+	const name = displayName(attachment).toLowerCase()
+	return IMAGE_EXTENSIONS.some((ext) => name.endsWith(ext))
+}
+
+/** Same-origin, cookie-authed GET, usable directly as an <img src>. */
+function downloadUrl(workspace: string, attachment: ChatAttachment): string {
+	const params = new URLSearchParams({ file_key: attachment.s3 })
+	if (attachment.storage) params.set('storage', attachment.storage)
+	return `${base}/api/w/${workspace}/job_helpers/download_s3_file?${params.toString()}`
+}
+
+/** Without a workspace there is no link to build, so an image falls back to a file chip. */
+export function attachmentLanes(
+	workspace: string | undefined,
+	attachments: readonly ChatAttachment[] | undefined
+): MessageAttachments {
+	const images: AttachedImage[] = []
+	const contextElements: ContextElement[] = []
+	for (const attachment of attachments ?? []) {
+		const name = displayName(attachment)
+		if (workspace && looksLikeImage(attachment)) {
+			images.push({ dataUrl: downloadUrl(workspace, attachment), mediaType: 'image/png', name })
+		} else {
+			contextElements.push(
+				createAttachedFileContextElement(name, `Attached file · ${attachment.s3}`)
+			)
+		}
+	}
+	return { images, contextElements }
+}
diff --git a/frontend/src/lib/components/flows/map/FlowGraphPreviewButton.svelte b/frontend/src/lib/components/flows/map/FlowGraphPreviewButton.svelte
index c9a2b62bcb..545571fd49 100644
--- a/frontend/src/lib/components/flows/map/FlowGraphPreviewButton.svelte
+++ b/frontend/src/lib/components/flows/map/FlowGraphPreviewButton.svelte
@@ -46,7 +46,7 @@
 		btnClasses={twMerge(
 			'relative p-1.5 transition-all duration-200 drop-shadow-base',
 			wide ? 'w-[120px]' : 'w-[44.5px]',
-			'max-[1760px]:mt-[1.5px]' // Magic number comes from app.css (when :root fontSize becomes bigger)
+			'mt-[1.5px] [@media(min-device-width:1760px)]:mt-0' // Magic number comes from app.css (when :root fontSize becomes bigger)
 		)}
 		style="height: {NODE.height}px;"
 		on:click={() => {
diff --git a/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte b/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte
index 22b74230b4..044e52c6ba 100644
--- a/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte
+++ b/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte
@@ -20,7 +20,6 @@
 	import { overlayPortalTarget } from '$lib/components/common/overlayHost.svelte'
 
 	import { locateModules, groupByParent } from '../multiSelectUtils'
-	import { workspaceStore } from '$lib/stores'
 	import FlowGraphV2 from '$lib/components/graph/FlowGraphV2.svelte'
 	import { replaceId } from '../flowStore.svelte'
 	import { setScheduledPollSchedule, type TriggerContext } from '$lib/components/triggers'
@@ -50,6 +49,9 @@
 		dfsStructure,
 		moduleToStructureNode
 	} from '$lib/components/graph/flowStructure'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		sidebarSize?: number | undefined
@@ -114,7 +116,7 @@
 	const { customUi, selectionManager, history, flowStateStore, flowStore, pathStore, opWorkspace } =
 		getContext<FlowEditorContext>('FlowEditorContext')
 
-	let opWs = $derived(opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(opWorkspace?.() ?? $operatingWorkspace)
 
 	const moveManager = new MoveManager()
 	const { triggersCount, triggersState } = getContext<TriggerContext>('TriggerContext')
diff --git a/frontend/src/lib/components/flows/map/InsertModuleInner.svelte b/frontend/src/lib/components/flows/map/InsertModuleInner.svelte
index 7c75d97fab..3c50e213f1 100644
--- a/frontend/src/lib/components/flows/map/InsertModuleInner.svelte
+++ b/frontend/src/lib/components/flows/map/InsertModuleInner.svelte
@@ -12,10 +12,12 @@
 	import RefreshButton from '$lib/components/common/button/RefreshButton.svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
 	import { ResourceService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import type { FlowEditorContext } from '../types'
 	import { logReusableAgentUsage } from '../agentTelemetry'
 	import { BotIcon, Loader2, Plus } from 'lucide-svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	const dispatch = createEventDispatcher()
 	interface Props {
@@ -56,7 +58,7 @@
 
 	// Optional: this picker also renders outside the flow editor's context (the triggers wrapper).
 	const flowEditorContext = getContext<FlowEditorContext | undefined>('FlowEditorContext')
-	let ws = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
+	let ws = $derived(flowEditorContext?.opWorkspace?.() ?? $operatingWorkspace)
 
 	// Flagged for the whole menu, whichever pane is showing: the flow builder walks node
 	// selection on ArrowUp/ArrowDown while it is unset, which tears the popover down.
diff --git a/frontend/src/lib/components/flows/pickers/PickHubScript.svelte b/frontend/src/lib/components/flows/pickers/PickHubScript.svelte
index 05205d8335..2e63266a58 100644
--- a/frontend/src/lib/components/flows/pickers/PickHubScript.svelte
+++ b/frontend/src/lib/components/flows/pickers/PickHubScript.svelte
@@ -9,13 +9,16 @@
 	import { ScriptService, type HubScriptKind } from '$lib/gen'
 	import { Loader2 } from 'lucide-svelte'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
-	import { disableHubStore, workspaceStore } from '$lib/stores'
+	import { disableHubStore } from '$lib/stores'
 	import { logHubScriptPick } from '$lib/utils/featureUsage'
 	import {
 		alphabetical,
 		byPopularity,
 		localCountsByIntegration
 	} from '$lib/components/pickerPopularity'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		kind?: HubScriptKind & string
@@ -66,7 +69,7 @@
 			// Independent reads, so they share one round trip before first paint.
 			const [integrations, local] = await Promise.all([
 				listHubIntegrationsShared(filterKind),
-				$workspaceStore ? localCountsByIntegration($workspaceStore) : {}
+				$operatingWorkspace ? localCountsByIntegration($operatingWorkspace) : {}
 			])
 			const hubPicks = Object.fromEntries(integrations.map((x) => [x.name, x.picks ?? 0]))
 			popularity = byPopularity(hubPicks, local)
diff --git a/frontend/src/lib/components/flows/pickers/PickHubScriptQuick.svelte b/frontend/src/lib/components/flows/pickers/PickHubScriptQuick.svelte
index 2499c285c4..6648c622c0 100644
--- a/frontend/src/lib/components/flows/pickers/PickHubScriptQuick.svelte
+++ b/frontend/src/lib/components/flows/pickers/PickHubScriptQuick.svelte
@@ -42,7 +42,7 @@
 	import { Circle, ExternalLink } from 'lucide-svelte'
 	import Popover from '$lib/components/Popover.svelte'
 	import { usePromise } from '$lib/svelte5Utils.svelte'
-	import { disableHubStore, hubBaseUrlStore, userStore, workspaceStore } from '$lib/stores'
+	import { disableHubStore, hubBaseUrlStore, userStore } from '$lib/stores'
 	import { get } from 'svelte/store'
 	import Button from '$lib/components/common/button/Button.svelte'
 	import { Alert } from '$lib/components/common'
@@ -53,6 +53,9 @@
 		byPopularity,
 		localCountsByIntegration
 	} from '$lib/components/pickerPopularity'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let customUi: undefined | FlowBuilderWhitelabelCustomUi = getContext('customUi')
 
@@ -113,7 +116,7 @@
 			// Independent reads, so they share one round trip before first paint.
 			const [integrations, local] = await Promise.all([
 				listHubIntegrationsShared(filterKind, refreshCount),
-				$workspaceStore ? localCountsByIntegration($workspaceStore) : {}
+				$operatingWorkspace ? localCountsByIntegration($operatingWorkspace) : {}
 			])
 			const hubPicks = Object.fromEntries(integrations.map((x) => [x.name, x.picks ?? 0]))
 			popularity = byPopularity(hubPicks, local)
diff --git a/frontend/src/lib/components/flows/pickers/WorkspaceScriptPicker.svelte b/frontend/src/lib/components/flows/pickers/WorkspaceScriptPicker.svelte
index 575744cb04..5bfb13bec4 100644
--- a/frontend/src/lib/components/flows/pickers/WorkspaceScriptPicker.svelte
+++ b/frontend/src/lib/components/flows/pickers/WorkspaceScriptPicker.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import { createEventDispatcher, getContext, untrack } from 'svelte'
 	import type { FlowEditorContext } from '../types'
 	import { ScriptService } from '$lib/gen'
@@ -11,6 +10,9 @@
 	import Toggle from '$lib/components/Toggle.svelte'
 	import NoItemFound from '$lib/components/home/NoItemFound.svelte'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	type Item = {
 		path: string
@@ -24,7 +26,7 @@
 	let filteredItems = $state(undefined) as (Item & { marked?: string })[] | undefined
 
 	const flowEditorContext = getContext<FlowEditorContext>('FlowEditorContext')
-	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $operatingWorkspace)
 	interface Props {
 		kind?: 'script' | 'trigger' | 'approval' | 'failure' | 'preprocessor'
 		isTemplate?: boolean | undefined
@@ -55,10 +57,10 @@
 	const dispatch = createEventDispatcher()
 	let lockHash = $state(false)
 	$effect(() => {
-		$workspaceStore && kind && untrack(() => loadItems())
+		$operatingWorkspace && kind && untrack(() => loadItems())
 	})
 	$effect(() => {
-		if ($workspaceStore) {
+		if ($operatingWorkspace) {
 			ownerFilter = undefined
 		}
 	})
diff --git a/frontend/src/lib/components/flows/pickers/WorkspaceScriptPickerQuick.svelte b/frontend/src/lib/components/flows/pickers/WorkspaceScriptPickerQuick.svelte
index 9e3a20b4a7..aaf198fd01 100644
--- a/frontend/src/lib/components/flows/pickers/WorkspaceScriptPickerQuick.svelte
+++ b/frontend/src/lib/components/flows/pickers/WorkspaceScriptPickerQuick.svelte
@@ -1,4 +1,5 @@
 <script module lang="ts">
+	import { workspaceStore } from '$lib/stores'
 	let initialWorkspace = get(workspaceStore)
 	let loadItemsCached = createCache(
 		({
@@ -36,7 +37,6 @@
 </script>
 
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import { createEventDispatcher, getContext, untrack } from 'svelte'
 	import type { FlowEditorContext } from '../types'
 	import { FlowService, ScriptService } from '$lib/gen'
@@ -50,6 +50,9 @@
 	import { get } from 'svelte/store'
 	import { userStore } from '$lib/stores'
 	import Button from '$lib/components/common/button/Button.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	type Item = {
 		path: string
@@ -59,7 +62,7 @@
 	}
 
 	const flowEditorContext = getContext<FlowEditorContext>('FlowEditorContext')
-	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $operatingWorkspace)
 
 	let items = usePromise(
 		async () => await loadItemsCached({ workspace: opWs!, kind, isTemplate, refreshCount }),
@@ -123,10 +126,10 @@
 	}
 	$effect(() => {
 		refreshCount
-		$workspaceStore && kind && untrack(() => items.refresh())
+		$operatingWorkspace && kind && untrack(() => items.refresh())
 	})
 	$effect(() => {
-		if ($workspaceStore) {
+		if ($operatingWorkspace) {
 			ownerFilter = undefined
 		}
 	})
diff --git a/frontend/src/lib/components/flows/propPicker/StepHistory.svelte b/frontend/src/lib/components/flows/propPicker/StepHistory.svelte
index 67190154b8..8fc9a3493e 100644
--- a/frontend/src/lib/components/flows/propPicker/StepHistory.svelte
+++ b/frontend/src/lib/components/flows/propPicker/StepHistory.svelte
@@ -10,12 +10,14 @@
 <script lang="ts">
 	import InfiniteList from '$lib/components/InfiniteList.svelte'
 	import { JobService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { getContext, createEventDispatcher, untrack } from 'svelte'
 	import type { FlowEditorContext } from '../types'
 	import { Pin } from 'lucide-svelte'
 	import { Cell } from '$lib/components/table'
 	import JobPickerLight from './JobPickerLight.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		selected?: string | undefined
@@ -41,7 +43,7 @@
 
 	const { pathStore, flowStateStore, opWorkspace } =
 		getContext<FlowEditorContext>('FlowEditorContext') ?? {}
-	let opWs = $derived(opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(opWorkspace?.() ?? $operatingWorkspace)
 	const dispatch = createEventDispatcher()
 
 	let infiniteList: InfiniteList | undefined = $state(undefined)
diff --git a/frontend/src/lib/components/git_sync/GitPushPreview.svelte b/frontend/src/lib/components/git_sync/GitPushPreview.svelte
new file mode 100644
index 0000000000..bed6d741d1
--- /dev/null
+++ b/frontend/src/lib/components/git_sync/GitPushPreview.svelte
@@ -0,0 +1,263 @@
+<!--
+@component
+Lists what pushing the workspace would commit, and pushes it. The host owns the
+buttons — the setup dialog puts them in its own footer, the standalone modal in its
+— and drives them through `apply()` and `status()`.
+-->
+<script lang="ts">
+	import { untrack } from 'svelte'
+	import { Alert, Button, CopyButton } from '$lib/components/common'
+	import { Loader2, RotateCw, XCircle, Terminal, ChevronDown, ChevronUp } from 'lucide-svelte'
+	import GitDiffPreview from '../GitDiffPreview.svelte'
+	import { JobService } from '$lib/gen'
+	import { workspaceStore } from '$lib/stores'
+	import hubPaths from '$lib/hubPaths.json'
+	import { jobManager } from '$lib/services/JobManager'
+	import type { SyncResponse, SettingsObject } from '$lib/git-sync'
+
+	interface Props {
+		gitRepoResourcePath: string
+		uiState: SettingsObject
+		onSuccess?: () => void
+		/** Told when a push starts and ends, so a host that can outlive this component knows a
+		 *  push is in flight — this one is destroyed the moment its dialog closes. */
+		onApplyStateChange?: (applying: boolean) => void
+	}
+
+	let { gitRepoResourcePath, uiState, onSuccess, onApplyStateChange }: Props = $props()
+
+	let previewJobId = $state<string | null>(null)
+	let previewJobStatus = $state<'running' | 'success' | 'failure' | undefined>(undefined)
+	let isPreviewLoading = $state(false)
+	let previewError = $state('')
+
+	let applyJobId = $state<string | null>(null)
+	let applyJobStatus = $state<'running' | 'success' | 'failure' | undefined>(undefined)
+	let isApplying = $state(false)
+	let applyError = $state('')
+
+	let showCliInstructions = $state(false)
+	const cliInstructions = $derived(`# Setup (only needed if local folder not initialized yet)
+npm install -g windmill-cli
+wmill workspace add ${$workspaceStore} ${$workspaceStore} ${window.location.origin}
+wmill init --workspace ${$workspaceStore} --repository ${gitRepoResourcePath}
+
+# Pull workspace content to git repository
+wmill sync pull --workspace ${$workspaceStore} --repository ${gitRepoResourcePath}`)
+	let previewResult = $state<SyncResponse | null>(null)
+
+	/** What the host needs to label and enable its buttons. */
+	export function status() {
+		return {
+			previewing: isPreviewLoading,
+			applying: isApplying,
+			// Nothing to push is not worth a push job.
+			canApply:
+				!!previewResult && !previewError && !isApplying && (previewResult.changes?.length ?? 0) > 0
+		}
+	}
+
+	export function apply() {
+		return executeJob(false)
+	}
+
+	// The list of changes is what this is for, so it loads on its own rather than on a button.
+	$effect(() => {
+		gitRepoResourcePath
+		untrack(() => void executeJob(true))
+	})
+
+	async function executeJob(isDryRun: boolean) {
+		const isPreview = isDryRun
+
+		if (isPreview) {
+			isPreviewLoading = true
+			previewError = ''
+			previewResult = null
+			previewJobId = null
+			previewJobStatus = undefined
+		} else {
+			isApplying = true
+			onApplyStateChange?.(true)
+			applyError = ''
+			applyJobId = null
+			applyJobStatus = undefined
+		}
+
+		try {
+			const workspace = $workspaceStore
+			if (!workspace) return
+
+			const payload = {
+				workspace_id: workspace,
+				repo_url_resource_path: gitRepoResourcePath,
+				dry_run: isDryRun,
+				pull: false,
+				settings_json: JSON.stringify(uiState)
+			}
+
+			const jobId = await JobService.runScriptByPath({
+				workspace,
+				path: hubPaths.gitInitRepo,
+				requestBody: payload,
+				skipPreprocessor: true
+			})
+
+			if (isPreview) {
+				previewJobId = jobId
+				previewJobStatus = 'running'
+			} else {
+				applyJobId = jobId
+				applyJobStatus = 'running'
+			}
+
+			const result = await jobManager.runWithProgress(() => Promise.resolve(jobId), {
+				workspace,
+				timeout: 60000,
+				timeoutMessage: `${isPreview ? 'Preview' : 'Apply'} job timed out after 60s`,
+				onProgress: (status) => {
+					if (isPreview) {
+						previewJobStatus = status.status
+					} else {
+						applyJobStatus = status.status
+					}
+
+					if (status.status === 'failure') {
+						if (isPreview) {
+							previewError = status.error || 'Listing the changes failed'
+						} else {
+							applyError = status.error || 'Push failed'
+						}
+					}
+				}
+			})
+
+			if (isPreview) {
+				if (previewJobStatus === 'success') {
+					previewResult = result as SyncResponse
+				}
+			} else {
+				if (applyJobStatus === 'success') {
+					onSuccess?.()
+				}
+			}
+		} catch (e) {
+			const errorMsg = e?.message || 'Operation failed'
+			if (isPreview) {
+				previewJobStatus = 'failure'
+				previewError = errorMsg
+			} else {
+				applyJobStatus = 'failure'
+				applyError = errorMsg
+			}
+		} finally {
+			if (isPreview) {
+				isPreviewLoading = false
+			} else {
+				isApplying = false
+				onApplyStateChange?.(false)
+			}
+		}
+	}
+</script>
+
+<div class="flex flex-col gap-4 h-full">
+	{#if isPreviewLoading}
+		<div class="flex-1 min-h-24 flex flex-col items-center justify-center gap-2 text-sm text-hint">
+			<Loader2 size={36} class="animate-spin" />
+			Listing the changes to push...
+		</div>
+	{:else}
+		<p class="text-xs text-secondary">
+			Here is what will get pushed to the repository, according to the filters you set.
+		</p>
+	{/if}
+
+	{#if previewError}
+		<Alert type="error" title="Could not list the changes">
+			<div class="flex flex-col items-start gap-2">
+				<span>{previewError}</span>
+				<Button
+					variant="default"
+					unifiedSize="xs"
+					startIcon={{ icon: RotateCw }}
+					onClick={() => void executeJob(true)}
+				>
+					Retry
+				</Button>
+			</div>
+		</Alert>
+	{/if}
+
+	{#if previewResult && !previewError}
+		<div class="flex flex-col gap-2 flex-1 min-h-0">
+			<h4 class="text-sm font-semibold text-primary">Changes to push</h4>
+
+			{#if previewResult.changes?.length > 0}
+				<GitDiffPreview {previewResult} heightClass="flex-1 min-h-0" />
+			{:else}
+				<div class="text-sm text-secondary">
+					The repository already matches this workspace: there is nothing to push.
+				</div>
+			{/if}
+		</div>
+	{/if}
+
+	{#if applyError}
+		<Alert type="error" title="Push failed">
+			{applyError}
+		</Alert>
+	{/if}
+
+	<div class="mt-auto flex flex-col gap-2">
+		{#each [{ id: previewJobId, status: previewJobStatus, label: 'Changes job', running: isPreviewLoading }, { id: applyJobId, status: applyJobStatus, label: 'Push job', running: isApplying }] as job (job.label)}
+			<!-- The row is held from the moment the job is started, since its id only arrives once
+			     the server has taken it; it goes once the job succeeded, its outcome being on
+			     screen already. -->
+			{#if job.running || (job.id && job.status !== 'success')}
+				<div class="flex items-center gap-2 min-h-4 text-2xs text-secondary">
+					{#if job.status === 'running'}
+						<Loader2 class="animate-spin" size={12} />
+					{:else if job.status === 'failure'}
+						<XCircle size={12} class="text-red-700" />
+					{/if}
+					{#if job.id}
+						<span class="text-hint">{job.label}:</span>
+						<a
+							target="_blank"
+							class="underline"
+							href={`/run/${job.id}?workspace=${$workspaceStore}`}
+						>
+							{job.id}
+						</a>
+					{/if}
+				</div>
+			{/if}
+		{/each}
+
+		<!-- Nothing to copy commands for until the changes are known. -->
+		<div class={isPreviewLoading ? 'hidden' : ''}>
+			<div class="flex">
+				<Button
+					variant="subtle"
+					unifiedSize="xs"
+					startIcon={{ icon: Terminal }}
+					endIcon={{ icon: showCliInstructions ? ChevronUp : ChevronDown }}
+					onClick={() => (showCliInstructions = !showCliInstructions)}
+				>
+					CLI instructions
+				</Button>
+			</div>
+
+			{#if showCliInstructions}
+				<div class="relative mt-2">
+					<CopyButton value={cliInstructions} class="absolute top-1 right-1" />
+					<pre
+						class="text-xs bg-surface-sunken rounded-lg p-3 pr-10 overflow-x-auto whitespace-pre-wrap break-all"
+						>{cliInstructions}</pre
+					>
+				</div>
+			{/if}
+		</div>
+	</div>
+</div>
diff --git a/frontend/src/lib/components/git_sync/GitSyncContext.svelte.ts b/frontend/src/lib/components/git_sync/GitSyncContext.svelte.ts
index 075c6b1f24..97b79b7c1b 100644
--- a/frontend/src/lib/components/git_sync/GitSyncContext.svelte.ts
+++ b/frontend/src/lib/components/git_sync/GitSyncContext.svelte.ts
@@ -1,5 +1,5 @@
 import { getContext, setContext } from 'svelte'
-import { enterpriseLicense, userStore } from '$lib/stores'
+import { enterpriseLicense, userStore, userWorkspaces, workspaceStore } from '$lib/stores'
 import { get } from 'svelte/store'
 import { sendUserToast } from '$lib/toast'
 import { apiErrorMessage } from '$lib/utils'
@@ -46,7 +46,15 @@ export type GitSyncSettings = {
 export type ModalState = {
 	push: { idx: number; repo: GitSyncRepository; open: boolean } | null
 	pull: { idx: number; repo: GitSyncRepository; open: boolean; settingsOnly?: boolean } | null
-	success: { open: boolean; savedWithoutInit?: boolean; autoPullOn?: boolean } | null
+	success: {
+		open: boolean
+		savedWithoutInit?: boolean
+		autoPullOn?: boolean
+		/** Why pulling fell back to polling, when it did. */
+		webhookError?: string
+		/** Whether this workspace is the one that would turn pulling on for this repository. */
+		ownsAutoPull?: boolean
+	} | null
 }
 
 export type ValidationState = {
@@ -202,6 +210,11 @@ export function createGitSyncContext(workspace: string) {
 					'flow',
 					'app',
 					'folder',
+					'resource',
+					'resourcetype',
+					'variable',
+					'schedule',
+					'trigger',
 					'workspacedependencies',
 					'datatablemigration'
 				]
@@ -290,8 +303,23 @@ export function createGitSyncContext(workspace: string) {
 		closeModal('pull')
 	}
 
-	function showSuccessModal(savedWithoutInit?: boolean, autoPullOn?: boolean) {
-		activeModals.success = { open: true, savedWithoutInit, autoPullOn }
+	/** Only a sync repository in a non-fork workspace has a pull toggle of its own: promotion
+	 * repositories have none, and a fork's pulling is its parent's to set. */
+	function ownsAutoPull(repo: GitSyncRepository): boolean {
+		const ws = get(workspaceStore)
+		const isFork =
+			(ws?.startsWith('wm-fork-') ?? false) ||
+			!!get(userWorkspaces)?.find((w) => w.id === ws)?.parent_workspace_id
+		return !repo.use_individual_branch && !isFork
+	}
+
+	function showSuccessModal(
+		savedWithoutInit?: boolean,
+		autoPullOn?: boolean,
+		ownsAutoPull?: boolean,
+		webhookError?: string
+	) {
+		activeModals.success = { open: true, savedWithoutInit, autoPullOn, ownsAutoPull, webhookError }
 	}
 
 	function closeSuccessModal() {
@@ -314,8 +342,11 @@ export function createGitSyncContext(workspace: string) {
 		repo.detectionJobId = undefined
 		repo.detectionJobStatus = undefined
 
-		// Track the detection timestamp to avoid race conditions from old jobs
+		// Track the detection timestamp to avoid race conditions from old jobs. Stamped before
+		// the request, or a failure to even start the job reads as superseded and leaves the
+		// repository loading for good.
 		const detectionTimestamp = Date.now()
+		repo._detectionTimestamp = detectionTimestamp
 
 		try {
 			const jobId = await JobService.runScriptByPath({
@@ -335,7 +366,6 @@ export function createGitSyncContext(workspace: string) {
 
 			repo.detectionJobId = jobId
 			repo.detectionJobStatus = 'running'
-			repo._detectionTimestamp = detectionTimestamp
 
 			// Use JobManager for polling - result will be the actual job response
 			await jobManager.runWithProgress(() => Promise.resolve(jobId), {
@@ -506,7 +536,9 @@ export function createGitSyncContext(workspace: string) {
 		}
 	}
 
-	async function saveRepository(idx: number, savedWithoutInit = false) {
+	/** `announce` off for a caller that reports the save itself — the setup dialog ends on a
+	 *  step saying the same thing, and a modal over it would say it twice. */
+	async function saveRepository(idx: number, savedWithoutInit = false, announce = true) {
 		const repo = repositories[idx]
 		if (!repo || !validateRepository(repo, idx)) {
 			throw new Error('Cannot save invalid repository')
@@ -539,7 +571,8 @@ export function createGitSyncContext(workspace: string) {
 		if (repoToSave.auto_pull) {
 			repoToSave.auto_pull = {
 				...repoToSave.auto_pull,
-				enabled_by: repoToSave.auto_pull.enabled ? get(userStore)?.email : undefined
+				enabled_by: repoToSave.auto_pull.enabled ? get(userStore)?.email : undefined,
+				webhook_error: await readWebhookError(repoToSave)
 			}
 		}
 
@@ -553,7 +586,31 @@ export function createGitSyncContext(workspace: string) {
 			repoToSave.detectionState = undefined
 			repoToSave.extractedSettings = undefined
 			// Show success modal for new connections
-			showSuccessModal(savedWithoutInit, repoToSave.auto_pull?.enabled === true)
+			if (announce) {
+				showSuccessModal(
+					savedWithoutInit,
+					repoToSave.auto_pull?.enabled === true,
+					ownsAutoPull(repoToSave),
+					repoToSave.auto_pull?.webhook_error
+				)
+			}
+		}
+	}
+
+	/** The webhook is registered after the settings commit, best-effort, and a failure is
+	 * reported only through the stored settings — so it stays invisible until they are read
+	 * back. Without this, pulling reads as working when it has silently fallen back to
+	 * polling (an app missing the webhook permission, an instance GitHub cannot reach). */
+	async function readWebhookError(repo: GitSyncRepository): Promise<string | undefined> {
+		if (!repo.auto_pull?.enabled) return undefined
+		try {
+			const settings = await WorkspaceService.getSettings({ workspace })
+			return settings.git_sync?.repositories?.find(
+				(r) => r.git_repo_resource_path.replace('$res:', '') === repo.git_repo_resource_path
+			)?.auto_pull?.webhook_error
+		} catch {
+			// Only costs the warning; the card shows it on the next load.
+			return undefined
 		}
 	}
 
@@ -704,6 +761,11 @@ export function createGitSyncContext(workspace: string) {
 					'flow',
 					'app',
 					'folder',
+					'resource',
+					'resourcetype',
+					'variable',
+					'schedule',
+					'trigger',
 					'workspacedependencies',
 					'datatablemigration'
 				]
@@ -712,9 +774,10 @@ export function createGitSyncContext(workspace: string) {
 			legacyImported: false,
 			isUnsavedConnection: true,
 			collapsed: false
-			// Pull-from-Git defaults are applied by the repository card once the
-			// selected resource resolves: only app-backed repos (instant webhook
-			// delivery) default to auto-pull on; polling is opt-in for token repos.
+			// Pull-from-Git defaults are applied once the selected resource resolves, by
+			// whoever is configuring the connection (see applyNewConnectionDefaults): only
+			// app-backed repos (instant webhook delivery) default to auto-pull on; polling is
+			// opt-in for token repos.
 		})
 		gitSyncTestJobs.push({
 			jobId: '',
@@ -741,6 +804,11 @@ export function createGitSyncContext(workspace: string) {
 					'flow',
 					'app',
 					'folder',
+					'resource',
+					'resourcetype',
+					'variable',
+					'schedule',
+					'trigger',
 					'workspacedependencies',
 					'datatablemigration'
 				]
diff --git a/frontend/src/lib/components/git_sync/GitSyncModalManager.svelte b/frontend/src/lib/components/git_sync/GitSyncModalManager.svelte
index 610dafb562..cb8236cafc 100644
--- a/frontend/src/lib/components/git_sync/GitSyncModalManager.svelte
+++ b/frontend/src/lib/components/git_sync/GitSyncModalManager.svelte
@@ -111,5 +111,7 @@
 		bind:open={gitSyncContext.activeModals.success.open}
 		savedWithoutInit={gitSyncContext.activeModals.success.savedWithoutInit}
 		autoPullOn={gitSyncContext.activeModals.success.autoPullOn}
+		explainAutoPullOff={gitSyncContext.activeModals.success.ownsAutoPull ?? false}
+		webhookError={gitSyncContext.activeModals.success.webhookError}
 	/>
 {/if}
diff --git a/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte b/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte
index 291c89c606..8c3af1c54d 100644
--- a/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte
+++ b/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte
@@ -1,7 +1,6 @@
 <script lang="ts">
 	import {
 		Save,
-		Trash,
 		XCircle,
 		CheckCircle2,
 		RotateCw,
@@ -15,9 +14,9 @@
 	import ResourcePicker from '$lib/components/ResourcePicker.svelte'
 	import GitSyncFilterSettings from '$lib/components/workspaceSettings/GitSyncFilterSettings.svelte'
 	import DetectionFlow from './DetectionFlow.svelte'
+	import { applyNewConnectionDefaults } from './setup/connectionDefaults'
 	import { sendUserToast } from '$lib/toast'
 	import { apiErrorMessage } from '$lib/utils'
-	import { fade } from 'svelte/transition'
 	import { workspaceStore, userWorkspaces, enterpriseLicense } from '$lib/stores'
 	import type { GitSyncRepository } from './GitSyncContext.svelte'
 	import GitSyncModeDisplay from './GitSyncModeDisplay.svelte'
@@ -56,7 +55,6 @@
 	const repo = $derived(repository || (idx !== null ? gitSyncContext.getRepository(idx) : null))
 	const validation = $derived(idx !== null ? gitSyncContext.getValidation(idx) : null)
 	const gitSyncTestJob = $derived(idx !== null ? gitSyncContext.gitSyncTestJobs?.[idx] : null)
-	let confirmingDelete = $state(false)
 
 	function pullStatusDate(status: { at: number }): string {
 		return new Date(status.at * 1000).toISOString()
@@ -303,38 +301,13 @@
 						// Extract git URL from resource value
 						const value = resource.value as Record<string, any>
 						isGithubApp = value?.is_github_app === true
-						// A newly added sync connection defaults to pulling from Git only
-						// when the repository is app-backed (instant webhook delivery).
-						// Polling is opt-in for token repositories, and fork/dev workspaces
-						// never get the parent-only defaults (the backend rejects them).
-						// EE-only.
-						if (
-							repoMode === 'sync' &&
-							repo.isUnsavedConnection &&
-							hasManagedCredential &&
-							!isFork &&
-							$enterpriseLicense &&
-							repo.auto_pull === undefined
-						) {
-							repo.auto_pull = { enabled: true, mode: 'auto', sync_forks: true }
-						}
-						// Promotion deploys push wm_deploy/** branches that exist to be
-						// merged; without a PR the deploy is an orphaned branch. Default
-						// the managed PR on where Windmill can open it (app-backed).
-						// Fork PRs stay opt-in everywhere.
-						if (
-							repoMode === 'promotion' &&
-							repo.isUnsavedConnection &&
-							hasManagedCredential &&
-							$enterpriseLicense &&
-							repo.promotion_open_prs === undefined
-						) {
-							repo.promotion_open_prs = true
-						}
-						// Webhook with polling fallback is the only delivery for app repos.
-						if (isGithubApp && repo.auto_pull?.mode === 'polling') {
-							repo.auto_pull = { ...repo.auto_pull, mode: 'auto' }
-						}
+						applyNewConnectionDefaults(repo, {
+							mode: repoMode,
+							managedCredential: hasManagedCredential,
+							isGithubApp,
+							isFork,
+							ee: !!$enterpriseLicense
+						})
 						let gitUrl = value?.url || value?.git_url
 
 						if (gitUrl && typeof gitUrl === 'string') {
@@ -479,27 +452,6 @@
 		}
 	}
 
-	function initiateDelete() {
-		confirmingDelete = true
-	}
-
-	async function confirmDelete() {
-		if (idx === null) return
-		try {
-			await gitSyncContext.removeRepository(idx)
-			sendUserToast('Repository connection removed successfully')
-		} catch (error: any) {
-			console.error('Failed to remove repository:', error)
-			sendUserToast('Failed to remove repository: ' + apiErrorMessage(error), true)
-		} finally {
-			confirmingDelete = false
-		}
-	}
-
-	function cancelDelete() {
-		confirmingDelete = false
-	}
-
 	function runGitSyncTestJob() {
 		if (idx !== null && gitSyncContext.runTestJob) {
 			gitSyncContext.runTestJob(idx)
@@ -566,36 +518,6 @@
 			{/if}
 		</button>
 	{/if}
-	{#if !confirmingDelete}
-		<div transition:fade|local={{ duration: 100 }}>
-			<Button
-				size="xs"
-				variant="default"
-				onclick={initiateDelete}
-				startIcon={{ icon: Trash }}
-				destructive
-			>
-				Delete
-			</Button>
-		</div>
-	{:else}
-		<div class="flex gap-1">
-			<button
-				transition:fade|local={{ duration: 100 }}
-				class="px-3 py-1 text-xs bg-red-500 text-white rounded duration-200 hover:bg-red-600"
-				onclick={confirmDelete}
-			>
-				Confirm delete
-			</button>
-			<button
-				transition:fade|local={{ duration: 100 }}
-				class="px-2 py-1 text-xs bg-surface-secondary rounded duration-200 hover:bg-surface-hover"
-				onclick={cancelDelete}
-			>
-				<XCircle size={12} />
-			</button>
-		</div>
-	{/if}
 {/snippet}
 
 {#snippet repositoryContent()}
@@ -675,7 +597,7 @@
 				</div>
 			{/if}
 			{#if gitSyncTestJob && gitSyncTestJob.status !== undefined}
-				<div class="flex text-sm gap-1 items-center">
+				<div class="flex text-xs gap-1 items-center">
 					{#if gitSyncTestJob.status === 'running'}
 						<RotateCw size={14} class="animate-spin" />
 					{:else if gitSyncTestJob.status === 'success'}
diff --git a/frontend/src/lib/components/git_sync/GitSyncSection.svelte b/frontend/src/lib/components/git_sync/GitSyncSection.svelte
index 7327912697..04b23b60c3 100644
--- a/frontend/src/lib/components/git_sync/GitSyncSection.svelte
+++ b/frontend/src/lib/components/git_sync/GitSyncSection.svelte
@@ -1,14 +1,21 @@
 <script lang="ts">
-	import { ExternalLink, ChevronDown, ChevronRight, Plus } from 'lucide-svelte'
-	import { Button, Alert } from '$lib/components/common'
+	import { ExternalLink, Plus, Settings, GitBranch, Trash } from 'lucide-svelte'
+	import DropdownV2 from '$lib/components/DropdownV2.svelte'
+	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
+	import { Button, Alert, Badge, Drawer, DrawerContent } from '$lib/components/common'
+	import GitSyncSetupModal from './GitSyncSetupModal.svelte'
+	import EEOnly from '$lib/components/EEOnly.svelte'
+	import Tooltip from '$lib/components/Tooltip.svelte'
 	import SettingsPageHeader from '$lib/components/settings/SettingsPageHeader.svelte'
 	import { setGitSyncContext } from './GitSyncContext.svelte'
 	import GitSyncRepositoryCard from './GitSyncRepositoryCard.svelte'
+	import type { GitSyncRepository } from './GitSyncContext.svelte'
 	import GitSyncModalManager from './GitSyncModalManager.svelte'
 	import { enterpriseLicense, workspaceStore, userWorkspaces } from '$lib/stores'
 	import { base } from '$lib/base'
 	import { WorkspaceService } from '$lib/gen'
 	import { sendUserToast } from '$lib/toast'
+	import { apiErrorMessage } from '$lib/utils'
 	import { untrack } from 'svelte'
 
 	// Create context reactively based on workspaceStore
@@ -78,14 +85,12 @@
 	// A dev workspace reuses the single repo it inherited from prod: whether it's
 	// currently in sync or promotion mode, it's the same one card, toggled between
 	// the two — so a dev never configures a separate promotion repo.
-	const devPrimaryRepo = $derived(isDevWorkspace ? (primarySync ?? primaryPromotion) : null)
 	// The single-repo dev UX (one card + promotion toggle, secondaries hidden) is
 	// only safe when the dev actually has one repo — i.e. it inherited prod's on
 	// fork. An ATTACHED dev keeps its own repos: with more than one, fall back to
 	// the normal layout so none are hidden and we don't present an unrelated repo
 	// as prod's promotion target.
 	const devSingleRepo = $derived(isDevWorkspace && (gitSyncContext?.repositories?.length ?? 0) <= 1)
-	const secondarySync = $derived(gitSyncContext?.getSecondarySyncRepositories() || [])
 	const secondaryPromotion = $derived(gitSyncContext?.getSecondaryPromotionRepositories() || [])
 	// Fork creation keeps only sync-mode repositories and a fork is refused a
 	// promotion one, so the single way a fork holds one is a dev workspace
@@ -104,15 +109,106 @@
 		return `${base}/workspace_settings?workspace=${parent}&tab=dev_workspace`
 	})
 
-	// State for collapsible sections
-	let secondarySyncExpanded = $state(false)
-	let secondaryPromotionExpanded = $state(false)
-
-	// Check if any secondary repositories are unsaved
-	const hasUnsavedSecondary = $derived(secondarySync.some((s) => s.repo.isUnsavedConnection))
-	const hasUnsavedSecondaryPromotion = $derived(
-		secondaryPromotion.some((s) => s.repo.isUnsavedConnection)
+	const repositories = $derived(gitSyncContext?.repositories ?? [])
+	const rows = $derived(repositories.map((repo, idx) => ({ repo, idx })))
+	const syncRows = $derived(rows.filter((r) => !r.repo.use_individual_branch))
+	const promotionRows = $derived(rows.filter((r) => r.repo.use_individual_branch))
+	const hasUnsavedConnection = $derived(repositories.some((r) => r.isUnsavedConnection))
+	const usedResourcePaths = $derived(
+		repositories.map((r) => r.git_repo_resource_path).filter((p) => !!p?.trim())
 	)
+
+	/** The repository the delete confirmation is about, kept with its path so a list that
+	 *  shifted under it is caught rather than removing the wrong one. */
+	let deleting: { idx: number; path: string } | undefined = $state(undefined)
+	let deletingBusy = $state(false)
+
+	async function confirmDelete() {
+		if (!deleting || !gitSyncContext) return
+		const { idx, path } = deleting
+		if (gitSyncContext.repositories[idx]?.git_repo_resource_path !== path) {
+			deleting = undefined
+			return
+		}
+		deletingBusy = true
+		try {
+			await gitSyncContext.removeRepository(idx)
+			sendUserToast('Repository connection removed')
+			deleting = undefined
+		} catch (e) {
+			sendUserToast('Failed to remove the repository: ' + apiErrorMessage(e), true)
+		} finally {
+			deletingBusy = false
+		}
+	}
+
+	let setupMode = $state<'sync' | 'promotion'>('sync')
+	let setupOpen = $state(false)
+	// Fixed when the dialog opens: the dialog adds its own unsaved repository to the list.
+	let setupTitle = $state('')
+	function openSetup(mode: 'sync' | 'promotion') {
+		setupMode = mode
+		setupTitle =
+			mode === 'promotion'
+				? primaryPromotion
+					? 'Add a secondary promotion repository'
+					: 'Add a promotion repository'
+				: primarySync
+					? 'Add a secondary sync repository'
+					: repositories.length === 0
+						? 'Configure Git Sync'
+						: 'Add a sync repository'
+		setupOpen = true
+	}
+
+	// Keyed by resource path rather than index: deleting a repository shifts the
+	// indexes, and reloading the settings replaces the objects.
+	let settingsPath: string | undefined = $state(undefined)
+	const settingsIdx = $derived(
+		settingsPath === undefined
+			? -1
+			: repositories.findIndex((r) => r.git_repo_resource_path === settingsPath)
+	)
+	let settingsDrawer: Drawer | undefined = $state(undefined)
+	$effect(() => {
+		if (settingsPath !== undefined && settingsIdx === -1)
+			untrack(() => settingsDrawer?.closeDrawer())
+	})
+	function openSettings(path: string) {
+		settingsPath = path
+		settingsDrawer?.openDrawer()
+	}
+
+	function cardProps(idx: number) {
+		const repo = repositories[idx]
+		if (devSingleRepo) {
+			return {
+				variant: 'primary-sync' as const,
+				mode: repo?.use_individual_branch ? ('promotion' as const) : ('sync' as const),
+				devPromotion: !!$enterpriseLicense
+			}
+		}
+		if (idx === primarySync?.idx) return { variant: 'primary-sync' as const, mode: 'sync' as const }
+		if (idx === primaryPromotion?.idx)
+			return { variant: 'primary-promotion' as const, mode: 'promotion' as const }
+		return { variant: 'secondary' as const, isSecondary: true }
+	}
+
+	function rowLabel(idx: number): string {
+		const repo = repositories[idx]
+		const promotion = !!repo?.use_individual_branch
+		if (devSingleRepo) return promotion ? 'Git Promotion' : 'Git Sync'
+		const primary = idx === primarySync?.idx || idx === primaryPromotion?.idx
+		return `${primary ? 'Primary' : 'Secondary'} ${promotion ? 'promotion' : 'sync'} repository`
+	}
+
+	// Shown without EE too, disabled, so CE users see what the upgrade unlocks. Offered with
+	// no sync repository as well: a workspace that configured promotion first still has none.
+	const showAddSync = $derived(!devSingleRepo && !hasUnsavedConnection)
+	const addSyncLabel = $derived(
+		primarySync ? 'Add secondary sync repository' : 'Add sync repository'
+	)
+	const showAddPromotion = $derived(showPromotion && !devSingleRepo && !hasUnsavedConnection)
 </script>
 
 {#if !gitSyncContext}
@@ -132,7 +228,7 @@
 		{#snippet actions()}
 			{#if (gitSyncAllowed || gitSyncStatus.user_count != null) && gitSyncContext?.repositories != undefined}
 				<Button
-					variant="accent"
+					variant={repositories.length > 0 ? 'accent' : 'default'}
 					target="_blank"
 					endIcon={{ icon: ExternalLink }}
 					href={`/runs?job_kinds=deploymentcallbacks&workspace=${$workspaceStore}`}
@@ -166,161 +262,82 @@
 		<div class="mb-2"></div>
 	{/if}
 	{#if (gitSyncAllowed || gitSyncStatus.user_count != null) && gitSyncContext?.repositories != undefined}
-		<!-- Primary Sync Repository -->
-		<div class="space-y-6 pt-6">
-			<GitSyncRepositoryCard
-				variant="primary-sync"
-				mode={devSingleRepo && devPrimaryRepo?.repo?.use_individual_branch ? 'promotion' : 'sync'}
-				idx={(devSingleRepo ? devPrimaryRepo : primarySync)?.idx ?? null}
-				repository={(devSingleRepo ? devPrimaryRepo : primarySync)?.repo ?? null}
-				onAdd={() => gitSyncContext.addSyncRepository()}
-				isCollapsible={false}
-				showEmptyState={(devSingleRepo ? devPrimaryRepo : primarySync)?.repo == null}
-				devPromotion={devSingleRepo && !!$enterpriseLicense}
-			/>
+		<div class="pt-6">
+			{#if repositories.length === 0}
+				<div
+					class="flex flex-col items-center gap-3 text-center py-10 px-4 border rounded-md bg-surface-tertiary"
+				>
+					<GitBranch size={24} class="text-secondary" />
+					<div class="flex flex-col gap-1 items-center">
+						<span class="font-semibold text-sm text-emphasis">No repository connected</span>
+						<p class="text-xs text-secondary max-w-sm">
+							Commit every deploy of this workspace to a Git repository, and deploy new commits back
+							into it.
+						</p>
+					</div>
+					<!-- Sync only: promotion pushes wm_deploy/** branches to be merged into the branch
+					     another workspace syncs, so it is not where a workspace starts. -->
+					<Button unifiedSize="md" variant="accent" onClick={() => openSetup('sync')}>
+						Configure Git Sync
+					</Button>
+				</div>
+			{:else}
+				<div class="flex flex-col border rounded-md divide-y bg-surface-tertiary">
+					{#each syncRows as { repo, idx } (idx)}
+						{@render repoRow(repo, idx)}
+					{/each}
+					{#if promotionRows.length > 0}
+						<!-- The two kinds deploy differently, so the list says which is which rather than
+						     leaving it to each row's own line. -->
+						<div class="px-4 pt-3 pb-1 text-2xs font-semibold text-hint">Promotion repositories</div>
+						{#each promotionRows as { repo, idx } (idx)}
+							{@render repoRow(repo, idx)}
+						{/each}
+					{/if}
+				</div>
 
-			{#if $enterpriseLicense}
-				<!-- Secondary Sync Repositories (EE only; a dev workspace has a single inherited repo) -->
-				{#if primarySync && !primarySync.repo?.isUnsavedConnection && !devSingleRepo}
-					{#if secondarySync.length > 0 || secondarySyncExpanded}
-						<div class="mt-4">
-							<button
-								class="flex items-center gap-2 text-sm text-secondary hover:text-primary transition-colors"
-								onclick={() => (secondarySyncExpanded = !secondarySyncExpanded)}
-							>
-								{#if secondarySyncExpanded}
-									<ChevronDown size={16} />
-								{:else}
-									<ChevronRight size={16} />
-								{/if}
-								Secondary sync repositories ({secondarySync.length})
-							</button>
-
-							{#if secondarySyncExpanded}
-								<div class="mt-3 space-y-3">
-									{#if secondarySync.length === 0}
-										<div class="text-sm text-secondary italic">
-											No secondary sync repositories configured
-										</div>
-									{:else}
-										{#each secondarySync as { repo, idx } (repo.git_repo_resource_path)}
-											<div class="pl-4">
-												<GitSyncRepositoryCard variant="secondary" {idx} isSecondary={true} />
-											</div>
-										{/each}
-									{/if}
-
-									{#if !hasUnsavedSecondary}
-										<div class="pl-4">
-											<Button
-												size="xs"
-												variant="default"
-												startIcon={{ icon: Plus }}
-												onclick={() => gitSyncContext.addSyncRepository()}
-											>
-												Add secondary sync
-											</Button>
-										</div>
-									{/if}
-								</div>
-							{/if}
-						</div>
-					{:else}
-						<!-- Collapsed state when no secondary repos exist -->
-						{#if !hasUnsavedSecondary}
-							<div class="mt-2">
-								<button
-									class="text-xs text-primary hover:text-secondary transition-colors"
-									onclick={() => {
-										secondarySyncExpanded = true
-										gitSyncContext.addSyncRepository()
-									}}
+				{#if showAddSync || showAddPromotion}
+					<div class="flex gap-4 mt-3">
+						{#if showAddSync}
+							<div class="flex items-center gap-1">
+								<Button
+									unifiedSize="md"
+									variant="default"
+									startIcon={{ icon: Plus }}
+									disabled={!$enterpriseLicense}
+									onClick={() => openSetup('sync')}
 								>
-									+ Add secondary sync repository
-								</button>
+									{addSyncLabel}
+								</Button>
+								{#if !$enterpriseLicense}<EEOnly />{/if}
 							</div>
 						{/if}
-					{/if}
-				{/if}
-
-				<!-- Primary Promotion Repository (EE only; roots only — a dev promotes via the
-					toggle on its single inherited repo, not a separate promotion repo) -->
-				{#if showPromotion && !devSingleRepo}
-					<div class="mt-6">
-						<GitSyncRepositoryCard
-							variant="primary-promotion"
-							mode="promotion"
-							idx={primaryPromotion?.idx ?? null}
-							repository={primaryPromotion?.repo ?? null}
-							onAdd={() => gitSyncContext.addPromotionRepository()}
-							isCollapsible={false}
-							showEmptyState={primaryPromotion?.repo === null}
-						/>
-
-						<!-- Secondary Promotion Repositories -->
-						{#if primaryPromotion && !primaryPromotion.repo?.isUnsavedConnection}
-							{#if secondaryPromotion.length > 0 || secondaryPromotionExpanded}
-								<div class="mt-4">
-									<button
-										class="flex items-center gap-2 text-sm text-secondary hover:text-primary transition-colors"
-										onclick={() => (secondaryPromotionExpanded = !secondaryPromotionExpanded)}
-									>
-										{#if secondaryPromotionExpanded}
-											<ChevronDown size={16} />
-										{:else}
-											<ChevronRight size={16} />
-										{/if}
-										Secondary promotion repositories ({secondaryPromotion.length})
-									</button>
-
-									{#if secondaryPromotionExpanded}
-										<div class="mt-3 space-y-3">
-											{#if secondaryPromotion.length === 0}
-												<div class="text-sm text-secondary italic">
-													No secondary promotion repositories configured
-												</div>
-											{:else}
-												{#each secondaryPromotion as { repo, idx } (repo.git_repo_resource_path)}
-													<div class="pl-4">
-														<GitSyncRepositoryCard variant="secondary" {idx} isSecondary={true} />
-													</div>
-												{/each}
-											{/if}
-
-											{#if !hasUnsavedSecondaryPromotion}
-												<div class="pl-4">
-													<Button
-														size="xs"
-														variant="default"
-														startIcon={{ icon: Plus }}
-														onclick={() => gitSyncContext.addPromotionRepository()}
-													>
-														Add secondary promotion
-													</Button>
-												</div>
-											{/if}
-										</div>
-									{/if}
-								</div>
-							{:else}
-								<!-- Collapsed state when no secondary promotion repos exist -->
-								{#if !hasUnsavedSecondaryPromotion}
-									<div class="mt-2">
-										<button
-											class="text-xs text-primary hover:text-secondary transition-colors"
-											onclick={() => {
-												secondaryPromotionExpanded = true
-												gitSyncContext.addPromotionRepository()
-											}}
-										>
-											+ Add secondary promotion repository
-										</button>
-									</div>
-								{/if}
-							{/if}
+						{#if showAddPromotion}
+							<div class="flex items-center gap-1">
+								<Button
+									unifiedSize="md"
+									variant="default"
+									startIcon={{ icon: Plus }}
+									disabled={!$enterpriseLicense}
+									onClick={() => openSetup('promotion')}
+								>
+									Add promotion repository
+								</Button>
+								<Tooltip documentationLink="https://www.windmill.dev/docs/advanced/deploy_gh_gl">
+									Each deploy in this workspace pushes its changes to a dedicated
+									<span class="font-mono">wm_deploy/**</span>
+									branch of the repository instead of committing to its tracked branch directly. Merging
+									that branch promotes the change: the workspace that syncs the tracked branch deploys
+									it on merge, so set up Git Sync there. Windmill can open the pull request for each
+									deploy branch, or you can use the open-pr-on-commit workflow.
+								</Tooltip>
+								{#if !$enterpriseLicense}<EEOnly />{/if}
+							</div>
 						{/if}
 					</div>
-				{:else if !showPromotion}
+				{/if}
+
+				{#if $enterpriseLicense && !showPromotion}
 					<div class="mt-6">
 						<Alert
 							type="info"
@@ -348,7 +365,92 @@
 			{/if}
 		</div>
 
+		<ConfirmationModal
+			open={!!deleting}
+			title="Remove the repository connection"
+			confirmationText="Remove"
+			loading={deletingBusy}
+			onConfirmed={confirmDelete}
+			onCanceled={() => (deleting = undefined)}
+		>
+			<span class="text-sm">
+				Deploys of this workspace will stop being committed to
+				<span class="font-mono">{deleting?.path}</span>. The repository itself and its resource are
+				left untouched.
+			</span>
+		</ConfirmationModal>
+
+		<GitSyncSetupModal
+			bind:opened={setupOpen}
+			title={setupTitle}
+			mode={setupMode}
+			{usedResourcePaths}
+		/>
+
+		<Drawer
+			bind:this={settingsDrawer}
+			size="1000px"
+			on:afterClose={() => (settingsPath = undefined)}
+		>
+			<DrawerContent
+				title={settingsIdx !== -1 ? rowLabel(settingsIdx) : 'Repository settings'}
+				on:close={() => settingsDrawer?.closeDrawer()}
+			>
+				{#if settingsIdx !== -1}
+					{#key settingsIdx}
+						<GitSyncRepositoryCard
+							idx={settingsIdx}
+							isCollapsible={false}
+							{...cardProps(settingsIdx)}
+						/>
+					{/key}
+				{/if}
+			</DrawerContent>
+		</Drawer>
+
 		<!-- Modals -->
 		<GitSyncModalManager />
 	{/if}
 {/if}
+
+{#snippet repoRow(repo: GitSyncRepository, idx: number)}
+	{@const validation = gitSyncContext?.getValidation(idx)}
+	<div class="flex items-center justify-between gap-4 px-4 py-3">
+		<div class="flex flex-col gap-0.5 min-w-0">
+			<div class="flex items-center gap-2 min-w-0">
+				<span class="text-xs font-medium text-emphasis truncate">
+					{repo.git_repo_resource_path || 'No resource selected'}
+				</span>
+				{#if repo.isUnsavedConnection}
+					<Badge small color="yellow">Not saved</Badge>
+				{:else if validation?.hasChanges}
+					<Badge small color="yellow">Unsaved changes</Badge>
+				{/if}
+				{#if repo.legacyImported}
+					<Badge small color="orange">Legacy configuration</Badge>
+				{/if}
+			</div>
+			<span class="text-2xs text-secondary">{rowLabel(idx)}</span>
+		</div>
+		<div class="flex items-center gap-1">
+			<Button
+				unifiedSize="md"
+				variant="default"
+				startIcon={{ icon: Settings }}
+				onClick={() => openSettings(repo.git_repo_resource_path)}
+			>
+				Settings
+			</Button>
+			<DropdownV2
+				items={[
+					{
+						displayName: 'Delete',
+						icon: Trash,
+						type: 'delete',
+						action: () => (deleting = { idx, path: repo.git_repo_resource_path })
+					}
+				]}
+			/>
+		</div>
+	</div>
+{/snippet}
diff --git a/frontend/src/lib/components/git_sync/GitSyncSetupModal.svelte b/frontend/src/lib/components/git_sync/GitSyncSetupModal.svelte
new file mode 100644
index 0000000000..c89ed45d76
--- /dev/null
+++ b/frontend/src/lib/components/git_sync/GitSyncSetupModal.svelte
@@ -0,0 +1,600 @@
+<script lang="ts">
+	import type { Snippet } from 'svelte'
+	import { untrack } from 'svelte'
+	import { ArrowRight, Database } from 'lucide-svelte'
+	import Button from '../common/button/Button.svelte'
+	import Alert from '../common/alert/Alert.svelte'
+	import Modal2 from '../common/modal/Modal2.svelte'
+	import Stepper from '../common/stepper/Stepper.svelte'
+	import ResourcePicker from '../ResourcePicker.svelte'
+	import Path from '../Path.svelte'
+	import TextInput from '../text_input/TextInput.svelte'
+	import EEOnly from '../EEOnly.svelte'
+	import RadioCard from '../common/radioCard/RadioCard.svelte'
+	import GithubIcon from '../icons/GithubIcon.svelte'
+	import GitlabIcon from '../icons/GitlabIcon.svelte'
+	import GitlabProjectConnectForm from './setup/GitlabProjectConnectForm.svelte'
+	import GithubAppConnectForm from './setup/GithubAppConnectForm.svelte'
+	import TokenUrlConnectForm from './setup/TokenUrlConnectForm.svelte'
+	import { createRepositoryResource, repoSlug, type RepoConnection } from './setup/repoConnection'
+	import { GithubAppSetup } from './setup/githubAppSetup.svelte'
+	import { onDestroy } from 'svelte'
+	import { getGitSyncContext } from './GitSyncContext.svelte'
+	import ConfigureSyncStep from './setup/ConfigureSyncStep.svelte'
+	import GitPushPreview from './GitPushPreview.svelte'
+	import GitSyncSuccessContent from './GitSyncSuccessContent.svelte'
+	import { ResourceService } from '$lib/gen'
+	import { enterpriseLicense, workspaceStore } from '$lib/stores'
+	import { apiErrorMessage } from '$lib/utils'
+
+	type Provider = 'gitlab' | 'github_app' | 'github_pat' | 'existing'
+
+	type Props = {
+		opened: boolean
+		title: string
+		mode: 'sync' | 'promotion'
+		/** Resources already attached to a repository of this workspace, which cannot be picked twice. */
+		usedResourcePaths: string[]
+	}
+
+	let { opened = $bindable(), title, mode, usedResourcePaths }: Props = $props()
+
+	const ctx = getGitSyncContext()
+
+	const STEPS = [
+		'Choose a provider',
+		'Connect the repository',
+		'Configure sync',
+		'Initialize the repository',
+		'Done'
+	]
+
+	let step: 1 | 2 | 3 | 4 | 5 = $state(1)
+	/** What the last step reports, set by the save that got there. */
+	let done: { savedWithoutInit: boolean; autoPullOn: boolean; webhookError?: string } | undefined =
+		$state(undefined)
+
+	/** Resource path of the unsaved repository step 3 configures. By path rather than
+	 * index, as the context's list can shift under it. */
+	let draftPath: string | undefined = $state(undefined)
+	const draftIdx = $derived(
+		draftPath === undefined
+			? -1
+			: ctx.repositories.findIndex((r) => r.git_repo_resource_path === draftPath)
+	)
+	const draft = $derived(draftIdx === -1 ? undefined : ctx.repositories[draftIdx])
+	let push: GitPushPreview | undefined = $state()
+	/** Each trip to step 3 is its own attempt, and readiness names the one it belongs to: a
+	 * step destroyed mid-load still reports when its request lands, and that answer is about
+	 * the attempt it was opened for — which may be for the same repository as the current one. */
+	let configureAttempt = $state(0)
+	let factsLoadedFor: number | undefined = $state(undefined)
+	const factsLoaded = $derived(factsLoadedFor === configureAttempt)
+	let saving = $state(false)
+	let saveError: string | undefined = $state(undefined)
+	let provider: Provider | undefined = $state(undefined)
+	let existingPath: string | undefined = $state(undefined)
+	/** The workspace has a git_repository resource no repository uses yet, so picking one is
+	 *  offered up front rather than behind the hint. */
+	let hasResource = $state(false)
+
+	let connection: RepoConnection | undefined = $state(undefined)
+	/** Path of the resource the run creates. `Path` keeps whatever non-empty path it is bound
+	 * to, so it has to be cleared when the repository changes — otherwise the second
+	 * repository is offered the first one's path, which is already taken. */
+	let newPath = $state('')
+	let newPathError = $state('')
+	let branch = $state('')
+	let folder = $state('')
+	let connecting = $state(false)
+	let connectError: string | undefined = $state(undefined)
+	let githubApp: GithubAppSetup | undefined = $state(undefined)
+
+	/** A push started from step 4. Owned here rather than read off `GitPushPreview`: closing
+	 *  the dialog destroys that component in the same flush as the dismissal, so its state is
+	 *  already gone by the time the dismissal is handled. */
+	let applying = $state(false)
+	/** Work in flight that a dismissal must not cut short. */
+	const busy = $derived(connecting || saving || applying)
+	/** The push of step 4 landed. What is left is saving the connection, so a failure there
+	 * must not be offered as "save without initializing" — the repository already holds the
+	 * workspace's content. */
+	let initialized = $state(false)
+
+	onDestroy(() => {
+		githubApp?.dispose()
+		discardDraft()
+	})
+	$effect(() => {
+		if (!opened)
+			untrack(() => {
+				githubApp?.dispose()
+				discardDraft()
+			})
+	})
+
+	/** Drops the unsaved repository, keeping the resource, which stays pickable.
+	 *
+	 * A push that is still running is left alone: it may yet initialize the repository, and
+	 * the row it leaves behind is how the user finishes saving the connection. */
+	function discardDraft() {
+		if (busy) {
+			draftPath = undefined
+			return
+		}
+		if (draftIdx !== -1 && ctx.repositories[draftIdx]?.isUnsavedConnection) {
+			void ctx.removeRepository(draftIdx)
+		}
+		draftPath = undefined
+	}
+
+	/** Ignores a report from any attempt but the one on screen. */
+	function noteFacts(attempt: number, loaded: boolean) {
+		if (attempt !== configureAttempt) return
+		factsLoadedFor = loaded ? attempt : undefined
+	}
+
+	function enterConfigure(path: string) {
+		discardDraft()
+		configureAttempt += 1
+		factsLoadedFor = undefined
+		// Whatever was pushed belonged to the draft just discarded, not to this one.
+		initialized = false
+		const before = ctx.repositories.length
+		if (mode === 'promotion') ctx.addPromotionRepository()
+		else ctx.addSyncRepository()
+		// Refused (CE is limited to one repository): the context toasted why.
+		if (ctx.repositories.length === before) return
+		ctx.repositories[before].git_repo_resource_path = path
+		draftPath = path
+		saveError = undefined
+		step = 3
+	}
+
+	/** From step 3 the resource already exists, so going back offers it as the
+	 * existing resource to use rather than reconnecting from scratch. */
+	function back() {
+		if (busy) return
+		if (step === 4) {
+			step = 3
+			return
+		}
+		if (step === 3 && draftPath) {
+			const path = draftPath
+			discardDraft()
+			provider = 'existing'
+			existingPath = path
+		}
+		step = 1
+	}
+
+	async function saveDraft(withoutInit = false) {
+		if (draftIdx === -1) return
+		saving = true
+		saveError = undefined
+		try {
+			// The last step says what the success modal would have, so it stays quiet.
+			await ctx.saveRepository(draftIdx, withoutInit, false)
+			done = {
+				savedWithoutInit: withoutInit,
+				autoPullOn: draft?.auto_pull?.enabled === true,
+				// Read back by the save: the webhook is registered after the settings commit and
+				// a failure only leaves polling on.
+				webhookError: draft?.auto_pull?.webhook_error
+			}
+			step = 5
+		} catch (e) {
+			saveError = apiErrorMessage(e)
+		} finally {
+			saving = false
+		}
+	}
+
+	async function reset() {
+		step = 1
+		done = undefined
+		applying = false
+		initialized = false
+		githubApp?.dispose()
+		githubApp = undefined
+		hasResource = false
+		provider = undefined
+		existingPath = undefined
+		connection = undefined
+		newPath = ''
+		newPathError = ''
+		namedFor = undefined
+		branch = ''
+		folder = ''
+		connectError = undefined
+		const workspace = $workspaceStore
+		if (!workspace) return
+		try {
+			const resources = await ResourceService.listResource({
+				workspace,
+				resourceType: 'git_repository'
+			})
+			const firstUnused = resources.find((r) => !usedResourcePaths.includes(r.path))
+			hasResource = !!firstUnused
+			if (provider === undefined && firstUnused) {
+				provider = 'existing'
+				existingPath = firstUnused.path
+			}
+		} catch (e) {
+			console.error('Failed to list git_repository resources', e)
+		}
+	}
+
+	$effect(() => {
+		if (opened) untrack(() => reset())
+	})
+
+	// Cast: the only writes to `connection` are the `bind:` on the provider forms, which the
+	// checker does not see as assignments — it narrows the variable to `undefined` without it.
+	const repoName = $derived.by(() => {
+		const url = (connection as RepoConnection | undefined)?.url
+		return url ? repoSlug(url) : undefined
+	})
+	let namedFor: string | undefined = $state(undefined)
+	$effect(() => {
+		const name = repoName
+		untrack(() => {
+			if (name === namedFor) return
+			namedFor = name
+			newPath = ''
+			newPathError = ''
+		})
+	})
+
+	// GitLab without EE has no server-side token store nor project listing, so it
+	// takes the same URL + token form as a GitHub PAT.
+	const gitlabHeld = $derived(provider === 'gitlab' && !!$enterpriseLicense)
+
+	const canContinue = $derived(
+		step === 1
+			? provider === 'existing'
+				? !!existingPath
+				: provider !== undefined
+			: step === 2
+				? !!connection && !!newPath && !newPathError && !connecting
+				: (draft?.detectionState === 'no-wmill' || draft?.detectionState === 'has-wmill') &&
+					factsLoaded &&
+					!saving
+	)
+
+	// Steps this run skips: connecting, when an existing resource is used, and initializing,
+	// when the repository already holds a Windmill configuration.
+	const disabledIndices = $derived([
+		...(provider === 'existing' ? [1] : []),
+		...(draft?.detectionState === 'has-wmill' ? [3] : [])
+	])
+
+	function selectProvider(p: Provider) {
+		if (p !== provider) connection = undefined
+		provider = p
+		if (p === 'github_app' && !githubApp && $workspaceStore) {
+			githubApp = new GithubAppSetup($workspaceStore)
+			void githubApp.reload()
+		}
+	}
+
+	async function next() {
+		if (step === 1) {
+			if (provider === 'existing') {
+				if (existingPath) enterConfigure(existingPath)
+			} else {
+				connectError = undefined
+				step = 2
+				// Nothing to pick from yet: go straight to installing. Only while this click
+				// is still being handled, or the browser blocks the tab.
+				if (provider === 'github_app' && githubApp?.loaded && githubApp.usable.length === 0) {
+					githubApp.openInstall()
+				}
+			}
+			return
+		}
+		const workspace = $workspaceStore
+		if (!connection || !workspace) return
+		connecting = true
+		connectError = undefined
+		// Read once: the fields stay editable while the request is in flight, and reading the
+		// path again afterwards would configure a repository this run never created.
+		const submitted = { path: newPath, connection, branch, folder }
+		try {
+			await createRepositoryResource(workspace, submitted.path, submitted.connection, {
+				branch: submitted.branch,
+				folder: submitted.folder
+			})
+			enterConfigure(submitted.path)
+		} catch (e) {
+			connectError = apiErrorMessage(e)
+		} finally {
+			connecting = false
+		}
+	}
+</script>
+
+<Modal2
+	bind:isOpen={opened}
+	target="#content"
+	formStyling
+	preventDismiss={busy}
+	{title}
+	contentClasses="flex flex-col"
+	fixedWidth="md"
+	fixedHeight="lg"
+>
+	<div class="flex h-full flex-col gap-4">
+		<Stepper
+			tabs={STEPS}
+			selectedIndex={step - 1}
+			maxReachedIndex={step - 1}
+			{disabledIndices}
+			small
+			on:click={(e) => {
+				if (e.detail.index === 0 && step > 1) back()
+			}}
+		/>
+
+		<div class="flex-1 flex flex-col min-h-0">
+			<div class="flex-1 overflow-y-auto flex flex-col gap-2">
+				{#if step === 1}
+					{#snippet githubIcon()}
+						<GithubIcon height={18} width={18} />
+					{/snippet}
+					{#snippet gitlabIcon()}
+						<GitlabIcon height={18} width={18} />
+					{/snippet}
+					{#snippet resourceIcon()}
+						<Database size={18} class="text-secondary" />
+					{/snippet}
+					<div
+						role="radiogroup"
+						aria-label="How to connect the repository"
+						class="flex flex-col gap-2"
+					>
+						{@render providerCard(
+							'github_app',
+							githubIcon,
+							'GitHub App (recommended)',
+							'Connect with the GitHub UI.',
+							!$enterpriseLicense
+						)}
+						{@render providerCard(
+							'github_pat',
+							githubIcon,
+							'GitHub personal access token',
+							'Generate a token from GitHub to allow Windmill to access your account.'
+						)}
+						{@render providerCard(
+							'gitlab',
+							gitlabIcon,
+							'GitLab',
+							'Generate a token from GitLab to allow Windmill to access your account.'
+						)}
+						{#if hasResource || provider === 'existing'}
+							{@render providerCard(
+								'existing',
+								resourceIcon,
+								'Use an existing git_repository resource',
+								'Pick a resource that already holds the repository URL and its credentials.'
+							)}
+						{/if}
+					</div>
+					{#if provider === 'existing'}
+						<ResourcePicker
+							bind:value={existingPath}
+							resourceType="git_repository"
+							excludedValues={usedResourcePaths}
+						/>
+					{/if}
+				{:else if step === 5}
+					{#if done}
+						<GitSyncSuccessContent
+							savedWithoutInit={done.savedWithoutInit}
+							autoPullOn={done.autoPullOn}
+							webhookError={done.webhookError}
+						/>
+					{/if}
+				{:else if step === 4}
+					{#if draft}
+						<GitPushPreview
+							bind:this={push}
+							gitRepoResourcePath={draft.git_repo_resource_path}
+							uiState={draft.settings}
+							onApplyStateChange={(v) => (applying = v)}
+							onSuccess={() => {
+								initialized = true
+								void saveDraft()
+							}}
+						/>
+					{/if}
+					{#if saveError}
+						<Alert type="error" size="xs" title="Could not save the repository">
+							{saveError}
+						</Alert>
+					{/if}
+				{:else if step === 3}
+					{#if draftIdx !== -1}
+						<!-- One step per attempt, so a repository configured again starts from scratch
+						     rather than reusing the instance that is still loading. -->
+						{#key configureAttempt}
+							<ConfigureSyncStep
+								idx={draftIdx}
+								{mode}
+								attempt={configureAttempt}
+								onFactsChange={noteFacts}
+							/>
+						{/key}
+					{/if}
+					{#if saveError}
+						<Alert type="error" size="xs" title="Could not save the repository">
+							{saveError}
+						</Alert>
+					{/if}
+				{:else if $workspaceStore}
+					<div class="flex flex-col gap-6">
+						{#if provider === 'github_app' && githubApp}
+							<GithubAppConnectForm workspace={$workspaceStore} setup={githubApp} bind:connection />
+						{:else if gitlabHeld}
+							<GitlabProjectConnectForm workspace={$workspaceStore} bind:connection />
+						{:else if provider === 'gitlab'}
+							<TokenUrlConnectForm provider="gitlab" bind:connection />
+						{:else}
+							<TokenUrlConnectForm provider="github" bind:connection />
+						{/if}
+
+						{#if connection}
+							<div class="flex flex-col gap-4 border-t pt-4">
+								<label class="flex flex-col gap-1">
+									<span class="text-xs font-semibold text-emphasis">Branch</span>
+									<span class="text-xs text-secondary">
+										The branch deploys are committed to. Leave empty for the repository's default
+										branch.
+									</span>
+									<TextInput bind:value={branch} inputProps={{ placeholder: 'Default branch' }} />
+								</label>
+								<label class="flex flex-col gap-1">
+									<span class="text-xs font-semibold text-emphasis">Folder</span>
+									<span class="text-xs text-secondary">
+										Where in the repository the workspace is kept, relative to its root. Leave empty
+										for the root. The folder must already exist in the repository.
+									</span>
+									<TextInput bind:value={folder} inputProps={{ placeholder: 'Repository root' }} />
+								</label>
+								<div class="flex flex-col gap-1">
+									<span class="text-xs font-semibold text-emphasis">Save as resource</span>
+									<span class="text-xs text-secondary">
+										Windmill keeps the repository and its access as a <code>git_repository</code> resource
+										at this path.
+									</span>
+									{#key connection.url}
+										<Path
+											kind="resource"
+											initialPath=""
+											fullNamePlaceholder={repoSlug(connection.url)}
+											autofocus={false}
+											bind:path={newPath}
+											bind:error={newPathError}
+										/>
+									{/key}
+								</div>
+							</div>
+						{/if}
+
+						{#if connectError}
+							<Alert type="error" size="xs" title="Could not connect the repository">
+								{connectError}
+							</Alert>
+						{/if}
+					</div>
+				{/if}
+			</div>
+
+			<div class="flex justify-between items-center pt-3">
+				<div>
+					{#if step > 1 && step < 5}
+						<Button unifiedSize="sm" variant="default" disabled={busy} onClick={back}>Back</Button>
+					{:else if step === 1 && !hasResource && provider !== 'existing'}
+						<Button variant="subtle" unifiedSize="sm" onClick={() => selectProvider('existing')}>
+							Use an existing resource instead
+						</Button>
+					{/if}
+				</div>
+				{#if step === 5}
+					<Button unifiedSize="sm" variant="accent" onClick={() => (opened = false)}>Close</Button>
+				{:else if step === 4}
+					<div class="flex items-center gap-2">
+						{#if initialized}
+							<Button
+								unifiedSize="sm"
+								variant="accent"
+								disabled={saving}
+								loading={saving}
+								onClick={() => saveDraft()}
+							>
+								Retry saving the connection
+							</Button>
+						{:else}
+							<Button
+								unifiedSize="sm"
+								variant="default"
+								disabled={push?.status().applying || push?.status().previewing || saving}
+								loading={saving}
+								onClick={() => saveDraft(true)}
+							>
+								Save without initializing
+							</Button>
+							<Button
+								unifiedSize="sm"
+								variant="accent"
+								disabled={!push?.status().canApply || saving}
+								loading={push?.status().applying}
+								onClick={() => push?.apply()}
+							>
+								Initialize repository
+							</Button>
+						{/if}
+					</div>
+				{:else if step === 3}
+					{#if draft?.detectionState === 'no-wmill'}
+						<Button
+							unifiedSize="sm"
+							variant="accent"
+							disabled={!canContinue}
+							endIcon={{ icon: ArrowRight }}
+							onClick={() => (step = 4)}
+						>
+							Next
+						</Button>
+					{:else}
+						<Button
+							unifiedSize="sm"
+							variant="accent"
+							disabled={!canContinue}
+							loading={saving}
+							onClick={() => void saveDraft()}
+						>
+							Save and connect
+						</Button>
+					{/if}
+				{:else}
+					<Button
+						unifiedSize="sm"
+						variant="accent"
+						disabled={!canContinue}
+						loading={connecting}
+						endIcon={connecting ? undefined : { icon: ArrowRight }}
+						onClick={next}
+					>
+						{step === 2 ? 'Connect' : 'Next'}
+					</Button>
+				{/if}
+			</div>
+		</div>
+	</div>
+</Modal2>
+
+{#snippet providerCard(
+	key: Provider,
+	icon: Snippet,
+	title: string,
+	subtitle: string,
+	eeOnly: boolean = false
+)}
+	{#snippet description()}
+		<span class="flex items-center gap-2">
+			<span>{subtitle}</span>
+			{#if eeOnly}<EEOnly />{/if}
+		</span>
+	{/snippet}
+	<RadioCard
+		label={title}
+		{description}
+		selected={provider === key}
+		disabled={eeOnly}
+		{icon}
+		showRadio={false}
+		onSelect={() => selectProvider(key)}
+	/>
+{/snippet}
diff --git a/frontend/src/lib/components/git_sync/GitSyncSuccessContent.svelte b/frontend/src/lib/components/git_sync/GitSyncSuccessContent.svelte
new file mode 100644
index 0000000000..047f55ef41
--- /dev/null
+++ b/frontend/src/lib/components/git_sync/GitSyncSuccessContent.svelte
@@ -0,0 +1,72 @@
+<!--
+@component
+What the user is told once a git sync connection is saved: shown as the last step of the
+setup dialog, and in the standalone modal for a connection saved outside it.
+-->
+<script lang="ts">
+	import { Alert } from '$lib/components/common'
+	import { CheckCircle2 } from 'lucide-svelte'
+
+	interface Props {
+		savedWithoutInit?: boolean
+		autoPullOn?: boolean
+		/** Whether to say what pulling off means. The setup dialog says it where it offers the
+		 * toggle, so only the standalone modal — whose save came from a card that says it
+		 * nowhere — needs it here. */
+		explainAutoPullOff?: boolean
+		/** Set when pulling is on but its webhook could not be registered. */
+		webhookError?: string
+	}
+
+	let {
+		savedWithoutInit = false,
+		autoPullOn = false,
+		explainAutoPullOff = false,
+		webhookError = undefined
+	}: Props = $props()
+</script>
+
+<!-- The notices belong at the top, where the steps before them put their own; what the dialog
+     ends on is centered in what is left. -->
+<div class="flex flex-col gap-4 h-full">
+	{#if savedWithoutInit}
+		<Alert type="info" title="Repository saved without initialization">
+			Only new changes will be pushed to this repository. What this workspace holds today has not
+			been pushed to it.
+		</Alert>
+	{/if}
+
+	{#if autoPullOn && webhookError}
+		<Alert type="warning" title="Pull from Git is on, but falling back to polling">
+			{webhookError}
+		</Alert>
+	{:else if autoPullOn}
+		<Alert type="success" title="Pull from Git is on">
+			New commits to the tracked branch deploy into this workspace automatically. You can adjust
+			this anytime on the repository's settings.
+		</Alert>
+	{:else if explainAutoPullOff}
+		<Alert
+			type="warning"
+			title="Deploy changes from Git back to Windmill"
+			documentationLink="https://www.windmill.dev/docs/advanced/deploy_gh_gl#github-actions-setup"
+		>
+			Turn on "Automatically deploy changes from Git" on the repository to have Windmill pull new
+			commits into this workspace for you. Prefer to control deployment from your own pipeline
+			(tests, custom gating, deploy on PR merge)? Set up GitHub Actions or a similar CI/CD workflow
+			instead.
+		</Alert>
+	{/if}
+
+	<!-- `pb`: centered in what the notices leave, it would otherwise read as sitting low on the
+	     step rather than in the middle of it. -->
+	<div class="flex-1 min-h-24 pb-16 flex flex-col items-center justify-center gap-2 text-center">
+		<CheckCircle2 class="h-8 w-8 text-green-600" />
+		<div class="flex flex-col gap-1">
+			<h3 class="text-lg font-semibold text-primary">Git sync connection saved successfully!</h3>
+			<p class="text-sm text-secondary">
+				Your repository is now configured to receive changes from Windmill.
+			</p>
+		</div>
+	</div>
+</div>
diff --git a/frontend/src/lib/components/git_sync/GitSyncSuccessModal.svelte b/frontend/src/lib/components/git_sync/GitSyncSuccessModal.svelte
index 32dc68a0f4..00ffa285b2 100644
--- a/frontend/src/lib/components/git_sync/GitSyncSuccessModal.svelte
+++ b/frontend/src/lib/components/git_sync/GitSyncSuccessModal.svelte
@@ -1,81 +1,24 @@
 <script lang="ts">
 	import Modal from '$lib/components/common/modal/Modal.svelte'
-	import { CheckCircle2, ExternalLink, ArrowRight } from 'lucide-svelte'
+	import GitSyncSuccessContent from './GitSyncSuccessContent.svelte'
 
 	interface Props {
 		open: boolean
 		savedWithoutInit?: boolean
 		autoPullOn?: boolean
+		explainAutoPullOff?: boolean
+		webhookError?: string
 	}
 
-	let { open = $bindable(false), savedWithoutInit = false, autoPullOn = false }: Props = $props()
+	let {
+		open = $bindable(false),
+		savedWithoutInit = false,
+		autoPullOn = false,
+		explainAutoPullOff = false,
+		webhookError = undefined
+	}: Props = $props()
 </script>
 
 <Modal bind:open title="Git Sync Connection Saved" class="sm:max-w-4xl" cancelText="Close">
-	<div class="flex flex-col gap-6 p-6">
-		<!-- Success header -->
-		<div class="flex items-center gap-3">
-			<div class="flex-shrink-0">
-				<CheckCircle2 class="h-8 w-8 text-green-600" />
-			</div>
-			<div>
-				<h3 class="text-lg font-semibold text-primary">Git sync connection saved successfully!</h3>
-				<p class="text-sm text-secondary mt-1"
-					>Your repository is now configured to receive changes from Windmill.</p
-				>
-			</div>
-		</div>
-
-		<!-- Info box for saved without init -->
-		{#if savedWithoutInit}
-			<div class="bg-blue-50 border border-blue-200 rounded-lg p-4">
-				<h4 class="font-medium text-blue-900 mb-2">Repository saved without initialization</h4>
-				<p class="text-sm text-blue-800">
-					Only new changes will be pushed to this repository. Existing content in Windmill has not
-					been initialized to the repository.
-				</p>
-			</div>
-		{/if}
-
-		<!-- Optional setup section -->
-		{#if autoPullOn}
-			<div class="bg-green-50 border border-green-200 rounded-lg p-4">
-				<h4 class="font-medium text-green-900 mb-2 flex items-center gap-2">
-					<ArrowRight class="h-4 w-4" />
-					Pull from Git is on
-				</h4>
-				<p class="text-sm text-green-800">
-					New commits to the tracked branch deploy into this workspace automatically. You can
-					adjust this anytime on the repository card.
-				</p>
-			</div>
-		{:else}
-			<div class="bg-amber-50 border border-amber-200 rounded-lg p-4">
-				<h4 class="font-medium text-amber-900 mb-2 flex items-center gap-2">
-					<ArrowRight class="h-4 w-4" />
-					Deploy changes from Git back to Windmill
-				</h4>
-				<p class="text-sm text-amber-800 mb-3">
-					Turn on "Automatically deploy changes from Git" on the repository to have Windmill pull
-					new commits into this workspace for you.
-				</p>
-			<div class="flex flex-col gap-2">
-				<p class="text-sm text-amber-700">
-					Prefer to control deployment from your own pipeline (tests, custom gating, deploy on PR
-					merge)? Set up GitHub Actions or similar CI/CD workflows instead.
-				</p>
-				<div class="mt-3">
-					<a
-						href="https://www.windmill.dev/docs/advanced/deploy_gh_gl#github-actions-setup"
-						target="_blank"
-						class="text-sm text-amber-700 hover:text-amber-900 underline flex items-center gap-1"
-					>
-						<ExternalLink class="h-3 w-3" />
-						Learn more about CI-based deployment
-					</a>
-					</div>
-				</div>
-			</div>
-		{/if}
-	</div>
+	<GitSyncSuccessContent {savedWithoutInit} {autoPullOn} {explainAutoPullOff} {webhookError} />
 </Modal>
diff --git a/frontend/src/lib/components/git_sync/PushWorkspaceModal.svelte b/frontend/src/lib/components/git_sync/PushWorkspaceModal.svelte
index 87c6ecb807..dea331bea5 100644
--- a/frontend/src/lib/components/git_sync/PushWorkspaceModal.svelte
+++ b/frontend/src/lib/components/git_sync/PushWorkspaceModal.svelte
@@ -1,13 +1,9 @@
 <script lang="ts">
 	import Modal from '$lib/components/common/modal/Modal.svelte'
-	import { Button, Alert } from '$lib/components/common'
-	import { Loader2, CheckCircle2, XCircle, Terminal, ChevronDown, ChevronUp } from 'lucide-svelte'
-	import GitDiffPreview from '../GitDiffPreview.svelte'
-	import { JobService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
-	import hubPaths from '$lib/hubPaths.json'
-	import { jobManager } from '$lib/services/JobManager'
-	import type { SyncResponse, SettingsObject } from '$lib/git-sync'
+	import { Button } from '$lib/components/common'
+	import { Loader2 } from 'lucide-svelte'
+	import GitPushPreview from './GitPushPreview.svelte'
+	import type { SettingsObject } from '$lib/git-sync'
 
 	interface Props {
 		open: boolean
@@ -27,317 +23,63 @@
 		onSaveWithoutInit
 	}: Props = $props()
 
-	// Job state
-	let previewJobId = $state<string | null>(null)
-	let previewJobStatus = $state<'running' | 'success' | 'failure' | undefined>(undefined)
-	let isPreviewLoading = $state(false)
-	let previewError = $state('')
-
-	let applyJobId = $state<string | null>(null)
-	let applyJobStatus = $state<'running' | 'success' | 'failure' | undefined>(undefined)
-	let isApplying = $state(false)
-	let applyError = $state('')
-
-	// UI state
-	let showCliInstructions = $state(false)
-	let previewResult = $state<SyncResponse | null>(null)
-
-	// Note: Escape key is handled by the Modal component itself
-
-	// Reset state when modal opens/closes
-	$effect(() => {
-		if (!open) {
-			previewJobId = null
-			previewJobStatus = undefined
-			isPreviewLoading = false
-			previewError = ''
-			applyJobId = null
-			applyJobStatus = undefined
-			isApplying = false
-			applyError = ''
-			showCliInstructions = false
-			previewResult = null
-		}
-	})
-
-	// Execute job with dry run or actual execution
-	async function executeJob(isDryRun: boolean) {
-		const isPreview = isDryRun
-
-		if (isPreview) {
-			isPreviewLoading = true
-			previewError = ''
-			previewResult = null
-			previewJobId = null
-			previewJobStatus = undefined
-		} else {
-			isApplying = true
-			applyError = ''
-			applyJobId = null
-			applyJobStatus = undefined
-		}
-
-		try {
-			const workspace = $workspaceStore
-			if (!workspace) return
-
-			const payload = {
-				workspace_id: workspace,
-				repo_url_resource_path: gitRepoResourcePath,
-				dry_run: isDryRun,
-				pull: false,
-				settings_json: JSON.stringify(uiState)
-			}
-
-			const jobId = await JobService.runScriptByPath({
-				workspace,
-				path: hubPaths.gitInitRepo,
-				requestBody: payload,
-				skipPreprocessor: true
-			})
-
-			if (isPreview) {
-				previewJobId = jobId
-				previewJobStatus = 'running'
-			} else {
-				applyJobId = jobId
-				applyJobStatus = 'running'
-			}
-
-			// Use JobManager instead of tryEvery
-			const result = await jobManager.runWithProgress(() => Promise.resolve(jobId), {
-				workspace,
-				timeout: 60000,
-				timeoutMessage: `${isPreview ? 'Preview' : 'Apply'} job timed out after 60s`,
-				onProgress: (status) => {
-					if (isPreview) {
-						previewJobStatus = status.status
-					} else {
-						applyJobStatus = status.status
-					}
-
-					// Handle failure status
-					if (status.status === 'failure') {
-						if (isPreview) {
-							previewError = status.error || 'Preview failed'
-						} else {
-							applyError = status.error || 'Push failed'
-						}
-					}
-				}
-			})
-
-			// Handle successful result
-			if (isPreview) {
-				if (previewJobStatus === 'success') {
-					previewResult = result as SyncResponse
-				}
-			} else {
-				if (applyJobStatus === 'success') {
-					onSuccess?.()
-				}
-			}
-		} catch (e) {
-			const errorMsg = e?.message || 'Operation failed'
-			if (isPreview) {
-				previewJobStatus = 'failure'
-				previewError = errorMsg
-			} else {
-				applyJobStatus = 'failure'
-				applyError = errorMsg
-			}
-		} finally {
-			if (isPreview) {
-				isPreviewLoading = false
-			} else {
-				isApplying = false
-			}
-		}
-	}
+	let push: GitPushPreview | undefined = $state()
+	const status = $derived(push?.status() ?? { previewing: true, applying: false, canApply: false })
 </script>
 
 <Modal bind:open title="Push Workspace to Git Repository" class="sm:max-w-4xl">
-	<div class="flex flex-col gap-4">
-		<!-- Description -->
-		<p class="text-sm text-secondary"
-			>Push your current workspace content to the connected Git repository based on the configured
-			filters.</p
-		>
-		<p class="text-sm text-primary"
-			>Note: This will not update git sync settings in wmill.yaml. Settings can only be pulled from
-			the repository as it is the source of truth.</p
-		>
-
-		<!-- Settings display for new connections -->
-		{#if isNewConnection}
-			<div class="bg-surface-secondary border border-border rounded-lg p-3">
-				<h4 class="text-sm font-medium text-primary mb-2"
-					>Settings that will be pushed to repository</h4
-				>
-				<div class="text-xs text-secondary space-y-1">
-					<div><strong>Include paths:</strong> {uiState.include_path?.join(', ') || 'None'}</div>
-					<div><strong>Exclude paths:</strong> {uiState.exclude_path?.join(', ') || 'None'}</div>
-					{#if uiState.extra_include_path?.length > 0}
-						<div><strong>Extra include paths:</strong> {uiState.extra_include_path.join(', ')}</div>
-					{/if}
-					<div><strong>Include types:</strong> {uiState.include_type?.join(', ') || 'None'}</div>
-				</div>
-				<p class="text-xs text-primary mt-2"
-					>To modify these settings, cancel and configure them in the workspace settings.</p
-				>
-			</div>
+	<!-- The setup dialog shows the filters on its own step; opened on its own, this is the only
+	     place that says what the filters let through. -->
+	<div class="flex flex-col gap-1 text-xs text-secondary mb-4">
+		<div><span class="font-semibold text-emphasis">Include paths:</span> {uiState.include_path?.join(', ') || 'None'}</div>
+		<div><span class="font-semibold text-emphasis">Exclude paths:</span> {uiState.exclude_path?.join(', ') || 'None'}</div>
+		{#if uiState.extra_include_path?.length}
+			<div><span class="font-semibold text-emphasis">Extra include paths:</span> {uiState.extra_include_path.join(', ')}</div>
 		{/if}
-
-		<!-- Preview section -->
-		{#if !previewResult}
-			<div class="flex justify-start pt-4">
-				<Button
-					size="md"
-					variant="accent"
-					onclick={() => executeJob(true)}
-					disabled={isPreviewLoading}
-					startIcon={{
-						icon: isPreviewLoading ? Loader2 : undefined,
-						classes: isPreviewLoading ? 'animate-spin' : ''
-					}}
-				>
-					{isPreviewLoading ? 'Previewing...' : 'Preview changes'}
-				</Button>
-			</div>
-		{/if}
-
-		<!-- Job status for preview -->
-		{#if previewJobId}
-			<div class="flex items-center gap-2 text-xs text-primary">
-				{#if previewJobStatus === 'running'}
-					<Loader2 class="animate-spin" size={14} />
-				{:else if previewJobStatus === 'success'}
-					<CheckCircle2 size={14} class="text-green-600" />
-				{:else if previewJobStatus === 'failure'}
-					<XCircle size={14} class="text-red-700" />
-				{/if}
-				Preview job:
-				<a
-					target="_blank"
-					class="underline"
-					href={`/run/${previewJobId}?workspace=${$workspaceStore}`}
-				>
-					{previewJobId}
-				</a>
-			</div>
-		{/if}
-
-		<!-- Preview error -->
-		{#if previewError}
-			<Alert type="error" title="Preview failed">
-				{previewError}
-			</Alert>
-		{/if}
-
-		<!-- Preview results -->
-		{#if previewResult && !previewError}
-			<div class="space-y-3">
-				<h4 class="text-sm font-semibold text-primary">Changes to Push</h4>
-
-				{#if previewResult.changes?.length > 0}
-					<GitDiffPreview {previewResult} />
-				{:else}
-					<div class="bg-surface-secondary rounded-lg p-3">
-						<div class="text-sm text-primary">No changes to push to the repository.</div>
-					</div>
-				{/if}
-			</div>
-		{/if}
-
-		<!-- Apply section (shown after successful preview) -->
-		{#if previewResult && !previewError}
-			{@const hasChanges = previewResult.changes?.length > 0}
-			{#if hasChanges}
-				<div class="border-t pt-4 mt-4">
-					<div class="flex justify-start gap-2">
-						<Button
-							size="xs"
-							onclick={() => executeJob(false)}
-							disabled={isApplying}
-							startIcon={{
-								icon: isApplying ? Loader2 : undefined,
-								classes: isApplying ? 'animate-spin' : ''
-							}}
-						>
-							{isApplying
-								? isNewConnection
-									? 'Initializing...'
-									: 'Pushing...'
-								: isNewConnection
-									? 'Initialize repo and save connection'
-									: 'Push to repository'}
-						</Button>
-						{#if isNewConnection && onSaveWithoutInit}
-							<Button size="xs" color="light" onclick={onSaveWithoutInit} disabled={isApplying}>
-								Save without initializing repo
-							</Button>
-						{/if}
-					</div>
-				</div>
-			{/if}
-		{/if}
-
-		<!-- Job status for apply -->
-		{#if applyJobId}
-			<div class="flex items-center gap-2 text-xs text-primary">
-				{#if applyJobStatus === 'running'}
-					<Loader2 class="animate-spin" size={14} />
-				{:else if applyJobStatus === 'success'}
-					<CheckCircle2 size={14} class="text-green-600" />
-				{:else if applyJobStatus === 'failure'}
-					<XCircle size={14} class="text-red-700" />
-				{/if}
-				Push job:
-				<a
-					target="_blank"
-					class="underline"
-					href={`/run/${applyJobId}?workspace=${$workspaceStore}`}
-				>
-					{applyJobId}
-				</a>
-			</div>
-		{/if}
-
-		<!-- Apply error -->
-		{#if applyError}
-			<Alert type="error" title="Push failed">
-				{applyError}
-			</Alert>
-		{/if}
-
-		<!-- CLI Instructions (collapsible) -->
-		<div class="border-t pt-4 mt-4">
-			<button
-				class="flex items-center gap-2 text-sm text-secondary hover:text-primary transition-colors"
-				onclick={() => (showCliInstructions = !showCliInstructions)}
-			>
-				<Terminal size={16} />
-				<span>CLI Instructions</span>
-				{#if showCliInstructions}
-					<ChevronUp size={16} />
-				{:else}
-					<ChevronDown size={16} />
-				{/if}
-			</button>
-
-			{#if showCliInstructions}
-				<div class="mt-3 bg-surface-secondary rounded-lg p-3">
-					<pre class="text-xs bg-surface p-3 rounded overflow-x-auto whitespace-pre-wrap break-all">
-# Setup (only needed if local folder not initialized yet)
-npm install -g windmill-cli
-wmill workspace add {$workspaceStore} {$workspaceStore} {window.location.origin}
-wmill init --workspace {$workspaceStore} --repository {gitRepoResourcePath}
-
-# Pull workspace content to git repository
-wmill sync pull --workspace {$workspaceStore} --repository {gitRepoResourcePath}</pre
-					>
-				</div>
-			{/if}
-		</div>
+		<div><span class="font-semibold text-emphasis">Included types:</span> {uiState.include_type?.join(', ') || 'None'}</div>
+		<p class="mt-2">
+			This does not update the git sync settings in <span class="font-mono">wmill.yaml</span>: they
+			can only be pulled from the repository, which is their source of truth. To change what is
+			pushed, cancel and edit the filters in the workspace settings.
+		</p>
 	</div>
+
+	{#if open}
+		{#key gitRepoResourcePath}
+			<GitPushPreview bind:this={push} {gitRepoResourcePath} {uiState} {onSuccess} />
+		{/key}
+	{/if}
+
+	<!-- Reversed row: whatever is rendered first lands rightmost, so the primary action ends up at
+	     the far right and Cancel on the left. -->
+	{#snippet actions()}
+		<Button
+			unifiedSize="sm"
+			variant="accent"
+			onclick={() => push?.apply()}
+			disabled={!status.canApply}
+			startIcon={{
+				icon: status.applying ? Loader2 : undefined,
+				classes: status.applying ? 'animate-spin' : ''
+			}}
+		>
+			{status.applying
+				? isNewConnection
+					? 'Initializing...'
+					: 'Pushing...'
+				: isNewConnection
+					? 'Initialize repo and save connection'
+					: 'Push to repository'}
+		</Button>
+		{#if isNewConnection && onSaveWithoutInit}
+			<Button
+				unifiedSize="sm"
+				variant="default"
+				onclick={onSaveWithoutInit}
+				disabled={status.applying || status.previewing}
+			>
+				Save without initializing repo
+			</Button>
+		{/if}
+	{/snippet}
 </Modal>
diff --git a/frontend/src/lib/components/git_sync/setup/ConfigureSyncStep.svelte b/frontend/src/lib/components/git_sync/setup/ConfigureSyncStep.svelte
new file mode 100644
index 0000000000..c1ff4e1f0d
--- /dev/null
+++ b/frontend/src/lib/components/git_sync/setup/ConfigureSyncStep.svelte
@@ -0,0 +1,314 @@
+<script lang="ts">
+	import { untrack } from 'svelte'
+	import { CheckCircle2, Loader2, RotateCw, XCircle } from 'lucide-svelte'
+	import { Alert, Button } from '$lib/components/common'
+	import Toggle from '$lib/components/Toggle.svelte'
+	import EEOnly from '$lib/components/EEOnly.svelte'
+	import GitSyncFilterSettings from '$lib/components/workspaceSettings/GitSyncFilterSettings.svelte'
+	import { ApiError, GitSyncService, ResourceService } from '$lib/gen'
+	import { enterpriseLicense, userWorkspaces, workspaceStore } from '$lib/stores'
+	import { apiErrorMessage } from '$lib/utils'
+	import { getGitSyncContext } from '../GitSyncContext.svelte'
+	import GitSyncModeDisplay from '../GitSyncModeDisplay.svelte'
+	import { applyNewConnectionDefaults } from './connectionDefaults'
+
+	type Props = {
+		/** The unsaved repository this step configures, in the git sync context. */
+		idx: number
+		mode: 'sync' | 'promotion'
+		/** Identifies the run this step belongs to, so a load outliving it cannot answer for a
+		 * later one — the same repository can be configured again after going Back. */
+		attempt: number
+		/** Reports whether the resource and its credential have been read. What Windmill holds
+		 * decides the defaults and which toggles exist, so the run must not be saved before
+		 * they land. */
+		onFactsChange?: (attempt: number, loaded: boolean) => void
+	}
+
+	let { idx, mode, attempt, onFactsChange }: Props = $props()
+
+	const ctx = getGitSyncContext()
+	const repo = $derived(ctx.getRepository(idx))
+
+	const currentWorkspace = $derived($userWorkspaces?.find((w) => w.id === $workspaceStore))
+	const isFork = $derived(
+		($workspaceStore?.startsWith('wm-fork-') ?? false) || !!currentWorkspace?.parent_workspace_id
+	)
+
+	let managedCredential = $state(false)
+	let targetBranch: string | undefined = $state(undefined)
+	let factsError: string | undefined = $state(undefined)
+
+	async function loadResourceFacts(path: string) {
+		const workspace = $workspaceStore
+		if (!workspace) return
+		// Read now, not when the request lands: a destroyed step still evaluates its props
+		// against the dialog's current state, which would make this answer for a later run.
+		const run = attempt
+		onFactsChange?.(run, false)
+		factsError = undefined
+		let resource: Awaited<ReturnType<typeof ResourceService.getResource>> | undefined
+		let origin: Awaited<ReturnType<typeof GitSyncService.getCredentialOrigin>> | undefined
+		try {
+			;[resource, origin] = await Promise.all([
+				ResourceService.getResource({ workspace, path }),
+				GitSyncService.getCredentialOrigin({ workspace, path }).catch((e) => {
+					// The route only exists on EE, where its absence is the answer: Windmill holds
+					// no credential. Any other failure leaves that unknown, and answering "none"
+					// would quietly save the repository without the defaults a managed one gets.
+					if (e instanceof ApiError && e.status === 404) return undefined
+					throw e
+				})
+			])
+		} catch (e) {
+			if (repo?.git_repo_resource_path !== path) return
+			factsError = apiErrorMessage(e)
+			return
+		}
+		// The step may have been rebuilt for another repository while this was in flight.
+		if (repo?.git_repo_resource_path !== path) return
+		const isGithubApp = (resource?.value as any)?.is_github_app === true
+		managedCredential = isGithubApp || origin?.origin !== undefined
+		if (repo) {
+			applyNewConnectionDefaults(repo, {
+				mode,
+				managedCredential,
+				isGithubApp,
+				isFork,
+				ee: !!$enterpriseLicense
+			})
+			targetBranch = await ctx.getTargetBranch(repo).catch(() => undefined)
+		}
+		onFactsChange?.(run, true)
+	}
+
+	async function detect() {
+		try {
+			await ctx.detectRepository(idx)
+		} catch (e) {
+			if (repo) {
+				repo.detectionState = 'error'
+				repo.detectionError = apiErrorMessage(e)
+			}
+		}
+	}
+
+	$effect(() => {
+		const path = repo?.git_repo_resource_path
+		if (!path) return
+		untrack(() => {
+			void loadResourceFacts(path)
+			if (!repo?.detectionState || repo.detectionState === 'idle') void detect()
+		})
+	})
+
+	// Applied to every fork of this workspace, so they are the parent's to set — a fork has
+	// neither toggle, matching the repository card.
+	function setSyncForks(v: boolean) {
+		if (repo?.auto_pull) repo.auto_pull = { ...repo.auto_pull, sync_forks: v }
+	}
+	function setForkOpenPrs(v: boolean) {
+		if (repo) repo.fork_open_prs = v
+	}
+	function setPromotionOpenPrs(v: boolean) {
+		if (repo) repo.promotion_open_prs = v
+	}
+
+	function setAutoPull(enabled: boolean) {
+		if (!repo) return
+		repo.auto_pull = enabled
+			? {
+					...(repo.auto_pull ?? {}),
+					enabled: true,
+					mode: repo.auto_pull?.mode ?? 'auto',
+					sync_forks: repo.auto_pull?.sync_forks ?? true
+				}
+			: repo.auto_pull
+				? { ...repo.auto_pull, enabled: false }
+				: undefined
+	}
+</script>
+
+{#if repo}
+	<div class="flex flex-col gap-4 h-full">
+		{#if factsError}
+			<Alert type="error" size="xs" title="Could not read the connection">
+				<div class="flex flex-col items-start gap-2">
+					<span>{factsError}</span>
+					<Button
+						variant="default"
+						unifiedSize="xs"
+						startIcon={{ icon: RotateCw }}
+						onClick={() => {
+							const path = repo?.git_repo_resource_path
+							if (path) void loadResourceFacts(path)
+						}}
+					>
+						Retry
+					</Button>
+				</div>
+			</Alert>
+		{/if}
+		{#if !repo.detectionState || repo.detectionState === 'idle' || repo.detectionState === 'loading'}
+			<div class="flex-1 flex flex-col items-center justify-center gap-2 text-sm text-hint">
+				<Loader2 size={36} class="animate-spin" />
+				Checking the repository...
+			</div>
+		{:else if repo.detectionState === 'error'}
+			<Alert type="error" size="xs" title="Could not read the repository">
+				<div class="flex flex-col items-start gap-2">
+					<span>{repo.detectionError || 'The check failed.'}</span>
+					<span> Check the URL and the token, or go back and connect the repository again. </span>
+					<Button
+						variant="default"
+						unifiedSize="xs"
+						startIcon={{ icon: RotateCw }}
+						onClick={() => void detect()}
+					>
+						Retry
+					</Button>
+				</div>
+			</Alert>
+		{:else if repo.detectionState === 'no-wmill'}
+			<Alert type="info" size="xs" bgClass="border-0" title="New repository">
+				The repository has no Windmill configuration yet. Choose what to sync, then initialize it
+				with the current content of this workspace.
+			</Alert>
+		{:else if repo.detectionState === 'has-wmill'}
+			<Alert type="success" size="xs" bgClass="border-0" title="Existing Windmill repository">
+				The repository already holds a Windmill configuration. Its sync settings are loaded below.
+			</Alert>
+		{/if}
+
+		{#if repo.detectionState === 'no-wmill' || repo.detectionState === 'has-wmill'}
+			<GitSyncFilterSettings
+				git_repo_resource_path={repo.git_repo_resource_path}
+				bind:include_path={repo.settings.include_path}
+				bind:include_type={repo.settings.include_type}
+				bind:exclude_types_override={repo.exclude_types_override}
+				isLegacyRepo={false}
+				bind:excludes={repo.settings.exclude_path}
+				bind:extraIncludes={repo.settings.extra_include_path}
+				isInitialSetup={repo.detectionState === 'no-wmill'}
+				requiresMigration={false}
+				useIndividualBranch={repo.use_individual_branch}
+			>
+				{#snippet subtitle()}
+					<GitSyncModeDisplay {mode} {targetBranch} repository={repo} />
+				{/snippet}
+			</GitSyncFilterSettings>
+
+			{#if mode === 'promotion'}
+				<Toggle
+					bind:checked={repo.group_by_folder}
+					options={{
+						right: 'Group all changes from the same folder in the same branch',
+						rightTooltip:
+							'Instead of creating a branch per item, Windmill creates a branch per folder containing the items being deployed.'
+					}}
+				/>
+				{#if managedCredential}
+					<Toggle
+						checked={repo.promotion_open_prs ?? false}
+						options={{
+							right: 'Open a pull request for each deploy branch',
+							rightTooltip:
+								'After a deploy pushes its wm_deploy/** branch, Windmill opens a pull request to the target branch. Runs from the deploy itself, so it works without inbound webhooks.'
+						}}
+						on:change={(e) => setPromotionOpenPrs(e.detail)}
+					/>
+				{:else}
+					<span class="text-2xs text-secondary">
+						To open a pull request for each deploy branch, connect the repository through the GitHub
+						App or give a GitLab repository a project access token — otherwise set up the
+						<span class="font-mono">open-pr-on-commit</span> workflow in the repository.
+					</span>
+				{/if}
+			{:else if !isFork}
+				<div class="flex flex-col gap-1">
+					<Toggle
+						checked={repo.auto_pull?.enabled ?? false}
+						disabled={!$enterpriseLicense}
+						options={{
+							right: 'Automatically deploy changes from Git',
+							rightTooltip:
+								'Windmill deploys new commits from the tracked branch into this workspace.'
+						}}
+						on:change={(e) => setAutoPull(e.detail)}
+					>
+						{#snippet right()}
+							{#if !$enterpriseLicense}<EEOnly />{/if}
+						{/snippet}
+					</Toggle>
+					{#if repo.auto_pull?.enabled}
+						<span class="text-2xs text-secondary">
+							{managedCredential
+								? 'New commits are delivered instantly by webhook, with polling as a fallback.'
+								: 'The branch is checked for new commits about every minute.'}
+						</span>
+					{:else}
+						<span class="text-2xs text-secondary">
+							Leave it off to control deployment from your own pipeline (tests, custom gating,
+							deploy on PR merge) with
+							<a
+								href="https://www.windmill.dev/docs/advanced/deploy_gh_gl#github-actions-setup"
+								target="_blank"
+								rel="noreferrer"
+								class="text-accent hover:underline">GitHub Actions or a similar CI/CD workflow</a
+							>.
+						</span>
+					{/if}
+					<Toggle
+						disabled={!repo.auto_pull?.enabled}
+						checked={!!(repo.auto_pull?.enabled && repo.auto_pull?.sync_forks)}
+						options={{
+							right: 'Automatically sync forks with git branches',
+							rightTooltip: repo.auto_pull?.enabled
+								? "When a fork's wm-fork/** branch changes in the repository (for example after merging the tracked branch into it), Windmill deploys those commits into the fork workspace. Configured once here, applied to every fork of this workspace."
+								: 'Requires automatic deploy from Git to be enabled above.'
+						}}
+						on:change={(e) => setSyncForks(e.detail)}
+					/>
+					{#if managedCredential}
+						<Toggle
+							checked={repo.fork_open_prs ?? false}
+							disabled={!$enterpriseLicense}
+							options={{
+								right: 'Open a pull request when an item is deployed in a fork',
+								rightTooltip:
+									"After an item deployed in a fork is pushed to the fork's branch (wm-fork/**, or the dev branch for a dev workspace), Windmill opens a pull request to the tracked branch of the shared repository. Runs from the deploy itself, so it works without inbound webhooks."
+							}}
+							on:change={(e) => setForkOpenPrs(e.detail)}
+						>
+							{#snippet right()}
+								{#if !$enterpriseLicense}<EEOnly />{/if}
+							{/snippet}
+						</Toggle>
+					{/if}
+				</div>
+			{/if}
+		{/if}
+
+		{#if repo.detectionState !== 'no-wmill' && repo.detectionState !== 'has-wmill'}
+			<!-- Holds its row from the start: the job id only arrives once the check job has been
+			     started, and letting the row appear then shifts everything above it. -->
+			<div class="mt-auto flex items-center gap-2 min-h-4 text-2xs text-secondary">
+				{#if repo.detectionJobId}
+					{#if repo.detectionJobStatus === 'success'}
+						<CheckCircle2 size={12} class="text-green-600" />
+					{:else if repo.detectionJobStatus === 'failure'}
+						<XCircle size={12} class="text-red-700" />
+					{/if}
+					<span class="text-hint">Check job:</span>
+					<a
+						target="_blank"
+						class="underline"
+						href={`/run/${repo.detectionJobId}?workspace=${$workspaceStore}`}
+					>
+						{repo.detectionJobId}
+					</a>
+				{/if}
+			</div>
+		{/if}
+	</div>
+{/if}
diff --git a/frontend/src/lib/components/git_sync/setup/GithubAppConnectForm.svelte b/frontend/src/lib/components/git_sync/setup/GithubAppConnectForm.svelte
new file mode 100644
index 0000000000..fdea233345
--- /dev/null
+++ b/frontend/src/lib/components/git_sync/setup/GithubAppConnectForm.svelte
@@ -0,0 +1,232 @@
+<script lang="ts">
+	import { Download, ExternalLink, Loader2, Minus, RotateCw, Upload } from 'lucide-svelte'
+	import { Alert, Button } from '$lib/components/common'
+	import Select from '$lib/components/select/Select.svelte'
+	import DropdownV2 from '$lib/components/DropdownV2.svelte'
+	import TextInput from '$lib/components/text_input/TextInput.svelte'
+	import RepositorySelector from '$lib/components/RepositorySelector.svelte'
+	import {
+		addInstallationToWorkspace,
+		deleteInstallation,
+		exportInstallation,
+		importInstallation
+	} from '$lib/githubApp'
+	import type { RepoConnection } from './repoConnection'
+	import type { GithubAppSetup } from './githubAppSetup.svelte'
+
+	type Props = {
+		workspace: string
+		setup: GithubAppSetup
+		connection: RepoConnection | undefined
+	}
+
+	let { workspace, setup, connection = $bindable() }: Props = $props()
+
+	const gh = $derived(setup.gh)
+	const usable = $derived(setup.usable)
+	const broken = $derived(gh.workspaceGithubInstallations.filter((i) => !!i.error))
+	// Installations reachable from another workspace the user is in, deduplicated.
+	const elsewhere = $derived(
+		gh.githubInstallations.filter(
+			(i, idx, all) =>
+				!i.error &&
+				!gh.workspaceGithubInstallations.some((w) => w.installation_id === i.installation_id) &&
+				all.findIndex((o) => o.installation_id === i.installation_id) === idx
+		)
+	)
+	const selected = $derived(
+		usable.find((i) => i.installation_id === gh.selectedGHAppInstallationId)
+	)
+
+	const reload = () => setup.reload()
+
+	$effect(() => {
+		connection = gh.selectedGHAppRepository
+			? { url: gh.selectedGHAppRepository, isGithubApp: true }
+			: undefined
+	})
+
+	async function useFrom(installationId: number, sourceWorkspace: string) {
+		await addInstallationToWorkspace(workspace, installationId, sourceWorkspace, reload)
+	}
+
+	/** Pasting a JWT exported from another Windmill instance. */
+	let importing = $state(false)
+
+	// Export hands out a JWT the other instance imports; an installation reached through a
+	// GitHub Enterprise Server of its own is not transferable that way.
+	const installationActions = $derived([
+		...(selected && !selected.github_base_url
+			? [
+					{
+						displayName: 'Copy installation token (to another instance)',
+						icon: Download,
+						action: () => void exportInstallation(workspace, selected.installation_id)
+					}
+				]
+			: []),
+		...(gh.isGhesSelfManaged
+			? []
+			: [
+					{
+						displayName: 'Import an installation from another instance',
+						icon: Upload,
+						action: () => (importing = true)
+					}
+				]),
+		...(selected && !selected.provisioned_by_admin
+			? [
+					{
+						displayName: 'Remove installation from this workspace',
+						icon: Minus,
+						type: 'delete' as const,
+						action: () => void deleteInstallation(workspace, selected.installation_id, reload)
+					}
+				]
+			: [])
+	])
+</script>
+
+<div class="flex flex-col gap-4">
+	{#if (!setup.loaded || gh.loadingGithubInstallations) && gh.workspaceGithubInstallations.length === 0}
+		<div class="flex items-center gap-2 text-xs text-secondary">
+			<Loader2 size={14} class="animate-spin" /> Loading GitHub App installations...
+		</div>
+	{:else}
+		{#if usable.length === 0}
+			<Alert type="info" size="xs" bgClass="border-0" title="">
+				{#if gh.isCheckingInstallation}
+					Finish installing the Windmill GitHub App in the tab that opened. This dialog picks up the
+					installation on its own.
+				{:else}
+					Install the Windmill GitHub App on the GitHub account or organization that owns the
+					repository, then come back here.
+				{/if}
+			</Alert>
+		{:else}
+			<label class="flex flex-col gap-1">
+				<span class="text-xs font-semibold text-emphasis">GitHub account</span>
+				<Select
+					items={usable.map((i) => ({
+						label: i.account_id,
+						value: i.installation_id,
+						subtitle: `${i.total_count} repositories`
+					}))}
+					bind:value={
+						() => gh.selectedGHAppInstallationId,
+						(v) => {
+							gh.selectedGHAppInstallationId = v
+							gh.selectedGHAppRepository = undefined
+						}
+					}
+					clearable={false}
+				/>
+			</label>
+			{#if selected}
+				<label class="flex flex-col gap-1">
+					<span class="text-xs font-semibold text-emphasis">Repository</span>
+					<!-- RepositorySelector snapshots its repositories at mount -->
+					{#key selected.installation_id}
+						<RepositorySelector
+							bind:selectedRepository={gh.selectedGHAppRepository}
+							installationId={selected.installation_id}
+							initialRepositories={selected.repositories}
+							totalCount={selected.total_count}
+							perPage={selected.per_page}
+						/>
+					{/key}
+				</label>
+			{/if}
+		{/if}
+
+		{#if broken.length > 0}
+			<Alert type="warning" size="xs" title="Some installations cannot be used">
+				{broken.map((i) => `${i.account_id}: ${i.error}`).join('; ')}
+			</Alert>
+		{/if}
+
+		<div class="flex items-center gap-2">
+			<Button
+				variant="default"
+				unifiedSize="sm"
+				disabled={!gh.githubInstallationUrl}
+				startIcon={gh.isCheckingInstallation
+					? { icon: Loader2, classes: 'animate-spin' }
+					: undefined}
+				endIcon={{ icon: ExternalLink }}
+				title={gh.isCheckingInstallation ? 'Open the GitHub installation page again' : undefined}
+				onClick={() => setup.openInstall()}
+			>
+				{gh.isCheckingInstallation
+					? 'Waiting for the installation...'
+					: usable.length === 0
+						? 'Install the GitHub App'
+						: 'Install on another account'}
+			</Button>
+			<Button
+				variant="subtle"
+				unifiedSize="sm"
+				iconOnly
+				title="Refresh installations"
+				startIcon={{ icon: RotateCw }}
+				disabled={gh.loadingGithubInstallations}
+				onClick={reload}
+			/>
+			{#if installationActions.length > 0}
+				<DropdownV2 items={installationActions} />
+			{/if}
+		</div>
+
+		{#if importing}
+			<div class="flex flex-col gap-1">
+				<span class="text-xs font-semibold text-emphasis">Installation token</span>
+				<span class="text-xs text-secondary">
+					Paste the token copied from the instance that holds the installation.
+				</span>
+				<div class="flex items-center gap-2">
+					<TextInput
+						bind:value={gh.importJwt}
+						size="sm"
+						class="flex-1 min-w-0"
+						inputProps={{ placeholder: 'JWT token', autocomplete: 'off' }}
+					/>
+					<Button
+						variant="default"
+						unifiedSize="sm"
+						disabled={!gh.importJwt}
+						onClick={async () => {
+							await importInstallation(workspace, gh.importJwt, () => {
+								gh.importJwt = ''
+								importing = false
+								void reload()
+							})
+						}}
+					>
+						Import
+					</Button>
+				</div>
+			</div>
+		{/if}
+
+		{#if elsewhere.length > 0}
+			<div class="flex flex-col gap-1">
+				<span class="text-xs font-semibold text-emphasis">Installed in your other workspaces</span>
+				{#each elsewhere as inst (inst.installation_id)}
+					<div class="flex items-center justify-between gap-2 text-xs">
+						<span class="text-primary">
+							{inst.account_id}
+							<span class="text-secondary">from {inst.workspace_id}</span>
+						</span>
+						<Button
+							variant="default"
+							unifiedSize="xs"
+							onClick={() => inst.workspace_id && useFrom(inst.installation_id, inst.workspace_id)}
+						>
+							Use here
+						</Button>
+					</div>
+				{/each}
+			</div>
+		{/if}
+	{/if}
+</div>
diff --git a/frontend/src/lib/components/git_sync/setup/GitlabProjectConnectForm.svelte b/frontend/src/lib/components/git_sync/setup/GitlabProjectConnectForm.svelte
new file mode 100644
index 0000000000..59d26c1a34
--- /dev/null
+++ b/frontend/src/lib/components/git_sync/setup/GitlabProjectConnectForm.svelte
@@ -0,0 +1,114 @@
+<script lang="ts">
+	import { GitBranch, Loader2 } from 'lucide-svelte'
+	import { Alert, Button } from '$lib/components/common'
+	import TextInput from '$lib/components/text_input/TextInput.svelte'
+	import Select from '$lib/components/select/Select.svelte'
+	import { GitSyncService, type GitlabProject } from '$lib/gen'
+	import { apiErrorMessage } from '$lib/utils'
+	import type { RepoConnection } from './repoConnection'
+
+	type Props = {
+		workspace: string
+		connection: RepoConnection | undefined
+	}
+
+	let { workspace, connection = $bindable() }: Props = $props()
+
+	let baseUrl = $state('https://gitlab.com')
+	let token = $state('')
+	let projects: GitlabProject[] = $state([])
+	let selectedProject: string | undefined = $state(undefined)
+	let loading = $state(false)
+	let listError: string | undefined = $state(undefined)
+	/** What the current listing was made with: a project chosen against another token or
+	 * another instance must not be stored under the ones on screen now. */
+	let listedToken = $state('')
+	let listedBaseUrl = $state('')
+
+	const staleListing = $derived(
+		projects.length > 0 && (token !== listedToken || baseUrl !== listedBaseUrl)
+	)
+	const project = $derived(projects.find((p) => p.path_with_namespace === selectedProject))
+
+	$effect(() => {
+		connection =
+			project && !staleListing
+				? { url: project.http_url_to_repo, heldToken: listedToken }
+				: undefined
+	})
+
+	async function listProjects() {
+		loading = true
+		listError = undefined
+		const listedWith = token
+		const listedAgainst = baseUrl
+		try {
+			projects = await GitSyncService.listGitlabProjects({
+				workspace,
+				requestBody: { base_url: listedAgainst, token: listedWith }
+			})
+			listedToken = listedWith
+			listedBaseUrl = listedAgainst
+			selectedProject = projects[0]?.path_with_namespace
+			if (projects.length === 0) {
+				listError = 'The token can see no project with at least the Developer role'
+			}
+		} catch (e) {
+			listError = apiErrorMessage(e)
+			projects = []
+			selectedProject = undefined
+		} finally {
+			loading = false
+		}
+	}
+</script>
+
+<div class="flex flex-col gap-4">
+	<label class="flex flex-col gap-1">
+		<span class="text-xs font-semibold text-emphasis">GitLab instance</span>
+		<TextInput bind:value={baseUrl} />
+	</label>
+	<label class="flex flex-col gap-1">
+		<span class="text-xs font-semibold text-emphasis">Project access token</span>
+		<span class="text-xs text-secondary">
+			Create it on the project you are syncing, with the <code>api</code> scope and the
+			<code>Maintainer</code> role.
+		</span>
+		<TextInput bind:value={token} inputProps={{ type: 'password', autocomplete: 'off' }} />
+		<span class="text-2xs text-hint">
+			Windmill stores it and renews it before it expires. Use one token per project.
+		</span>
+	</label>
+	<div class="flex">
+		<Button
+			variant="default"
+			unifiedSize="sm"
+			disabled={!token.trim() || !baseUrl.trim() || loading}
+			startIcon={{ icon: loading ? Loader2 : GitBranch, classes: loading ? 'animate-spin' : '' }}
+			onClick={listProjects}
+		>
+			List projects
+		</Button>
+	</div>
+	{#if listError}
+		<Alert type="error" title="Could not list projects" size="xs">{listError}</Alert>
+	{/if}
+	{#if staleListing}
+		<span class="text-xs text-secondary">
+			The token or the instance changed. List the projects again to choose one they can
+			reach.
+		</span>
+	{:else if projects.length > 0}
+		<label class="flex flex-col gap-1">
+			<span class="text-xs font-semibold text-emphasis">Project</span>
+			<Select
+				items={projects.map((p) => ({
+					label: p.path_with_namespace,
+					value: p.path_with_namespace
+				}))}
+				bind:value={selectedProject}
+				clearable={false}
+			/>
+		</label>
+	{/if}
+</div>
diff --git a/frontend/src/lib/components/git_sync/setup/TokenUrlConnectForm.svelte b/frontend/src/lib/components/git_sync/setup/TokenUrlConnectForm.svelte
new file mode 100644
index 0000000000..2d8c7f2f48
--- /dev/null
+++ b/frontend/src/lib/components/git_sync/setup/TokenUrlConnectForm.svelte
@@ -0,0 +1,95 @@
+<script lang="ts">
+	import TextInput from '$lib/components/text_input/TextInput.svelte'
+	import { ExternalLink } from 'lucide-svelte'
+	import {
+		parseRepoUrl,
+		withToken,
+		type RepoConnection,
+		type TokenProvider
+	} from './repoConnection'
+
+	type Props = {
+		provider: TokenProvider
+		connection: RepoConnection | undefined
+	}
+
+	let { provider, connection = $bindable() }: Props = $props()
+
+	let repoUrl = $state('')
+	let token = $state('')
+
+	const parsed = $derived(parseRepoUrl(repoUrl))
+	const urlError = $derived(
+		repoUrl.trim() && !parsed ? 'Enter the https URL of the repository' : ''
+	)
+
+	$effect(() => {
+		connection =
+			parsed && token.trim()
+				? { url: parsed.toString(), tokenUrl: withToken(parsed, token, provider) }
+				: undefined
+	})
+
+	/** Where this token is created. Built from the repository URL once there is one, so a
+	 * self-hosted instance points at its own settings rather than github.com / gitlab.com. */
+	const tokenHelpUrl = $derived.by(() => {
+		const origin = parsed?.origin
+		if (provider === 'github') {
+			return `${origin ?? 'https://github.com'}/settings/personal-access-tokens/new`
+		}
+		// GitLab issues a project access token from the project itself.
+		const project = parsed?.pathname.replace(/\.git\/?$/, '').replace(/\/+$/, '')
+		return origin && project
+			? `${origin}${project}/-/settings/access_tokens`
+			: 'https://gitlab.com/-/user_settings/personal_access_tokens'
+	})
+</script>
+
+<div class="flex flex-col gap-4">
+	<label class="flex flex-col gap-1">
+		<span class="text-xs font-semibold text-emphasis">Repository URL</span>
+		<TextInput
+			bind:value={repoUrl}
+			error={urlError}
+			inputProps={{
+				placeholder:
+					provider === 'github'
+						? 'https://github.com/acme/windmill-workspace'
+						: 'https://gitlab.com/acme/windmill-workspace'
+			}}
+		/>
+		{#if urlError}
+			<span class="text-2xs text-red-500">{urlError}</span>
+		{/if}
+	</label>
+	<label class="flex flex-col gap-1">
+		<span class="text-xs font-semibold text-emphasis">
+			{provider === 'github' ? 'Personal access token' : 'Access token'}
+		</span>
+		<span class="text-xs text-secondary">
+			{#if provider === 'github'}
+				A fine-grained token with read and write access to the repository's <b>Contents</b>.
+			{:else}
+				A project access token with the <code>write_repository</code> scope and the
+				<code>Developer</code> role.
+			{/if}
+		</span>
+		<TextInput bind:value={token} inputProps={{ type: 'password', autocomplete: 'off' }} />
+		<a
+			href={tokenHelpUrl}
+			target="_blank"
+			rel="noreferrer"
+			class="flex w-fit items-center gap-1 text-2xs text-accent hover:underline"
+		>
+			<ExternalLink size={12} />
+			{#if provider === 'github'}
+				Create one on GitHub{parsed ? ' — pick this repository, then Contents: read and write' : ''}
+			{:else}
+				Create one in the project's settings{parsed ? '' : ' — enter the repository URL first'}
+			{/if}
+		</a>
+		<span class="text-2xs text-hint">
+			Stored in a secret variable next to the resource. Renew it there before it expires.
+		</span>
+	</label>
+</div>
diff --git a/frontend/src/lib/components/git_sync/setup/connectionDefaults.ts b/frontend/src/lib/components/git_sync/setup/connectionDefaults.ts
new file mode 100644
index 0000000000..4af90decf6
--- /dev/null
+++ b/frontend/src/lib/components/git_sync/setup/connectionDefaults.ts
@@ -0,0 +1,45 @@
+import type { GitSyncRepository } from '../GitSyncContext.svelte'
+
+/**
+ * Defaults for a connection that has not been saved yet, once its resource is known.
+ * Only fills what the user has not set, so it is safe to call again.
+ */
+export function applyNewConnectionDefaults(
+	repo: GitSyncRepository,
+	o: {
+		mode: 'sync' | 'promotion'
+		/** Windmill holds a credential for the repository: a GitHub App or a stored token. */
+		managedCredential: boolean
+		isGithubApp: boolean
+		isFork: boolean
+		ee: boolean
+	}
+): void {
+	if (!repo.isUnsavedConnection) return
+	// Pulling from Git defaults on only where Windmill can receive webhooks. Polling is
+	// opt-in for token repositories, and forks never get the parent-only defaults (the
+	// backend rejects them).
+	if (
+		o.mode === 'sync' &&
+		o.managedCredential &&
+		!o.isFork &&
+		o.ee &&
+		repo.auto_pull === undefined
+	) {
+		repo.auto_pull = { enabled: true, mode: 'auto', sync_forks: true }
+	}
+	// A promotion deploy pushes a wm_deploy/** branch that exists to be merged; without a
+	// pull request it is an orphaned branch. Fork PRs stay opt-in everywhere.
+	if (
+		o.mode === 'promotion' &&
+		o.managedCredential &&
+		o.ee &&
+		repo.promotion_open_prs === undefined
+	) {
+		repo.promotion_open_prs = true
+	}
+	// Webhook with a polling fallback is the only delivery for app repositories.
+	if (o.isGithubApp && repo.auto_pull?.mode === 'polling') {
+		repo.auto_pull = { ...repo.auto_pull, mode: 'auto' }
+	}
+}
diff --git a/frontend/src/lib/components/git_sync/setup/githubAppSetup.svelte.ts b/frontend/src/lib/components/git_sync/setup/githubAppSetup.svelte.ts
new file mode 100644
index 0000000000..645973720f
--- /dev/null
+++ b/frontend/src/lib/components/git_sync/setup/githubAppSetup.svelte.ts
@@ -0,0 +1,50 @@
+import {
+	createGitHubAppState,
+	loadGithubInstallations,
+	startInstallationCheck,
+	stopInstallationCheck,
+	type GitHubAppState
+} from '$lib/githubApp'
+
+/**
+ * GitHub App installations for the setup dialog. Owned by the dialog rather than the
+ * connect form so the installations are known before the user leaves step 1: the
+ * install page has to be opened synchronously from that click, or the browser blocks
+ * the new tab.
+ */
+export class GithubAppSetup {
+	gh: GitHubAppState = $state(createGitHubAppState())
+	loaded = $state(false)
+
+	constructor(private workspace: string) {}
+
+	get usable() {
+		return this.gh.workspaceGithubInstallations.filter((i) => !i.error)
+	}
+
+	async reload(): Promise<void> {
+		try {
+			await loadGithubInstallations(this.gh, this.workspace)
+		} catch {
+			// loadGithubInstallations toasts its own failure
+		}
+		this.loaded = true
+		const usable = this.usable
+		if (!usable.some((i) => i.installation_id === this.gh.selectedGHAppInstallationId)) {
+			this.gh.selectedGHAppInstallationId = usable[0]?.installation_id
+			this.gh.selectedGHAppRepository = undefined
+		}
+	}
+
+	/** Must be called from a click handler, synchronously. */
+	openInstall(): void {
+		const url = this.gh.githubInstallationUrl
+		if (!url) return
+		window.open(url, '_blank', 'noopener')
+		startInstallationCheck(this.gh, this.workspace, () => void this.reload())
+	}
+
+	dispose(): void {
+		stopInstallationCheck(this.gh)
+	}
+}
diff --git a/frontend/src/lib/components/git_sync/setup/repoConnection.test.ts b/frontend/src/lib/components/git_sync/setup/repoConnection.test.ts
new file mode 100644
index 0000000000..4b9cdbe9cb
--- /dev/null
+++ b/frontend/src/lib/components/git_sync/setup/repoConnection.test.ts
@@ -0,0 +1,29 @@
+import { describe, expect, test } from 'vitest'
+import { parseRepoUrl, repoSlug, withToken } from './repoConnection'
+
+describe('parseRepoUrl', () => {
+	test('drops credentials, query and fragment from a pasted URL', () => {
+		const url = parseRepoUrl(' https://someone:secret@github.com/acme/infra.git?utm=1#readme ')
+		expect(url?.toString()).toBe('https://github.com/acme/infra.git')
+	})
+
+	test('refuses what cannot carry a token safely or name a repository', () => {
+		// http would put the token on the wire, and the rest name no repository at all.
+		expect(parseRepoUrl('http://github.com/acme/infra')).toBeUndefined()
+		expect(parseRepoUrl('ssh://git@github.com/acme/infra')).toBeUndefined()
+		expect(parseRepoUrl('github.com/acme/infra')).toBeUndefined()
+		expect(parseRepoUrl('https://github.com/acme')).toBeUndefined()
+	})
+})
+
+test('withToken encodes the token so a punctuated one survives the round trip', () => {
+	const token = 'glpat-a/b@c:d'
+	const embedded = withToken(parseRepoUrl('https://gitlab.com/acme/infra')!, token, 'gitlab')
+	expect(embedded).toBe(`https://oauth2:${encodeURIComponent(token)}@gitlab.com/acme/infra`)
+	expect(new URL(embedded).password).toBe(encodeURIComponent(token))
+})
+
+test('repoSlug names the resource after the repository', () => {
+	expect(repoSlug('https://github.com/acme/My-Repo.git')).toBe('my_repo')
+	expect(repoSlug('https://gitlab.com/group/sub/project/')).toBe('project')
+})
diff --git a/frontend/src/lib/components/git_sync/setup/repoConnection.ts b/frontend/src/lib/components/git_sync/setup/repoConnection.ts
new file mode 100644
index 0000000000..81955086fd
--- /dev/null
+++ b/frontend/src/lib/components/git_sync/setup/repoConnection.ts
@@ -0,0 +1,117 @@
+import { GitSyncService, ResourceService, VariableService } from '$lib/gen'
+
+/** What a provider form hands back once the user has picked a repository. */
+export type RepoConnection = {
+	/** The repository URL, never carrying a secret. */
+	url: string
+	isGithubApp?: boolean
+	/** A token for Windmill to store and renew server-side (EE GitLab). */
+	heldToken?: string
+	/** `url` with the token embedded, filed as a secret variable because the
+	 * resource value itself is readable by anyone who can read the resource. */
+	tokenUrl?: string
+}
+
+/** Username git sends alongside a token: GitHub ignores it for PATs, GitLab
+ * requires a non-empty one and documents `oauth2`. */
+const TOKEN_USERNAME = { github: 'x-access-token', gitlab: 'oauth2' } as const
+
+export type TokenProvider = keyof typeof TOKEN_USERNAME
+
+/** Parses a pasted repository URL, dropping any credentials it carried. */
+export function parseRepoUrl(raw: string): URL | undefined {
+	let u: URL
+	try {
+		u = new URL(raw.trim())
+	} catch {
+		return undefined
+	}
+	// https only: the token is embedded in this URL, and plain http would put it on the wire.
+	if (u.protocol !== 'https:') return undefined
+	if (u.pathname.replace(/\/+$/, '').split('/').filter(Boolean).length < 2) return undefined
+	u.username = ''
+	u.password = ''
+	u.search = ''
+	u.hash = ''
+	return u
+}
+
+export function withToken(url: URL, token: string, provider: TokenProvider): string {
+	const u = new URL(url.toString())
+	u.username = TOKEN_USERNAME[provider]
+	u.password = token.trim()
+	return u.toString()
+}
+
+/** A resource name derived from the repository, e.g. `acme/infra.git` → `infra`. */
+export function repoSlug(url: string): string {
+	const last =
+		url
+			.replace(/\.git\/?$/, '')
+			.replace(/\/+$/, '')
+			.split('/')
+			.pop() ?? ''
+	return last.replace(/[^a-zA-Z0-9_]/g, '_').toLowerCase() || 'git_repository'
+}
+
+/**
+ * Writes everything a connection needs and creates the `git_repository` resource at
+ * `path`. A token-bearing URL goes to a secret variable at the same path, which the
+ * backend renames along with the resource.
+ */
+export async function createRepositoryResource(
+	workspace: string,
+	path: string,
+	conn: RepoConnection,
+	location: { branch?: string; folder?: string }
+): Promise<void> {
+	const branch = location.branch?.trim()
+	// Relative to the repository root, which is how the sync script joins it.
+	const folder = location.folder?.trim().replace(/^\/+|\/+$/g, '')
+	let url = conn.url
+	let createdVariable = false
+	if (conn.tokenUrl) {
+		if (await VariableService.existsVariable({ workspace, path })) {
+			throw new Error(`A variable already exists at ${path}. Pick another path.`)
+		}
+		await VariableService.createVariable({
+			workspace,
+			requestBody: {
+				path,
+				value: conn.tokenUrl,
+				is_secret: true,
+				description: `Authenticated URL of the git repository ${conn.url}`
+			}
+		})
+		createdVariable = true
+		url = `$var:${path}`
+	}
+	try {
+		if (conn.heldToken) {
+			await GitSyncService.setGitCredential({
+				workspace,
+				requestBody: { repo_url: conn.url, token: conn.heldToken }
+			})
+		}
+		await ResourceService.createResource({
+			workspace,
+			requestBody: {
+				path,
+				resource_type: 'git_repository',
+				description: `Git repository ${conn.url}`,
+				value: {
+					url,
+					...(branch ? { branch } : {}),
+					...(folder ? { folder } : {}),
+					is_github_app: !!conn.isGithubApp
+				}
+			}
+		})
+	} catch (e) {
+		// Otherwise a retry at the same path is refused over this run's own secret.
+		if (createdVariable) {
+			await VariableService.deleteVariable({ workspace, path }).catch(() => {})
+		}
+		throw e
+	}
+}
diff --git a/frontend/src/lib/components/graph/FlowGraphV2.svelte b/frontend/src/lib/components/graph/FlowGraphV2.svelte
index 4c004a4f56..3c870832ee 100644
--- a/frontend/src/lib/components/graph/FlowGraphV2.svelte
+++ b/frontend/src/lib/components/graph/FlowGraphV2.svelte
@@ -55,7 +55,6 @@
 	import FlowYamlEditor from '../flows/header/FlowYamlEditor.svelte'
 	import BranchOneEndNode from './renderers/nodes/branchOneEndNode.svelte'
 	import type { TriggerContext } from '../triggers'
-	import { workspaceStore } from '$lib/stores'
 	import SubflowBound from './renderers/nodes/SubflowBound.svelte'
 	import DiffDrawer from '../DiffDrawer.svelte'
 	import ViewportResizer from './ViewportResizer.svelte'
@@ -112,6 +111,9 @@
 		locateModules,
 		areContiguousSiblings
 	} from '../flows/multiSelectUtils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let useDataflow: Writable<boolean | undefined> = writable<boolean | undefined>(false)
 	let showAssets: Writable<boolean | undefined> = writable<boolean | undefined>(true)
@@ -266,7 +268,7 @@
 		fullSize = false,
 		disableAi = false,
 		triggerNode = false,
-		workspace = $workspaceStore ?? 'NO_WORKSPACE',
+		workspace = $operatingWorkspace ?? 'NO_WORKSPACE',
 		editMode = false,
 		allowSimplifiedPoll = true,
 		expandedSubflows = $bindable({}),
diff --git a/frontend/src/lib/components/graph/renderers/nodes/AssetNode.svelte b/frontend/src/lib/components/graph/renderers/nodes/AssetNode.svelte
index 12cf247c9a..cf2a7339c6 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/AssetNode.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/AssetNode.svelte
@@ -207,10 +207,13 @@
 	import type { Edge, Node } from '@xyflow/svelte'
 
 	import { getNodeColorClasses, NODE } from '../../util'
-	import { userStore } from '$lib/stores'
 	import { deepEqual } from 'fast-equals'
 	import { slide } from 'svelte/transition'
 	import AssetColumnBadges from '$lib/components/assets/AssetColumnBadges.svelte'
+	import { useOperatingUser } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	interface Props {
 		data: AssetN['data']
@@ -279,7 +282,7 @@
 							Could not find resource
 						{/snippet}
 					</Tooltip>
-				{:else if isSelected && assetCanBeExplored(data.asset, cachedResourceMetadata) && !$userStore?.operator}
+				{:else if isSelected && assetCanBeExplored(data.asset, cachedResourceMetadata) && !actingUser?.operator}
 					<div transition:slide={{ axis: 'x', duration: 100 }}>
 						<ExploreAssetButton
 							btnClasses="rounded-none"
diff --git a/frontend/src/lib/components/home/BulkActionsBar.svelte b/frontend/src/lib/components/home/BulkActionsBar.svelte
index f36ed4848a..fffd18a3c0 100644
--- a/frontend/src/lib/components/home/BulkActionsBar.svelte
+++ b/frontend/src/lib/components/home/BulkActionsBar.svelte
@@ -10,13 +10,16 @@
 	import Select from '$lib/components/select/Select.svelte'
 	import Label from '$lib/components/Label.svelte'
 	import { sendUserToast } from '$lib/toast'
+	import { useReducedMotion } from '$lib/svelte5Utils.svelte'
 	import { invalidateWorkspaceDrafts } from '$lib/workspaceDrafts.svelte'
 	import { Archive, ArchiveRestore, FolderInput, MoreHorizontal, Trash, X } from 'lucide-svelte'
+	import { fly } from 'svelte/transition'
 	import {
 		blockedReason,
 		eligible,
 		movedPath,
 		runBulk,
+		sourcePath,
 		type BulkAction,
 		type BulkContext,
 		type BulkOutcome
@@ -36,7 +39,17 @@
 	let { selection, workspace, isAdmin, moveTargets, onDone }: Props = $props()
 
 	let ctx: BulkContext = $derived({ workspace, isAdmin })
-	let items = $derived(selection.items)
+	// The bar is still on screen while it flies out, and unticking the last row is
+	// what starts that — by then the live selection is empty. Rendering the last
+	// non-empty one keeps the count and the action states from blinking on the way
+	// out. `keepOnly` only ever removes keys, so acting on the held copy is inert.
+	let lastNonEmpty = $state<BulkItem[]>([])
+	$effect(() => {
+		if (selection.items.length > 0) lastNonEmpty = selection.items
+	})
+	let items = $derived(selection.items.length > 0 ? selection.items : lastNonEmpty)
+
+	let reducedMotion = useReducedMotion()
 
 	const plural = (n: number) => (n === 1 ? '' : 's')
 	const ACTION_LABEL: Record<BulkAction, string> = {
@@ -71,9 +84,6 @@
 
 	function actionTitle(action: BulkAction): string {
 		const n = targets(action).length
-		// Selection mode is entered from the toolbar with nothing picked yet, so this
-		// is the state the primary entry point lands on — it has no blocked reason.
-		if (items.length === 0) return `Select items to ${ACTION_LABEL[action].toLowerCase()}`
 		if (n === 0) return `Cannot ${ACTION_LABEL[action].toLowerCase()}: ${blockedSummary(action)}`
 		if (n < items.length) return `${ACTION_LABEL[action]} ${n} of the ${items.length} selected`
 		return `${ACTION_LABEL[action]} ${n} item${plural(n)}`
@@ -98,6 +108,11 @@
 	let discardReverts = $derived(pendingItems.filter((i) => !i.draftOnly))
 
 	function open(action: BulkAction) {
+		// Gate on the LIVE selection, not `items`. That holds the last non-empty
+		// copy so the bar doesn't blink to zero while it flies out, and the bar stays
+		// clickable for the whole 200ms outro — so without this a click landing in
+		// that window would open a dialog acting on rows the user just deselected.
+		if (selection.items.length === 0) return
 		if (targets(action).length === 0) return
 		pending = action
 		outcomes = undefined
@@ -156,92 +171,99 @@
 	}
 </script>
 
-<div
-	class="fixed bottom-6 left-1/2 -translate-x-1/2 z-40 flex items-center gap-2 rounded-md border bg-surface px-3 py-2 shadow-lg"
->
-	<span class="text-xs font-semibold text-emphasis whitespace-nowrap">
-		{selection.size} selected
-	</span>
-	<div class="h-4 border-l"></div>
-	<Button
-		variant="subtle"
-		unifiedSize="sm"
-		startIcon={{ icon: FolderInput }}
-		disabled={targets('move').length === 0}
-		title={actionTitle('move')}
-		on:click={() => open('move')}
+<!-- Centred by the wrapper rather than by a translate on the bar itself: `fly`
+     composes its slide onto whatever transform the element already has, and a
+     captured `-translate-x-1/2` would be stale the moment the bar's width
+     changed mid-animation. -->
+<div class="fixed bottom-6 inset-x-0 z-40 flex justify-center pointer-events-none">
+	<div
+		transition:fly={{ y: 32, duration: reducedMotion.val ? 0 : 200 }}
+		class="pointer-events-auto flex items-center gap-2 rounded-md border bg-surface px-3 py-2 shadow-lg"
 	>
-		Move{countSuffix('move')}
-	</Button>
-	<!-- Both render when both have targets: a selection mixing archived and active
-	     rows would otherwise be a dead end for whichever action lost the toss. With
-	     no targets either way, Archive stands alone and disabled, explaining why. -->
-	{#if targets('archive').length > 0 || targets('unarchive').length === 0}
+		<span class="text-xs font-semibold text-emphasis whitespace-nowrap">
+			{items.length} selected
+		</span>
+		<div class="h-4 border-l"></div>
 		<Button
 			variant="subtle"
 			unifiedSize="sm"
-			startIcon={{ icon: Archive }}
-			disabled={targets('archive').length === 0}
-			title={actionTitle('archive')}
-			on:click={() => open('archive')}
+			startIcon={{ icon: FolderInput }}
+			disabled={targets('move').length === 0}
+			title={actionTitle('move')}
+			on:click={() => open('move')}
 		>
-			Archive{countSuffix('archive')}
+			Move{countSuffix('move')}
 		</Button>
-	{/if}
-	{#if targets('unarchive').length > 0}
-		<Button
-			variant="subtle"
-			unifiedSize="sm"
-			startIcon={{ icon: ArchiveRestore }}
-			title={actionTitle('unarchive')}
-			on:click={() => open('unarchive')}
-		>
-			Unarchive{countSuffix('unarchive')}
-		</Button>
-	{/if}
-	<DropdownV2
-		placement="top-end"
-		items={[
-			{
-				displayName: `Discard drafts${countSuffix('discard')}`,
-				icon: Trash,
-				action: () => open('discard'),
-				disabled: targets('discard').length === 0,
-				// Only while blocked: a disabled entry can't open its modal, so the reason
-				// has to live here — and an enabled one would render a pointless ⓘ.
-				tooltip: targets('discard').length === 0 ? actionTitle('discard') : undefined
-			},
-			{
-				displayName: `Delete${countSuffix('delete')}`,
-				icon: Trash,
-				type: 'delete' as const,
-				action: () => open('delete'),
-				disabled: targets('delete').length === 0,
-				tooltip: targets('delete').length === 0 ? actionTitle('delete') : undefined
-			}
-		]}
-	>
-		{#snippet buttonReplacement()}
+		<!-- Both render when both have targets: a selection mixing archived and active
+		     rows would otherwise be a dead end for whichever action lost the toss. With
+		     no targets either way, Archive stands alone and disabled, explaining why. -->
+		{#if targets('archive').length > 0 || targets('unarchive').length === 0}
 			<Button
-				nonCaptureEvent
 				variant="subtle"
 				unifiedSize="sm"
-				startIcon={{ icon: MoreHorizontal }}
-				title="More actions"
+				startIcon={{ icon: Archive }}
+				disabled={targets('archive').length === 0}
+				title={actionTitle('archive')}
+				on:click={() => open('archive')}
 			>
-				More
+				Archive{countSuffix('archive')}
 			</Button>
-		{/snippet}
-	</DropdownV2>
-	<div class="h-4 border-l"></div>
-	<Button
-		variant="subtle"
-		unifiedSize="sm"
-		iconOnly
-		startIcon={{ icon: X }}
-		title="Cancel selection (Esc)"
-		on:click={() => selection.exit()}
-	/>
+		{/if}
+		{#if targets('unarchive').length > 0}
+			<Button
+				variant="subtle"
+				unifiedSize="sm"
+				startIcon={{ icon: ArchiveRestore }}
+				title={actionTitle('unarchive')}
+				on:click={() => open('unarchive')}
+			>
+				Unarchive{countSuffix('unarchive')}
+			</Button>
+		{/if}
+		<DropdownV2
+			placement="top-end"
+			items={[
+				{
+					displayName: `Discard drafts${countSuffix('discard')}`,
+					icon: Trash,
+					action: () => open('discard'),
+					disabled: targets('discard').length === 0,
+					// Only while blocked: a disabled entry can't open its modal, so the reason
+					// has to live here — and an enabled one would render a pointless ⓘ.
+					tooltip: targets('discard').length === 0 ? actionTitle('discard') : undefined
+				},
+				{
+					displayName: `Delete${countSuffix('delete')}`,
+					icon: Trash,
+					type: 'delete' as const,
+					action: () => open('delete'),
+					disabled: targets('delete').length === 0,
+					tooltip: targets('delete').length === 0 ? actionTitle('delete') : undefined
+				}
+			]}
+		>
+			{#snippet buttonReplacement()}
+				<Button
+					nonCaptureEvent
+					variant="subtle"
+					unifiedSize="sm"
+					startIcon={{ icon: MoreHorizontal }}
+					title="More actions"
+				>
+					More
+				</Button>
+			{/snippet}
+		</DropdownV2>
+		<div class="h-4 border-l"></div>
+		<Button
+			variant="subtle"
+			unifiedSize="sm"
+			iconOnly
+			startIcon={{ icon: X }}
+			title="Cancel selection (Esc)"
+			on:click={() => selection.exit()}
+		/>
+	</div>
 </div>
 
 <ConfirmationModal
@@ -266,7 +288,7 @@
 				{@const target = moveTarget}
 				{@render pathList(
 					'Will be moved to',
-					pendingItems.map((i) => `${i.path} → ${movedPath(i, target)}`)
+					pendingItems.map((i) => `${sourcePath(i)} → ${movedPath(i, target)}`)
 				)}
 			{/if}
 		{:else if pending === 'discard'}
diff --git a/frontend/src/lib/components/home/CreateActionsMenu.svelte b/frontend/src/lib/components/home/CreateActionsMenu.svelte
index 2cf1f28d54..7c5bb4986e 100644
--- a/frontend/src/lib/components/home/CreateActionsMenu.svelte
+++ b/frontend/src/lib/components/home/CreateActionsMenu.svelte
@@ -247,7 +247,8 @@
 		}
 	}
 
-	let activeKey = $state(allOptions[0]?.key)
+	// the doc panel only shows while an option is hovered or focused, so the menu opens compact
+	let activeKey: string | undefined = $state(undefined)
 	// every option's import action, surfaced together under the bottom "Import" submenu.
 	// The hub project leads and is separated below: the others each paste one artifact the
 	// user already holds, while this one brings a whole project in from somewhere else.
@@ -350,6 +351,7 @@
 		if (isOpen && !wasOpen) {
 			logFeatureUsage('home', 'new_menu_open', { key: source })
 		}
+		if (!isOpen) activeKey = undefined
 		wasOpen = isOpen
 	})
 
@@ -360,8 +362,18 @@
 		// only persist the non-default (hidden) state, so a cleared key means "shown"
 		storeLocalSetting(SHOW_DOC_SETTING, value ? undefined : 'false')
 	}
-	let active = $derived(allOptions.find((o) => o.key === activeKey) ?? allOptions[0])
-	let activeAc = $derived(accentClasses[active.accent])
+	// The pointer crosses the gutter outside the menu on its way into the Workflow-as-Code
+	// submenu, so leaving the menu keeps the panel while that submenu is open; it clears
+	// once the submenu closes with neither pointer nor focus left on the menu.
+	let menuEl: HTMLDivElement | undefined = $state(undefined)
+	$effect(() => {
+		if ($wacSubOpen || !menuEl) return
+		if (!menuEl.matches(':hover') && !menuEl.contains(document.activeElement)) {
+			activeKey = undefined
+		}
+	})
+	let active = $derived(allOptions.find((o) => o.key === activeKey))
+	let activeAc = $derived(active ? accentClasses[active.accent] : undefined)
 
 	// shared YAML/JSON import drawer, reused by every "Import …" extra
 	let importDrawer: Drawer | undefined = $state(undefined)
@@ -427,179 +439,195 @@
 	{/if}
 </div>
 
-{#if $open && active}
+{#if $open}
+	<!-- The positioned element keeps its width while the doc panel toggles: floating-ui
+	     anchors it by its left edge, so a resize would paint one frame at the old left before
+	     the reposition. The visible card grows leftward inside it; the rest ignores the pointer. -->
 	<div
 		use:melt={$menu}
 		data-arrow-loop
-		class="z-[6000] flex flex-row rounded-lg border border-gray-200 dark:border-gray-700 bg-surface shadow-xl focus:outline-none"
+		class="z-[6000] flex flex-row justify-end pointer-events-none focus:outline-none"
 		style={showDoc ? 'width: 780px;' : ''}
+		bind:this={menuEl}
+		onpointerleave={() => {
+			if (!$wacSubOpen) activeKey = undefined
+		}}
 	>
-		{#if showDoc}
-			<!-- explanation of the highlighted editor -->
-			<div class="flex flex-col gap-3 p-5 flex-1 min-w-0">
-				<div class="flex flex-row items-center gap-3">
-					<div
-						class="w-12 h-12 rounded-xl flex items-center justify-center shrink-0 {activeAc.tile}"
-					>
-						<active.icon size={26} class={activeAc.iconText} />
-					</div>
-					<div class="min-w-0">
-						<div class="flex flex-row items-center gap-2">
-							<h3 class="font-semibold text-primary leading-tight">{active.label}</h3>
-							{#if active.badge}
-								<span
-									class="shrink-0 rounded px-1.5 py-0.5 text-[10px] font-semibold uppercase tracking-wide {active
-										.badge.class}"
-								>
-									{active.badge.label}
-								</span>
-							{/if}
-						</div>
-						<p class="text-xs text-tertiary">{active.tagline}</p>
-					</div>
-				</div>
-
-				<p class="text-xs text-secondary leading-relaxed">{active.description}</p>
-
-				<ul class="flex flex-col gap-1.5 mt-1">
-					{#each active.bullets as bullet (bullet)}
-						<li class="flex flex-row items-center gap-2 text-xs text-secondary">
-							<ChevronRight size={14} class={activeAc.iconText} />
-							{bullet}
-						</li>
-					{/each}
-				</ul>
-
-				<button
-					class="mt-auto self-start inline-flex items-center gap-1 pt-2 text-[10px] text-tertiary hover:text-secondary transition-colors"
-					title="Hide descriptions"
-					tabindex={-1}
-					onclick={() => setShowDoc(false)}
-				>
-					<PanelLeftClose size={12} />
-					Hide descriptions
-				</button>
-			</div>
-		{/if}
-
-		<!-- option list -->
-		<div class="flex flex-col gap-0.5 p-2 w-[18rem] shrink-0">
-			{#snippet rowBody(option: Option, ac: (typeof accentClasses)[string])}
-				<div class="w-6 h-6 rounded-md flex items-center justify-center shrink-0 {ac.tile}">
-					<option.icon size={14} class={ac.iconText} />
-				</div>
-				<span class="text-xs font-medium text-primary flex-1 min-w-0 whitespace-nowrap">
-					{option.label}
-				</span>
-				{#if option.badge}
-					<span
-						class="shrink-0 rounded px-1.5 py-0.5 text-[10px] font-semibold uppercase tracking-wide {option
-							.badge.class}"
-					>
-						{option.badge.label}
-					</span>
-				{/if}
-			{/snippet}
-			{#each allOptions as option (option.key)}
-				{@const ac = accentClasses[option.accent]}
-				{@const rowClass =
-					'w-full flex flex-row items-center gap-2.5 rounded-md px-2 py-1.5 text-left cursor-pointer transition-colors focus:outline-none data-[highlighted]:bg-surface-hover hover:bg-surface-hover'}
-				{#if option.variants}
-					<button
-						use:melt={$wacSubTrigger}
-						class={rowClass}
-						onfocusin={() => (activeKey = option.key)}
-						onpointerenter={() => (activeKey = option.key)}
-					>
-						{@render rowBody(option, ac)}
-						<ChevronRight size={14} class="shrink-0 text-tertiary" />
-					</button>
-					{#if $wacSubOpen}
+		<div
+			class="pointer-events-auto flex flex-row rounded-lg border border-gray-200 dark:border-gray-700 bg-surface shadow-xl {showDoc &&
+			active
+				? 'w-full'
+				: ''}"
+		>
+			{#if showDoc && active && activeAc}
+				<!-- explanation of the highlighted editor -->
+				<div class="flex flex-col gap-3 p-5 flex-1 min-w-0">
+					<div class="flex flex-row items-center gap-3">
 						<div
-							use:melt={$wacSubMenu}
-							use:hugViewportRight
-							class="z-[6001] flex flex-col gap-0.5 p-1 w-52 rounded-lg border border-gray-200 dark:border-gray-700 bg-surface shadow-xl focus:outline-none"
+							class="w-12 h-12 rounded-xl flex items-center justify-center shrink-0 {activeAc.tile}"
 						>
-							{#each option.variants ?? [] as variant (variant.label)}
-								{@const VariantIcon = variant.icon}
-								<button
-									use:melt={$item}
-									class="flex flex-row items-center gap-2.5 rounded-md px-2 py-1.5 text-left cursor-pointer transition-colors focus:outline-none data-[highlighted]:bg-surface-hover hover:bg-surface-hover"
-									onclick={() => variant.onSelect()}
-								>
-									<VariantIcon width={14} height={14} />
-									<span class="text-xs font-medium text-primary">{variant.label}</span>
-								</button>
-							{/each}
+							<active.icon size={26} class={activeAc.iconText} />
 						</div>
-					{/if}
-				{:else}
-					<button
-						use:melt={$item}
-						class={rowClass}
-						onfocusin={() => (activeKey = option.key)}
-						onpointerenter={() => (activeKey = option.key)}
-						onclick={() => option.onSelect()}
-					>
-						{@render rowBody(option, ac)}
-					</button>
-				{/if}
-			{/each}
+						<div class="min-w-0">
+							<div class="flex flex-row items-center gap-2">
+								<h3 class="font-semibold text-primary leading-tight">{active.label}</h3>
+								{#if active.badge}
+									<span
+										class="shrink-0 rounded px-1.5 py-0.5 text-[10px] font-semibold uppercase tracking-wide {active
+											.badge.class}"
+									>
+										{active.badge.label}
+									</span>
+								{/if}
+							</div>
+							<p class="text-xs text-tertiary">{active.tagline}</p>
+						</div>
+					</div>
 
-			<!-- bottom import section: one entry whose submenu imports any artifact -->
-			<div class="mx-1 my-1 border-t border-gray-200 dark:border-gray-700"></div>
-			<button
-				use:melt={$importSubTrigger}
-				class="w-full flex flex-row items-center gap-2.5 rounded-md px-2 py-1.5 text-left cursor-pointer transition-colors focus:outline-none data-[highlighted]:bg-surface-hover hover:bg-surface-hover"
-			>
-				<div
-					class="w-6 h-6 rounded-md flex items-center justify-center shrink-0 bg-gray-100 dark:bg-gray-700"
-				>
-					<Import size={14} class="text-gray-600 dark:text-gray-300" />
+					<p class="text-xs text-secondary leading-relaxed">{active.description}</p>
+
+					<ul class="flex flex-col gap-1.5 mt-1">
+						{#each active.bullets as bullet (bullet)}
+							<li class="flex flex-row items-center gap-2 text-xs text-secondary">
+								<ChevronRight size={14} class={activeAc.iconText} />
+								{bullet}
+							</li>
+						{/each}
+					</ul>
+
+					<button
+						class="mt-auto self-start inline-flex items-center gap-1 pt-2 text-[10px] text-tertiary hover:text-secondary transition-colors"
+						title="Hide descriptions"
+						tabindex={-1}
+						onclick={() => setShowDoc(false)}
+					>
+						<PanelLeftClose size={12} />
+						Hide descriptions
+					</button>
 				</div>
-				<span class="text-xs font-medium text-primary flex-1 min-w-0 whitespace-nowrap">
-					Import
-				</span>
-				<ChevronRight size={14} class="shrink-0 text-tertiary" />
-			</button>
-			{#if $importSubOpen}
-				<div
-					use:melt={$importSubMenu}
-					use:hugViewportRight
-					class="z-[6001] flex flex-col gap-0.5 p-1 w-52 rounded-lg border border-gray-200 dark:border-gray-700 bg-surface shadow-xl focus:outline-none"
-				>
-					{#each importActions as action, i (action.label)}
+			{/if}
+
+			<!-- option list -->
+			<div class="flex flex-col gap-0.5 p-2 w-[18rem] shrink-0">
+				{#snippet rowBody(option: Option, ac: (typeof accentClasses)[string])}
+					<div class="w-6 h-6 rounded-md flex items-center justify-center shrink-0 {ac.tile}">
+						<option.icon size={14} class={ac.iconText} />
+					</div>
+					<span class="text-xs font-medium text-primary flex-1 min-w-0 whitespace-nowrap">
+						{option.label}
+					</span>
+					{#if option.badge}
+						<span
+							class="shrink-0 rounded px-1.5 py-0.5 text-[10px] font-semibold uppercase tracking-wide {option
+								.badge.class}"
+						>
+							{option.badge.label}
+						</span>
+					{/if}
+				{/snippet}
+				{#each allOptions as option (option.key)}
+					{@const ac = accentClasses[option.accent]}
+					{@const rowClass =
+						'w-full flex flex-row items-center gap-2.5 rounded-md px-2 py-1.5 text-left cursor-pointer transition-colors focus:outline-none data-[highlighted]:bg-surface-hover hover:bg-surface-hover'}
+					{#if option.variants}
+						<button
+							use:melt={$wacSubTrigger}
+							class={rowClass}
+							onfocusin={() => (activeKey = option.key)}
+							onpointerenter={() => (activeKey = option.key)}
+						>
+							{@render rowBody(option, ac)}
+							<ChevronRight size={14} class="shrink-0 text-tertiary" />
+						</button>
+						{#if $wacSubOpen}
+							<div
+								use:melt={$wacSubMenu}
+								use:hugViewportRight
+								class="pointer-events-auto z-[6001] flex flex-col gap-0.5 p-1 w-52 rounded-lg border border-gray-200 dark:border-gray-700 bg-surface shadow-xl focus:outline-none"
+							>
+								{#each option.variants ?? [] as variant (variant.label)}
+									{@const VariantIcon = variant.icon}
+									<button
+										use:melt={$item}
+										class="flex flex-row items-center gap-2.5 rounded-md px-2 py-1.5 text-left cursor-pointer transition-colors focus:outline-none data-[highlighted]:bg-surface-hover hover:bg-surface-hover"
+										onclick={() => variant.onSelect()}
+									>
+										<VariantIcon width={14} height={14} />
+										<span class="text-xs font-medium text-primary">{variant.label}</span>
+									</button>
+								{/each}
+							</div>
+						{/if}
+					{:else}
 						<button
 							use:melt={$item}
-							class="flex flex-row items-center gap-2.5 rounded-md px-2 py-1.5 text-left cursor-pointer transition-colors focus:outline-none data-[highlighted]:bg-surface-hover hover:bg-surface-hover"
-							onclick={() => action.onSelect()}
+							class={rowClass}
+							onfocusin={() => (activeKey = option.key)}
+							onpointerenter={() => (activeKey = option.key)}
+							onclick={() => option.onSelect()}
 						>
-							{#if onImportHubProject && i === 0}
-								<Store size={14} class="shrink-0 text-tertiary" />
-							{:else}
-								<Import size={14} class="shrink-0 text-tertiary" />
-							{/if}
-							<span class="text-xs font-medium text-primary whitespace-nowrap">
-								{action.label}
-							</span>
+							{@render rowBody(option, ac)}
 						</button>
-						{#if onImportHubProject && i === 0}
-							<div class="mx-1 my-0.5 border-t border-gray-200 dark:border-gray-700"></div>
-						{/if}
-					{/each}
-				</div>
-			{/if}
+					{/if}
+				{/each}
 
-			{#if !showDoc}
+				<!-- bottom import section: one entry whose submenu imports any artifact -->
+				<div class="mx-1 my-1 border-t border-gray-200 dark:border-gray-700"></div>
 				<button
-					class="mt-1 px-2 py-1 text-left text-[10px] text-tertiary/70 hover:text-tertiary hover:underline transition-colors"
-					title="Show descriptions"
-					tabindex={-1}
-					onclick={() => setShowDoc(true)}
+					use:melt={$importSubTrigger}
+					class="w-full flex flex-row items-center gap-2.5 rounded-md px-2 py-1.5 text-left cursor-pointer transition-colors focus:outline-none data-[highlighted]:bg-surface-hover hover:bg-surface-hover"
+					onfocusin={() => (activeKey = undefined)}
+					onpointerenter={() => (activeKey = undefined)}
 				>
-					Show descriptions
+					<div
+						class="w-6 h-6 rounded-md flex items-center justify-center shrink-0 bg-gray-100 dark:bg-gray-700"
+					>
+						<Import size={14} class="text-gray-600 dark:text-gray-300" />
+					</div>
+					<span class="text-xs font-medium text-primary flex-1 min-w-0 whitespace-nowrap">
+						Import
+					</span>
+					<ChevronRight size={14} class="shrink-0 text-tertiary" />
 				</button>
-			{/if}
+				{#if $importSubOpen}
+					<div
+						use:melt={$importSubMenu}
+						use:hugViewportRight
+						class="pointer-events-auto z-[6001] flex flex-col gap-0.5 p-1 w-52 rounded-lg border border-gray-200 dark:border-gray-700 bg-surface shadow-xl focus:outline-none"
+					>
+						{#each importActions as action, i (action.label)}
+							<button
+								use:melt={$item}
+								class="flex flex-row items-center gap-2.5 rounded-md px-2 py-1.5 text-left cursor-pointer transition-colors focus:outline-none data-[highlighted]:bg-surface-hover hover:bg-surface-hover"
+								onclick={() => action.onSelect()}
+							>
+								{#if onImportHubProject && i === 0}
+									<Store size={14} class="shrink-0 text-tertiary" />
+								{:else}
+									<Import size={14} class="shrink-0 text-tertiary" />
+								{/if}
+								<span class="text-xs font-medium text-primary whitespace-nowrap">
+									{action.label}
+								</span>
+							</button>
+							{#if onImportHubProject && i === 0}
+								<div class="mx-1 my-0.5 border-t border-gray-200 dark:border-gray-700"></div>
+							{/if}
+						{/each}
+					</div>
+				{/if}
+
+				{#if !showDoc}
+					<button
+						class="mt-1 px-2 py-1 text-left text-[10px] text-tertiary/70 hover:text-tertiary hover:underline transition-colors"
+						title="Show descriptions"
+						tabindex={-1}
+						onclick={() => setShowDoc(true)}
+					>
+						Show descriptions
+					</button>
+				{/if}
+			</div>
 		</div>
 	</div>
 {/if}
diff --git a/frontend/src/lib/components/home/HomeConnectDrawer.svelte b/frontend/src/lib/components/home/HomeConnectDrawer.svelte
index e7e4a306d9..e08ac2ddea 100644
--- a/frontend/src/lib/components/home/HomeConnectDrawer.svelte
+++ b/frontend/src/lib/components/home/HomeConnectDrawer.svelte
@@ -5,10 +5,12 @@
 	import CopyableCodeBlock from '$lib/components/details/CopyableCodeBlock.svelte'
 	import { Bot, ExternalLink, Terminal } from 'lucide-svelte'
 	import { shell } from 'svelte-highlight/languages'
+	import { mcpTokenUrlDisabled } from '$lib/mcpAuth'
 
 	type ConnectTab = 'cli' | 'mcp'
 
 	let drawer: Drawer | undefined = $state()
+	let tokenUrlDisabled = $state(false)
 	let selectedTab: ConnectTab = $state('cli')
 	let openVersion = $state(0)
 
@@ -24,6 +26,10 @@ wmill sync pull`)
 	export function openDrawer(tab: ConnectTab = 'cli') {
 		selectedTab = tab
 		openVersion += 1
+		// Falls back like CreateToken below, which shows the bare URL when the read fails.
+		void mcpTokenUrlDisabled()
+			.then((v) => (tokenUrlDisabled = v))
+			.catch(() => (tokenUrlDisabled = true))
 		drawer?.openDrawer()
 	}
 
@@ -96,8 +102,13 @@ wmill sync pull`)
 											<div class="flex flex-col gap-1">
 												<h3 class="text-sm font-semibold text-emphasis">MCP URL</h3>
 												<p class="text-xs text-secondary max-w-xl">
-													Generate an MCP server URL for the current workspace and choose which
-													scripts, flows, and endpoints the client can access.
+													{#if tokenUrlDisabled}
+														The MCP server URL for the current workspace. Your client signs in to
+														Windmill to use it.
+													{:else}
+														Generate an MCP server URL for the current workspace and choose which
+														scripts, flows, and endpoints the client can access.
+													{/if}
 												</p>
 											</div>
 
diff --git a/frontend/src/lib/components/home/ItemsList.svelte b/frontend/src/lib/components/home/ItemsList.svelte
index 7038a316fa..f86ec9d5bf 100644
--- a/frontend/src/lib/components/home/ItemsList.svelte
+++ b/frontend/src/lib/components/home/ItemsList.svelte
@@ -20,7 +20,6 @@
 	import type uFuzzy from '@leeoniya/ufuzzy'
 	import {
 		ArrowDownUp,
-		CheckSquare,
 		ChevronsDownUp,
 		ChevronsUpDown,
 		Code2,
@@ -1805,20 +1804,10 @@
 		{/if}
 
 		{#if !loading && !contentActive && !workspaceEmpty}
-			<!-- List controls, between the kind toggle and the searchbar: select mode, tree
-			     view, expand/collapse (tree only), sort. Nothing to select, group or order on
-			     an empty workspace, so the whole row goes. -->
+			<!-- List controls, between the kind toggle and the searchbar: tree view,
+			     expand/collapse (tree only), sort. Nothing to group or order on an empty
+			     workspace, so the whole row goes. -->
 			<div class="flex items-center gap-2">
-				{#if homeSelection.available && !homeSelection.active}
-					<Button
-						startIcon={{ icon: CheckSquare }}
-						iconOnly
-						unifiedSize="xs"
-						variant="default"
-						title="Select items — move, archive, delete or discard several at once"
-						on:click={() => homeSelection.enter()}
-					/>
-				{/if}
 				<Toggle size="xs" bind:checked={treeView} options={{ right: 'Tree view' }} />
 				{#if treeView}
 					<Button
diff --git a/frontend/src/lib/components/home/ListFilters.svelte b/frontend/src/lib/components/home/ListFilters.svelte
index 6fa2865616..1594141ad2 100644
--- a/frontend/src/lib/components/home/ListFilters.svelte
+++ b/frontend/src/lib/components/home/ListFilters.svelte
@@ -4,7 +4,8 @@
 	import type { BadgeColor, BadgeIconProps } from '../common/badge/model'
 	import { appIconComponent } from '../icons'
 	import { integrationDisplayName } from '../resourceTypeDisplay'
-	import { onDestroy, onMount } from 'svelte'
+	import { untrack } from 'svelte'
+	import { useHostedPage } from '../hostedPage'
 
 	interface Props {
 		filters: string[]
@@ -39,42 +40,35 @@
 		inline = false
 	}: Props = $props()
 
-	const queryChange: (value: URL) => void = (url: URL) => {
-		if (syncQuery) {
-			window.history.pushState(history.state, '', `?${url?.searchParams.toString()}`)
-		}
-	}
-
-	const eventListener = (e: PopStateEvent) => {
-		if (syncQuery) {
-			loadFilterFromUrl()
-		}
-	}
-
-	onMount(() => {
-		window.addEventListener('popstate', eventListener)
-	})
-
-	onDestroy(() => {
-		window.removeEventListener('popstate', (e) => eventListener(e))
-	})
-
-	loadFilterFromUrl()
+	const hosted = useHostedPage()
 
 	function loadFilterFromUrl() {
-		let queryValue = new URL(window.location.href).searchParams.get(queryName) ?? undefined
-		selectedFilter = queryValue
+		const search = hosted ? hosted.search : window.location.search
+		selectedFilter = new URLSearchParams(search).get(queryName) ?? undefined
 	}
 
-	export async function setQuery(url: URL, key: string, value: string | undefined): Promise<void> {
-		if (value != undefined) {
-			url.searchParams.set(key, value)
-		} else {
-			url.searchParams.delete(key)
-		}
-		queryChange(url)
+	function writeQuery(value: string | undefined) {
+		if (!syncQuery) return
+		const params = new URLSearchParams(hosted ? hosted.search : window.location.search)
+		if (value != undefined) params.set(queryName, value)
+		else params.delete(queryName)
+		if (hosted) hosted.setSearch(params.size ? `?${params}` : '')
+		else window.history.pushState(history.state, '', `?${params}`)
 	}
 
+	$effect(() => {
+		if (!syncQuery) return
+		if (hosted) {
+			hosted.search
+			untrack(loadFilterFromUrl)
+			return
+		}
+		window.addEventListener('popstate', loadFilterFromUrl)
+		return () => window.removeEventListener('popstate', loadFilterFromUrl)
+	})
+
+	untrack(loadFilterFromUrl)
+
 	let filtersAndSelected = $derived(
 		selectedFilter
 			? filters.includes(selectedFilter)
@@ -109,11 +103,7 @@
 					class="inline-flex items-center gap-1 align-middle"
 					onclick={() => {
 						selectedFilter = selectedFilter == filter ? undefined : filter
-						if (selectedFilter) {
-							setQuery(new URL(window.location.href), queryName, selectedFilter)
-						} else {
-							setQuery(new URL(window.location.href), queryName, undefined)
-						}
+						writeQuery(selectedFilter)
 					}}
 					{color}
 					clickable
diff --git a/frontend/src/lib/components/home/bulkActions.test.ts b/frontend/src/lib/components/home/bulkActions.test.ts
index 4710019671..d69c3b30ff 100644
--- a/frontend/src/lib/components/home/bulkActions.test.ts
+++ b/frontend/src/lib/components/home/bulkActions.test.ts
@@ -56,10 +56,12 @@ describe('blockedReason', () => {
 		expect(blockedReason('unarchive', item({ archived: false }), admin)).toBeDefined()
 	})
 
-	it('routes a draft-only row to discard, never to move/archive/delete', () => {
+	it('lets a draft-only row move or discard, never archive/delete', () => {
 		const draftOnly = item({ draftOnly: true, isDraft: true })
 		expect(blockedReason('discard', draftOnly, admin)).toBeUndefined()
-		expect(blockedReason('move', draftOnly, admin)).toBeDefined()
+		// Moving one rewrites its own draft row (DraftService.moveDraft) — there is
+		// no deployed path, but there is somewhere for it to go.
+		expect(blockedReason('move', draftOnly, admin)).toBeUndefined()
 		expect(blockedReason('archive', draftOnly, admin)).toBeDefined()
 		expect(blockedReason('delete', draftOnly, admin)).toBeDefined()
 	})
@@ -75,4 +77,13 @@ describe('movedPath', () => {
 		expect(movedPath(item({ path: 'f/alpha/sub/x' }), 'f/beta')).toBe('f/beta/sub/x')
 		expect(movedPath(item({ path: 'u/ana/x' }), 'f/beta')).toBe('f/beta/x')
 	})
+
+	it('names a draft-only row by what it displays, not the path it is parked at', () => {
+		const parked = item({
+			draftOnly: true,
+			path: 'u/ana/draft_9f3c',
+			displayPath: 'u/ana/my_script'
+		})
+		expect(movedPath(parked, 'f/beta')).toBe('f/beta/my_script')
+	})
 })
diff --git a/frontend/src/lib/components/home/bulkActions.ts b/frontend/src/lib/components/home/bulkActions.ts
index 161ddb0d72..da88e19121 100644
--- a/frontend/src/lib/components/home/bulkActions.ts
+++ b/frontend/src/lib/components/home/bulkActions.ts
@@ -8,11 +8,21 @@
  * addresses the deployed row. A draft-only item is therefore not deletable —
  * there is nothing deployed at its path.
  */
-import { AppService, FlowService, ScriptService } from '$lib/gen'
+import { AppService, DraftService, FlowService, ScriptService } from '$lib/gen'
+import type { UserDraftItemKind } from '$lib/gen'
 import { updateItemPathAndSummary } from '$lib/components/moveRenameManager'
 import { discardDraft } from '$lib/utils_draft_deploy'
 import type { BulkItem } from './homeSelection.svelte'
 
+/** The draft overlay is the one place a raw app is its own kind. Narrowed to the
+ * four kinds `moveDraft` accepts — a `BulkItem` is never anything else, and
+ * saying so lets the compiler check that rather than trusting it. */
+function draftKind(
+	item: BulkItem
+): Extract<UserDraftItemKind, 'script' | 'flow' | 'app' | 'raw_app'> {
+	return item.kind === 'app' && item.rawApp ? 'raw_app' : item.kind
+}
+
 export type BulkAction = 'move' | 'archive' | 'unarchive' | 'delete' | 'discard'
 
 export type BulkContext = {
@@ -32,7 +42,6 @@ export function blockedReason(
 	const notOwner = 'you are not an owner of this path'
 	switch (action) {
 		case 'move':
-			if (item.draftOnly) return 'a draft-only item has no deployed path to move'
 			if (item.archived) return 'archived items cannot be moved'
 			if (!item.owner) return notOwner
 			if (!item.canWrite) return 'you do not have write permission on this path'
@@ -64,17 +73,35 @@ export function eligible(action: BulkAction, items: BulkItem[], ctx: BulkContext
 	return items.filter((i) => blockedReason(action, i, ctx) == undefined)
 }
 
+/** The path a move reads from. A draft-only item is parked at a generated
+ * storage path but named by what was typed in the editor, and it is that name
+ * the user expects to find under the target. */
+export function sourcePath(item: BulkItem): string {
+	return item.draftOnly ? item.displayPath : item.path
+}
+
 /** Where an item lands under `target` (`f/<folder>` or `u/<user>`): everything
  * below its own owner prefix is preserved, so nested paths keep their shape. */
 export function movedPath(item: BulkItem, target: string): string {
-	const rest = item.path.split('/').slice(2).join('/')
+	const rest = sourcePath(item).split('/').slice(2).join('/')
 	return `${target}/${rest}`
 }
 
 async function moveItem(ctx: BulkContext, item: BulkItem, target: string): Promise<void> {
 	const newPath = movedPath(item, target)
 	// Re-saving a script at its current path would mint a pointless new version.
-	if (newPath === item.path) return
+	if (newPath === sourcePath(item)) return
+	if (item.draftOnly) {
+		// Nothing is deployed at this path, so there is no deploy to re-run: the
+		// item IS its draft row, and moving it rewrites that row.
+		await DraftService.moveDraft({
+			workspace: ctx.workspace,
+			kind: draftKind(item),
+			path: item.path,
+			requestBody: { new_path: newPath }
+		})
+		return
+	}
 	await updateItemPathAndSummary({
 		workspace: ctx.workspace,
 		kind: item.kind,
@@ -117,10 +144,15 @@ async function deleteItem(ctx: BulkContext, item: BulkItem): Promise<void> {
 }
 
 async function discardItemDraft(ctx: BulkContext, item: BulkItem): Promise<void> {
-	// The draft overlay is the one place a raw app is its own kind.
-	const kind = item.kind === 'app' && item.rawApp ? 'raw_app' : item.kind
 	// invalidate=false: the caller refreshes the draft list once for the batch.
-	const res = await discardDraft(kind, item.path, ctx.workspace, item.draftOnly, false, false)
+	const res = await discardDraft(
+		draftKind(item),
+		item.path,
+		ctx.workspace,
+		item.draftOnly,
+		false,
+		false
+	)
 	if (!res.success) throw new Error(res.error ?? 'discard failed')
 }
 
diff --git a/frontend/src/lib/components/home/homeSelection.dom.test.ts b/frontend/src/lib/components/home/homeSelection.dom.test.ts
new file mode 100644
index 0000000000..1e325fa3bd
--- /dev/null
+++ b/frontend/src/lib/components/home/homeSelection.dom.test.ts
@@ -0,0 +1,59 @@
+import { describe, it, expect, beforeEach } from 'vitest'
+import { HomeSelection, type BulkItem } from './homeSelection.svelte'
+
+// A shift-click range resolves its ends through the rendered rows, so these need a
+// document: the keys come back from `[data-row-selection-key]` in visual order.
+function row(key: string): BulkItem {
+	return {
+		key,
+		kind: 'script',
+		path: key.slice('script/'.length),
+		displayPath: key.slice('script/'.length),
+		summary: '',
+		canWrite: true,
+		owner: true,
+		archived: false,
+		draftOnly: false,
+		isDraft: false,
+		rawApp: false
+	}
+}
+
+const a = row('script/f/a/one')
+const b = row('script/f/a/two')
+const c = row('script/f/a/three')
+
+function rendered(...items: BulkItem[]): HomeSelection {
+	document.body.innerHTML = items
+		.map((i) => `<div data-row-selection-key="${i.key}"></div>`)
+		.join('')
+	const s = new HomeSelection()
+	s.available = true
+	for (const i of items) s.register(i)
+	return s
+}
+
+describe('HomeSelection shift-range', () => {
+	beforeEach(() => {
+		document.body.innerHTML = ''
+	})
+
+	it('selects the span between the anchor and the clicked row', () => {
+		const s = rendered(a, b, c)
+		s.toggle(a)
+
+		s.toggle(c, true)
+
+		expect(s.items.map((i) => i.key)).toEqual([a.key, b.key, c.key])
+	})
+
+	it('does not reach back into a selection the user already emptied', () => {
+		const s = rendered(a, b, c)
+		s.toggle(a)
+		s.toggle(a)
+
+		s.toggle(c, true)
+
+		expect(s.items.map((i) => i.key)).toEqual([c.key])
+	})
+})
diff --git a/frontend/src/lib/components/home/homeSelection.svelte.ts b/frontend/src/lib/components/home/homeSelection.svelte.ts
index fa755aabb3..97e2acc9d7 100644
--- a/frontend/src/lib/components/home/homeSelection.svelte.ts
+++ b/frontend/src/lib/components/home/homeSelection.svelte.ts
@@ -77,21 +77,16 @@ export class HomeSelection {
 	/** The page offers multi-selection at all (never to an operator, and not on
 	 * the embedded read-only variants of the list). */
 	available = $state(false)
-	/** Selection mode is on even with nothing selected yet — entered from the
-	 * toolbar, so every row reveals its checkbox before the first pick. */
-	private explicit = $state(false)
 	private selected = new SvelteMap<string, BulkItem>()
 	/** Every rendered selectable row, so a shift-click range can resolve the keys
 	 * between the anchor and the clicked row back to items. */
 	private registry = new SvelteMap<string, BulkItem>()
 	private anchor: string | undefined = undefined
 
+	/** Selection mode lasts exactly as long as something is selected: unticking
+	 * the last row drops back to the normal list. */
 	get active(): boolean {
-		return this.available && (this.explicit || this.selected.size > 0)
-	}
-
-	get size(): number {
-		return this.selected.size
+		return this.available && this.selected.size > 0
 	}
 
 	get items(): BulkItem[] {
@@ -133,12 +128,7 @@ export class HomeSelection {
 		this.registry.delete(key)
 	}
 
-	enter(): void {
-		this.explicit = true
-	}
-
 	exit(): void {
-		this.explicit = false
 		this.selected.clear()
 		this.anchor = undefined
 	}
@@ -155,13 +145,15 @@ export class HomeSelection {
 	}
 
 	toggle(item: BulkItem, range = false): void {
-		this.explicit = true
 		if (range && this.anchor != undefined && this.anchor !== item.key) {
 			if (this.selectRange(this.anchor, item.key)) return
 		}
 		if (this.selected.has(item.key)) this.selected.delete(item.key)
 		else this.selected.set(item.key, item)
-		this.anchor = item.key
+		// Unticking the last row ends selection mode, so the row it was on is not an
+		// anchor any more: the next shift-click would otherwise reach back and select
+		// everything between it and the row the user just started from.
+		this.anchor = this.selected.size === 0 ? undefined : item.key
 	}
 
 	/** Visual order is read back from the DOM: the tree nests rows and pages them
diff --git a/frontend/src/lib/components/hostedPage.ts b/frontend/src/lib/components/hostedPage.ts
new file mode 100644
index 0000000000..424c10c450
--- /dev/null
+++ b/frontend/src/lib/components/hostedPage.ts
@@ -0,0 +1,31 @@
+import { getContext, setContext } from 'svelte'
+
+// A list page mounted somewhere other than its own route — an AI session's preview tab. The
+// document URL there belongs to the host, so the page's view (the filters in its query) has to
+// live wherever the host keeps it, and its rows and links open where the host decides instead of
+// in a drawer or a top-level navigation. Components under such a host read this instead of
+// `window.location`; outside one there is none, and they keep to the document.
+
+export type HostedPage = {
+	/** The page's query, `''` or `?…`. Reactive: the host may re-point it. */
+	readonly search: string
+	/** Replace the page's query. */
+	setSearch(search: string): void
+	/** Open one of the page's rows, by path. */
+	openItem(path: string): void
+	/** Follow an in-app link (base included) the page would otherwise navigate to. */
+	openLink(href: string): void
+}
+
+const KEY = Symbol('hostedPage')
+
+/** Reads context: call during component initialisation. */
+export function setHostedPage(host: HostedPage): void {
+	setContext(KEY, host)
+}
+
+/** The host of this page, or undefined on the page's own route. Reads context: call during
+ * component initialisation. */
+export function useHostedPage(): HostedPage | undefined {
+	return getContext<HostedPage | undefined>(KEY)
+}
diff --git a/frontend/src/lib/components/instanceBanner.ts b/frontend/src/lib/components/instanceBanner.ts
index f1693024b8..4cceb7ad59 100644
--- a/frontend/src/lib/components/instanceBanner.ts
+++ b/frontend/src/lib/components/instanceBanner.ts
@@ -1,5 +1,3 @@
-import { SettingService } from '$lib/gen'
-
 /** Drives the banner palette and icon; the subset of `AlertType` that fits an announcement. */
 export type InstanceBannerSeverity = 'info' | 'warning' | 'error'
 
@@ -123,7 +121,3 @@ export function isInstanceBannerVisible(
 	if (banner == undefined) return false
 	return !banner.dismissible || dismissedFingerprint !== banner.fingerprint
 }
-
-export async function fetchInstanceBanner(): Promise<ResolvedInstanceBanner | undefined> {
-	return resolveInstanceBanner(await SettingService.getGlobal({ key: INSTANCE_BANNER_SETTING }))
-}
diff --git a/frontend/src/lib/components/instanceSettings.ts b/frontend/src/lib/components/instanceSettings.ts
index 34079eae51..92988f53b5 100644
--- a/frontend/src/lib/components/instanceSettings.ts
+++ b/frontend/src/lib/components/instanceSettings.ts
@@ -2,6 +2,8 @@ import type { ButtonType } from './common/button/model'
 import { allowedOriginsSettingError } from './triggers/http/utils'
 import { z } from 'zod'
 import { instanceBannerFormError } from './instanceBanner'
+import { ACCENT_COLOR_SETTING, parseAccentColor } from '$lib/accentColor'
+import { parseMaxTokenExpirationDays } from '$lib/tokenExpiration'
 import { writable } from 'svelte/store'
 
 /**
@@ -71,6 +73,7 @@ export interface Setting {
 		| 'ws_connectivity'
 		| 'retention_overrides'
 		| 'instance_banner'
+		| 'accent_color'
 	storage: SettingStorage
 	advancedToggle?: {
 		label: string
@@ -239,19 +242,6 @@ export const settings: Record<string, Setting[]> = {
 			placeholder: 'only for EE',
 			storage: 'setting'
 		},
-		{
-			label: 'Announcement banner',
-			description:
-				'Message shown above every page of the instance, for maintenance windows and incidents.',
-			key: 'instance_banner',
-			fieldType: 'instance_banner',
-			storage: 'setting',
-			// The banner only renders on the managed cloud, so only offer it there.
-			cloudonly: true,
-			hideInQuickSetup: true,
-			// Gates Save. The card renders the specific message itself, so no `error` here.
-			isValid: (value: any) => instanceBannerFormError(value) == undefined
-		},
 		{
 			label: 'Non-prod instance',
 			description:
@@ -307,6 +297,61 @@ export const settings: Record<string, Setting[]> = {
 			storage: 'setting',
 			ee_only: '',
 			hideInQuickSetup: true
+		},
+		{
+			label: 'Maximum token expiration (days)',
+			key: 'max_token_expiration_days',
+			description:
+				'Furthest ahead an API token a user creates can expire, in days. A token asking for longer, or for no expiration, is created with this expiration instead. Service accounts are exempt, so automation can keep longer-lived credentials. Leave empty to let users pick any expiration, including none.',
+			fieldType: 'number',
+			placeholder: 'no limit',
+			storage: 'setting',
+			hideInQuickSetup: true,
+			error: 'Must be a whole number of days, from 1 to 1,000,000',
+			// The server reads anything else as no ceiling at all.
+			isValid: (value: unknown) =>
+				value === undefined ||
+				value === null ||
+				value === '' ||
+				parseMaxTokenExpirationDays(value) !== undefined
+		},
+		{
+			label: 'Disable token in MCP URLs',
+			description:
+				'Reject the ?token= query parameter on the MCP endpoints, so MCP clients authenticate with an Authorization header or through the OAuth flow. A token in a URL is a credential that ends up in browser history, proxy logs and referrers. Existing MCP URLs carrying a token stop working. Servers and workers pick this up within a minute; dedicated MCP servers (MODE=mcp) apply it when they next restart.',
+			key: 'mcp_disable_token_query_param',
+			fieldType: 'boolean',
+			storage: 'setting',
+			hideInQuickSetup: true
+		},
+		{
+			label: 'Announcement banner',
+			description:
+				'Message shown above every page of the instance, for maintenance windows and incidents.',
+			key: 'instance_banner',
+			fieldType: 'instance_banner',
+			storage: 'setting',
+			// The banner only renders on EE, so the card is disabled without a license.
+			ee_only: '',
+			hideInQuickSetup: true,
+			// Gates Save. The card renders the specific message itself, so no `error` here.
+			isValid: (value: any) => instanceBannerFormError(value) == undefined
+		},
+		{
+			label: 'Accent color',
+			description:
+				'Recolors buttons, selections and the sidebar for every user, so each environment (e.g. staging vs. production) is recognizable at a glance.',
+			key: ACCENT_COLOR_SETTING,
+			fieldType: 'accent_color',
+			storage: 'setting',
+			ee_only: '',
+			hideInQuickSetup: true,
+			error: 'Must be a hex color like #1f9d55',
+			isValid: (value: unknown) =>
+				value === undefined ||
+				value === null ||
+				value === '' ||
+				parseAccentColor(value) !== undefined
 		}
 	],
 	Jobs: [
diff --git a/frontend/src/lib/components/instanceSettings/AccentColorSetting.svelte b/frontend/src/lib/components/instanceSettings/AccentColorSetting.svelte
new file mode 100644
index 0000000000..619d32a7a0
--- /dev/null
+++ b/frontend/src/lib/components/instanceSettings/AccentColorSetting.svelte
@@ -0,0 +1,51 @@
+<script lang="ts">
+	import type { Writable } from 'svelte/store'
+	import Toggle from '../Toggle.svelte'
+	import TextInput from '../text_input/TextInput.svelte'
+	import { ACCENT_COLOR_SETTING, parseAccentColor } from '$lib/accentColor'
+
+	interface Props {
+		values: Writable<Record<string, any>>
+		disabled?: boolean
+	}
+
+	let { values, disabled = false }: Props = $props()
+
+	const DEFAULT_PICK = '#1f9d55'
+
+	let raw = $derived($values[ACCENT_COLOR_SETTING])
+	// An empty value is deleted on save, so it reads as off rather than as an empty color.
+	let enabled = $derived(typeof raw === 'string' && raw !== '')
+</script>
+
+<div class="flex flex-col gap-2">
+	<Toggle
+		{disabled}
+		bind:checked={
+			() => enabled, (v) => ($values[ACCENT_COLOR_SETTING] = v ? DEFAULT_PICK : undefined)
+		}
+		options={{ right: 'Use a custom accent color' }}
+	/>
+	{#if enabled}
+		<div class="flex items-center gap-2">
+			<input
+				type="color"
+				class="!w-16 h-8 shrink-0 cursor-pointer"
+				aria-label="Accent color"
+				{disabled}
+				value={parseAccentColor(raw) ?? DEFAULT_PICK}
+				oninput={(e) => ($values[ACCENT_COLOR_SETTING] = e.currentTarget.value)}
+			/>
+			<div class="w-32">
+				<TextInput
+					inputProps={{ disabled, placeholder: DEFAULT_PICK }}
+					bind:value={() => raw ?? '', (v) => ($values[ACCENT_COLOR_SETTING] = String(v).trim() || undefined)}
+				/>
+			</div>
+		</div>
+		<span class="text-xs text-secondary">
+			Accents keep the default palette's lightness and take this color's hue, so text stays readable
+			whatever color you pick. Applies to every user after saving.
+		</span>
+	{/if}
+</div>
diff --git a/frontend/src/lib/components/jobs/JobPreview.svelte b/frontend/src/lib/components/jobs/JobPreview.svelte
index 972cff6799..7f95ef8f63 100644
--- a/frontend/src/lib/components/jobs/JobPreview.svelte
+++ b/frontend/src/lib/components/jobs/JobPreview.svelte
@@ -15,8 +15,10 @@
 	import { Badge } from '../common'
 	import { forLater } from '$lib/forLater'
 	import DurationMs from '../DurationMs.svelte'
-	import { workspaceStore } from '$lib/stores'
 	import { twMerge } from 'tailwind-merge'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	const POPUP_HEIGHT = 320 as const
 
@@ -115,7 +117,7 @@
 					<span class="text-xs font-normal text-secondary">Arguments</span>
 					<JobArgs
 						id={job?.id}
-						workspace={job?.workspace_id ?? $workspaceStore ?? 'no_w'}
+						workspace={job?.workspace_id ?? $operatingWorkspace ?? 'no_w'}
 						args={job?.args}
 					/>
 				</div>
diff --git a/frontend/src/lib/components/jobs/MissingWorkerTagAlert.svelte b/frontend/src/lib/components/jobs/MissingWorkerTagAlert.svelte
index 6d996e76e4..c6b86b1cc7 100644
--- a/frontend/src/lib/components/jobs/MissingWorkerTagAlert.svelte
+++ b/frontend/src/lib/components/jobs/MissingWorkerTagAlert.svelte
@@ -2,9 +2,11 @@
 	import { base } from '$app/paths'
 	import Alert from '$lib/components/common/alert/Alert.svelte'
 	import { WorkerService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { resource } from 'runed'
 	import { hasWorkerForTag } from './missingWorker'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		/** Worker tag the feature's jobs run on. */
@@ -17,7 +19,7 @@
 
 	let { tag, subject, workspace = undefined, class: className = '' }: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	// With per-workspace default tags, jobs run on a workspace-suffixed variant of
 	// `tag`, so probing the bare tag would warn about a tag nothing uses. The
diff --git a/frontend/src/lib/components/meltComponents/Menu.svelte b/frontend/src/lib/components/meltComponents/Menu.svelte
index 4a821ceacc..ab6de64123 100644
--- a/frontend/src/lib/components/meltComponents/Menu.svelte
+++ b/frontend/src/lib/components/meltComponents/Menu.svelte
@@ -176,6 +176,9 @@
 	}
 
 	async function getMenuElements(): Promise<HTMLElement[]> {
+		// Runs on every pointerdown anywhere, for every mounted menu. Skip the
+		// whole-document query when the outside handler below cannot act anyway.
+		if (!usePointerDownOutside || !open) return []
 		// Tooltip content counts as menu territory for the same reason as the
 		// onOutsideClick veto above.
 		return Array.from(
diff --git a/frontend/src/lib/components/meltComponents/Popover.svelte b/frontend/src/lib/components/meltComponents/Popover.svelte
index 6a6b7d681b..dd69d16917 100644
--- a/frontend/src/lib/components/meltComponents/Popover.svelte
+++ b/frontend/src/lib/components/meltComponents/Popover.svelte
@@ -194,6 +194,9 @@
 	}
 
 	async function getMenuElements(): Promise<HTMLElement[]> {
+		// Runs on every pointerdown anywhere, for every mounted popover. Skip the
+		// whole-document query when the outside handler below cannot act anyway.
+		if (!usePointerDownOutside || (!isOpen && !fullScreen)) return []
 		const selector = excludeSelectors ? `[data-popover], ${excludeSelectors}` : '[data-popover]'
 		return Array.from(document.querySelectorAll(selector)) as HTMLElement[]
 	}
diff --git a/frontend/src/lib/components/metrics/MetricsDrawer.svelte b/frontend/src/lib/components/metrics/MetricsDrawer.svelte
index cdc640fba8..223b490041 100644
--- a/frontend/src/lib/components/metrics/MetricsDrawer.svelte
+++ b/frontend/src/lib/components/metrics/MetricsDrawer.svelte
@@ -2,7 +2,6 @@
 	import { Drawer, DrawerContent, Button, ClearableInput } from '$lib/components/common'
 	import Toggle from '$lib/components/Toggle.svelte'
 	import { DataMetricService, type DataMetric } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { SvelteSet } from 'svelte/reactivity'
 	import {
 		attachAliasFor,
@@ -16,6 +15,9 @@
 	import { Copy, Play } from 'lucide-svelte'
 	import SqlRepl from '$lib/components/SqlRepl.svelte'
 	import SimpleAgTable from '$lib/components/SimpleAgTable.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let {
 		getCode,
@@ -27,7 +29,7 @@
 		workspace?: string
 	} = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	let drawer: Drawer | undefined = $state()
 	let entries = $state<DataMetric[]>([])
diff --git a/frontend/src/lib/components/moveRenameManager.ts b/frontend/src/lib/components/moveRenameManager.ts
index 12cc009cb7..1500f8fc69 100644
--- a/frontend/src/lib/components/moveRenameManager.ts
+++ b/frontend/src/lib/components/moveRenameManager.ts
@@ -21,6 +21,11 @@ export async function checkFlowOnBehalfOf(
  *
  * Note: on_behalf_of_email is intentionally omitted from flow updates for security
  * reasons — the backend will redeploy the flow on behalf of the current user.
+ *
+ * `skip_draft_deletion` on every call: this re-deploys the DEPLOYED content at a
+ * new path, so the caller's draft is unrelated work, not the thing being
+ * deployed. Without the flag the backend would delete it. The backend carries
+ * every remaining draft at the old path over to the new one.
  */
 export async function updateItemPathAndSummary(opts: {
 	workspace: string
@@ -47,7 +52,8 @@ export async function updateItemPathAndSummary(opts: {
 				dedicated_worker: flow.dedicated_worker,
 				ws_error_handler_muted: flow.ws_error_handler_muted,
 				visible_to_runner_only: flow.visible_to_runner_only,
-				labels
+				labels,
+				skip_draft_deletion: true
 			}
 		})
 	} else if (kind === 'script') {
@@ -61,7 +67,8 @@ export async function updateItemPathAndSummary(opts: {
 				lock: script.lock,
 				parent_hash: script.hash,
 				path: newPath,
-				labels
+				labels,
+				skip_draft_deletion: true
 			}
 		})
 	} else if (kind === 'app') {
@@ -71,7 +78,8 @@ export async function updateItemPathAndSummary(opts: {
 			requestBody: {
 				path: newPath !== initialPath ? newPath : undefined,
 				summary: newSummary,
-				labels
+				labels,
+				skip_draft_deletion: true
 			}
 		})
 	}
diff --git a/frontend/src/lib/components/operatingWorkspace.svelte.ts b/frontend/src/lib/components/operatingWorkspace.svelte.ts
new file mode 100644
index 0000000000..93a7f2c0de
--- /dev/null
+++ b/frontend/src/lib/components/operatingWorkspace.svelte.ts
@@ -0,0 +1,48 @@
+import { getContext, setContext } from 'svelte'
+import { fromStore, toStore, type Readable } from 'svelte/store'
+import { workspaceStore } from '$lib/stores'
+import { withWorkspaceParam } from './sessions/sessionMode.svelte'
+import { useActingUser } from '$lib/actingUser.svelte'
+
+// The workspace a subtree acts on. An AI session edits its (possibly forked) workspace while
+// `workspaceStore` stays on the navigation workspace, and a component that reads the navigation
+// store directly writes to the parent from inside a fork's editor. So the hosts that embed an
+// editor for another workspace set it once, and every component under them reads
+// `useOperatingWorkspace()` instead of `$workspaceStore` — nothing has to thread it through props.
+// Outside such a host it is the navigation store itself.
+
+const KEY = Symbol('operatingWorkspace')
+const navigation = fromStore(workspaceStore)
+
+/** Declare the workspace this subtree acts on. A getter, read wherever the workspace is used;
+ * resolving to nothing defers to the enclosing host. Reads context: call during component
+ * initialisation. */
+export function setOperatingWorkspace(resolve: () => string | undefined): void {
+	const outer = getContext<(() => string | undefined) | undefined>(KEY)
+	setContext(KEY, outer ? () => resolve() ?? outer() : resolve)
+}
+
+/** The workspace this component acts on, as a store. Reads context: call during component
+ * initialisation. Falls back to the navigation workspace where no host set one, or where the
+ * host's resolves to nothing. */
+export function useOperatingWorkspace(): Readable<string | undefined> {
+	const resolve = getContext<(() => string | undefined) | undefined>(KEY)
+	return resolve ? toStore(() => resolve() ?? navigation.current) : workspaceStore
+}
+
+/** The user acting in this subtree's operating workspace: `$userStore` describes the navigation
+ * workspace, so a permission check reading it inside a fork's editor answers about the parent —
+ * enabling or disabling controls by the wrong roles. Unresolved reads as unknown, which
+ * `canWrite`/`isOwner` refuse; ask `resolved` before rendering that as a denial. Reads context
+ * and registers an effect: call during component initialisation. */
+export function useOperatingUser(): ReturnType<typeof useActingUser> {
+	const operating = fromStore(useOperatingWorkspace())
+	return useActingUser(() => operating.current)
+}
+
+/** Stamps this component's operating workspace onto an in-app link, which otherwise opens in
+ * the navigation workspace. Reads context: call during component initialisation. */
+export function useOperatingWorkspaceHref(): (href: string) => string {
+	const operating = fromStore(useOperatingWorkspace())
+	return (href) => withWorkspaceParam(href, operating.current)
+}
diff --git a/frontend/src/lib/components/operatingWorkspace.test.ts b/frontend/src/lib/components/operatingWorkspace.test.ts
new file mode 100644
index 0000000000..1c14aa7262
--- /dev/null
+++ b/frontend/src/lib/components/operatingWorkspace.test.ts
@@ -0,0 +1,119 @@
+import { existsSync, readFileSync } from 'node:fs'
+import { dirname, join, relative, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { describe, expect, it } from 'vitest'
+
+const components = dirname(fileURLToPath(import.meta.url))
+const lib = dirname(components)
+
+// The editors an AI session mounts for its own, possibly forked, workspace. Everything they
+// render acts on that workspace, so a component reading the navigation store directly writes
+// to the parent from inside a fork's editor — and nothing at runtime would say so.
+const SESSION_EDITORS = [
+	'sessions/ScriptEditorView.svelte',
+	'sessions/FlowEditorView.svelte',
+	'sessions/RawAppEditorView.svelte',
+	'sessions/PipelineEditorView.svelte',
+	'sessions/PageItemEditorView.svelte'
+]
+
+// Components that read the navigation store on purpose, with why. Keep each reason true.
+const NAVIGATION_READERS: Record<string, string> = {
+	'ScriptBuilder.svelte': 'keeps its own tag list when it acts off the navigation workspace',
+	'WorkerTagSelect.svelte': 'the shared worker tag cache is navigation-scoped',
+	'WorkerTagPicker.svelte': 'the shared worker tag cache is navigation-scoped',
+	'flows/content/FlowModuleWorkerTagSelect.svelte':
+		'the shared worker tag cache is navigation-scoped',
+	'FolderPicker.svelte': '`$userStore` describes the navigation workspace',
+	'FolderEditor.svelte': '`$userStore` describes the navigation workspace'
+}
+
+// Followed through plain modules too: a barrel like `$lib/components/common` is how most
+// components are reached.
+function resolveImport(from: string, spec: string): string | undefined {
+	const target = spec.startsWith('$lib/')
+		? join(lib, spec.slice('$lib/'.length))
+		: spec.startsWith('.')
+			? resolve(dirname(from), spec)
+			: undefined
+	if (!target || target.includes('/gen/')) return undefined
+	const candidates = [target, `${target}.ts`, `${target}.svelte.ts`, join(target, 'index.ts')]
+	return candidates.find((c) => /\.(svelte|ts|js)$/.test(c) && existsSync(c))
+}
+
+function reachableComponents(): string[] {
+	const seen = new Set<string>()
+	const queue = SESSION_EDITORS.map((f) => join(components, f))
+	while (queue.length) {
+		const file = queue.pop()!
+		if (seen.has(file)) continue
+		seen.add(file)
+		const source = readFileSync(file, 'utf-8')
+		for (const m of source.matchAll(/(?:from\s+|import\(\s*)['"]([^'"]+)['"]/g)) {
+			const next = resolveImport(file, m[1])
+			if (next) queue.push(next)
+		}
+	}
+	return [...seen].filter((f) => f.endsWith('.svelte')).map((f) => relative(components, f))
+}
+
+// Module scripts have no component context to read the operating workspace from, so what
+// they fetch takes its workspace explicitly; only instance code and markup are checked.
+function instanceCode(file: string): string {
+	return readFileSync(join(components, file), 'utf-8')
+		.replace(/<script\b[^>]*\bmodule\b[^>]*>[\s\S]*?<\/script>/g, '')
+		.replace(/<!--[\s\S]*?-->|\/\*[\s\S]*?\*\/|(^|[^:])\/\/.*$/gm, '$1')
+}
+
+function readsNavigationStore(file: string): boolean {
+	return /\$workspaceStore\b|\bget\(workspaceStore\)/.test(instanceCode(file))
+}
+
+// Roles are per workspace, so a permission judged from `$userStore` inside a fork's editor
+// answers about the parent: it disables edits the user may make, or offers ones the backend
+// then refuses. Identity (username, email) is the same person in either, and stays.
+// Following one alias, the shape that slipped past this before: `let user = $derived(… $userStore
+// …)` with the permission checks reading `user`. Aliasing the navigation user for identity —
+// their username, or which workspace they are on — is fine and stays.
+function judgesByAliasedNavigationUser(code: string): boolean {
+	const aliases = [...code.matchAll(/(?:let|const)\s+(\w+)\s*=\s*\$derived[^\n]*\$userStore/g)].map(
+		(m) => m[1]
+	)
+	return aliases.some((name) =>
+		new RegExp(
+			`${name}(?:\\?|!)?\\.(?:is_admin|is_super_admin|operator|folders|groups)\\b|canWrite\\((?:[^()]|\\([^()]*\\))*?\\b${name}\\b|isOwner\\((?:[^()]|\\([^()]*\\))*?\\b${name}\\b`
+		).test(code)
+	)
+}
+
+const PERMISSION_READ =
+	/canWrite\((?:[^()]|\([^()]*\))*?\$userStore|isOwner\((?:[^()]|\([^()]*\))*?\$userStore|\$userStore(?:\?|!)?\.(?:is_admin|is_super_admin|operator|folders|groups)\b/
+
+// Components that judge by the navigation user on purpose, with why.
+const NAVIGATION_JUDGES: Record<string, string> = {
+	'FolderPicker.svelte':
+		'resolves the target workspace’s member itself, and asks `$userStore` only for the navigation one',
+	'FolderEditor.svelte':
+		'resolves the target workspace’s member itself, and asks `$userStore` only for the navigation one'
+}
+
+describe('components under a session editor', () => {
+	it('read the operating workspace, not the navigation store', () => {
+		const reachable = reachableComponents()
+		// A walk that finds nothing would pass vacuously.
+		expect(reachable).toContain('triggers/http/RouteEditorInner.svelte')
+		const offenders = reachable.filter((f) => !(f in NAVIGATION_READERS) && readsNavigationStore(f))
+		expect(offenders).toEqual([])
+	})
+
+	it('judge permissions by the user acting in that workspace', () => {
+		const reachable = reachableComponents()
+		expect(reachable).toContain('triggers/PermissionedAsLine.svelte')
+		const offenders = reachable.filter((f) => {
+			if (f in NAVIGATION_JUDGES) return false
+			const code = instanceCode(f)
+			return PERMISSION_READ.test(code) || judgesByAliasedNavigationUser(code)
+		})
+		expect(offenders).toEqual([])
+	})
+})
diff --git a/frontend/src/lib/components/progressBar/ProgressBar.svelte b/frontend/src/lib/components/progressBar/ProgressBar.svelte
index 1bf99d0e91..77e21dc205 100644
--- a/frontend/src/lib/components/progressBar/ProgressBar.svelte
+++ b/frontend/src/lib/components/progressBar/ProgressBar.svelte
@@ -4,6 +4,7 @@
 	import { twMerge } from 'tailwind-merge'
 	import { Loader2 } from 'lucide-svelte'
 	import { fade } from 'svelte/transition'
+	import type { Snippet } from 'svelte'
 
 	// Remove padding/margin, border radius and titles
 
@@ -36,6 +37,8 @@
 		isScheduled?: boolean
 		// Whether the job was skipped (early-stop labelled as skipped)
 		isSkipped?: boolean
+		/** Rendered after "Error occurred" when the bar is in its error state. */
+		errorAction?: Snippet
 	}
 
 	let {
@@ -56,7 +59,8 @@
 		isWaitingForEvents = false,
 		isCanceled = false,
 		isScheduled = false,
-		isSkipped = false
+		isSkipped = false,
+		errorAction
 	}: Props = $props()
 	let duration = 200
 
@@ -148,7 +152,7 @@
 		<div
 			class="flex justify-between items-end font-medium transition-colors duration-300 ease-in-out {error !=
 				undefined || isCanceled
-				? 'text-red-700 dark:text-red-200'
+				? 'text-red-600 dark:text-red-400'
 				: 'text-blue-700 dark:text-blue-200'}"
 		>
 			<div class={twMerge(slim ? 'text-xs' : 'text-sm', 'flex items-center gap-1')}>
@@ -184,6 +188,9 @@
 						{/if}
 					</span>
 				{/key}
+				{#if status == 'error' && errorAction}
+					{@render errorAction()}
+				{/if}
 			</div>
 			<span
 				class={twMerge(slim ? 'text-xs' : 'text-sm', 'transition-all duration-200 ease-in-out')}
diff --git a/frontend/src/lib/components/propertyPicker/ObjectViewer.svelte b/frontend/src/lib/components/propertyPicker/ObjectViewer.svelte
index 9746991d6b..d9684430c5 100644
--- a/frontend/src/lib/components/propertyPicker/ObjectViewer.svelte
+++ b/frontend/src/lib/components/propertyPicker/ObjectViewer.svelte
@@ -26,13 +26,15 @@
 		Braces
 	} from 'lucide-svelte'
 	import S3FilePicker from '../S3FilePicker.svelte'
-	import { workspaceStore } from '$lib/stores'
 	import AnimatedButton from '$lib/components/common/button/AnimatedButton.svelte'
 	import Popover from '../Popover.svelte'
 	import { twMerge } from 'tailwind-merge'
 	import ContextMenu, {
 		type ContextMenuItem
 	} from '$lib/components/common/contextmenu/ContextMenu.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		json: any
@@ -408,16 +410,14 @@
 					<div class="flex">
 						<span class="text-primary">{closeBracket}</span>
 						{#if getTypeAsString(jsonFiltered) === 's3object'}
-							{@const s3DownloadApiPath = `/w/${$workspaceStore}/job_helpers/download_s3_file?file_key=${encodeURIComponent(jsonFiltered?.s3 ?? '')}${jsonFiltered?.storage ? `&storage=${jsonFiltered.storage}` : ''}`}
+							{@const s3DownloadApiPath = `/w/${$operatingWorkspace}/job_helpers/download_s3_file?file_key=${encodeURIComponent(jsonFiltered?.s3 ?? '')}${jsonFiltered?.storage ? `&storage=${jsonFiltered.storage}` : ''}`}
 							{@const s3DownloadName = jsonFiltered?.s3.split('/').pop() ?? 'unnamed_download.file'}
 							{#if shouldDownloadViaClient()}
 								<button
 									class="text-secondary underline font-semibold text-2xs whitespace-nowrap ml-1 w-fit"
 									onclick={() => downloadViaClient(s3DownloadApiPath, s3DownloadName)}
 								>
-									<span class="flex items-center gap-1"
-										><Download size={12} />download</span
-									>
+									<span class="flex items-center gap-1"><Download size={12} />download</span>
 								</button>
 							{:else}
 								<a
@@ -425,9 +425,7 @@
 									href={`/api${s3DownloadApiPath}`}
 									download={s3DownloadName}
 								>
-									<span class="flex items-center gap-1"
-										><Download size={12} />download</span
-									>
+									<span class="flex items-center gap-1"><Download size={12} />download</span>
 								</a>
 							{/if}
 							<button
diff --git a/frontend/src/lib/components/propertyPicker/PropPicker.svelte b/frontend/src/lib/components/propertyPicker/PropPicker.svelte
index ae02462942..b80a13de1d 100644
--- a/frontend/src/lib/components/propertyPicker/PropPicker.svelte
+++ b/frontend/src/lib/components/propertyPicker/PropPicker.svelte
@@ -1,6 +1,5 @@
 <script lang="ts">
 	import { ResourceService, VariableService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { getContext, onDestroy, untrack } from 'svelte'
 	import { Badge, Button } from '../common'
 	import type { PropPickerWrapperContext } from '../flows/propPicker/PropPickerWrapper.svelte'
@@ -12,6 +11,9 @@
 	import { filterNestedObject } from '../flows/previousResults'
 	import type { PropPickerContext } from '../prop_picker'
 	import Scrollable from '../Scrollable.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		pickableProperties: PickableProperties
@@ -101,7 +103,7 @@
 		variables = Object.fromEntries(
 			(
 				await VariableService.listVariable({
-					workspace: $workspaceStore ?? ''
+					workspace: $operatingWorkspace ?? ''
 				})
 			).map((variable) => [variable.path, variable.is_secret ? '***' : (variable.value ?? '')])
 		)
@@ -111,7 +113,7 @@
 		resources = Object.fromEntries(
 			(
 				await ResourceService.listResource({
-					workspace: $workspaceStore ?? ''
+					workspace: $operatingWorkspace ?? ''
 				})
 			).map((resource) => [resource.path, resource.description ?? ''])
 		)
diff --git a/frontend/src/lib/components/raw_apps/DefaultDatabaseSelector.svelte b/frontend/src/lib/components/raw_apps/DefaultDatabaseSelector.svelte
index 66e3ab0355..c4d6d47269 100644
--- a/frontend/src/lib/components/raw_apps/DefaultDatabaseSelector.svelte
+++ b/frontend/src/lib/components/raw_apps/DefaultDatabaseSelector.svelte
@@ -2,24 +2,26 @@
 	import { Settings } from 'lucide-svelte'
 	import Popover from '$lib/components/meltComponents/Popover.svelte'
 	import Select from '$lib/components/select/Select.svelte'
-	import { workspaceStore } from '$lib/stores'
 	import {
+		createDatatableAccessResource,
 		createDatatablesResource,
-		createSchemasResource,
 		toDatatableItems,
 		toSchemaItems
 	} from './datatableUtils.svelte'
 	import { Button } from '../common'
-	import { getRawAppOperatingWorkspace } from './rawAppWorkspace'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+	import { appDatatableRole } from './dataTableRefUtils'
 
-	const getOpWs = getRawAppOperatingWorkspace()
-	let opWs = $derived(getOpWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	let opWs = $derived($operatingWorkspace)
 
 	interface Props {
 		/** Currently selected datatable */
 		datatable: string | undefined
 		/** Currently selected schema */
 		schema: string | undefined
+		/** The role the app uses each data table through: schemas are listed as that role. */
+		roles?: Record<string, string>
 		/** Callback when either value changes */
 		onChange?: (datatable: string | undefined, schema: string | undefined) => void
 		/** Description text to show in the popover */
@@ -29,19 +31,31 @@
 	let {
 		datatable,
 		schema,
+		roles,
 		onChange,
 		description = 'Set the default datatable and schema for new tables. This is where AI will create new tables when needed.'
 	}: Props = $props()
 
+	const role = $derived(datatable ? appDatatableRole(roles, datatable) : undefined)
+
 	// Load available datatables and schemas using shared utilities
 	const datatables = createDatatablesResource(() => opWs)
-	const schemas = createSchemasResource(
+	const access = createDatatableAccessResource(
 		() => datatable,
+		() => role,
 		() => opWs
 	)
 
 	const datatableItems = $derived(toDatatableItems(datatables.current))
-	const schemaItems = $derived(toSchemaItems(schemas.current))
+	// Until the answer is for this workspace, data table and role, the schemas in hand belong to
+	// another.
+	const schemaItems = $derived(
+		access.current.workspace === opWs &&
+			access.current.datatable === datatable &&
+			access.current.role === role
+			? toSchemaItems(access.current.schemas)
+			: []
+	)
 
 	// Track datatable changes to reset schema
 	let previousDatatable = $state<string | undefined>(undefined)
@@ -82,6 +96,9 @@
 					placeholder="Select database"
 					size="sm"
 				/>
+				{#if role}
+					<span class="text-2xs text-tertiary">Used as role {role}</span>
+				{/if}
 			</div>
 
 			<div class="flex flex-col gap-1">
diff --git a/frontend/src/lib/components/raw_apps/RawAppDataTableDrawer.svelte b/frontend/src/lib/components/raw_apps/RawAppDataTableDrawer.svelte
index 5f0488638d..7ccf89a275 100644
--- a/frontend/src/lib/components/raw_apps/RawAppDataTableDrawer.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppDataTableDrawer.svelte
@@ -1,35 +1,50 @@
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import { WorkspaceService } from '$lib/gen'
+	import { listUsableDatatableRoles } from '../datatableUsableRoles'
 	import Drawer from '../common/drawer/Drawer.svelte'
 	import DrawerContent from '../common/drawer/DrawerContent.svelte'
 	import Button from '../common/button/Button.svelte'
-	import Select from '../select/Select.svelte'
 	import { sendUserToast } from '$lib/toast'
-	import type { DataTableRef } from './dataTableRefUtils'
+	import { appDatatableRole, type DataTableRef } from './dataTableRefUtils'
+	import { untrack } from 'svelte'
 	import { resource } from 'runed'
-	import { ArrowLeft, Expand, LoaderCircle, Minimize, Plus, RefreshCcw } from 'lucide-svelte'
+	import { ArrowLeft, Expand, Minimize, Plus, RefreshCcw } from 'lucide-svelte'
 	import DBManagerContent from '../DBManagerContent.svelte'
-	import type { DbInput } from '../dbTypes'
-	import type { SelectedTable } from '../DBManager.svelte'
-	import { getRawAppOperatingWorkspace } from './rawAppWorkspace'
+	import {
+		ADMIN_DATATABLE_ROLE,
+		datatableNameTakesRole,
+		defaultMigrationRole,
+		type DbInput
+	} from '../dbTypes'
+	import type { PendingRowAction, SelectedTable } from '../DBManager.svelte'
 	import { useDbManagerTag } from '../dbManagerTag.svelte'
 	import DbWorkerTagButton from '../DbWorkerTagButton.svelte'
+	import type { DataTableTables } from '$lib/gen'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
-	const getOpWs = getRawAppOperatingWorkspace()
-	let opWs = $derived(getOpWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	let opWs = $derived($operatingWorkspace)
 
 	interface Props {
-		onAdd?: (ref: DataTableRef) => void
+		/** `roles` holds, for each added table's data table under roles, the role its tables were
+		 * browsed as: the app uses the data table through it from then on. `roleChanged` names the
+		 * data tables the app now uses through another role than before (its stored role, or the
+		 * data table's default when it stored none): their existing refs are replaced, since the new
+		 * role may not reach them. */
+		onAdd?: (refs: DataTableRef[], roles: Record<string, string>, roleChanged: Set<string>) => void
 		existingRefs?: DataTableRef[]
+		/** The role the app uses each data table through, by data table name */
+		roles?: Record<string, string>
 		/** Z-index offset for the drawer, useful when opening from within modals */
 		offset?: number
 	}
 
-	let { onAdd, existingRefs = [], offset = 0 }: Props = $props()
+	let { onAdd, existingRefs = [], roles = undefined, offset = 0 }: Props = $props()
 
 	let open = $state(false)
 	let selectedDatatable = $state<string | undefined>(undefined)
+	/** Role the manager connects as; undefined means the data table's default. */
+	let selectedRole = $state<string | undefined>(undefined)
 
 	// For DB manager
 	let dbManagerContent: DBManagerContent | undefined = $state()
@@ -39,10 +54,19 @@
 
 	// Multi-select mode: selected tables
 	let selectedTables = $state<SelectedTable[]>([])
+	/** The role each data table's selected tables were browsed as. */
+	let browsedRoles = $state<Record<string, string>>({})
+
+	// Survives the re-mount a data table switch causes.
+	let pendingAction = $state<PendingRowAction | undefined>(undefined)
 
 	// Selected schema/table from DBManager (for preview)
 	let selectedSchemaKey = $state<string | undefined>(undefined)
 	let selectedTableKey = $state<string | undefined>(undefined)
+	// What the manager opens on, set only when it (re-)mounts: the live selection above changes
+	// on every click, and feeding it to the input would reload the whole manager each time.
+	let openSchemaKey = $state<string | undefined>(undefined)
+	let openTableKey = $state<string | undefined>(undefined)
 
 	// Load available datatables from workspace
 	const datatables = resource<string[]>([], async () => {
@@ -55,32 +79,197 @@
 		}
 	})
 
-	export function openDrawer() {
-		// Auto-select first datatable if only one exists
-		if (datatables.current.length === 1) {
-			selectedDatatable = datatables.current[0]
-		} else if (datatables.current.length > 1 && datatables.current.includes('main')) {
-			selectedDatatable = 'main'
-		} else {
-			selectedDatatable = undefined
+	const usableRoles = resource(
+		() => [open, opWs, selectedDatatable] as const,
+		async ([isOpen, workspace, datatable]) => {
+			if (!isOpen || !workspace || !datatable) return undefined
+			try {
+				return {
+					workspace,
+					datatable,
+					...(await listUsableDatatableRoles(workspace, datatable))
+				}
+			} catch (e) {
+				// Opens anyway: without a role the server connects as the default and says so if
+				// that is refused.
+				console.error('Failed to load datatable roles:', e)
+				return {
+					workspace,
+					datatable,
+					permissioned: false,
+					roles: [] as string[],
+					default_role: ADMIN_DATATABLE_ROLE
+				}
+			}
 		}
+	)
+
+	// A resource keeps its previous value while it refetches, and roles are per data table of one
+	// workspace: a fork and its parent both have a `main`, with their own roles on it.
+	const rolesOfCurrent = $derived(
+		usableRoles.current?.datatable === selectedDatatable && usableRoles.current?.workspace === opWs
+			? usableRoles.current
+			: undefined
+	)
+
+	// Mounting the manager fires its first queries, so it waits for the role: a round sent
+	// without one runs, and caches, as whatever the server defaults to.
+	const roleSettled = $derived(
+		selectedDatatable === undefined ||
+			(rolesOfCurrent !== undefined &&
+				(!rolesOfCurrent.permissioned ||
+					rolesOfCurrent.roles.length === 0 ||
+					selectedRole !== undefined ||
+					// Its reference cannot name a role, so it connects as the default one.
+					!datatableNameTakesRole(selectedDatatable)))
+	)
+
+	$effect(() => {
+		const current = rolesOfCurrent
+		if (
+			!current?.permissioned ||
+			selectedRole !== undefined ||
+			(selectedDatatable !== undefined && !datatableNameTakesRole(selectedDatatable))
+		)
+			return
+		const effective = current.roles.includes(current.default_role)
+			? current.default_role
+			: current.roles[0]
+		const datatable = selectedDatatable
+		if (effective && datatable) untrack(() => connectAs(datatable, effective))
+	})
+
+	// Every data table with its schemas and tables: the tree is the picker. The privileges it
+	// reports are the connected role's, so the role picked on the open data table is asked too.
+	// Waits for the role like the manager does, and drops an answer for a selection that has
+	// since changed: it would describe another role.
+	let datatableTreeRun = 0
+	const datatableTree = resource(
+		() => [open, opWs, selectedDatatable, selectedRole, roleSettled] as const,
+		async ([isOpen, workspace, roleFor, role, settled]): Promise<DataTableTables[]> => {
+			if (!isOpen || !workspace) return []
+			if (!settled) return untrack(() => datatableTree.current)
+			const run = ++datatableTreeRun
+			try {
+				const result = await WorkspaceService.listDataTableTables({
+					workspace,
+					roleFor: role ? roleFor : undefined,
+					role
+				})
+				return run === datatableTreeRun ? result : untrack(() => datatableTree.current)
+			} catch (e) {
+				console.error('Failed to load datatable tables:', e)
+				return run === datatableTreeRun ? [] : untrack(() => datatableTree.current)
+			}
+		},
+		{ initialValue: [] }
+	)
+
+	/** The role a table of `datatable` is seen through right now: the connected data table's
+	 * picked role, or the default role the tree lists any other one as. */
+	function roleSeenFor(datatable: string): string | undefined {
+		if (!datatableNameTakesRole(datatable)) return undefined
+		if (datatable === selectedDatatable) {
+			return rolesOfCurrent?.permissioned ? selectedRole : undefined
+		}
+		const entry = datatableTree.current.find((t) => t.datatable_name === datatable)
+		return entry?.permissioned ? entry.default_role : undefined
+	}
+
+	function defaultRoleOf(datatable: string): string | undefined {
+		if (datatable === selectedDatatable && rolesOfCurrent?.permissioned) {
+			return rolesOfCurrent.default_role
+		}
+		const entry = datatableTree.current.find((t) => t.datatable_name === datatable)
+		return entry?.permissioned ? entry.default_role : undefined
+	}
+
+	const tableDatatable = (t: SelectedTable) => t.datatable ?? selectedDatatable
+
+	/** Stamps each newly selected table with the role it was seen through. A data table's
+	 * selections all come from one role, since the app uses it through one: picking a table under
+	 * another role drops the ones picked under the previous, which that role may not reach. */
+	function setSelectedTables(next: SelectedTable[]) {
+		const isNew = (t: SelectedTable) =>
+			!selectedTables.some(
+				(s) =>
+					tableDatatable(s) === tableDatatable(t) && s.schema === t.schema && s.table === t.table
+			)
+		const added = next.filter(isNew)
+		const nextRoles = { ...browsedRoles }
+		let kept = next
+		for (const table of added) {
+			const dt = tableDatatable(table)
+			if (!dt) continue
+			const role = roleSeenFor(dt)
+			if (role === undefined) continue
+			if (nextRoles[dt] !== undefined && nextRoles[dt] !== role) {
+				kept = kept.filter((s) => tableDatatable(s) !== dt || added.includes(s))
+			}
+			nextRoles[dt] = role
+		}
+		const stillSelected = new Set(kept.map(tableDatatable))
+		selectedTables = kept
+		browsedRoles = Object.fromEntries(
+			Object.entries(nextRoles).filter(([dt]) => stillSelected.has(dt))
+		)
+	}
+
+	// `undefined` where the workspace has no data table at all: the drawer opens on none and
+	// shows its placeholder, rather than on a name that does not exist.
+	function selectDatatable(datatable: string | undefined, role?: string) {
+		// A row clicked under another data table has just set the selection it should open on.
+		openSchemaKey = selectedSchemaKey
+		openTableKey = selectedTableKey
+		selectedDatatable = datatable
+		if (datatable === undefined) {
+			selectedRole = undefined
+			return
+		}
+		// A data table opens as the role its picked tables were browsed as, else the one the app
+		// already uses it through.
+		connectAs(
+			datatable,
+			datatableNameTakesRole(datatable)
+				? (role ?? browsedRoles[datatable] ?? appDatatableRole(roles, datatable))
+				: undefined
+		)
+	}
+
+	/** Connects to `datatable` as `role`. The tables picked on it under another role are dropped:
+	 * they would be saved under a role other than the one on screen. */
+	function connectAs(datatable: string, role: string | undefined) {
+		selectedRole = role
+		const browsed = browsedRoles[datatable]
+		if (browsed !== undefined && role !== undefined && role !== browsed) {
+			selectedTables = selectedTables.filter((t) => (t.datatable ?? datatable) !== datatable)
+			const { [datatable]: _, ...rest } = browsedRoles
+			browsedRoles = rest
+		}
+	}
+
+	// Cleared before a data table is selected: a pick left unadded when the drawer last closed
+	// would otherwise decide the role it reopens as.
+	function resetSelection() {
+		selectedTables = []
+		browsedRoles = {}
+		selectedRole = undefined
+	}
+
+	export function openDrawer() {
+		resetSelection()
 		selectedSchemaKey = undefined
 		selectedTableKey = undefined
-		selectedTables = []
+		selectDatatable(datatables.current.includes('main') ? 'main' : datatables.current[0])
 		expand = false
 		open = true
 	}
 
-	let initialTableKey: string | undefined = $state<string | undefined>(undefined)
-	let initialSchemaKey: string | undefined = $state<string | undefined>(undefined)
-
 	export function openDrawerWithRef(ref: DataTableRef) {
-		selectedDatatable = ref.datatable
+		resetSelection()
 		selectedSchemaKey = ref.schema
 		selectedTableKey = ref.table
-		initialTableKey = ref.table
-		initialSchemaKey = ref.schema
-		selectedTables = []
+		selectDatatable(ref.datatable)
 		expand = false
 		open = true
 	}
@@ -88,49 +277,58 @@
 	export function closeDrawer() {
 		open = false
 		dbManagerContent?.clearReplResult()
+		// An action outlives the data table it was asked for otherwise.
+		pendingAction = undefined
 	}
 
 	function handleAddTables() {
-		if (!selectedDatatable) {
-			sendUserToast('Please select a data table first', true)
-			return
-		}
-
 		if (selectedTables.length === 0) {
 			sendUserToast('Please select at least one table', true)
 			return
 		}
 
-		// Add all selected tables
+		const refs: DataTableRef[] = []
 		for (const table of selectedTables) {
-			const ref: DataTableRef = {
-				datatable: selectedDatatable,
-				schema: table.schema,
-				table: table.table
-			}
-			onAdd?.(ref)
+			const datatable = table.datatable ?? selectedDatatable
+			if (!datatable) continue
+			refs.push({ datatable, schema: table.schema, table: table.table })
 		}
+		const added = new Set(refs.map((r) => r.datatable))
+		const addedRoles = Object.fromEntries(
+			Object.entries(browsedRoles).filter(([dt]) => added.has(dt))
+		)
+		const roleChanged = new Set(
+			Object.entries(addedRoles)
+				.filter(([dt, role]) => {
+					const usedAs = appDatatableRole(roles, dt) ?? defaultRoleOf(dt)
+					return usedAs !== undefined && usedAs !== role
+				})
+				.map(([dt]) => dt)
+		)
+		onAdd?.(refs, addedRoles, roleChanged)
 
-		const count = selectedTables.length
+		const count = refs.length
 		sendUserToast(`Added ${count} table${count > 1 ? 's' : ''} to app`)
 		selectedTables = []
+		browsedRoles = {}
 	}
 
-	const datatableItems = $derived(
-		datatables.current.map((dt) => ({
-			value: dt,
-			label: dt
-		}))
-	)
-
+	// Carries the picked schema/table, so a click on a row of another data table lands on that
+	// table once the manager re-mounts against it.
 	const dbInput: DbInput | undefined = $derived(
 		selectedDatatable
 			? {
 					type: 'database' as const,
 					resourceType: 'postgresql' as const,
 					resourcePath: `datatable://${selectedDatatable}`,
-					specificSchema: initialSchemaKey,
-					specificTable: initialTableKey
+					role: selectedRole,
+					migrationRole: defaultMigrationRole(
+						selectedDatatable,
+						rolesOfCurrent?.permissioned,
+						rolesOfCurrent?.default_role
+					),
+					specificSchema: openSchemaKey,
+					specificTable: openTableKey
 				}
 			: undefined
 	)
@@ -141,15 +339,13 @@
 		}
 	})
 
-	// Convert existingRefs to disabledTables format for the current datatable
 	const disabledTables = $derived(
 		existingRefs
-			.filter((ref) => ref.datatable === selectedDatatable && ref.schema && ref.table)
-			.map((ref) => ({ schema: ref.schema!, table: ref.table! }))
+			.filter((ref) => ref.schema && ref.table)
+			.map((ref) => ({ datatable: ref.datatable, schema: ref.schema!, table: ref.table! }))
 	)
 
-	// Can add: has tables selected
-	const canAdd = $derived(selectedDatatable && selectedTables.length > 0)
+	const canAdd = $derived(selectedTables.length > 0)
 
 	// Shares the drawer-set override with the Database Manager: same data table,
 	// same worker group needed to reach it.
@@ -175,37 +371,27 @@
 		noPadding
 	>
 		{#if dbInput && opWs}
-			{#key selectedDatatable}
-				<DBManagerContent
-					bind:this={dbManagerContent}
-					input={dbInput}
-					workspace={opWs}
-					bind:workerTag={() => workerTag.tag, (v) => (workerTag.tag = v)}
-					bind:hasReplResult
-					bind:selectedSchemaKey
-					bind:selectedTableKey
-					multiSelectMode={true}
-					bind:selectedTables
-					{disabledTables}
-				>
-					{#snippet dbSelector()}
-						{#if datatables.loading}
-							<div class="flex items-center gap-2 text-tertiary ml-2">
-								<LoaderCircle size={14} class="animate-spin" />
-								<span class="text-sm">Loading...</span>
-							</div>
-						{:else if datatables.current.length >= 1}
-							<Select
-								transformInputSelectedText={(s) => `Datatable: ${s}`}
-								items={datatableItems}
-								bind:value={selectedDatatable}
-								placeholder="Select data table"
-								size="md"
-							/>
-						{/if}
-					{/snippet}
-				</DBManagerContent>
-			{/key}
+			{#if roleSettled}
+				{#key `${selectedDatatable}~${selectedRole ?? ''}`}
+					<DBManagerContent
+						bind:this={dbManagerContent}
+						input={dbInput}
+						workspace={opWs}
+						bind:workerTag={() => workerTag.tag, (v) => (workerTag.tag = v)}
+						bind:hasReplResult
+						bind:selectedSchemaKey
+						bind:selectedTableKey
+						multiSelectMode={true}
+						bind:selectedTables={() => selectedTables, setSelectedTables}
+						{disabledTables}
+						datatableTree={datatableTree.current}
+						datatableTreeLoading={datatableTree.loading}
+						onSelectDatatable={(dt) => selectDatatable(dt)}
+						onSelectRole={(dt, role) => selectDatatable(dt, role)}
+						bind:pendingAction
+					/>
+				{/key}
+			{/if}
 		{:else}
 			<div class="flex items-center justify-center h-full text-tertiary">
 				<span>Select a data table to explore</span>
@@ -214,12 +400,11 @@
 
 		{#snippet actions()}
 			<Button
-				variant="contained"
-				color="blue"
+				variant="accent"
 				disabled={!canAdd}
 				on:click={handleAddTables}
 				startIcon={{ icon: Plus }}
-				size="xs"
+				unifiedSize="sm"
 			>
 				{#if selectedTables.length > 0}
 					Add {selectedTables.length} table{selectedTables.length > 1 ? 's' : ''}
@@ -240,8 +425,8 @@
 				loading={dbManagerContent?.isLoading() ?? false}
 				on:click={() => dbManagerContent?.refresh()}
 				startIcon={{ icon: RefreshCcw }}
-				size="xs"
-				color="light"
+				unifiedSize="sm"
+				variant="default"
 				disabled={!selectedDatatable}
 			>
 				Refresh
@@ -250,8 +435,9 @@
 			<Button
 				on:click={() => (expand = !expand)}
 				startIcon={{ icon: expand ? Minimize : Expand }}
-				size="xs"
-				color="light"
+				unifiedSize="sm"
+				variant="default"
+				iconOnly
 			/>
 		{/snippet}
 	</DrawerContent>
diff --git a/frontend/src/lib/components/raw_apps/RawAppDataTableList.svelte b/frontend/src/lib/components/raw_apps/RawAppDataTableList.svelte
index b874f37d17..1f6f9c0eb4 100644
--- a/frontend/src/lib/components/raw_apps/RawAppDataTableList.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppDataTableList.svelte
@@ -16,6 +16,8 @@
 		defaultDatatable?: string | undefined
 		/** Default schema for new tables */
 		defaultSchema?: string | undefined
+		/** The role the app uses each data table through, by data table name */
+		roles?: Record<string, string>
 		onAdd?: () => void
 		onRemove?: (index: number) => void
 		onSelect?: (ref: DataTableRef, index: number) => void
@@ -31,6 +33,7 @@
 		dataTableRefs = [],
 		defaultDatatable = undefined,
 		defaultSchema = undefined,
+		roles = undefined,
 		onAdd,
 		onRemove,
 		onSelect,
@@ -95,6 +98,7 @@
 			<DefaultDatabaseSelector
 				datatable={defaultDatatable}
 				schema={defaultSchema}
+				{roles}
 				onChange={onDefaultChange}
 			/>
 		{/if}
@@ -124,6 +128,14 @@
 				<div class="flex items-center gap-1.5 px-1 py-1 text-2xs text-tertiary">
 					<Database size={12} class="shrink-0" />
 					<span class="font-medium truncate">{datatableName}</span>
+					{#if roles?.[datatableName]}
+						<span
+							class="truncate font-mono"
+							title="The app's queries on this data table run as this role"
+						>
+							as {roles[datatableName]}
+						</span>
+					{/if}
 					{#if isDefaultDatatable}
 						<span title="Default datatable">
 							<Star size={10} class="shrink-0 text-primary" />
diff --git a/frontend/src/lib/components/raw_apps/RawAppEditor.svelte b/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
index ebacf5c862..78d3ba8102 100644
--- a/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
@@ -14,8 +14,7 @@
 
 	// import { addWmillClient } from './utils'
 	import RawAppBackgroundRunner from './RawAppBackgroundRunner.svelte'
-	import { workspaceStore } from '$lib/stores'
-	import { setRawAppOperatingWorkspace } from './rawAppWorkspace'
+	import { setOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 	import { useLocalStorageValue } from '$lib/svelte5Utils.svelte'
 	import {
 		WMILL_TS_PATH,
@@ -70,9 +69,15 @@
 		formatDataTableRef,
 		isDatatableTableAllowed,
 		type RawAppData,
-		DEFAULT_DATA
+		DEFAULT_DATA,
+		appDatatableRole
 	} from './dataTableRefUtils'
+	import { datatableReference } from '../dbTypes'
 	import { randomUUID } from '$lib/utils/uuid'
+	import { editorFontSize } from '$lib/editorFontSize.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		files?: Record<string, string>
@@ -102,8 +107,16 @@
 			| undefined
 		diffDrawer?: DiffDrawer | undefined
 		onNavigate?: (item: import('$lib/components/workspacePicker').WorkspaceItem) => void
-		/** Fired after a successful deploy; the session preview reloads on it. */
-		onDeploy?: (e: { path: string }) => void
+		/** Fired after a successful deploy; the session preview reloads on it and the route
+		 *  re-pins the draft's fork base. `version` is what this deploy wrote and `head`
+		 *  what is deployed now: the two differ when another deploy landed beside it. */
+		onDeploy?: (e: {
+			path: string
+			version?: number
+			head?: number
+			headBy?: string
+			headAt?: string
+		}) => void
 		/** Initial collapsed state for the file/runnable sidebar. The user's
 		 * toggled preference is persisted under `sidebarStorageKey`; this prop
 		 * only seeds the very first open. */
@@ -131,6 +144,16 @@
 		pendingDraftPath?: string | undefined
 		// Threaded to the AutosaveIndicator's "Reset to deployed" button.
 		onResetToDeployed?: () => void | Promise<void>
+		/** The app_version the draft forked from, for the deploy-time "new version
+		 *  deployed" guard: deploying is refused with a confirmation while it is not
+		 *  the head. The head at load when the draft's base is unknown; undefined for
+		 *  a draft-only app. */
+		version?: number | undefined
+		/** Moves the draft's base to the deployed head and keeps its content;
+		 *  offered in the diff drawer while the draft is behind. */
+		onTakeLatest?: (head?: string) => void | Promise<void>
+		/** The app_version the draft forked from, threaded to the topbar's diff drawer. */
+		draftBaseVersion?: string | undefined
 		// See ScriptBuilderProps — same indicator semantics.
 		loadedFromDraft?: boolean
 		othersDraftsCount?: number
@@ -202,17 +225,18 @@
 		onScreenshotRequester = undefined,
 		onRestore,
 		onSavedNewAppPath,
-		condensedHeader = false
+		condensedHeader = false,
+		version = undefined,
+		onTakeLatest = undefined,
+		draftBaseVersion = undefined
 	}: Props = $props()
-	export const version: number | undefined = undefined
 
 	// Workspace this editor operates on: the session's acting workspace when
 	// embedded in a session preview (autosaveWorkspace), else the navigation
-	// workspace. Deploy/save/background-runner must target it, not $workspaceStore.
-	const opWorkspace = $derived(autosaveWorkspace ?? $workspaceStore)
-	// Expose it to the sidebar sub-components (inline scripts, datatable/shared-UI
-	// drawers, DB selector) so their lookups target the app's workspace too.
-	setRawAppOperatingWorkspace(() => opWorkspace)
+	// workspace. Deploy/save/background-runner must target it, not the navigation one.
+	const opWorkspace = $derived(autosaveWorkspace ?? $operatingWorkspace)
+	// Everything under the editor acts on it too (see operatingWorkspace.svelte.ts).
+	setOperatingWorkspace(() => opWorkspace)
 
 	// The path autosaves land on, which is what the session preview loads the app by.
 	const draftStoragePath = $derived(autosavePath ?? liveEditorDraftStoragePath)
@@ -248,6 +272,12 @@
 	// so the preview just opens the app.
 	setOpenInSessionHandoff({ source: () => sessionOpen })
 
+	let header: RawAppEditorHeader | undefined = $state(undefined)
+	/** The Deployed↔Current diff, for the route's stale-draft prompt. */
+	export function openDiffDrawer() {
+		return header?.openDiffDrawer()
+	}
+
 	/** Hand this app off to a fresh AI session, seeding `seedPrompt` and sending
 	 * it on arrival. Exposed for the template picker's "Start in AI session": the
 	 * route owns the prompt, but the draft persistence the preview depends on
@@ -536,7 +566,10 @@
 	// The only writer of `activeTabId`, `selectedRunnable` and `selectedDocument`.
 	// Everything switches through here, so the three can't disagree: one left
 	// stale marks two sidebar rows selected, or leaves a tab over an empty pane.
-	function select(next: EditorSelection, opts?: { force?: boolean; notifyIframe?: boolean }): void {
+	function select(
+		next: EditorSelection,
+		opts?: { force?: boolean; notifyIframe?: boolean; focus?: boolean }
+	): void {
 		if (next.kind === 'preview') {
 			// In split mode Preview is always shown on the right, so selecting it is
 			// a no-op (would collapse the left pane). `force` lets closeTab fall back
@@ -545,21 +578,23 @@
 			activeTabId = PREVIEW_TAB_ID
 			selectedRunnable = undefined
 			selectedDocument = undefined
+			iframeFocusPending = undefined
 			return
 		}
 		if (next.kind === 'file') {
 			activeTabId = ensureFileTab(next.path)
 			selectedRunnable = undefined
 			selectedDocument = next.path
-			if (opts?.notifyIframe !== false) openInIframe(next.path)
+			if (opts?.notifyIframe !== false) openInIframe(next.path, opts?.focus)
 			return
 		}
 		activeTabId = ensureRunnableTab(next.key)
 		selectedDocument = undefined
 		selectedRunnable = next.key
+		iframeFocusPending = undefined
 	}
 
-	function activateTab(id: string, opts?: { force?: boolean }) {
+	function activateTab(id: string, opts?: { force?: boolean; focus?: boolean }) {
 		if (!tabs.some((t) => t.id === id)) return
 		select(selectionOfTab(id), opts)
 	}
@@ -572,13 +607,20 @@
 		closeTab(runnableTabId(key))
 	}
 
-	// Ask the UI Builder iframe to open a document. `populateFiles` replays
-	// `iframeDocument` on iframe load, so record it even when the iframe isn't
-	// ready yet (the postMessage is then skipped).
-	function openInIframe(path: string) {
+	// Ask the UI Builder iframe to open a document, taking the keyboard only when
+	// the user picked it. For a file whose current content the iframe doesn't hold
+	// yet, `populateFiles` opens `iframeDocument` in the same message as that
+	// content: opening first errors on a new file and races the write on a changed
+	// one (the iframe applies the edit twice). It also opens it on iframe load.
+	// Documents outside `files` (wmill.ts, ui/, node_modules/) never go through it.
+	function openInIframe(path: string, focus = false) {
 		iframeDocument = path
-		if (iframeLoaded) {
-			iframe?.contentWindow?.postMessage({ type: 'selectFile', path }, '*')
+		const content = files?.[path]
+		if (iframeLoaded && (content === undefined || iframeFiles?.[path] === content)) {
+			iframeFocusPending = undefined
+			iframe?.contentWindow?.postMessage({ type: 'selectFile', path, focus }, '*')
+		} else {
+			iframeFocusPending = focus ? path : undefined
 		}
 	}
 
@@ -700,17 +742,32 @@
 			summary = update.summary
 		}
 		if (update.files !== undefined) {
+			iframeFiles = undefined
 			files = update.files
 		}
 		if (update.runnables !== undefined) {
 			runnables = update.runnables
 		}
 		if (update.data !== undefined) {
-			data = update.data
+			replaceData(update.data)
 		}
 		historyManager.manualSnapshot(files ?? {}, runnables, summary, data, true)
 	}
 
+	/** Replaces `data` from outside the editor (history, YAML). The policy sync writes the policy
+	 * into `data`, so the policy takes the new values first or it puts the old ones straight back. */
+	function replaceData(next: RawAppData) {
+		data = next
+		aiChatManager.datatableCreationPolicy = {
+			...aiChatManager.datatableCreationPolicy,
+			// As on load: data that names no data table leaves nothing to create tables in.
+			enabled: next.datatable !== undefined,
+			datatable: next.datatable,
+			schema: next.schema,
+			roles: next.roles
+		}
+	}
+
 	let jobs: string[] = $state([])
 	let jobsById: Record<string, JobById> = $state({})
 
@@ -766,6 +823,17 @@
 	}
 
 	let iframeLoaded = $state(false) // @hmr:keep
+	// The files the iframe holds: last posted to it, or last reported by it. Explicit
+	// replacements (history, YAML) clear it so they are always sent: the iframe can
+	// hold edits it hasn't reported yet, which a skip would leave in place.
+	let iframeFiles: Record<string, string> | undefined
+	// The document the user picked that `openInIframe` left for `populateFiles` to
+	// open. It takes the keyboard only if it is still the document being opened.
+	let iframeFocusPending: string | undefined
+	// Last keystroke or click in the editor, or edit reported by the iframe. AI
+	// edits only move the editor to their file once the user has paused this long.
+	let lastUserInputAt = 0
+	const USER_IDLE_MS = 3000
 	// Briefly drops the `setActiveDocument` echo VS Code fires while we're
 	// pushing the initial file set — the iframe auto-opens a default editor
 	// during boot which we don't want to treat as a user-driven activation.
@@ -813,6 +881,10 @@
 
 	function populateFiles() {
 		if (files) {
+			// `files` is reassigned with unchanged content (the session draft sync, history
+			// restores, the iframe's own reports). Re-sending it makes the iframe reopen its
+			// document and rewrite the files under the user's cursor.
+			if (deepEqual(files, iframeFiles)) return
 			suppressSetActiveDocument = true
 			if (suppressTimer !== undefined) clearTimeout(suppressTimer)
 			suppressTimer = setTimeout(() => {
@@ -831,10 +903,14 @@
 		}
 	}
 	function setFilesInIframe(newFiles: Record<string, string>) {
+		const target = iframe?.contentWindow
+		if (!target) return
+		iframeFiles = { ...newFiles }
+		iframeFocusPending = undefined
 		const files = Object.fromEntries(
 			Object.entries(newFiles).filter(([path, _]) => !path.endsWith('/'))
 		)
-		iframe?.contentWindow?.postMessage(
+		target.postMessage(
 			{
 				type: 'setFiles',
 				files: files
@@ -845,14 +921,20 @@
 
 	function setFilesAndSelectInIframe(newFiles: Record<string, string>, pathToSelect: string) {
 		iframeDocument = pathToSelect
+		const target = iframe?.contentWindow
+		if (!target) return
+		iframeFiles = { ...newFiles }
+		const focus = iframeFocusPending === pathToSelect
+		iframeFocusPending = undefined
 		const files = Object.fromEntries(
 			Object.entries(newFiles).filter(([path, _]) => !path.endsWith('/'))
 		)
-		iframe?.contentWindow?.postMessage(
+		target.postMessage(
 			{
 				type: 'setFilesAndSelect',
 				files: files,
-				pathToSelect: pathToSelect
+				pathToSelect: pathToSelect,
+				focus
 			},
 			'*'
 		)
@@ -878,7 +960,8 @@
 		aiChatManager.datatableCreationPolicy = {
 			enabled: data.datatable !== undefined,
 			datatable: data.datatable,
-			schema: data.schema
+			schema: data.schema,
+			roles: data.roles
 		}
 
 		// Start auto-snapshot
@@ -900,9 +983,15 @@
 		// Read the current policy from aiChatManager
 		const policy = aiChatManager.datatableCreationPolicy
 		// Only update if different to avoid infinite loops
-		if (data.datatable !== policy.datatable || data.schema !== policy.schema) {
+		if (
+			data.datatable !== policy.datatable ||
+			data.schema !== policy.schema ||
+			// By value: the policy holds its own proxy of the same map.
+			JSON.stringify(data.roles) !== JSON.stringify(policy.roles)
+		) {
 			data.datatable = policy.datatable
 			data.schema = policy.schema
+			data.roles = policy.roles
 		}
 	})
 
@@ -961,14 +1050,15 @@
 				return frontendFiles
 			},
 			setFrontendFile: (path, content): LintResult => {
-				console.log('setting frontend file', path, content)
+				console.log('setting frontend file', path, `${content.length} chars`)
 				if (!files) {
 					files = {}
 				}
 				files[path] = content
-				// Combined setFilesAndSelect avoids a race, so let it do the telling.
-				select({ kind: 'file', path }, { notifyIframe: false })
-				setFilesAndSelectInIframe(files, path)
+				// Follow the AI to the file it edits, but never pull a user who is editing
+				// off their file. The files effect sends the content.
+				if (Date.now() - lastUserInputAt < USER_IDLE_MS) ensureFileTab(path)
+				else select({ kind: 'file', path })
 				return lint()
 			},
 			deleteFrontendFile: (path) => {
@@ -976,7 +1066,6 @@
 					files = {}
 				}
 				delete files[path]
-				setFilesInIframe(files)
 			},
 			listBackendRunnables: () => {
 				return Object.entries(runnables).map(([key, runnable]) => ({
@@ -1079,10 +1168,32 @@
 					return []
 				}
 
-				const tables = await WorkspaceService.listDataTableTables({
-					workspace: opWorkspace
+				// A data table the app uses through a role is listed as that role, so the AI sees
+				// what the app's own queries reach.
+				const workspace = opWorkspace
+				const tables = await WorkspaceService.listDataTableTables({ workspace })
+				// Only data tables that still exist: `data.roles` can outlive a removed or renamed one,
+				// and the server answers a `role_for` naming nothing with a 404.
+				const roled = Object.entries(data.roles ?? {}).filter(([dt]) =>
+					tables.some((t) => t.datatable_name === dt)
+				)
+				const roledTables = await Promise.all(
+					roled.map(([roleFor, role]) =>
+						WorkspaceService.listDataTableTables({
+							workspace,
+							datatableName: roleFor,
+							roleFor,
+							role
+						})
+					)
+				)
+				const merged = tables.map((entry) => {
+					const i = roled.findIndex(([dt]) => dt === entry.datatable_name)
+					return i === -1
+						? entry
+						: (roledTables[i].find((t) => t.datatable_name === entry.datatable_name) ?? entry)
 				})
-				return filterDatatableTables(tables)
+				return filterDatatableTables(merged)
 			},
 			getDatatableTableSchema: async (
 				datatableName: string,
@@ -1106,7 +1217,8 @@
 					workspace: opWorkspace,
 					datatableName,
 					schemaName,
-					tableName
+					tableName,
+					role: appDatatableRole(data.roles, datatableName)
 				})
 				return schema.columns
 			},
@@ -1124,13 +1236,15 @@
 				}
 
 				try {
+					// The same role the app's runnables use, so a table the AI creates belongs to it.
+					const role = appDatatableRole(data.roles, datatableName)
 					const result = await runScriptAndPollResult(
 						{
 							workspace: opWorkspace,
 							requestBody: {
 								language: 'postgresql',
 								content: sql,
-								args: { database: `datatable://${datatableName}` }
+								args: { database: datatableReference(datatableName, role) }
 							}
 						},
 						writingJobOptions
@@ -1150,6 +1264,12 @@
 							const resourcePath = `datatable://${datatableName}`
 							delete $dbSchemas[resourcePath]
 							delete $dbSchemas[`${opWorkspace}:${resourcePath}`]
+							// The DB manager keys its cache by the role it connected as too.
+							for (const key of Object.keys($dbSchemas)) {
+								if (key.startsWith(`${opWorkspace}:${resourcePath}?role=`)) {
+									delete $dbSchemas[key]
+								}
+							}
 						}
 					}
 
@@ -1317,9 +1437,11 @@
 		if (e.data.type === 'setFiles') {
 			// Normalize Windows-style path separators to Linux-style
 			const normalizedFiles = normalizeFilePaths(e.data.files)
+			iframeFiles = { ...normalizedFiles }
 			// Only mark pending changes if files actually changed (ignore echo from setFilesInIframe)
 			if (!deepEqual(files, normalizedFiles)) {
 				files = normalizedFiles
+				lastUserInputAt = Date.now()
 				historyManager.markPendingChanges()
 			}
 		} else if (e.data.type === 'getBundle') {
@@ -1931,22 +2053,9 @@
 		if (opWorkspace) params.set('workspace', opWorkspace)
 		return `/ui_builder/index.html?${params}`
 	}
-	// Host's computed `text-xs` size in px. Windmill bumps :root to 18px at
-	// ≥1760px viewports, so this re-evaluates on resize via the listener below.
-	let editorFontSize = $state(12)
-	function recomputeEditorFontSize() {
-		const rootPx = parseFloat(getComputedStyle(document.documentElement).fontSize)
-		// text-xs is 0.75rem
-		editorFontSize = rootPx * 0.75
-	}
-	$effect(() => {
-		recomputeEditorFontSize()
-		const onResize = () => recomputeEditorFontSize()
-		window.addEventListener('resize', onResize)
-		return () => window.removeEventListener('resize', onResize)
-	})
 	$effect(() => {
 		iframe?.addEventListener('load', () => {
+			iframeFiles = undefined
 			iframeLoaded = true
 		})
 	})
@@ -1996,7 +2105,7 @@
 	$effect(() => {
 		// Match VS Code's editor font size to Windmill's text-xs.
 		if (iframe && iframeLoaded) {
-			iframe.contentWindow?.postMessage({ type: 'setFontSize', px: editorFontSize }, '*')
+			iframe.contentWindow?.postMessage({ type: 'setFontSize', px: editorFontSize.regular }, '*')
 		}
 	})
 	$effect(() => {
@@ -2012,6 +2121,7 @@
 		}
 	})
 	$effect(() => {
+		// populateFiles must track file entries so in-place AI edits trigger synchronization.
 		iframe && iframeLoaded && files && populateFiles()
 	})
 	$effect(() => {
@@ -2040,7 +2150,7 @@
 	// future `FileExplorer` caller feeds folder paths back in.
 	function handleSelectPath(path: string) {
 		if (!path || path.endsWith('/')) return
-		select({ kind: 'file', path })
+		select({ kind: 'file', path }, { focus: true })
 	}
 
 	// Track previous values for change detection
@@ -2134,19 +2244,12 @@
 		data: RawAppData
 	}) {
 		try {
+			iframeFiles = undefined
 			files = structuredClone($state.snapshot(entry.files))
 			runnables = structuredClone($state.snapshot(entry.runnables))
 			summary = entry.summary
-			data = structuredClone($state.snapshot(entry.data))
+			replaceData(structuredClone($state.snapshot(entry.data)))
 
-			// If the open document survives into the new files, use the combined message
-			if (iframeDocument && isOpenableDocument(iframeDocument)) {
-				// Use combined setFilesAndSelect message to avoid race condition
-				setFilesAndSelectInIframe(entry.files, iframeDocument)
-			} else {
-				// Otherwise just set files normally
-				setFilesInIframe(entry.files)
-			}
 			populateRunnables()
 		} catch (error) {
 			console.error('Failed to apply entry:', error)
@@ -2283,13 +2386,22 @@
 	gateJobIds={false}
 	extraSourceWindow={() => externalPreviewWindow}
 />
-<div bind:clientWidth={rootWidth} class="max-h-full overflow-hidden h-full min-h-0 flex flex-col">
+<div
+	bind:clientWidth={rootWidth}
+	onkeydowncapture={() => (lastUserInputAt = Date.now())}
+	onpointerdowncapture={() => (lastUserInputAt = Date.now())}
+	class="max-h-full overflow-hidden h-full min-h-0 flex flex-col"
+>
 	<RawAppEditorHeader
+		bind:this={header}
 		bind:jobs
 		bind:jobsById
 		bind:savedApp
 		bind:summary
 		bind:pendingDraftPath
+		{version}
+		{onTakeLatest}
+		{draftBaseVersion}
 		{onRestore}
 		{onSavedNewAppPath}
 		{policy}
@@ -2340,13 +2452,7 @@
 					class="h-full overflow-y-auto relative"
 				>
 					<RawAppSidebar
-						bind:files={
-							() => files,
-							(newFiles) => {
-								files = newFiles
-								setFilesInIframe(newFiles ?? {})
-							}
-						}
+						bind:files
 						onSelectPath={handleSelectPath}
 						onSelectRunnable={(key) => select({ kind: 'runnable', key })}
 						onDeleteRunnable={deleteRunnable}
@@ -2368,6 +2474,20 @@
 								schema
 							}
 						}}
+						datatableRoles={data.roles}
+						onDatatableRolesChange={(roles, roleChanged) => {
+							// The default schema was picked among what the previous role reaches: after the
+							// user moves the app's default data table to another role, it is picked again.
+							const dt = data.datatable
+							const schemaStale = dt !== undefined && roleChanged.has(dt)
+							data.roles = roles
+							if (schemaStale) data.schema = undefined
+							aiChatManager.datatableCreationPolicy = {
+								...aiChatManager.datatableCreationPolicy,
+								roles,
+								...(schemaStale && { schema: undefined })
+							}
+						}}
 						{runnables}
 						{modules}
 						{historyManager}
@@ -2409,7 +2529,7 @@
 								<DraggableTabs
 									tabs={leftPaneTabs}
 									activeId={activeTabId}
-									onSelect={(id) => activateTab(id)}
+									onSelect={(id) => activateTab(id, { focus: true })}
 									onClose={(id) => closeTab(id)}
 									onReorder={(next) => reorderTabs(next)}
 								>
@@ -2494,7 +2614,7 @@
 								<DraggableTabs
 									tabs={rightPaneTabs}
 									activeId={rightPaneActiveId}
-									onSelect={(id) => activateTab(id)}
+									onSelect={(id) => activateTab(id, { focus: true })}
 									onClose={(id) => closeTab(id)}
 									onReorder={(next) => reorderTabs(next)}
 								>
diff --git a/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte b/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte
index 58329fac6c..7faa17978c 100644
--- a/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte
@@ -13,7 +13,7 @@
 		type OpenInSessionSource
 	} from '$lib/components/sessions/OpenInSessionButton.svelte'
 	import { discardDraftAfterDeploy } from '$lib/userDraftToast'
-	import { enterpriseLicense, userStore, userWorkspaces, workspaceStore } from '$lib/stores'
+	import { enterpriseLicense, userStore, userWorkspaces } from '$lib/stores'
 	import {
 		Bug,
 		DiffIcon,
@@ -28,7 +28,7 @@
 		Undo,
 		WandSparkles
 	} from 'lucide-svelte'
-	import { untrack } from 'svelte'
+	import { onDestroy, untrack } from 'svelte'
 	import { orderedJsonStringify, type Value, replaceFalseWithUndefined } from '../../utils'
 	import { random_adj } from '$lib/components/random_positive_adjetive'
 
@@ -39,6 +39,7 @@
 	import DeploymentHistory from '../apps/editor/DeploymentHistory.svelte'
 	import Awareness from '$lib/components/Awareness.svelte'
 	import type DiffDrawer from '$lib/components/DiffDrawer.svelte'
+	import { VERSION_PAGE_SIZE } from '$lib/components/diff_drawer'
 
 	import EditorHeader from '$lib/components/EditorHeader.svelte'
 	import AutosaveIndicator from '$lib/components/AutosaveIndicator.svelte'
@@ -65,7 +66,7 @@
 	// In a session pane the editor does NOT own the localStorage draft — the
 	// session runtime does, keyed by the session's (fork) workspace. So the
 	// `if (!inSessionPane) UserDraft.remove(...)` guards below skip the editor's
-	// own removal (it would target the wrong, main-`$workspaceStore` key). The
+	// own removal (it would target the wrong, navigation-workspace key). The
 	// session-side equivalent is RawAppEditorView's `onDeploy` →
 	// `runtime.syncPreviewWithDeployed`, which discards the fork draft + reloads
 	// the preview to the deployed version.
@@ -74,6 +75,14 @@
 	import type { RawAppData } from './dataTableRefUtils'
 	import { editInForkAllowed, editInForkLabel, openEditInFork } from '$lib/utils/editInFork'
 	import { isCloudHosted } from '$lib/cloud'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	// async function hash(message) {
 	// 	try {
@@ -109,6 +118,12 @@
 			  }
 			| undefined
 		version?: number | undefined
+		/** Moves the draft's base to the deployed head and keeps its content;
+		 *  offered in the diff drawer while the draft is behind. */
+		onTakeLatest?: (head?: string) => void | Promise<void>
+		/** The app_version the draft forked from; the drawer offers `onTakeLatest` only
+		 *  while it differs from the head on display. */
+		draftBaseVersion?: string | undefined
 		newApp: boolean
 		newPath?: string
 		/** Initial labels for the app, threaded from the loaded app data. */
@@ -143,11 +158,20 @@
 		/** Indicator-only overrides for the sessions preview: the AutosaveIndicator
 		 *  watches the session's (workspace, path) so it renders + animates on the
 		 *  key SessionEditorTarget saves under. Undefined on the full-page editor →
-		 *  falls back to `$workspaceStore`/`liveEditorDraftStoragePath`. */
+		 *  falls back to the operating workspace/`liveEditorDraftStoragePath`. */
 		autosaveWorkspace?: string
 		autosavePath?: string
-		// Fired after a successful deploy; lets the session preview reload.
-		onDeploy?: (e: { path: string }) => void
+		// Fired after a successful deploy; lets the session preview reload. `version` is
+		// what this deploy wrote, for the next draft's fork base; `head` is what is
+		// deployed now, with its author and time, and the two differ when another deploy
+		// landed beside this one.
+		onDeploy?: (e: {
+			path: string
+			version?: number
+			head?: number
+			headBy?: string
+			headAt?: string
+		}) => void
 		/** Surfaces the user-typed path (`newEditedPath`) up to the route
 		 *  when (and only when) it differs from the deployed/seeded
 		 *  `savedApp.path`. The route writes it into the autosaved raw-app
@@ -178,6 +202,8 @@
 		diffDrawer = undefined,
 		savedApp = $bindable(undefined),
 		version = $bindable(undefined),
+		onTakeLatest = undefined,
+		draftBaseVersion = undefined,
 		newApp,
 		newPath = '',
 		labels: initialLabels = undefined,
@@ -218,7 +244,7 @@
 
 	// The AutosaveIndicator watches these; in the sessions preview they're the
 	// session's (workspace, path), else the full-page editor's own values.
-	const opWorkspace = $derived(autosaveWorkspace ?? $workspaceStore)
+	const opWorkspace = $derived(autosaveWorkspace ?? $operatingWorkspace)
 	const indicatorPath = $derived(autosavePath ?? liveEditorDraftStoragePath)
 
 	$effect(() => {
@@ -343,9 +369,9 @@
 			// `path` orphaned the real draft row. Bracketed + flushed:
 			// RawAppEditor stays mounted through the post-deploy navigation
 			// and its mirror would otherwise displace the queued delete.
-			if (!inSessionPane && $workspaceStore) {
+			if (!inSessionPane && $operatingWorkspace) {
 				discardDraftAfterDeploy({
-					workspace: $workspaceStore,
+					workspace: $operatingWorkspace,
 					itemKind: 'raw_app',
 					path: appPath
 				})
@@ -388,34 +414,139 @@
 		}
 	}
 
-	async function syncWithDeployed() {
+	async function syncWithDeployed(opening?: number) {
 		const deployedApp = await AppService.getAppByPath({
 			workspace: opWorkspace!,
 			path: appPath!,
 			withStarredInfo: true
 		})
 
+		// A superseded opening must not write these: the current one would then render
+		// and offer Take latest against the older head.
+		if (opening != null && !diffDrawer?.ownsOpening(opening)) return
 		deployedBy = deployedApp.created_by
+		const shownVersions = (deployedApp as { versions?: number[] }).versions
+		deployedVersionShown = Array.isArray(shownVersions)
+			? shownVersions[shownVersions.length - 1]
+			: undefined
 
 		// Normalize away post-deploy noise (see stripRawAppDiffNoise) so the
 		// diff/comparison only reflects what the editor actually changed.
 		deployedValue = replaceFalseWithUndefined(stripRawAppDiffNoise(deployedApp))
 	}
 
-	async function openDiffDrawer() {
+	/** The app_version the payload in `deployedValue` came from, so the picker marks that
+	 *  one as head rather than trusting the history's first row. */
+	let deployedVersionShown: number | undefined = $state(undefined)
+
+	/** Deployed versions for the diff picker, newest first. Best-effort: losing the
+	 *  list costs the picker, not the diff. */
+	/** Throws: the drawer says so and lets the reader ask for the same page again. */
+	async function fetchVersionPage(page: number) {
+		if (!opWorkspace || !appPath) return undefined
+		{
+			const history = await AppService.getAppHistoryByPath({
+				workspace: opWorkspace,
+				path: appPath,
+				page,
+				perPage: VERSION_PAGE_SIZE
+			})
+			// Head is the version the payload beside this list came from; see FlowBuilder.
+			const head = deployedVersionShown ?? history[0]?.version
+			// No ordinal: the list arrives a page at a time, so a number counted within one
+			// would rename versions as more load.
+			return history.map((h) => {
+				const detail = [
+					h.created_by,
+					h.created_at ? new Date(h.created_at).toLocaleString() : undefined,
+					h.deployment_msg
+				].filter(Boolean)
+				const isHead = h.version === head
+				return {
+					id: String(h.version),
+					label: `${h.version}${isHead ? ' · latest' : ''}`,
+					subtitle: detail.length ? detail.join(' · ') : undefined,
+					isHead
+				}
+			})
+		}
+	}
+
+	/** Names the deployed side when the picker has no list to label it with — both are
+	 *  read in `syncWithDeployed`, which succeeds independently of the history. */
+	function deployedVersionLabel(): string | undefined {
+		if (deployedVersionShown == null) return undefined
+		return `Deployed ${deployedVersionShown}${deployedBy ? ` by ${deployedBy}` : ''} · latest`
+	}
+
+	/** The first page, best-effort: losing it costs the picker, not the diff. */
+	async function deployedVersionOptions() {
+		try {
+			return await fetchVersionPage(1)
+		} catch {
+			return undefined
+		}
+	}
+
+	/** Hands the drawer the next page each time the reader asks for one. The page number
+	 *  belongs to this item's history, so it lives here — and only moves once a page has
+	 *  actually arrived, or a failed request would skip it. */
+	function moreVersionsLoader() {
+		let loaded = 1
+		return async () => {
+			const page = await fetchVersionPage(loaded + 1)
+			loaded += 1
+			return page
+		}
+	}
+
+	/** The opening this editor claimed last. A path change remounts this editor while the
+	 *  drawer stays mounted, so its teardown hands that opening back rather than leaving
+	 *  the drawer on the item the user left. */
+	let lastOpening: number | undefined = undefined
+	onDestroy(() => {
+		if (lastOpening != null) diffDrawer?.abandonOpening(lastOpening)
+	})
+
+	export async function openDiffDrawer() {
 		if (!savedApp) {
 			return
 		}
+		// The fetches below are awaited, so a reopen (or a path change, which remounts
+		// this editor but not the drawer) while they run must not have the older one
+		// land last. The drawer counts the openings for that reason.
+		const opening = diffDrawer?.beginOpening()
+		lastOpening = opening
+		if (opening == null) return
 
 		// deployedValue should be syncronized when we open Diff
-		await syncWithDeployed()
+		await syncWithDeployed(opening)
 
-		diffDrawer?.openDrawer()
-		diffDrawer?.setDiff({
-			mode: 'normal',
-			deployed: deployedValue ?? stripRawAppDiffNoise(savedApp),
-			current: currentDiffValue
-		})
+		// Blanking the drawer belongs to the opening that will fill it.
+		if (!diffDrawer?.ownsOpening(opening)) return
+		diffDrawer.openDrawer(opening)
+		const versions = await deployedVersionOptions()
+		if (!diffDrawer?.ownsOpening(opening)) return
+		diffDrawer.setDiff(
+			{
+				mode: 'normal',
+				deployed: deployedValue ?? stripRawAppDiffNoise(savedApp),
+				deployedLabel: deployedVersionLabel(),
+				versions,
+				loadMoreVersions: moreVersionsLoader(),
+				onTakeLatest,
+				draftBase: draftBaseVersion,
+				deployedHead: deployedVersionShown != null ? String(deployedVersionShown) : undefined,
+				loadVersion: async (id) => {
+					const v = await AppService.getAppByVersion({ workspace: opWorkspace!, id: Number(id) })
+					// Same normalization as `syncWithDeployed`, so switching versions doesn't
+					// reintroduce the post-deploy noise the head side already strips.
+					return replaceFalseWithUndefined(stripRawAppDiffNoise(v as any))
+				},
+				current: currentDiffValue
+			},
+			opening
+		)
 	}
 
 	async function updateApp(npath: string) {
@@ -428,7 +559,7 @@
 		if (!policy.execution_mode) {
 			policy.execution_mode = 'publisher'
 		}
-		await AppService.updateAppRaw({
+		const deployed = await AppService.updateAppRaw({
 			workspace: opWorkspace!,
 			path: appPath!,
 			formData: {
@@ -442,7 +573,7 @@
 					// custom_path requires admin so to accept update without it, we need to send as undefined when non-admin (when undefined, it will be ignored)
 					// it also means that customPath needs to be set to '' instead of undefined to unset it (when admin)
 					custom_path:
-						$userStore?.is_admin || $userStore?.is_super_admin ? (customPath ?? '') : undefined,
+						actingUser?.is_admin || actingUser?.is_super_admin ? (customPath ?? '') : undefined,
 					labels
 				},
 				js,
@@ -458,18 +589,21 @@
 			custom_path: customPath,
 			labels: $state.snapshot(labels)
 		}
-		const appHistory = await AppService.getAppHistoryByPath({
+		const head = await AppService.getAppLatestVersion({
 			workspace: opWorkspace!,
 			path: npath
 		})
-		version = appHistory[0]?.version
+		// The deploy's own answer is the next draft's base; `version` is what is deployed
+		// now, and the two differ when another deploy landed beside this one. The route
+		// owns this prop and re-pushes `parentVersion ?? head` as soon as `onDeploy` returns.
+		version = head?.version
 
 		closeSaveDrawer()
 		sendUserToast('App deployed successfully')
 		// Bracketed + flushed (see createApp).
-		if (!inSessionPane && $workspaceStore) {
+		if (!inSessionPane && $operatingWorkspace) {
 			discardDraftAfterDeploy({
-				workspace: $workspaceStore,
+				workspace: $operatingWorkspace,
 				itemKind: 'raw_app',
 				path: appPath
 			})
@@ -477,7 +611,13 @@
 		if (appPath !== npath) {
 			onSavedNewAppPath?.(npath)
 		}
-		onDeploy?.({ path: npath })
+		onDeploy?.({
+			path: npath,
+			version: deployed.version,
+			head: version,
+			headBy: head?.created_by,
+			headAt: head?.created_at
+		})
 	}
 
 	async function setPublishState(message?: string) {
@@ -502,6 +642,9 @@
 	}
 
 	let onLatest = $state(true)
+	/** The last comparison could not read the head, so the confirmation it raises is
+	 *  caution and not an observed deploy. Cleared by the next reading comparison. */
+	let headUnknown = $state(false)
 	async function compareVersions() {
 		if (version === undefined) {
 			return
@@ -512,9 +655,14 @@
 				path: appPath
 			})
 			onLatest = appVersion?.version === undefined || version === appVersion?.version
+			headUnknown = false
 		} catch (e) {
 			console.error('Error comparing versions', e)
-			onLatest = true
+			// The head is what this compares against, so an unanswered read is not
+			// evidence of being current: confirm, as an unclaimable deploy does, and say
+			// that is why rather than claiming a version that was never seen.
+			onLatest = false
+			headUnknown = true
 		}
 	}
 
@@ -607,6 +755,8 @@
 	{confirmCallback}
 	bind:open
 	{diffDrawer}
+	claimOpening={() => (lastOpening = diffDrawer?.beginOpening())}
+	{headUnknown}
 	bind:deployedValue
 	currentValue={currentDiffValue}
 />
@@ -622,26 +772,34 @@
 						if (!savedApp || newApp) {
 							return
 						}
+						// The other entry point into the same drawer, so it takes an opening too.
+						const opening = diffDrawer?.beginOpening()
+						lastOpening = opening
+						if (opening == null) return
 						// deployedValue should be syncronized when we open Diff
-						await syncWithDeployed()
+						await syncWithDeployed(opening)
 
+						if (!diffDrawer?.ownsOpening(opening)) return
 						saveDrawerOpen = false
-						diffDrawer?.openDrawer()
-						diffDrawer?.setDiff({
-							mode: 'normal',
-							deployed: deployedValue ?? stripRawAppDiffNoise(savedApp),
-							current: currentDiffValue,
-							button: {
-								text: 'Looks good, deploy',
-								onClick: () => {
-									if (newApp || appPath == '') {
-										createApp(newEditedPath)
-									} else {
-										handleUpdateApp(newEditedPath)
+						diffDrawer.openDrawer(opening)
+						diffDrawer.setDiff(
+							{
+								mode: 'normal',
+								deployed: deployedValue ?? stripRawAppDiffNoise(savedApp),
+								current: currentDiffValue,
+								button: {
+									text: 'Looks good, deploy',
+									onClick: () => {
+										if (newApp || appPath == '') {
+											createApp(newEditedPath)
+										} else {
+											handleUpdateApp(newEditedPath)
+										}
 									}
 								}
-							}
-						})
+							},
+							opening
+						)
 					}}
 				>
 					<div class="flex flex-row gap-2 items-center">
@@ -674,6 +832,7 @@
 			{setPublishState}
 			{appPath}
 			{onLatest}
+			{headUnknown}
 			{savedApp}
 			rawApp
 			operatingWorkspace={opWorkspace}
diff --git a/frontend/src/lib/components/raw_apps/RawAppInlineScriptEditor.svelte b/frontend/src/lib/components/raw_apps/RawAppInlineScriptEditor.svelte
index 42c048878b..d7ae7b2245 100644
--- a/frontend/src/lib/components/raw_apps/RawAppInlineScriptEditor.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppInlineScriptEditor.svelte
@@ -23,8 +23,6 @@
 	import { resource } from 'runed'
 	import { usePreparedAssetSqlQueries } from '$lib/infer.svelte'
 	import AssetsDropdownButton from '../assets/AssetsDropdownButton.svelte'
-	import { workspaceStore } from '$lib/stores'
-	import { getRawAppOperatingWorkspace } from './rawAppWorkspace'
 	import { SvelteSet } from 'svelte/reactivity'
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import { editor as meditor } from 'monaco-editor'
@@ -42,6 +40,7 @@
 		getDebugErrorMessage
 	} from '$lib/components/debug'
 	import TextInput from '../text_input/TextInput.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		inlineScript: (InlineScript & { language: ScriptLang }) | undefined
@@ -78,8 +77,8 @@
 		delete_after_secs = $bindable()
 	}: Props = $props()
 
-	const getOpWs = getRawAppOperatingWorkspace()
-	let opWs = $derived(getOpWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	let opWs = $derived($operatingWorkspace)
 
 	let diffEditor = $state() as DiffEditor | undefined
 	let validCode = $state(true)
diff --git a/frontend/src/lib/components/raw_apps/RawAppInlineScriptRunnable.svelte b/frontend/src/lib/components/raw_apps/RawAppInlineScriptRunnable.svelte
index ca48eb74dc..200e76d85b 100644
--- a/frontend/src/lib/components/raw_apps/RawAppInlineScriptRunnable.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppInlineScriptRunnable.svelte
@@ -26,13 +26,18 @@
 	import LogViewer from '$lib/components/LogViewer.svelte'
 	import DisplayResult from '$lib/components/DisplayResult.svelte'
 	import RunButton from '$lib/components/RunButton.svelte'
-	import { userStore, workspaceStore } from '$lib/stores'
+	import { userStore } from '$lib/stores'
 	import { isHubFlowPath } from '$lib/utils'
 	import { sendUserToast } from '$lib/toast'
-	import { getRawAppOperatingWorkspace } from './rawAppWorkspace'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
 
-	const getOpWs = getRawAppOperatingWorkspace()
-	let opWs = $derived(getOpWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	let opWs = $derived($operatingWorkspace)
 
 	type RunnableWithInlineScript = RunnableWithFields & {
 		inlineScript?: InlineScript & { language: ScriptLang }
@@ -133,7 +138,7 @@
 			case 'email':
 				return $userStore?.email ?? ''
 			case 'groups':
-				return $userStore?.groups ?? []
+				return actingUser?.groups ?? []
 			case 'workspace':
 				return opWs ?? ''
 			case 'author':
diff --git a/frontend/src/lib/components/raw_apps/RawAppInlineScriptsPanel.svelte b/frontend/src/lib/components/raw_apps/RawAppInlineScriptsPanel.svelte
index 6d0854ee54..891fcfa7c8 100644
--- a/frontend/src/lib/components/raw_apps/RawAppInlineScriptsPanel.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppInlineScriptsPanel.svelte
@@ -1,11 +1,10 @@
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import RawAppInlineScripRunnable, { type Runnable } from './RawAppInlineScriptRunnable.svelte'
 	import { createScriptFromInlineScript } from '../apps/editor/inlineScriptsPanel/utils'
-	import { getRawAppOperatingWorkspace } from './rawAppWorkspace'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
-	const getOpWs = getRawAppOperatingWorkspace()
-	let opWs = $derived(getOpWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	let opWs = $derived($operatingWorkspace)
 
 	interface Props {
 		runnables: Record<string, Runnable>
diff --git a/frontend/src/lib/components/raw_apps/RawAppInputsSpecEditor.svelte b/frontend/src/lib/components/raw_apps/RawAppInputsSpecEditor.svelte
index 7b3639f41d..67ead38501 100644
--- a/frontend/src/lib/components/raw_apps/RawAppInputsSpecEditor.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppInputsSpecEditor.svelte
@@ -13,11 +13,16 @@
 	import { fieldTypeToTsType } from '../apps/utils'
 	import type { InputType } from '../apps/inputType'
 	import Select from '$lib/components/select/Select.svelte'
-	import { userStore, workspaceStore } from '$lib/stores'
-	import { getRawAppOperatingWorkspace } from './rawAppWorkspace'
+	import { userStore } from '$lib/stores'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
 
-	const getOpWs = getRawAppOperatingWorkspace()
-	let opWs = $derived(getOpWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	let opWs = $derived($operatingWorkspace)
 
 	// Build ctx properties with current user's actual values
 	let ctxProperties = $derived([
@@ -30,7 +35,7 @@
 		{
 			value: 'groups',
 			label: 'Groups',
-			subtitle: `string[] — ${JSON.stringify($userStore?.groups ?? [])}`
+			subtitle: `string[] — ${JSON.stringify(actingUser?.groups ?? [])}`
 		},
 		{
 			value: 'workspace',
diff --git a/frontend/src/lib/components/raw_apps/RawAppSharedUiDrawer.svelte b/frontend/src/lib/components/raw_apps/RawAppSharedUiDrawer.svelte
index b84a60ca0f..1ec0b01b7a 100644
--- a/frontend/src/lib/components/raw_apps/RawAppSharedUiDrawer.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppSharedUiDrawer.svelte
@@ -1,15 +1,14 @@
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import { WorkspaceService } from '$lib/gen'
 	import { sendUserToast } from '$lib/toast'
 	import Drawer from '../common/drawer/Drawer.svelte'
 	import DrawerContent from '../common/drawer/DrawerContent.svelte'
 	import Editor from '$lib/components/Editor.svelte'
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
-	import { getRawAppOperatingWorkspace } from './rawAppWorkspace'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
-	const getOpWs = getRawAppOperatingWorkspace()
-	let opWs = $derived(getOpWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	let opWs = $derived($operatingWorkspace)
 
 	let open = $state(false)
 	let files: Record<string, string> = $state({})
diff --git a/frontend/src/lib/components/raw_apps/RawAppSidebar.svelte b/frontend/src/lib/components/raw_apps/RawAppSidebar.svelte
index fbe02e1dc9..0dd8d3bdae 100644
--- a/frontend/src/lib/components/raw_apps/RawAppSidebar.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppSidebar.svelte
@@ -40,6 +40,13 @@
 		/** Default schema for new tables */
 		defaultSchema?: string | undefined
 		onDefaultChange?: (datatable: string | undefined, schema: string | undefined) => void
+		/** The role the app uses each data table through, by data table name */
+		datatableRoles?: Record<string, string>
+		/** `roleChanged` names the data tables now used through another role than before. */
+		onDatatableRolesChange?: (
+			roles: Record<string, string> | undefined,
+			roleChanged: Set<string>
+		) => void
 	}
 
 	let {
@@ -60,15 +67,27 @@
 		onDataTableRefsChange,
 		defaultDatatable = undefined,
 		defaultSchema = undefined,
-		onDefaultChange
+		onDefaultChange,
+		datatableRoles = undefined,
+		onDatatableRolesChange
 	}: Props = $props()
 
 	let dataTableDrawer: RawAppDataTableDrawer | undefined = $state()
 	let selectedDataTableIndex: number | undefined = $state(undefined)
 	let sharedUiDrawer: RawAppSharedUiDrawer | undefined = $state()
 
-	function handleAddDataTable(ref: DataTableRef) {
-		onDataTableRefsChange?.([...dataTableRefs, ref])
+	function handleAddDataTables(
+		refs: DataTableRef[],
+		browsedRoles: Record<string, string>,
+		roleChanged: Set<string>
+	) {
+		onDataTableRefsChange?.([
+			...dataTableRefs.filter((r) => !roleChanged.has(r.datatable)),
+			...refs
+		])
+		if (Object.keys(browsedRoles).length > 0) {
+			onDatatableRolesChange?.({ ...datatableRoles, ...browsedRoles }, roleChanged)
+		}
 	}
 
 	function handleRemoveDataTable(index: number) {
@@ -153,6 +172,7 @@
 	{dataTableRefs}
 	{defaultDatatable}
 	{defaultSchema}
+	roles={datatableRoles}
 	onAdd={() => dataTableDrawer?.openDrawer()}
 	onRemove={handleRemoveDataTable}
 	onSelect={handleSelectDataTable}
@@ -161,8 +181,9 @@
 />
 <RawAppDataTableDrawer
 	bind:this={dataTableDrawer}
-	onAdd={handleAddDataTable}
+	onAdd={handleAddDataTables}
 	existingRefs={dataTableRefs}
+	roles={datatableRoles}
 />
 <RawAppSharedUiDrawer bind:this={sharedUiDrawer} />
 
diff --git a/frontend/src/lib/components/raw_apps/RawAppTemplatePicker.svelte b/frontend/src/lib/components/raw_apps/RawAppTemplatePicker.svelte
index 7ead1f6fb0..0afef7744d 100644
--- a/frontend/src/lib/components/raw_apps/RawAppTemplatePicker.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppTemplatePicker.svelte
@@ -1,10 +1,10 @@
 <script lang="ts">
+	import { untrack } from 'svelte'
 	import { Sparkles, Plus, List, Ban, ExternalLinkIcon, Loader2 } from 'lucide-svelte'
 	import type { Policy } from '$lib/gen'
-	import { superadmin, userStore, workspaceStore } from '$lib/stores'
+	import { superadmin, userStore } from '$lib/stores'
 	import { base } from '$lib/base'
 	import { sendUserToast } from '$lib/toast'
-	import { getRawAppOperatingWorkspace } from './rawAppWorkspace'
 	import Modal from '$lib/components/common/modal/Modal.svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
@@ -19,16 +19,25 @@
 	import { loadCopilot } from '$lib/components/copilot/loadCopilot'
 	import { react18Template, react19Template, svelte5Template } from './templates'
 	import type { Runnable } from './rawAppPolicy'
-	import { type DataTableRef, type RawAppData, formatDataTableRef } from './dataTableRefUtils'
 	import {
+		type DataTableRef,
+		type RawAppData,
+		formatDataTableRef,
+		withAppDatatableRole
+	} from './dataTableRefUtils'
+	import {
+		createDatatableAccessResource,
 		createDatatablesResource,
-		createSchemasResource,
+		createRolesResource,
+		rolesWorthPicking,
 		toDatatableItems,
 		toSchemaItems
 	} from './datatableUtils.svelte'
+	import { datatableNameTakesRole, defaultMigrationRole } from '../dbTypes'
 	import RawAppDataTableList from './RawAppDataTableList.svelte'
 	import RawAppDataTableDrawer from './RawAppDataTableDrawer.svelte'
 	import FileEditorIcon from './FileEditorIcon.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	export type RawAppTemplatePickerResult = {
 		files: Record<string, string>
@@ -62,19 +71,142 @@
 	let appSummary = $state('')
 	let initialPrompt = $state('')
 	let preWhitelistedTables = $state<DataTableRef[]>([])
+	/** The role each pre-whitelisted table's data table was browsed as. */
+	let preWhitelistedRoles = $state<Record<string, string>>({})
 	let dataTableDrawer: RawAppDataTableDrawer | undefined = $state()
 
-	const getOpWs = getRawAppOperatingWorkspace()
-	let opWs = $derived(getOpWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	let opWs = $derived($operatingWorkspace)
 
 	const datatables = createDatatablesResource(() => opWs)
-	const schemas = createSchemasResource(
+	const roles = createRolesResource(
 		() => selectedDatatable,
 		() => opWs
 	)
+	let selectedRole = $state<string | undefined>(undefined)
+
+	// Every reader waits for an answer stamped with the current selection: until then `current`
+	// belongs to the previous workspace, data table or role.
+	// A data table whose name cannot carry a role in a reference is used as its default one.
+	const rolesAnswered = $derived(
+		roles.current.workspace === opWs && roles.current.datatable === selectedDatatable
+	)
+	const loadedRoles = $derived(
+		rolesAnswered &&
+			selectedDatatable !== undefined &&
+			datatableNameTakesRole(selectedDatatable)
+			? roles.current.roles
+			: []
+	)
+	const showRolePicker = $derived(rolesWorthPicking(loadedRoles))
+	// Saved explicitly rather than left to resolve: "whatever the default is then" moves the app
+	// the day an admin changes the default.
+	const effectiveRole = $derived(
+		selectedRole !== undefined && loadedRoles.includes(selectedRole) ? selectedRole : undefined
+	)
+	// An app uses one role per data table: the one picked above is what the table drawer browses
+	// as and what the list shows, or tables would be added under a role the app is not saved with.
+	const pickerRoles = $derived(
+		selectedDatatable !== undefined && effectiveRole !== undefined
+			? withAppDatatableRole(preWhitelistedRoles, selectedDatatable, effectiveRole)
+			: preWhitelistedRoles
+	)
 
 	const availableDatatables = $derived(datatables.current)
-	const availableSchemas = $derived(schemas.current)
+	// `undefined` while the list loads, so this is false until it has answered.
+	const hasNoDatatables = $derived(availableDatatables?.length === 0)
+
+	const rolesSettled = $derived(
+		hasNoDatatables || (selectedDatatable !== undefined && rolesAnswered)
+	)
+
+	// A role is picked on one data table: two data tables can both define an `analyst` that
+	// means something different, so a name surviving the switch is not the role surviving it.
+	let rolesPickedOn = $state<string | undefined>(undefined)
+	$effect(() => {
+		const loaded = roles.current
+		if (!rolesAnswered) return
+		const switched = untrack(() => rolesPickedOn) !== selectedDatatable
+		const current = untrack(() => selectedRole)
+		if (switched || current === undefined || !loaded.roles.includes(current)) {
+			// Tables already picked on this data table were browsed as a role: keep that one.
+			const browsed = selectedDatatable
+				? untrack(() => preWhitelistedRoles)[selectedDatatable]
+				: undefined
+			pickRole(
+				browsed !== undefined && loaded.roles.includes(browsed)
+					? browsed
+					: loaded.roles.includes(loaded.defaultRole)
+						? loaded.defaultRole
+						: loaded.roles[0]
+			)
+			rolesPickedOn = selectedDatatable
+		}
+	})
+
+	/** Picks the app's role on the selected data table. Tables picked on it under another role are
+	 * dropped: that role may reach them where this one does not. */
+	function pickRole(role: string | undefined) {
+		selectedRole = role
+		const dt = selectedDatatable
+		const browsed = dt ? preWhitelistedRoles[dt] : undefined
+		if (dt === undefined || role === undefined || browsed === undefined || browsed === role) return
+		preWhitelistedTables = preWhitelistedTables.filter((t) => t.datatable !== dt)
+		const { [dt]: _, ...rest } = preWhitelistedRoles
+		preWhitelistedRoles = rest
+	}
+
+	const access = createDatatableAccessResource(
+		() => selectedDatatable,
+		() => effectiveRole,
+		() => opWs,
+		() => rolesSettled && (loadedRoles.length === 0 || effectiveRole !== undefined)
+	)
+	// Under roles, and this caller may use none of them: the app would be saved with queries the
+	// server refuses.
+	const noUsableRole = $derived(
+		rolesSettled &&
+			selectedDatatable !== undefined &&
+			roles.current.permissioned &&
+			roles.current.roles.length === 0
+	)
+	const rolesUnknown = $derived(rolesSettled && roles.current.failed)
+	const accessSettled = $derived(
+		hasNoDatatables ||
+			(rolesSettled &&
+				selectedDatatable !== undefined &&
+				access.current.workspace === opWs &&
+				access.current.datatable === selectedDatatable &&
+				access.current.role === effectiveRole)
+	)
+	const accessUnknown = $derived(accessSettled && access.current.failed)
+	const availableSchemas = $derived(accessSettled ? access.current.schemas : [])
+	const canCreateSchema = $derived(accessSettled && access.current.canCreateSchema)
+
+	// Only an app that keeps the data table is held back by it: with table creation off nothing
+	// saves it.
+	const blockedByRole = $derived(
+		(noUsableRole || rolesUnknown || accessUnknown) && tableCreationEnabled
+	)
+
+	// A role that cannot create schemas has nothing to name, so the mode goes back to the one
+	// every role has, once that is an answer.
+	$effect(() => {
+		if (accessSettled && !accessUnknown && schemaMode === 'new' && !canCreateSchema) {
+			schemaMode = 'none'
+		}
+	})
+	// Likewise an existing schema the current role no longer reaches is unpicked, so the select
+	// does not keep showing it.
+	$effect(() => {
+		if (
+			accessSettled &&
+			selectedSchema !== undefined &&
+			!availableSchemas.includes(selectedSchema)
+		) {
+			selectedSchema = undefined
+		}
+	})
 
 	let hasAutoSelected = false
 	$effect(() => {
@@ -115,12 +247,18 @@
 	const datatableItems = $derived(toDatatableItems(availableDatatables))
 	const schemaItems = $derived(toSchemaItems(availableSchemas))
 
+	// An existing schema counts only while the current role reaches it: one picked under another
+	// role would save an app that creates its tables where it cannot.
 	const effectiveSchema = $derived(
-		schemaMode === 'new' ? newSchemaName : schemaMode === 'existing' ? selectedSchema : undefined
+		schemaMode === 'new'
+			? newSchemaName
+			: schemaMode === 'existing' &&
+				  selectedSchema !== undefined &&
+				  availableSchemas.includes(selectedSchema)
+				? selectedSchema
+				: undefined
 	)
 
-	const hasNoDatatables = $derived(availableDatatables?.length === 0)
-
 	// copilotInfo is a global that stays empty until some ancestor's fetch lands, so
 	// `enabled` alone cannot tell "no providers" from "not loaded yet" and the modal
 	// would announce AI as unconfigured while it is merely unknown. Gate on the
@@ -140,7 +278,13 @@
 	async function start(withPrompt: boolean) {
 		const template = templates[selectedTemplateIndex]
 
-		if (schemaMode === 'new' && newSchemaName && selectedDatatable && opWs) {
+		if (
+			tableCreationEnabled &&
+			schemaMode === 'new' &&
+			newSchemaName &&
+			selectedDatatable &&
+			opWs
+		) {
 			try {
 				const { dbSchemaOpsWithPreviewScripts } = await import('$lib/components/dbOps')
 				const dbOps = dbSchemaOpsWithPreviewScripts({
@@ -148,7 +292,13 @@
 					input: {
 						type: 'database',
 						resourceType: 'postgresql',
-						resourcePath: `datatable://${selectedDatatable}`
+						resourcePath: `datatable://${selectedDatatable}`,
+						role: effectiveRole,
+						migrationRole: defaultMigrationRole(
+							selectedDatatable,
+							roles.current.permissioned,
+							roles.current.defaultRole
+						)
 					}
 				})
 				await dbOps.onCreateSchema({ schema: newSchemaName })
@@ -159,14 +309,20 @@
 		}
 
 		const formattedTables = preWhitelistedTables.map(formatDataTableRef)
-		const data: RawAppData =
-			tableCreationEnabled && selectedDatatable
-				? {
-						tables: formattedTables,
-						datatable: selectedDatatable,
-						schema: effectiveSchema
-					}
-				: { tables: formattedTables, datatable: undefined, schema: undefined }
+		const keepsDatatable = tableCreationEnabled && selectedDatatable !== undefined
+		// The roles shown, for the data tables the app ends up using.
+		const usedDatatables = new Set(preWhitelistedTables.map((t) => t.datatable))
+		if (keepsDatatable) usedDatatables.add(selectedDatatable!)
+		const shownRoles = Object.entries(pickerRoles ?? {}).filter(([dt]) => usedDatatables.has(dt))
+		const appRoles = shownRoles.length > 0 ? Object.fromEntries(shownRoles) : undefined
+		const data: RawAppData = keepsDatatable
+			? {
+					tables: formattedTables,
+					datatable: selectedDatatable,
+					schema: effectiveSchema,
+					roles: appRoles
+				}
+			: { tables: formattedTables, datatable: undefined, schema: undefined, roles: appRoles }
 
 		const policy: Policy = {
 			on_behalf_of: $userStore?.username.includes('@')
@@ -259,15 +415,43 @@
 										<label class="text-xs text-emphasis font-semibold" for="datatable"
 											>Datatable</label
 										>
-										<Select
-											id="datatable"
-											disablePortal
-											items={datatableItems}
-											bind:value={selectedDatatable}
-											placeholder="Datatable"
-											size="sm"
-											class="w-40"
-										/>
+										<div class="flex flex-row items-center gap-2">
+											<Select
+												id="datatable"
+												disablePortal
+												items={datatableItems}
+												bind:value={selectedDatatable}
+												placeholder="Datatable"
+												size="sm"
+												class="w-40"
+											/>
+											{#if showRolePicker}
+												<!-- Reads as one phrase, "main as analyst", so the role needs no label. -->
+												<span class="text-xs text-secondary">as</span>
+												<Select
+													id="datatable-role"
+													disablePortal
+													items={loadedRoles.map((r) => ({ value: r, label: r }))}
+													bind:value={() => selectedRole, pickRole}
+													clearable={false}
+													placeholder="Role"
+													size="sm"
+													class="w-40"
+												/>
+											{/if}
+											{#if noUsableRole || rolesUnknown || accessUnknown}
+												<span
+													class="text-xs text-red-600 dark:text-red-400"
+													title={access.current.error}
+												>
+													{rolesUnknown
+														? 'could not read its roles'
+														: noUsableRole
+															? 'no role you can use'
+															: 'could not reach it'}
+												</span>
+											{/if}
+										</div>
 									</div>
 									<div>
 										<span class="text-xs text-emphasis font-semibold">Schema</span>
@@ -276,7 +460,21 @@
 												<ToggleButtonGroup bind:selected={schemaMode} noWFull>
 													{#snippet children({ item })}
 														<ToggleButton value="none" label="None" icon={Ban} {item} size="sm" />
-														<ToggleButton value="new" label="New" icon={Plus} {item} size="sm" />
+														<ToggleButton
+															value="new"
+															label="New"
+															icon={Plus}
+															disabled={!canCreateSchema}
+															tooltip={canCreateSchema
+																? undefined
+																: noUsableRole
+																	? `You can use no role of ${selectedDatatable}`
+																	: accessUnknown
+																		? `Could not read what may be created in ${selectedDatatable}`
+																		: `${effectiveRole ?? 'This connection'} cannot create schemas in ${selectedDatatable}`}
+															{item}
+															size="sm"
+														/>
 														<ToggleButton
 															value="existing"
 															label="Existing"
@@ -333,6 +531,7 @@
 								dataTableRefs={preWhitelistedTables}
 								defaultDatatable={selectedDatatable}
 								defaultSchema={effectiveSchema}
+								roles={pickerRoles}
 								standalone
 								hideDefaultSelector
 								onAdd={() => dataTableDrawer?.openDrawer()}
@@ -418,7 +617,11 @@
 					variant="default"
 					size="sm"
 					on:click={() => start(false)}
-					disabled={!templates[selectedTemplateIndex] || newSchemaAlreadyExists}
+					disabled={!templates[selectedTemplateIndex] ||
+						newSchemaAlreadyExists ||
+						!rolesSettled ||
+						!accessSettled ||
+						blockedByRole}
 				>
 					{$copilotInfo.workspaceDisabled ? 'Start' : 'Start without AI'}
 				</Button>
@@ -426,7 +629,10 @@
 					<Button
 						variant="accent"
 						on:click={() => start(true)}
-						disabled={!templates[selectedTemplateIndex] ||
+						disabled={!rolesSettled ||
+							!accessSettled ||
+							blockedByRole ||
+							!templates[selectedTemplateIndex] ||
 							!initialPrompt.trim() ||
 							newSchemaAlreadyExists}
 						startIcon={{ icon: Sparkles }}
@@ -444,7 +650,15 @@
 	bind:this={dataTableDrawer}
 	offset={10000}
 	existingRefs={preWhitelistedTables}
-	onAdd={(ref) => {
-		preWhitelistedTables = [...preWhitelistedTables, ref]
+	roles={pickerRoles}
+	onAdd={(refs, browsedRoles, roleChanged) => {
+		preWhitelistedTables = [
+			...preWhitelistedTables.filter((t) => !roleChanged.has(t.datatable)),
+			...refs
+		]
+		preWhitelistedRoles = { ...preWhitelistedRoles, ...browsedRoles }
+		if (selectedDatatable !== undefined && browsedRoles[selectedDatatable] !== undefined) {
+			selectedRole = browsedRoles[selectedDatatable]
+		}
 	}}
 />
diff --git a/frontend/src/lib/components/raw_apps/dataTableRefUtils.test.ts b/frontend/src/lib/components/raw_apps/dataTableRefUtils.test.ts
index 500311aecb..f8c0bbf935 100644
--- a/frontend/src/lib/components/raw_apps/dataTableRefUtils.test.ts
+++ b/frontend/src/lib/components/raw_apps/dataTableRefUtils.test.ts
@@ -1,5 +1,31 @@
 import { describe, expect, it } from 'vitest'
-import { buildDataTableWhitelist, isDatatableTableAllowed } from './dataTableRefUtils'
+import {
+	buildDataTableWhitelist,
+	isDatatableTableAllowed,
+	sdkDatatableCall,
+	withAppDatatableRole
+} from './dataTableRefUtils'
+
+describe('app data table roles', () => {
+	it('writes the role the way each SDK takes it', () => {
+		expect(sdkDatatableCall('main', 'analyst', 'typescript')).toBe(
+			"wmill.datatable('main', { role: 'analyst' })"
+		)
+		expect(sdkDatatableCall('main', 'analyst', 'python')).toBe(
+			"wmill.datatable('main', role='analyst')"
+		)
+		expect(sdkDatatableCall('main', undefined, 'python')).toBe('wmill.datatable()')
+	})
+
+	it('keeps one role per data table, and no map once none is left', () => {
+		const roles = withAppDatatableRole(undefined, 'main', 'analyst')
+		expect(withAppDatatableRole(roles, 'other', 'operator')).toEqual({
+			main: 'analyst',
+			other: 'operator'
+		})
+		expect(withAppDatatableRole(roles, 'main', undefined)).toBeUndefined()
+	})
+})
 
 describe('datatable whitelist helpers', () => {
 	it('allows every datatable table when no refs are configured', () => {
diff --git a/frontend/src/lib/components/raw_apps/dataTableRefUtils.ts b/frontend/src/lib/components/raw_apps/dataTableRefUtils.ts
index dfbfe6e4cd..85e6862129 100644
--- a/frontend/src/lib/components/raw_apps/dataTableRefUtils.ts
+++ b/frontend/src/lib/components/raw_apps/dataTableRefUtils.ts
@@ -16,6 +16,43 @@ export interface RawAppData {
 	datatable: string | undefined
 	/** The schema for table creation (if specified) */
 	schema: string | undefined
+	/** The role the app uses each data table through, by data table name. A data table without
+	 * an entry is used as its default role, then `admin`. */
+	roles?: Record<string, string>
+}
+
+export function appDatatableRole(
+	roles: Record<string, string> | undefined,
+	datatable: string
+): string | undefined {
+	return roles?.[datatable]
+}
+
+/** `roles` with `datatable` set to `role`, or without it when `role` is undefined. */
+export function withAppDatatableRole(
+	roles: Record<string, string> | undefined,
+	datatable: string,
+	role: string | undefined
+): Record<string, string> | undefined {
+	const next = { ...roles }
+	if (role === undefined) delete next[datatable]
+	else next[datatable] = role
+	return Object.keys(next).length > 0 ? next : undefined
+}
+
+/** The SDK call app code uses to reach a data table, in the language it is written in. A role
+ * is a keyword argument in Python and an option in TypeScript. */
+export function sdkDatatableCall(
+	datatable: string,
+	role: string | undefined,
+	language: 'typescript' | 'python'
+): string {
+	if (role === undefined) {
+		return datatable === 'main' ? 'wmill.datatable()' : `wmill.datatable('${datatable}')`
+	}
+	return language === 'python'
+		? `wmill.datatable('${datatable}', role='${role}')`
+		: `wmill.datatable('${datatable}', { role: '${role}' })`
 }
 
 /** Default data configuration */
diff --git a/frontend/src/lib/components/raw_apps/datatableUtils.svelte.ts b/frontend/src/lib/components/raw_apps/datatableUtils.svelte.ts
index 5e25b73eca..566aac9484 100644
--- a/frontend/src/lib/components/raw_apps/datatableUtils.svelte.ts
+++ b/frontend/src/lib/components/raw_apps/datatableUtils.svelte.ts
@@ -1,9 +1,27 @@
 import { resource } from 'runed'
-import { workspaceStore, dbSchemas } from '$lib/stores'
+import { workspaceStore } from '$lib/stores'
 import { WorkspaceService } from '$lib/gen'
-import { getDbSchemas } from '$lib/components/apps/components/display/dbtable/metadata'
+import { listUsableDatatableRoles } from '$lib/components/datatableUsableRoles'
+import { ADMIN_DATATABLE_ROLE } from '$lib/components/dbTypes'
 import { get } from 'svelte/store'
 
+/**
+ * `fetch` wrapped so that an answer for a request a newer one has replaced resolves to
+ * `stale()` instead: a resource keeps whichever answer lands last, and a slow answer for the
+ * previous data table or role would otherwise describe a selection that no longer exists.
+ */
+function latestOnly<A extends unknown[], T>(
+	fetch: (...args: A) => Promise<T>,
+	stale: () => T
+): (...args: A) => Promise<T> {
+	let run = 0
+	return async (...args) => {
+		const mine = ++run
+		const result = await fetch(...args)
+		return mine === run ? result : stale()
+	}
+}
+
 /**
  * Creates a resource that loads available datatables from the workspace.
  * Pass a getter function that returns the workspace to create a reactive dependency.
@@ -21,42 +39,151 @@ export function createDatatablesResource(getWorkspace: () => string | undefined)
 	})
 }
 
+export type DatatableRoles = {
+	/** The workspace and data table this answers for: while a switch is in flight, `current` still
+	 * holds the previous ones' roles, and a fork and its parent both have a `main` of their own. */
+	workspace: string | undefined
+	datatable: string | undefined
+	/** Whether the data table is under roles. Without roles `roles` is empty because there is
+	 * nothing to pick, which is not the same as a permissioned one this caller may use no role of. */
+	permissioned: boolean
+	/** The lookup failed, so an empty `roles` means nothing was learned. */
+	failed: boolean
+	roles: string[]
+	defaultRole: string
+}
+
 /**
- * Creates a resource that loads schemas for a given datatable.
- * The getDatatable getter is used as a reactive dependency - when it changes, schemas are refetched.
+ * Creates a resource that loads the roles the caller may use on a datatable, and the one it
+ * defaults to.
  */
-export function createSchemasResource(
+export function createRolesResource(
 	getDatatable: () => string | undefined,
 	getWorkspace: () => string | undefined = () => get(workspaceStore)
 ) {
-	return resource<string[]>([() => getDatatable() ?? '', () => getWorkspace() ?? ''], async () => {
-		const datatable = getDatatable()
-		const workspace = getWorkspace()
-		if (!datatable || !workspace) return []
+	const initialValue: DatatableRoles = {
+		workspace: undefined,
+		datatable: undefined,
+		permissioned: false,
+		failed: false,
+		roles: [],
+		defaultRole: ADMIN_DATATABLE_ROLE
+	}
+	const rolesResource = resource(
+		() => [getDatatable() ?? '', getWorkspace() ?? ''] as const,
+		latestOnly(
+			async ([datatableName, workspace]: readonly [string, string]): Promise<DatatableRoles> => {
+				const empty = {
+					...initialValue,
+					workspace: workspace || undefined,
+					datatable: datatableName || undefined
+				}
+				if (!datatableName || !workspace) return empty
+				try {
+					const res = await listUsableDatatableRoles(workspace, datatableName)
+					return {
+						...empty,
+						permissioned: res.permissioned,
+						roles: res.roles,
+						defaultRole: res.default_role
+					}
+				} catch (e) {
+					console.error('Failed to load datatable roles:', e)
+					return { ...empty, failed: true }
+				}
+			},
+			() => rolesResource.current
+		),
+		{ initialValue }
+	)
+	return rolesResource
+}
 
-		const resourcePath = `datatable://${datatable}`
-		// Key the schema cache by workspace too: a datatable of the same name can
-		// exist in both the nav and the acting workspace, so `datatable://<name>`
-		// alone would let one workspace's schema be reused for the other.
-		const cacheKey = `${workspace}:${resourcePath}`
-		const schemas = get(dbSchemas)
-		let dbSchema = schemas[cacheKey]
+export type DatatableAccess = {
+	/** What this answers for. Until all three match the selection, the schemas and the right to
+	 * create one belong to another workspace, data table or role. */
+	workspace: string | undefined
+	datatable: string | undefined
+	role: string | undefined
+	/** The request failed, or the server kept the entry with an error (a role this caller may
+	 * not use, an unreachable database). `canCreateSchema: false` is then no answer at all. */
+	failed: boolean
+	error: string | undefined
+	schemas: string[]
+	canCreateSchema: boolean
+}
 
-		if (!dbSchema) {
-			try {
-				schemas[cacheKey] = await getDbSchemas('postgresql', resourcePath, workspace, (msg) =>
-					console.error('Schema error:', msg)
-				)
-				dbSchema = get(dbSchemas)[cacheKey]
-			} catch (e) {
-				console.error(`Failed to load schema for ${datatable}:`, e)
-				return []
-			}
-		}
+/**
+ * Creates a resource that loads, for one data table read as one role, the schemas that role can
+ * reach and whether it may create more.
+ */
+export function createDatatableAccessResource(
+	getDatatable: () => string | undefined,
+	getRole: () => string | undefined,
+	getWorkspace: () => string | undefined = () => get(workspaceStore),
+	/** False while the role is still being settled: a listing sent before that is read as the
+	 * data table's default role, which is not the one about to be asked for. */
+	getReady: () => boolean = () => true
+) {
+	const initialValue: DatatableAccess = {
+		workspace: undefined,
+		datatable: undefined,
+		role: undefined,
+		failed: false,
+		error: undefined,
+		schemas: [],
+		canCreateSchema: false
+	}
+	const accessResource = resource(
+		() => [getDatatable() ?? '', getRole() ?? '', getWorkspace() ?? '', getReady()] as const,
+		latestOnly(
+			async ([datatable, role, workspace, ready]: readonly [
+				string,
+				string,
+				string,
+				boolean
+			]): Promise<DatatableAccess> => {
+				const asked = {
+					...initialValue,
+					workspace: workspace || undefined,
+					datatable: datatable || undefined,
+					role: role || undefined
+				}
+				if (!ready) return accessResource.current
+				if (!datatable || !workspace) return asked
+				try {
+					const tables = await WorkspaceService.listDataTableTables({
+						workspace,
+						datatableName: datatable,
+						roleFor: datatable,
+						role: role || undefined
+					})
+					const entry = tables.find((t) => t.datatable_name === datatable)
+					return {
+						...asked,
+						failed: entry === undefined || entry.error !== undefined,
+						error: entry?.error,
+						schemas: Object.keys(entry?.schemas ?? {}).sort(),
+						canCreateSchema: !!entry?.can_create_schema
+					}
+				} catch (e) {
+					console.error('Failed to load datatable access:', e)
+					return { ...asked, failed: true, error: (e as Error)?.message }
+				}
+			},
+			() => accessResource.current
+		),
+		{ initialValue }
+	)
+	return accessResource
+}
 
-		if (!dbSchema?.schema) return []
-		return Object.keys(dbSchema.schema)
-	})
+/**
+ * Whether naming a role says anything: a data table without roles has none to pick, and one
+ * whose single usable role is `admin` offers no choice.
+ */
+export function rolesWorthPicking(roles: string[]): boolean {
+	return roles.length > 1 || (roles.length === 1 && roles[0] !== ADMIN_DATATABLE_ROLE)
 }
 
 /**
diff --git a/frontend/src/lib/components/raw_apps/rawAppWorkspace.ts b/frontend/src/lib/components/raw_apps/rawAppWorkspace.ts
deleted file mode 100644
index 71702fd826..0000000000
--- a/frontend/src/lib/components/raw_apps/rawAppWorkspace.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-import { getContext, setContext } from 'svelte'
-
-// The workspace a raw-app editor operates on. In a session preview this is the
-// session's acting workspace, which differs from the navigation `$workspaceStore`
-// (a session deliberately leaves the nav store on the workspace the top nav
-// points at). RawAppEditor provides it once; the sidebar sub-components (inline
-// scripts, datatable/shared-UI drawers, DB selector, …) read it so their lookups
-// target the workspace the app actually lives in rather than the nav workspace.
-//
-// A getter (not a value) so the live `$derived` opWorkspace is read reactively at
-// each call site. Consumers fall back to `$workspaceStore` when unset — e.g. the
-// full-page app editor, where the nav workspace IS the operating workspace.
-
-const KEY = 'RawAppOperatingWorkspace'
-
-export function setRawAppOperatingWorkspace(get: () => string | undefined): void {
-	setContext(KEY, get)
-}
-
-export function getRawAppOperatingWorkspace(): (() => string | undefined) | undefined {
-	return getContext(KEY)
-}
diff --git a/frontend/src/lib/components/resources/ResourcesList.svelte b/frontend/src/lib/components/resources/ResourcesList.svelte
new file mode 100644
index 0000000000..180474276a
--- /dev/null
+++ b/frontend/src/lib/components/resources/ResourcesList.svelte
@@ -0,0 +1,1623 @@
+<script lang="ts">
+	import { getLocalDraftHint } from '$lib/localDraftHints.svelte'
+	import { page } from '$app/state'
+	import AppConnect from '$lib/components/AppConnectDrawer.svelte'
+	import CenteredPage from '$lib/components/CenteredPage.svelte'
+	import { Alert, Badge, Button, EmptyState, Skeleton, Tab, TabFade } from '$lib/components/common'
+	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
+	import Drawer from '$lib/components/common/drawer/Drawer.svelte'
+	import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
+	import Tabs from '$lib/components/common/tabs/Tabs.svelte'
+	import DeployWorkspaceDrawer from '$lib/components/DeployWorkspaceDrawer.svelte'
+	import Dropdown from '$lib/components/DropdownV2.svelte'
+	import IconedResourceType from '$lib/components/IconedResourceType.svelte'
+	import PageHeader from '$lib/components/PageHeader.svelte'
+	import Popover from '$lib/components/Popover.svelte'
+	import Required from '$lib/components/Required.svelte'
+	import { resourceTypesStore } from '$lib/components/resourceTypesStore'
+	import SchemaViewer from '$lib/components/SchemaViewer.svelte'
+	import FilterSearchbar, {
+		hasActiveFilters,
+		useUrlSyncedFilterInstance,
+		type FilterInstanceRec
+	} from '$lib/components/FilterSearchbar.svelte'
+	import { buildResourcesFilterSchema } from '$lib/components/resources/resourcesFilter'
+	import { buildResourceTypesFilterSchema } from '$lib/components/resources/resourceTypesFilter'
+	import {
+		resourceTypeSearchText,
+		setResourceTypeDisplayNames,
+		sortResourceTypesByMatch
+	} from '$lib/components/resourceTypeDisplay'
+	import SharedBadge from '$lib/components/SharedBadge.svelte'
+	import DraftBadge from '$lib/components/DraftBadge.svelte'
+	import InheritedLabels from '$lib/components/InheritedLabels.svelte'
+	import ShareModal from '$lib/components/ShareModal.svelte'
+	import SimpleEditor from '$lib/components/SimpleEditor.svelte'
+	import SupabaseConnect from '$lib/components/SupabaseConnect.svelte'
+	import Cell from '$lib/components/table/Cell.svelte'
+	import DataTable from '$lib/components/table/DataTable.svelte'
+	import Head from '$lib/components/table/Head.svelte'
+	import Row from '$lib/components/table/Row.svelte'
+	import Toggle from '$lib/components/Toggle.svelte'
+	import Tooltip from '$lib/components/Tooltip.svelte'
+	import type { ResourceType, WorkspaceDeployUISettings } from '$lib/gen'
+	import { OauthService, ResourceService, WorkspaceService, type ListableResource } from '$lib/gen'
+	import { enterpriseLicense, userWorkspaces } from '$lib/stores'
+	import { sendUserToast } from '$lib/toast'
+	import {
+		canWrite,
+		classNames,
+		debounce,
+		emptySchema,
+		removeMarkdown,
+		truncate,
+		validateFileExtension
+	} from '$lib/utils'
+	import { isDeployable, ALL_DEPLOYABLE } from '$lib/utils_deployable'
+
+	import { convert } from '@redocly/json-to-json-schema'
+	import {
+		Boxes,
+		Braces,
+		Building,
+		Circle,
+		Database,
+		FileUp,
+		Link,
+		Palette,
+		Pen,
+		Plus,
+		RotateCw,
+		Save,
+		SearchX,
+		Shield,
+		Trash,
+		Zap
+	} from 'lucide-svelte'
+	import { onMount, untrack } from 'svelte'
+	import autosize from '$lib/autosize'
+	import EditableSchemaWrapper from '$lib/components/schema/EditableSchemaWrapper.svelte'
+	import ResourceEditorDrawer from '$lib/components/ResourceEditorDrawer.svelte'
+	import {
+		agentEditorTarget,
+		closeAgentEditor,
+		openAgentEditor
+	} from '$lib/components/flows/agentEditorStore.svelte'
+	import { copilotInfo } from '$lib/aiStore'
+	import { setPageDrawerAnchor } from '$lib/components/sessions/pageDrawerSession'
+	import { useHostedPage } from '$lib/components/hostedPage'
+	import { RESOURCES_PATH } from '$lib/components/sessions/previewPaths'
+	import GfmMarkdown from '$lib/components/GfmMarkdown.svelte'
+	import ExploreAssetButton, { assetCanBeExplored } from '$lib/components/ExploreAssetButton.svelte'
+	import NoDirectDeployAlert from '$lib/components/NoDirectDeployAlert.svelte'
+	import {
+		useOperatingWorkspace,
+		useOperatingUser
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const hosted = useHostedPage()
+
+	type ResourceW = ListableResource & { canWrite: boolean; marked?: string }
+	type ResourceTypeW = ResourceType & { canWrite: boolean }
+
+	let cacheResources: ResourceW[] | undefined = $state()
+	let stateResources: ResourceW[] | undefined = $state()
+	let themeResources: ResourceW[] | undefined = $state()
+	let resources: ResourceW[] | undefined = $state()
+	let resourceTypes: ResourceTypeW[] | undefined = $state()
+
+	// Collect unique paths, types, owners for filter autocomplete
+	let allPaths: string[] = $state([])
+	let allResourceTypes: string[] = $state([])
+	let allOwners: string[] = $state([])
+	let allLabels: string[] = $state([])
+
+	let resourceTypeViewer: Drawer | undefined = $state(undefined)
+	let resourceTypeViewerObj = $state({
+		rt: '',
+		description: '',
+		schema: emptySchema(),
+		formatExtension: undefined as string | undefined,
+		isFileset: false
+	})
+
+	let resourceTypeDrawer: Drawer | undefined = $state(undefined)
+	let editResourceTypeDrawer: Drawer | undefined = $state(undefined)
+	let newResourceType = $state({
+		name: '',
+		schema: emptySchema(),
+		description: '',
+		formatExtension: undefined as string | undefined,
+		isFileset: undefined as boolean | undefined
+	})
+	let isNewResourceTypeNameValid: boolean = $state(false)
+	let resourceTypeNameExists: boolean = $state(false)
+
+	let editResourceType = $state({
+		name: '',
+		schema: emptySchema(),
+		description: '',
+		formatExtension: undefined as string | undefined,
+		isFileset: false
+	})
+	let resourceEditor: ResourceEditorDrawer | undefined = $state(undefined)
+
+	/** An `ai_agent` gets the agent editor rather than the generic resource form, which would
+	 *  render its configuration as raw JSON. Both write the same resource draft, so the choice is
+	 *  presentational and either can open a path the other left a draft at. */
+	function openResourceEditor(path: string, resourceType: string | undefined) {
+		if (hosted) {
+			hosted.openItem(path)
+			return
+		}
+		if (resourceType === 'ai_agent') {
+			// The generic editor anchors itself from `initEdit`; this one has to, or the URL, a
+			// refresh, and the AI session's idea of where you are all miss the open agent. Claim the
+			// hash first so the deep-link effect does not treat our own write as a new navigation.
+			handledHash = `#/resource/${path}`
+			// One row at a time: the hash can retarget from a resource to an agent, and the two
+			// editors are separate overlays that would otherwise stack, the older one surfacing again
+			// when the newer is closed.
+			resourceEditor?.close?.({ keepAnchor: true })
+			openAgentEditor({ path })
+			setPageDrawerAnchor(RESOURCES_PATH, path)
+		} else {
+			closeAgentEditor()
+			resourceEditor?.initEdit?.(path)
+		}
+	}
+	let shareModal: ShareModal | undefined = $state(undefined)
+	let appConnect: AppConnect | undefined = $state(undefined)
+	let supabaseConnect: SupabaseConnect | undefined = $state(undefined)
+	let deleteConfirmedCallback: (() => void) | undefined = $state(undefined)
+	let deleteIsLinked = $state(false)
+	let deletePath = $state('')
+	let loading = $state({
+		resources: true,
+		types: true
+	})
+
+	let showCreateButtons = $state(false)
+
+	// FilterSearchbar setup
+	let userFoldersFilterType = $derived(
+		operatingUser.current?.is_super_admin && operatingUser.current.username.includes('@')
+			? 'only f/*'
+			: operatingUser.current?.is_admin || operatingUser.current?.is_super_admin
+				? 'u/username and f/*'
+				: undefined
+	)
+	let resourcesFilterSchema = $derived(
+		buildResourcesFilterSchema({
+			paths: allPaths,
+			resourceTypes: allResourceTypes,
+			owners: allOwners,
+			labels: allLabels,
+			showUserFoldersFilter: userFoldersFilterType !== undefined,
+			userFoldersLabel:
+				userFoldersFilterType === 'only f/*'
+					? 'Only f/*'
+					: `Only u/${operatingUser.current?.username} and f/*`
+		})
+	)
+	let filters = useUrlSyncedFilterInstance(untrack(() => resourcesFilterSchema))
+	// A link can carry the user folders filter to someone it is not offered to, where it would sit
+	// set with no chip to clear it. Dropped only once a user is actually known: `resolved` holds for
+	// the navigation workspace even while its user is still loading.
+	$effect(() => {
+		if (!operatingUser.resolved($operatingWorkspace) || !operatingUser.current) return
+		if (userFoldersFilterType !== undefined) return
+		if (!filters.val.user_folders_only) return
+		untrack(() => {
+			const { user_folders_only: _, ...rest } = filters.val
+			filters.val = rest
+		})
+	})
+	let itemFolders = $derived(
+		Array.from(
+			new Set(
+				(resources ?? [])
+					.map((x) => x.path.split('/').slice(0, 2).join('/'))
+					.filter((x) => x.startsWith('f/'))
+			)
+		)
+			.sort()
+			.map((f) => f.replace(/^f\//, ''))
+	)
+	let resourceTypesFilterSchema = buildResourceTypesFilterSchema()
+	let resourceTypesFilters: {
+		val: Partial<FilterInstanceRec<typeof resourceTypesFilterSchema>>
+	} = $state({ val: {} })
+	let filteredResourceTypes = $derived.by(() => {
+		if (!resourceTypes) return resourceTypes
+		const f = resourceTypesFilters.val
+		// Bare search covers name and description together, like the add-resource drawer --
+		// `gdrive` is only findable as "google" through its description. The `name:` and
+		// `description:` facets stay scoped to their own field.
+		const defaultSearch = f._default_?.trim().toLowerCase()
+		const nameSearch = f.name?.toLowerCase()
+		const descSearch = f.description?.toLowerCase()
+		if (!defaultSearch && !nameSearch && !descSearch) return resourceTypes
+		const matched = resourceTypes.filter((rt) => {
+			if (
+				defaultSearch &&
+				!resourceTypeSearchText(rt.name, rt.description).toLowerCase().includes(defaultSearch)
+			)
+				return false
+			if (nameSearch && !rt.name.toLowerCase().includes(nameSearch)) return false
+			if (descSearch && !(rt.description ?? '').toLowerCase().includes(descSearch)) return false
+			return true
+		})
+		return sortResourceTypesByMatch(
+			matched,
+			defaultSearch ?? '',
+			(rt) => rt.name,
+			(rt) => rt.description
+		)
+	})
+
+	let folderPresets = $derived([
+		...itemFolders.map((f) => ({ name: `f/${f}`, value: `path_start:\\ f/${f}/` })),
+		...allLabels.map((l) => ({ name: l, value: `label:\\ ${l}` })),
+		...(!resourcesFilterSchema.user_folders_only.hidden
+			? [
+					{
+						name: resourcesFilterSchema.user_folders_only.label ?? '?',
+						value: 'user_folders_only:\\ true'
+					}
+				]
+			: [])
+	])
+
+	async function loadResources(): Promise<void> {
+		resources = await loadResourceInternal(undefined, 'cache,state,app_theme')
+		loading.resources = false
+	}
+
+	async function loadCache(): Promise<void> {
+		cacheResources = await loadResourceInternal('cache', undefined)
+		loading.resources = false
+	}
+
+	async function loadState(): Promise<void> {
+		stateResources = await loadResourceInternal('state', undefined)
+		loading.resources = false
+	}
+
+	async function loadTheme(): Promise<void> {
+		themeResources = await loadResourceInternal('app_theme', undefined)
+		loading.resources = false
+	}
+
+	async function loadResourceInternal(
+		resourceType: string | undefined,
+		resourceTypeExclude: string | undefined
+	): Promise<ResourceW[]> {
+		const currentFilters = filters.val
+
+		// Build API parameters from filters.
+		// `includeDraftOnly` surfaces per-user drafts at paths that have
+		// no deployed resource — appended server-side when no narrowing
+		// filter is set, so the user sees AI-agent-created drafts on
+		// the home page.
+		const apiParams: any = {
+			workspace: $operatingWorkspace!,
+			resourceTypeExclude,
+			resourceType: resourceType || (currentFilters.resource_type as string | undefined),
+			includeDraftOnly: true
+		}
+
+		if (currentFilters.path) {
+			// path filter can be comma-separated for multiple values
+			apiParams.path = currentFilters.path
+		}
+		if (currentFilters.path_start) {
+			apiParams.pathStart = currentFilters.path_start
+		}
+		if (currentFilters.description) {
+			apiParams.description = currentFilters.description
+		}
+		if (currentFilters.value) {
+			apiParams.value = currentFilters.value
+		}
+		if (currentFilters.owner) {
+			apiParams.pathStart = currentFilters.owner
+		}
+		if (currentFilters._default_) {
+			apiParams.broadFilter = currentFilters._default_
+		}
+		if (currentFilters.label) {
+			apiParams.label = currentFilters.label
+		}
+
+		const result = (await ResourceService.listResource(apiParams)).map((x) => {
+			return {
+				canWrite:
+					canWrite(x.path, x.extra_perms!, operatingUser.current) &&
+					$operatingWorkspace! == x.workspace_id,
+				...x
+			}
+		})
+
+		// Extract unique values for autocomplete
+		allPaths = Array.from(new Set(result.map((x) => x.path))).sort()
+		allResourceTypes = Array.from(new Set(result.map((x) => x.resource_type))).sort()
+		allOwners = Array.from(
+			new Set(result.map((x) => x.path.split('/').slice(0, 2).join('/')))
+		).sort()
+		allLabels = Array.from(
+			new Set(result.flatMap((x) => [...(x.labels ?? []), ...(x.inherited_labels ?? [])]))
+		).sort()
+
+		return result
+	}
+
+	async function loadResourceTypes(): Promise<void> {
+		const rows = await ResourceService.listResourceType({ workspace: $operatingWorkspace! })
+		setResourceTypeDisplayNames(rows)
+		resourceTypes = rows.map((x) => {
+			return {
+				canWrite: $operatingWorkspace! == x.workspace_id,
+				...x
+			}
+		})
+		loading.types = false
+	}
+
+	async function deleteResource(path: string, account?: number): Promise<void> {
+		if (account) {
+			OauthService.disconnectAccount({ workspace: $operatingWorkspace!, id: account })
+		}
+		// The response names the linked variables that went with it, which nothing else on the
+		// page would show.
+		sendUserToast(await ResourceService.deleteResource({ workspace: $operatingWorkspace!, path }))
+		reload()
+	}
+
+	async function addResourceType(): Promise<void> {
+		if (!newResourceType.isFileset) {
+			if (newResourceType.formatExtension === '') {
+				throw new Error('Invalid empty file extension (make sure it is selected)')
+			}
+			if (!validateFileExtension(newResourceType.formatExtension ?? 'txt')) {
+				throw new Error('Invalid file extension')
+			}
+		}
+		await ResourceService.createResourceType({
+			workspace: $operatingWorkspace!,
+			requestBody: {
+				name: (disableCustomPrefix ? '' : 'c_') + newResourceType.name,
+				schema: newResourceType.schema,
+				description: newResourceType.description,
+				format_extension: newResourceType.formatExtension,
+				is_fileset: newResourceType.isFileset
+			}
+		})
+		resourceTypeDrawer?.closeDrawer?.()
+		sendUserToast('Resource type created')
+		loadResourceTypes()
+		$resourceTypesStore = undefined
+	}
+
+	async function updateResourceType(): Promise<void> {
+		await ResourceService.updateResourceType({
+			workspace: $operatingWorkspace!,
+			path: editResourceType.name,
+			requestBody: {
+				schema: editResourceType.schema,
+				description: editResourceType.description
+			}
+		})
+		editResourceTypeDrawer?.closeDrawer?.()
+		sendUserToast('Resource type updated')
+		loadResourceTypes()
+	}
+
+	async function handleDeleteResourceType(name: string) {
+		try {
+			await ResourceService.deleteResourceType({ workspace: $operatingWorkspace!, path: name })
+			loadResourceTypes()
+		} catch (err) {
+			if (err.status === 400 && err.body.includes('foreign key')) {
+				sendUserToast(
+					`Could not delete resource type because there are resources attached to it. Delete resources using this type first.`,
+					true
+				)
+			} else {
+				sendUserToast(`Could not delete resource type: ${err?.body || err}`, true)
+			}
+		}
+	}
+
+	const startNewType = () => {
+		// Find a unique name by checking for duplicates and appending a number
+		const baseName = 'my_resource_type'
+		let uniqueName = baseName
+		let counter = 2
+
+		// Check if the base name or numbered variants exist
+		while (true) {
+			const fullName = (disableCustomPrefix ? '' : 'c_') + uniqueName
+			const exists = resourceTypes?.some((rt) => rt.name === fullName) ?? false
+
+			if (!exists) {
+				break
+			}
+
+			uniqueName = `${baseName}_${counter}`
+			counter++
+		}
+
+		newResourceType = {
+			name: uniqueName,
+			schema: emptySchema(),
+			description: '',
+			formatExtension: undefined,
+			isFileset: undefined
+		}
+		validateResourceTypeName()
+
+		resourceTypeDrawer?.openDrawer?.()
+	}
+
+	async function startEditResourceType(name: string) {
+		const rt = await ResourceService.getResourceType({
+			workspace: $operatingWorkspace!,
+			path: name
+		})
+		editResourceType = {
+			name: rt.name,
+			schema: rt.schema as any,
+			description: rt.description ?? '',
+			formatExtension: rt.format_extension,
+			isFileset: rt.is_fileset ?? false
+		}
+		editResourceTypeDrawer?.openDrawer?.()
+	}
+
+	onMount(() => {
+		// Redirect targets of this route's own connect flows, never a host's.
+		if (hosted) return
+		const callback = page.url.searchParams.get('callback')
+		if (callback == 'supabase_wizard') {
+			supabaseConnect?.open?.()
+		}
+
+		const connect_app = page.url.searchParams.get('connect_app')
+		if (connect_app) {
+			const rt = connect_app ?? undefined
+			if (rt == 'undefined') {
+				appConnect?.open?.()
+			} else {
+				appConnect?.open?.(rt)
+			}
+		}
+	})
+
+	function openInferrer(): void {
+		inferrer?.openDrawer?.()
+	}
+
+	let disableCustomPrefix = $state(false)
+	let tab: 'workspace' | 'types' | 'states' | 'cache' | 'theme' = $state('workspace') as
+		| 'workspace'
+		| 'types'
+		| 'states'
+		| 'cache'
+		| 'theme'
+
+	let inferrer: Drawer | undefined = $state(undefined)
+	let inferrerJson = $state('')
+
+	function inferJson(): void {
+		try {
+			newResourceType.schema = {
+				$schema: undefined,
+				required: [],
+				properties: {},
+				...convert(JSON.parse(inferrerJson))
+			}
+		} catch (e) {
+			sendUserToast(`Invalid JSON: ${e}`, true)
+		}
+		inferrer?.closeDrawer?.()
+	}
+	let deploymentDrawer: DeployWorkspaceDrawer | undefined = $state(undefined)
+
+	async function reload() {
+		loading = {
+			resources: true,
+			types: true
+		}
+		if (tab == 'cache') {
+			await loadCache()
+		} else if (tab == 'states') {
+			await loadState()
+		} else if (tab == 'theme') {
+			await loadTheme()
+		} else {
+			await loadResources()
+		}
+		await loadResourceTypes()
+		loading = {
+			resources: false,
+			types: false
+		}
+	}
+
+	let deployUiSettings: WorkspaceDeployUISettings | undefined = $state(undefined)
+
+	async function getDeployUiSettings() {
+		if (!$enterpriseLicense) {
+			deployUiSettings = ALL_DEPLOYABLE
+			return
+		}
+		let settings = await WorkspaceService.getPublicSettings({ workspace: $operatingWorkspace! })
+		deployUiSettings = settings.deploy_ui ?? ALL_DEPLOYABLE
+	}
+	getDeployUiSettings()
+
+	function validateResourceTypeName() {
+		const snakeCaseRegex = /^[a-z0-9]+(_[a-z0-9]+)*$/
+		isNewResourceTypeNameValid = snakeCaseRegex.test(newResourceType.name)
+		checkResourceTypeNameExists.debounced()
+	}
+
+	const checkResourceTypeNameExists = debounce(() => {
+		if (!newResourceType.name) {
+			resourceTypeNameExists = false
+			return
+		}
+		const fullName = (disableCustomPrefix ? '' : 'c_') + newResourceType.name
+		resourceTypeNameExists = resourceTypes?.some((rt) => rt.name === fullName) ?? false
+	}, 300)
+
+	// Re-check when prefix setting changes
+	$effect(() => {
+		if (disableCustomPrefix !== undefined) {
+			checkResourceTypeNameExists.debounced()
+		}
+	})
+
+	function toSnakeCase() {
+		newResourceType.name = newResourceType.name
+			.replace(/([a-z0-9])([A-Z])/g, '$1_$2')
+			.replace(/[\W]+/g, '_')
+			.replace(/_+/g, '_')
+			.replace(/^_+|_+$/g, '')
+			.toLowerCase()
+		validateResourceTypeName()
+	}
+
+	let resourceNameToFileExtMap: Record<string, string> | undefined = undefined
+	let resourceNameToIsFilesetMap: Record<string, boolean> | undefined = undefined
+
+	let loadingResourceNameToFileExt = false
+	async function loadResourceNameToFileExtMap() {
+		if (resourceNameToFileExtMap != undefined) return
+		if (loadingResourceNameToFileExt) {
+			while (resourceNameToFileExtMap == undefined) {
+				console.log('waiting for resourceNameToFileExtMap')
+				await new Promise((resolve) => setTimeout(resolve, 100))
+			}
+			return
+		}
+		loadingResourceNameToFileExt = true
+		try {
+			const raw = (await ResourceService.fileResourceTypeToFileExtMap({
+				workspace: $operatingWorkspace!
+			})) as Record<string, string | { format_extension: string | null; is_fileset: boolean }>
+			resourceNameToFileExtMap = {}
+			resourceNameToIsFilesetMap = {}
+			for (const [k, v] of Object.entries(raw)) {
+				if (typeof v === 'string') {
+					resourceNameToFileExtMap[k] = v
+					resourceNameToIsFilesetMap![k] = false
+				} else {
+					if (v.format_extension) {
+						resourceNameToFileExtMap[k] = v.format_extension
+					}
+					resourceNameToIsFilesetMap![k] = v.is_fileset ?? false
+				}
+			}
+		} catch (e) {
+			console.error('Error loading resourceNameToFileExtMap', e)
+		} finally {
+			loadingResourceNameToFileExt = false
+		}
+	}
+
+	function resourceNameToFileExt(resourceName: string): string | undefined {
+		return resourceNameToFileExtMap?.[resourceName]
+	}
+
+	function resourceNameIsFileset(resourceName: string): boolean {
+		return resourceNameToIsFilesetMap?.[resourceName] ?? false
+	}
+
+	// Eagerly load the map
+	loadResourceNameToFileExtMap()
+
+	// Current resources based on tab
+	let currentResources = $derived(
+		tab == 'cache'
+			? cacheResources
+			: tab == 'states'
+				? stateResources
+				: tab == 'theme'
+					? themeResources
+					: resources
+	)
+
+	// Filter resources client-side for user folder filtering (admin feature)
+	let filteredItems = $derived.by(() => {
+		let items = currentResources
+		if (filters.val.user_folders_only && items) {
+			items = items.filter((item) => {
+				if (userFoldersFilterType === 'only f/*') return item.path.startsWith('f/')
+				if (userFoldersFilterType === 'u/username and f/*')
+					return (
+						item.path.startsWith('f/') ||
+						item.path.startsWith(`u/${operatingUser.current?.username}/`)
+					)
+				return true
+			})
+		}
+		return items
+	})
+
+	// Reload resources when filters change
+	$effect(() => {
+		filters.val
+		if ($operatingWorkspace) {
+			untrack(() => {
+				if (tab === 'workspace') {
+					loadResources()
+				} else if (tab === 'theme') {
+					loadTheme()
+				} else if (tab === 'cache') {
+					loadCache()
+				} else if (tab === 'states') {
+					loadState()
+				}
+			})
+		}
+	})
+	$effect(() => {
+		if ($operatingWorkspace && operatingUser.current) {
+			untrack(() => {
+				loadResources()
+				loadResourceTypes()
+			})
+		}
+	})
+
+	// Deep link: #/resource/<path> opens that resource's edit drawer. Reactive
+	// rather than onMount so a hash change on the already-mounted page (e.g. the
+	// AI session preview re-pointing its tab) opens the drawer too. Row links
+	// pre-set handledHash: their onclick already opens the drawer.
+	let handledHash = ''
+	$effect(() => {
+		// A host opens rows itself, and the document's hash is not this page's.
+		if (hosted) return
+		const hash = page.url.hash
+		if (!hash.startsWith('#/resource/')) {
+			// Navigating away from a drawer target must clear the tracker, or
+			// re-targeting the same item later would be skipped as already handled.
+			handledHash = ''
+			return
+		}
+		if (hash === handledHash || !resourceEditor) return
+		// The type decides which editor opens, so wait for the list that carries it.
+		if (!resources) return
+		handledHash = hash
+		const path = hash.slice(11)
+		void openResourceFromHash(path)
+	})
+
+	/** The listing is narrowed by the active filters, so a deep-linked resource may not be in it.
+	 *  Treating that absence as "unknown type" would open the generic form, which materializes a
+	 *  default into every field the value omits and so writes a draft just by rendering. Ask the
+	 *  server instead. */
+	async function openResourceFromHash(path: string) {
+		let resourceType = resources?.find((r) => r.path === path)?.resource_type
+		if (resourceType === undefined) {
+			// The hash can move on while this is in flight, and two lookups can land out of order.
+			// Whichever resolves last must not open an editor the URL has already left.
+			const openingFor = handledHash
+			try {
+				resourceType = (
+					await ResourceService.getResource({ workspace: $operatingWorkspace!, path })
+				).resource_type
+			} catch (err) {
+				if (handledHash !== openingFor) return
+				// Opening the generic form on an unknown type is the very thing this avoids, so a
+				// failed lookup opens nothing at all. The hash stays claimed: the effect above reads
+				// it, so releasing it here would re-enter this lookup and toast on a loop. Clicking
+				// the row is the way to try again.
+				sendUserToast(`Could not open ${path}: ${err}`, true)
+				return
+			}
+			if (handledHash !== openingFor) return
+		}
+		openResourceEditor(path, resourceType)
+	}
+
+	let showTable = $derived(
+		tab == 'workspace' || tab == 'states' || tab == 'cache' || tab == 'theme'
+	)
+
+	let activeFilters = $derived(hasActiveFilters(filters.val))
+
+	const emptyStates: Record<string, { icon: any; title: string; description: string }> = {
+		workspace: {
+			icon: Boxes,
+			title: 'No resources yet',
+			description:
+				'Resources hold the connection settings and credentials your scripts, flows and apps use to reach external systems.'
+		},
+		states: {
+			icon: Database,
+			title: 'No states yet',
+			description:
+				'States appear here once a script stores data to keep it persistent between runs of the same trigger.'
+		},
+		cache: {
+			icon: Zap,
+			title: 'No cached results yet',
+			description:
+				'Cached results appear here once a flow step with caching enabled has run at least once.'
+		},
+		theme: {
+			icon: Palette,
+			title: 'No themes yet',
+			description:
+				'Themes are CSS for the legacy low-code app editor only. Add one from the CSS panel of an app — they cannot be created here.'
+		}
+	}
+	let emptyState = $derived(emptyStates[tab] ?? emptyStates.workspace)
+</script>
+
+<ConfirmationModal
+	open={Boolean(deleteConfirmedCallback)}
+	title="Remove resource"
+	confirmationText="Remove"
+	trashbin
+	on:canceled={() => {
+		deleteConfirmedCallback = undefined
+	}}
+	on:confirmed={() => {
+		if (deleteConfirmedCallback) {
+			deleteConfirmedCallback()
+		}
+		deleteConfirmedCallback = undefined
+	}}
+>
+	<div class="flex flex-col w-full space-y-4">
+		<span
+			>Are you sure you want to remove <span class="font-semibold break-all">{deletePath}</span
+			>?</span
+		>
+		{#if deleteIsLinked}
+			<Alert type="warning" title="Linked variable">
+				This resource is linked with a variable of the same path. That variable is deleted with it,
+				unless another resource still references it.
+			</Alert>
+		{/if}
+		<Alert type="info" title="Bypass confirmation">
+			<div>
+				You can press
+				<Badge color="dark-gray">SHIFT</Badge>
+				while removing a resource to bypass confirmation.
+			</div>
+		</Alert>
+	</div>
+</ConfirmationModal>
+
+<DeployWorkspaceDrawer bind:this={deploymentDrawer} />
+
+<Drawer bind:this={inferrer} size="800px">
+	<DrawerContent title="Infer type from JSON" on:close={() => inferrer?.toggleDrawer?.()}>
+		<SimpleEditor
+			bind:code={inferrerJson}
+			lang="json"
+			class="h-full"
+			fixedOverflowWidgets={false}
+		/>
+		{#snippet actions()}
+			<Button unifiedSize="sm" on:click={inferJson}>Infer</Button>
+		{/snippet}
+	</DrawerContent>
+</Drawer>
+
+<Drawer bind:this={resourceTypeViewer} size="800px">
+	<DrawerContent title={resourceTypeViewerObj.rt} on:close={resourceTypeViewer.closeDrawer}>
+		{#snippet titleExtra()}
+			<IconedResourceType
+				name={resourceTypeViewerObj.rt}
+				formatExtension={resourceTypeViewerObj.formatExtension}
+				isFileset={resourceTypeViewerObj.isFileset}
+				silent
+				width="20px"
+				height="20px"
+			/>
+		{/snippet}
+		<div class="flex flex-col gap-6">
+			{#if resourceTypeViewerObj.description}
+				<GfmMarkdown md={resourceTypeViewerObj.description ?? ''} prose="sm" noPadding />
+			{/if}
+			{#if resourceTypeViewerObj.isFileset}
+				<Alert type="info" title="Fileset resource type">
+					This resource type represents a collection of files. Each file is identified by its
+					relative path and contains text content. In the CLI, filesets are stored as directories.
+				</Alert>
+			{:else if resourceTypeViewerObj.formatExtension}
+				<Alert
+					type="info"
+					title="Plain text file resource (.{resourceTypeViewerObj.formatExtension})"
+				>
+					This resource type represents a plain text file with a <b
+						>.{resourceTypeViewerObj.formatExtension}</b
+					>
+					extension. (e.g. <b>my_file.{resourceTypeViewerObj.formatExtension}</b>)
+				</Alert>
+			{:else}
+				<SchemaViewer schema={resourceTypeViewerObj.schema} />
+			{/if}
+		</div>
+	</DrawerContent>
+</Drawer>
+
+<Drawer bind:this={editResourceTypeDrawer} size="800px">
+	<DrawerContent title="Edit resource type" on:close={editResourceTypeDrawer.closeDrawer}>
+		{#snippet actions()}
+			<Button
+				startIcon={{ icon: Save }}
+				on:click={updateResourceType}
+				unifiedSize="md"
+				variant="accent">Update</Button
+			>
+		{/snippet}
+		<div class="flex flex-col gap-6">
+			<label for="inp">
+				<div class="mb-1 font-semibold text-emphasis text-xs gap-1 flex flex-row items-center"
+					>Name
+					<div class="flex flex-row items-center gap-x-4">
+						<div class="flex flex-row items-center">
+							<div class="inline-block">
+								<input
+									disabled
+									id="inp"
+									type="text"
+									bind:value={editResourceType.name}
+									class={classNames('!h-8  !border !border-gray-200')}
+								/>
+							</div>
+						</div>
+					</div>
+				</div></label
+			>
+			<label>
+				<div class="mb-1 font-semibold text-emphasis text-xs">Description</div>
+				<textarea use:autosize autocomplete="off" bind:value={editResourceType.description}
+				></textarea></label
+			>
+			<div>
+				{#if editResourceType.isFileset}
+					<Alert type="info" title="Fileset resource type">
+						This resource type represents a collection of files. The schema cannot be edited.
+					</Alert>
+				{:else if editResourceType.formatExtension}
+					<Alert type="info" title="Plain text file resource (.{editResourceType.formatExtension})">
+						This resource type represents a plain text file with a <b
+							>.{editResourceType.formatExtension}</b
+						>
+						extension. (e.g. <b>my_file.{editResourceType.formatExtension}</b>). The schema only
+						contains a `content` field and thus cannot be edited.
+					</Alert>
+				{:else}
+					<div class="mb-1 font-semibold text-emphasis text-xs">Schema</div>
+					<div class="flex flex-col gap-2">
+						<EditableSchemaWrapper bind:schema={editResourceType.schema} noPreview />
+					</div>
+				{/if}
+			</div>
+		</div>
+	</DrawerContent>
+</Drawer>
+
+<Drawer bind:this={resourceTypeDrawer} size="1200px">
+	<DrawerContent title="Create resource type" on:close={resourceTypeDrawer.closeDrawer}>
+		{#snippet actions()}
+			<Button
+				unifiedSize="md"
+				variant="accent"
+				startIcon={{ icon: Save }}
+				on:click={addResourceType}
+				disabled={!isNewResourceTypeNameValid || resourceTypeNameExists}>Save</Button
+			>
+		{/snippet}
+		<div class="flex flex-col gap-6">
+			<label for="inp">
+				<div class="mb-1 font-semibold text-emphasis text-xs gap-1 flex flex-row items-center"
+					>Name<Required required={true} /><Tooltip>
+						Resource types are synchronized with the official types on the hub regularly. The `c_`
+						prefix is to avoid name clashes with them.
+					</Tooltip></div
+				>
+				<div class="flex flex-row items-center gap-x-4">
+					<div class="flex flex-row items-center">
+						{#if !disableCustomPrefix}
+							<span
+								class="border border-r-0 rounded-l py-1 text-sm bg-surface-secondary inline-block w-8 h-8 px-2"
+							>
+								c_
+							</span>
+						{/if}
+
+						<div class="inline-block">
+							<input
+								id="inp"
+								type="text"
+								bind:value={newResourceType.name}
+								class={classNames('!h-8  !border ', !disableCustomPrefix ? '!rounded-l-none' : '')}
+								oninput={validateResourceTypeName}
+							/>
+						</div>
+					</div>
+					{#if operatingUser.current?.is_admin || operatingUser.current?.is_super_admin}
+						<Toggle
+							bind:checked={disableCustomPrefix}
+							options={{ right: 'disable c_ prefix (admin only)' }}
+						/>
+					{/if}
+				</div>
+				{#if newResourceType.name}
+					{#if !isNewResourceTypeNameValid}
+						<p class="mt-1 px-2 text-red-600 dark:text-red-400 text-2xs"
+							>Name must be snake_case!
+							<button onclick={toSnakeCase} class="text-blue-600">Fix...</button></p
+						>
+					{:else if resourceTypeNameExists}
+						<p class="mt-1 px-2 text-red-600 dark:text-red-400 text-2xs"
+							>A resource type with this name already exists!</p
+						>
+					{/if}
+				{/if}
+			</label>
+			<label>
+				<div class="mb-1 font-semibold text-emphasis text-xs">Description</div>
+				<textarea use:autosize autocomplete="off" bind:value={newResourceType.description}
+				></textarea></label
+			>
+			<div>
+				<div class="flex justify-between w-full items-center mb-1">
+					<div class="font-semibold text-emphasis text-xs">Schema</div>
+					<div class="w-full flex flex-row-reverse">
+						<Button
+							on:click={openInferrer}
+							unifiedSize="md"
+							variant="default"
+							startIcon={{ icon: Braces }}
+						>
+							Infer schema from a json value
+						</Button>
+					</div>
+				</div>
+
+				<div class="flex flex-col gap-2">
+					<EditableSchemaWrapper
+						bind:schema={newResourceType.schema}
+						bind:formatExtension={newResourceType.formatExtension}
+						bind:isFileset={newResourceType.isFileset}
+						fullHeight
+					/>
+				</div>
+			</div>
+		</div>
+	</DrawerContent>
+</Drawer>
+
+{#if operatingUser.current?.operator && $operatingWorkspace && !$userWorkspaces.find((_) => _.id === $operatingWorkspace)?.operator_settings?.resources}
+	<div class="bg-red-100 border-l-4 border-red-600 text-orange-700 p-4 m-4 mt-12" role="alert">
+		<p class="font-bold">Unauthorized</p>
+		<p>Page not available for operators</p>
+	</div>
+{:else}
+	<CenteredPage>
+		<PageHeader
+			title="Resources"
+			tooltip="Save and permission rich objects (JSON) including credentials obtained through OAuth."
+			documentationLink="https://www.windmill.dev/docs/core_concepts/resources_and_types"
+		>
+			{#if showCreateButtons}
+				<div class="flex flex-row justify-end gap-4">
+					<Button
+						variant="default"
+						unifiedSize="md"
+						startIcon={{ icon: Plus }}
+						on:click={startNewType}
+						aiId="resources-add-resource-type"
+						aiDescription="Add resource type"
+					>
+						Add resource type
+					</Button>
+					<Button
+						unifiedSize="md"
+						variant="accent"
+						startIcon={{ icon: Boxes }}
+						on:click={() => appConnect?.open?.()}
+						aiId="resources-add-resource"
+						aiDescription="Add resource"
+					>
+						Add resource
+					</Button>
+				</div>
+			{/if}
+		</PageHeader>
+		<NoDirectDeployAlert onUpdateCanEditStatus={(v) => (showCreateButtons = v)} />
+		<div class="flex justify-between">
+			<Tabs
+				class="w-full"
+				bind:selected={tab}
+				on:selected={(e) => {
+					if (e.detail == 'cache') {
+						loading.resources = true
+						loadCache()
+					} else if (e.detail == 'states') {
+						loading.resources = true
+						loadState()
+					} else if (e.detail == 'theme') {
+						loading.resources = true
+						loadTheme()
+					}
+				}}
+			>
+				<Tab value="workspace" label="Workspace" icon={Building} />
+				<Tab value="types" label="Resource Types">
+					{#snippet extra()}
+						<Tooltip
+							documentationLink="https://www.windmill.dev/docs/core_concepts/resources_and_types"
+						>
+							Every resource has a Resource Type attached to it which contains its schema and make
+							it easy in scripts and flows to accept only resources of a specific resource type.
+						</Tooltip>
+					{/snippet}
+				</Tab>
+				<Tab value="states" label="States">
+					{#snippet extra()}
+						<Tooltip>
+							States are actually resources (but excluded from the Workspace tab for clarity).
+							States are used by scripts to keep data persistent between runs of the same script by
+							the same trigger (schedule or user)
+						</Tooltip>
+					{/snippet}
+				</Tab>
+				<Tab value="cache" label="Cache">
+					{#snippet extra()}
+						<Tooltip>
+							Cached results are actually resources (but excluded from the Workspace tab for
+							clarity). Cache are used by flows's step to cache result to avoid recomputing
+							unnecessarily
+						</Tooltip>
+					{/snippet}
+				</Tab>
+				<Tab value="theme" label="Theme">
+					{#snippet extra()}
+						<Tooltip>
+							Themes are actually resources (but excluded from the Workspace tab for clarity). They
+							are CSS for the legacy low-code app editor only, and are added from the CSS panel of
+							an app rather than from this page.
+						</Tooltip>
+					{/snippet}
+				</Tab>
+			</Tabs>
+			<div class="flex gap-2 grow justify-end">
+				<Button
+					unifiedSize="md"
+					iconOnly
+					onClick={reload}
+					startIcon={{
+						icon: RotateCw,
+						classes: loading.resources || loading.types ? 'animate-spin' : ''
+					}}
+				/>
+				{#if tab == 'types'}
+					<FilterSearchbar
+						schema={resourceTypesFilterSchema}
+						class="max-w-[26rem] grow"
+						bind:value={resourceTypesFilters.val}
+						placeholder="Filter resource types..."
+					/>
+				{:else}
+					<FilterSearchbar
+						schema={resourcesFilterSchema}
+						class="max-w-[26rem] grow"
+						bind:value={filters.val}
+						placeholder="Filter resources..."
+						presets={folderPresets}
+					/>
+				{/if}
+			</div>
+		</div>
+		<TabFade key={tab}>
+			{#if showTable}
+				<div class="overflow-x-auto pb-40 mt-4">
+					{#if loading.resources}
+						<Skeleton layout={[0.5, [2], 1]} />
+						{#each new Array(6) as _}
+							<Skeleton layout={[[4], 0.7]} />
+						{/each}
+					{:else if filteredItems?.length == 0}
+						{#if activeFilters}
+							<EmptyState
+								icon={SearchX}
+								title="No resources found"
+								description="No resource matches the current filters. Try clearing or widening them."
+							/>
+						{:else}
+							<EmptyState
+								icon={emptyState.icon}
+								title={emptyState.title}
+								description={emptyState.description}
+								action={tab == 'workspace' && showCreateButtons
+									? {
+											label: 'Add a resource',
+											icon: Boxes,
+											onClick: () => appConnect?.open?.(),
+											aiId: 'resources-empty-add-resource',
+											aiDescription: 'Add resource'
+										}
+									: undefined}
+							/>
+						{/if}
+					{:else}
+						<DataTable>
+							<Head>
+								<Row>
+									<Cell head first />
+									<Cell head>Path</Cell>
+									<Cell head>Resource type</Cell>
+									<Cell head>Description</Cell>
+									<Cell head>Status</Cell>
+									<Cell head last actions>Actions</Cell>
+								</Row>
+							</Head>
+							<tbody class="divide-y bg-surface">
+								{#if filteredItems}
+									{#each filteredItems as { path, description, resource_type, extra_perms, canWrite, is_oauth, is_linked, account, refresh_error, is_expired, marked, is_refreshed, labels, inherited_labels, ws_specific, draft_only, is_draft }}
+										{@const hasDraft =
+											getLocalDraftHint($operatingWorkspace, 'resource', path) ?? is_draft}
+										<Row>
+											<Cell first>
+												<SharedBadge {canWrite} extraPerms={extra_perms} />
+											</Cell>
+											<Cell>
+												<div class="flex items-center gap-2">
+													<a
+														class="break-all"
+														href="#/resource/{path}"
+														onclick={() => {
+															handledHash = `#/resource/${path}`
+															openResourceEditor(path, resource_type)
+														}}
+														>{#if marked}{@html marked}{:else}{path}{/if}{hasDraft ? '*' : ''}</a
+													>
+													<DraftBadge {draft_only} is_draft={hasDraft} />
+													{#if labels?.length}
+														<div class="flex items-center gap-0.5">
+															{#each labels as label}
+																<Badge
+																	color="blue"
+																	small
+																	class="px-1"
+																	title="Label: {label}"
+																	clickable
+																	onclick={() => {
+																		const arr = (filters.val.label ?? '').split(',').filter(Boolean)
+																		const idx = arr.indexOf(label)
+																		if (idx >= 0) arr.splice(idx, 1)
+																		else arr.push(label)
+																		const newFilters = { ...filters.val }
+																		if (arr.length) newFilters.label = arr.join(',')
+																		else delete newFilters.label
+																		filters.val = newFilters
+																	}}>{label}</Badge
+																>
+															{/each}
+														</div>
+													{/if}
+													<InheritedLabels labels={inherited_labels} />
+												</div>
+											</Cell>
+											<Cell>
+												<a
+													href="#{name}"
+													onclick={() => {
+														const linkedRt = resourceTypes?.find((rt) => rt.name === resource_type)
+														if (linkedRt) {
+															resourceTypeViewerObj = {
+																rt: linkedRt.name,
+																//@ts-ignore
+																schema: linkedRt.schema,
+																description: linkedRt.description ?? '',
+																formatExtension: linkedRt.format_extension,
+																isFileset: linkedRt.is_fileset ?? false
+															}
+															resourceTypeViewer?.openDrawer?.()
+														} else {
+															sendUserToast(
+																`Resource type ${resource_type} not found in workspace.`,
+																true
+															)
+														}
+													}}
+												>
+													<IconedResourceType
+														name={resource_type}
+														after={true}
+														formatExtension={resourceNameToFileExt(resource_type)}
+														isFileset={resourceNameIsFileset(resource_type)}
+													/>
+												</a>
+											</Cell>
+											<Cell>
+												<div class="flex items-center min-h-8 w-full min-w-0 max-w-[30rem]">
+													<span
+														class="text-primary text-xs whitespace-pre-wrap ellipsize-multi-line [-webkit-line-clamp:2]"
+														title={removeMarkdown(description ?? '')}
+													>
+														{removeMarkdown(truncate(description ?? '', 200))}
+													</span>
+												</div>
+											</Cell>
+											<Cell>
+												<div class="flex flex-row text-center">
+													<div class="w-10">
+														{#if is_linked}
+															<Popover>
+																<Link size={16} />
+																{#snippet text()}
+																	<div>
+																		This resource is linked with a variable of the same path. They
+																		are deleted and renamed together.
+																	</div>
+																{/snippet}
+															</Popover>
+														{/if}
+													</div>
+													<div class="w-10">
+														{#if is_refreshed}
+															<Popover>
+																<RotateCw />
+																{#snippet text()}
+																	<div>
+																		The OAuth token will be kept up-to-date in the background by
+																		Windmill using its refresh token
+																	</div>
+																{/snippet}
+															</Popover>
+														{/if}
+													</div>
+
+													{#if is_oauth}
+														<div class="w-10 pt-1.5">
+															{#if refresh_error}
+																<Popover>
+																	<Circle
+																		class="text-red-600 animate-[pulse_5s_linear_infinite] fill-current"
+																		size={12}
+																	/>
+																	{#snippet text()}
+																		<div>
+																			Latest exchange of the refresh token did not succeed. Error: {refresh_error}
+																		</div>
+																	{/snippet}
+																</Popover>
+															{:else if is_expired}
+																<Popover>
+																	<Circle
+																		class="text-yellow-600 animate-[pulse_5s_linear_infinite] fill-current"
+																		size={12}
+																	/>
+
+																	{#snippet text()}
+																		<div>
+																			The access_token is expired, it will get renewed the next time
+																			this variable is fetched or you can request is to be refreshed
+																			in the dropdown on the right.
+																		</div>
+																	{/snippet}
+																</Popover>
+															{:else}
+																<Popover>
+																	<Circle
+																		class="text-green-600 animate-[pulse_5s_linear_infinite] fill-current"
+																		size={12}
+																	/>
+																	{#snippet text()}
+																		<div>
+																			The resource was connected through OAuth and the token is not
+																			expired.
+																		</div>
+																	{/snippet}
+																</Popover>
+															{/if}
+														</div>
+													{/if}
+												</div>
+											</Cell>
+											<Cell last actions>
+												<div class="flex justify-end items-center gap-2">
+													{#if path && assetCanBeExplored({ kind: 'resource', path }, { resource_type }) && !operatingUser.current?.operator}
+														<ExploreAssetButton
+															asset={{ kind: 'resource', path }}
+															_resourceMetadata={{ resource_type }}
+															class="w-24"
+														/>
+													{/if}
+													<Dropdown
+														class="w-fit"
+														items={[
+															{
+																displayName: 'Permissions',
+																icon: Shield,
+																action: () => {
+																	shareModal?.openDrawer?.(path, 'resource')
+																}
+															},
+															{
+																displayName: 'Edit',
+																icon: Pen,
+																disabled: !canWrite || !showCreateButtons,
+																action: () => {
+																	openResourceEditor(path, resource_type)
+																}
+															},
+															// The agent form covers an agent's configuration, not everything a
+															// resource carries: the workspace-specific toggle in particular is
+															// only in the generic editor. JSON rather than that editor's form,
+															// which would render the configuration field by field and write a
+															// default into every one the agent leaves unset. Both write the same
+															// draft row, so this is a second view of the same edits.
+															...(resource_type === 'ai_agent'
+																? [
+																		{
+																			displayName: 'Edit as JSON',
+																			icon: Braces,
+																			disabled: !canWrite || !showCreateButtons,
+																			action: () => {
+																				// The drawer anchors itself in the hash, which the deep-link
+																				// effect would then read and route back to the agent editor.
+																				// Claim it first, as the row's own link does.
+																				handledHash = `#/resource/${path}`
+																				// A host's item tab opens an agent on JSON already.
+																				if (hosted) hosted.openItem(path)
+																				else resourceEditor?.initEdit?.(path, { json: true })
+																			}
+																		}
+																	]
+																: []),
+															...(!ws_specific && isDeployable('resource', path, deployUiSettings)
+																? [
+																		{
+																			displayName: 'Deploy to prod/staging',
+																			icon: FileUp,
+																			action: () => {
+																				deploymentDrawer?.openDrawer(path, 'resource')
+																			}
+																		}
+																	]
+																: []),
+															{
+																displayName: 'Delete',
+																disabled: !canWrite || !showCreateButtons,
+																icon: Trash,
+																type: 'delete',
+																action: (event) => {
+																	// TODO
+																	// @ts-ignore
+																	if (event?.shiftKey) {
+																		deleteResource(path, account)
+																	} else {
+																		deleteIsLinked = is_linked ?? false
+																		deletePath = path
+																		deleteConfirmedCallback = () => {
+																			deleteResource(path, account)
+																		}
+																	}
+																}
+															},
+															...(account != undefined
+																? [
+																		{
+																			displayName: 'Refresh token',
+																			icon: RotateCw,
+																			action: async () => {
+																				await OauthService.refreshToken({
+																					workspace: $operatingWorkspace ?? '',
+																					id: account ?? 0,
+																					requestBody: {
+																						path
+																					}
+																				})
+																				sendUserToast('Token refreshed')
+																				loadResources()
+																			}
+																		}
+																	]
+																: [])
+														]}
+													/>
+												</div></Cell
+											>
+										</Row>
+									{/each}
+								{/if}
+							</tbody>
+						</DataTable>
+					{/if}
+				</div>
+			{:else if tab == 'types'}
+				{#if loading.types}
+					<Skeleton layout={[0.5, [2], 1]} />
+					{#each new Array(6) as _}
+						<Skeleton layout={[[4], 0.7]} />
+					{/each}
+				{:else if filteredResourceTypes?.length == 0}
+					<div class="mt-4">
+						<EmptyState
+							icon={SearchX}
+							title="No resource types found"
+							description="No resource type matches the current filters. Try clearing or widening them."
+						/>
+					</div>
+				{:else}
+					<div class="overflow-auto mt-4">
+						<DataTable>
+							<Head>
+								<Row>
+									<Cell head first>Name</Cell>
+									<Cell head>Description</Cell>
+									<Cell head last actions>Actions</Cell>
+								</Row>
+							</Head>
+							<tbody class="divide-y bg-surface">
+								{#if filteredResourceTypes}
+									{#each filteredResourceTypes as { name, description, schema, canWrite, format_extension, is_fileset }}
+										<Row>
+											<Cell first>
+												<a
+													href="#{name}"
+													onclick={() => {
+														resourceTypeViewerObj = {
+															rt: name,
+															//@ts-ignore
+															schema: schema,
+															description: description ?? '',
+															formatExtension: format_extension,
+															isFileset: is_fileset ?? false
+														}
+
+														resourceTypeViewer?.openDrawer?.()
+													}}
+												>
+													<IconedResourceType
+														after={true}
+														{name}
+														formatExtension={format_extension}
+														isFileset={is_fileset}
+													/>
+												</a>
+											</Cell>
+											<Cell>
+												<!-- Fixed at two lines: min-h so short descriptions still set the same row
+													height as long ones, line-clamp so long ones cannot push the row taller.
+													title carries the whole thing, since the clamp hides the rest. -->
+												<div class="flex items-center min-h-8 w-full min-w-0 max-w-[30rem]">
+													<span
+														class="text-primary text-xs whitespace-pre-wrap ellipsize-multi-line [-webkit-line-clamp:2]"
+														title={removeMarkdown(description ?? '')}
+													>
+														{removeMarkdown(truncate(description ?? '', 200))}
+													</span>
+												</div>
+											</Cell>
+											<Cell last actions>
+												{#if !canWrite}
+													<!-- Badge is inline-flex, so it needs a right-aligning wrapper to sit
+														flush with the action buttons on the rows that have them. -->
+													<div class="flex justify-end">
+														<Badge>
+															Shared globally
+															<Tooltip>
+																This resource type is from the 'admins' workspace shared with all
+																workspaces
+															</Tooltip>
+														</Badge>
+													</div>
+												{:else if operatingUser.current?.is_admin || operatingUser.current?.is_super_admin}
+													<div class="flex flex-row-reverse gap-2">
+														<Button
+															unifiedSize="sm"
+															variant="default"
+															disabled={!showCreateButtons}
+															btnClasses="border-0"
+															startIcon={{ icon: Trash }}
+															on:click={() => handleDeleteResourceType(name)}
+															destructive
+														>
+															Delete
+														</Button>
+														<Button
+															unifiedSize="sm"
+															variant="default"
+															disabled={!showCreateButtons}
+															startIcon={{ icon: Pen }}
+															on:click={() => startEditResourceType(name)}
+														>
+															Edit
+														</Button>
+													</div>
+												{:else}
+													<Badge>
+														Non Editable
+														<Tooltip>
+															Since resource types are shared with the whole workspace, only admins
+															can edit/delete them
+														</Tooltip>
+													</Badge>
+												{/if}
+											</Cell>
+										</Row>
+									{/each}
+								{/if}
+							</tbody>
+						</DataTable>
+					</div>
+				{/if}
+			{/if}
+		</TabFade>
+	</CenteredPage>
+{/if}
+
+<SupabaseConnect bind:this={supabaseConnect} on:refresh={loadResources} />
+<AppConnect bind:this={appConnect} on:refresh={loadResources} />
+
+<ResourceEditorDrawer
+	bind:this={resourceEditor}
+	workspace={$operatingWorkspace}
+	on:refresh={loadResources}
+	onRestored={loadResources}
+/>
+
+<ShareModal
+	bind:this={shareModal}
+	on:change={() => {
+		loadResources()
+	}}
+/>
+
+<!-- Same capabilities as from a flow step: the editor is the same one, so which surface opened it
+     must not decide whether its tools can be written with the copilot. -->
+<!-- Imported only once an agent is opened: the editor pulls in the flow editor, which is most of
+     this route's JavaScript and none of what the resources table needs. -->
+{#if !hosted && agentEditorTarget()}
+	{#await import('$lib/components/flows/content/AgentEditorModal.svelte') then { default: AgentEditorModal }}
+		<AgentEditorModal
+			enableAi={$copilotInfo.enabled}
+			owns={(t) => t.host === undefined}
+			onRenamed={(from, to) => {
+				void loadResources()
+				// Only while the dialog still shows the agent: closed mid-request, it already cleared the
+				// anchor, and writing it back would reopen the editor on refresh.
+				if (agentEditorTarget()?.path !== from) return
+				// Claimed first, as a row click does, so the deep-link effect does not reopen it.
+				handledHash = `#/resource/${to}`
+				setPageDrawerAnchor(RESOURCES_PATH, to)
+			}}
+		/>
+	{/await}
+{/if}
diff --git a/frontend/src/lib/components/resources/resourcesFilter.ts b/frontend/src/lib/components/resources/resourcesFilter.ts
index 0526ff87b3..97d1b61c7e 100644
--- a/frontend/src/lib/components/resources/resourcesFilter.ts
+++ b/frontend/src/lib/components/resources/resourcesFilter.ts
@@ -76,15 +76,14 @@ export function buildResourcesFilterSchema({
 			icon: Tag,
 			description: 'Filter by label (comma-separated for multiple)'
 		},
-		...(showUserFoldersFilter
-			? {
-					user_folders_only: {
-						type: 'boolean' as const,
-						label: userFoldersLabel || 'User folders only',
-						icon: Users,
-						description: 'Show only resources in user folders'
-					}
-				}
-			: {})
+		// The key stays for every role, hidden where the filter does not apply: the list's URL sync
+		// reads the key set once, before the acting user that gates it may have loaded.
+		user_folders_only: {
+			type: 'boolean' as const,
+			label: userFoldersLabel || 'User folders only',
+			icon: Users,
+			description: 'Show only resources in user folders',
+			hidden: !showUserFoldersFilter
+		}
 	} satisfies FilterSchemaRec
 }
diff --git a/frontend/src/lib/components/runs/JobDetailHeader.svelte b/frontend/src/lib/components/runs/JobDetailHeader.svelte
index 5015d5ed37..fb7a8890fc 100644
--- a/frontend/src/lib/components/runs/JobDetailHeader.svelte
+++ b/frontend/src/lib/components/runs/JobDetailHeader.svelte
@@ -13,7 +13,7 @@
 	import { sendUserToast } from '$lib/toast'
 	import ScheduleEditor from '$lib/components/triggers/schedules/ScheduleEditor.svelte'
 	import TimeAgo from '$lib/components/TimeAgo.svelte'
-	import { enterpriseLicense, userStore, workspaceStore } from '$lib/stores'
+	import { enterpriseLicense, userStore } from '$lib/stores'
 	import Tooltip from '$lib/components/meltComponents/Tooltip.svelte'
 	import { ExternalLink, ListFilter, ChevronDown, Share2, Link, Copy } from 'lucide-svelte'
 	import JobStatus from '$lib/components/JobStatus.svelte'
@@ -31,6 +31,14 @@
 	import { flowPathToHref } from '$lib/scripts'
 	import { slide } from 'svelte/transition'
 	import { twMerge } from 'tailwind-merge'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	interface Props {
 		job: Job
@@ -79,7 +87,7 @@
 		}
 		togglingResolution = true
 		try {
-			const workspace = job.workspace_id ?? $workspaceStore ?? ''
+			const workspace = job.workspace_id ?? $operatingWorkspace ?? ''
 			const affected = resolve
 				? await JobService.resolveCompletedJobs({
 						workspace,
@@ -296,7 +304,7 @@
 				Triggered by
 			{/if}
 			<a
-				href={`${base}/run/${job.parent_job}?workspace=${$workspaceStore}`}
+				href={`${base}/run/${job.parent_job}?workspace=${$operatingWorkspace}`}
 				target="_blank"
 				rel="noopener noreferrer"
 				class="flex items-center gap-1"
@@ -418,7 +426,7 @@
 					{#each expandedFields as config}
 						{@const displayValue = getDisplayValue(config, job)}
 						{@const fullValue = getFullValue(config, job)}
-						{@const href = config.getHref?.(job, $workspaceStore || '')}
+						{@const href = config.getHref?.(job, $operatingWorkspace || '')}
 
 						<div class="flex items-baseline gap-1 text-xs">
 							<span class="text-secondary flex-shrink-0">{config.label}</span>
@@ -496,7 +504,7 @@
 						<div class="flex items-baseline flex-wrap gap-x-2 gap-y-1">
 							<JobStatus {job} />
 
-							{#if isJobResolvable(job) && !$userStore?.operator}
+							{#if isJobResolvable(job) && !actingUser?.operator}
 								<!-- No startIcon on these: the row is baseline-aligned, and a Button is
 								     itself a flex container whose baseline comes from its icon rather
 								     than its label, which sits the text ~3px above the badges. Text
@@ -585,7 +593,7 @@
 						{#each fields as config}
 							{@const displayValue = getDisplayValue(config, job)}
 							{@const fullValue = getFullValue(config, job)}
-							{@const href = config.getHref?.(job, $workspaceStore || '')}
+							{@const href = config.getHref?.(job, $operatingWorkspace || '')}
 
 							<div class="flex items-baseline gap-3 text-xs">
 								<span class="text-secondary min-w-[110px] flex-shrink-0">
@@ -638,7 +646,7 @@
 							{#each fields as config (config.field)}
 								{@const displayValue = getDisplayValue(config, job)}
 								{@const fullValue = getFullValue(config, job)}
-								{@const href = config.getHref?.(job, $workspaceStore || '')}
+								{@const href = config.getHref?.(job, $operatingWorkspace || '')}
 
 								<!-- Field -->
 								<div class="flex items-baseline gap-1 text-xs min-w-0">
@@ -686,7 +694,7 @@
 							{#each expandedFields as config}
 								{@const displayValue = getDisplayValue(config, job)}
 								{@const fullValue = getFullValue(config, job)}
-								{@const href = config.getHref?.(job, $workspaceStore || '')}
+								{@const href = config.getHref?.(job, $operatingWorkspace || '')}
 
 								<div class="flex items-baseline gap-3 text-xs">
 									<span class="text-secondary min-w-[110px] flex-shrink-0">
diff --git a/frontend/src/lib/components/runs/NoWorkerWithTagWarning.svelte b/frontend/src/lib/components/runs/NoWorkerWithTagWarning.svelte
index 91eee5f1a1..5ff51c9c04 100644
--- a/frontend/src/lib/components/runs/NoWorkerWithTagWarning.svelte
+++ b/frontend/src/lib/components/runs/NoWorkerWithTagWarning.svelte
@@ -1,9 +1,11 @@
 <script lang="ts">
 	import { WorkerService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { AlertTriangle } from 'lucide-svelte'
 	import Popover from '../Popover.svelte'
 	import { onDestroy, untrack } from 'svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 	interface Props {
 		tag: string | undefined
 		tagLabel?: string
@@ -31,7 +33,7 @@
 			if (!customTag) return
 			const existsWorkerWithTag = await WorkerService.existsWorkersWithTags({
 				tags: customTag,
-				workspace: $workspaceStore
+				workspace: $operatingWorkspace
 			})
 			noWorkerWithTag = !existsWorkerWithTag[customTag]
 			if (noWorkerWithTag) {
diff --git a/frontend/src/lib/components/runs/RunBadges.svelte b/frontend/src/lib/components/runs/RunBadges.svelte
index c54de9f18d..668521b429 100644
--- a/frontend/src/lib/components/runs/RunBadges.svelte
+++ b/frontend/src/lib/components/runs/RunBadges.svelte
@@ -4,11 +4,13 @@
 	import { getJobKindDisplayLabel, truncateHash } from '$lib/utils'
 	import { base } from '$lib/base'
 	import { truncateRev } from '$lib/utils'
-	import { workspaceStore } from '$lib/stores'
 	import Badge from '$lib/components/common/badge/Badge.svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
 	import { ListFilter, Tag } from 'lucide-svelte'
 	import type { Job } from '$lib/gen'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		job: Job
@@ -33,7 +35,7 @@
 
 {#if job.script_hash && showScriptHash && job.job_kind !== 'aiagent'}
 	{#if job.job_kind == 'script'}
-		<a href="{base}/scripts/get/{job.script_hash}?workspace={$workspaceStore}"
+		<a href="{base}/scripts/get/{job.script_hash}?workspace={$operatingWorkspace}"
 			><Badge color="gray" title={`Script hash: ${job.script_hash}`} {large}
 				>{truncateHash(job.script_hash)}
 			</Badge></a
diff --git a/frontend/src/lib/components/schedules/SchedulesList.svelte b/frontend/src/lib/components/schedules/SchedulesList.svelte
new file mode 100644
index 0000000000..80236a300f
--- /dev/null
+++ b/frontend/src/lib/components/schedules/SchedulesList.svelte
@@ -0,0 +1,718 @@
+<script lang="ts">
+	import { getLocalDraftHint } from '$lib/localDraftHints.svelte'
+	import {
+		ScheduleService,
+		type ScheduleWJobs,
+		type WorkspaceDeployUISettings,
+		WorkspaceService
+	} from '$lib/gen'
+	import { canWrite, displayDate, getLocalSetting, storeLocalSetting } from '$lib/utils'
+	import { withForkConflictRetry } from '$lib/utils/forkConflict'
+	import { base } from '$app/paths'
+	import CenteredPage from '$lib/components/CenteredPage.svelte'
+	import { Badge, Button, EmptyState, Skeleton } from '$lib/components/common'
+	import Dropdown from '$lib/components/DropdownV2.svelte'
+	import PageHeader from '$lib/components/PageHeader.svelte'
+	import Popover from '$lib/components/Popover.svelte'
+	import SharedBadge from '$lib/components/SharedBadge.svelte'
+	import DraftBadge from '$lib/components/DraftBadge.svelte'
+	import InheritedLabels from '$lib/components/InheritedLabels.svelte'
+	import ShareModal from '$lib/components/ShareModal.svelte'
+	import Toggle from '$lib/components/Toggle.svelte'
+	import { userWorkspaces, enterpriseLicense } from '$lib/stores'
+	import {
+		Calendar,
+		Circle,
+		Copy,
+		Eye,
+		FileUp,
+		List,
+		Loader2,
+		Pen,
+		Play,
+		Plus,
+		SearchX,
+		Shield,
+		Trash
+	} from 'lucide-svelte'
+	import { goto } from '$lib/navigation'
+	import { sendUserToast } from '$lib/toast'
+	import FilterSearchbar, {
+		hasActiveFilters,
+		useUrlSyncedFilterInstance
+	} from '$lib/components/FilterSearchbar.svelte'
+	import { buildSchedulesFilterSchema } from '$lib/components/schedules/schedulesFilter'
+	import NoItemFound from '$lib/components/home/NoItemFound.svelte'
+	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
+	import JobPreview from '$lib/components/jobs/JobPreview.svelte'
+	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
+	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
+	import { untrack } from 'svelte'
+	import { page } from '$app/stores'
+	import { useHostedPage } from '$lib/components/hostedPage'
+	import DeployWorkspaceDrawer from '$lib/components/DeployWorkspaceDrawer.svelte'
+	import { ALL_DEPLOYABLE, isDeployable } from '$lib/utils_deployable'
+	import { runScheduleNow } from '$lib/components/triggers/scheduled/utils'
+	import ScheduleEditor from '$lib/components/triggers/schedules/ScheduleEditor.svelte'
+	import {
+		useOperatingWorkspace,
+		useOperatingUser
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const hosted = useHostedPage()
+
+	function editSchedule(path: string, isFlow: boolean) {
+		if (hosted) hosted.openItem(path)
+		else scheduleEditor?.openEdit(path, isFlow)
+	}
+
+	type ScheduleW = ScheduleWJobs & { canWrite: boolean }
+
+	let schedules: ScheduleW[] = $state([])
+	let shareModal: ShareModal | undefined = $state()
+	let loading = $state(true)
+	let loadingSchedulesWithJobStats = $state(true)
+	let deploymentDrawer: DeployWorkspaceDrawer | undefined = $state()
+	let deployUiSettings: WorkspaceDeployUISettings | undefined = $state(undefined)
+
+	async function getDeployUiSettings() {
+		if (!$enterpriseLicense) {
+			deployUiSettings = ALL_DEPLOYABLE
+			return
+		}
+		let settings = await WorkspaceService.getPublicSettings({ workspace: $operatingWorkspace! })
+		deployUiSettings = settings.deploy_ui ?? ALL_DEPLOYABLE
+	}
+	getDeployUiSettings()
+	async function loadSchedules(): Promise<void> {
+		const currentFilters = filters.val
+
+		// Build API parameters from filters.
+		// `includeDraftOnly` surfaces per-user drafts at paths that have
+		// no deployed schedule — appended server-side when no narrowing
+		// filter is set, so the user sees AI-agent-created drafts on
+		// the home page.
+		const apiParams: any = {
+			workspace: $operatingWorkspace!,
+			includeDraftOnly: true
+		}
+
+		if (currentFilters.schedule_path) {
+			apiParams.schedulePath = currentFilters.schedule_path
+		}
+		if (currentFilters.path_start) {
+			apiParams.pathStart = currentFilters.path_start
+		}
+		if (currentFilters.path) {
+			apiParams.path = currentFilters.path
+		}
+		if (currentFilters.description) {
+			apiParams.description = currentFilters.description
+		}
+		if (currentFilters.summary) {
+			apiParams.summary = currentFilters.summary
+		}
+		if (currentFilters.args) {
+			apiParams.args = currentFilters.args
+		}
+		if (currentFilters._default_) {
+			apiParams.broadFilter = currentFilters._default_
+		}
+		if (currentFilters.label) {
+			apiParams.label = currentFilters.label
+		}
+
+		const result = (await ScheduleService.listSchedules(apiParams)).map((x) => {
+			return { canWrite: canWrite(x.path, x.extra_perms!, operatingUser.current), ...x }
+		})
+
+		// Extract unique values for autocomplete
+		allPaths = Array.from(new Set(result.map((x) => x.path))).sort()
+		allScriptPaths = Array.from(new Set(result.map((x) => x.script_path))).sort()
+		allLabels = Array.from(
+			new Set(result.flatMap((x) => [...(x.labels ?? []), ...(x.inherited_labels ?? [])]))
+		).sort()
+
+		schedules = result
+		loading = false
+		// after the schedule core data has been loaded, load all the job stats
+		// TODO: we could potentially not reload the job stats on every call to loadSchedules, but for now it's
+		// simpler to always call it. Update if performance becomes an issue.
+		loadSchedulesWithJobStats()
+	}
+
+	// Reload schedules when filters change
+	$effect(() => {
+		filters.val
+		if ($operatingWorkspace) {
+			untrack(() => loadSchedules())
+		}
+	})
+
+	async function loadSchedulesWithJobStats(): Promise<void> {
+		loadingSchedulesWithJobStats = true
+		let schedulesWithJobsByPath = new Map<string, ScheduleW>()
+		let schedulesWithJobsList = await ScheduleService.listSchedulesWithJobs({
+			workspace: $operatingWorkspace!
+		})
+		schedulesWithJobsList.map((x) => {
+			schedulesWithJobsByPath[x.path] = x
+		})
+		for (let schedule of schedules) {
+			if (schedulesWithJobsByPath[schedule.path]) {
+				schedule.jobs = schedulesWithJobsByPath[schedule.path].jobs
+			}
+		}
+		loadingSchedulesWithJobStats = false
+	}
+
+	// Per-path counter bumped when a schedule toggle is cancelled or errors,
+	// to force-remount that row's <Toggle>. Toggle uses `bind:checked` on
+	// its native input; once the user clicks, the local checkbox state
+	// diverges from the parent's prop expression, and Svelte 5 prop
+	// reactivity won't push a same-valued prop back down. Re-mounting
+	// re-initializes from the prop. List-page rows don't optimistically
+	// flip `enabled`, so they need this nudge — but only the affected row,
+	// not all rows on the page.
+	let toggleResetVersions = $state<Record<string, number>>({})
+	function bumpToggleReset(path: string) {
+		toggleResetVersions[path] = (toggleResetVersions[path] ?? 0) + 1
+	}
+
+	async function setScheduleEnabled(path: string, enabled: boolean): Promise<void> {
+		try {
+			const ok = await withForkConflictRetry(
+				(force) =>
+					ScheduleService.setScheduleEnabled({
+						path,
+						workspace: $operatingWorkspace!,
+						requestBody: { enabled, force }
+					}),
+				'schedule'
+			)
+			if (ok) {
+				loadSchedules()
+			} else {
+				// Cancelled — nothing changed on the server, skip the reload
+				// (which would re-fetch job stats and flash the loading flag)
+				// and just nudge the toggle back to the prop value.
+				bumpToggleReset(path)
+			}
+		} catch (err) {
+			sendUserToast(`Cannot ` + (enabled ? 'enable' : 'disable') + ` schedule: ${err.body}`, true)
+			bumpToggleReset(path)
+			loadSchedules()
+		}
+	}
+
+	$effect(() => {
+		if ($operatingWorkspace && operatingUser.current) {
+			untrack(() => {
+				loadSchedules()
+			})
+		}
+	})
+	let scheduleEditor: ScheduleEditor | undefined = $state()
+
+	// Deep link: #<path> opens that schedule's edit drawer. Tracks the last
+	// handled hash (not a one-shot flag) so a hash change on the already-mounted
+	// page (e.g. the AI session preview re-pointing its tab) opens the drawer
+	// too. Row links pre-set handledHash: their onclick already opens the drawer.
+	let handledHash = ''
+	$effect(() => {
+		// A host opens rows itself, and the document's hash is not this page's.
+		if (hosted) return
+		const hash = $page.url.hash
+		if (hash.length <= 1) {
+			// Navigating away from a drawer target must clear the tracker, or
+			// re-targeting the same schedule later would be skipped as already handled.
+			handledHash = ''
+			return
+		}
+		if (hash === handledHash || schedules.length === 0 || !scheduleEditor) return
+		const path = hash.slice(1)
+		const schedule = schedules.find((s) => s.path === path)
+		if (schedule) {
+			handledHash = hash
+			scheduleEditor.openEdit(path, schedule.is_flow)
+		}
+	})
+
+	// Collect unique values for filter autocomplete
+	let allPaths: string[] = $state([])
+	let allScriptPaths: string[] = $state([])
+	let allLabels: string[] = $state([])
+
+	// FilterSearchbar setup
+	let userFoldersFilterType = $derived(
+		operatingUser.current?.is_super_admin && operatingUser.current.username.includes('@')
+			? 'only f/*'
+			: operatingUser.current?.is_admin || operatingUser.current?.is_super_admin
+				? 'u/username and f/*'
+				: undefined
+	)
+	let schedulesFilterSchema = $derived(
+		buildSchedulesFilterSchema({
+			paths: allPaths,
+			scriptPaths: allScriptPaths,
+			labels: allLabels,
+			showUserFoldersFilter: userFoldersFilterType !== undefined,
+			userFoldersLabel:
+				userFoldersFilterType === 'only f/*'
+					? 'Only f/*'
+					: `Only u/${operatingUser.current?.username} and f/*`
+		})
+	)
+	let filters = useUrlSyncedFilterInstance(untrack(() => schedulesFilterSchema))
+	// A link can carry the user folders filter to someone it is not offered to, where it would sit
+	// set with no chip to clear it. Dropped only once a user is actually known: `resolved` holds for
+	// the navigation workspace even while its user is still loading.
+	$effect(() => {
+		if (!operatingUser.resolved($operatingWorkspace) || !operatingUser.current) return
+		if (userFoldersFilterType !== undefined) return
+		if (!filters.val.user_folders_only) return
+		untrack(() => {
+			const { user_folders_only: _, ...rest } = filters.val
+			filters.val = rest
+		})
+	})
+
+	let activeFilters = $derived(hasActiveFilters(filters.val))
+	let allFolders = $derived(
+		Array.from(
+			new Set(
+				(schedules ?? [])
+					.map((x) => x.path.split('/').slice(0, 2).join('/'))
+					.filter((x) => x.startsWith('f/'))
+			)
+		)
+			.sort()
+			.map((f) => f.replace(/^f\//, ''))
+	)
+	let presets = $derived([
+		...allFolders.map((f) => ({ name: `f/${f}`, value: `path_start:\\ f/${f}/` })),
+		...allLabels.map((l) => ({ name: l, value: `label:\\ ${l}` })),
+		...(!schedulesFilterSchema.user_folders_only.hidden
+			? [
+					{
+						name: schedulesFilterSchema.user_folders_only.label ?? '?',
+						value: 'user_folders_only:\\ true'
+					}
+				]
+			: [])
+	])
+
+	let nbDisplayed = $state(15)
+	let filterEnabledDisabled: 'all' | 'enabled' | 'disabled' = $state('all')
+
+	const SCHEDULE_PATH_KIND_FILTER_SETTING = 'schedulePathKindFilter'
+	let selectedFilterKind = $state(
+		(getLocalSetting(SCHEDULE_PATH_KIND_FILTER_SETTING) as 'schedule' | 'script_flow') ?? 'schedule'
+	)
+
+	$effect(() => {
+		storeLocalSetting(SCHEDULE_PATH_KIND_FILTER_SETTING, selectedFilterKind)
+	})
+
+	function filterItemsPathsBaseOnUserFilters(
+		item: ScheduleW,
+		selectedFilterKind: 'schedule' | 'script_flow',
+		userFoldersOnly: boolean
+	) {
+		if (userFoldersOnly) {
+			if (selectedFilterKind === 'schedule') {
+				return (
+					!item.path.startsWith('u/') ||
+					item.path.startsWith('u/' + operatingUser.current?.username + '/')
+				)
+			} else {
+				return (
+					!item.script_path.startsWith('u/') ||
+					item.script_path.startsWith('u/' + operatingUser.current?.username + '/')
+				)
+			}
+		} else {
+			return true
+		}
+	}
+
+	function filterItemsBasedOnEnabledDisabled(
+		item: ScheduleW,
+		filterEnabledDisabled: 'all' | 'enabled' | 'disabled'
+	) {
+		// Draft-only rows have nothing deployed, so they read as disabled here
+		// too — matching the off, disabled toggle the row renders.
+		const enabled = !item.draft_only && item.enabled
+		if (filterEnabledDisabled === 'all') return true
+		if (filterEnabledDisabled === 'enabled') return enabled
+		if (filterEnabledDisabled === 'disabled') return !enabled
+	}
+
+	// Filter schedules client-side for enabled/disabled and user folders
+	let filteredItems = $derived.by(() => {
+		return schedules?.filter(
+			(x) =>
+				filterItemsPathsBaseOnUserFilters(
+					x,
+					selectedFilterKind,
+					userFoldersFilterType !== undefined && !!filters.val.user_folders_only
+				) && filterItemsBasedOnEnabledDisabled(x, filterEnabledDisabled)
+		)
+	})
+
+	let items = $derived(filteredItems)
+</script>
+
+<DeployWorkspaceDrawer bind:this={deploymentDrawer} />
+<ScheduleEditor onUpdate={loadSchedules} bind:this={scheduleEditor} />
+
+{#if operatingUser.current?.operator && $operatingWorkspace && !$userWorkspaces.find((_) => _.id === $operatingWorkspace)?.operator_settings?.schedules}
+	<div class="bg-red-100 border-l-4 border-red-600 text-orange-700 p-4 m-4 mt-12" role="alert">
+		<p class="font-bold">Unauthorized</p>
+		<p>Page not available for operators</p>
+	</div>
+{:else}
+	<CenteredPage>
+		<PageHeader
+			title="Schedules"
+			tooltip="Trigger Scripts and Flows according to a cron schedule"
+			documentationLink="https://www.windmill.dev/docs/core_concepts/scheduling"
+		>
+			<Button
+				unifiedSize="md"
+				variant="accent"
+				startIcon={{ icon: Plus }}
+				on:click={() => scheduleEditor?.openNew(false)}
+				aiId="schedules-add-schedule"
+				aiDescription="Add schedule"
+			>
+				New schedule
+			</Button>
+		</PageHeader>
+		<div class="w-full h-full flex flex-col">
+			<div class="flex flex-row items-center justify-end gap-4 pb-4">
+				<ToggleButtonGroup bind:selected={filterEnabledDisabled} class="w-fit">
+					{#snippet children({ item })}
+						<ToggleButton value="all" label="All" {item} />
+						<ToggleButton value="enabled" label="Enabled" {item} />
+						<ToggleButton value="disabled" label="Disabled" {item} />
+					{/snippet}
+				</ToggleButtonGroup>
+				<FilterSearchbar
+					schema={schedulesFilterSchema}
+					bind:value={filters.val}
+					class="grow max-w-[26rem]"
+					{presets}
+				/>
+			</div>
+			{#if loading}
+				{#each new Array(6) as _}
+					<Skeleton layout={[[6], 0.4]} />
+				{/each}
+			{:else if !schedules?.length}
+				{#if activeFilters}
+					<EmptyState
+						icon={SearchX}
+						title="No schedules found"
+						description="No schedule matches the current filters. Try clearing or widening them."
+					/>
+				{:else}
+					<EmptyState
+						icon={Calendar}
+						title="No schedules yet"
+						description="Schedules run a script or flow automatically on a cron expression."
+						action={{
+							label: 'Add a schedule',
+							icon: Plus,
+							onClick: () => scheduleEditor?.openNew(false),
+							aiId: 'schedules-empty-add',
+							aiDescription: 'Add schedule'
+						}}
+					/>
+				{/if}
+			{:else if items?.length}
+				<div class="border rounded-md divide-y">
+					{#each items.slice(0, nbDisplayed) as { path, error, summary, edited_by, edited_at, schedule, timezone, enabled, script_path, is_flow, extra_perms, canWrite, jobs, paused_until, labels, inherited_labels, draft_only, is_draft } (path)}
+						{@const hasDraft =
+							getLocalDraftHint($operatingWorkspace, 'trigger_schedule', path) ?? is_draft}
+						{@const href = `${is_flow ? '/flows/get' : '/scripts/get'}/${script_path}`}
+						{@const avg_s = jobs
+							? jobs.reduce((acc, x) => acc + x.duration_ms, 0) / jobs.length
+							: undefined}
+
+						<div
+							class="bg-surface-tertiary hover:bg-surface-hover w-full items-center px-4 py-2 gap-4 first-of-type:!border-t-0
+				first-of-type:rounded-t-md last-of-type:rounded-b-md flex flex-col"
+						>
+							<div class="w-full flex gap-4 items-center">
+								<RowIcon kind={is_flow ? 'flow' : 'script'} />
+
+								<a
+									href="#{path}"
+									onclick={() => {
+										handledHash = `#${path}`
+										editSchedule(path, is_flow)
+									}}
+									class="min-w-0 grow hover:underline decoration-gray-400"
+								>
+									<div
+										class="text-emphasis flex-wrap text-left text-xs font-semibold mb-1 truncate"
+									>
+										{summary || script_path}{hasDraft ? '*' : ''}
+									</div>
+									<div class="text-secondary text-xs truncate text-left">
+										schedule: {path}
+									</div>
+								</a>
+								{#if labels?.length}
+									{#each labels as label}
+										<Badge
+											color="blue"
+											small
+											class="px-1"
+											title="Label: {label}"
+											clickable
+											onclick={() => {
+												const arr = (filters.val.label ?? '').split(',').filter(Boolean)
+												const idx = arr.indexOf(label)
+												if (idx >= 0) arr.splice(idx, 1)
+												else arr.push(label)
+												const newFilters = { ...filters.val }
+												if (arr.length) newFilters.label = arr.join(',')
+												else delete newFilters.label
+												filters.val = newFilters
+											}}>{label}</Badge
+										>
+									{/each}
+								{/if}
+								<InheritedLabels labels={inherited_labels} />
+
+								{#if paused_until && new Date(paused_until) > new Date()}
+									<div class="pb-1">
+										<Badge color="yellow"
+											>Paused until {new Date(paused_until).toLocaleString()}</Badge
+										>
+									</div>
+								{/if}
+
+								<div class="gap-2 items-center hidden md:flex">
+									<Badge large color="blue">{schedule}</Badge>
+									<Badge small color="gray">{timezone}</Badge>
+								</div>
+
+								<div class="hidden lg:flex flex-row gap-1 items-center">
+									<SharedBadge {canWrite} extraPerms={extra_perms} />
+								</div>
+
+								<div class="w-10">
+									{#if error}
+										<Popover notClickable>
+											<span class="flex h-4 w-4">
+												<Circle
+													class="text-red-600 animate-ping absolute inline-flex fill-current"
+													size={12}
+												/>
+												<Circle class="text-red-600 relative inline-flex fill-current" size={12} />
+											</span>
+											{#snippet text()}
+												<div>
+													The schedule disabled itself because there was an error scheduling the
+													next job: {error}
+												</div>
+											{/snippet}
+										</Popover>
+									{/if}
+								</div>
+
+								<div class="flex items-center justify-end gap-2 shrink-0 min-w-[8rem]">
+									<DraftBadge {draft_only} is_draft={hasDraft} />
+									{#key toggleResetVersions[path] ?? 0}
+										<Toggle
+											disabled={draft_only}
+											options={{
+												title: draft_only
+													? 'Draft only: deploy the schedule to enable it'
+													: hasDraft
+														? 'Enables/disables the deployed schedule; the draft is not affected'
+														: undefined
+											}}
+											checked={!draft_only && enabled}
+											on:change={(e) => {
+												if (canWrite) {
+													setScheduleEnabled(path, e.detail)
+												} else {
+													sendUserToast('not enough permission', true)
+													// Permission denied — bump the row's reset
+													// counter so the Toggle remounts back to the
+													// prop value. Without this, the local
+													// `bind:checked` flip from the user's click
+													// stays stuck on.
+													bumpToggleReset(path)
+												}
+											}}
+										/>
+									{/key}
+								</div>
+								<div class="flex gap-2 items-center justify-end">
+									<Button
+										href={`${base}/runs/?schedule_path=${path}&job_trigger_kind=schedule&show_future_jobs=true`}
+										disabled={draft_only}
+										unifiedSize="md"
+										startIcon={{ icon: List }}
+										variant="subtle"
+									>
+										Runs
+									</Button>
+									<Button
+										on:click={() => editSchedule(path, is_flow)}
+										unifiedSize="md"
+										startIcon={{ icon: canWrite ? Pen : Eye }}
+										variant="subtle"
+									>
+										{canWrite ? 'Edit' : 'View'}
+									</Button>
+									<Dropdown
+										size="md"
+										items={[
+											{
+												displayName: `View ${is_flow ? 'Flow' : 'Script'}`,
+												icon: Eye,
+												action: () => {
+													if (hosted) hosted.openLink(`${base}${href}`)
+													else goto(href)
+												}
+											},
+											{
+												displayName: `Duplicate schedule`,
+												icon: Copy,
+												action: () => {
+													scheduleEditor?.openNew(is_flow, script_path, path)
+												}
+											},
+											{
+												displayName: 'Delete',
+												type: 'delete',
+												icon: Trash,
+												disabled: !canWrite,
+												action: async () => {
+													await ScheduleService.deleteSchedule({
+														workspace: $operatingWorkspace ?? '',
+														path
+													})
+													loadSchedules()
+												}
+											},
+											{
+												displayName: canWrite ? 'Edit' : 'View',
+												icon: canWrite ? Pen : Eye,
+												action: () => {
+													editSchedule(path, is_flow)
+												}
+											},
+											...(isDeployable('trigger', path, deployUiSettings)
+												? [
+														{
+															displayName: 'Deploy to prod/staging',
+															icon: FileUp,
+															action: () => {
+																deploymentDrawer?.openDrawer(path, 'trigger', {
+																	triggers: {
+																		kind: 'schedules'
+																	}
+																})
+															}
+														}
+													]
+												: []),
+											{
+												displayName: 'View runs',
+												icon: List,
+												href: `${base}/runs/?schedule_path=${path}&job_trigger_kind=schedule&show_future_jobs=true`
+											},
+											{
+												displayName: 'Audit logs',
+												icon: Eye,
+												href: `${base}/audit_logs?resource=${path}`
+											},
+											{
+												displayName: 'Run now',
+												icon: Play,
+												action: () => {
+													runScheduleNow(script_path, path, is_flow, $operatingWorkspace!)
+												}
+											},
+											{
+												displayName: 'Permissions',
+												icon: Shield,
+												action: () => {
+													shareModal?.openDrawer(path, 'schedule')
+												}
+											}
+										]}
+									/>
+								</div>
+							</div>
+							<div class="w-full flex justify-between items-baseline">
+								{#if loadingSchedulesWithJobStats}
+									<div class="flex gap-1 ml-0.5 text-xs text-secondary items-center">
+										<Loader2 size={14} class="animate-spin" />
+										<span>Job stats loading...</span>
+									</div>
+								{:else}
+									<div class="flex gap-1.5 ml-0.5 items-baseline flex-row-reverse">
+										{#if avg_s}
+											<div class="pl-2 text-secondary text-xs"
+												>Avg: {(avg_s / 1000).toFixed(2)}s</div
+											>
+										{/if}
+										{#each jobs ?? [] as job}
+											{@const h = (avg_s ? job.duration_ms / avg_s : 1) * 7 + 3}
+											<a href="{base}/run/{job.id}?workspace={$operatingWorkspace}">
+												<JobPreview id={job.id} class="p-4">
+													<div>
+														<div
+															class="{job.success ? 'bg-green-300' : 'bg-red-300'} mx-auto w-1.5"
+															style="height: {h}px"
+														></div>
+														<!-- <div class="text-[0.6em] mt-0.5 text-center text-primary"
+														>{(job.duration_ms / 1000).toFixed(2)}s</div
+													> -->
+													</div>
+												</JobPreview>
+											</a>
+										{/each}
+									</div>
+								{/if}
+								<div
+									class="flex flex-wrap text-xs text-secondary gap-1 items-center justify-end truncate pr-2"
+									>{#if edited_by}<div class="truncate">edited by {edited_by}</div>{/if}<div
+										class="truncate">{edited_by ? 'at ' : ''}{displayDate(edited_at)}</div
+									></div
+								></div
+							>
+						</div>
+					{/each}
+				</div>
+			{:else}
+				<NoItemFound />
+			{/if}
+		</div>
+		{#if items && items?.length > 15 && nbDisplayed < items.length}
+			<div class="flex items-center gap-4 text-xs font-semibold text-emphasis">
+				<span>{nbDisplayed} items out of {items.length}</span>
+				<Button unifiedSize="sm" variant="subtle" on:click={() => (nbDisplayed += 30)}>
+					Load 30 more
+				</Button>
+			</div>
+		{/if}
+	</CenteredPage>
+{/if}
+
+<ShareModal
+	bind:this={shareModal}
+	on:change={() => {
+		loadSchedules()
+	}}
+/>
diff --git a/frontend/src/lib/components/schedules/schedulesFilter.ts b/frontend/src/lib/components/schedules/schedulesFilter.ts
index 24fb1c90a3..4b887e5aa4 100644
--- a/frontend/src/lib/components/schedules/schedulesFilter.ts
+++ b/frontend/src/lib/components/schedules/schedulesFilter.ts
@@ -73,15 +73,14 @@ export function buildSchedulesFilterSchema({
 			icon: Tag,
 			description: 'Filter by label (comma-separated for multiple)'
 		},
-		...(showUserFoldersFilter
-			? {
-					user_folders_only: {
-						type: 'boolean' as const,
-						label: userFoldersLabel || 'User folders only',
-						icon: Users,
-						description: 'Show only schedules in user folders'
-					}
-				}
-			: {})
+		// The key stays for every role, hidden where the filter does not apply: the list's URL sync
+		// reads the key set once, before the acting user that gates it may have loaded.
+		user_folders_only: {
+			type: 'boolean' as const,
+			label: userFoldersLabel || 'User folders only',
+			icon: Users,
+			description: 'Show only schedules in user folders',
+			hidden: !showUserFoldersFilter
+		}
 	} satisfies FilterSchemaRec
 }
diff --git a/frontend/src/lib/components/schema/JobSchemaPicker.svelte b/frontend/src/lib/components/schema/JobSchemaPicker.svelte
index 47e6220c79..fe132d546c 100644
--- a/frontend/src/lib/components/schema/JobSchemaPicker.svelte
+++ b/frontend/src/lib/components/schema/JobSchemaPicker.svelte
@@ -1,8 +1,10 @@
 <script lang="ts">
 	import SchemaPickerRow from './SchemaPickerRow.svelte'
-	import { workspaceStore } from '$lib/stores'
 	import { ExternalLink } from 'lucide-svelte'
 	import { base } from '$lib/base'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		job: any
@@ -60,7 +62,7 @@
 			<div class="center-center">
 				<a
 					target="_blank"
-					href="{base}/run/{job.id}?workspace={$workspaceStore}"
+					href="{base}/run/{job.id}?workspace={$operatingWorkspace}"
 					class="text-right float-right text-secondary px-2"
 					title="See run detail in a new tab"
 				>
diff --git a/frontend/src/lib/components/schema/RunningJobSchemaPicker.svelte b/frontend/src/lib/components/schema/RunningJobSchemaPicker.svelte
index 4e2a503d84..2714cc92c3 100644
--- a/frontend/src/lib/components/schema/RunningJobSchemaPicker.svelte
+++ b/frontend/src/lib/components/schema/RunningJobSchemaPicker.svelte
@@ -2,19 +2,21 @@
 	import SchemaPickerRow from './SchemaPickerRow.svelte'
 	import Skeleton from '$lib/components/common/skeleton/Skeleton.svelte'
 	import { JobService } from '$lib/gen/index.js'
-	import { workspaceStore } from '$lib/stores'
 	import { createEventDispatcher, untrack } from 'svelte'
 	import { ExternalLink } from 'lucide-svelte'
 	import { base } from '$lib/base'
 	import { Cell, Row } from '$lib/components/table'
 	import { twMerge } from 'tailwind-merge'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	const dispatch = createEventDispatcher()
 	interface Props {
-		job: any;
-		selected?: boolean;
-		payloadData?: any | undefined;
-		hovering?: boolean;
+		job: any
+		selected?: boolean
+		payloadData?: any | undefined
+		hovering?: boolean
 	}
 
 	let {
@@ -22,7 +24,7 @@
 		selected = false,
 		payloadData = $bindable(undefined),
 		hovering = $bindable(false)
-	}: Props = $props();
+	}: Props = $props()
 
 	let loadingArgs = $state(true)
 	loadArgsFromRunningJob(untrack(() => job).id)
@@ -30,7 +32,7 @@
 	async function loadArgsFromRunningJob(id: string | undefined) {
 		if (!id) return
 		payloadData = await JobService.getJobArgs({
-			workspace: $workspaceStore!,
+			workspace: $operatingWorkspace!,
 			id
 		})
 		loadingArgs = false
@@ -58,32 +60,28 @@
 	>
 		<SchemaPickerRow {payloadData} date={job.started_at} {hovering}>
 			{#snippet start()}
-					
-					<div class="center-center">
-						<div
-							class={twMerge(
-								'rounded-full w-2 h-2 animate-pulse',
-								job.suspend ? 'bg-violet-400' : 'bg-orange-400'
-							)}
-							title="Running"
-						></div>
-					</div>
-				
-					{/snippet}
+				<div class="center-center">
+					<div
+						class={twMerge(
+							'rounded-full w-2 h-2 animate-pulse',
+							job.suspend ? 'bg-violet-400' : 'bg-orange-400'
+						)}
+						title="Running"
+					></div>
+				</div>
+			{/snippet}
 			{#snippet extra()}
-					
-					<div class="center-center {hovering ? '' : '!hidden'}">
-						<a
-							target="_blank"
-							href="{base}/run/{job.id}?workspace={$workspaceStore}"
-							class="text-right float-right text-secondary"
-							title="See run detail in a new tab"
-						>
-							<ExternalLink size={16} />
-						</a>
-					</div>
-				
-					{/snippet}
+				<div class="center-center {hovering ? '' : '!hidden'}">
+					<a
+						target="_blank"
+						href="{base}/run/{job.id}?workspace={$operatingWorkspace}"
+						class="text-right float-right text-secondary"
+						title="See run detail in a new tab"
+					>
+						<ExternalLink size={16} />
+					</a>
+				</div>
+			{/snippet}
 		</SchemaPickerRow>
 	</Row>
 {/if}
diff --git a/frontend/src/lib/components/scriptEditor/LogPanel.svelte b/frontend/src/lib/components/scriptEditor/LogPanel.svelte
index 010369a663..fe2bc6c73c 100644
--- a/frontend/src/lib/components/scriptEditor/LogPanel.svelte
+++ b/frontend/src/lib/components/scriptEditor/LogPanel.svelte
@@ -9,7 +9,6 @@
 		type Preview,
 		type WorkflowStatus
 	} from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { base } from '$lib/base'
 	import { displayDate } from '$lib/utils'
 	import Tabs from '../common/tabs/Tabs.svelte'
@@ -33,6 +32,9 @@
 	import Tooltip from '$lib/components/Tooltip.svelte'
 	import type { PreviewPanelUi } from '../custom_ui'
 	import { getStringError } from '../copilot/chat/utils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		lang: Preview['language'] | undefined
@@ -268,7 +270,7 @@
 										<Cell first>
 											<a
 												class="pr-3"
-												href="{base}/run/{id}?workspace={workspace ?? $workspaceStore}"
+												href="{base}/run/{id}?workspace={workspace ?? $operatingWorkspace}"
 												target="_blank">{id.substring(30)}</a
 											>
 										</Cell>
@@ -286,7 +288,7 @@
 												onclick={preventDefault(() => {
 													openDrawer({ mode: 'json', content: undefined, title: 'Result' })
 													JobService.getCompletedJobResult({
-														workspace: workspace ?? $workspaceStore ?? 'NO_W',
+														workspace: workspace ?? $operatingWorkspace ?? 'NO_W',
 														id
 													}).then((res) => {
 														drawerContent && (drawerContent.content = res)
@@ -302,7 +304,7 @@
 												onclick={preventDefault(async () => {
 													const code = (
 														await JobService.getCompletedJob({
-															workspace: workspace ?? $workspaceStore ?? 'NO_W',
+															workspace: workspace ?? $operatingWorkspace ?? 'NO_W',
 															id
 														})
 													).raw_code
@@ -323,7 +325,7 @@
 													const logs = await (
 														await fetch(
 															OpenAPI.BASE +
-																`/w/${workspace ?? $workspaceStore}/jobs_u/get_logs/${id}`
+																`/w/${workspace ?? $operatingWorkspace}/jobs_u/get_logs/${id}`
 														)
 													).text()
 													console.log(logs)
diff --git a/frontend/src/lib/components/script_builder.ts b/frontend/src/lib/components/script_builder.ts
index 69916f321b..c28aad82cc 100644
--- a/frontend/src/lib/components/script_builder.ts
+++ b/frontend/src/lib/components/script_builder.ts
@@ -36,6 +36,13 @@ export interface ScriptBuilderProps {
 	 * stop/restart pair is a no-op on a non-live entry.
 	 */
 	userDraftPath?: string
+	/** Moves the draft's base to the head and keeps its content; offered in the diff
+	 *  drawer while the draft is behind. Called with the version the drawer shows as
+	 *  head. The route owns it because the base lives in a per-kind field of the value. */
+	onTakeLatest?: (head?: string) => void | Promise<void>
+	/** The hash the draft forked from, so the drawer offers `onTakeLatest` only while
+	 *  it differs from the head on display. */
+	draftBaseHash?: string
 	/**
 	 * Workspace + path the AutosaveIndicator watches for sync state. Default
 	 * (undefined) falls back to `$workspaceStore` / `userDraftPath` — the
diff --git a/frontend/src/lib/components/select/GenericDropdown.svelte b/frontend/src/lib/components/select/GenericDropdown.svelte
index 78a88a6457..a2bd6a044b 100644
--- a/frontend/src/lib/components/select/GenericDropdown.svelte
+++ b/frontend/src/lib/components/select/GenericDropdown.svelte
@@ -53,6 +53,9 @@
 		const spaceAbove = inputR.y
 		const isBelow = fitsBelow || spaceBelow >= spaceAbove
 		let [x, y] = disablePortal ? [0, 0] : [inputR.x, inputR.y]
+		// The list grows to its widest item, so one wider than the room right of its input
+		// would run off screen: slide it left instead.
+		if (!disablePortal) x = Math.max(0, Math.min(x, window.innerWidth - listR.width))
 		if (isBelow)
 			return { width: inputR.width, height: listR.height, x: x, y: y + inputR.height, isBelow }
 		else {
diff --git a/frontend/src/lib/components/select/MultiSelect.svelte b/frontend/src/lib/components/select/MultiSelect.svelte
index 419984b20d..0ebb824865 100644
--- a/frontend/src/lib/components/select/MultiSelect.svelte
+++ b/frontend/src/lib/components/select/MultiSelect.svelte
@@ -18,6 +18,7 @@
 	let {
 		items,
 		placeholder = 'Select items',
+		searchPlaceholder = 'Search...',
 		value = $bindable(),
 		class: className = '',
 		style,
@@ -42,6 +43,9 @@
 		items?: Item[]
 		value: Value[]
 		placeholder?: string
+		/** Placeholder of the dropdown's search field. Worth setting where the list is there to
+		 *  create entries rather than pick from, so the field says what to type. */
+		searchPlaceholder?: string
 		class?: string
 		style?: string
 		filterText?: string
@@ -96,7 +100,12 @@
 
 	function onAddValue(item: ProcessedItem<Value>) {
 		if (item.__is_create && onCreateItem) {
+			const before = currentValue.length
 			onCreateItem(item.value)
+			// Cleared only once the entry exists: it is then in the list, and leaving it in the
+			// field would filter the list down to it. A consumer that refused the value (a
+			// duplicate, a name it rejects) keeps what was typed, to be corrected.
+			if ((value?.length ?? 0) !== before) filterText = ''
 		} else {
 			value = [...currentValue, item.value]
 		}
@@ -192,7 +201,7 @@
 						bind:value={filterText}
 						inputProps={{
 							onblur: (e) => (e.preventDefault(), searchInputEl?.focus()),
-							placeholder: 'Search...'
+							placeholder: searchPlaceholder
 						}}
 						class="!pr-7 !bg-surface"
 					/>
diff --git a/frontend/src/lib/components/sessions/FlowEditorView.svelte b/frontend/src/lib/components/sessions/FlowEditorView.svelte
index 8a500e0a9e..d74436578f 100644
--- a/frontend/src/lib/components/sessions/FlowEditorView.svelte
+++ b/frontend/src/lib/components/sessions/FlowEditorView.svelte
@@ -108,6 +108,9 @@
 		     cell.store), reactive state owned by the SessionRuntime class (via
 		     flowCell), not by a component ancestor — so Svelte's ownership check
 		     flags a false positive here. -->
+		<!-- draftBaseVersion / version: the base the session's draft carries and the head at
+		     load time, so the deploy guard compares the same pair the full-page editor does;
+		     without them every deploy from a session tab reads as up to date. -->
 		<!-- svelte-ignore ownership_invalid_binding -->
 		<FlowBuilder
 			flowStore={cell.store}
@@ -119,6 +122,10 @@
 			{selectedId}
 			loading={false}
 			bind:savedFlow={cell.saved.val}
+			draftBaseVersion={cell.store.val?.version_id != null
+				? String(cell.store.val.version_id)
+				: undefined}
+			version={cell.saved.val?.version_id}
 			{diffDrawer}
 			{onNavigate}
 			onDetails={onSeeDetails}
diff --git a/frontend/src/lib/components/sessions/OpenInSessionButton.svelte b/frontend/src/lib/components/sessions/OpenInSessionButton.svelte
index 03ce21589e..4e453c09a3 100644
--- a/frontend/src/lib/components/sessions/OpenInSessionButton.svelte
+++ b/frontend/src/lib/components/sessions/OpenInSessionButton.svelte
@@ -41,9 +41,12 @@
 	import { AIBtnClasses } from '$lib/components/copilot/chat/AIButtonStyle'
 	import { prefersSessionHandoff } from '$lib/components/copilot/chat/global/gate'
 	import { copilotInfo } from '$lib/aiStore'
-	import { userStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
 	import { openSourceInSession } from './sessionSwitch.svelte'
+	import { useOperatingUser } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	let {
 		source,
@@ -83,7 +86,7 @@
 	const show = $derived(
 		!inSessionPanel &&
 			!!(source?.target || source?.page) &&
-			prefersSessionHandoff($userStore?.operator)
+			prefersSessionHandoff(actingUser?.operator)
 	)
 
 	// Not $state: only read inside open() as a re-entrancy latch, never rendered.
diff --git a/frontend/src/lib/components/sessions/PageItemEditorView.svelte b/frontend/src/lib/components/sessions/PageItemEditorView.svelte
new file mode 100644
index 0000000000..73efd892d4
--- /dev/null
+++ b/frontend/src/lib/components/sessions/PageItemEditorView.svelte
@@ -0,0 +1,174 @@
+<script lang="ts">
+	import { setContext, untrack } from 'svelte'
+	import { Loader2 } from 'lucide-svelte'
+	import { enterpriseLicense } from '$lib/stores'
+	import { resource } from 'runed'
+	import { Button } from '$lib/components/common'
+	import { lookupPageItem } from './pageItemLookup'
+	import VariableEditor from '$lib/components/VariableEditor.svelte'
+	import ResourceEditorDrawer from '$lib/components/ResourceEditorDrawer.svelte'
+	import { setOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+	import {
+		pageItemKindLabel,
+		pageItemUrl,
+		TRIGGER_PAGES,
+		type PageItemRef,
+		type TriggerKind
+	} from './previewPaths'
+	import type { SessionRuntime } from './sessionRuntime.svelte'
+
+	let {
+		runtime,
+		item,
+		workspaceId,
+		reloadNonce = 0
+	}: {
+		runtime: SessionRuntime
+		item: PageItemRef
+		workspaceId: string
+		/** Bumped to reload the item from the server, discarding the mounted editor. */
+		reloadNonce?: number
+	} = $props()
+
+	// Mounted in the preview panel, outside the chat's own subtree: chat-aware components
+	// below would otherwise resolve the app-wide manager rather than this session's.
+	// Captured at init, as SessionEditorTarget does: descendants rely on its presence.
+	setContext(
+		'aiChatManager',
+		untrack(() => runtime.manager)
+	)
+	setOperatingWorkspace(() => workspaceId)
+
+	type TriggerEditorHandle = { openEdit: (path: string, isFlow: boolean) => Promise<void> }
+	type EditorModule = { default: any }
+
+	const TRIGGER_EDITORS: Record<TriggerKind | 'schedule', () => Promise<EditorModule>> = {
+		schedule: () => import('$lib/components/triggers/schedules/ScheduleEditorInner.svelte'),
+		http: () => import('$lib/components/triggers/http/RouteEditorInner.svelte'),
+		websocket: () =>
+			import('$lib/components/triggers/websocket/WebsocketTriggerEditorInner.svelte'),
+		postgres: () => import('$lib/components/triggers/postgres/PostgresTriggerEditorInner.svelte'),
+		kafka: () => import('$lib/components/triggers/kafka/KafkaTriggerEditorInner.svelte'),
+		nats: () => import('$lib/components/triggers/nats/NatsTriggerEditorInner.svelte'),
+		mqtt: () => import('$lib/components/triggers/mqtt/MqttTriggerEditorInner.svelte'),
+		amqp: () => import('$lib/components/triggers/amqp/AmqpTriggerEditorInner.svelte'),
+		sqs: () => import('$lib/components/triggers/sqs/SqsTriggerEditorInner.svelte'),
+		gcp: () => import('$lib/components/triggers/gcp/GcpTriggerEditorInner.svelte'),
+		azure: () => import('$lib/components/triggers/azure/AzureTriggerEditorInner.svelte'),
+		email: () => import('$lib/components/triggers/email/EmailTriggerEditorInner.svelte')
+	}
+
+	const triggerKey = $derived(
+		item.kind === 'schedule' ? 'schedule' : item.kind === 'trigger' ? item.triggerKind : undefined
+	)
+	const eeLocked = $derived(
+		item.kind === 'trigger' && !!TRIGGER_PAGES[item.triggerKind].ee && !$enterpriseLicense
+	)
+
+	let variableEditor: VariableEditor | undefined = $state()
+	let resourceEditor: ResourceEditorDrawer | undefined = $state()
+	let triggerEditor: TriggerEditorHandle | undefined = $state()
+
+	// Each editor loads through the same call its list page makes, once its instance is bound.
+	// Keyed below on everything that names what it shows, so each binding is a fresh instance.
+	$effect(() => {
+		const path = item.path
+		const v = variableEditor
+		const r = resourceEditor
+		const t = triggerEditor
+		untrack(() => {
+			v?.editVariable(path)
+			// An agent opens on JSON: the generic form would render its configuration field by
+			// field and write a default into each one the value leaves out, drafting just by opening.
+			void r?.initEdit(path, { json: lookup.current?.resourceType === 'ai_agent' })
+			void t?.openEdit(path, false)
+		})
+	})
+
+	// A save can move the item; the tab follows it, which remounts the editor on what was
+	// written. Saving in place remounts it too: the editors keep the pre-save baseline, and
+	// their drawers only ever relied on being closed after a save.
+	let savedNonce = $state(0)
+
+	// Whether the item still exists, deployed or as a draft, read again whenever the editor
+	// remounts: a delete or a discarded draft reloads the tab too, and the editors have no state
+	// of their own for an item that is gone. A lookup that fails otherwise is left to the editor,
+	// which reports its own load errors.
+	const lookup = resource(
+		() => ({ ref: item, workspace: workspaceId, reload: `${reloadNonce}:${savedNonce}` }),
+		({ ref, workspace }) =>
+			lookupPageItem(ref, workspace).then(
+				(found) => ({ exists: !!found, resourceType: found?.resource_type as string | undefined }),
+				() => ({ exists: true, resourceType: undefined })
+			)
+	)
+
+	function closeTab() {
+		const tab = runtime.previewTabs.tabs.find((t) => t.url === pageItemUrl(item))
+		if (tab) runtime.previewTabs.close(tab.id)
+	}
+	function onSaved(path: string | undefined) {
+		if (path && path !== item.path) {
+			runtime.previewTabs.retargetPageItem(item, { ...item, path })
+		} else {
+			savedNonce++
+		}
+	}
+</script>
+
+{#snippet loading()}
+	<div class="flex-1 flex items-center justify-center text-tertiary">
+		<Loader2 class="animate-spin" />
+	</div>
+{/snippet}
+
+<div class="flex h-full min-h-0 flex-col">
+	{#if eeLocked}
+		<div class="p-4 text-sm text-secondary">This trigger requires an enterprise license.</div>
+	{:else if lookup.loading || !lookup.current}
+		{@render loading()}
+	{:else if !lookup.current.exists}
+		<div class="flex flex-col items-start gap-3 p-4 text-sm text-secondary">
+			<p>
+				{pageItemKindLabel(item)} <span class="font-mono">{item.path}</span> no longer exists in this
+				workspace.
+			</p>
+			<Button variant="default" unifiedSize="sm" onClick={closeTab}>Close tab</Button>
+		</div>
+	{:else}
+		{#key `${item.kind}:${triggerKey}:${item.path}:${workspaceId}:${reloadNonce}:${savedNonce}`}
+			{#if item.kind === 'variable'}
+				<VariableEditor
+					bind:this={variableEditor}
+					inline
+					workspace={workspaceId}
+					{onSaved}
+					onClose={closeTab}
+				/>
+			{:else if item.kind === 'resource'}
+				<ResourceEditorDrawer
+					bind:this={resourceEditor}
+					inline
+					workspace={workspaceId}
+					onClose={closeTab}
+					onSaved={(path) => {
+						if (path !== undefined) onSaved(path)
+					}}
+					onRestored={() => savedNonce++}
+				/>
+			{:else if triggerKey}
+				{#await TRIGGER_EDITORS[triggerKey]()}
+					{@render loading()}
+				{:then Module}
+					<Module.default
+						bind:this={triggerEditor}
+						useDrawer
+						inline
+						onClose={closeTab}
+						onUpdate={(path?: string) => onSaved(path)}
+					/>
+				{/await}
+			{/if}
+		{/key}
+	{/if}
+</div>
diff --git a/frontend/src/lib/components/sessions/PageListView.svelte b/frontend/src/lib/components/sessions/PageListView.svelte
new file mode 100644
index 0000000000..7dab54c494
--- /dev/null
+++ b/frontend/src/lib/components/sessions/PageListView.svelte
@@ -0,0 +1,131 @@
+<script lang="ts">
+	import { setContext, untrack } from 'svelte'
+	import { Loader2 } from 'lucide-svelte'
+	import { setOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+	import { setHostedPage, type HostedPage } from '$lib/components/hostedPage'
+	import { pageItemForListPath, parsePreviewItemRoute } from './previewPaths'
+	import { previewLocationLabel } from './previewRouter'
+	import { whereIs } from './sessionPreviewTabs.svelte'
+	import type { SessionPreviewTab } from './sessionState.svelte'
+	import type { SessionRuntime } from './sessionRuntime.svelte'
+
+	let {
+		runtime,
+		tab,
+		path,
+		workspaceId,
+		container,
+		reloadNonce = 0
+	}: {
+		runtime: SessionRuntime
+		tab: SessionPreviewTab
+		/** The list page, base-stripped. */
+		path: string
+		workspaceId: string
+		/** The tab's element, which also holds the list's portalled drawers and menus. */
+		container: HTMLElement
+		/** Bumped to load the list again from the server. */
+		reloadNonce?: number
+	} = $props()
+
+	// Mounted in the preview panel, outside the chat's own subtree, as PageItemEditorView is.
+	setContext(
+		'aiChatManager',
+		untrack(() => runtime.manager)
+	)
+	setOperatingWorkspace(() => workspaceId)
+
+	// The tab is where the list keeps its filters: written as the tab's observed location, so
+	// the chat reads them and a remount restores them, as it would for a frame.
+	const locationParts = () => {
+		const loc = whereIs(tab).split('#')[0]
+		const at = loc.indexOf('?')
+		return at < 0
+			? { pathname: loc, search: '' }
+			: { pathname: loc.slice(0, at), search: loc.slice(at) }
+	}
+	const host: HostedPage = {
+		get search() {
+			return locationParts().search
+		},
+		setSearch(search) {
+			runtime.previewTabs.observeLocation(tab.id, locationParts().pathname + search)
+		},
+		openItem(itemPath) {
+			const ref = pageItemForListPath(path, itemPath)
+			if (ref) runtime.previewTabs.open({ type: 'pageitem', ref })
+		},
+		openLink(href) {
+			const item = parsePreviewItemRoute(href)
+			if (item) {
+				runtime.previewTabs.open({
+					type: 'item',
+					item: { kind: item.kind, raw_app: item.raw_app, path: item.itemPath, summary: '' }
+				})
+			} else {
+				runtime.previewTabs.open({ type: 'page', href, label: previewLocationLabel(href) })
+			}
+		}
+	}
+	setHostedPage(host)
+
+	// Any in-app link under the tab opens in the session rather than taking the whole window off
+	// it: a list, its drawers and its menus carry plain hrefs throughout (runs, audit logs, a
+	// job). A `#` link is a row's own: its handler opens the row through the host, and following
+	// it would write the row into the sessions page's own hash.
+	$effect(() => {
+		const el = container
+		function onClick(e: MouseEvent) {
+			if (e.defaultPrevented || e.button !== 0) return
+			if (e.metaKey || e.ctrlKey || e.shiftKey || e.altKey) return
+			const a = (e.target as Element | null)?.closest?.('a[href]') as HTMLAnchorElement | null
+			if (!a || (a.target && a.target !== '_self') || a.hasAttribute('download')) return
+			const url = new URL(a.href, window.location.href)
+			if (url.origin !== window.location.origin) return
+			e.preventDefault()
+			if (a.getAttribute('href')?.startsWith('#')) return
+			host.openLink(url.pathname + url.search + url.hash)
+		}
+		el.addEventListener('click', onClick)
+		return () => el.removeEventListener('click', onClick)
+	})
+
+	const listed = $derived(pageItemForListPath(path, ''))
+</script>
+
+{#snippet loading()}
+	<div class="flex-1 flex items-center justify-center text-tertiary">
+		<Loader2 class="animate-spin" />
+	</div>
+{/snippet}
+
+<!-- Dynamic imports, as the editors: each list pulls in its item's editor. -->
+<div class="flex h-full min-h-0 flex-col overflow-auto">
+	{#key `${path}:${workspaceId}:${reloadNonce}`}
+		{#if listed?.kind === 'variable'}
+			{#await import('$lib/components/variables/VariablesList.svelte')}
+				{@render loading()}
+			{:then Module}
+				<Module.default />
+			{/await}
+		{:else if listed?.kind === 'resource'}
+			{#await import('$lib/components/resources/ResourcesList.svelte')}
+				{@render loading()}
+			{:then Module}
+				<Module.default />
+			{/await}
+		{:else if listed?.kind === 'schedule'}
+			{#await import('$lib/components/schedules/SchedulesList.svelte')}
+				{@render loading()}
+			{:then Module}
+				<Module.default />
+			{/await}
+		{:else if listed?.kind === 'trigger'}
+			{#await import('$lib/components/triggers/TriggerList.svelte')}
+				{@render loading()}
+			{:then Module}
+				<Module.default triggerKind={listed.triggerKind} />
+			{/await}
+		{/if}
+	{/key}
+</div>
diff --git a/frontend/src/lib/components/sessions/PreviewTabHost.svelte b/frontend/src/lib/components/sessions/PreviewTabHost.svelte
index e641a98132..e094d1bcbe 100644
--- a/frontend/src/lib/components/sessions/PreviewTabHost.svelte
+++ b/frontend/src/lib/components/sessions/PreviewTabHost.svelte
@@ -167,6 +167,10 @@
 		applyPageIframeTheme(darkMode)
 	})
 
+	// A page item's editor reads its draft only when it loads, so a reload remounts it.
+	let pageItemReloadNonce = $state(0)
+	let pageListReloadNonce = $state(0)
+
 	export function reload() {
 		// A live editor shares the runtime store the chat mutates, so generic chat
 		// edits are already reflected — no reload needed. Deploys refresh it via
@@ -179,6 +183,14 @@
 			viewer?.refresh()
 			return
 		}
+		if (slot.kind === 'pageitem') {
+			pageItemReloadNonce++
+			return
+		}
+		if (slot.kind === 'pagelist') {
+			pageListReloadNonce++
+			return
+		}
 		try {
 			const win = frame?.contentWindow
 			if (!win) return
@@ -416,6 +428,43 @@
 			</div>
 		{/if}
 	</div>
+{:else if slot.kind === 'pageitem' && mounted && runtime}
+	<div
+		bind:this={overlayHostEl}
+		class="absolute inset-0 flex flex-col min-h-0 bg-surface {visibility}"
+		aria-hidden={!active}
+	>
+		<!-- Waits for the host element, as the run form does: the editors' own drawers and
+		     modals portal when they mount, and resolve their host only then. -->
+		{#if overlayHostEl}
+			{#await import('./PageItemEditorView.svelte')}
+				{@render editorLoading()}
+			{:then Module}
+				<Module.default {runtime} item={slot.ref} {workspaceId} reloadNonce={pageItemReloadNonce} />
+			{/await}
+		{/if}
+	</div>
+{:else if slot.kind === 'pagelist' && mounted && runtime}
+	<div
+		bind:this={overlayHostEl}
+		class="absolute inset-0 flex flex-col min-h-0 bg-surface {visibility}"
+		aria-hidden={!active}
+	>
+		{#if overlayHostEl}
+			{#await import('./PageListView.svelte')}
+				{@render editorLoading()}
+			{:then Module}
+				<Module.default
+					{runtime}
+					{tab}
+					path={slot.path}
+					{workspaceId}
+					container={overlayHostEl}
+					reloadNonce={pageListReloadNonce}
+				/>
+			{/await}
+		{/if}
+	</div>
 {:else if slot.kind === 'artifact' && mounted}
 	<div
 		bind:this={overlayHostEl}
diff --git a/frontend/src/lib/components/sessions/RawAppEditorView.svelte b/frontend/src/lib/components/sessions/RawAppEditorView.svelte
index a59ff5eb45..e95bc142e5 100644
--- a/frontend/src/lib/components/sessions/RawAppEditorView.svelte
+++ b/frontend/src/lib/components/sessions/RawAppEditorView.svelte
@@ -172,9 +172,10 @@
 
 	// The inline mini-composer over a selected element sends a chat turn; the
 	// element is already an app_dom_selector chip, so it rides along as context.
-	// Mirror the composer: while a turn is streaming, queue it (a second concurrent
-	// sendRequest would race the shared abortController / streaming buffers) — it
-	// auto-sends when the current turn completes.
+	// Mirror the composer: while another send holds the chat — streaming, in
+	// preflight, or waiting for the transcript to be restored — queue it (a second
+	// concurrent sendRequest would race the shared abortController / streaming
+	// buffers) — it auto-sends when the current turn completes.
 	function onInlinePrompt(selector: string, prompt: string) {
 		// Snapshot the selection synchronously at submit time so a re-selection
 		// during the async send preflight (immediate path) or before the queue
@@ -190,7 +191,7 @@
 			.filter(
 				(c) => c.type !== 'app_dom_selector' || (c.selector === selector && c.appPath === path)
 			)
-		if (runtime.manager.loading) {
+		if (runtime.manager.loading || runtime.manager.sendInFlight || runtime.manager.sendPending) {
 			runtime.manager.queueMessage(prompt, [], snapshot)
 		} else {
 			void runtime.manager.sendRequest({ instructions: prompt, contextOverride: snapshot })
@@ -240,6 +241,9 @@
 			     cell.saved.val), reactive state owned by the SessionRuntime class (via
 			     rawAppCell), not by a component ancestor — so Svelte's ownership check
 			     flags a false positive here. -->
+			<!-- version / draftBaseVersion: the pair the session's draft carries, so the
+			     deploy guard and the drawer compare what the full-page editor does;
+			     without them every deploy from a session tab reads as up to date. -->
 			<!-- svelte-ignore ownership_invalid_binding -->
 			<RawAppEditor
 				bind:files={cell.store.val.files}
@@ -253,6 +257,10 @@
 				autosavePath={path}
 				policy={cell.store.val.policy}
 				bind:savedApp={cell.saved.val}
+				version={cell.store.val?.parent_version ?? cell.saved.val?.deployed_version}
+				draftBaseVersion={cell.store.val?.parent_version != null
+					? String(cell.store.val.parent_version)
+					: undefined}
 				newApp={!cell.saved.val || cell.saved.val.no_deployed === true}
 				{diffDrawer}
 				{onNavigate}
diff --git a/frontend/src/lib/components/sessions/SessionChangesBar.svelte b/frontend/src/lib/components/sessions/SessionChangesBar.svelte
index 61333a65bc..777ca8c935 100644
--- a/frontend/src/lib/components/sessions/SessionChangesBar.svelte
+++ b/frontend/src/lib/components/sessions/SessionChangesBar.svelte
@@ -197,8 +197,8 @@
 		return previewTargetForDeployKind(item.deployKind, item.path)
 	}
 
-	// The row's primary action is the preview; kinds the panel can't host
-	// (triggers, schedules, resources, variables) fall back to their diff.
+	// The row's primary action is the preview; kinds the panel can't host fall back
+	// to their diff.
 	function openRow(item: DeployItem) {
 		if (previewTargetFor(item)) openInPreview(item)
 		else openDrawer(item.key)
diff --git a/frontend/src/lib/components/sessions/SessionEditorTarget.svelte b/frontend/src/lib/components/sessions/SessionEditorTarget.svelte
index 65e1a13abf..0ff2329abf 100644
--- a/frontend/src/lib/components/sessions/SessionEditorTarget.svelte
+++ b/frontend/src/lib/components/sessions/SessionEditorTarget.svelte
@@ -9,6 +9,7 @@
 	import { itemDisplayName } from './previewRouter'
 	import SessionItemNotFound from './SessionItemNotFound.svelte'
 	import { setEditorStoragePath } from '../editorStoragePathContext'
+	import { setOperatingWorkspace } from '../operatingWorkspace.svelte'
 
 	let {
 		runtime,
@@ -51,6 +52,7 @@
 	// component instance keeps the first runtime's manager — so descendants may
 	// rely on its presence, not its identity.
 	setContext('aiChatManager', runtime.manager)
+	setOperatingWorkspace(() => workspaceId)
 
 	// This tab's storage path, for the editor below: several tabs are mounted at
 	// once and only this one knows which item each is open on.
diff --git a/frontend/src/lib/components/sessions/SessionPicker.svelte b/frontend/src/lib/components/sessions/SessionPicker.svelte
index e5b62da0eb..ce1ad89246 100644
--- a/frontend/src/lib/components/sessions/SessionPicker.svelte
+++ b/frontend/src/lib/components/sessions/SessionPicker.svelte
@@ -33,6 +33,7 @@
 		reconcileAfterWorkspaceChange,
 		renameSession,
 		selectSession,
+		sessionPageHref,
 		sessionLastActivityAt,
 		sessionState,
 		setNewSessionWorkspace,
@@ -44,8 +45,9 @@
 	import { unreadCountFor } from './sessionUnread.svelte'
 	import Toggle from '$lib/components/Toggle.svelte'
 	import {
-		getOrCreateRuntime,
+		ensureSessionChatPeek,
 		getRuntime,
+		getSessionChatPeek,
 		getSessionChatStatus,
 		removeSession,
 		resetSessionPreviewTabs
@@ -87,7 +89,7 @@
 	// displayMessages array vs. the localStorage-backed lastSeen map;
 	// both are reactive so the badge updates without polling.
 	function unreadFor(session: Session): number {
-		return unreadCountFor(session.id, getRuntime(session.id))
+		return unreadCountFor(session.id, getRuntime(session.id), getSessionChatPeek(session.id))
 	}
 
 	// Whether the composer for a session holds non-whitespace text. We
@@ -378,14 +380,12 @@
 		}
 	})
 
-	// Eagerly create a runtime per VISIBLE session so the status dot reflects
-	// the persisted chat (last message, pending confirmation, etc.) without
-	// requiring the user to open the session first. Sessions outside the
-	// current workspace scope are left cold to avoid opening IDB connections
-	// for unrelated work.
+	// Read each VISIBLE session's stored chat so the status dot and unread count
+	// reflect it without the user opening the session. A runtime per listed
+	// session would hold every listed chat in memory for as long as the page lives.
 	$effect(() => {
 		for (const session of visibleSessions) {
-			getOrCreateRuntime(session)
+			if (!getRuntime(session.id)) void ensureSessionChatPeek(session)
 		}
 	})
 
@@ -402,7 +402,7 @@
 		// so opening one must not change the user's active (navigation) workspace.
 		// Open the dedicated sessions page; its preview panel iframes the
 		// session's view (captured page / editor target).
-		await goto(`/sessions?session_name=${encodeURIComponent(session.name)}`)
+		await goto(sessionPageHref(session.id))
 		if (restoreFocus) {
 			// goto() resets focus to <body> — put it back on the active session button
 			// so subsequent arrow keys keep navigating the list.
@@ -609,14 +609,14 @@
 
 	// After deleting the open session, land somewhere usable: the newest remaining
 	// session, else a fresh one. The page derives the visible session from the
-	// `session_name` query, so leaving the URL on a deleted session would fall
+	// `session` query, so leaving the URL on a deleted session would fall
 	// through to recovery and open a blank one rather than their recent work.
 	async function openReplacementSession() {
 		const next = sessionState.sessions[0]
 		if (next) await activate(next)
 		else {
 			const fresh = createSession()
-			await goto(`/sessions?session_name=${encodeURIComponent(fresh.name)}`)
+			await goto(sessionPageHref(fresh.id))
 		}
 	}
 
@@ -768,7 +768,9 @@
 									{/if}
 									{#each group.sessions as session (session.id)}
 										{@const runtime = getRuntime(session.id)}
-										{@const status = runtime ? getSessionChatStatus(runtime) : 'idle'}
+										{@const status = runtime
+											? getSessionChatStatus(runtime)
+											: (getSessionChatPeek(session.id)?.status ?? 'idle')}
 										{@const isSelected =
 											sessionActive && session.id === sessionState.currentSessionId}
 										{@const unread = unreadFor(session)}
@@ -986,7 +988,9 @@
 				{/snippet}
 				{#snippet sessionRow(session, indented, treeDepth)}
 					{@const runtime = getRuntime(session.id)}
-					{@const status = runtime ? getSessionChatStatus(runtime) : 'idle'}
+					{@const status = runtime
+						? getSessionChatStatus(runtime)
+						: (getSessionChatPeek(session.id)?.status ?? 'idle')}
 					{@const isSelected = sessionActive && session.id === sessionState.currentSessionId}
 					{@const isEditing = editingId === session.id}
 					{@const unread = unreadFor(session)}
@@ -1294,7 +1298,7 @@
 	<div class="flex flex-col gap-3">
 		<p>
 			Delete session <span class="font-medium text-primary"
-				>{pendingDelete?.summary ?? pendingDelete?.name}</span
+				>{pendingDelete?.summary ?? 'Untitled session'}</span
 			>? This cannot be undone.
 		</p>
 		{#if pendingDeleteForkId}
diff --git a/frontend/src/lib/components/sessions/SessionWrapper.svelte b/frontend/src/lib/components/sessions/SessionWrapper.svelte
index b56b72c2be..775b1b150f 100644
--- a/frontend/src/lib/components/sessions/SessionWrapper.svelte
+++ b/frontend/src/lib/components/sessions/SessionWrapper.svelte
@@ -46,6 +46,7 @@
 		reconcileAfterWorkspaceChange,
 		renameSession,
 		selectSession,
+		sessionPageHref,
 		sessionState,
 		setSessionArchived,
 		syncWorkspaceTo,
@@ -164,10 +165,10 @@
 	async function resetToNewSession() {
 		const fresh = createSession()
 		selectSession(fresh.id)
-		// The page derives the visible session from the `session_name` query, not
+		// The page derives the visible session from the `session` query, not
 		// currentSessionId: navigate so the URL leaves the deleted/archived session,
 		// which would otherwise fall through to recovery or stay on the archived one.
-		await goto(`/sessions?session_name=${encodeURIComponent(fresh.name)}`)
+		await goto(sessionPageHref(fresh.id))
 	}
 
 	// If the session targets a forked workspace that's still accessible,
@@ -536,7 +537,7 @@
 		<div class="flex flex-col gap-3">
 			<p>
 				Delete session <span class="font-medium text-primary"
-					>{session?.summary ?? session?.name}</span
+					>{session?.summary ?? 'Untitled session'}</span
 				>? This cannot be undone.
 			</p>
 			{#if sessionForkId}
@@ -568,7 +569,7 @@
 		<div class="flex flex-col gap-3">
 			<p>
 				Archive session <span class="font-medium text-primary"
-					>{session?.summary ?? session?.name}</span
+					>{session?.summary ?? 'Untitled session'}</span
 				>? You can restore it later from the archived list.
 			</p>
 			{#if sessionForkId}
diff --git a/frontend/src/lib/components/sessions/appDraftCodec.test.ts b/frontend/src/lib/components/sessions/appDraftCodec.test.ts
index ba0d6f5f2d..8a6ac74f86 100644
--- a/frontend/src/lib/components/sessions/appDraftCodec.test.ts
+++ b/frontend/src/lib/components/sessions/appDraftCodec.test.ts
@@ -78,3 +78,25 @@ describe('appDraftCodec — draft_path round-trip', () => {
 		expect(back.draft_path).toBe('u/admin/renamed')
 	})
 })
+
+describe('appDraftCodec — fork base round-trip', () => {
+	it('carries the draft version both ways', () => {
+		const draft = runtimeRawAppToDraft(runtime({ parent_version: 3 }))
+		expect(draft.parent_version).toBe(3)
+		expect(applyDraftToRuntimeRawApp(runtime({ parent_version: 1 }), draft).parent_version).toBe(3)
+	})
+
+	it('keeps an unknown base unknown rather than adopting the runtime version', () => {
+		const dv: RawAppDraft = {
+			summary: 'app',
+			files: {},
+			runnables: {},
+			data: { tables: [] } as any
+		}
+		// This result round-trips into the next save: a fallback here would claim the
+		// content forked from the version the session happens to hold.
+		expect(applyDraftToRuntimeRawApp(runtime({ parent_version: 2 }), dv).parent_version).toBe(
+			undefined
+		)
+	})
+})
diff --git a/frontend/src/lib/components/sessions/appDraftCodec.ts b/frontend/src/lib/components/sessions/appDraftCodec.ts
index 10752b8d8f..7d9f4b048f 100644
--- a/frontend/src/lib/components/sessions/appDraftCodec.ts
+++ b/frontend/src/lib/components/sessions/appDraftCodec.ts
@@ -16,6 +16,9 @@ export type RawAppDraft = {
 	// friendly name (they read `value->>'draft_path'`) — and so editing the path
 	// in the editor changes the persisted draft and triggers an autosave.
 	draft_path?: string
+	// The app_version the draft forked from. The server derives `draft.base` from
+	// it, which is what tells a draft that is behind the deployed head.
+	parent_version?: number
 }
 
 // The shape a raw-app cell's store (`RawAppRuntimeValue` in
@@ -30,6 +33,7 @@ export type RuntimeRawApp = {
 	policy: any
 	custom_path?: string
 	draft_path?: string
+	parent_version?: number
 }
 
 // Strip runtime-only metadata (just `path`, the storage key) when persisting
@@ -43,7 +47,8 @@ export function runtimeRawAppToDraft(raw: RuntimeRawApp): RawAppDraft {
 		data: raw.data,
 		policy: raw.policy,
 		custom_path: raw.custom_path,
-		draft_path: raw.draft_path
+		draft_path: raw.draft_path,
+		parent_version: raw.parent_version
 	}
 }
 
@@ -58,6 +63,10 @@ export function applyDraftToRuntimeRawApp(raw: RuntimeRawApp, dv: RawAppDraft):
 		data: dv.data,
 		policy: dv.policy ?? raw.policy,
 		custom_path: dv.custom_path ?? raw.custom_path,
-		draft_path: dv.draft_path ?? raw.draft_path
+		draft_path: dv.draft_path ?? raw.draft_path,
+		// The incoming draft's own fork base, absence included: this round-trips into the
+		// next save, so falling back to the runtime's version would give that content a
+		// base it never forked from and hide that it is behind.
+		parent_version: dv.parent_version
 	}
 }
diff --git a/frontend/src/lib/components/sessions/pageDrawerSession.ts b/frontend/src/lib/components/sessions/pageDrawerSession.ts
index ca7379be20..0a3e7435ca 100644
--- a/frontend/src/lib/components/sessions/pageDrawerSession.ts
+++ b/frontend/src/lib/components/sessions/pageDrawerSession.ts
@@ -11,6 +11,7 @@ import type { UserDraftItemKind } from '$lib/gen'
 // flow editors, where pulling the filter schemas that module reads views from would make
 // every trigger's save utils eager.
 import {
+	drawerHashFor,
 	pageHref,
 	stripBase,
 	TRIGGER_PAGES,
@@ -63,11 +64,6 @@ async function flushOrRefuse(query: Parameters<typeof UserDraftDbSyncer.flush>[0
 	}
 }
 
-// How each page addresses a row in its hash. Resources route theirs through an extra
-// segment; every other page names the path directly.
-const drawerHashFor = (pagePath: string, itemPath: string) =>
-	pagePath === RESOURCES_PATH ? `/resource/${itemPath}` : itemPath
-
 /**
  * Deep-link the row whose drawer just opened, so the location says what is on screen — a
  * drawer opened from a row's Edit button is as open as one reached by link, and the chat
diff --git a/frontend/src/lib/components/sessions/pageItemLookup.ts b/frontend/src/lib/components/sessions/pageItemLookup.ts
new file mode 100644
index 0000000000..bee3fc41c1
--- /dev/null
+++ b/frontend/src/lib/components/sessions/pageItemLookup.ts
@@ -0,0 +1,62 @@
+import {
+	AmqpTriggerService,
+	ApiError,
+	AzureTriggerService,
+	EmailTriggerService,
+	GcpTriggerService,
+	HttpTriggerService,
+	KafkaTriggerService,
+	MqttTriggerService,
+	NatsTriggerService,
+	PostgresTriggerService,
+	ResourceService,
+	ScheduleService,
+	SqsTriggerService,
+	VariableService,
+	WebsocketTriggerService
+} from '$lib/gen'
+import type { PageItemRef, TriggerKind } from './previewPaths'
+
+type Get = (args: { workspace: string; path: string; getDraft: boolean }) => Promise<unknown>
+
+const TRIGGER_GETS: Record<TriggerKind, Get> = {
+	http: (a) => HttpTriggerService.getHttpTrigger(a),
+	websocket: (a) => WebsocketTriggerService.getWebsocketTrigger(a),
+	postgres: (a) => PostgresTriggerService.getPostgresTrigger(a),
+	kafka: (a) => KafkaTriggerService.getKafkaTrigger(a),
+	nats: (a) => NatsTriggerService.getNatsTrigger(a),
+	mqtt: (a) => MqttTriggerService.getMqttTrigger(a),
+	amqp: (a) => AmqpTriggerService.getAmqpTrigger(a),
+	sqs: (a) => SqsTriggerService.getSqsTrigger(a),
+	gcp: (a) => GcpTriggerService.getGcpTrigger(a),
+	azure: (a) => AzureTriggerService.getAzureTrigger(a),
+	email: (a) => EmailTriggerService.getEmailTrigger(a)
+}
+
+function getFor(ref: PageItemRef): Get {
+	switch (ref.kind) {
+		case 'variable':
+			return (a) => VariableService.getVariable(a)
+		case 'resource':
+			return (a) => ResourceService.getResource(a)
+		case 'schedule':
+			return (a) => ScheduleService.getSchedule(a)
+		case 'trigger':
+			return TRIGGER_GETS[ref.triggerKind]
+	}
+}
+
+/** A page item as its editor would load it — deployed, or only a draft — or undefined when it
+ * is neither: deleted, or a draft that was discarded. Any other failure is thrown, for the
+ * caller to leave to the editor rather than report as a missing item. */
+export async function lookupPageItem(
+	ref: PageItemRef,
+	workspace: string
+): Promise<Record<string, any> | undefined> {
+	try {
+		return (await getFor(ref)({ workspace, path: ref.path, getDraft: true })) as Record<string, any>
+	} catch (e) {
+		if (e instanceof ApiError && e.status === 404) return undefined
+		throw e
+	}
+}
diff --git a/frontend/src/lib/components/sessions/previewPaths.ts b/frontend/src/lib/components/sessions/previewPaths.ts
index 063cf7cc04..bd1ab1f1a3 100644
--- a/frontend/src/lib/components/sessions/previewPaths.ts
+++ b/frontend/src/lib/components/sessions/previewPaths.ts
@@ -48,6 +48,92 @@ export const TRIGGER_PAGES: Record<TriggerKind, { path: string; label: string; e
 	email: { path: '/email_triggers', label: 'Email triggers' }
 }
 
+/** A workspace item edited from its list page rather than at an editor route: a variable,
+ * resource, schedule or trigger. A session hosts each in a tab of its own. */
+export type PageItemRef =
+	| { kind: 'variable' | 'resource' | 'schedule'; path: string }
+	| { kind: 'trigger'; triggerKind: TriggerKind; path: string }
+
+/** How a list page addresses a row in its hash. Resources route theirs through an extra
+ * segment; every other page names the path directly. */
+export const drawerHashFor = (pagePath: string, itemPath: string) =>
+	pagePath === RESOURCES_PATH ? `/resource/${itemPath}` : itemPath
+
+/** The full page a page item is edited on: its list page, with the row's drawer open. */
+export function pageItemPageHref(ref: PageItemRef): string {
+	const listPath = pageItemListPath(ref)
+	return `${pageHref(listPath)}#${drawerHashFor(listPath, ref.path)}`
+}
+
+/** The list page a page item is edited from. */
+export function pageItemListPath(ref: PageItemRef): string {
+	switch (ref.kind) {
+		case 'variable':
+			return VARIABLES_PATH
+		case 'resource':
+			return RESOURCES_PATH
+		case 'schedule':
+			return SCHEDULES_PATH
+		case 'trigger':
+			return TRIGGER_PAGES[ref.triggerKind].path
+	}
+}
+
+/** Whether a (base-stripped) path is the list page of a page item kind. */
+export function isPageItemListPath(path: string): boolean {
+	return pageItemForListPath(path, '') !== undefined
+}
+
+/** The page item a list page's row names, or undefined for a page that lists none. */
+export function pageItemForListPath(pagePath: string, path: string): PageItemRef | undefined {
+	const clean = stripBase(pagePath)
+	if (clean === VARIABLES_PATH) return { kind: 'variable', path }
+	if (clean === RESOURCES_PATH) return { kind: 'resource', path }
+	if (clean === SCHEDULES_PATH) return { kind: 'schedule', path }
+	const trigger = Object.entries(TRIGGER_PAGES).find(([, p]) => p.path === clean)
+	return trigger ? { kind: 'trigger', triggerKind: trigger[0] as TriggerKind, path } : undefined
+}
+
+const PAGE_ITEM_ROUTE = /^pageitem:(variable|resource|schedule|trigger\.([a-z]+))\/([^?#]+)$/
+
+// A scheme rather than a path, like artifacts: the tab mounts the item's editor in process,
+// so there is no page a frame could load. The path is encoded whole, so its slashes cannot
+// be read as part of the scheme.
+export function pageItemUrl(ref: PageItemRef): string {
+	const kind = ref.kind === 'trigger' ? `trigger.${ref.triggerKind}` : ref.kind
+	return `pageitem:${kind}/${encodeURIComponent(ref.path)}`
+}
+
+export function parsePageItemRoute(url: string): PageItemRef | null {
+	const m = url.match(PAGE_ITEM_ROUTE)
+	if (!m) return null
+	let path: string
+	try {
+		path = decodeURIComponent(m[3])
+	} catch {
+		return null
+	}
+	if (m[2] !== undefined) {
+		if (!(m[2] in TRIGGER_PAGES)) return null
+		return { kind: 'trigger', triggerKind: m[2] as TriggerKind, path }
+	}
+	return { kind: m[1] as 'variable' | 'resource' | 'schedule', path }
+}
+
+/** Singular human name of a page item's kind, e.g. "Kafka trigger". */
+export function pageItemKindLabel(ref: PageItemRef): string {
+	switch (ref.kind) {
+		case 'variable':
+			return 'Variable'
+		case 'resource':
+			return 'Resource'
+		case 'schedule':
+			return 'Schedule'
+		case 'trigger':
+			return TRIGGER_PAGES[ref.triggerKind].label.replace(/s$/, '')
+	}
+}
+
 /** Label a trigger list page from its (base-stripped) pathname, or undefined. */
 export function triggerLabelForPath(path: string): string | undefined {
 	const clean = stripBase(path)
diff --git a/frontend/src/lib/components/sessions/previewReload.test.ts b/frontend/src/lib/components/sessions/previewReload.test.ts
index c8da6bc097..e7924a1813 100644
--- a/frontend/src/lib/components/sessions/previewReload.test.ts
+++ b/frontend/src/lib/components/sessions/previewReload.test.ts
@@ -1,6 +1,7 @@
 import { describe, it, expect } from 'vitest'
 import { toolReloadEffect, tabsToReload, viewerTabsToReload } from './previewReload'
 import type { SessionPreviewTab } from './sessionState.svelte'
+import { pageItemUrl } from './previewPaths'
 
 describe('toolReloadEffect', () => {
 	it('maps a non-item mutation to its own list page only', () => {
@@ -52,6 +53,26 @@ describe('toolReloadEffect', () => {
 	})
 })
 
+describe('page item tabs', () => {
+	const tab = (url: string): SessionPreviewTab => ({ id: url, url, loc: url })
+	const kafkaA = tab('pageitem:trigger.kafka/u%2Fme%2Fa')
+	const kafkaB = tab('pageitem:trigger.kafka/u%2Fme%2Fb')
+	const list = tab('/kafka_triggers')
+
+	it('reloads only the trigger a write names, and its list page', () => {
+		const { pages, items } = toolReloadEffect('write_trigger', {
+			kind: 'kafka',
+			config: { path: 'u/me/a' }
+		})
+		const named = new Set(items.map((i) => pageItemUrl(i)))
+		expect(tabsToReload([kafkaA, kafkaB, list], new Set(pages), named)).toEqual([kafkaA, list])
+	})
+
+	it('reloads every tab of the kind when the tool names no item', () => {
+		expect(tabsToReload([kafkaA, kafkaB], new Set(['/kafka_triggers']))).toEqual([kafkaA, kafkaB])
+	})
+})
+
 describe('tabsToReload', () => {
 	const scheduleTab: SessionPreviewTab = { id: 's', url: '/schedules', loc: '/schedules' }
 	const resourceTab: SessionPreviewTab = { id: 'r', url: '/resources', loc: '/resources' }
@@ -120,31 +141,31 @@ describe('viewerTabsToReload', () => {
 	})
 })
 
-describe('toolReloadEffect items', () => {
+describe('toolReloadEffect deployed', () => {
 	// A deploy is invisible to a View tab otherwise: it renders the deployed version over
 	// the API and shares no store with the chat.
 	it('names the item a deploy or delete changed, for the kinds a tab can view', () => {
 		for (const type of ['script', 'flow', 'app']) {
-			expect(toolReloadEffect('deploy_workspace_item', { type, path: 'u/me/x' }).items).toEqual([
+			expect(toolReloadEffect('deploy_workspace_item', { type, path: 'u/me/x' }).deployed).toEqual([
 				'u/me/x'
 			])
-			expect(toolReloadEffect('delete_workspace_item', { type, path: 'u/me/x' }).items).toEqual([
+			expect(toolReloadEffect('delete_workspace_item', { type, path: 'u/me/x' }).deployed).toEqual([
 				'u/me/x'
 			])
 		}
 	})
 
 	it('names no item for a draft-only tool — nothing deployed changed', () => {
-		expect(toolReloadEffect('write_script', { path: 'u/me/x' }).items).toEqual([])
+		expect(toolReloadEffect('write_script', { path: 'u/me/x' }).deployed).toEqual([])
 		expect(
-			toolReloadEffect('discard_local_draft', { type: 'script', path: 'u/me/x' }).items
+			toolReloadEffect('discard_local_draft', { type: 'script', path: 'u/me/x' }).deployed
 		).toEqual([])
-		expect(toolReloadEffect('rebase_draft', { type: 'flow', path: 'u/me/x' }).items).toEqual([])
+		expect(toolReloadEffect('rebase_draft', { type: 'flow', path: 'u/me/x' }).deployed).toEqual([])
 	})
 
 	it('names no item for types that have a list page instead of a view side', () => {
 		expect(
-			toolReloadEffect('deploy_workspace_item', { type: 'schedule', path: 'u/me/s' }).items
+			toolReloadEffect('deploy_workspace_item', { type: 'schedule', path: 'u/me/s' }).deployed
 		).toEqual([])
 	})
 })
diff --git a/frontend/src/lib/components/sessions/previewReload.ts b/frontend/src/lib/components/sessions/previewReload.ts
index 5df0715063..d9259c900d 100644
--- a/frontend/src/lib/components/sessions/previewReload.ts
+++ b/frontend/src/lib/components/sessions/previewReload.ts
@@ -1,6 +1,15 @@
 import type { SessionPreviewTab } from './sessionState.svelte'
 import { whereIs } from './sessionPreviewTabs.svelte'
-import { parsePreviewItemRoute, stripBase, TRIGGER_PAGES, type TriggerKind } from './previewPaths'
+import {
+	pageItemListPath,
+	pageItemUrl,
+	parsePageItemRoute,
+	parsePreviewItemRoute,
+	stripBase,
+	TRIGGER_PAGES,
+	type PageItemRef,
+	type TriggerKind
+} from './previewPaths'
 
 // Which list pages a completed chat tool can change, as base-stripped paths
 // (e.g. `/schedules`). This allowlist is the single source of truth for "does
@@ -13,40 +22,50 @@ import { parsePreviewItemRoute, stripBase, TRIGGER_PAGES, type TriggerKind } fro
 // deliberately absent: every editable item is a live in-process editor that
 // self-syncs from the store the chat mutates, so its tab needs no reload — and
 // no list page we preview lists open drafts. They fall through to NO_RELOAD.
-// This "live editors self-sync, only list pages reload" invariant is the reason
-// the callers below and in the sessions page reload nothing for item tabs.
 //
-// `items` is the one exception to it. A tab can sit on the VIEW side of an item,
+// Page items (variables, resources, schedules, triggers) are the exception among
+// in-process tabs: their editors read a draft only when they open, so a write to
+// one reloads its tab too. `items` names it when the tool's args do; without a
+// path, every tab of that kind reloads.
+//
+// `deployed` is the other exception. A tab can sit on the VIEW side of an item,
 // which renders the DEPLOYED version read over the API — it shares no store with
 // the chat, so a tool that changes what is deployed at a path has to name it here
 // or that tab keeps showing the previous deployment. Only tools that change the
-// deployed item belong in `items`; a draft write does not.
-export type ToolReloadEffect = { pages: string[]; items: string[] }
-const NO_RELOAD: ToolReloadEffect = { pages: [], items: [] }
+// deployed item belong in `deployed`; a draft write does not.
+export type ToolReloadEffect = { pages: string[]; items: PageItemRef[]; deployed: string[] }
+const NO_RELOAD: ToolReloadEffect = { pages: [], items: [], deployed: [] }
 
 export function toolReloadEffect(name: string, args: any): ToolReloadEffect {
 	switch (name) {
 		case 'write_schedule':
-			return { pages: ['/schedules'], items: [] }
+			return withItem(['/schedules'], itemRef('schedule', args))
 		case 'write_trigger':
-			return { pages: triggerPages(args?.kind), items: [] }
+			// Its path sits in the trigger's own config, not beside `kind`.
+			return withItem(triggerPages(args?.kind), itemRef('trigger', args?.config, args?.kind))
 		case 'write_resource':
-			return { pages: ['/resources'], items: [] }
+			return withItem(['/resources'], itemRef('resource', args))
 		case 'write_variable':
-			return { pages: ['/variables'], items: [] }
+			return withItem(['/variables'], itemRef('variable', args))
 		case 'create_folder':
-			return { pages: ['/folders'], items: [] }
+			return { pages: ['/folders'], items: [], deployed: [] }
 		// These two change what is deployed at a path, so a tab on that item's View side
 		// is showing a version that no longer exists.
 		case 'delete_workspace_item':
 		case 'deploy_workspace_item':
-			return { pages: pagesForItemType(args?.type, args), items: deployedItems(args) }
+			return {
+				...withItem(pagesForItemType(args?.type, args), itemRef(args?.type, args)),
+				deployed: deployedItems(args)
+			}
 		// Generic item tools carry a workspace-item `type`; refresh its list page
 		// when it lives on one (schedule/resource/variable/trigger). script/flow/app
 		// have their own live editor tab and no previewed list page → nothing.
 		case 'discard_local_draft':
 		case 'rebase_draft':
-			return { pages: pagesForItemType(args?.type, args), items: [] }
+			return withItem(
+				pagesForItemType(args?.type, args),
+				itemRef(args?.type, args, args?.trigger_kind)
+			)
 		default:
 			return NO_RELOAD
 	}
@@ -60,6 +79,22 @@ function deployedItems(args: any): string[] {
 	return typeof args?.path === 'string' && args.path ? [args.path] : []
 }
 
+function withItem(pages: string[], item: PageItemRef | undefined): ToolReloadEffect {
+	return { pages, items: item && pages.length ? [item] : [], deployed: [] }
+}
+
+function itemRef(type: unknown, args: any, triggerKind?: unknown): PageItemRef | undefined {
+	const path = args?.path
+	if (typeof path !== 'string' || !path) return undefined
+	if (type === 'variable' || type === 'resource' || type === 'schedule') {
+		return { kind: type, path }
+	}
+	if (type === 'trigger' && (triggerKind as string) in TRIGGER_PAGES) {
+		return { kind: 'trigger', triggerKind: triggerKind as TriggerKind, path }
+	}
+	return undefined
+}
+
 function pagesForItemType(type: unknown, args: any): string[] {
 	switch (type) {
 		case 'schedule':
@@ -80,16 +115,25 @@ function triggerPages(kind: unknown): string[] {
 	return page ? [page.path] : []
 }
 
-// The open tabs a page-reload should refresh: those whose observed page path is
-// in `pages`. Item-editor and pipeline tab routes are never list pages, so they
-// never match (see the self-sync invariant above). Pure over a tab snapshot so
-// the sessions page can reload by id and this stays unit-testable.
+// The open tabs a reload should refresh: list-page tabs whose observed page path is
+// in `pages`, and page item tabs on those pages — only the named ones when a tool
+// named its item. Item-editor and pipeline tab routes are never list pages, so they
+// never match (see the self-sync invariant above). Pure over a tab snapshot so the
+// sessions page can reload by id and this stays unit-testable.
 export function tabsToReload(
 	tabs: SessionPreviewTab[],
-	pages: ReadonlySet<string>
+	pages: ReadonlySet<string>,
+	items: ReadonlySet<string> = new Set()
 ): SessionPreviewTab[] {
 	if (pages.size === 0) return []
-	return tabs.filter((t) => pages.has(stripBase(whereIs(t))))
+	return tabs.filter((t) => {
+		const pageItem = parsePageItemRoute(t.url)
+		if (!pageItem) return pages.has(stripBase(whereIs(t)))
+		const listPath = pageItemListPath(pageItem)
+		if (!pages.has(listPath)) return false
+		const named = [...items].some((u) => pageItemListPath(parsePageItemRoute(u)!) === listPath)
+		return !named || items.has(pageItemUrl(pageItem))
+	})
 }
 
 // The open tabs a deploy/delete of `items` should refresh: those sitting on the VIEW side
diff --git a/frontend/src/lib/components/sessions/previewRouter.test.ts b/frontend/src/lib/components/sessions/previewRouter.test.ts
index c8a35cbdbc..fe409d94c1 100644
--- a/frontend/src/lib/components/sessions/previewRouter.test.ts
+++ b/frontend/src/lib/components/sessions/previewRouter.test.ts
@@ -14,8 +14,27 @@ import {
 	previewLocationContext,
 	previewLocationLabel,
 	resolvePreviewTab,
-	runFormUrl
+	runFormUrl,
+	workspacePageHref
 } from './previewRouter'
+import { pageItemUrl } from './previewPaths'
+
+describe('workspacePageHref', () => {
+	it('sends a page item tab to its list page with the row open, never to its scheme', () => {
+		expect(workspacePageHref(pageItemUrl({ kind: 'resource', path: 'u/me/db' }))).toBe(
+			'/resources#/resource/u/me/db'
+		)
+		expect(
+			workspacePageHref(pageItemUrl({ kind: 'trigger', triggerKind: 'kafka', path: 'f/a/b' }))
+		).toBe('/kafka_triggers#f/a/b')
+	})
+
+	it('has no page for a tab that belongs to the chat', () => {
+		expect(workspacePageHref(artifactUrl('a1', 'Plan'))).toBeUndefined()
+		expect(workspacePageHref(runFormUrl('call_1', 'Run'))).toBeUndefined()
+		expect(workspacePageHref('/runs?path=u/me/x')).toBe('/runs?path=u/me/x')
+	})
+})
 
 describe('drawerAnchorFor', () => {
 	it('reads the anchored row on the pages that deep-link one', () => {
@@ -281,6 +300,17 @@ describe('resolvePreviewTab', () => {
 		expect(resolvePreviewTab('/runs')).toEqual({ kind: 'iframe' })
 	})
 
+	it('mounts the list page of a page item kind in process, whatever its filters', () => {
+		expect(resolvePreviewTab('/variables?path_start=f%2Fa%2F')).toEqual({
+			kind: 'pagelist',
+			path: '/variables'
+		})
+		expect(resolvePreviewTab('/kafka_triggers')).toEqual({
+			kind: 'pagelist',
+			path: '/kafka_triggers'
+		})
+	})
+
 	it('routes any script item to a live editor', () => {
 		expect(resolvePreviewTab('/scripts/edit/f/foo/bar')).toEqual({
 			kind: 'editor',
diff --git a/frontend/src/lib/components/sessions/previewRouter.ts b/frontend/src/lib/components/sessions/previewRouter.ts
index c2abd52cf9..d1de9ff633 100644
--- a/frontend/src/lib/components/sessions/previewRouter.ts
+++ b/frontend/src/lib/components/sessions/previewRouter.ts
@@ -3,8 +3,14 @@ import {
 	AUDIT_LOGS_PATH,
 	FOLDERS_PATH,
 	GROUPS_PATH,
+	isPageItemListPath,
+	pageItemForListPath,
+	pageItemListPath,
+	pageItemPageHref,
+	pageItemUrl,
 	pageKey,
 	pageHref,
+	parsePageItemRoute,
 	parsePreviewItemRoute,
 	RESOURCES_PATH,
 	RUNS_PATH,
@@ -14,6 +20,7 @@ import {
 	WORKSPACE_SETTINGS_PATH,
 	triggerLabelForPath,
 	TRIGGER_PAGES,
+	type PageItemRef,
 	type PreviewItemMode,
 	type PreviewItemRoute,
 	type TriggerKind
@@ -21,11 +28,15 @@ import {
 // Re-exported so the preview code that already reads locations through this module keeps
 // one import, while a caller needing only a path can reach for the leaf instead.
 export {
+	pageItemListPath,
+	pageItemUrl,
 	pageKey,
 	pageHref,
+	parsePageItemRoute,
 	parsePreviewItemRoute,
 	stripBase,
 	TRIGGER_PAGES,
+	type PageItemRef,
 	type PreviewItemMode,
 	type PreviewItemRoute,
 	type TriggerKind
@@ -74,6 +85,7 @@ export type PreviewTarget =
 	| { type: 'item'; item: WorkspaceItem; mode?: PreviewItemMode; version?: string }
 	| { type: 'artifact'; id: string; name: string; version?: ArtifactVersionTarget }
 	| { type: 'runform'; toolCallId: string; label: string }
+	| { type: 'pageitem'; ref: PageItemRef }
 
 export type PreviewPage = { label: string; path: string; icon: DrillIcon }
 
@@ -123,6 +135,26 @@ export function drawerAnchorFor(location: string): string | undefined {
 	return location.slice(hashAt + 1).replace(/^\/resource\//, '') || undefined
 }
 
+/** The item a list-page location deep-links, as a tab of its own: a session edits these
+ * in process, so the list page's drawer is never where one belongs. */
+export function pageItemForLocation(location: string): PageItemRef | undefined {
+	const anchor = drawerAnchorFor(location)
+	if (!anchor) return undefined
+	let path: string
+	try {
+		path = decodeURIComponent(anchor)
+	} catch {
+		return undefined
+	}
+	return pageItemForListPath(location, path)
+}
+
+/** A location with a deep-linked row replaced by that row's own tab; any other unchanged. */
+export function pageItemLocation(location: string): string {
+	const ref = pageItemForLocation(location)
+	return ref ? pageItemUrl(ref) : location
+}
+
 // Query params the preview host injects into an iframe URL (`nomenubar` hides the nav,
 // `workspace` scopes the page). Never part of what a location means.
 const INJECTED_PARAMS = ['nomenubar', 'workspace'] as const
@@ -132,7 +164,7 @@ const INJECTED_PARAMS = ['nomenubar', 'workspace'] as const
 export function canonicalizeObservedLoc(loc: string): string {
 	// An artifact or a run form is a scheme, not a path — `new URL` would happily parse it
 	// and hand back a pathname with the scheme gone.
-	if (parseArtifactRoute(loc) || parseRunFormRoute(loc)) return loc
+	if (parseArtifactRoute(loc) || parseRunFormRoute(loc) || parsePageItemRoute(loc)) return loc
 	try {
 		const u = new URL(loc, 'http://_')
 		for (const p of INJECTED_PARAMS) u.searchParams.delete(p)
@@ -207,6 +239,8 @@ export function describeLocation(loc: string): PreviewLocation {
 	// Identity is the call, never the label: that carries the script's summary, so folding it
 	// in would open a second tab for the same form whenever the summary differed.
 	if (runForm) return { identity: `runform:${runForm.toolCallId}`, view: '', anchor: '' }
+	const pageItem = parsePageItemRoute(loc)
+	if (pageItem) return { identity: pageItemUrl(pageItem), view: '', anchor: '' }
 	const canonical = canonicalizeObservedLoc(loc)
 	const path = stripBase(canonical)
 	const bare = canonical.split('#')[0]
@@ -328,6 +362,15 @@ export function previewLocationContext(loc: string): {
 	location: string
 	open?: string
 } {
+	// Told as its list page with the item open, the shape the model already reads for a row
+	// whose drawer is open — which is all a page item tab is to it.
+	const pageItem = parsePageItemRoute(loc)
+	if (pageItem) {
+		return {
+			...previewLocationContext(pageItemListPath(pageItem)),
+			open: promptSafe(pageItem.path)
+		}
+	}
 	const { identity, anchor } = describeLocation(loc)
 	const bare = canonicalizeObservedLoc(loc).split('#')[0]
 	const query = bare.includes('?') ? bare.slice(bare.indexOf('?') + 1) : ''
@@ -376,6 +419,8 @@ export function previewLocationLabel(url: string): string {
 	if (artifact) return artifact.name || 'Artifact'
 	const runForm = parseRunFormRoute(url)
 	if (runForm) return runForm.label || 'Run form'
+	const pageItem = parsePageItemRoute(url)
+	if (pageItem) return pageItem.path.split('/').pop() || pageItem.path
 	const page = matchReusablePage(url)
 	if (page) return page.label
 	const trigger = triggerLabelForPath(url)
@@ -492,13 +537,16 @@ export const isArtifactKey = (key: string) => key.startsWith('artifact:')
 // item's view page, or an iframe fallback. An item of a wrappable kind (script,
 // flow, raw app) mounts its per-(kind,path) cell editor on `/edit/` and its viewer
 // on `/get/`; a `/pipeline/<folder>` route mounts the data-pipeline graph editor
-// (single, shared runtime.pipelineEditorState — `path` is the folder); everything
+// (single, shared runtime.pipelineEditorState — `path` is the folder); the list page
+// of a page item kind mounts that list; everything
 // else (static pages, regular drag-and-drop apps, any other route) stays an iframe.
 export type PreviewSlot =
 	| { kind: 'editor'; editorKind: SessionTargetKind | 'pipeline'; path: string }
 	| { kind: 'viewer'; viewerKind: SessionTargetKind; path: string }
 	| { kind: 'artifact'; id: string; version?: number }
 	| { kind: 'runform'; toolCallId: string }
+	| { kind: 'pageitem'; ref: PageItemRef }
+	| { kind: 'pagelist'; path: string }
 	| { kind: 'iframe' }
 
 /** The item kind a preview slot hosts, for the slots that host one — so callers can
@@ -514,21 +562,48 @@ export function resolvePreviewTab(url: string): PreviewSlot {
 	if (artifact) return { kind: 'artifact', id: artifact.id, version: artifact.version }
 	const runForm = parseRunFormRoute(url)
 	if (runForm) return { kind: 'runform', toolCallId: runForm.toolCallId }
+	const pageItem = parsePageItemRoute(url)
+	if (pageItem) return { kind: 'pageitem', ref: pageItem }
+	const route = stripBase(url)
+	if (isPageItemListPath(route)) return { kind: 'pagelist', path: route }
 	const pipelineFolder = parsePipelineRoute(url)
 	if (pipelineFolder) {
 		return { kind: 'editor', editorKind: 'pipeline', path: pipelineFolder }
 	}
-	const route = parsePreviewItemRoute(url)
-	if (!route) return { kind: 'iframe' }
+	const item = parsePreviewItemRoute(url)
+	if (!item) return { kind: 'iframe' }
 	const itemKind: SessionTargetKind | undefined =
-		route.kind === 'script'
+		item.kind === 'script'
 			? 'script'
-			: route.kind === 'flow'
+			: item.kind === 'flow'
 				? 'flow'
-				: route.kind === 'app' && route.raw_app
+				: item.kind === 'app' && item.raw_app
 					? 'raw_app'
 					: undefined
 	if (!itemKind) return { kind: 'iframe' }
-	if (route.mode === 'view') return { kind: 'viewer', viewerKind: itemKind, path: route.itemPath }
-	return { kind: 'editor', editorKind: itemKind, path: route.itemPath }
+	if (item.mode === 'view') return { kind: 'viewer', viewerKind: itemKind, path: item.itemPath }
+	return { kind: 'editor', editorKind: itemKind, path: item.itemPath }
+}
+
+/** The full workspace page showing what a tab shows ("Open in workspace"), or undefined when
+ * there is none. Every tab kind answers here, so a new one cannot fall through to its url being
+ * navigated as a path — an artifact or page item url is a scheme, not a route. */
+export function workspacePageHref(location: string): string | undefined {
+	const slot = resolvePreviewTab(location)
+	switch (slot.kind) {
+		case 'artifact':
+		case 'runform':
+			return undefined
+		case 'pageitem':
+			return pageItemPageHref(slot.ref)
+		case 'editor':
+		case 'viewer':
+		case 'pagelist':
+		case 'iframe':
+			return location
+		default: {
+			const unhandled: never = slot
+			return unhandled
+		}
+	}
 }
diff --git a/frontend/src/lib/components/sessions/sessionMirror.svelte.ts b/frontend/src/lib/components/sessions/sessionMirror.svelte.ts
index bfa1621822..f30d66ca45 100644
--- a/frontend/src/lib/components/sessions/sessionMirror.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionMirror.svelte.ts
@@ -1169,7 +1169,6 @@ function unpackBackup(
 	const active = chats.find((c) => c.id === head.chatId)
 	const session: Session = {
 		...(head as unknown as Session),
-		name: '',
 		// Everything in the backup has been read here: no unread badge, and the last
 		// activity is the backup's own time.
 		lastSeenCount: active?.displayMessages.length ?? 0,
diff --git a/frontend/src/lib/components/sessions/sessionMirror.test.ts b/frontend/src/lib/components/sessions/sessionMirror.test.ts
index 7676662d31..55a1acc138 100644
--- a/frontend/src/lib/components/sessions/sessionMirror.test.ts
+++ b/frontend/src/lib/components/sessions/sessionMirror.test.ts
@@ -1077,7 +1077,7 @@ describe('sessionMirror restore', () => {
 		expect(pullMock).toHaveBeenCalledTimes(2)
 		await vi.waitFor(() => expect(sessionState.sessions.map((s) => s.id)).toEqual(['s9']))
 		const restored = sessionState.sessions[0]
-		expect(restored.name).toBe('session-1')
+		expect(restored.name).toBeUndefined()
 		expect(restored.summary).toBe('remote')
 		expect(restored.lastSeenCount).toBe(1)
 		expect((await readStoredChat('c9', EMAIL))?.displayMessages).toHaveLength(1)
diff --git a/frontend/src/lib/components/sessions/sessionMirrorPlan.ts b/frontend/src/lib/components/sessions/sessionMirrorPlan.ts
index caea48c792..5d40c35e3b 100644
--- a/frontend/src/lib/components/sessions/sessionMirrorPlan.ts
+++ b/frontend/src/lib/components/sessions/sessionMirrorPlan.ts
@@ -78,7 +78,7 @@ export function isFallbackStorage(name: string): boolean {
 
 /**
  * The part of a session record the backup keeps. Left out on purpose: `name` (a
- * per-browser counter), the unsent-draft fields (`pending_*`, `draftPrompt`,
+ * per-browser legacy label), the unsent-draft fields (`pending_*`, `draftPrompt`,
  * `autoSendDraftAt`), `workspace_root_id` (derived on import), `transient`, `restoredAt`
  * (this browser's clock), and the two fields reading a session bumps (`lastSeenCount`,
  * `lastActivityAt`) — so opening a session and reading its new messages never costs a push.
diff --git a/frontend/src/lib/components/sessions/sessionMode.svelte.ts b/frontend/src/lib/components/sessions/sessionMode.svelte.ts
index a4972a9afb..a2c20e08a8 100644
--- a/frontend/src/lib/components/sessions/sessionMode.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionMode.svelte.ts
@@ -47,6 +47,17 @@ export function withMenuHidden(url: string, workspaceId?: string): string {
 	}
 }
 
+// True when this window is a sessions-preview iframe: embedded, with the `nomenubar` flag
+// the preview always sets and the logged layout stickies into sessionStorage.
+export function isSessionPreviewFrame(): boolean {
+	if (typeof window === 'undefined' || window.self === window.top) return false
+	try {
+		return sessionStorage.getItem('nomenubar_embedded') === 'true'
+	} catch {
+		return false
+	}
+}
+
 // Append `?workspace=` to a canonical route so a full-page navigation (e.g.
 // "Open in workspace") lands on the session's effective workspace instead of
 // the navigation workspace. Unlike withMenuHidden, the menu is kept visible —
diff --git a/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts b/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts
index beafda0ace..d1dc5bc189 100644
--- a/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts
@@ -8,7 +8,10 @@ import {
 	describeLocation,
 	matchPreviewPage,
 	showsView,
+	pageItemLocation,
+	pageItemUrl,
 	parseArtifactRoute,
+	parsePageItemRoute,
 	parsePipelineRoute,
 	previewLocationContext,
 	promptSafe,
@@ -24,6 +27,12 @@ import {
 import type { SessionPreviewTab, SessionTarget } from './sessionState.svelte'
 import type { Kind } from '$lib/utils_deployable'
 import { pipelineFolderFromBundlePath } from '$lib/pipelinePaths'
+import {
+	pageItemKindLabel,
+	TRIGGER_PAGES,
+	type PageItemRef,
+	type TriggerKind
+} from './previewPaths'
 
 // The single live owner of a session's preview tabs. Runs behind a small
 // interface both the sessions page (renderer) and the `open_preview` tool cross,
@@ -79,7 +88,10 @@ function keptVersion(
 // scheme. `onto` is the tab about to be written, passed wherever one is being re-pointed so
 // that every such path keeps its pin.
 function targetUrl(target: PreviewTarget, onto?: SessionPreviewTab): string {
-	if (target.type === 'page') return target.href
+	// A list page asked for with a row anchored is that row's own tab: its drawer would only
+	// open the editor a page item tab already hosts, inside a frame of its own.
+	if (target.type === 'page') return pageItemLocation(target.href)
+	if (target.type === 'pageitem') return pageItemUrl(target.ref)
 	if (target.type === 'artifact') {
 		return artifactUrl(target.id, target.name, keptVersion(target, onto))
 	}
@@ -160,10 +172,9 @@ export function previewTargetForSessionTarget(
 
 // Adapt a deployable item's layout kind (the session review dock speaks `Kind`,
 // not SessionTarget) to a preview destination: the three live editors, data
-// pipelines, plus legacy drag-and-drop apps, which the panel hosts as an iframe
-// over their edit route. Every other kind maps to undefined — not for lack of any
-// route (a variable or trigger has a list page the panel can host) but because
-// there is no item editor to preview, so their row falls back to the diff. The
+// pipelines, page items (variables, resources, schedules, triggers), plus legacy
+// drag-and-drop apps, which the panel hosts as an iframe over their edit route.
+// Every other kind maps to undefined, and its row falls back to the diff. The
 // undefined is also the caller's test for "can this row be previewed?".
 export function previewTargetForDeployKind(kind: Kind, path: string): PreviewTarget | undefined {
 	if (kind === 'app') {
@@ -172,6 +183,16 @@ export function previewTargetForDeployKind(kind: Kind, path: string): PreviewTar
 	if (kind === 'script' || kind === 'flow' || kind === 'raw_app') {
 		return previewTargetForSessionTarget(kind, path)
 	}
+	if (kind === 'variable' || kind === 'resource' || kind === 'schedule') {
+		return { type: 'pageitem', ref: { kind, path } }
+	}
+	const triggerKind = kind.endsWith('_trigger') ? kind.slice(0, -'_trigger'.length) : undefined
+	if (triggerKind && triggerKind in TRIGGER_PAGES) {
+		return {
+			type: 'pageitem',
+			ref: { kind: 'trigger', triggerKind: triggerKind as TriggerKind, path }
+		}
+	}
 	// A pipeline's editor is its folder's graph view, not its bundle path.
 	if (kind === 'data_pipeline') {
 		const folder = pipelineFolderFromBundlePath(path)
@@ -197,7 +218,14 @@ export function hydratePreviewTabs(session: {
 		seen.add(t.id)
 		// Rebuilt field-by-field so stray properties on old saved records (e.g. the
 		// retired `pinned` flag) don't survive hydration and get persisted back.
-		tabs.push({ id: t.id, url: t.url, loc: t.loc || t.url })
+		// A list page saved with a row's drawer open comes back as that row's own tab. Read from
+		// where the frame was, not from what was last commanded: the user may have moved to
+		// another row since, or closed the drawer, and the observation is what they saw.
+		const loc = t.loc || t.url
+		const item = pageItemLocation(t.loc ? loc : t.url)
+		tabs.push(
+			parsePageItemRoute(item) ? { id: t.id, url: item, loc: item } : { id: t.id, url: t.url, loc }
+		)
 	}
 	if (tabs.length > 0) {
 		const wantActive = session.activePreviewTabId
@@ -298,22 +326,14 @@ export class SessionPreviewTabs {
 		// Drift is a change of what the frame *shows*, not of its URL string: a page
 		// writing its own filter defaults back is not the user navigating away.
 		const drifted = !showsView(tab.loc, url)
-		// Both cases the browser will not act on, decided here because this is where the
-		// old and new commands are both in hand: re-commanding the URL a drifted frame
-		// already carries moves nothing, and moving to another fragment resolves within the
-		// same document — so a list page never re-runs the `#<path>` read that opens a row.
-		// Dropping the fragment is not one of them: the same-document path applies only to a
-		// target that has one, so the browser loads the page — closing the drawer by itself —
-		// and forcing a second load races that one back onto the row.
-		const fragmentOnly =
-			!commandUnchanged && url.includes('#') && tab.url.split('#')[0] === url.split('#')[0]
+		// Decided here because this is where the old and new commands are both in hand:
+		// re-commanding the URL a drifted frame already carries moves nothing.
 		retargetTab(tab, url)
-		if ((commandUnchanged && drifted) || fragmentOnly) this.pulseReload(tab.id)
+		if (commandUnchanged && drifted) this.pulseReload(tab.id)
 	}
 
-	// Force the host to reload the iframe. A navigation onto the tab's exact current URL
-	// changes nothing, so URL-driven behavior — a `#<path>` opening a drawer the user has
-	// since closed — would never re-fire.
+	// Force the host to reload the tab. A navigation onto the tab's exact current URL
+	// changes nothing, so URL-driven behavior would never re-fire.
 	pulseReload(id: string): void {
 		this.#reloadPulse = { id, nonce: this.#reloadPulse.nonce + 1 }
 	}
@@ -443,21 +463,21 @@ export class SessionPreviewTabs {
 		// shows this. The tab on this exact view wins over any other on the page —
 		// `new_tab` puts two views side by side, and retargeting whichever sits first
 		// would overwrite the other and leave both on the same row.
-		const shown = opts?.forceNewTab
-			? undefined
-			: (this.#tabs.find((t) => showsView(t.loc, url)) ??
-				this.#tabs.find((t) => describeLocation(t.loc).identity === describeLocation(url).identity))
+		// A page item stays one tab whatever the opener asks: two would hold two drafts of it.
+		const shown =
+			opts?.forceNewTab && !parsePageItemRoute(url)
+				? undefined
+				: (this.#tabs.find((t) => showsView(t.loc, url)) ??
+					this.#tabs.find(
+						(t) => describeLocation(t.loc).identity === describeLocation(url).identity
+					))
 		if (shown) {
 			const same = showsView(shown.loc, url)
 			if (same) {
 				// The frame is already here, but record what was asked for: `url` is what the
 				// tab persists and remounts from, so leaving it on where the frame started
-				// sends a refresh back to the row the user has since moved off.
+				// sends a refresh back to the view the user has since moved off.
 				recordCommand(shown, url)
-				// Nothing to navigate to, so nothing would re-run: the list pages read their
-				// `#<path>` once per document, and the drawer it opens may since have been
-				// closed. Only a forced load can bring it back.
-				if (describeLocation(url).anchor) this.pulseReload(shown.id)
 			} else {
 				this.#retarget(shown, url)
 			}
@@ -520,7 +540,17 @@ export class SessionPreviewTabs {
 				return
 			}
 		}
-		this.#retarget(t, targetUrl(target, t))
+		// One tab per page item, as for editors: two would hold two drafts of one item.
+		const url = targetUrl(target, t)
+		if (parsePageItemRoute(url)) {
+			const existing = this.#tabs.find((x) => x.url === url)
+			if (existing && existing.id !== t.id) {
+				this.#activeId = existing.id
+				this.#flush()
+				return
+			}
+		}
+		this.#retarget(t, url)
 		this.#flush()
 	}
 
@@ -582,6 +612,17 @@ export class SessionPreviewTabs {
 		this.#flush()
 	}
 
+	/** Follow a page item its editor saved under a new path, in place. */
+	retargetPageItem(from: PageItemRef, to: PageItemRef): void {
+		const fromUrl = pageItemUrl(from)
+		const toUrl = pageItemUrl(to)
+		if (fromUrl === toUrl) return
+		const tab = this.#tabs.find((t) => t.url === fromUrl)
+		if (!tab) return
+		retargetTab(tab, toUrl)
+		this.#flush()
+	}
+
 	closeArtifact(artifactId: string): void {
 		const tab = this.#tabs.find((t) => parseArtifactRoute(t.url)?.id === artifactId)
 		if (tab) this.close(tab.id)
@@ -614,23 +655,14 @@ export class SessionPreviewTabs {
 	}
 
 	// Feed back the location an iframe reported on load (only the page can read
-	// contentWindow.location). Updates the observed `loc`; `url` follows only when a
-	// drawer closed (below), and the host navigates on a command it isn't already at,
-	// so that write does not move the frame.
+	// contentWindow.location). Updates the observed `loc` only: the host navigates on a
+	// command it isn't already at, and an in-frame move is the user browsing.
 	observeLocation(id: string, loc: string): void {
 		const t = this.#tabs.find((x) => x.id === id)
 		if (!t) return
 		const canonical = canonicalizeObservedLoc(loc)
 		if (t.loc === canonical) return
 		t.loc = canonical
-		// Closing a drawer drops the row from the frame's URL. The command has to follow, or
-		// the tab reopens it on the next mount — the iframe loads `url`, not `loc`. Only the
-		// anchor: any other in-frame move is the user browsing, which must not re-command.
-		const commanded = describeLocation(t.url)
-		const observed = describeLocation(canonical)
-		if (commanded.anchor && !observed.anchor && commanded.identity === observed.identity) {
-			t.url = t.url.split('#')[0]
-		}
 		this.#flush()
 	}
 
@@ -738,6 +770,7 @@ export function describePreview(
 	const lines = tabs.map((t) => {
 		const where = whereIs(t)
 		const artifact = parseArtifactRoute(where)
+		const pageItem = parsePageItemRoute(where)
 		const page = matchPreviewPage(where)
 		const pipelineFolder = parsePipelineRoute(where)
 		const route = parsePreviewItemRoute(where)
@@ -745,18 +778,24 @@ export function describePreview(
 			? // A pinned tab is not showing what the assistant last wrote, and nothing else in this
 				// summary would tell it so.
 				`artifact "${artifact.name || 'Artifact'}"${artifact.version ? ` (pinned to v${artifact.version})` : ''}`
-			: page
-				? `page "${page.label}"${previewLocationDetail(where)}`
-				: pipelineFolder
-					? `pipeline "${pipelineFolder}"`
-					: route
-						? `${route.raw_app ? 'raw_app' : route.kind} "${route.itemPath}"`
-						: // Trigger list pages land here (they're outside PREVIEW_PAGES), and
-							// their `#<path>` is the trigger the drawer has open.
-							`${stripBase(where)}${previewLocationDetail(where)}`
+			: pageItem
+				? `${pageItemKindLabel(pageItem).toLowerCase()} "${pageItem.path}"`
+				: page
+					? `page "${page.label}"${previewLocationDetail(where)}`
+					: pipelineFolder
+						? `pipeline "${pipelineFolder}"`
+						: route
+							? `${route.raw_app ? 'raw_app' : route.kind} "${route.itemPath}"`
+							: // Trigger list pages land here (they're outside PREVIEW_PAGES), and
+								// their `#<path>` is the trigger the drawer has open.
+								`${stripBase(where)}${previewLocationDetail(where)}`
 		const slotKind = resolvePreviewTab(t.url).kind
 		const live =
-			slotKind === 'editor' ? ', live editor' : slotKind === 'viewer' ? ', deployed view' : ''
+			slotKind === 'editor' || slotKind === 'pageitem'
+				? ', live editor'
+				: slotKind === 'viewer'
+					? ', deployed view'
+					: ''
 		const active = t.id === activeId ? ', active' : ''
 		// One list entry per tab: an artifact's name, a pipeline folder and an item path
 		// all arrive decoded from a URL, so any of them could otherwise write a line here.
diff --git a/frontend/src/lib/components/sessions/sessionPreviewTabs.test.ts b/frontend/src/lib/components/sessions/sessionPreviewTabs.test.ts
index b71de62c23..8b1ba27ea0 100644
--- a/frontend/src/lib/components/sessions/sessionPreviewTabs.test.ts
+++ b/frontend/src/lib/components/sessions/sessionPreviewTabs.test.ts
@@ -177,10 +177,88 @@ describe('previewTargetForDeployKind', () => {
 			pipelineTarget
 		)
 	})
+	it('routes variables, resources, schedules and triggers to their own tab', () => {
+		expect(previewTargetForDeployKind('schedule', 'u/me/s')).toEqual({
+			type: 'pageitem',
+			ref: { kind: 'schedule', path: 'u/me/s' }
+		})
+		expect(previewTargetForDeployKind('http_trigger', 'u/me/t')).toEqual({
+			type: 'pageitem',
+			ref: { kind: 'trigger', triggerKind: 'http', path: 'u/me/t' }
+		})
+		expect(previewTargetForDeployKind('variable', 'u/me/v')).toEqual({
+			type: 'pageitem',
+			ref: { kind: 'variable', path: 'u/me/v' }
+		})
+	})
+
 	it('has no destination for kinds the preview panel cannot host', () => {
-		expect(previewTargetForDeployKind('schedule', 'u/me/s')).toBeUndefined()
-		expect(previewTargetForDeployKind('http_trigger', 'u/me/t')).toBeUndefined()
-		expect(previewTargetForDeployKind('variable', 'u/me/v')).toBeUndefined()
+		expect(previewTargetForDeployKind('folder', 'f/x')).toBeUndefined()
+		expect(previewTargetForDeployKind('resource_type', 'x')).toBeUndefined()
+	})
+})
+
+describe('page item tabs', () => {
+	const variable: PreviewTarget = {
+		type: 'pageitem',
+		ref: { kind: 'variable', path: 'u/me/token' }
+	}
+
+	it('opens a list page anchored at a row as that row’s own tab, beside the list', () => {
+		const o = owner()
+		o.open({ type: 'page', href: '/routes', label: 'HTTP routes' })
+		o.open({ type: 'page', href: '/routes#u/me/a', label: 'HTTP routes' })
+		expect(o.tabs.map((t) => t.url)).toEqual(['/routes', 'pageitem:trigger.http/u%2Fme%2Fa'])
+
+		// Resources address their row through an extra segment.
+		o.open({ type: 'page', href: '/resources?owner=u#/resource/u/me/db', label: 'Resources' })
+		expect(o.tabs.at(-1)!.url).toBe('pageitem:resource/u%2Fme%2Fdb')
+	})
+
+	it('keeps one tab per item, whatever the opener asks', () => {
+		const o = owner()
+		o.open(variable)
+		o.open({ type: 'page', href: '/runs', label: 'Runs' })
+		expect(o.open({ type: 'page', href: '/variables#u/me/token', label: 'V' }).status).toBe(
+			'focused'
+		)
+		expect(o.open(variable, { forceNewTab: true }).status).toBe('focused')
+		o.navigate(variable)
+		expect(o.tabs).toHaveLength(2)
+		expect(o.activeId).toBe(o.tabs[0].id)
+	})
+
+	it('follows an item saved under a new path in place', () => {
+		const o = owner()
+		o.open(variable)
+		const id = o.tabs[0].id
+		o.retargetPageItem(
+			{ kind: 'variable', path: 'u/me/token' },
+			{ kind: 'variable', path: 'f/x/token' }
+		)
+		expect(o.tabs).toEqual([
+			{ id, url: 'pageitem:variable/f%2Fx%2Ftoken', loc: 'pageitem:variable/f%2Fx%2Ftoken' }
+		])
+	})
+
+	it('restores a tab saved on a row’s drawer as the row it was last on', () => {
+		const snap = hydratePreviewTabs({
+			previewTabs: [
+				{ id: 'a', url: '/schedules#u/me/daily', loc: '/schedules?path=u#u/me/daily' },
+				// A drawer opened inside the frame: the command is still the bare list.
+				{ id: 'b', url: '/variables', loc: '/variables#u/me/token' },
+				// The user moved on to another row inside the frame…
+				{ id: 'c', url: '/variables#u/me/token', loc: '/variables#u/me/other' },
+				// …or closed the drawer, leaving no row to restore.
+				{ id: 'd', url: '/variables#u/me/token', loc: '/variables' }
+			]
+		})
+		expect(snap.tabs).toEqual([
+			{ id: 'a', url: 'pageitem:schedule/u%2Fme%2Fdaily', loc: 'pageitem:schedule/u%2Fme%2Fdaily' },
+			{ id: 'b', url: 'pageitem:variable/u%2Fme%2Ftoken', loc: 'pageitem:variable/u%2Fme%2Ftoken' },
+			{ id: 'c', url: 'pageitem:variable/u%2Fme%2Fother', loc: 'pageitem:variable/u%2Fme%2Fother' },
+			{ id: 'd', url: '/variables#u/me/token', loc: '/variables' }
+		])
 	})
 })
 
@@ -232,93 +310,34 @@ describe('SessionPreviewTabs.open', () => {
 		expect(o.activeId).toBe(firstId)
 	})
 
-	// A trigger list page is not a `matchReusablePage`, so the runtime's
-	// navigate-in-place path doesn't cover it: re-pointing the tab has to happen
-	// here or the panel keeps showing the previously opened row.
-	it('re-points a page tab whose hash target changed instead of only focusing it', () => {
-		const o = owner()
-		const routes = (href: string) => ({ type: 'page' as const, href, label: 'HTTP routes' })
-		o.open(routes('/routes#u/me/a'))
-		const firstId = o.activeId
-
-		// 'retargeted', not 'opened': the tab count is unchanged, and the caller
-		// reports that to the model.
-		const res = o.open(routes('/routes#u/me/b'))
-		expect(res.status).toBe('retargeted')
-		expect(o.tabs).toHaveLength(1)
-		expect(o.activeId).toBe(firstId)
-		expect(o.tabs[0].url).toBe('/routes#u/me/b')
-
-		// Back to the bare list: still the same tab, no longer anchored at a row.
-		expect(o.open(routes('/routes')).status).toBe('retargeted')
-		expect(o.tabs).toHaveLength(1)
-		expect(o.tabs[0].url).toBe('/routes')
-
-		// ...and asking for the view it already shows is a plain focus.
-		expect(o.open(routes('/routes')).status).toBe('focused')
-	})
-
 	// The list pages rewrite their own filter defaults into the URL after mount,
 	// and `loc` follows that rewrite. Matching on anything but the path made a tab
 	// stop recognizing itself, so every later open spawned a duplicate.
 	it('still recognizes a tab after the page rewrote its own filter params', () => {
 		const o = owner()
 		const routes = (href: string) => ({ type: 'page' as const, href, label: 'HTTP routes' })
-		o.open(routes('/routes#u/me/a'))
-		const id = o.tabs[0].id
-		o.observeLocation(id, '/routes?filter_path_of=trigger#u/me/a')
+		o.open(routes('/routes'))
+		o.observeLocation(o.tabs[0].id, '/routes?filter_path_of=trigger')
 
-		const res = o.open(routes('/routes#u/me/b'))
-		expect(res.status).toBe('retargeted')
+		expect(o.open(routes('/routes')).status).toBe('focused')
 		expect(o.tabs).toHaveLength(1)
-		expect(o.tabs[0].url).toBe('/routes#u/me/b')
 	})
 
 	// `new_tab` deliberately keeps two views of one page side by side. Reopening one of
 	// them must focus the tab already showing it, not retarget whichever tab happens to
-	// sit first in the strip — that would overwrite the other view and leave two tabs
-	// on the same row.
+	// sit first in the strip — that would overwrite the other view.
 	it('focuses the tab already showing the exact location before retargeting by path', () => {
 		const o = owner()
-		const routes = (href: string) => ({ type: 'page' as const, href, label: 'HTTP routes' })
-		o.open(routes('/routes#u/me/a'))
+		const runs = (href: string) => ({ type: 'page' as const, href, label: 'Runs' })
+		o.open(runs('/runs?path=u/me/a'))
 		const first = o.tabs[0].id
-		o.open(routes('/routes#u/me/b'), { forceNewTab: true })
+		o.open(runs('/runs?path=u/me/b'), { forceNewTab: true })
 		const second = o.tabs[1].id
 
-		expect(o.open(routes('/routes#u/me/b')).status).toBe('focused')
+		expect(o.open(runs('/runs?path=u/me/b')).status).toBe('focused')
 		expect(o.activeId).toBe(second)
 		expect(o.tabs).toHaveLength(2)
-		expect(o.tabs.find((t) => t.id === first)?.url).toBe('/routes#u/me/a')
-	})
-
-	// The list pages read their `#<path>` once per document, so a drawer the user closed
-	// inside the frame only comes back on a forced load — and re-commanding the location
-	// the tab already shows produces no navigation the host could act on.
-	it('forces a load when the requested row is the one the tab already shows', () => {
-		const o = owner()
-		const routes = (href: string) => ({ type: 'page' as const, href, label: 'HTTP routes' })
-		o.open(routes('/routes#u/me/a'))
-		const id = o.tabs[0].id
-		o.observeLocation(id, '/routes?filter_path_of=trigger#u/me/a')
-		const before = o.reloadPulse.nonce
-
-		expect(o.open(routes('/routes#u/me/a')).status).toBe('focused')
-		expect(o.reloadPulse).toEqual({ id, nonce: before + 1 })
-	})
-
-	// Dropping the fragment is a load in itself, so the forced one lands on top of a
-	// navigation still in flight — and reloads the row the command asked to leave.
-	it('does not force a load when the requested location drops the row', () => {
-		const o = owner()
-		const routes = (href: string) => ({ type: 'page' as const, href, label: 'HTTP routes' })
-		o.open(routes('/routes#u/me/a'))
-		const id = o.tabs[0].id
-		const before = o.reloadPulse.nonce
-
-		o.navigate(routes('/routes'))
-		expect(o.tabs.find((t) => t.id === id)?.url).toBe('/routes')
-		expect(o.reloadPulse.nonce).toBe(before)
+		expect(o.tabs.find((t) => t.id === first)?.url).toBe('/runs?path=u/me/a')
 	})
 
 	// Runs restores the user's "hide schedules" preference into the URL whenever a load
@@ -365,29 +384,11 @@ describe('SessionPreviewTabs.open', () => {
 		expect(o.tabs[0].url).toBe('/apps/edit/u/me/dash')
 	})
 
-	// Re-commanding the URL a tab is already pointed at changes nothing the host can
-	// see, so the frame would stay wherever the user navigated it inside the page.
-	it('forces a reload when the request matches the command but the frame drifted', () => {
-		const o = owner()
-		const routes = (href: string) => ({ type: 'page' as const, href, label: 'HTTP routes' })
-		o.open(routes('/routes#u/me/a'))
-		const id = o.tabs[0].id
-		// The user clicked another trigger inside the iframe.
-		o.observeLocation(id, '/routes#u/me/b')
-		const before = o.reloadPulse.nonce
-
-		const res = o.open(routes('/routes#u/me/a'))
-		expect(res.status).toBe('retargeted')
-		expect(o.tabs).toHaveLength(1)
-		expect(o.tabs[0].loc).toBe('/routes#u/me/a')
-		expect(o.reloadPulse.nonce).toBe(before + 1)
-	})
-
 	it('forceNewTab opts a page out of the location dedupe', () => {
 		const o = owner()
 		const routes = (href: string) => ({ type: 'page' as const, href, label: 'HTTP routes' })
-		o.open(routes('/routes#u/me/a'))
-		const res = o.open(routes('/routes#u/me/b'), { forceNewTab: true })
+		o.open(routes('/routes'))
+		const res = o.open(routes('/routes'), { forceNewTab: true })
 		expect(res.status).toBe('opened')
 		expect(o.tabs).toHaveLength(2)
 	})
@@ -512,59 +513,6 @@ describe('SessionPreviewTabs.open', () => {
 	})
 })
 
-describe('SessionPreviewTabs.open — commanded url', () => {
-	it('records the requested row even when the frame is already showing it', () => {
-		const o = owner()
-		o.open({ type: 'page', href: '/routes#u/me/a', label: 'R' })
-		// The user moves to another row inside the frame.
-		o.observeLocation(o.tabs[0].id, '/routes#u/me/b')
-		o.open({ type: 'page', href: '/routes#u/me/b', label: 'R' })
-		// `url` is what a refresh and a remount reload from, so it has to follow.
-		expect(o.tabs[0].url).toBe('/routes#u/me/b')
-		expect(o.tabs).toHaveLength(1)
-	})
-})
-
-describe('SessionPreviewTabs.observeLocation', () => {
-	it('drops the row from the command when the frame closes its drawer', () => {
-		const o = owner()
-		o.open({ type: 'page', href: '/routes#u/me/a', label: 'R' })
-		// The page clears its own hash when the drawer closes.
-		o.observeLocation(o.tabs[0].id, '/routes?filter_path_of=trigger')
-		// The iframe mounts from `url`, so a remount would otherwise reopen the drawer.
-		expect(o.tabs[0].url).toBe('/routes')
-	})
-
-	it('leaves the command alone when the user just browses inside the frame', () => {
-		const o = owner()
-		o.open({ type: 'page', href: '/routes#u/me/a', label: 'R' })
-		o.observeLocation(o.tabs[0].id, '/routes#u/me/b')
-		expect(o.tabs[0].url).toBe('/routes#u/me/a')
-	})
-})
-
-describe('SessionPreviewTabs.open — forced loads', () => {
-	it('pulses when only the fragment changes, since the browser would not load', () => {
-		const o = owner()
-		o.open({ type: 'page', href: '/routes#u/me/a', label: 'R' })
-		const before = o.reloadPulse.nonce
-		o.open({ type: 'page', href: '/routes#u/me/b', label: 'R' })
-		// Same document: the browser resolves the new fragment without a load, so the
-		// list page never re-runs the `#<path>` read that opens the row.
-		expect(o.reloadPulse.nonce).toBeGreaterThan(before)
-		expect(o.tabs).toHaveLength(1)
-	})
-
-	it('does not pulse when the document itself changes', () => {
-		const o = owner()
-		o.open({ type: 'page', href: '/routes#u/me/a', label: 'R' })
-		const before = o.reloadPulse.nonce
-		o.open({ type: 'page', href: '/schedules#u/me/a', label: 'S' })
-		// Different page: src changes, the browser loads it, nothing to force.
-		expect(o.reloadPulse.nonce).toBe(before)
-	})
-})
-
 describe('SessionPreviewTabs.navigate', () => {
 	it('retargets the active tab to an editor item', () => {
 		const o = owner()
diff --git a/frontend/src/lib/components/sessions/sessionRecoveryNotice.svelte.ts b/frontend/src/lib/components/sessions/sessionRecoveryNotice.svelte.ts
index 635bd68601..443f972334 100644
--- a/frontend/src/lib/components/sessions/sessionRecoveryNotice.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionRecoveryNotice.svelte.ts
@@ -1,6 +1,6 @@
 import { SvelteSet } from 'svelte/reactivity'
 
-// Session ids opened as a stand-in for a `session_name` this browser doesn't
+// Session ids opened as a stand-in for a `session` URL this browser doesn't
 // hold. Kept in memory rather than on the Session record: persisted, the notice
 // would replay on every reload of a session the user has since made their own.
 const recovered = new SvelteSet<string>()
diff --git a/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts b/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
index d1e38b2cd3..0cf42b9233 100644
--- a/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
@@ -56,7 +56,10 @@ import {
 	selectPreviewTabsToClose,
 	whereIs
 } from './sessionPreviewTabs.svelte'
+import { pageItemKindLabel } from './previewPaths'
 import {
+	pageItemForLocation,
+	pageItemLocation,
 	parsePreviewItemRoute,
 	previewLocationContext,
 	previewLocationLabel,
@@ -97,7 +100,13 @@ import type {
 	RawAppDomResult
 } from '$lib/components/raw_apps/rawAppDom'
 import { getNonStreamingMetadataCompletion } from '$lib/components/copilot/lib'
-import { pendingUserAction, type DisplayMessage } from '$lib/components/copilot/chat/shared'
+import {
+	pendingUserAction,
+	type ChatJob,
+	type DisplayMessage
+} from '$lib/components/copilot/chat/shared'
+import { readStoredChat } from '$lib/components/copilot/chat/HistoryManager.svelte'
+import { getCurrentUserEmail } from '$lib/userScopedStorage'
 import type { ChatCompletionMessageParam } from 'openai/resources/index.mjs'
 
 // Per-kind load state for a session's editor target. Pure state container the
@@ -129,6 +138,9 @@ export interface RawAppRuntimeValue {
 	path: string
 	custom_path?: string
 	draft_path?: string
+	/** The app_version this cell's content forked from, carried so the editor's deploy
+	 *  guard and diff drawer compare the same pair the full-page editor does. */
+	parent_version?: number
 }
 // The deployed baseline a raw-app cell diffs against (topbar Diff drawer).
 export interface RawAppSavedValue {
@@ -144,6 +156,9 @@ export interface RawAppSavedValue {
 	/** No deployed counterpart (draft-only); disables the topbar Diff. */
 	no_deployed?: boolean
 	custom_path?: string
+	/** The deployed head at load time, which the editor's deploy guard falls back to when
+	 *  the draft carries no base of its own. */
+	deployed_version?: number
 }
 
 // One editor cell per (kind, path) the session loads: the load slot plus the
@@ -399,7 +414,8 @@ function createRuntime(session: Session): SessionRuntime {
 	// What the side panel is showing, stamped on each user message so the chat
 	// knows the page (and the row whose drawer is open) without spending a
 	// get_preview_status round-trip. Live editors are skipped: they register
-	// themselves as the ACTIVE EDITOR through UserDraft's live-draft registry.
+	// themselves as the ACTIVE EDITOR through UserDraft's live-draft registry. A page
+	// item tab is not one of them, and reads as its list page with the item open.
 	manager.activePreviewResolver = () => {
 		const owner = getRuntime(session.id)?.previewTabs
 		// What is on screen, not merely which tab is selected: the rule tells the model
@@ -407,7 +423,9 @@ function createRuntime(session: Session): SessionRuntime {
 		// point those at a page the user cannot see.
 		const tab = owner?.displayedTab
 		if (!tab) return undefined
-		if (resolvePreviewTab(tab.url).kind !== 'iframe') return undefined
+		const slotKind = resolvePreviewTab(tab.url).kind
+		if (slotKind !== 'iframe' && slotKind !== 'pageitem' && slotKind !== 'pagelist')
+			return undefined
 		return previewLocationContext(whereIs(tab))
 	}
 	// Pre-flight: materialise the (still-transient) session, then commit
@@ -609,8 +627,9 @@ function createRuntime(session: Session): SessionRuntime {
 				// when the path has never been deployed.
 				const aiDraft = UserDraft.get<Flow>('flow', path, { workspace })
 
-				// getDraft=true omits version_id (the plain getFlowByPath has it) —
-				// stamp it on so the flow doesn't always diff. Best-effort.
+				// Fallback for the head: the payload fetches below carry `version_id`, and
+				// this one covers a response that does not. Best-effort, and a request of
+				// its own, so the same response wins wherever both are available.
 				let deployedVersionId: number | undefined
 				try {
 					deployedVersionId = (await FlowService.getFlowByPath({ workspace, path }))?.version_id
@@ -624,12 +643,16 @@ function createRuntime(session: Session): SessionRuntime {
 					// yet on the backend — draft-only flows are a valid state.
 					try {
 						const result = await FlowService.getFlowByPath({ workspace, path, getDraft: true })
-						saved.val = result as SavedFlow
+						// The editor's deploy guard compares against the head, so keep this
+						// response's own and fall back to the one fetched above.
+						saved.val = {
+							...(result as SavedFlow),
+							version_id: (result as SavedFlow).version_id ?? deployedVersionId
+						}
 					} catch {
 						saved.val = undefined
 					}
 					await initFlow(aiDraft, store, stateStore, workspace)
-					if (deployedVersionId != null && store.val) store.val.version_id = deployedVersionId
 					slot.loadedPath = path
 					slot.loadedWorkspace = workspace
 					return
@@ -637,8 +660,12 @@ function createRuntime(session: Session): SessionRuntime {
 
 				// No local draft yet — seed from `result.draft ?? result`.
 				const result = await FlowService.getFlowByPath({ workspace, path, getDraft: true })
-				saved.val = result as SavedFlow
-				const flow: Flow = ((result as SavedFlow).draft ?? (result as Flow)) as Flow
+				saved.val = {
+					...(result as SavedFlow),
+					version_id: (result as SavedFlow).version_id ?? deployedVersionId
+				}
+				const serverDraft = (result as SavedFlow).draft as Flow | undefined
+				const flow: Flow = (serverDraft ?? (result as Flow)) as Flow
 				// Seed the per-tab last_sync from the server draft's timestamp so the
 				// seeding save below attaches a matching last_sync and the server can
 				// reject stale writes (see loadRawApp). Without this a server draft —
@@ -651,7 +678,13 @@ function createRuntime(session: Session): SessionRuntime {
 				)
 				UserDraft.save('flow', path, flow, { workspace })
 				await initFlow(flow, store, stateStore, workspace)
-				if (deployedVersionId != null && store.val) store.val.version_id = deployedVersionId
+				// A draft keeps the base it forked from, unknown included (it then falls
+				// back to the timestamps); only a fresh checkout takes the head, which is
+				// also what keeps it from always diffing. See loadScript. The head comes
+				// from the response that supplied the payload, so a deploy landing between
+				// the two requests cannot label this checkout as forked from the older one.
+				const head = (result as SavedFlow).version_id ?? deployedVersionId
+				if (head != null && store.val && !serverDraft) store.val.version_id = head
 				slot.loadedPath = path
 				slot.loadedWorkspace = workspace
 			} catch (err) {
@@ -694,11 +727,10 @@ function createRuntime(session: Session): SessionRuntime {
 					}
 					// Clone before layering the AI draft on top, else we'd mutate
 					// `saved.val` in place and lose the pristine diff baseline.
+					const savedDraft = saved.val?.draft as NewScript | undefined
 					const baseline: NewScript = saved.val
 						? (structuredClone(
-								$state.snapshot(
-									(saved.val.draft as NewScript | undefined) ?? (saved.val as NewScript)
-								)
+								$state.snapshot(savedDraft ?? (saved.val as NewScript))
 							) as NewScript)
 						: {
 								// Seed from the draft's own path (a rename lives in `draft_path`,
@@ -716,9 +748,8 @@ function createRuntime(session: Session): SessionRuntime {
 								schema: emptySchema(),
 								language: (aiDraft.language ?? 'bun') as any
 							}
-					if (saved.val?.hash) {
-						baseline.parent_hash = saved.val.hash
-					}
+					// Only a fresh checkout forks from the head; see the branch below.
+					if (!savedDraft && saved.val?.hash) baseline.parent_hash = saved.val.hash
 					baseline.content = aiDraft.content
 					if (aiDraft.language) baseline.language = aiDraft.language
 					if (aiDraft.summary !== undefined) baseline.summary = aiDraft.summary
@@ -733,10 +764,13 @@ function createRuntime(session: Session): SessionRuntime {
 				saved.val = result as SavedScript
 				// Clone before mutating, else `baseline` aliases `result` and
 				// `baseline.parent_hash` corrupts the diff baseline.
-				const baseline = structuredClone(
-					((result as SavedScript).draft as NewScript | undefined) ?? (result as NewScript)
-				)
-				baseline.parent_hash = result.hash
+				const serverDraft = (result as SavedScript).draft as NewScript | undefined
+				const baseline = structuredClone(serverDraft ?? (result as NewScript))
+				// Only a fresh checkout forks from the head. A draft keeps the base it has,
+				// unknown included: `draft.base` is derived from `parent_hash` on every
+				// save, so stamping the head over it would say this draft is up to date
+				// when it is not. An unknown base falls back to the timestamps.
+				if (!serverDraft) baseline.parent_hash = result.hash
 				// Seed the per-tab last_sync from the server draft's timestamp so the
 				// seeding save below attaches a matching last_sync and the server can
 				// reject stale writes (see loadRawApp). Without this a server draft —
@@ -797,7 +831,10 @@ function createRuntime(session: Session): SessionRuntime {
 							path: result.path,
 							policy: result.policy,
 							custom_path: result.custom_path,
-							no_deployed: result.no_deployed
+							no_deployed: result.no_deployed,
+							deployed_version: Array.isArray(result.versions)
+								? result.versions[result.versions.length - 1]
+								: undefined
 						}
 					} catch {
 						saved.val = undefined
@@ -833,7 +870,10 @@ function createRuntime(session: Session): SessionRuntime {
 					path: result.path,
 					policy: result.policy,
 					custom_path: result.custom_path,
-					no_deployed: result.no_deployed
+					no_deployed: result.no_deployed,
+					deployed_version: Array.isArray(result.versions)
+						? result.versions[result.versions.length - 1]
+						: undefined
 				}
 				// Prefer the server draft over the deployed value (mirrors the
 				// flow/script `result.draft ?? result`). A raw-app draft is already
@@ -863,7 +903,14 @@ function createRuntime(session: Session): SessionRuntime {
 					summary: draftValue?.summary ?? result.summary ?? '',
 					path: result.path,
 					custom_path: draftValue?.custom_path ?? result.custom_path,
-					draft_path: draftValue?.draft_path
+					draft_path: draftValue?.draft_path,
+					// Only a fresh checkout forks from the head; a draft keeps its own base,
+					// unknown included, or it would read as up to date. See loadScript.
+					parent_version: draftValue
+						? draftValue.parent_version
+						: Array.isArray(result.versions)
+							? result.versions[result.versions.length - 1]
+							: undefined
 				}
 				// Seed the per-tab last_sync from the server draft's timestamp so
 				// later saves attach a matching last_sync and the server can reject
@@ -970,7 +1017,7 @@ function createRuntime(session: Session): SessionRuntime {
 
 async function initRuntime(runtime: SessionRuntime, session: Session) {
 	const { manager } = runtime
-	await manager.historyManager.init()
+	await manager.historyManager.init(session)
 	manager.historyManager.setSessionId(session.id)
 	// Restore linked files persisted for this session (live handles re-grant on send;
 	// snapshots restore directly). Non-transient sessions persist immediately.
@@ -985,7 +1032,9 @@ async function initRuntime(runtime: SessionRuntime, session: Session) {
 	if (session.chatId) {
 		manager.historyManager.setCurrentChatId(session.chatId)
 		await manager.historyManager.tagChatWithSession(session.chatId, session.id)
-		await manager.loadPastChat(session.chatId)
+		// preserveQueue: restoring a session's own chat is not a conversation switch.
+		// A message queued while the restore ran is unsent user input waiting for it.
+		await manager.loadPastChat(session.chatId, { preserveQueue: true })
 		// loadPastChat only seeds the mask when the chat exists in history; a chatId
 		// pointing at a chat not yet persisted (no turn saved) would leave it
 		// undefined, and the Edits surface would then show every workspace draft.
@@ -1005,7 +1054,11 @@ export function getOrCreateRuntime(session: Session): SessionRuntime {
 	if (!runtime) {
 		runtime = createRuntime(session)
 		runtimes.set(session.id, runtime)
-		initRuntime(runtime, session).catch((e) => console.error('Failed to init session runtime', e))
+		// The gate opens even when the restore fails: a session that cannot read its
+		// history is still usable, and a send that waits forever is not.
+		runtime.manager.setReadyGate(
+			initRuntime(runtime, session).catch((e) => console.error('Failed to init session runtime', e))
+		)
 	}
 	return runtime
 }
@@ -1016,6 +1069,9 @@ export function disposeRuntime(sessionId: string) {
 	runtime.manager.cancel('runtime disposed')
 	runtime.manager.historyManager.close()
 	runtimes.delete(sessionId)
+	// The sidebar reads the stored chat again rather than trust a read that
+	// predates everything this runtime saw.
+	peeks.delete(sessionId)
 }
 
 export function listRuntimes(): SessionRuntime[] {
@@ -1049,7 +1105,13 @@ onRemoteTurnEnd((sessionId, chatId) => {
 
 async function applyRemoteTurnEnd(sessionId: string, chatId: string): Promise<void> {
 	const runtime = runtimes.get(sessionId)
-	if (!runtime) return
+	if (!runtime) {
+		// The driving tab may have rotated to a new chat; follow it, or the next
+		// read and a later runtime would open the old one.
+		setSessionChatId(sessionId, chatId)
+		refreshSessionChatPeek(sessionId)
+		return
+	}
 	const m = runtime.manager
 	// Two transient states get a short retry rather than a skip, because the
 	// composer unlocks when this promise settles and a skip would unlock it on
@@ -1091,7 +1153,9 @@ async function applyRemoteTurnEnd(sessionId: string, chatId: string): Promise<vo
 // and/or held by a live owner — would otherwise keep showing the old target.
 // Must write through the live owner when one exists; a bare record write would
 // be clobbered by the owner's next flush.
-export function resetSessionPreviewTabs(sessionId: string, url: string): void {
+export function resetSessionPreviewTabs(sessionId: string, seedUrl: string): void {
+	// A list page seeded on a row's drawer opens that row's own tab, as open() would.
+	const url = pageItemLocation(seedUrl)
 	const tabs = [{ id: 'session', url, loc: url }]
 	const rt = runtimes.get(sessionId)
 	if (rt) {
@@ -1169,12 +1233,17 @@ setOpenPreviewHandler(async ({ sessionId: callerSessionId, kind, path }) => {
 // open_page dispatches here to show a workspace page (Runs/Schedules) as a page
 // tab in the calling session's preview panel. Returns undefined when there is no
 // session so open_page can fall back to browser navigation.
-setOpenPagePreviewHandler(({ sessionId: callerSessionId, href, label, newTab }) => {
+setOpenPagePreviewHandler(({ sessionId: callerSessionId, href, label: pageLabel, newTab }) => {
 	const sessionId = callerSessionId ?? sessionState.currentSessionId
 	if (!sessionId) return undefined
 	const session = sessionState.sessions.find((s) => s.id === sessionId)
 	if (!session) return undefined
 	const owner = getOrCreateRuntime(session).previewTabs
+	// A page opened on one item is that item's tab, and the report has to name what opened.
+	const pageItem = pageItemForLocation(href)
+	const label = pageItem
+		? `the ${pageItemKindLabel(pageItem).toLowerCase()} ${promptSafe(pageItem.path)}`
+		: pageLabel
 	// open() owns the whole decision — which tab already shows this page, whether the
 	// requested view differs from what it shows, and whether a forced load is needed to
 	// re-fire a drawer. Deciding any of that again here means two predicates for one
@@ -1383,3 +1452,87 @@ export function getSessionChatStatus(runtime: SessionRuntime): SessionChatStatus
 	if (last && (last.role === 'assistant' || last.role === 'tool')) return 'awaiting-user'
 	return 'idle'
 }
+
+// ---------------------------------------------------------------------------
+// Sessions without a runtime
+// ---------------------------------------------------------------------------
+
+// A runtime costs a chat manager and its loaded transcript, and lives until its
+// session is deleted, so the sidebar does not create one per listed session. It
+// reads the session's one stored chat instead, once. Without a runtime nothing
+// runs in this tab, so only two facts of that chat can matter: its length (for
+// the unread count) and whether its last message failed. Every other status is
+// a live one.
+export interface SessionChatPeek {
+	status: 'error' | 'idle'
+	messageCount: number
+}
+
+const peeks = new SvelteMap<string, SessionChatPeek>()
+const peeksInFlight = new Set<string>()
+const peeksPendingRefresh = new Set<string>()
+
+// Not gated on `detached`: a chat saved mid-wait stores its job undetached, and
+// loadPastChat resumes polling every unfinished job either way.
+function isLiveJob(j: ChatJob): boolean {
+	return (
+		j.status === 'queued' ||
+		j.status === 'running' ||
+		j.status === 'suspended' ||
+		j.status === 'scheduled'
+	)
+}
+
+function sessionById(sessionId: string): Session | undefined {
+	return sessionState.sessions.find((s) => s.id === sessionId)
+}
+
+function refreshSessionChatPeek(sessionId: string): void {
+	peeks.delete(sessionId)
+	if (peeksInFlight.has(sessionId)) {
+		peeksPendingRefresh.add(sessionId)
+		return
+	}
+	const session = sessionById(sessionId)
+	if (session) void ensureSessionChatPeek(session)
+}
+
+export function getSessionChatPeek(sessionId: string): SessionChatPeek | undefined {
+	return peeks.get(sessionId)
+}
+
+/** Read the stored chat of a session that has no runtime. A chat with a detached
+ *  job still running gets its runtime instead: only a runtime polls the job and
+ *  resumes the conversation when it finishes. */
+export async function ensureSessionChatPeek(session: Session): Promise<void> {
+	const id = session.id
+	const chatId = session.chatId
+	if (runtimes.has(id) || peeks.has(id) || peeksInFlight.has(id) || !chatId) return
+	const email = getCurrentUserEmail()
+	if (!email) return
+	peeksInFlight.add(id)
+	try {
+		const chat = await readStoredChat(chatId, email)
+		if (sessionById(id)?.chatId !== chatId) {
+			refreshSessionChatPeek(id)
+			return
+		}
+		if (!chat || runtimes.has(id)) return
+		if (chat.backgroundJobs?.some(isLiveJob)) {
+			getOrCreateRuntime(session)
+			return
+		}
+		const last = chat.displayMessages[chat.displayMessages.length - 1]
+		peeks.set(id, {
+			status: last?.role === 'user' && last.error ? 'error' : 'idle',
+			messageCount: chat.displayMessages.length
+		})
+	} catch (e) {
+		console.error('Failed to read session chat', e)
+	} finally {
+		peeksInFlight.delete(id)
+		if (peeksPendingRefresh.delete(id)) {
+			refreshSessionChatPeek(id)
+		}
+	}
+}
diff --git a/frontend/src/lib/components/sessions/sessionState.svelte.ts b/frontend/src/lib/components/sessions/sessionState.svelte.ts
index 3014e6d5e7..c5a2f28455 100644
--- a/frontend/src/lib/components/sessions/sessionState.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionState.svelte.ts
@@ -82,7 +82,9 @@ export type SessionSummarySource = 'placeholder' | 'generated' | 'manual'
 
 export type Session = {
 	id: string
-	name: string
+	// Per-browser `session-N` label that older sessions-page URLs carried; only read
+	// to resolve those links.
+	name?: string
 	// Committed strictly at first user-message send. Undefined for drafts
 	// that have never been sent — those scope by `pending_workspace_id`
 	// instead and don't show the fork bar.
@@ -1005,8 +1007,8 @@ if (BROWSER) {
 	})
 }
 
-export function findSessionByName(name: string): Session | undefined {
-	return sessionState.sessions.find((s) => s.name === name)
+export function sessionPageHref(id: string): string {
+	return `/sessions?session=${encodeURIComponent(id)}`
 }
 
 // Bumped to ask the active session's composer to re-focus even when
@@ -1045,15 +1047,6 @@ export function findEmptyLandingSession(): Session | undefined {
 	)
 }
 
-// Session names are a per-browser counter (`session-N`) that the sessions page puts in
-// its URL, so a new or restored record takes the number after the highest in use.
-function nextSessionNumber(sessions: Session[]): number {
-	const numbers = sessions
-		.map((s) => /^session-(\d+)$/.exec(s.name)?.[1])
-		.map((n) => (n ? parseInt(n, 10) : 0))
-	return (numbers.length ? Math.max(...numbers) : 0) + 1
-}
-
 export function createSession(): Session {
 	// Reuse an existing untouched draft from the active family rather than pile a
 	// blank entry on every `+`, so several pending sessions can still be built up
@@ -1074,7 +1067,6 @@ export function createSession(): Session {
 		return reusable
 	}
 	sessionState.sessions = sessionState.sessions.filter((s) => !isDiscardableDraft(s))
-	const next = nextSessionNumber(sessionState.sessions)
 	// Start in the workspace you're in. The one exception: a root you can't
 	// deploy to (locked, no bypass) steers to its dev, since a session there
 	// couldn't edit anything. The picker lets you switch.
@@ -1100,7 +1092,6 @@ export function createSession(): Session {
 	const summary = `${adj.charAt(0).toUpperCase() + adj.slice(1)} session`
 	const session: Session = {
 		id: createLongHash(),
-		name: `session-${next}`,
 		summary,
 		summarySource: 'placeholder',
 		pending_workspace_id: pending && pending.length > 0 ? pending : undefined,
@@ -1459,11 +1450,10 @@ export async function importSessions(records: Session[], email: string): Promise
 	try {
 		const tx = db.transaction('sessions', 'readwrite')
 		const existing = new Set((await tx.store.getAllKeys()).map(String))
-		let next = nextSessionNumber([...(await tx.store.getAll()), ...sessionState.sessions])
 		const restoredAt = Date.now()
 		for (const r of records) {
 			if (existing.has(r.id) || deletedSessionIds.has(r.id)) continue
-			const record: Session = { ...r, name: `session-${next++}`, restoredAt }
+			const record: Session = { ...r, restoredAt }
 			delete record.transient
 			delete record.workspace_root_id
 			ensureSessionRootId(record)
diff --git a/frontend/src/lib/components/sessions/sessionStateIndexedDb.test.ts b/frontend/src/lib/components/sessions/sessionStateIndexedDb.test.ts
index dddfe795f7..fe0ad84d78 100644
--- a/frontend/src/lib/components/sessions/sessionStateIndexedDb.test.ts
+++ b/frontend/src/lib/components/sessions/sessionStateIndexedDb.test.ts
@@ -814,33 +814,28 @@ describe('sessionState IndexedDB persistence', () => {
 		await vi.waitFor(() => expect(sessionState.sessions).toEqual([]))
 	})
 
-	// A restored backup must never replace what this browser has, come back after the
-	// user deleted it here, or take a name the sessions page already routes by.
-	it('importSessions adds only unknown, undeleted records under fresh names', async () => {
+	// A restored backup must never replace what this browser has, or come back after the
+	// user deleted it here.
+	it('importSessions adds only unknown, undeleted records', async () => {
 		const user = freshUser()
 		await login(user)
-		const local = session({ id: 'local', name: 'session-3', createdAt: 1, summary: 'mine' })
+		const local = session({ id: 'local', createdAt: 1, summary: 'mine' })
 		await putSession(local)
 		sessionState.sessions.push(local)
 		deleteSession('local')
 		await flush()
-		await putSession(session({ id: 'kept', name: 'session-5', createdAt: 2, summary: 'kept' }))
+		await putSession(session({ id: 'kept', createdAt: 2, summary: 'kept' }))
 
 		const imported = await importSessions(
 			[
-				session({ id: 'local', name: 'session-1', createdAt: 1, summary: 'remote copy' }),
-				session({ id: 'kept', name: 'session-1', createdAt: 2, summary: 'remote copy' }),
-				session({ id: 'new', name: 'session-1', createdAt: 3, workspace_id: 'ws' })
+				session({ id: 'local', createdAt: 1, summary: 'remote copy' }),
+				session({ id: 'kept', createdAt: 2, summary: 'remote copy' }),
+				session({ id: 'new', createdAt: 3, workspace_id: 'ws' })
 			],
 			user.email
 		)
 		expect(imported).toEqual(['new'])
-		await vi.waitFor(() =>
-			expect(sessionState.sessions.map((s) => [s.id, s.name])).toEqual([
-				['new', 'session-6'],
-				['kept', 'session-5']
-			])
-		)
+		await vi.waitFor(() => expect(sessionState.sessions.map((s) => s.id)).toEqual(['new', 'kept']))
 		expect(sessionState.sessions.find((s) => s.id === 'kept')?.summary).toBe('kept')
 
 		// The wrong user's name gets nothing written.
diff --git a/frontend/src/lib/components/sessions/sessionSwitch.svelte.ts b/frontend/src/lib/components/sessions/sessionSwitch.svelte.ts
index a7a492b874..36a91ee453 100644
--- a/frontend/src/lib/components/sessions/sessionSwitch.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionSwitch.svelte.ts
@@ -4,6 +4,7 @@ import { workspaceStore } from '$lib/stores'
 import {
 	createSession,
 	selectSession,
+	sessionPageHref,
 	sessionInCurrentFamily,
 	sessionLastActivityAt,
 	sessionState,
@@ -81,7 +82,7 @@ function resumableSession(): Session | undefined {
 export async function enterSessionMode(opts?: { replace?: boolean }): Promise<void> {
 	const target = resumableSession() ?? createSession()
 	selectSession(target.id)
-	await goto(`/sessions?session_name=${encodeURIComponent(target.name)}`, {
+	await goto(sessionPageHref(target.id), {
 		replaceState: opts?.replace ?? false
 	})
 }
@@ -197,7 +198,7 @@ async function openInSession(
 		navRouteOffered = true
 	}
 	selectSession(session.id)
-	await goto(`/sessions?session_name=${encodeURIComponent(session.name)}`)
+	await goto(sessionPageHref(session.id))
 }
 
 // Open an editor's own hand-off, running its `beforeOpen` (which persists the
@@ -243,5 +244,5 @@ export async function startSessionWithPrompt(
 	// An empty prompt has nothing to send; leave the composer focused instead.
 	if (opts?.autoSend && prompt.trim()) setSessionAutoSend(session.id)
 	selectSession(session.id)
-	await goto(`/sessions?session_name=${encodeURIComponent(session.name)}`)
+	await goto(sessionPageHref(session.id))
 }
diff --git a/frontend/src/lib/components/sessions/sessionSwitch.test.ts b/frontend/src/lib/components/sessions/sessionSwitch.test.ts
index f03ba418b6..4eae32da6b 100644
--- a/frontend/src/lib/components/sessions/sessionSwitch.test.ts
+++ b/frontend/src/lib/components/sessions/sessionSwitch.test.ts
@@ -62,7 +62,7 @@ describe('enterSessionMode — restore is scoped to the active family', () => {
 		try {
 			await enterSessionMode()
 			expect(sessionState.currentSessionId).toBe('sw-in-family')
-			expect(goto).toHaveBeenCalledWith('/sessions?session_name=session-911', {
+			expect(goto).toHaveBeenCalledWith('/sessions?session=sw-in-family', {
 				replaceState: false
 			})
 		} finally {
@@ -82,7 +82,7 @@ describe('enterSessionMode — restore is scoped to the active family', () => {
 		try {
 			await enterSessionMode()
 			expect(sessionState.currentSessionId).toBe('sw-local')
-			expect(goto).toHaveBeenCalledWith('/sessions?session_name=session-913', {
+			expect(goto).toHaveBeenCalledWith('/sessions?session=sw-local', {
 				replaceState: false
 			})
 		} finally {
diff --git a/frontend/src/lib/components/sessions/sessionUnread.svelte.ts b/frontend/src/lib/components/sessions/sessionUnread.svelte.ts
index 281c6571bc..26ce3f205b 100644
--- a/frontend/src/lib/components/sessions/sessionUnread.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionUnread.svelte.ts
@@ -1,4 +1,4 @@
-import type { SessionRuntime } from './sessionRuntime.svelte'
+import type { SessionChatPeek, SessionRuntime } from './sessionRuntime.svelte'
 import { sessionState, putSession } from './sessionState.svelte'
 
 // Per-session "last seen" watermark — the displayMessages count the last time
@@ -20,11 +20,16 @@ export function markSessionSeen(sessionId: string, count: number) {
 	void putSession(s)
 }
 
-// Number of unread messages for a session. Undefined / unloaded runtime
-// returns 0 — until messages are hydrated we don't know what's new.
-export function unreadCountFor(sessionId: string, runtime: SessionRuntime | undefined): number {
-	if (!runtime) return 0
+// Number of unread messages for a session, from its runtime when it has one, else
+// from the sidebar's read of its stored chat. Neither loaded returns 0 — until
+// messages are read we don't know what's new.
+export function unreadCountFor(
+	sessionId: string,
+	runtime: SessionRuntime | undefined,
+	peek: SessionChatPeek | undefined
+): number {
+	const total = runtime ? runtime.manager.displayMessages.length : peek?.messageCount
+	if (total === undefined) return 0
 	const seen = sessionState.sessions.find((x) => x.id === sessionId)?.lastSeenCount ?? 0
-	const total = runtime.manager.displayMessages.length
 	return Math.max(0, total - seen)
 }
diff --git a/frontend/src/lib/components/sessions/useUserDraftSync.svelte.ts b/frontend/src/lib/components/sessions/useUserDraftSync.svelte.ts
index 7e89d3b945..64f7f7e6c2 100644
--- a/frontend/src/lib/components/sessions/useUserDraftSync.svelte.ts
+++ b/frontend/src/lib/components/sessions/useUserDraftSync.svelte.ts
@@ -94,7 +94,10 @@ export function useUserDraftSync<Draft>(opts: UserDraftSyncOptions<Draft>): void
 			// re-apply only advances the sig, never reverts an edit or fires a save.
 			if (sig === lastInboundSig) return
 			lastInboundSig = sig
-			codec.applyDraftToStore(incoming)
+			// Copies both ways: a store sharing proxies with the draft makes every local
+			// edit re-fire this effect as if a draft came in, reassigning the store on
+			// each keystroke.
+			codec.applyDraftToStore($state.snapshot(incoming) as Draft)
 		})
 	})
 
@@ -125,7 +128,9 @@ export function useUserDraftSync<Draft>(opts: UserDraftSyncOptions<Draft>): void
 			untrack(() => {
 				const current = UserDraft.get<Draft>(codec.itemKind, path, { workspace })
 				if (current && codec.sig(current) === sig) return
-				const toSave = codec.storeToDraft(current) ?? draft
+				const toSave = $state.snapshot(codec.storeToDraft(current) ?? draft) as Draft
+				// Our own write comes back through the handle; the inbound side must skip it.
+				lastInboundSig = codec.sig(toSave)
 				UserDraft.save<Draft>(codec.itemKind, path, toSave, { workspace })
 			})
 		}
diff --git a/frontend/src/lib/components/settings/CreateToken.svelte b/frontend/src/lib/components/settings/CreateToken.svelte
index 20e4891189..8ee5391443 100644
--- a/frontend/src/lib/components/settings/CreateToken.svelte
+++ b/frontend/src/lib/components/settings/CreateToken.svelte
@@ -1,15 +1,22 @@
 <script lang="ts">
-	import { untrack } from 'svelte'
-	import { userWorkspaces, workspaceStore, type UserWorkspace } from '$lib/stores'
-	import { Button } from '../common'
+	import { onMount, untrack } from 'svelte'
+	import { userWorkspaces, usersWorkspaceStore, type UserWorkspace } from '$lib/stores'
+	import { Alert, Button, Skeleton } from '../common'
 	import { triggerableByAI } from '$lib/actions/triggerableByAI.svelte'
 	import Toggle from '../Toggle.svelte'
-	import { UserService, type NewToken } from '$lib/gen'
+	import { SettingService, UserService, type NewToken } from '$lib/gen'
+	import { mcpTokenUrlDisabled } from '$lib/mcpAuth'
 	import TokenDisplay from './TokenDisplay.svelte'
 	import ScopesPicker from './ScopesPicker.svelte'
+	import CopyableCodeBlock from '../details/CopyableCodeBlock.svelte'
+	import { shell } from 'svelte-highlight/languages'
+	import { parseMaxTokenExpirationDays } from '$lib/tokenExpiration'
 
 	import TextInput from '../text_input/TextInput.svelte'
 	import Select from '../select/Select.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		showMcpMode?: boolean
@@ -44,7 +51,8 @@
 
 	let newToken = $state<string | undefined>(undefined)
 	let newMcpToken = $state<string | undefined>(undefined)
-	let newTokenExpiration = $state<number | undefined>(undefined)
+	// What the user picked; `newTokenExpiration` is that pick held within the ceiling.
+	let pickedExpiration = $state<number | undefined>(undefined)
 	let newTokenWorkspace = $state<string | undefined>(untrack(() => defaultNewTokenWorkspace))
 	let mcpCreationMode = $state(false)
 	let lastRequestedMcpMode = $state<boolean | undefined>(undefined)
@@ -52,6 +60,63 @@
 
 	let pickedScopes = $state<string[] | null>(null)
 	let readOnly = $state(false)
+	// How this instance lets an MCP client in. `oauth` means it refuses `?token=`, so a
+	// generated token would not get a client in and the URL is handed over bare instead.
+	// A failed read lands on `oauth`: the bare URL works whichever way the setting is,
+	// whereas guessing `token` mints a non-expiring credential the server may refuse.
+	type McpUrlPolicy = 'loading' | 'token' | 'oauth'
+	let mcpUrlPolicy = $state<McpUrlPolicy>('loading')
+
+	async function loadMcpUrlPolicy() {
+		mcpUrlPolicy = 'loading'
+		try {
+			mcpUrlPolicy = (await mcpTokenUrlDisabled()) ? 'oauth' : 'token'
+		} catch (err) {
+			console.error('Failed to load the MCP token setting:', err)
+			mcpUrlPolicy = 'oauth'
+		}
+	}
+
+	const DAY_SECS = 24 * 60 * 60
+	const EXPIRATION_CHOICES = [
+		{ label: '15 minutes', value: 15 * 60 },
+		{ label: '30 minutes', value: 30 * 60 },
+		{ label: '1 hour', value: 60 * 60 },
+		{ label: '1 day', value: DAY_SECS },
+		{ label: '7 days', value: 7 * DAY_SECS },
+		{ label: '30 days', value: 30 * DAY_SECS },
+		{ label: '90 days', value: 90 * DAY_SECS },
+		{ label: '180 days', value: 180 * DAY_SECS },
+		{ label: '365 days', value: 365 * DAY_SECS }
+	]
+
+	// The `max_token_expiration_days` instance setting. The server shortens any token that asks
+	// for longer, or for no expiration, so with it set the form only offers what would be kept.
+	let maxExpirationDays = $state<number | undefined>(undefined)
+
+	onMount(async () => {
+		let value: unknown
+		try {
+			value = await SettingService.getGlobal({ key: 'max_token_expiration_days' })
+		} catch {
+			// The server still shortens tokens itself; the form just offers every choice.
+			return
+		}
+		const days = parseMaxTokenExpirationDays(value)
+		if (days == undefined) {
+			return
+		}
+		maxExpirationDays = days
+	})
+
+	// Without a ceiling the expiration field is hidden in MCP mode, so a value picked on one side
+	// of the toggle must not ride along unseen. With one, the field shows in both modes and keeps
+	// its value.
+	function resetExpirationOnModeChange() {
+		if (maxExpirationSecs == undefined) {
+			pickedExpiration = undefined
+		}
+	}
 
 	function ensureCurrentWorkspaceIncluded(
 		workspacesList: UserWorkspace[],
@@ -69,8 +134,9 @@
 
 	function enterMcpMode() {
 		mcpCreationMode = true
-		newTokenExpiration = undefined
-		newTokenWorkspace = defaultNewTokenWorkspace ?? $workspaceStore
+		void loadMcpUrlPolicy()
+		resetExpirationOnModeChange()
+		newTokenWorkspace = defaultNewTokenWorkspace ?? $operatingWorkspace
 		newToken = undefined
 		newMcpToken = undefined
 		readOnly = false
@@ -84,7 +150,7 @@
 
 	function exitMcpMode() {
 		mcpCreationMode = false
-		newTokenExpiration = undefined
+		resetExpirationOnModeChange()
 		newTokenWorkspace = defaultNewTokenWorkspace
 		newMcpToken = undefined
 		readOnly = false
@@ -103,18 +169,12 @@
 
 			const tokenScopes = scopes ?? pickedScopes ?? undefined
 
-			const workspaceId = isAllWorkspaces
-				? undefined
-				: mcpMode
-					? newTokenWorkspace || $workspaceStore
-					: newTokenWorkspace
-
 			const createdToken = await UserService.createToken({
 				requestBody: {
 					label: newTokenLabel,
 					expiration: date?.toISOString(),
 					scopes: tokenScopes,
-					workspace_id: workspaceId,
+					workspace_id: tokenWorkspaceId,
 					read_only: readOnly
 				} as NewToken
 			})
@@ -136,19 +196,63 @@
 		}
 	}
 
-	const workspaces = $derived(ensureCurrentWorkspaceIncluded($userWorkspaces, $workspaceStore))
+	const workspaces = $derived(ensureCurrentWorkspaceIncluded($userWorkspaces, $operatingWorkspace))
 	const isAllWorkspaces = $derived(newTokenWorkspace === ALL_WORKSPACES)
+	const tokenWorkspaceId = $derived(
+		isAllWorkspaces
+			? undefined
+			: mcpCreationMode
+				? newTokenWorkspace || $operatingWorkspace
+				: newTokenWorkspace
+	)
+
+	// Mirrors the server's exemption for tokens owned by a service account: one in the workspace
+	// the token is for, or in any workspace for a workspace-less token.
+	const isServiceAccount = $derived.by(() => {
+		const memberships = $usersWorkspaceStore?.workspaces ?? []
+		return tokenWorkspaceId == undefined
+			? memberships.some((w) => w.is_service_account)
+			: memberships.some((w) => w.id === tokenWorkspaceId && w.is_service_account)
+	})
+	const maxExpirationSecs = $derived(
+		maxExpirationDays == undefined || isServiceAccount ? undefined : maxExpirationDays * DAY_SECS
+	)
+	const maxExpirationLabel = $derived(
+		maxExpirationDays === 1 ? '1 day' : `${maxExpirationDays} days`
+	)
+	const expirationItems = $derived(
+		maxExpirationSecs == undefined
+			? [{ label: 'No expiration', value: undefined }, ...EXPIRATION_CHOICES]
+			: [
+					...EXPIRATION_CHOICES.filter((choice) => choice.value < maxExpirationSecs),
+					{ label: `${maxExpirationLabel} (maximum)`, value: maxExpirationSecs }
+				]
+	)
+	// A ceiling can start applying after the pick: once the setting loads, or when the MCP workspace
+	// moves to one where the account is not a service account.
+	const newTokenExpiration = $derived(
+		maxExpirationSecs != undefined &&
+			(pickedExpiration == undefined || pickedExpiration > maxExpirationSecs)
+			? maxExpirationSecs
+			: pickedExpiration
+	)
 	// The workspace used to browse scripts/flows/endpoints in the scope picker.
 	// For an all-workspaces token there is no single workspace, so fall back to
 	// the current one just for populating the endpoint list.
 	const scopeWorkspaceId = $derived(
-		isAllWorkspaces ? $workspaceStore || '' : newTokenWorkspace || $workspaceStore || ''
+		isAllWorkspaces ? $operatingWorkspace || '' : newTokenWorkspace || $operatingWorkspace || ''
 	)
-	const mcpBaseUrl = $derived(
+	// Undefined wherever the workspace is: `/api/mcp/w/undefined/mcp` reads like a real URL
+	// and is copyable, so the OAuth panel withholds it rather than showing a broken one. The
+	// token branch guards the same case by disabling its generate button.
+	const mcpUrl = $derived(
 		isAllWorkspaces
-			? `${window.location.origin}/api/mcp/gateway?token=`
-			: `${window.location.origin}/api/mcp/w/${newTokenWorkspace}/mcp?token=`
+			? `${window.location.origin}/api/mcp/gateway`
+			: newTokenWorkspace
+				? `${window.location.origin}/api/mcp/w/${newTokenWorkspace}/mcp`
+				: undefined
 	)
+	const mcpBaseUrl = $derived(`${mcpUrl ?? ''}?token=`)
 
 	$effect(() => {
 		const requestedMcpMode = mcpOnly || openWithMcpMode
@@ -176,7 +280,9 @@
 	<!-- Stays bounded by the panel width: a content-driven width (min-w-min) would let a long
 	     scope chip stretch this card and push the rest of the form out of view. -->
 	<div class="p-4 rounded-md mb-6 bg-surface-tertiary">
-		<h3 class="pb-2 font-semibold text-emphasis text-sm">{title}</h3>
+		<h3 class="pb-2 font-semibold text-emphasis text-sm">
+			{mcpCreationMode && mcpUrlPolicy !== 'token' ? 'MCP URL' : title}
+		</h3>
 
 		{#if showMcpMode && !mcpOnly}
 			<div
@@ -206,115 +312,147 @@
 			</div>
 		{/if}
 
-		{#if scopes != undefined}
-			<div class="mb-4">
-				<span class="block mb-1 text-emphasis text-xs font-semibold">Scope</span>
-				{#each scopes as scope (scope)}
-					<TextInput inputProps={{ disabled: true }} value={scope} class="mb-2 w-full" />
-				{/each}
-				<div class="text-tertiary">
-					<Toggle
-						bind:checked={readOnly}
-						options={{
-							right: 'Read-only',
-							rightTooltip:
-								'Restricts this token to GET/HEAD endpoints. Any mutating request (POST/PUT/PATCH/DELETE) or job-run action will be rejected with 403, regardless of the scopes listed above.'
-						}}
-						size="2xs"
+		{#if mcpCreationMode && mcpUrlPolicy === 'loading'}
+			<Skeleton layout={[[2], 0.5, [1]]} />
+		{:else if mcpCreationMode && mcpUrlPolicy === 'oauth'}
+			{#if !lockWorkspace}
+				<div class="mb-4 max-w-md">
+					<span class="block mb-1 text-emphasis text-xs font-semibold">Workspace</span>
+					<!-- No all-workspaces entry: the gateway's consent screen binds the token it issues
+					     to the one workspace picked there, so OAuth has no multi-workspace grant to offer. -->
+					<Select
+						bind:value={newTokenWorkspace}
+						items={workspaces.map((w) => ({ label: w.name, value: w.id, subtitle: w.id }))}
 					/>
 				</div>
-			</div>
-		{/if}
+			{/if}
 
-		{#if !scopes || scopes.length === 0}
-			<ScopesPicker
-				mode={mcpCreationMode ? 'mcp' : 'standard'}
-				workspaceId={scopeWorkspaceId}
-				bind:value={pickedScopes}
-				bind:readOnly
-			/>
-		{/if}
+			{#if mcpUrl}
+				<CopyableCodeBlock code={mcpUrl} language={shell} wrap />
 
-		<div class="mt-2 grid grid-cols-1 md:grid-cols-2 gap-4">
-			{#if mcpCreationMode}
-				{#if !lockWorkspace}
-					<div>
-						<span class="block mb-1 text-emphasis text-xs font-semibold">Workspace</span>
-						<Select
-							bind:value={newTokenWorkspace}
-							items={[
-								{
-									label: 'All workspaces',
-									value: ALL_WORKSPACES,
-									subtitle: 'Multi-workspace'
-								},
-								...workspaces.map((w) => ({ label: w.name, value: w.id, subtitle: w.id }))
-							]}
+				<div class="mt-2">
+					<Alert type="info" title="This instance requires MCP clients to sign in" size="xs">
+						Paste this URL into your client. It opens a Windmill page where you approve the access
+						it asks for, and no token needs to be copied around.
+					</Alert>
+				</div>
+			{:else}
+				<p class="text-xs text-tertiary">Pick a workspace to get its MCP URL.</p>
+			{/if}
+
+			{#if !mcpOnly}
+				<div class="mt-4 flex justify-end gap-2 flex-row">
+					<Button onClick={exitMcpMode} variant="default">Cancel</Button>
+				</div>
+			{/if}
+		{:else}
+			{#if scopes != undefined}
+				<div class="mb-4">
+					<span class="block mb-1 text-emphasis text-xs font-semibold">Scope</span>
+					{#each scopes as scope (scope)}
+						<TextInput inputProps={{ disabled: true }} value={scope} class="mb-2 w-full" />
+					{/each}
+					<div class="text-tertiary">
+						<Toggle
+							bind:checked={readOnly}
+							options={{
+								right: 'Read-only',
+								rightTooltip:
+									'Restricts this token to GET/HEAD endpoints. Any mutating request (POST/PUT/PATCH/DELETE) or job-run action will be rejected with 403, regardless of the scopes listed above.'
+							}}
+							size="2xs"
 						/>
-						{#if isAllWorkspaces}
+					</div>
+				</div>
+			{/if}
+
+			{#if !scopes || scopes.length === 0}
+				<ScopesPicker
+					mode={mcpCreationMode ? 'mcp' : 'standard'}
+					workspaceId={scopeWorkspaceId}
+					bind:value={pickedScopes}
+					bind:readOnly
+				/>
+			{/if}
+
+			<div class="mt-2 grid grid-cols-1 md:grid-cols-2 gap-4">
+				{#if mcpCreationMode}
+					{#if !lockWorkspace}
+						<div>
+							<span class="block mb-1 text-emphasis text-xs font-semibold">Workspace</span>
+							<Select
+								bind:value={newTokenWorkspace}
+								items={[
+									{
+										label: 'All workspaces',
+										value: ALL_WORKSPACES,
+										subtitle: 'Multi-workspace'
+									},
+									...workspaces.map((w) => ({ label: w.name, value: w.id, subtitle: w.id }))
+								]}
+							/>
+							{#if isAllWorkspaces}
+								<p class="mt-1 text-xs text-tertiary">
+									This token works across every workspace you can access. Tools take a
+									<code>workspace_id</code> argument; call <code>list_workspaces</code> to discover them.
+								</p>
+							{/if}
+						</div>
+					{/if}
+				{/if}
+
+				{#if !mcpOnly}
+					<div>
+						<span class="block mb-1 text-emphasis text-xs font-semibold"
+							>Label <span class="text-xs text-primary">(optional)</span></span
+						>
+						<TextInput inputProps={{ type: 'text' }} bind:value={newTokenLabel} class="w-full" />
+					</div>
+				{/if}
+
+				{#if !mcpCreationMode || maxExpirationSecs != undefined}
+					<div>
+						<span class="block mb-1 text-xs text-emphasis font-semibold">
+							Expires In
+							{#if maxExpirationSecs == undefined}
+								<span class="text-xs text-primary">(optional)</span>
+							{/if}
+						</span>
+						<Select
+							bind:value={() => newTokenExpiration, (v) => (pickedExpiration = v)}
+							placeholder={maxExpirationSecs == undefined ? 'No expiration' : 'Pick an expiration'}
+							inputClass="w-full"
+							items={expirationItems}
+						/>
+						{#if maxExpirationSecs != undefined}
 							<p class="mt-1 text-xs text-tertiary">
-								This token works across every workspace you can access. Tools take a
-								<code>workspace_id</code> argument; call <code>list_workspaces</code> to discover them.
+								This instance limits tokens to {maxExpirationLabel}.
 							</p>
 						{/if}
 					</div>
 				{/if}
-			{/if}
+			</div>
 
-			{#if !mcpOnly}
-				<div>
-					<span class="block mb-1 text-emphasis text-xs font-semibold"
-						>Label <span class="text-xs text-primary">(optional)</span></span
+			<div class="mt-4 flex justify-end gap-2 flex-row">
+				{#if !mcpOnly}
+					<Button
+						on:click={() => {
+							exitMcpMode()
+						}}
+						variant="default"
 					>
-					<TextInput inputProps={{ type: 'text' }} bind:value={newTokenLabel} class="w-full" />
-				</div>
-			{/if}
-
-			{#if !mcpCreationMode}
-				<div>
-					<span class="block mb-1 text-xs text-emphasis font-semibold"
-						>Expires In <span class="text-xs text-primary">(optional)</span></span
-					>
-					<Select
-						bind:value={newTokenExpiration}
-						placeholder="No expiration"
-						inputClass="w-full"
-						items={[
-							{ label: 'No expiration', value: undefined },
-							{ label: '15 minutes', value: 15 * 60 },
-							{ label: '30 minutes', value: 30 * 60 },
-							{ label: '1 hour', value: 1 * 60 * 60 },
-							{ label: '1 day', value: 1 * 24 * 60 * 60 },
-							{ label: '7 days', value: 7 * 24 * 60 * 60 },
-							{ label: '30 days', value: 30 * 24 * 60 * 60 },
-							{ label: '90 days', value: 90 * 24 * 60 * 60 },
-							{ label: '180 days', value: 180 * 24 * 60 * 60 },
-							{ label: '365 days', value: 365 * 24 * 60 * 60 }
-						]}
-					/>
-				</div>
-			{/if}
-		</div>
-
-		<div class="mt-4 flex justify-end gap-2 flex-row">
-			{#if !mcpOnly}
+						Cancel
+					</Button>
+				{/if}
 				<Button
-					on:click={() => {
-						exitMcpMode()
-					}}
-					variant="default"
+					on:click={() => createToken(mcpCreationMode)}
+					disabled={mcpCreationMode && (newTokenWorkspace == undefined || !pickedScopes)}
+					variant="accent"
 				>
-					Cancel
+					{mcpCreationMode ? 'Generate MCP URL' : 'New token'}
 				</Button>
-			{/if}
-			<Button
-				on:click={() => createToken(mcpCreationMode)}
-				disabled={mcpCreationMode && (newTokenWorkspace == undefined || !pickedScopes)}
-				variant="accent"
-			>
-				{mcpCreationMode ? 'Generate MCP URL' : 'New token'}
-			</Button>
-		</div>
+			</div>
+		{/if}
 	</div>
 
 	{#if newToken && displayCreateToken}
diff --git a/frontend/src/lib/components/settings/EditTokenScopesModal.svelte b/frontend/src/lib/components/settings/EditTokenScopesModal.svelte
index ffea14f4c0..44a44a7937 100644
--- a/frontend/src/lib/components/settings/EditTokenScopesModal.svelte
+++ b/frontend/src/lib/components/settings/EditTokenScopesModal.svelte
@@ -2,11 +2,13 @@
 	import { untrack } from 'svelte'
 	import { UserService } from '$lib/gen'
 	import { sendUserToast } from '$lib/toast'
-	import { workspaceStore } from '$lib/stores'
 	import Button from '../common/button/Button.svelte'
 	import Modal from '../common/modal/Modal.svelte'
 	import TextInput from '../text_input/TextInput.svelte'
 	import ScopesPicker from './ScopesPicker.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		open: boolean
@@ -35,7 +37,7 @@
 	const isMcp = $derived(
 		(initialScopes ?? []).length > 0 && (initialScopes ?? []).every((s) => s.startsWith('mcp:'))
 	)
-	const mcpWorkspaceId = $derived(tokenWorkspaceId ?? $workspaceStore ?? '')
+	const mcpWorkspaceId = $derived(tokenWorkspaceId ?? $operatingWorkspace ?? '')
 
 	let labelValue = $state('')
 	let pickedScopes = $state<string[] | null>(null)
diff --git a/frontend/src/lib/components/settings/TokensTable.svelte b/frontend/src/lib/components/settings/TokensTable.svelte
index abfdd0f36d..1024aefa72 100644
--- a/frontend/src/lib/components/settings/TokensTable.svelte
+++ b/frontend/src/lib/components/settings/TokensTable.svelte
@@ -62,7 +62,9 @@
 			!label.startsWith('mcp-oauth-') &&
 			!label.startsWith('embed_app:') &&
 			!label.startsWith('sdk_app:') &&
-			!label.startsWith('impersonation:')
+			!label.startsWith('impersonation:') &&
+			!label.startsWith('cli-login:') &&
+			!label.startsWith('remote-deploy:')
 		)
 	}
 
diff --git a/frontend/src/lib/components/settings/UserAIPromptsSettings.svelte b/frontend/src/lib/components/settings/UserAIPromptsSettings.svelte
index 407d3a3bfe..096689bd09 100644
--- a/frontend/src/lib/components/settings/UserAIPromptsSettings.svelte
+++ b/frontend/src/lib/components/settings/UserAIPromptsSettings.svelte
@@ -6,7 +6,10 @@
 	import Label from '../Label.svelte'
 	import AIPromptsModal from './AIPromptsModal.svelte'
 	import { ExternalLink, Settings } from 'lucide-svelte'
-	import { userStore } from '$lib/stores'
+	import { useOperatingUser } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	const USER_CUSTOM_PROMPTS_KEY = 'userCustomAIPrompts'
 
@@ -49,7 +52,7 @@
 		<div class="flex flex-col gap-4">
 			<p class="text-xs text-secondary">
 				Customize AI behavior with system prompts. These are stored locally in your browser and
-				apply in addition to {#if $userStore?.is_admin || $userStore?.is_super_admin}<a
+				apply in addition to {#if actingUser?.is_admin || actingUser?.is_super_admin}<a
 						href="/workspace_settings?tab=ai"
 						>workspace-level prompts <ExternalLink size={12} class="inline-block" /></a
 					>{:else}workspace-level prompts{/if}.
diff --git a/frontend/src/lib/components/settings/WorkspaceUserSettings.svelte b/frontend/src/lib/components/settings/WorkspaceUserSettings.svelte
index 5c8af52683..449e9c7d31 100644
--- a/frontend/src/lib/components/settings/WorkspaceUserSettings.svelte
+++ b/frontend/src/lib/components/settings/WorkspaceUserSettings.svelte
@@ -46,6 +46,7 @@
 	let auto_invite_domain: string | undefined = $state()
 	let operatorOnly: boolean | undefined = $state(undefined)
 	let autoAdd: boolean | undefined = $state(false)
+	let addAdminsAndDevelopersToForks = $state(false)
 	let nbDisplayed = $state(30)
 
 	// Instance group auto-add settings
@@ -122,6 +123,25 @@
 		autoAdd = autoInvite?.mode === 'add'
 		autoAddInstanceGroups = autoInvite?.instance_groups || []
 		autoAddInstanceGroupsRoles = autoInvite?.instance_groups_roles || {}
+		addAdminsAndDevelopersToForks = settings.add_admins_and_developers_to_forks ?? false
+	}
+
+	async function updateAddAdminsAndDevelopersToForks(enabled: boolean): Promise<void> {
+		try {
+			await WorkspaceService.editAddAdminsAndDevelopersToForks({
+				workspace: $workspaceStore!,
+				requestBody: { add_admins_and_developers_to_forks: enabled }
+			})
+			sendUserToast(
+				enabled
+					? 'New forks will start with the admins and developers of this workspace'
+					: 'New forks will start with their creator only'
+			)
+		} catch (e) {
+			console.error('Failed to update the fork members setting:', e)
+			addAdminsAndDevelopersToForks = !enabled
+			sendUserToast(`Failed to update the fork members setting: ${e}`, true)
+		}
 	}
 
 	let getUsagePromise: CancelablePromise<UserUsage[]> | undefined = undefined
@@ -1067,6 +1087,22 @@
 
 <div class="pt-12"></div>
 
+<Section
+	label="Fork members"
+	description="Choose who a new fork of this workspace starts with, besides the person who creates it."
+	wrapperClass="pb-12"
+>
+	<Toggle
+		bind:checked={addAdminsAndDevelopersToForks}
+		on:change={(e) => updateAddAdminsAndDevelopersToForks(e.detail)}
+		options={{
+			right: 'Add admins and developers to new forks',
+			rightTooltip:
+				'Admins and developers of this workspace join every new fork with the role they have here, so they can follow and review the work done in it. Forks of those forks follow the same setting.'
+		}}
+	/>
+</Section>
+
 {#if invites?.length > 0}
 	<Section
 		label="Invites ({invites.length ?? ''})"
diff --git a/frontend/src/lib/components/sidebar/DeleteForkedWorkspaceModal.svelte b/frontend/src/lib/components/sidebar/DeleteForkedWorkspaceModal.svelte
index 3a73758146..b90124ee9f 100644
--- a/frontend/src/lib/components/sidebar/DeleteForkedWorkspaceModal.svelte
+++ b/frontend/src/lib/components/sidebar/DeleteForkedWorkspaceModal.svelte
@@ -45,11 +45,13 @@
 			const settings = await WorkspaceService.getPublicSettings({ workspace: $workspaceStore })
 			const datatables = settings.datatable?.datatables ?? {}
 			forkedDatatables = Object.entries(datatables)
-				.filter(([_, dt]) => dt.forked_from != null)
+				// A clone owns its database and is droppable; an entry pointing at the parent's is
+				// not this workspace's to drop, and never carries a clone stamp anyway.
+				.filter(([_, dt]) => dt.forked_from != null && dt.database != null)
 				.map(([name, dt]) => ({
 					name,
-					resourceType: dt.database.resource_type ?? 'instance',
-					resourcePath: dt.database.resource_path ?? '',
+					resourceType: dt.database?.resource_type ?? 'instance',
+					resourcePath: dt.database?.resource_path ?? '',
 					dropOnDelete: true
 				}))
 		} catch {
@@ -120,7 +122,12 @@
 			}
 		}
 
-		await WorkspaceService.deleteWorkspace({ workspace })
+		const result = await WorkspaceService.deleteWorkspace({ workspace })
+		// The server names any data table in another workspace that this delete left governed by
+		// nothing. Only surfaced when there is something to say.
+		if (typeof result === 'string' && result.includes('no longer resolve')) {
+			sendUserToast(result, 'warning', [], undefined, 20000)
+		}
 		await deleteSessionsForWorkspace(workspace).catch((e) =>
 			console.error('Session cleanup after workspace delete failed', e)
 		)
diff --git a/frontend/src/lib/components/sidebar/sidebarChrome.ts b/frontend/src/lib/components/sidebar/sidebarChrome.ts
index 71ff703d27..4c58202416 100644
--- a/frontend/src/lib/components/sidebar/sidebarChrome.ts
+++ b/frontend/src/lib/components/sidebar/sidebarChrome.ts
@@ -1,6 +1,6 @@
 // Sidebar rail background. Kept here as the single source for every host that
 // renders or mimics the sidebar (app layout, kitchen-sink harness).
-// The dark value is a theme-driven CSS variable so it adapts across dark
-// variants (default vs GitHub dark) — see tailwind.config.cjs `--sidebar-bg-dark`.
-export const SIDEBAR_BG = '#F3F3F7'
+// Both are CSS variables (see tailwind.config.cjs `--sidebar-bg-*`) so they adapt
+// across dark variants and to the instance accent tint (accentColor.ts).
+export const SIDEBAR_BG = 'var(--sidebar-bg-light)'
 export const SIDEBAR_BG_DARK = 'var(--sidebar-bg-dark)'
diff --git a/frontend/src/lib/components/sidebar/workspaceMenuHref.test.ts b/frontend/src/lib/components/sidebar/workspaceMenuHref.test.ts
index bc82a9269e..df8e668fba 100644
--- a/frontend/src/lib/components/sidebar/workspaceMenuHref.test.ts
+++ b/frontend/src/lib/components/sidebar/workspaceMenuHref.test.ts
@@ -6,18 +6,18 @@ describe('workspaceMenuHref', () => {
 		expect(
 			workspaceMenuHref({
 				pathname: '/sessions',
-				searchParams: new URLSearchParams('session_name=foo'),
+				searchParams: new URLSearchParams('session=foo'),
 				id: 'wm-fork-bar',
 				sameFamily: true
 			})
-		).toBe('/sessions?session_name=foo&workspace=wm-fork-bar')
+		).toBe('/sessions?session=foo&workspace=wm-fork-bar')
 	})
 
 	it('drops the open session for a cross-family target', () => {
 		expect(
 			workspaceMenuHref({
 				pathname: '/sessions',
-				searchParams: new URLSearchParams('session_name=foo'),
+				searchParams: new URLSearchParams('session=foo&session_name=session-5'),
 				id: 'other-root',
 				sameFamily: false
 			})
@@ -52,7 +52,7 @@ describe('workspaceMenuHref', () => {
 		expect(
 			workspaceMenuHref({
 				pathname: '/runs',
-				searchParams: new URLSearchParams('workspace=old&job=123&session_name=s'),
+				searchParams: new URLSearchParams('workspace=old&job=123&session=s'),
 				id: 'target',
 				sameFamily: true,
 				landOnHome: true
diff --git a/frontend/src/lib/components/sidebar/workspaceMenuHref.ts b/frontend/src/lib/components/sidebar/workspaceMenuHref.ts
index 6c8290b071..57342f2b08 100644
--- a/frontend/src/lib/components/sidebar/workspaceMenuHref.ts
+++ b/frontend/src/lib/components/sidebar/workspaceMenuHref.ts
@@ -25,6 +25,7 @@ export function workspaceMenuHref(args: {
 	const params = new URLSearchParams(args.searchParams)
 	params.set('workspace', args.id)
 	if (!args.sameFamily) {
+		params.delete('session')
 		params.delete('session_name')
 	}
 	return `${args.pathname}?${params.toString()}`
diff --git a/frontend/src/lib/components/stickToBottom.ts b/frontend/src/lib/components/stickToBottom.ts
new file mode 100644
index 0000000000..f08d2cfe04
--- /dev/null
+++ b/frontend/src/lib/components/stickToBottom.ts
@@ -0,0 +1,47 @@
+/**
+ * Keeps a growing pane pinned to its end, for the chat transcript and the agent run
+ * viewer. Shared for one non-obvious guard: a programmatic scroll dispatches its
+ * `scroll` event asynchronously, so content landing in between widens the gap for a
+ * tick, which reads as the reader scrolling away and disengages the follow.
+ */
+
+/**
+ * Distance from the end within which a reader counts as still following. Allows
+ * for sub-pixel rounding from `scrollTo` and the occasional overscroll bounce.
+ */
+const STICK_TO_BOTTOM_PX = 8
+
+/** A scroll event this close after our own scroll is ours, not the reader's. */
+const OWN_SCROLL_WINDOW_MS = 120
+
+export type BottomSticker = {
+	/** Jump to the end. Instant: smooth would animate every append and race the next. */
+	scrollToEnd: (pane: HTMLElement | undefined | null) => void
+	/** Whether the pane is at its end, i.e. the reader wants to be carried along. */
+	isAtEnd: (pane: HTMLElement | undefined | null) => boolean
+	/** Whether the scroll event being handled was one we caused. */
+	isOwnScroll: () => boolean
+}
+
+export function createBottomSticker(): BottomSticker {
+	let scrolledAt: number | undefined
+
+	return {
+		scrollToEnd(pane) {
+			if (!pane) {
+				return
+			}
+			scrolledAt = Date.now()
+			pane.scrollTo({ top: pane.scrollHeight, behavior: 'auto' })
+		},
+		isAtEnd(pane) {
+			if (!pane) {
+				return false
+			}
+			return pane.scrollHeight - pane.scrollTop - pane.clientHeight <= STICK_TO_BOTTOM_PX
+		},
+		isOwnScroll() {
+			return scrolledAt !== undefined && Date.now() - scrolledAt < OWN_SCROLL_WINDOW_MS
+		}
+	}
+}
diff --git a/frontend/src/lib/components/text_input/TextInput.svelte b/frontend/src/lib/components/text_input/TextInput.svelte
index 03fcedbd8e..0528ca7ae7 100644
--- a/frontend/src/lib/components/text_input/TextInput.svelte
+++ b/frontend/src/lib/components/text_input/TextInput.svelte
@@ -46,17 +46,17 @@
 	// Base leading == (unified height − vertical padding) so a single-line
 	// contenteditable div centers its text the way a native <input> does.
 	//
-	// In "large mode" (viewport ≥ 1760px, where app.css bumps :root to 18px →
+	// In "large mode" (screen ≥ 1760px, where app.css bumps :root to 18px →
 	// font 13.5px) headless-Chromium ink measurement showed the text sitting
 	// ~1px low with the base leading. The residual is a fixed ~2px of line box,
 	// so the exact centered value there is (content-box height − 2px). Scoped to
-	// the same 1760px breakpoint as the font-size bump; small mode is unchanged.
+	// the same query as the font-size bump; small mode is unchanged.
 	export const inputLeadingClasses: Record<ButtonType.UnifiedSize, string> = {
-		'2xs': 'leading-4 min-[1760px]:leading-[calc(1rem_-_2px)]', // h-5 − py-0.5 → 1rem
-		xs: 'leading-4 min-[1760px]:leading-[calc(1rem_-_2px)]', // h-5 − py-0.5 → 1rem
-		sm: 'leading-6 min-[1760px]:leading-[calc(1.5rem_-_2px)]', // h-7 − py-0.5 → 1.5rem
-		md: 'leading-8 min-[1760px]:leading-[calc(2rem_-_2px)]', // h-8, no py → 2rem
-		lg: 'leading-10 min-[1760px]:leading-[calc(2.5rem_-_2px)]' // h-10, no py → 2.5rem
+		'2xs': 'leading-4 [@media(min-device-width:1760px)]:leading-[calc(1rem_-_2px)]', // h-5 − py-0.5 → 1rem
+		xs: 'leading-4 [@media(min-device-width:1760px)]:leading-[calc(1rem_-_2px)]', // h-5 − py-0.5 → 1rem
+		sm: 'leading-6 [@media(min-device-width:1760px)]:leading-[calc(1.5rem_-_2px)]', // h-7 − py-0.5 → 1.5rem
+		md: 'leading-8 [@media(min-device-width:1760px)]:leading-[calc(2rem_-_2px)]', // h-8, no py → 2rem
+		lg: 'leading-10 [@media(min-device-width:1760px)]:leading-[calc(2.5rem_-_2px)]' // h-10, no py → 2.5rem
 	}
 </script>
 
diff --git a/frontend/src/lib/components/triggers/AddTriggersButton.svelte b/frontend/src/lib/components/triggers/AddTriggersButton.svelte
index 4027bf9081..17387d13e0 100644
--- a/frontend/src/lib/components/triggers/AddTriggersButton.svelte
+++ b/frontend/src/lib/components/triggers/AddTriggersButton.svelte
@@ -8,7 +8,9 @@
 	import { isCloudHosted } from '$lib/cloud'
 	import { CloudOff } from 'lucide-svelte'
 	import { isServiceAvailable } from './native/utils'
-	import { workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		setDropdownWidthToButtonWidth?: boolean
@@ -41,15 +43,15 @@
 	let githubAvailable = $state(false)
 
 	async function setNextcloudState() {
-		nextcloudAvailable = await isServiceAvailable('nextcloud', $workspaceStore!)
+		nextcloudAvailable = await isServiceAvailable('nextcloud', $operatingWorkspace!)
 	}
 
 	async function setGoogleState() {
-		googleAvailable = await isServiceAvailable('google', $workspaceStore!)
+		googleAvailable = await isServiceAvailable('google', $operatingWorkspace!)
 	}
 
 	async function setGithubState() {
-		githubAvailable = await isServiceAvailable('github', $workspaceStore!)
+		githubAvailable = await isServiceAvailable('github', $operatingWorkspace!)
 	}
 
 	setNextcloudState()
diff --git a/frontend/src/lib/components/triggers/CaptureSection.svelte b/frontend/src/lib/components/triggers/CaptureSection.svelte
index eebfe3c1a7..5b1980e1b4 100644
--- a/frontend/src/lib/components/triggers/CaptureSection.svelte
+++ b/frontend/src/lib/components/triggers/CaptureSection.svelte
@@ -26,7 +26,6 @@
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import { Popover } from '$lib/components/meltComponents'
 	import { CaptureService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { isObject, sendUserToast } from '$lib/utils'
 	import { triggerIconMap } from './utils'
 	import { formatDateShort } from '$lib/utils'
@@ -37,6 +36,9 @@
 	import { twMerge } from 'tailwind-merge'
 	import { FlaskConical } from 'lucide-svelte'
 	import Alert from '../common/alert/Alert.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		disabled?: boolean | undefined
@@ -139,7 +141,7 @@
 			if (!captureInfo.path) return
 
 			const captures = await CaptureService.listCaptures({
-				workspace: $workspaceStore!,
+				workspace: $operatingWorkspace!,
 				runnableKind: captureInfo.isFlow ? 'flow' : 'script',
 				path: captureInfo.path,
 				triggerKind: captureType,
@@ -167,7 +169,7 @@
 
 			try {
 				const captures = await CaptureService.listCaptures({
-					workspace: $workspaceStore!,
+					workspace: $operatingWorkspace!,
 					runnableKind: captureInfo.isFlow ? 'flow' : 'script',
 					path: captureInfo.path,
 					triggerKind: captureType,
@@ -213,7 +215,7 @@
 		try {
 			isLoadingBigPayload = true
 			const fullCapture = await CaptureService.getCapture({
-				workspace: $workspaceStore!,
+				workspace: $operatingWorkspace!,
 				id: capture.id
 			})
 
diff --git a/frontend/src/lib/components/triggers/CaptureTable.svelte b/frontend/src/lib/components/triggers/CaptureTable.svelte
index 2d20ac02e1..ea0cf5e256 100644
--- a/frontend/src/lib/components/triggers/CaptureTable.svelte
+++ b/frontend/src/lib/components/triggers/CaptureTable.svelte
@@ -10,7 +10,6 @@
 	import { createEventDispatcher, onDestroy, untrack } from 'svelte'
 	import { type TriggerKind } from '../triggers'
 	import { CaptureService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { type CaptureTriggerKind } from '$lib/gen'
 	import CaptureButton from '$lib/components/triggers/CaptureButton.svelte'
 	import InfiniteList from '../InfiniteList.svelte'
@@ -19,6 +18,9 @@
 	import type { Capture } from '$lib/gen'
 	import { AwsIcon, MqttIcon, AmqpIcon } from '../icons'
 	import GoogleCloudIcon from '../icons/GoogleCloudIcon.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		path: string
@@ -33,9 +35,8 @@
 		limitPayloadSize?: boolean
 		noBorder?: boolean
 		captureActiveIndicator?: boolean | undefined
-		// Workspace to scope capture list/get/delete calls to. Defaults to the nav
-		// `$workspaceStore`; an AI-session live editor passes the session's acting
-		// workspace (a fork) so captures hit the right workspace.
+		// Workspace to scope capture list/get/delete calls to. Defaults to the operating
+		// workspace (see `useOperatingWorkspace`).
 		workspace?: string
 	}
 
@@ -55,7 +56,7 @@
 		workspace = undefined
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	let selected: number | undefined = $state(undefined)
 	let testKind: 'preprocessor' | 'main' = $state('main')
diff --git a/frontend/src/lib/components/triggers/CaptureWrapper.svelte b/frontend/src/lib/components/triggers/CaptureWrapper.svelte
index bfffbfc56b..9b616454fd 100644
--- a/frontend/src/lib/components/triggers/CaptureWrapper.svelte
+++ b/frontend/src/lib/components/triggers/CaptureWrapper.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import { CaptureService, type CaptureConfig, type CaptureTriggerKind } from '$lib/gen'
 	import { onDestroy, untrack } from 'svelte'
 	import { sendUserToast, sleep } from '$lib/utils'
@@ -18,6 +17,9 @@
 	import GcpCapture from './gcp/GcpCapture.svelte'
 	import AzureCapture from './azure/AzureCapture.svelte'
 	import EmailCapture from './email/EmailCapture.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		isFlow: boolean
@@ -63,7 +65,7 @@
 					is_flow: isFlow,
 					trigger_config: args && Object.keys(args).length > 0 ? args : undefined
 				},
-				workspace: $workspaceStore!
+				workspace: $operatingWorkspace!
 			})
 			return true
 		} catch (error) {
@@ -94,7 +96,7 @@
 
 	async function getCaptureConfigs() {
 		const captureConfigsList = await CaptureService.getCaptureConfigs({
-			workspace: $workspaceStore!,
+			workspace: $operatingWorkspace!,
 			runnableKind: isFlow ? 'flow' : 'script',
 			path
 		})
@@ -123,7 +125,7 @@
 		while (captureActive) {
 			if (i % 3 === 0) {
 				await CaptureService.pingCaptureConfig({
-					workspace: $workspaceStore!,
+					workspace: $operatingWorkspace!,
 					triggerKind: captureType,
 					runnableKind: isFlow ? 'flow' : 'script',
 					path
diff --git a/frontend/src/lib/components/triggers/PermissionedAsLine.svelte b/frontend/src/lib/components/triggers/PermissionedAsLine.svelte
index 73d1220166..86c5ad74b8 100644
--- a/frontend/src/lib/components/triggers/PermissionedAsLine.svelte
+++ b/frontend/src/lib/components/triggers/PermissionedAsLine.svelte
@@ -4,9 +4,12 @@
 		type OnBehalfOfDetails
 	} from '$lib/components/OnBehalfOfSelector.svelte'
 	import { useFolderDefaultPermissionedAs } from '$lib/components/useFolderDefaultPermissionedAs.svelte'
-	import { userStore, workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+	import { userStore } from '$lib/stores'
 	import { AlertTriangle } from 'lucide-svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		/** Current permissioned_as value from the trigger (e.g., 'u/admin') */
@@ -22,11 +25,13 @@
 	}
 
 	let { permissionedAs, onPermissionedAsChange, path = undefined }: Props = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	const wsId = $derived($operatingWorkspace)
 
 	const canPreserve = $derived(
-		$userStore?.is_admin || ($userStore?.groups ?? []).includes('wm_deployers')
+		actingUser?.is_admin || (actingUser?.groups ?? []).includes('wm_deployers')
 	)
 
 	const myPermissionedAs = $derived($userStore?.username ? `u/${$userStore.username}` : undefined)
diff --git a/frontend/src/lib/components/triggers/TestTriggerConnection.svelte b/frontend/src/lib/components/triggers/TestTriggerConnection.svelte
index 77a81ba432..f6d838be25 100644
--- a/frontend/src/lib/components/triggers/TestTriggerConnection.svelte
+++ b/frontend/src/lib/components/triggers/TestTriggerConnection.svelte
@@ -10,10 +10,9 @@
 		WebsocketTriggerService,
 		GcpTriggerService
 	} from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import { sendUserToast } from '$lib/toast'
 	import Button from '../common/button/Button.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		kind: 'websocket' | 'nats' | 'kafka' | 'postgres' | 'sqs' | 'mqtt' | 'amqp' | 'gcp'
@@ -23,8 +22,8 @@
 	}
 
 	let { kind, args, noButton = false, testLoading = $bindable(false) }: Props = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	const kindToName: { [key: string]: string } = {
 		websocket: 'WebSocket',
diff --git a/frontend/src/lib/components/triggers/TriggerEditorToolbar.svelte b/frontend/src/lib/components/triggers/TriggerEditorToolbar.svelte
index 72f0d83fa0..ab8b850fa2 100644
--- a/frontend/src/lib/components/triggers/TriggerEditorToolbar.svelte
+++ b/frontend/src/lib/components/triggers/TriggerEditorToolbar.svelte
@@ -13,7 +13,7 @@
 	import { stripBase, TRIGGER_PAGES, SCHEDULES_PATH } from '$lib/components/sessions/previewPaths'
 	import { pageDrawerSessionSource } from '../sessions/pageDrawerSession'
 	import { page } from '$app/state'
-	import { workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 	import TriggerHistoryButton from './TriggerHistoryButton.svelte'
 
 	interface Props {
@@ -62,6 +62,8 @@
 		triggerPath,
 		triggerKind
 	}: Props = $props()
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	const canSave = $derived((permissions === 'write' && edit) || permissions === 'create')
 
@@ -79,7 +81,7 @@
 			? pageDrawerSessionSource(
 					triggerPagePath,
 					trigger?.isDraft ? undefined : triggerPath || trigger?.path,
-					$workspaceStore ?? undefined
+					wsId ?? undefined
 				)
 			: undefined
 	)
diff --git a/frontend/src/lib/components/triggers/TriggerHistoryButton.svelte b/frontend/src/lib/components/triggers/TriggerHistoryButton.svelte
index f8bf4c7bb4..9f5d698f24 100644
--- a/frontend/src/lib/components/triggers/TriggerHistoryButton.svelte
+++ b/frontend/src/lib/components/triggers/TriggerHistoryButton.svelte
@@ -1,7 +1,6 @@
 <script lang="ts">
 	import { History } from 'lucide-svelte'
 	import { TriggerService, type TriggerHistoryEntry } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { displayDate } from '$lib/utils'
 	import Button from '../common/button/Button.svelte'
 	import Drawer from '../common/drawer/Drawer.svelte'
@@ -9,8 +8,8 @@
 	import Badge from '../common/badge/Badge.svelte'
 	import Skeleton from '../common/skeleton/Skeleton.svelte'
 	import TriggerHistoryChanges from './TriggerHistoryChanges.svelte'
-	import { getTriggerWorkspace } from './triggerWorkspace'
 	import type { TriggerType } from './utils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		/** Trigger kind as the backend records it: `schedule`, `http`, `kafka`, … */
@@ -22,8 +21,8 @@
 
 	// An AI session can edit a trigger in a workspace that is not the nav one;
 	// the whole trigger subtree reads its workspace through this seam.
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	let drawer: Drawer | undefined = $state()
 	let entries: TriggerHistoryEntry[] | undefined = $state(undefined)
diff --git a/frontend/src/lib/components/triggers/TriggerList.svelte b/frontend/src/lib/components/triggers/TriggerList.svelte
new file mode 100644
index 0000000000..501eebd90f
--- /dev/null
+++ b/frontend/src/lib/components/triggers/TriggerList.svelte
@@ -0,0 +1,983 @@
+<script lang="ts">
+	import { onDestroy, untrack } from 'svelte'
+	import { base } from '$app/paths'
+	import { page } from '$app/stores'
+	import {
+		AzureTriggerService,
+		GcpTriggerService,
+		PostgresTriggerService,
+		SettingService,
+		WorkspaceService,
+		type TriggerMode,
+		type WorkspaceDeployUISettings
+	} from '$lib/gen'
+	import {
+		canWrite,
+		capitalize,
+		copyToClipboard,
+		displayDate,
+		getLocalSetting,
+		removeTriggerKindIfUnused,
+		sendUserToast,
+		storeLocalSetting
+	} from '$lib/utils'
+	import { withForkConflictRetry } from '$lib/utils/forkConflict'
+	import { getLocalDraftHint } from '$lib/localDraftHints.svelte'
+	import { enterpriseLicense, usedTriggerKinds, userWorkspaces, workspaceStore } from '$lib/stores'
+	import { goto, setQuery } from '$lib/navigation'
+	import { isCloudHosted } from '$lib/cloud'
+	import { ALL_DEPLOYABLE, isDeployable } from '$lib/utils_deployable'
+	import {
+		Circle,
+		ClipboardCopy,
+		Code,
+		Database,
+		Eye,
+		FileUp,
+		Mail,
+		Pause,
+		Pen,
+		Plus,
+		Route,
+		Shield,
+		Trash,
+		Unplug
+	} from 'lucide-svelte'
+	import CenteredPage from '$lib/components/CenteredPage.svelte'
+	import { Alert, Badge, Button, EmptyState, Skeleton } from '$lib/components/common'
+	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
+	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
+	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
+	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
+	import DeployWorkspaceDrawer from '$lib/components/DeployWorkspaceDrawer.svelte'
+	import DraftBadge from '$lib/components/DraftBadge.svelte'
+	import Dropdown from '$lib/components/DropdownV2.svelte'
+	import ListFilters from '$lib/components/home/ListFilters.svelte'
+	import NoItemFound from '$lib/components/home/NoItemFound.svelte'
+	import PageHeader from '$lib/components/PageHeader.svelte'
+	import Popover from '$lib/components/Popover.svelte'
+	import SearchItems from '$lib/components/SearchItems.svelte'
+	import SharedBadge from '$lib/components/SharedBadge.svelte'
+	import ShareModal from '$lib/components/ShareModal.svelte'
+	import Toggle from '$lib/components/Toggle.svelte'
+	import AmqpIcon from '$lib/components/icons/AmqpIcon.svelte'
+	import AwsIcon from '$lib/components/icons/AwsIcon.svelte'
+	import AzureIcon from '$lib/components/icons/AzureIcon.svelte'
+	import GoogleCloudIcon from '$lib/components/icons/GoogleCloudIcon.svelte'
+	import KafkaIcon from '$lib/components/icons/KafkaIcon.svelte'
+	import MqttIcon from '$lib/components/icons/MqttIcon.svelte'
+	import NatsIcon from '$lib/components/icons/NatsIcon.svelte'
+	import TriggerModeToggle from './TriggerModeToggle.svelte'
+	import { getHttpRoute } from './http/utils'
+	import { getEmailAddress, getEmailDomain } from './email/utils'
+	import { TRIGGER_LIST_CONFIG, type TriggerRow } from './triggerListConfig'
+	import type { TriggerKind } from '$lib/components/sessions/previewPaths'
+	import { useHostedPage } from '$lib/components/hostedPage'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	let { triggerKind }: { triggerKind: TriggerKind } = $props()
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const hosted = useHostedPage()
+
+	const config = $derived(TRIGGER_LIST_CONFIG[triggerKind])
+	const isAdmin = $derived(
+		!!(operatingUser.current?.is_admin || operatingUser.current?.is_super_admin)
+	)
+
+	type EditorHandle = {
+		openNew: (isFlow: boolean) => void
+		openEdit: (path: string, isFlow: boolean) => void
+	}
+	type Module = { default: any }
+	const EDITORS: Record<TriggerKind, () => Promise<Module>> = {
+		http: () => import('./http/RouteEditor.svelte'),
+		websocket: () => import('./websocket/WebsocketTriggerEditor.svelte'),
+		postgres: () => import('./postgres/PostgresTriggerEditor.svelte'),
+		kafka: () => import('./kafka/KafkaTriggerEditor.svelte'),
+		nats: () => import('./nats/NatsTriggerEditor.svelte'),
+		sqs: () => import('./sqs/SqsTriggerEditor.svelte'),
+		gcp: () => import('./gcp/GcpTriggerEditor.svelte'),
+		azure: () => import('./azure/AzureTriggerEditor.svelte'),
+		mqtt: () => import('./mqtt/MqttTriggerEditor.svelte'),
+		amqp: () => import('./amqp/AmqpTriggerEditor.svelte'),
+		email: () => import('./email/EmailTriggerEditor.svelte')
+	}
+	const ICONS: Record<TriggerKind, any> = {
+		http: Route,
+		websocket: Unplug,
+		postgres: Database,
+		kafka: KafkaIcon,
+		nats: NatsIcon,
+		sqs: AwsIcon,
+		gcp: GoogleCloudIcon,
+		azure: AzureIcon,
+		mqtt: MqttIcon,
+		amqp: AmqpIcon,
+		email: Mail
+	}
+	const Icon = $derived(ICONS[triggerKind])
+
+	type TriggerW = TriggerRow & { canWrite: boolean }
+
+	let triggers: TriggerW[] = $state([])
+	let loading = $state(true)
+	let editor: EditorHandle | undefined = $state()
+	let shareModal: ShareModal | undefined = $state()
+	let deploymentDrawer: DeployWorkspaceDrawer | undefined = $state()
+	let routesGenerator: { openDrawer: () => void } | undefined = $state()
+	let openAPISpecGenerator: { openDrawer: () => void } | undefined = $state()
+	let deployUiSettings: WorkspaceDeployUISettings | undefined = $state(undefined)
+	let globalHttpWorkspacedRoute = $state(false)
+	let emailDomain: string | null = $state(null)
+
+	function openEdit(path: string, isFlow: boolean) {
+		if (hosted) hosted.openItem(path)
+		else editor?.openEdit(path, isFlow)
+	}
+
+	function openLink(href: string) {
+		if (hosted) hosted.openLink(`${base}${href}`)
+		else goto(href)
+	}
+
+	async function getDeployUiSettings() {
+		if (!$enterpriseLicense) {
+			deployUiSettings = ALL_DEPLOYABLE
+			return
+		}
+		let settings = await WorkspaceService.getPublicSettings({ workspace: $operatingWorkspace! })
+		deployUiSettings = settings.deploy_ui ?? ALL_DEPLOYABLE
+	}
+	getDeployUiSettings()
+
+	if (untrack(() => triggerKind) === 'http') {
+		SettingService.getGlobal({ key: 'http_route_workspaced_route' })
+			.then((setting) => (globalHttpWorkspacedRoute = (setting as boolean) ?? false))
+			.catch(() => (globalHttpWorkspacedRoute = false))
+	}
+
+	async function loadTriggers(): Promise<void> {
+		const workspace = $operatingWorkspace!
+		const listed = await config.list({ workspace, includeDraftOnly: true })
+		triggers = listed.map((x) => ({
+			canWrite: canWrite(x.path, x.extra_perms!, operatingUser.current),
+			...x
+		}))
+		// The nav rail lists the trigger kinds of the navigation workspace only.
+		if (workspace === $workspaceStore) {
+			$usedTriggerKinds = removeTriggerKindIfUnused(
+				triggers.length,
+				config.usedKind,
+				$usedTriggerKinds
+			)
+		}
+		if (triggerKind === 'email') emailDomain = await getEmailDomain()
+		loading = false
+	}
+
+	$effect(() => {
+		if ($operatingWorkspace && operatingUser.current) {
+			untrack(() => loadTriggers())
+		}
+	})
+
+	let interval: ReturnType<typeof setInterval> | undefined = untrack(() => config.status)
+		? setInterval(async () => {
+				try {
+					const newTriggers = await config.list({ workspace: $operatingWorkspace! })
+					for (let i = 0; i < triggers.length; i++) {
+						const newTrigger = newTriggers.find((x) => x.path === triggers[i].path)
+						if (newTrigger) {
+							triggers[i] = {
+								...triggers[i],
+								error: newTrigger.error,
+								last_server_ping: newTrigger.last_server_ping,
+								mode: newTrigger.mode,
+								server_id: newTrigger.server_id
+							}
+						}
+					}
+				} catch (err) {
+					console.error(err)
+				}
+			}, 5000)
+		: undefined
+	onDestroy(() => clearInterval(interval))
+
+	function modeVerb(mode: TriggerMode) {
+		return mode === 'enabled' ? 'enable' : mode === 'disabled' ? 'disable' : 'suspend'
+	}
+
+	async function onToggleMode(path: string, mode: TriggerMode): Promise<boolean> {
+		const workspace = $operatingWorkspace!
+		const label = config.forkConflictLabel
+		if (label === undefined) {
+			try {
+				await config.setMode({ path, workspace, requestBody: { mode } })
+			} catch (err) {
+				sendUserToast(`${config.modeError(modeVerb(mode))}: ${err.body}`, true)
+			} finally {
+				loadTriggers()
+			}
+			return true
+		}
+		let committed = false
+		try {
+			const ok = await withForkConflictRetry(
+				(force) => config.setMode({ path, workspace, requestBody: { mode, force } }),
+				label
+			)
+			if (ok) {
+				if (config.modeToastLabel) {
+					sendUserToast(`${capitalize(mode)} ${config.modeToastLabel} ${path}`)
+				}
+				loadTriggers()
+			}
+			committed = ok
+		} catch (err) {
+			sendUserToast(`${config.modeError(modeVerb(mode))}: ${err.body}`, true)
+			loadTriggers()
+		}
+		return committed
+	}
+
+	async function deleteTrigger(row: TriggerW) {
+		const workspace = $operatingWorkspace ?? ''
+		if (triggerKind === 'postgres' || triggerKind === 'gcp' || triggerKind === 'azure') {
+			isDeleting = false
+			deleteA = false
+			deleteB = false
+			pendingDelete = row
+			return
+		}
+		if (!config.catchDelete) {
+			await config.remove({ workspace, path: row.path })
+			loadTriggers()
+			return
+		}
+		try {
+			await config.remove({ workspace, path: row.path })
+			if (config.deleteToastLabel) {
+				sendUserToast(`Successfully deleted ${config.deleteToastLabel}: ${row.path}`)
+			}
+			loadTriggers()
+		} catch (error) {
+			sendUserToast(error.body || error.message, true)
+		}
+	}
+
+	// Kinds whose trigger owns an external subscription (a replication slot and publication, a
+	// cloud subscription) confirm the delete, offering to drop those too.
+	let pendingDelete: TriggerW | undefined = $state(undefined)
+	let isDeleting = $state(false)
+	let deleteA = $state(false)
+	let deleteB = $state(false)
+
+	async function confirmPendingDelete() {
+		const row = pendingDelete
+		if (!row) return
+		const workspace = $operatingWorkspace ?? ''
+		isDeleting = true
+		const cleanups: (() => Promise<unknown>)[] = []
+		if (triggerKind === 'postgres') {
+			if (deleteA) {
+				cleanups.push(() =>
+					PostgresTriggerService.deletePostgresReplicationSlot({
+						workspace,
+						path: row.postgres_resource_path!,
+						requestBody: { name: row.replication_slot_name! }
+					})
+				)
+			}
+			if (deleteB) {
+				cleanups.push(() =>
+					PostgresTriggerService.deletePostgresPublication({
+						workspace,
+						path: row.postgres_resource_path!,
+						publication: row.publication_name!
+					})
+				)
+			}
+		} else if (triggerKind === 'gcp' && deleteA) {
+			const requestBody = { subscription_id: row.subscription_id!, project_id: row.project_id }
+			cleanups.push(() =>
+				row.gcp_resource_path
+					? GcpTriggerService.deleteGcpSubscription({
+							workspace,
+							path: row.gcp_resource_path,
+							requestBody
+						})
+					: GcpTriggerService.deleteGcpSubscriptionWithDefaultCredentials({
+							workspace,
+							requestBody
+						})
+			)
+		} else if (triggerKind === 'azure' && deleteA && row.subscription_name) {
+			cleanups.push(() =>
+				AzureTriggerService.deleteAzureSubscription({
+					workspace,
+					path: row.azure_resource_path!,
+					requestBody: {
+						azure_mode: row.azure_mode!,
+						scope_resource_id: row.scope_resource_id!,
+						topic_name: row.topic_name ?? undefined,
+						subscription_name: row.subscription_name!
+					}
+				})
+			)
+		}
+		for (const cleanup of cleanups) {
+			try {
+				sendUserToast((await cleanup()) as string)
+			} catch (error) {
+				isDeleting = false
+				sendUserToast(error.body || error.message, true)
+				return
+			}
+		}
+		const msg = (await config.remove({ workspace, path: row.path })) as string
+		sendUserToast(msg)
+		loadTriggers()
+		pendingDelete = undefined
+	}
+
+	// A host opens rows itself, and the document's hash is not this page's.
+	let hashHandled = false
+	$effect(() => {
+		if (hosted) return
+		if (!hashHandled && triggers.length > 0 && editor) {
+			let hash = $page.url.hash
+			if (hash.length > 1) {
+				let path = hash.slice(1)
+				let trigger = triggers.find((t) => t.path === path)
+				if (trigger) {
+					hashHandled = true
+					editor?.openEdit(path, trigger.is_flow)
+				}
+			}
+		}
+	})
+
+	let filteredItems: (TriggerW & { marked?: any })[] | undefined = $state([])
+	let filter = $state('')
+	let ownerFilter: string | undefined = $state(undefined)
+	let nbDisplayed = $state(15)
+
+	const TRIGGER_PATH_KIND_FILTER_SETTING = 'filter_path_of'
+	const FILTER_USER_FOLDER_SETTING_NAME = 'user_and_folders_only'
+	let selectedFilterKind = $state(
+		(getLocalSetting(TRIGGER_PATH_KIND_FILTER_SETTING) as 'trigger' | 'script_flow') ?? 'trigger'
+	)
+	let filterUserFolders = $state(getLocalSetting(FILTER_USER_FOLDER_SETTING_NAME) == 'true')
+
+	$effect(() => {
+		storeLocalSetting(TRIGGER_PATH_KIND_FILTER_SETTING, selectedFilterKind)
+	})
+	$effect(() => {
+		storeLocalSetting(FILTER_USER_FOLDER_SETTING_NAME, filterUserFolders ? 'true' : undefined)
+	})
+
+	// Read before the first write below, which would otherwise replace what the location asked for.
+	function loadQueryFilters(search: string) {
+		const params = new URLSearchParams(search)
+		const queryFilterKind = params.get(TRIGGER_PATH_KIND_FILTER_SETTING)
+		const queryFilterUserFolders = params.get(FILTER_USER_FOLDER_SETTING_NAME)
+		if (queryFilterKind) selectedFilterKind = queryFilterKind as 'trigger' | 'script_flow'
+		if (queryFilterUserFolders) filterUserFolders = queryFilterUserFolders == 'true'
+	}
+	untrack(() => loadQueryFilters(hosted ? hosted.search : window.location.search))
+	$effect(() => {
+		if (!hosted) return
+		const search = hosted.search
+		untrack(() => loadQueryFilters(search))
+	})
+
+	$effect(() => {
+		const kind = selectedFilterKind
+		const userFolders = String(filterUserFolders)
+		untrack(() => {
+			if (hosted) {
+				const params = new URLSearchParams(hosted.search)
+				params.set(TRIGGER_PATH_KIND_FILTER_SETTING, kind)
+				params.set(FILTER_USER_FOLDER_SETTING_NAME, userFolders)
+				const next = `?${params}`
+				if (next !== hosted.search) hosted.setSearch(next)
+				return
+			}
+			setQuery(TRIGGER_PATH_KIND_FILTER_SETTING, kind, window.location.hash || undefined).then(
+				() => {
+					setQuery(FILTER_USER_FOLDER_SETTING_NAME, userFolders, window.location.hash || undefined)
+				}
+			)
+		})
+	})
+
+	function filterItemsPathsBaseOnUserFilters(item: TriggerW) {
+		if ($operatingWorkspace == 'admins') return true
+		if (!filterUserFolders) return true
+		const path = selectedFilterKind === 'trigger' ? item.path : item.script_path
+		return !path.startsWith('u/') || path.startsWith('u/' + operatingUser.current?.username + '/')
+	}
+
+	const preFilteredItems = $derived(
+		triggers.filter(
+			(x) =>
+				(ownerFilter == undefined ||
+					(selectedFilterKind === 'trigger' ? x.path : x.script_path).startsWith(
+						ownerFilter + '/'
+					)) &&
+				filterItemsPathsBaseOnUserFilters(x)
+		)
+	)
+
+	let lastWorkspace = untrack(() => $operatingWorkspace)
+	$effect.pre(() => {
+		const workspace = $operatingWorkspace
+		if (workspace === lastWorkspace) return
+		lastWorkspace = workspace
+		ownerFilter = undefined
+	})
+
+	const owners = $derived(
+		Array.from(
+			new Set(
+				(filteredItems ?? [])
+					.map((x) => (selectedFilterKind === 'trigger' ? x.path : x.script_path))
+					.filter(Boolean)
+					.map((p) => p.split('/').slice(0, 2).join('/'))
+			)
+		).sort()
+	)
+
+	const items = $derived(filter !== '' ? filteredItems : preFilteredItems)
+
+	// A push delivery has no connection to report and no consumer to suspend: it is an endpoint.
+	function isLive(row: TriggerRow): boolean {
+		if (triggerKind === 'gcp') return row.delivery_type !== 'push'
+		if (triggerKind === 'azure') return row.azure_mode === 'namespace_pull'
+		return true
+	}
+
+	function copyUrl(row: TriggerRow): { label: string; value: string } | undefined {
+		switch (triggerKind) {
+			case 'http':
+				return {
+					label: 'Copy URL',
+					value: getHttpRoute(
+						'r',
+						row.route_path,
+						(row.workspaced_route ?? false) || globalHttpWorkspacedRoute,
+						row.workspace_id!
+					)
+				}
+			case 'gcp':
+			case 'azure':
+				return isLive(row)
+					? undefined
+					: {
+							label: 'Copy URL',
+							value: getHttpRoute(`${triggerKind}/w`, row.path, true, row.workspace_id!)
+						}
+			case 'email':
+				return { label: 'Copy email address', value: emailAddress(row) }
+			default:
+				return undefined
+		}
+	}
+
+	function emailAddress(row: TriggerRow) {
+		return getEmailAddress(
+			row.local_part,
+			row.workspaced_local_part ?? false,
+			row.workspace_id!,
+			emailDomain ?? ''
+		)
+	}
+
+	function websocketUrl(url: string) {
+		return url.startsWith('$script:')
+			? 'URL: ' + url.replace('$script:', 'result of script ')
+			: url.startsWith('$flow:')
+				? 'URL: ' + url.replace('$flow:', 'result of flow ')
+				: url
+	}
+
+	const operatorBlocked = $derived(
+		config.operatorGate &&
+			!!operatingUser.current?.operator &&
+			!!$operatingWorkspace &&
+			!$userWorkspaces.find((_) => _.id === $operatingWorkspace)?.operator_settings?.triggers
+	)
+	const canCreate = $derived(!config.adminOnly || isAdmin)
+</script>
+
+{#snippet rowTitle(row: TriggerW & { marked?: any }, hasDraft: boolean | undefined)}
+	{@const marked = ['http', 'websocket', 'kafka', 'nats', 'email'].includes(triggerKind)
+		? row.marked
+		: undefined}
+	<div class="text-emphasis flex-wrap text-left text-xs font-semibold mb-1 truncate">
+		{#if marked}
+			<span class="text-xs">
+				{@html marked}
+			</span>
+		{:else if triggerKind === 'http'}
+			{#if row.summary}
+				{row.summary}
+			{:else}
+				{row.http_method!.toUpperCase()}
+				/{isCloudHosted() || row.workspaced_route || globalHttpWorkspacedRoute
+					? row.workspace_id + '/' + row.route_path
+					: row.route_path}
+			{/if}
+		{:else if triggerKind === 'websocket'}
+			{websocketUrl(row.url!)}
+		{:else if triggerKind === 'kafka'}
+			{row.kafka_resource_path} - {row.topics!.join(', ')}
+		{:else if triggerKind === 'nats'}
+			{row.nats_resource_path} - {row.subjects!.join(', ')}
+		{:else if triggerKind === 'email'}
+			{emailAddress(row)}
+		{:else if triggerKind === 'gcp'}
+			{row.path} - {row.topic_id}
+		{:else if triggerKind === 'azure'}
+			{row.path} - {row.topic_name
+				? row.topic_name
+				: (row.scope_resource_id?.split('/')?.pop() ?? '')} ({row.azure_mode}, {row.subscription_name})
+		{:else}
+			{row.path}
+		{/if}{hasDraft ? '*' : ''}
+	</div>
+	{#if ['http', 'websocket', 'kafka', 'nats', 'email'].includes(triggerKind)}
+		<div class="text-secondary text-xs truncate text-left font-light">{row.path}</div>
+	{:else if triggerKind === 'postgres'}
+		<div class="text-secondary text-xs truncate text-left font-light">
+			{row.postgres_resource_path}
+		</div>
+	{/if}
+	<div class="text-secondary text-xs truncate text-left font-light">
+		{#if triggerKind === 'http' && row.static_asset_config}
+			file: {row.static_asset_config.s3}
+		{:else}
+			runnable: {row.script_path}
+		{/if}
+	</div>
+{/snippet}
+
+{#snippet statusDot(row: TriggerW)}
+	{@const status = config.status}
+	{#if status}
+		{@const ping = status.pings
+			? row.last_server_ping
+				? new Date(row.last_server_ping)
+				: undefined
+			: new Date()}
+		{@const pinging = ping && ping.getTime() > new Date().getTime() - 15 * 1000}
+		{@const effectiveMode = row.draft_only ? 'disabled' : row.mode}
+		{@const enabled = effectiveMode === 'enabled' || effectiveMode === 'suspended'}
+		<div class="w-10">
+			{#if (enabled && (!pinging || row.error)) || (!enabled && row.error) || (enabled && !row.server_id)}
+				<Popover notClickable>
+					<span class="flex h-4 w-4">
+						<Circle class="text-red-600 animate-ping absolute inline-flex fill-current" size={12} />
+						<Circle class="text-red-600 relative inline-flex fill-current" size={12} />
+					</span>
+					{#snippet text()}
+						<div>
+							{#if enabled}
+								{#if !row.server_id}
+									{status.starting}
+								{:else}
+									{status.notConnected}{row.error ? ': ' + row.error : ''}
+								{/if}
+							{:else}
+								{status.disabled}: {row.error}
+							{/if}
+						</div>
+					{/snippet}
+				</Popover>
+			{:else if enabled}
+				<Popover notClickable>
+					<span class="flex h-4 w-4">
+						<Circle class="text-green-600 relative inline-flex fill-current" size={12} />
+					</span>
+					{#snippet text()}
+						<div>
+							{status.connected}{status.shuttingDown && !row.server_id ? ' (shutting down...)' : ''}
+						</div>
+					{/snippet}
+				</Popover>
+			{/if}
+		</div>
+	{/if}
+{/snippet}
+
+<ConfirmationModal
+	open={pendingDelete !== undefined}
+	title={triggerKind === 'postgres'
+		? 'Delete Postgres trigger'
+		: triggerKind === 'gcp'
+			? 'Delete GCP Pub/Sub trigger'
+			: 'Delete Azure Event Grid trigger'}
+	confirmationText="Remove"
+	loading={isDeleting}
+	on:canceled={() => {
+		isDeleting = false
+		pendingDelete = undefined
+	}}
+	on:confirmed={confirmPendingDelete}
+>
+	<div class="flex flex-col w-full space-y-4">
+		<span>Are you sure you want to remove this trigger?</span>
+		{#if pendingDelete && triggerKind === 'postgres'}
+			<Toggle
+				options={{
+					left: `Delete the associated replication slot named: ${pendingDelete.replication_slot_name} ?`
+				}}
+				bind:checked={deleteA}
+			/>
+			<Toggle
+				options={{
+					left: `Delete the associated publication named: ${pendingDelete.publication_name} ?`
+				}}
+				bind:checked={deleteB}
+			/>
+		{:else if pendingDelete && triggerKind === 'gcp'}
+			<Toggle
+				options={{
+					left: `Delete subscription "${pendingDelete.subscription_id}" subscribed to topic "${pendingDelete.topic_id}"?`
+				}}
+				bind:checked={deleteA}
+			/>
+		{:else if pendingDelete?.subscription_name && triggerKind === 'azure'}
+			<Toggle
+				options={{
+					left: `Also delete Azure subscription "${pendingDelete.subscription_name}" on Azure?`
+				}}
+				bind:checked={deleteA}
+			/>
+		{/if}
+	</div>
+</ConfirmationModal>
+
+<DeployWorkspaceDrawer bind:this={deploymentDrawer} />
+{#await EDITORS[triggerKind]() then Editor}
+	<Editor.default onUpdate={loadTriggers} bind:this={editor} />
+{/await}
+{#if triggerKind === 'http'}
+	{#await import('./http/RoutesGenerator.svelte') then Generator}
+		<Generator.default closeFn={loadTriggers} bind:this={routesGenerator} />
+	{/await}
+	{#await import('./http/OpenAPISpecGenerator.svelte') then Generator}
+		<Generator.default bind:this={openAPISpecGenerator} />
+	{/await}
+{/if}
+
+<SearchItems
+	{filter}
+	items={preFilteredItems}
+	bind:filteredItems
+	f={(x) => (x.summary ?? '') + ' ' + x.path + ' (' + x.script_path + ')'}
+/>
+
+{#if operatorBlocked}
+	<div class="bg-red-100 border-l-4 border-red-600 text-orange-700 p-4 m-4 mt-12" role="alert">
+		<p class="font-bold">Unauthorized</p>
+		<p>Page not available for operators</p>
+	</div>
+{:else}
+	<CenteredPage>
+		<PageHeader
+			title={config.title}
+			tooltip={config.tooltip}
+			documentationLink={config.documentationLink}
+		>
+			<div class="flex flex-row gap-2">
+				{#if triggerKind === 'http'}
+					<Button
+						unifiedSize="md"
+						variant="default"
+						startIcon={{ icon: Plus }}
+						on:click={() => routesGenerator?.openDrawer()}
+					>
+						From OpenAPI spec
+					</Button>
+					<Button
+						unifiedSize="md"
+						variant="default"
+						startIcon={{ icon: Plus }}
+						on:click={() => openAPISpecGenerator?.openDrawer()}
+					>
+						To OpenAPI spec
+					</Button>
+				{/if}
+				{#if canCreate}
+					<Button
+						unifiedSize="md"
+						variant="accent"
+						startIcon={{ icon: Plus }}
+						on:click={() => editor?.openNew(false)}
+					>
+						New&nbsp;{config.newLabel}
+					</Button>
+				{/if}
+			</div>
+		</PageHeader>
+
+		{#if config.cloudDisabled && isCloudHosted()}
+			<Alert title="Not compatible with multi-tenant cloud" type="warning">
+				{config.title} are disabled in the multi-tenant cloud.
+			</Alert>
+			<div class="py-4"></div>
+		{/if}
+		<div class="w-full h-full flex flex-col">
+			<div class="w-full pb-4 pt-6">
+				<input
+					type="text"
+					placeholder={config.searchPlaceholder}
+					bind:value={filter}
+					class="search-item"
+				/>
+				<div class="flex flex-row items-center gap-2 mt-2">
+					<div class="text-xs font-semibold text-emphasis shrink-0"> Filter by path of </div>
+					<ToggleButtonGroup bind:selected={selectedFilterKind}>
+						{#snippet children({ item })}
+							<ToggleButton value="trigger" label={config.filterLabel} icon={Icon} {item} />
+							<ToggleButton value="script_flow" label="Script/Flow" icon={Code} {item} />
+						{/snippet}
+					</ToggleButtonGroup>
+				</div>
+				<ListFilters syncQuery bind:selectedFilter={ownerFilter} filters={owners} />
+
+				<div class="flex flex-row items-center justify-end gap-4">
+					{#if operatingUser.current?.is_super_admin && operatingUser.current.username.includes('@')}
+						<Toggle size="xs" bind:checked={filterUserFolders} options={{ right: 'Only f/*' }} />
+					{:else if isAdmin}
+						<Toggle
+							size="xs"
+							bind:checked={filterUserFolders}
+							options={{ right: `Only u/${operatingUser.current?.username} and f/*` }}
+						/>
+					{/if}
+				</div>
+			</div>
+			{#if loading}
+				{#each new Array(6) as _}
+					<Skeleton layout={[[6], 0.4]} />
+				{/each}
+			{:else if !triggers?.length}
+				<EmptyState
+					icon={Icon}
+					title={config.empty.title}
+					description={config.empty.description}
+					action={canCreate
+						? {
+								label: config.empty.actionLabel,
+								icon: Plus,
+								onClick: () => editor?.openNew(false),
+								aiId: config.empty.aiId,
+								aiDescription: config.empty.aiDescription
+							}
+						: undefined}
+				/>
+			{:else if items?.length}
+				<div class="border rounded-md divide-y">
+					{#each items.slice(0, nbDisplayed) as row (row.path)}
+						{@const {
+							path,
+							edited_by,
+							edited_at,
+							script_path,
+							is_flow,
+							extra_perms,
+							canWrite,
+							mode,
+							retry,
+							error_handler_path,
+							error_handler_args,
+							labels,
+							draft_only,
+							is_draft
+						} = row}
+						{@const hasDraft =
+							getLocalDraftHint($operatingWorkspace, config.draftKind, path) ?? is_draft}
+						{@const href = `${is_flow ? '/flows/get' : '/scripts/get'}/${script_path}`}
+						{@const effectiveMode = draft_only ? 'disabled' : mode}
+						{@const live = isLive(row)}
+						{@const copy = copyUrl(row)}
+
+						<div
+							class="bg-surface-tertiary hover:bg-surface-hover w-full items-center px-4 py-2 gap-4 first-of-type:!border-t-0
+				first-of-type:rounded-t-md last-of-type:rounded-b-md flex flex-col"
+						>
+							<div class="w-full flex gap-5 items-center">
+								<RowIcon kind={is_flow ? 'flow' : 'script'} />
+
+								<a
+									href="#{path}"
+									onclick={(e) => {
+										if (hosted) e.preventDefault()
+										openEdit(path, is_flow)
+									}}
+									class="min-w-0 grow hover:underline decoration-gray-400"
+								>
+									{@render rowTitle(row, hasDraft)}
+								</a>
+
+								<div class="hidden lg:flex flex-row gap-1 items-center">
+									<SharedBadge {canWrite} extraPerms={extra_perms} />
+									{#if triggerKind !== 'http' && triggerKind !== 'azure' && labels?.length}
+										{#each labels as label}
+											<Badge color="blue" small class="px-1" title="Label: {label}">{label}</Badge>
+										{/each}
+									{/if}
+								</div>
+
+								{#if live}
+									{@render statusDot(row)}
+								{/if}
+
+								<div class="flex items-center justify-end gap-2 shrink-0 min-w-[8rem]">
+									<DraftBadge {draft_only} is_draft={hasDraft} />
+									{#if live}
+										<TriggerModeToggle
+											disabled={draft_only}
+											title={draft_only
+												? 'Draft only: deploy the trigger to enable it'
+												: hasDraft
+													? 'Enables/disables the deployed trigger; the draft is not affected'
+													: undefined}
+											onToggleMode={(newMode) => onToggleMode(path, newMode)}
+											triggerMode={effectiveMode}
+											includeModalConfig={{
+												triggerPath: path,
+												triggerKind,
+												runnableConfig: {
+													path: script_path,
+													kind: is_flow ? 'flow' : 'script',
+													retry,
+													errorHandlerPath: error_handler_path,
+													errorHandlerArgs: error_handler_args
+												}
+											}}
+											{canWrite}
+											hideToggleLabels
+											hideDropdown
+										/>
+									{/if}
+								</div>
+
+								<div class="flex gap-2 items-center justify-end">
+									{#if copy}
+										<Button
+											on:click={() => copyToClipboard(copy.value)}
+											variant="subtle"
+											unifiedSize="md"
+											startIcon={{ icon: ClipboardCopy }}
+										>
+											{copy.label}
+										</Button>
+									{/if}
+									<Button
+										on:click={() => openEdit(path, is_flow)}
+										unifiedSize="md"
+										startIcon={canWrite ? { icon: Pen } : { icon: Eye }}
+										variant="subtle"
+									>
+										{canWrite ? 'Edit' : 'View'}
+									</Button>
+									<Dropdown
+										items={[
+											{
+												displayName: `View ${is_flow ? 'Flow' : 'Script'}`,
+												icon: Eye,
+												action: () => openLink(href)
+											},
+											...(canWrite && !draft_only && mode !== 'suspended'
+												? [
+														{
+															displayName: 'Suspend job execution',
+															icon: Pause,
+															action: () => {
+																onToggleMode(path, 'suspended')
+															}
+														}
+													]
+												: []),
+											{
+												displayName: canWrite ? 'Edit' : 'View',
+												icon: canWrite ? Pen : Eye,
+												action: () => openEdit(path, is_flow)
+											},
+											...(isDeployable('trigger', path, deployUiSettings)
+												? [
+														{
+															displayName: 'Deploy to prod/staging',
+															icon: FileUp,
+															action: () => {
+																deploymentDrawer?.openDrawer(path, 'trigger', {
+																	triggers: { kind: config.deployKind }
+																})
+															}
+														}
+													]
+												: []),
+											{
+												displayName: 'Audit logs',
+												icon: Eye,
+												href: `${base}/audit_logs?resource=${path}`
+											},
+											{
+												displayName: 'Permissions',
+												icon: Shield,
+												action: () => {
+													shareModal?.openDrawer(path, config.shareKind as any)
+												}
+											},
+											{
+												displayName: 'Delete',
+												type: 'delete',
+												icon: Trash,
+												disabled: !canWrite || (config.adminOnly && !isAdmin),
+												action: () => deleteTrigger(row)
+											}
+										]}
+									/>
+								</div>
+							</div>
+							<div class="w-full flex justify-end items-baseline">
+								<div
+									class="flex flex-wrap text-2xs font-normal text-secondary gap-1 items-center justify-end truncate pr-2"
+								>
+									{#if edited_by}<div class="truncate">edited by {edited_by}</div>{/if}
+									<div class="truncate">{edited_by ? 'at ' : ''}{displayDate(edited_at)}</div>
+								</div>
+							</div>
+						</div>
+					{/each}
+				</div>
+			{:else}
+				<NoItemFound />
+			{/if}
+		</div>
+		{#if items && items?.length > 15 && nbDisplayed < items.length}
+			<span class="text-xs font-normal text-primary"
+				>{nbDisplayed} items out of {items.length}
+				<button class="ml-4 font-semibold text-emphasis" onclick={() => (nbDisplayed += 30)}
+					>load 30 more</button
+				></span
+			>
+		{/if}
+	</CenteredPage>
+{/if}
+
+<ShareModal
+	bind:this={shareModal}
+	on:change={() => {
+		loadTriggers()
+	}}
+/>
diff --git a/frontend/src/lib/components/triggers/TriggerSuspendedJobsModal.svelte b/frontend/src/lib/components/triggers/TriggerSuspendedJobsModal.svelte
index 98bff3c722..cc00e398ec 100644
--- a/frontend/src/lib/components/triggers/TriggerSuspendedJobsModal.svelte
+++ b/frontend/src/lib/components/triggers/TriggerSuspendedJobsModal.svelte
@@ -19,8 +19,6 @@
 		TriggerMode
 	} from '$lib/gen/types.gen'
 	import Button from '../common/button/Button.svelte'
-	import { workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import { JobService, TriggerService } from '$lib/gen'
 	import { sendUserToast } from '$lib/toast'
 	import Cell from '$lib/components/table/Cell.svelte'
@@ -39,6 +37,7 @@
 		errorHandlerArgs,
 		slackErrorHandlerHubPathEnding
 	} from '../ErrorOrRecoveryHandler.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	type Props = {
 		triggerPath: string
@@ -49,8 +48,8 @@
 	}
 
 	let { triggerKind, triggerPath, onToggleMode, hasChanged, runnableConfig }: Props = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	let shouldShowModal = $state(false)
 	let queuedJobs = $state<QueuedJob[]>([])
diff --git a/frontend/src/lib/components/triggers/TriggerTokens.svelte b/frontend/src/lib/components/triggers/TriggerTokens.svelte
index 044b89022a..e480480131 100644
--- a/frontend/src/lib/components/triggers/TriggerTokens.svelte
+++ b/frontend/src/lib/components/triggers/TriggerTokens.svelte
@@ -2,13 +2,13 @@
 	import { run } from 'svelte/legacy'
 
 	import { FlowService, ScriptService, UserService, type TruncatedToken } from '$lib/gen'
-	import { userStore, workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+	import { userStore } from '$lib/stores'
 	import { getContext } from 'svelte'
 	import { Skeleton } from '../common'
 	import Label from '../Label.svelte'
 	import type { TriggerContext } from '../triggers'
 	import { capitalize } from '$lib/utils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		isFlow: boolean
@@ -17,8 +17,8 @@
 	}
 
 	let { isFlow, path, labelPrefix }: Props = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	const { triggersCount } = getContext<TriggerContext>('TriggerContext')
 
diff --git a/frontend/src/lib/components/triggers/TriggersEditor.svelte b/frontend/src/lib/components/triggers/TriggersEditor.svelte
index 4b7733ac33..ae32345907 100644
--- a/frontend/src/lib/components/triggers/TriggersEditor.svelte
+++ b/frontend/src/lib/components/triggers/TriggersEditor.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-	import { userStore, workspaceStore } from '$lib/stores'
+	import { userStore } from '$lib/stores'
 	import FlowCard from '../flows/common/FlowCard.svelte'
 	import { getContext, onDestroy, createEventDispatcher } from 'svelte'
 	import type { TriggerContext } from '$lib/components/triggers'
@@ -38,6 +38,9 @@
 	import { sendUserToast } from '$lib/toast'
 	import Alert from '../common/alert/Alert.svelte'
 	import type { FlowEditorContext } from '../flows/types'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		noEditor: boolean
@@ -137,13 +140,13 @@
 		try {
 			if (nativeServiceName) {
 				await NativeTriggerService.deleteNativeTrigger({
-					workspace: $workspaceStore ?? '',
+					workspace: $operatingWorkspace ?? '',
 					serviceName: nativeServiceName,
 					externalId: triggerPath ?? ''
 				})
 			} else if (deleteHandler) {
 				await deleteHandler()({
-					workspace: $workspaceStore ?? '',
+					workspace: $operatingWorkspace ?? '',
 					path: triggerPath ?? ''
 				})
 			} else {
@@ -187,7 +190,7 @@
 		if (triggerType === 'schedule') {
 			await triggersState.fetchSchedules(
 				triggersCount,
-				$workspaceStore,
+				$operatingWorkspace,
 				currentPath,
 				isFlow,
 				undefined,
@@ -196,7 +199,7 @@
 		} else if (triggerType === 'websocket') {
 			await triggersState.fetchWebsocketTriggers(
 				triggersCount,
-				$workspaceStore,
+				$operatingWorkspace,
 				currentPath,
 				isFlow,
 				$userStore
@@ -204,7 +207,7 @@
 		} else if (triggerType === 'postgres') {
 			await triggersState.fetchPostgresTriggers(
 				triggersCount,
-				$workspaceStore,
+				$operatingWorkspace,
 				currentPath,
 				isFlow,
 				$userStore
@@ -212,7 +215,7 @@
 		} else if (triggerType === 'kafka') {
 			await triggersState.fetchKafkaTriggers(
 				triggersCount,
-				$workspaceStore,
+				$operatingWorkspace,
 				currentPath,
 				isFlow,
 				$userStore
@@ -220,7 +223,7 @@
 		} else if (triggerType === 'nats') {
 			await triggersState.fetchNatsTriggers(
 				triggersCount,
-				$workspaceStore,
+				$operatingWorkspace,
 				currentPath,
 				isFlow,
 				$userStore
@@ -228,7 +231,7 @@
 		} else if (triggerType === 'gcp') {
 			await triggersState.fetchGcpTriggers(
 				triggersCount,
-				$workspaceStore,
+				$operatingWorkspace,
 				currentPath,
 				isFlow,
 				$userStore
@@ -236,7 +239,7 @@
 		} else if (triggerType === 'azure') {
 			await triggersState.fetchAzureTriggers(
 				triggersCount,
-				$workspaceStore,
+				$operatingWorkspace,
 				currentPath,
 				isFlow,
 				$userStore
@@ -244,7 +247,7 @@
 		} else if (triggerType === 'sqs') {
 			await triggersState.fetchSqsTriggers(
 				triggersCount,
-				$workspaceStore,
+				$operatingWorkspace,
 				currentPath,
 				isFlow,
 				$userStore
@@ -252,7 +255,7 @@
 		} else if (triggerType === 'mqtt') {
 			await triggersState.fetchMqttTriggers(
 				triggersCount,
-				$workspaceStore,
+				$operatingWorkspace,
 				currentPath,
 				isFlow,
 				$userStore
@@ -260,7 +263,7 @@
 		} else if (triggerType === 'amqp') {
 			await triggersState.fetchAmqpTriggers(
 				triggersCount,
-				$workspaceStore,
+				$operatingWorkspace,
 				currentPath,
 				isFlow,
 				$userStore
@@ -268,7 +271,7 @@
 		} else if (triggerType === 'http') {
 			await triggersState.fetchHttpTriggers(
 				triggersCount,
-				$workspaceStore,
+				$operatingWorkspace,
 				currentPath,
 				isFlow,
 				$userStore
@@ -276,7 +279,7 @@
 		} else if (triggerType === 'email') {
 			await triggersState.fetchEmailTriggers(
 				triggersCount,
-				$workspaceStore,
+				$operatingWorkspace,
 				currentPath,
 				isFlow,
 				$userStore
@@ -285,7 +288,7 @@
 			await triggersState.fetchNativeTriggers(
 				triggersCount,
 				'nextcloud',
-				$workspaceStore,
+				$operatingWorkspace,
 				currentPath,
 				isFlow,
 				$userStore
@@ -294,7 +297,7 @@
 			await triggersState.fetchNativeTriggers(
 				triggersCount,
 				'google',
-				$workspaceStore,
+				$operatingWorkspace,
 				currentPath,
 				isFlow,
 				$userStore
@@ -303,7 +306,7 @@
 			await triggersState.fetchNativeTriggers(
 				triggersCount,
 				'github',
-				$workspaceStore,
+				$operatingWorkspace,
 				currentPath,
 				isFlow,
 				$userStore
diff --git a/frontend/src/lib/components/triggers/amqp/AmqpEditorConfigSection.svelte b/frontend/src/lib/components/triggers/amqp/AmqpEditorConfigSection.svelte
index 72b6f6360a..8e73e32d78 100644
--- a/frontend/src/lib/components/triggers/amqp/AmqpEditorConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/amqp/AmqpEditorConfigSection.svelte
@@ -13,8 +13,7 @@
 	import TestTriggerConnection from '../TestTriggerConnection.svelte'
 	import Tooltip from '$lib/components/Tooltip.svelte'
 	import TestingBadge from '../testingBadge.svelte'
-	import { workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		can_write?: boolean
@@ -36,8 +35,8 @@
 		showTestingBadge = false
 	}: Props = $props()
 
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	// Toggling the exchange binding on/off. Off means the queue is consumed
 	// directly with no exchange binding.
diff --git a/frontend/src/lib/components/triggers/amqp/AmqpTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/amqp/AmqpTriggerEditorInner.svelte
index 9fb44491bb..3afcdf1a43 100644
--- a/frontend/src/lib/components/triggers/amqp/AmqpTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/amqp/AmqpTriggerEditorInner.svelte
@@ -10,8 +10,7 @@
 	import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
 	import Path from '$lib/components/Path.svelte'
 	import TriggerRunnablePicker from '$lib/components/triggers/TriggerRunnablePicker.svelte'
-	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+	import { usedTriggerKinds } from '$lib/stores'
 	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import Section from '$lib/components/Section.svelte'
@@ -42,9 +41,17 @@
 	import { deepEqual } from 'fast-equals'
 	import { useTriggerDraftSync } from '../useTriggerDraftSync.svelte'
 	import LocalDraftBanner from '$lib/components/LocalDraftBanner.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		useDrawer?: boolean
+		/** With `useDrawer`, render the drawer's content in place, filling the parent, with no drawer or close button. */
+		inline?: boolean
+		/** With `inline`, closes whatever hosts the editor; the header has a close button only when set. */
+		onClose?: () => void
 		description?: Snippet | undefined
 		hideTarget?: boolean
 		hideTooltips?: boolean
@@ -63,6 +70,8 @@
 
 	let {
 		useDrawer = true,
+		inline = false,
+		onClose = undefined,
 		description = undefined,
 		hideTarget = false,
 		hideTooltips = false,
@@ -78,8 +87,10 @@
 		onReset = undefined,
 		cloudDisabled = false
 	}: Props = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	const wsId = $derived($operatingWorkspace)
 
 	let amqp_resource_path: string = $state('')
 	let drawer: Drawer | undefined = $state(undefined)
@@ -94,7 +105,13 @@
 	let pathError = $state('')
 	let mode = $state<TriggerMode>('enabled')
 	let dirtyPath = $state(false)
-	let can_write = $state(true)
+	let permsPath = $state<string | undefined>(undefined)
+	let permsForWrite = $state<Record<string, boolean> | undefined>(undefined)
+	// The acting user in the operating workspace arrives asynchronously, and an unknown user
+	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
+	const can_write = $derived(
+		permsPath === undefined ? true : canWrite(permsPath, permsForWrite ?? {}, actingUser)
+	)
 	let drawerLoading = $state(true)
 	let showLoading = $state(false)
 	let queue_name: string = $state('')
@@ -158,6 +175,8 @@
 		defaultConfig?: Record<string, any>,
 		fixedScriptPath_?: string
 	) {
+		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
+		operatingUser.forgetFailures()
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100) // Do not show loading spinner for the first 100ms
@@ -229,6 +248,8 @@
 	}
 
 	async function loadTriggerConfig(cfg?: Record<string, any>): Promise<void> {
+		// The loaded trigger says what it runs; an opener's `isFlow` is only its guess.
+		if (cfg?.is_flow !== undefined) itemKind = cfg.is_flow ? 'flow' : 'script'
 		try {
 			amqp_resource_path = cfg?.amqp_resource_path
 			queue_name = cfg?.queue_name ?? ''
@@ -240,7 +261,8 @@
 			is_flow = cfg?.is_flow
 			path = cfg?.path
 			mode = cfg?.mode ?? 'enabled'
-			can_write = canWrite(cfg?.path, cfg?.extra_perms, $userStore)
+			permsPath = cfg?.path
+			permsForWrite = cfg?.extra_perms
 			error_handler_path = cfg?.error_handler_path
 			error_handler_args = cfg?.error_handler_args ?? {}
 			retry = cfg?.retry
@@ -397,36 +419,44 @@
 	/>
 {/if}
 
-{#if useDrawer}
+{#snippet drawerBody()}
+	<DrawerContent
+		hideClose={inline && !onClose}
+		fullScreen={!inline}
+		bannerReserved={draftSync.hasBaseline}
+		title={edit
+			? can_write
+				? `Edit AMQP trigger ${initialPath}`
+				: `AMQP trigger ${initialPath}`
+			: 'New AMQP trigger'}
+		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
+	>
+		{#snippet actions()}
+			{@render actionsSnippet()}
+		{/snippet}
+		{#snippet banner()}
+			<LocalDraftBanner
+				show={draftSync.hasDraft}
+				getDeployed={() => draftSync.deployed}
+				reserveSpace={draftSync.hasBaseline}
+				getCurrent={() => draftSync.current}
+				onDiscard={() => draftSync.resetToDeployed(initialPath)}
+				disabled={!can_write}
+			/>
+		{/snippet}
+		{@render config()}
+	</DrawerContent>
+{/snippet}
+
+{#if useDrawer && inline}
+	{@render drawerBody()}
+{:else if useDrawer}
 	<Drawer
 		size="800px"
 		bind:this={drawer}
 		on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.amqp.path)}
 	>
-		<DrawerContent
-			bannerReserved={draftSync.hasBaseline}
-			title={edit
-				? can_write
-					? `Edit AMQP trigger ${initialPath}`
-					: `AMQP trigger ${initialPath}`
-				: 'New AMQP trigger'}
-			on:close={drawer.closeDrawer}
-		>
-			{#snippet actions()}
-				{@render actionsSnippet()}
-			{/snippet}
-			{#snippet banner()}
-				<LocalDraftBanner
-					show={draftSync.hasDraft}
-					getDeployed={() => draftSync.deployed}
-					reserveSpace={draftSync.hasBaseline}
-					getCurrent={() => draftSync.current}
-					onDiscard={() => draftSync.resetToDeployed(initialPath)}
-					disabled={!can_write}
-				/>
-			{/snippet}
-			{@render config()}
-		</DrawerContent>
+		{@render drawerBody()}
 	</Drawer>
 {:else}
 	<Section label={!customLabel ? 'AMQP trigger' : ''} headerClass="grow min-w-0 h-[30px]">
@@ -523,7 +553,7 @@
 						bind:scriptPath={script_path}
 						{initialScriptPath}
 						canWrite={can_write}
-						isOperator={!!$userStore?.operator}
+						isOperator={!!actingUser?.operator}
 					/>
 				</Section>
 			{/if}
diff --git a/frontend/src/lib/components/triggers/azure/AzureTriggerEditorConfigSection.svelte b/frontend/src/lib/components/triggers/azure/AzureTriggerEditorConfigSection.svelte
index 992fab62b6..f6442d71ef 100644
--- a/frontend/src/lib/components/triggers/azure/AzureTriggerEditorConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/azure/AzureTriggerEditorConfigSection.svelte
@@ -10,7 +10,7 @@
 	import type { AzureMode, AzureArmResource } from '$lib/gen'
 	import { AzureTriggerService } from '$lib/gen'
 	import { emptyStringTrimmed } from '$lib/utils'
-	import { workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 	import { RefreshCw } from 'lucide-svelte'
 
 	interface Props {
@@ -38,6 +38,8 @@
 		event_type_filters = $bindable(),
 		path = ''
 	}: Props = $props()
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	type Edition = 'basic' | 'namespace'
 	type Delivery = 'push' | 'pull'
@@ -64,8 +66,8 @@
 	})
 
 	$effect(() => {
-		if (emptyStringTrimmed(subscription_name) && !emptyStringTrimmed(path) && $workspaceStore) {
-			const generated = `windmill-${$workspaceStore}-${path.replaceAll(/[^A-Za-z0-9-]/g, '-')}`
+		if (emptyStringTrimmed(subscription_name) && !emptyStringTrimmed(path) && wsId) {
+			const generated = `windmill-${wsId}-${path.replaceAll(/[^A-Za-z0-9-]/g, '-')}`
 			subscription_name = generated.slice(0, 50)
 		}
 	})
@@ -90,7 +92,7 @@
 	let scopeError = $state<string | undefined>(undefined)
 
 	async function loadScopeResources() {
-		if (!$workspaceStore || emptyStringTrimmed(azure_resource_path)) {
+		if (!wsId || emptyStringTrimmed(azure_resource_path)) {
 			scopeResources = []
 			return
 		}
@@ -99,11 +101,11 @@
 		try {
 			const result = is_namespace
 				? await AzureTriggerService.listAzureNamespaces({
-						workspace: $workspaceStore,
+						workspace: wsId,
 						path: azure_resource_path
 					})
 				: await AzureTriggerService.listAzureBasicTopics({
-						workspace: $workspaceStore,
+						workspace: wsId,
 						path: azure_resource_path
 					})
 			scopeResources = result
@@ -143,7 +145,7 @@
 	async function loadTopics() {
 		if (
 			!is_namespace ||
-			!$workspaceStore ||
+			!wsId ||
 			emptyStringTrimmed(azure_resource_path) ||
 			emptyStringTrimmed(scope_resource_id)
 		) {
@@ -154,7 +156,7 @@
 		topicsError = undefined
 		try {
 			const result = await AzureTriggerService.listAzureNamespaceTopics({
-				workspace: $workspaceStore,
+				workspace: wsId,
 				path: azure_resource_path,
 				requestBody: { scope_resource_id }
 			})
diff --git a/frontend/src/lib/components/triggers/azure/AzureTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/azure/AzureTriggerEditorInner.svelte
index e7063a92bb..12b6bf0533 100644
--- a/frontend/src/lib/components/triggers/azure/AzureTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/azure/AzureTriggerEditorInner.svelte
@@ -8,7 +8,7 @@
 	import Drawer from '$lib/components/common/drawer/Drawer.svelte'
 	import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
 	import Path from '$lib/components/Path.svelte'
-	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
+	import { usedTriggerKinds } from '$lib/stores'
 	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import { Loader2 } from 'lucide-svelte'
@@ -39,6 +39,11 @@
 	import Tab from '$lib/components/common/tabs/Tab.svelte'
 	import TriggerRetriesAndErrorHandler from '../TriggerRetriesAndErrorHandler.svelte'
 	import TriggerAdvancedBadges from '../TriggerAdvancedBadges.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace,
+		useOperatingWorkspaceHref
+	} from '$lib/components/operatingWorkspace.svelte'
 
 	let drawer: Drawer | undefined = $state(undefined)
 	let initialPath = $state('')
@@ -51,7 +56,15 @@
 	let pathError = $state('')
 	let mode = $state<TriggerMode>('enabled')
 	let dirtyPath = $state(false)
-	let can_write = $state(true)
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	let permsPath = $state<string | undefined>(undefined)
+	let permsForWrite = $state<Record<string, boolean> | undefined>(undefined)
+	// The acting user in the operating workspace arrives asynchronously, and an unknown user
+	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
+	const can_write = $derived(
+		permsPath === undefined ? true : canWrite(permsPath, permsForWrite ?? {}, actingUser)
+	)
 	let drawerLoading = $state(true)
 
 	let azure_resource_path: string = $state('')
@@ -79,6 +92,8 @@
 
 	let {
 		useDrawer = true,
+		inline = false,
+		onClose = undefined,
 		description = undefined,
 		hideTarget = false,
 		hideTooltips = false,
@@ -95,6 +110,10 @@
 		cloudDisabled = false
 	}: {
 		useDrawer?: boolean
+		/** With `useDrawer`, render the drawer's content in place, filling the parent, with no drawer or close button. */
+		inline?: boolean
+		/** With `inline`, closes whatever hosts the editor; the header has a close button only when set. */
+		onClose?: () => void
 		description?: Snippet | undefined
 		hideTarget?: boolean
 		hideTooltips?: boolean
@@ -110,6 +129,9 @@
 		onReset?: () => void
 		cloudDisabled?: boolean
 	} = $props()
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingHref = useOperatingWorkspaceHref()
+	const wsId = $derived($operatingWorkspace)
 
 	let hasChanged = $derived(!deepEqual(getAzureConfig(), originalConfig ?? {}))
 	const azureConfig = $derived.by(getAzureConfig)
@@ -117,7 +139,7 @@
 	const draftSync = useTriggerDraftSync({
 		itemKind: 'trigger_azure',
 		path: () => initialPath,
-		workspace: () => $workspaceStore,
+		workspace: () => wsId,
 		drawerLoading: () => drawerLoading,
 		getCfg: () => azureConfig,
 		applyCfg: loadTriggerConfig,
@@ -133,6 +155,8 @@
 		isFlow: boolean,
 		defaultValues?: Record<string, any>
 	) {
+		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
+		operatingUser.forgetFailures()
 		drawerLoading = true
 		try {
 			drawer?.openDrawer()
@@ -205,7 +229,7 @@
 		}
 		try {
 			const s = await AzureTriggerService.getAzureTrigger({
-				workspace: $workspaceStore!,
+				workspace: wsId!,
 				path: initialPath,
 				getDraft: true
 			})
@@ -224,6 +248,8 @@
 	}
 
 	async function loadTriggerConfig(cfg?: Record<string, any>): Promise<void> {
+		// The loaded trigger says what it runs; an opener's `isFlow` is only its guess.
+		if (cfg?.is_flow !== undefined) itemKind = cfg.is_flow ? 'flow' : 'script'
 		script_path = cfg?.script_path
 		initialScriptPath = cfg?.script_path
 		azure_resource_path = cfg?.azure_resource_path
@@ -234,7 +260,8 @@
 		event_type_filters = cfg?.event_type_filters
 		path = cfg?.path
 		mode = cfg?.mode ?? 'enabled'
-		can_write = canWrite(cfg?.path, cfg?.extra_perms, $userStore)
+		permsPath = cfg?.path
+		permsForWrite = cfg?.extra_perms
 		error_handler_path = cfg?.error_handler_path
 		error_handler_args = cfg?.error_handler_args ?? {}
 		retry = cfg?.retry
@@ -249,13 +276,7 @@
 		const previousPath = initialPath
 		const cfg = azureConfig
 		if (!cfg) return
-		const isSaved = await saveAzureTriggerFromCfg(
-			initialPath,
-			cfg,
-			edit,
-			$workspaceStore!,
-			usedTriggerKinds
-		)
+		const isSaved = await saveAzureTriggerFromCfg(initialPath, cfg, edit, wsId!, usedTriggerKinds)
 		if (isSaved) {
 			draftSync.discard(previousPath, getAzureConfig())
 			onUpdate?.(cfg.path)
@@ -309,7 +330,7 @@
 				(force) =>
 					AzureTriggerService.setAzureTriggerMode({
 						path: initialPath,
-						workspace: $workspaceStore ?? '',
+						workspace: wsId ?? '',
 						requestBody: { mode: newMode, force }
 					}),
 				'Azure trigger'
@@ -353,36 +374,44 @@
 	/>
 {/if}
 
-{#if useDrawer}
+{#snippet drawerBody()}
+	<DrawerContent
+		hideClose={inline && !onClose}
+		fullScreen={!inline}
+		bannerReserved={draftSync.hasBaseline}
+		title={edit
+			? can_write
+				? `Edit Azure trigger ${initialPath}`
+				: `Azure trigger ${initialPath}`
+			: 'New Azure trigger'}
+		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
+	>
+		{#snippet actions()}
+			{@render actionsButtons()}
+		{/snippet}
+		{#snippet banner()}
+			<LocalDraftBanner
+				show={draftSync.hasDraft}
+				getDeployed={() => draftSync.deployed}
+				reserveSpace={draftSync.hasBaseline}
+				getCurrent={() => draftSync.current}
+				onDiscard={() => draftSync.resetToDeployed(initialPath)}
+				disabled={!can_write}
+			/>
+		{/snippet}
+		{@render config()}
+	</DrawerContent>
+{/snippet}
+
+{#if useDrawer && inline}
+	{@render drawerBody()}
+{:else if useDrawer}
 	<Drawer
 		size="800px"
 		bind:this={drawer}
 		on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.azure.path)}
 	>
-		<DrawerContent
-			bannerReserved={draftSync.hasBaseline}
-			title={edit
-				? can_write
-					? `Edit Azure trigger ${initialPath}`
-					: `Azure trigger ${initialPath}`
-				: 'New Azure trigger'}
-			on:close={drawer?.closeDrawer}
-		>
-			{#snippet actions()}
-				{@render actionsButtons()}
-			{/snippet}
-			{#snippet banner()}
-				<LocalDraftBanner
-					show={draftSync.hasDraft}
-					getDeployed={() => draftSync.deployed}
-					reserveSpace={draftSync.hasBaseline}
-					getCurrent={() => draftSync.current}
-					onDiscard={() => draftSync.resetToDeployed(initialPath)}
-					disabled={!can_write}
-				/>
-			{/snippet}
-			{@render config()}
-		</DrawerContent>
+		{@render drawerBody()}
 	</Drawer>
 {:else}
 	<Section
@@ -487,7 +516,7 @@
 							bind:itemKind
 							bind:scriptPath={script_path}
 							allowRefresh={can_write}
-							allowEdit={!$userStore?.operator}
+							allowEdit={!actingUser?.operator}
 							clearable
 						/>
 						{#if emptyString(script_path)}
@@ -496,7 +525,9 @@
 								variant="default"
 								unifiedSize="md"
 								disabled={!can_write}
-								href={itemKind === 'flow' ? '/flows/add?hub=81' : '/scripts/add?hub=hub%2F28214'}
+								href={operatingHref(
+									itemKind === 'flow' ? '/flows/add?hub=81' : '/scripts/add?hub=hub%2F28214'
+								)}
 								target="_blank">Create from template</Button
 							>
 						{/if}
diff --git a/frontend/src/lib/components/triggers/email/DefaultEmailCapture.svelte b/frontend/src/lib/components/triggers/email/DefaultEmailCapture.svelte
index 068df9d707..f3a480bf58 100644
--- a/frontend/src/lib/components/triggers/email/DefaultEmailCapture.svelte
+++ b/frontend/src/lib/components/triggers/email/DefaultEmailCapture.svelte
@@ -1,10 +1,12 @@
 <script lang="ts">
 	import Label from '$lib/components/Label.svelte'
-	import { workspaceStore } from '$lib/stores'
 	import { base32 } from 'rfc4648'
 	import ClipboardPanel from '../../details/ClipboardPanel.svelte'
 	import CaptureSection, { type CaptureInfo } from '../CaptureSection.svelte'
 	import { fade } from 'svelte/transition'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		isFlow?: boolean
@@ -26,7 +28,7 @@
 
 	function getCaptureEmail() {
 		const cleanedPath = path.replaceAll('/', '.')
-		const plainPrefix = `capture+${$workspaceStore}+${(isFlow ? 'flow.' : '') + cleanedPath}`
+		const plainPrefix = `capture+${$operatingWorkspace}+${(isFlow ? 'flow.' : '') + cleanedPath}`
 		const encodedPrefix = base32
 			.stringify(new TextEncoder().encode(plainPrefix), {
 				pad: false
diff --git a/frontend/src/lib/components/triggers/email/DefaultEmailConfigSection.svelte b/frontend/src/lib/components/triggers/email/DefaultEmailConfigSection.svelte
index 0aebee6680..9e3c501ccd 100644
--- a/frontend/src/lib/components/triggers/email/DefaultEmailConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/email/DefaultEmailConfigSection.svelte
@@ -3,7 +3,6 @@
 	import Label from '$lib/components/Label.svelte'
 	import Tooltip from '$lib/components/Tooltip.svelte'
 	import { AlertTriangle } from 'lucide-svelte'
-	import { workspaceStore } from '$lib/stores'
 	import { SCRIPT_VIEW_SHOW_CREATE_TOKEN_BUTTON } from '$lib/consts'
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
 	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
@@ -13,12 +12,16 @@
 	import { emptyString } from '$lib/utils'
 	import UserSettings from '$lib/components/UserSettings.svelte'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let requestType: 'runnableVersion' | 'path' = $state('path')
 
 	function emailAddress() {
-		const pathOrHash = requestType === 'runnableVersion' ? runnableVersion : path.replaceAll('/', '.')
-		const plainPrefix = `${$workspaceStore}+${
+		const pathOrHash =
+			requestType === 'runnableVersion' ? runnableVersion : path.replaceAll('/', '.')
+		const plainPrefix = `${$operatingWorkspace}+${
 			(requestType === 'runnableVersion' ? 'hash.' : isFlow ? 'flow.' : '') + pathOrHash
 		}+${token}`
 		const encodedPrefix = base32
diff --git a/frontend/src/lib/components/triggers/email/DefaultEmailPanel.svelte b/frontend/src/lib/components/triggers/email/DefaultEmailPanel.svelte
index e8c201ff63..2424301f3f 100644
--- a/frontend/src/lib/components/triggers/email/DefaultEmailPanel.svelte
+++ b/frontend/src/lib/components/triggers/email/DefaultEmailPanel.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-	import { enterpriseLicense, userStore, workspaceStore } from '$lib/stores'
+	import { enterpriseLicense, userStore } from '$lib/stores'
 	import UserSettings from '../../UserSettings.svelte'
 	import { generateRandomString } from '$lib/utils'
 	import HighlightTheme from '../../HighlightTheme.svelte'
@@ -10,6 +10,9 @@
 	import Section from '../../Section.svelte'
 	import DefaultEmailConfigSection from './DefaultEmailConfigSection.svelte'
 	import { getEmailDomain } from './utils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let userSettings: UserSettings | undefined = $state(undefined)
 	interface Props {
@@ -55,7 +58,7 @@
 		token = e.detail
 		triggerTokens?.listTokens()
 	}}
-	newTokenWorkspace={$workspaceStore}
+	newTokenWorkspace={$operatingWorkspace}
 	newTokenLabel={`email-${$userStore?.username ?? 'superadmin'}-${generateRandomString(4)}`}
 	{scopes}
 />
@@ -70,7 +73,14 @@
 		<Skeleton layout={[[18]]} />
 	{:else}
 		{#if emailDomain}
-			<DefaultEmailConfigSection {runnableVersion} {token} {path} {isFlow} {userSettings} {emailDomain} />
+			<DefaultEmailConfigSection
+				{runnableVersion}
+				{token}
+				{path}
+				{isFlow}
+				{userSettings}
+				{emailDomain}
+			/>
 		{:else}
 			<div>
 				<Alert title="Email triggers are disabled" size="xs" type="warning">
diff --git a/frontend/src/lib/components/triggers/email/EmailCapture.svelte b/frontend/src/lib/components/triggers/email/EmailCapture.svelte
index f77c15b5bd..8815439c13 100644
--- a/frontend/src/lib/components/triggers/email/EmailCapture.svelte
+++ b/frontend/src/lib/components/triggers/email/EmailCapture.svelte
@@ -1,11 +1,13 @@
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import Label from '$lib/components/Label.svelte'
 	// import { page } from '$app/state'
 	import type { CaptureInfo } from '../CaptureSection.svelte'
 	import CaptureSection from '../CaptureSection.svelte'
 	import { fade } from 'svelte/transition'
 	import ClipboardPanel from '$lib/components/details/ClipboardPanel.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		local_part: string | undefined
@@ -27,7 +29,7 @@
 		captureLoading = false
 	}: Props = $props()
 
-	let captureEmail = $derived(`capture+${$workspaceStore}-${local_part}@${emailDomain}`)
+	let captureEmail = $derived(`capture+${$operatingWorkspace}-${local_part}@${emailDomain}`)
 </script>
 
 {#if captureInfo}
diff --git a/frontend/src/lib/components/triggers/email/EmailTriggerEditorConfigSection.svelte b/frontend/src/lib/components/triggers/email/EmailTriggerEditorConfigSection.svelte
index 3a60d3be71..4a44e01b30 100644
--- a/frontend/src/lib/components/triggers/email/EmailTriggerEditorConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/email/EmailTriggerEditorConfigSection.svelte
@@ -2,8 +2,6 @@
 	import { Alert } from '$lib/components/common'
 	import Required from '$lib/components/Required.svelte'
 	import Section from '$lib/components/Section.svelte'
-	import { userStore, workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	// import { page } from '$app/state'
 	import { getEmailAddress, getEmailDomain } from './utils'
 	import { isCloudHosted } from '$lib/cloud'
@@ -12,6 +10,10 @@
 	import { untrack } from 'svelte'
 	import { EmailTriggerService } from '$lib/gen'
 	import ClipboardPanel from '$lib/components/details/ClipboardPanel.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
 	interface Props {
 		initialTriggerPath?: string | undefined
 		dirtyLocalPart?: boolean
@@ -35,8 +37,10 @@
 		isDraftOnly = true,
 		showTestingBadge = false
 	}: Props = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	const wsId = $derived($operatingWorkspace)
 
 	let validateTimeout: number | undefined = undefined
 
@@ -95,7 +99,7 @@
 		local_part === undefined && (local_part = '')
 	})
 
-	let userIsAdmin = $derived($userStore?.is_admin || $userStore?.is_super_admin)
+	let userIsAdmin = $derived(actingUser?.is_admin || actingUser?.is_super_admin)
 	let userCanEditConfig = $derived(userIsAdmin || isDraftOnly) // User can edit config if they are admin or if the trigger is a draft which will not be saved
 </script>
 
diff --git a/frontend/src/lib/components/triggers/email/EmailTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/email/EmailTriggerEditorInner.svelte
index d2133cf865..fe472cb8c4 100644
--- a/frontend/src/lib/components/triggers/email/EmailTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/email/EmailTriggerEditorInner.svelte
@@ -17,8 +17,7 @@
 		type Retry,
 		type TriggerMode
 	} from '$lib/gen'
-	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+	import { usedTriggerKinds } from '$lib/stores'
 	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
 	import Section from '$lib/components/Section.svelte'
 	import { Loader2 } from 'lucide-svelte'
@@ -38,9 +37,16 @@
 	import LocalDraftBanner from '$lib/components/LocalDraftBanner.svelte'
 	import TriggerSuspendedJobsAlert from '../TriggerSuspendedJobsAlert.svelte'
 	import TriggerSuspendedJobsModal from '../TriggerSuspendedJobsModal.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace,
+		useOperatingWorkspaceHref
+	} from '$lib/components/operatingWorkspace.svelte'
 
 	let {
 		useDrawer = true,
+		inline = false,
+		onClose = undefined,
 		hideTarget = false,
 		description = undefined,
 		isEditor = false,
@@ -55,8 +61,11 @@
 		trigger = undefined,
 		customSaveBehavior = undefined
 	} = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	const operatingHref = useOperatingWorkspaceHref()
+	const wsId = $derived($operatingWorkspace)
 
 	// Form data state
 	let initialPath = $state('')
@@ -75,7 +84,13 @@
 	let workspaced_local_part = $state(false)
 	let drawerLoading = $state(true)
 	let showLoader = $state(false)
-	let can_write = $state(true)
+	let permsPath = $state<string | undefined>(undefined)
+	let permsForWrite = $state<Record<string, boolean> | undefined>(undefined)
+	// The acting user in the operating workspace arrives asynchronously, and an unknown user
+	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
+	const can_write = $derived(
+		permsPath === undefined ? true : canWrite(permsPath, permsForWrite ?? {}, actingUser)
+	)
 	let extraPerms = $state<Record<string, boolean> | undefined>(undefined)
 	let error_handler_path: string | undefined = $state()
 	let error_handler_args: Record<string, any> = $state({})
@@ -95,7 +110,7 @@
 	let originalConfig = $state<NewEmailTrigger | undefined>(undefined)
 
 	let hasChanged = $derived(!deepEqual(getEmailTriggerConfig(), originalConfig ?? {}))
-	const isAdmin = $derived($userStore?.is_admin || $userStore?.is_super_admin)
+	const isAdmin = $derived(actingUser?.is_admin || actingUser?.is_super_admin)
 	const emailConfig = $derived.by(getEmailTriggerConfig)
 
 	const draftSync = useTriggerDraftSync({
@@ -127,6 +142,8 @@
 		defaultConfig?: Partial<NewEmailTrigger>,
 		fixedScriptPath_?: string
 	) {
+		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
+		operatingUser.forgetFailures()
 		drawerLoading = true
 		let loader = setTimeout(() => {
 			showLoader = true
@@ -206,6 +223,8 @@
 	}
 
 	function loadTriggerConfig(cfg?: Partial<EmailTrigger>): void {
+		// The loaded trigger says what it runs; an opener's `isFlow` is only its guess.
+		if (cfg?.is_flow !== undefined) itemKind = cfg.is_flow ? 'flow' : 'script'
 		script_path = cfg?.script_path ?? ''
 		initialScriptPath = cfg?.script_path ?? ''
 		is_flow = cfg?.is_flow ?? false
@@ -213,7 +232,8 @@
 		local_part = cfg?.local_part ?? ''
 		workspaced_local_part = cfg?.workspaced_local_part ?? false
 		extraPerms = cfg?.extra_perms ?? undefined
-		can_write = canWrite(path, cfg?.extra_perms ?? {}, $userStore)
+		permsPath = path
+		permsForWrite = cfg?.extra_perms ?? {}
 		error_handler_path = cfg?.error_handler_path
 		error_handler_args = cfg?.error_handler_args ?? {}
 		retry = cfg?.retry
@@ -265,7 +285,7 @@
 				saveCfg,
 				edit,
 				wsId!,
-				!!$userStore?.is_admin || !!$userStore?.is_super_admin,
+				!!actingUser?.is_admin || !!actingUser?.is_super_admin,
 				usedTriggerKinds
 			)
 			if (isSaved) {
@@ -405,7 +425,7 @@
 						bind:scriptPath={script_path}
 						{initialScriptPath}
 						canWrite={can_write}
-						isOperator={!!$userStore?.operator}
+						isOperator={!!actingUser?.operator}
 						promptClass="text-xs mt-3 mb-1 text-primary"
 					>
 						{#snippet createButton()}
@@ -414,7 +434,9 @@
 									btnClasses="ml-4"
 									variant="accent"
 									size="xs"
-									href={itemKind === 'flow' ? '/flows/add?hub=72' : '/scripts/add?hub=hub%2F19813'}
+									href={operatingHref(
+										itemKind === 'flow' ? '/flows/add?hub=72' : '/scripts/add?hub=hub%2F19813'
+									)}
 									target="_blank">Create from template</Button
 								>
 							{/if}
@@ -486,36 +508,44 @@
 	{/if}
 {/snippet}
 
-{#if useDrawer}
+{#snippet drawerBody()}
+	<DrawerContent
+		hideClose={inline && !onClose}
+		fullScreen={!inline}
+		bannerReserved={draftSync.hasBaseline}
+		title={edit
+			? can_write
+				? `Edit email trigger ${initialPath}`
+				: `Email trigger ${initialPath}`
+			: 'New email trigger'}
+		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
+	>
+		{#snippet actions()}
+			{@render saveButton()}
+		{/snippet}
+		{#snippet banner()}
+			<LocalDraftBanner
+				show={draftSync.hasDraft}
+				getDeployed={() => draftSync.deployed}
+				reserveSpace={draftSync.hasBaseline}
+				getCurrent={() => draftSync.current}
+				onDiscard={() => draftSync.resetToDeployed(initialPath)}
+				disabled={!can_write}
+			/>
+		{/snippet}
+		{@render config()}
+	</DrawerContent>
+{/snippet}
+
+{#if useDrawer && inline}
+	{@render drawerBody()}
+{:else if useDrawer}
 	<Drawer
 		size="700px"
 		bind:this={drawer}
 		on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.email.path)}
 	>
-		<DrawerContent
-			bannerReserved={draftSync.hasBaseline}
-			title={edit
-				? can_write
-					? `Edit email trigger ${initialPath}`
-					: `Email trigger ${initialPath}`
-				: 'New email trigger'}
-			on:close={() => drawer?.closeDrawer()}
-		>
-			{#snippet actions()}
-				{@render saveButton()}
-			{/snippet}
-			{#snippet banner()}
-				<LocalDraftBanner
-					show={draftSync.hasDraft}
-					getDeployed={() => draftSync.deployed}
-					reserveSpace={draftSync.hasBaseline}
-					getCurrent={() => draftSync.current}
-					onDiscard={() => draftSync.resetToDeployed(initialPath)}
-					disabled={!can_write}
-				/>
-			{/snippet}
-			{@render config()}
-		</DrawerContent>
+		{@render drawerBody()}
 	</Drawer>
 {:else}
 	<Section label={!customLabel ? 'Email trigger' : ''} headerClass="grow min-w-0 h-[30px]">
diff --git a/frontend/src/lib/components/triggers/email/EmailTriggerPanel.svelte b/frontend/src/lib/components/triggers/email/EmailTriggerPanel.svelte
index 12ec403aeb..7eac6a8971 100644
--- a/frontend/src/lib/components/triggers/email/EmailTriggerPanel.svelte
+++ b/frontend/src/lib/components/triggers/email/EmailTriggerPanel.svelte
@@ -1,11 +1,15 @@
 <script lang="ts">
 	import EmailTriggerEditorInner from './EmailTriggerEditorInner.svelte'
 	import Description from '$lib/components/Description.svelte'
-	import { enterpriseLicense, userStore } from '$lib/stores'
+	import { enterpriseLicense } from '$lib/stores'
 	import { Alert } from '$lib/components/common'
 	import { onMount, type Snippet } from 'svelte'
 	import { getEmailDomain } from './utils'
 	import type { Trigger } from '../utils'
+	import { useOperatingUser } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	let emailTriggerEditor = $state<EmailTriggerEditorInner | null>(null)
 
@@ -73,7 +77,7 @@
 				trigger can be configured with a specific local part.
 			</Description>
 
-			{#if !$userStore?.is_admin && !$userStore?.is_super_admin && selectedTrigger.isDraft}
+			{#if !actingUser?.is_admin && !actingUser?.is_super_admin && selectedTrigger.isDraft}
 				<Alert title="Only workspace admins can create email triggers" type="info" size="xs" />
 			{/if}
 
diff --git a/frontend/src/lib/components/triggers/gcp/GcpCapture.svelte b/frontend/src/lib/components/triggers/gcp/GcpCapture.svelte
index 7538026782..a77d12ebef 100644
--- a/frontend/src/lib/components/triggers/gcp/GcpCapture.svelte
+++ b/frontend/src/lib/components/triggers/gcp/GcpCapture.svelte
@@ -1,10 +1,12 @@
 <script lang="ts">
 	import type { CaptureInfo } from '../CaptureSection.svelte'
 	import CaptureSection from '../CaptureSection.svelte'
-	import { workspaceStore } from '$lib/stores'
 	import { Url } from '$lib/components/common'
 	import { fade } from 'svelte/transition'
 	import { base } from '$lib/base'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		captureInfo?: CaptureInfo | undefined
@@ -30,7 +32,7 @@
 		if (!captureInfo) {
 			return
 		}
-		return `${window.location.origin}${base}/api/w/${$workspaceStore}/capture_u/gcp/${
+		return `${window.location.origin}${base}/api/w/${$operatingWorkspace}/capture_u/gcp/${
 			captureInfo.isFlow ? 'flow' : 'script'
 		}/${captureInfo.path}`
 	}
diff --git a/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorConfigSection.svelte b/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorConfigSection.svelte
index 591de38b3b..ade1de1f70 100644
--- a/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorConfigSection.svelte
@@ -15,8 +15,6 @@
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
 	import { base } from '$lib/base'
 	import Toggle from '$lib/components/Toggle.svelte'
-	import { userStore, workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 
 	import { Button, Url } from '$lib/components/common'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
@@ -25,11 +23,17 @@
 	import TestingBadge from '../testingBadge.svelte'
 	import Select from '$lib/components/select/Select.svelte'
 	import { safeSelectItems } from '$lib/components/select/utils.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
 
 	// Declared before `DEFAULT_PUSH_CONFIG` / the `base_endpoint` prop default,
 	// which call `getBaseUrl()` (a `wsId` reader) during component init.
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	const wsId = $derived($operatingWorkspace)
 
 	let topic_items: string[] = $state([])
 	let subscription_items: string[] = $state([])
@@ -152,14 +156,14 @@
 	// Keyed on the loaded mode, not the live one: reading the live mode would make the toggle a
 	// one-way door, disabling itself the moment a non-admin switched an inherited ADC trigger away.
 	const canUseDefaultCredentials = $derived(
-		$userStore?.is_admin === true || loaded_uses_default_credentials
+		actingUser?.is_admin === true || loaded_uses_default_credentials
 	)
 	const hasCredentials = $derived(usesDefaultCredentials || !emptyStringTrimmed(gcp_resource_path))
 	/** Saving re-provisions the subscription with the instance's credentials, so the backend runs
 	 * the admin check on every write, not only when the mode is switched. A non-admin who inherits
 	 * such a trigger can open it, so say why saving is unavailable instead of letting them hit a
 	 * bare 403. */
-	const blockedByAdminGate = $derived(usesDefaultCredentials && $userStore?.is_admin !== true)
+	const blockedByAdminGate = $derived(usesDefaultCredentials && actingUser?.is_admin !== true)
 
 	// One-shot on mount, so read the props rather than the derived: referencing `$derived` state
 	// here captures its initial value anyway, and Svelte warns about it.
@@ -274,7 +278,10 @@
 							     travel as `?project_id=`, dirty the config, and reach the column as a
 							     value `empty_as_none` does not trim away. -->
 							<TextInput
-								bind:value={() => project_id ?? '', (v) => (project_id = emptyStringTrimmed(v) ? undefined : v)}
+								bind:value={
+									() => project_id ?? '',
+									(v) => (project_id = emptyStringTrimmed(v) ? undefined : v)
+								}
 								inputProps={{
 									placeholder: 'my-gcp-project',
 									disabled: !can_write,
diff --git a/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorInner.svelte
index 3c63d79e12..03c4a12261 100644
--- a/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorInner.svelte
@@ -8,8 +8,7 @@
 	import Drawer from '$lib/components/common/drawer/Drawer.svelte'
 	import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
 	import Path from '$lib/components/Path.svelte'
-	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+	import { usedTriggerKinds } from '$lib/stores'
 	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import { Loader2 } from 'lucide-svelte'
@@ -43,6 +42,11 @@
 	import TriggerAdvancedBadges from '../TriggerAdvancedBadges.svelte'
 	import Subsection from '$lib/components/Subsection.svelte'
 	import Toggle from '$lib/components/Toggle.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace,
+		useOperatingWorkspaceHref
+	} from '$lib/components/operatingWorkspace.svelte'
 
 	let drawer: Drawer | undefined = $state(undefined)
 	let initialPath = $state('')
@@ -56,7 +60,15 @@
 	let pathError = $state('')
 	let mode = $state<TriggerMode>('enabled')
 	let dirtyPath = $state(false)
-	let can_write = $state(true)
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	let permsPath = $state<string | undefined>(undefined)
+	let permsForWrite = $state<Record<string, boolean> | undefined>(undefined)
+	// The acting user in the operating workspace arrives asynchronously, and an unknown user
+	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
+	const can_write = $derived(
+		permsPath === undefined ? true : canWrite(permsPath, permsForWrite ?? {}, actingUser)
+	)
 	let drawerLoading = $state(true)
 	let topic_id: string = $state('')
 	let gcp_resource_path: string | undefined = $state('')
@@ -90,6 +102,8 @@
 	let loadedUsesDefaultCredentials = $state(false)
 	let {
 		useDrawer = true,
+		inline = false,
+		onClose = undefined,
 		description = undefined,
 		hideTarget = false,
 		hideTooltips = false,
@@ -106,6 +120,10 @@
 		cloudDisabled = false
 	}: {
 		useDrawer?: boolean
+		/** With `useDrawer`, render the drawer's content in place, filling the parent, with no drawer or close button. */
+		inline?: boolean
+		/** With `inline`, closes whatever hosts the editor; the header has a close button only when set. */
+		onClose?: () => void
 		description?: Snippet | undefined
 		hideTarget?: boolean
 		hideTooltips?: boolean
@@ -121,8 +139,9 @@
 		onReset?: () => void
 		cloudDisabled?: boolean
 	} = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingHref = useOperatingWorkspaceHref()
+	const wsId = $derived($operatingWorkspace)
 
 	let hasChanged = $derived(!deepEqual(getGcpConfig(), originalConfig ?? {}))
 	const gcpConfig = $derived.by(getGcpConfig)
@@ -147,6 +166,8 @@
 		defaultValues?: Record<string, any>,
 		fixedScriptPath_?: string
 	) {
+		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
+		operatingUser.forgetFailures()
 		drawerLoading = true
 		try {
 			drawer?.openDrawer()
@@ -254,6 +275,8 @@
 	}
 
 	async function loadTriggerConfig(cfg?: Record<string, any>): Promise<void> {
+		// The loaded trigger says what it runs; an opener's `isFlow` is only its guess.
+		if (cfg?.is_flow !== undefined) itemKind = cfg.is_flow ? 'flow' : 'script'
 		script_path = cfg?.script_path
 		initialScriptPath = cfg?.script_path
 		gcp_resource_path = cfg?.gcp_resource_path ?? undefined
@@ -267,7 +290,8 @@
 		path = cfg?.path
 		mode = cfg?.mode ?? 'enabled'
 		topic_id = cfg?.topic_id ?? ''
-		can_write = canWrite(cfg?.path, cfg?.extra_perms, $userStore)
+		permsPath = cfg?.path
+		permsForWrite = cfg?.extra_perms
 		error_handler_path = cfg?.error_handler_path
 		error_handler_args = cfg?.error_handler_args ?? {}
 		retry = cfg?.retry
@@ -405,36 +429,44 @@
 	/>
 {/if}
 
-{#if useDrawer}
+{#snippet drawerBody()}
+	<DrawerContent
+		hideClose={inline && !onClose}
+		fullScreen={!inline}
+		bannerReserved={draftSync.hasBaseline}
+		title={edit
+			? can_write
+				? `Edit GCP Pub/Sub trigger ${initialPath}`
+				: `GCP Pub/Sub trigger ${initialPath}`
+			: 'New GCP Pub/Sub trigger'}
+		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
+	>
+		{#snippet actions()}
+			{@render actionsButtons()}
+		{/snippet}
+		{#snippet banner()}
+			<LocalDraftBanner
+				show={draftSync.hasDraft}
+				getDeployed={() => draftSync.deployed}
+				reserveSpace={draftSync.hasBaseline}
+				getCurrent={() => draftSync.current}
+				onDiscard={() => draftSync.resetToDeployed(initialPath)}
+				disabled={!can_write}
+			/>
+		{/snippet}
+		{@render config()}
+	</DrawerContent>
+{/snippet}
+
+{#if useDrawer && inline}
+	{@render drawerBody()}
+{:else if useDrawer}
 	<Drawer
 		size="800px"
 		bind:this={drawer}
 		on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.gcp.path)}
 	>
-		<DrawerContent
-			bannerReserved={draftSync.hasBaseline}
-			title={edit
-				? can_write
-					? `Edit GCP Pub/Sub trigger ${initialPath}`
-					: `GCP Pub/Sub trigger ${initialPath}`
-				: 'New GCP Pub/Sub trigger'}
-			on:close={drawer?.closeDrawer}
-		>
-			{#snippet actions()}
-				{@render actionsButtons()}
-			{/snippet}
-			{#snippet banner()}
-				<LocalDraftBanner
-					show={draftSync.hasDraft}
-					getDeployed={() => draftSync.deployed}
-					reserveSpace={draftSync.hasBaseline}
-					getCurrent={() => draftSync.current}
-					onDiscard={() => draftSync.resetToDeployed(initialPath)}
-					disabled={!can_write}
-				/>
-			{/snippet}
-			{@render config()}
-		</DrawerContent>
+		{@render drawerBody()}
 	</Drawer>
 {:else}
 	<Section label={!customLabel ? 'GCP Pub/Sub trigger' : ''} headerClass="grow min-w-0 h-[30px]">
@@ -532,7 +564,7 @@
 						bind:scriptPath={script_path}
 						{initialScriptPath}
 						canWrite={can_write}
-						isOperator={!!$userStore?.operator}
+						isOperator={!!actingUser?.operator}
 						promptText="Pick a script or flow to be triggered "
 					>
 						{#snippet createButton()}
@@ -542,7 +574,9 @@
 									variant="default"
 									unifiedSize="md"
 									disabled={!can_write}
-									href={itemKind === 'flow' ? '/flows/add?hub=68' : '/scripts/add?hub=hub%2F19796'}
+									href={operatingHref(
+										itemKind === 'flow' ? '/flows/add?hub=68' : '/scripts/add?hub=hub%2F19796'
+									)}
 									target="_blank">Create from template</Button
 								>
 							{/if}
diff --git a/frontend/src/lib/components/triggers/http/OpenAPISpecGenerator.svelte b/frontend/src/lib/components/triggers/http/OpenAPISpecGenerator.svelte
index fd66b449d0..b0cc491393 100644
--- a/frontend/src/lib/components/triggers/http/OpenAPISpecGenerator.svelte
+++ b/frontend/src/lib/components/triggers/http/OpenAPISpecGenerator.svelte
@@ -11,7 +11,7 @@
 		type OpenapiV3Info,
 		type WebhookFilters
 	} from '$lib/gen'
-	import { userStore, workspaceStore } from '$lib/stores'
+	import { userStore } from '$lib/stores'
 	import SimpleEditor from '$lib/components/SimpleEditor.svelte'
 	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
@@ -35,6 +35,9 @@
 	import CreateToken from '$lib/components/settings/CreateToken.svelte'
 	import Alert from '$lib/components/common/alert/Alert.svelte'
 	import { safeSelectItems } from '$lib/components/select/utils.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	type HttpRouteAndWebhook = WebhookFilters | OpenapiHttpRouteFilters
 
@@ -148,7 +151,7 @@
 			const info = buildInfo()
 			isGeneratingOpenapiSpec = true
 			openapiDocument = await OpenapiService.generateOpenapiSpec({
-				workspace: $workspaceStore!,
+				workspace: $operatingWorkspace!,
 				requestBody: {
 					openapi_spec_format,
 					info,
@@ -222,7 +225,7 @@
 				{/snippet}
 				<CopyableCodeBlock
 					code={`token=${emptyString(token) ? '' : token}; \\
-curl -X POST "${window.location.origin}${base}/api/w/${$workspaceStore!}/openapi/generate" \\
+curl -X POST "${window.location.origin}${base}/api/w/${$operatingWorkspace!}/openapi/generate" \\
 -H "Authorization: Bearer $token" \\
 -H "Content-Type: application/json" \\
 -d '${JSON.stringify(obj)}'`}
diff --git a/frontend/src/lib/components/triggers/http/RouteCapture.svelte b/frontend/src/lib/components/triggers/http/RouteCapture.svelte
index b1024573c9..5cbe3570dc 100644
--- a/frontend/src/lib/components/triggers/http/RouteCapture.svelte
+++ b/frontend/src/lib/components/triggers/http/RouteCapture.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import Label from '$lib/components/Label.svelte'
 	import CopyableCodeBlock from '$lib/components/details/CopyableCodeBlock.svelte'
 	import { bash } from 'svelte-highlight/languages'
@@ -10,6 +9,7 @@
 	import { isObject } from '$lib/utils'
 	import { Url } from '$lib/components/common'
 	import { fade } from 'svelte/transition'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		route_path: string | undefined
@@ -32,9 +32,11 @@
 		isFlow = false,
 		captureLoading = false
 	}: Props = $props()
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	let captureURL = $derived(
-		`${location.origin}${base}/api/w/${$workspaceStore}/capture_u/http/${
+		`${location.origin}${base}/api/w/${wsId}/capture_u/http/${
 			captureInfo?.isFlow ? 'flow' : 'script'
 		}/${captureInfo?.path.replaceAll('/', '.')}/${route_path ?? ''}`
 	)
diff --git a/frontend/src/lib/components/triggers/http/RouteCorsOption.svelte b/frontend/src/lib/components/triggers/http/RouteCorsOption.svelte
index 50b09a108d..eb371fbc73 100644
--- a/frontend/src/lib/components/triggers/http/RouteCorsOption.svelte
+++ b/frontend/src/lib/components/triggers/http/RouteCorsOption.svelte
@@ -47,7 +47,9 @@
 	// Advisory: the value saves either way, so this only points out an entry
 	// that could never match rather than deciding what a browser may send.
 	let warning = $derived(
-		restricted ? origins.map(allowedOriginWarning).find((message) => message !== undefined) : undefined
+		restricted
+			? origins.map(allowedOriginWarning).find((message) => message !== undefined)
+			: undefined
 	)
 
 	// While the toggle is on, whatever is typed is what gets saved. A rejected
diff --git a/frontend/src/lib/components/triggers/http/RouteEditorConfigSection.svelte b/frontend/src/lib/components/triggers/http/RouteEditorConfigSection.svelte
index 2365e1353c..b019b2f15b 100644
--- a/frontend/src/lib/components/triggers/http/RouteEditorConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/http/RouteEditorConfigSection.svelte
@@ -4,7 +4,6 @@
 	import Section from '$lib/components/Section.svelte'
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
 	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
-	import { userStore, workspaceStore } from '$lib/stores'
 	import { HttpTriggerService, SettingService } from '$lib/gen'
 	// import { page } from '$app/state'
 	import { getHttpRoute } from './utils'
@@ -13,6 +12,10 @@
 	import TestingBadge from '../testingBadge.svelte'
 	import { untrack } from 'svelte'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		initialTriggerPath?: string | undefined
@@ -41,6 +44,10 @@
 		isDraftOnly = true,
 		showTestingBadge = false
 	}: Props = $props()
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	const wsId = $derived($operatingWorkspace)
 
 	let validateTimeout: number | undefined = undefined
 
@@ -74,7 +81,7 @@
 		workspaced_route: boolean
 	) {
 		return await HttpTriggerService.existsRoute({
-			workspace: $workspaceStore!,
+			workspace: wsId!,
 			requestBody: {
 				route_path,
 				http_method: method,
@@ -95,7 +102,7 @@
 		isValid = routeError === ''
 	})
 
-	let fullRoute = $derived(getHttpRoute('r', route_path, workspaced_route, $workspaceStore ?? ''))
+	let fullRoute = $derived(getHttpRoute('r', route_path, workspaced_route, wsId ?? ''))
 
 	$effect.pre(() => {
 		!http_method && (http_method = 'post')
@@ -104,7 +111,11 @@
 		route_path === undefined && (route_path = '')
 	})
 
-	let userIsAdmin = $derived($userStore?.is_admin || $userStore?.is_super_admin)
+	// Unknown until the acting user resolves: forcing the prefix on an admin meanwhile would
+	// silently save a workspace-prefixed route they never chose.
+	let userIsAdmin = $derived(
+		operatingUser.resolved(wsId) ? actingUser?.is_admin || actingUser?.is_super_admin : undefined
+	)
 
 	let globalHttpWorkspacedRoute = $state(false)
 
@@ -127,7 +138,10 @@
 		// Existing non-workspaced triggers created by admins can still be edited by non-admins
 		// (with restricted fields), so we don't override their workspaced_route value.
 		const isNewTrigger = !initialTriggerPath
-		if ((globalHttpWorkspacedRoute || (!userIsAdmin && isNewTrigger)) && !workspaced_route) {
+		if (
+			(globalHttpWorkspacedRoute || (userIsAdmin === false && isNewTrigger)) &&
+			!workspaced_route
+		) {
 			workspaced_route = true
 			dirtyRoutePath = true
 		}
diff --git a/frontend/src/lib/components/triggers/http/RouteEditorInner.svelte b/frontend/src/lib/components/triggers/http/RouteEditorInner.svelte
index eb046f380e..5fc2999704 100644
--- a/frontend/src/lib/components/triggers/http/RouteEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/http/RouteEditorInner.svelte
@@ -21,7 +21,7 @@
 		type Retry,
 		type TriggerMode
 	} from '$lib/gen'
-	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
+	import { usedTriggerKinds } from '$lib/stores'
 	import {
 		canWrite,
 		capitalize,
@@ -76,9 +76,16 @@
 	import TriggerSuspendedJobsModal from '../TriggerSuspendedJobsModal.svelte'
 	import UserSettings from '$lib/components/UserSettings.svelte'
 	import Tooltip from '$lib/components/Tooltip.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace,
+		useOperatingWorkspaceHref
+	} from '$lib/components/operatingWorkspace.svelte'
 
 	let {
 		useDrawer = true,
+		inline = false,
+		onClose = undefined,
 		hideTarget = false,
 		description = undefined,
 		isEditor = false,
@@ -93,6 +100,11 @@
 		trigger = undefined,
 		customSaveBehavior = undefined
 	} = $props()
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	const operatingHref = useOperatingWorkspaceHref()
+	const wsId = $derived($operatingWorkspace)
 
 	// Form data state
 	let initialPath = $state('')
@@ -146,7 +158,13 @@
 	let authentication_resource_path = $state('')
 	let variable_path = $state('')
 	let signature_options_type = $state<'custom_script' | 'custom_signature'>('custom_signature')
-	let can_write = $state(true)
+	let permsPath = $state<string | undefined>(undefined)
+	let permsForWrite = $state<Record<string, boolean> | undefined>(undefined)
+	// The acting user in the operating workspace arrives asynchronously, and an unknown user
+	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
+	const can_write = $derived(
+		permsPath === undefined ? true : canWrite(permsPath, permsForWrite ?? {}, actingUser)
+	)
 	let extraPerms = $state<Record<string, boolean> | undefined>(undefined)
 	let summary: string | undefined = $state()
 	let routeDescription: string | undefined = $state()
@@ -179,7 +197,7 @@
 	const draftSync = useTriggerDraftSync({
 		itemKind: 'trigger_http',
 		path: () => initialPath,
-		workspace: () => $workspaceStore,
+		workspace: () => wsId,
 		drawerLoading: () => drawerLoading,
 		getCfg: () => routeConfig,
 		applyCfg: (c) => loadTriggerConfig(c as Partial<HttpTrigger>),
@@ -215,7 +233,7 @@
 	}
 
 	async function loadVariables() {
-		return await VariableService.listVariable({ workspace: $workspaceStore ?? '' })
+		return await VariableService.listVariable({ workspace: wsId ?? '' })
 	}
 
 	const authentication_options: AuthenticationOption[] = [
@@ -255,6 +273,8 @@
 		isFlow: boolean,
 		defaultConfig?: Partial<NewHttpTrigger>
 	) {
+		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
+		operatingUser.forgetFailures()
 		drawerLoading = true
 		let loader = setTimeout(() => {
 			showLoader = true
@@ -346,6 +366,8 @@
 	}
 
 	function loadTriggerConfig(cfg?: Partial<HttpTrigger>): void {
+		// The loaded trigger says what it runs; an opener's `isFlow` is only its guess.
+		if (cfg?.is_flow !== undefined) itemKind = cfg.is_flow ? 'flow' : 'script'
 		script_path = cfg?.script_path ?? ''
 		initialScriptPath = cfg?.script_path ?? ''
 		is_flow = cfg?.is_flow ?? false
@@ -374,7 +396,8 @@
 			is_static_website = cfg?.is_static_website ?? false
 		}
 		extraPerms = cfg?.extra_perms ?? undefined
-		can_write = canWrite(path, cfg?.extra_perms ?? {}, $userStore)
+		permsPath = path
+		permsForWrite = cfg?.extra_perms ?? {}
 		error_handler_path = cfg?.error_handler_path
 		error_handler_args = cfg?.error_handler_args ?? {}
 		retry = cfg?.retry
@@ -393,7 +416,7 @@
 			return { overlay: undefined, noDeployed: false }
 		}
 		const s = await HttpTriggerService.getHttpTrigger({
-			workspace: $workspaceStore!,
+			workspace: wsId!,
 			path: initialPath,
 			getDraft: true
 		})
@@ -419,8 +442,8 @@
 				initialPath,
 				saveCfg,
 				edit,
-				$workspaceStore!,
-				!!$userStore?.is_admin || !!$userStore?.is_super_admin,
+				wsId!,
+				!!actingUser?.is_admin || !!actingUser?.is_super_admin,
 				usedTriggerKinds
 			)
 			if (isSaved) {
@@ -482,7 +505,7 @@
 			// and parent live at distinct URLs — no fork-conflict warning.
 			await HttpTriggerService.setHttpTriggerMode({
 				path: initialPath,
-				workspace: $workspaceStore ?? '',
+				workspace: wsId ?? '',
 				requestBody: { mode: newMode }
 			})
 			sendUserToast(`${capitalize(newMode)} HTTP trigger ${initialPath}`)
@@ -535,8 +558,8 @@
 {#if authentication_method === 'windmill'}
 	<UserSettings
 		bind:this={userSettings}
-		newTokenWorkspace={$workspaceStore}
-		newTokenLabel={`http-${$userStore?.username ?? 'superadmin'}-${generateRandomString(4)}`}
+		newTokenWorkspace={wsId}
+		newTokenLabel={`http-${actingUser?.username ?? 'superadmin'}-${generateRandomString(4)}`}
 		{scopes}
 	/>
 {/if}
@@ -747,7 +770,7 @@
 										bind:itemKind
 										bind:scriptPath={script_path}
 										allowRefresh={can_write}
-										allowEdit={!$userStore?.operator}
+										allowEdit={!actingUser?.operator}
 										clearable
 									/>
 
@@ -755,9 +778,9 @@
 										<Button
 											variant="default"
 											size="lg"
-											href={itemKind === 'flow'
-												? '/flows/add?hub=62'
-												: '/scripts/add?hub=hub%2F19669'}
+											href={operatingHref(
+												itemKind === 'flow' ? '/flows/add?hub=62' : '/scripts/add?hub=hub%2F19669'
+											)}
 											target="_blank">Create from template</Button
 										>
 									{/if}
@@ -967,13 +990,11 @@
 														disabled={emptyString(variable_path) || !can_write}
 														variant="default"
 														size="xs"
-														href={itemKind === 'flow'
-															? `/flows/add?${SECRET_KEY_PATH}=${encodeURIComponent(variable_path)}&hub=${
-																	HubFlow.SIGNATURE_TEMPLATE
-																}`
-															: `/scripts/add?${SECRET_KEY_PATH}=${encodeURIComponent(
-																	variable_path
-																)}&hub=hub%2F${HUB_SCRIPT_ID}`}
+														href={operatingHref(
+															itemKind === 'flow'
+																? `/flows/add?${SECRET_KEY_PATH}=${encodeURIComponent(variable_path)}&hub=${HubFlow.SIGNATURE_TEMPLATE}`
+																: `/scripts/add?${SECRET_KEY_PATH}=${encodeURIComponent(variable_path)}&hub=hub%2F${HUB_SCRIPT_ID}`
+														)}
 														target="_blank">Create from template</Button
 													>
 												</div>
@@ -1057,36 +1078,40 @@
 	{/if}
 {/snippet}
 
-{#if useDrawer}
+{#snippet drawerBody()}
+	<DrawerContent
+		hideClose={inline && !onClose}
+		fullScreen={!inline}
+		bannerReserved={draftSync.hasBaseline}
+		title={edit ? (can_write ? `Edit route ${initialPath}` : `Route ${initialPath}`) : 'New route'}
+		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
+	>
+		{#snippet actions()}
+			{@render saveButton()}
+		{/snippet}
+		{#snippet banner()}
+			<LocalDraftBanner
+				show={draftSync.hasDraft}
+				getDeployed={() => draftSync.deployed}
+				reserveSpace={draftSync.hasBaseline}
+				getCurrent={() => draftSync.current}
+				onDiscard={() => draftSync.resetToDeployed(initialPath)}
+				disabled={!can_write}
+			/>
+		{/snippet}
+		{@render config()}
+	</DrawerContent>
+{/snippet}
+
+{#if useDrawer && inline}
+	{@render drawerBody()}
+{:else if useDrawer}
 	<Drawer
 		size="700px"
 		bind:this={drawer}
 		on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.http.path)}
 	>
-		<DrawerContent
-			bannerReserved={draftSync.hasBaseline}
-			title={edit
-				? can_write
-					? `Edit route ${initialPath}`
-					: `Route ${initialPath}`
-				: 'New route'}
-			on:close={() => drawer?.closeDrawer()}
-		>
-			{#snippet actions()}
-				{@render saveButton()}
-			{/snippet}
-			{#snippet banner()}
-				<LocalDraftBanner
-					show={draftSync.hasDraft}
-					getDeployed={() => draftSync.deployed}
-					reserveSpace={draftSync.hasBaseline}
-					getCurrent={() => draftSync.current}
-					onDiscard={() => draftSync.resetToDeployed(initialPath)}
-					disabled={!can_write}
-				/>
-			{/snippet}
-			{@render config()}
-		</DrawerContent>
+		{@render drawerBody()}
 	</Drawer>
 {:else}
 	<Section label={!customLabel ? 'HTTP Route' : ''} headerClass="grow min-w-0 h-[30px]">
diff --git a/frontend/src/lib/components/triggers/http/RoutesGenerator.svelte b/frontend/src/lib/components/triggers/http/RoutesGenerator.svelte
index 5c01c84918..71b54a39e0 100644
--- a/frontend/src/lib/components/triggers/http/RoutesGenerator.svelte
+++ b/frontend/src/lib/components/triggers/http/RoutesGenerator.svelte
@@ -16,13 +16,20 @@
 	import RouteEditor from './RouteEditor.svelte'
 	import { generateHttpTriggerFromOpenApi, type Source } from './utils'
 	import { isCloudHosted } from '$lib/cloud'
-	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
+	import { usedTriggerKinds } from '$lib/stores'
 	import FileInput from '../../common/fileInput/FileInput.svelte'
 	import { emptyStringTrimmed, sendUserToast } from '$lib/utils'
 	import FolderPicker from '../../FolderPicker.svelte'
 	import Required from '$lib/components/Required.svelte'
 	import { Drawer, DrawerContent } from '$lib/components/common'
 	import { get } from 'svelte/store'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
 
 	type Props = {
 		closeFn: () => Promise<void>
@@ -108,7 +115,7 @@
 		try {
 			isCreating = true
 			const message = await HttpTriggerService.createHttpTriggers({
-				workspace: $workspaceStore!,
+				workspace: $operatingWorkspace!,
 				requestBody: httpTriggers
 			})
 			sendUserToast(message)
@@ -134,7 +141,9 @@
 		}
 	}
 
-	let userIsAdmin = $derived($userStore?.is_admin || $userStore?.is_super_admin)
+	let userIsAdmin = $derived(
+		operatingUser.current?.is_admin || operatingUser.current?.is_super_admin
+	)
 
 	async function generateHttpTrigger() {
 		try {
@@ -314,7 +323,7 @@
 									<div class="text-primary">
 										{httpTrigger.http_method.toUpperCase()}
 										{isCloudHosted() || httpTrigger.workspaced_route || globalHttpWorkspacedRoute
-											? $workspaceStore! + '/' + httpTrigger.route_path
+											? $operatingWorkspace! + '/' + httpTrigger.route_path
 											: httpTrigger.route_path}
 									</div>
 									<div class="text-secondary text-xs truncate text-left font-light">
diff --git a/frontend/src/lib/components/triggers/http/RoutesPanel.svelte b/frontend/src/lib/components/triggers/http/RoutesPanel.svelte
index 4e827cd6c1..edda2aee47 100644
--- a/frontend/src/lib/components/triggers/http/RoutesPanel.svelte
+++ b/frontend/src/lib/components/triggers/http/RoutesPanel.svelte
@@ -1,9 +1,12 @@
 <script lang="ts">
 	import RouteEditorInner from './RouteEditorInner.svelte'
 	import Description from '$lib/components/Description.svelte'
-	import { userStore } from '$lib/stores'
 	import { Alert } from '$lib/components/common'
 	import { onMount } from 'svelte'
+	import { useOperatingUser } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	let routeEditor = $state<RouteEditorInner | null>(null)
 	let {
@@ -48,7 +51,7 @@
 				specific HTTP method and path.</Description
 			>
 
-			{#if !$userStore?.is_admin && !$userStore?.is_super_admin && selectedTrigger.isDraft}
+			{#if !actingUser?.is_admin && !actingUser?.is_super_admin && selectedTrigger.isDraft}
 				<Alert title="Non-admin users are limited to workspaced routes" type="info" size="xs" />
 			{/if}
 		</div>
diff --git a/frontend/src/lib/components/triggers/kafka/KafkaTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/kafka/KafkaTriggerEditorInner.svelte
index cd33bfb450..ea604bc5a8 100644
--- a/frontend/src/lib/components/triggers/kafka/KafkaTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/kafka/KafkaTriggerEditorInner.svelte
@@ -11,8 +11,7 @@
 	import Path from '$lib/components/Path.svelte'
 	import TriggerRunnablePicker from '$lib/components/triggers/TriggerRunnablePicker.svelte'
 	import { KafkaTriggerService, type ErrorHandler, type Retry, type TriggerMode } from '$lib/gen'
-	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+	import { usedTriggerKinds } from '$lib/stores'
 	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import Section from '$lib/components/Section.svelte'
@@ -37,9 +36,18 @@
 	import type { FilterNode } from '../filters'
 	import Select from '$lib/components/select/Select.svelte'
 	import Toggle from '$lib/components/Toggle.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace,
+		useOperatingWorkspaceHref
+	} from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		useDrawer?: boolean
+		/** With `useDrawer`, render the drawer's content in place, filling the parent, with no drawer or close button. */
+		inline?: boolean
+		/** With `inline`, closes whatever hosts the editor; the header has a close button only when set. */
+		onClose?: () => void
 		description?: Snippet | undefined
 		hideTarget?: boolean
 		hideTooltips?: boolean
@@ -58,6 +66,8 @@
 
 	let {
 		useDrawer = true,
+		inline = false,
+		onClose = undefined,
 		description = undefined,
 		hideTarget = false,
 		hideTooltips = false,
@@ -73,8 +83,11 @@
 		onDelete = undefined,
 		onReset = undefined
 	}: Props = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	const operatingHref = useOperatingWorkspaceHref()
+	const wsId = $derived($operatingWorkspace)
 
 	let drawer: Drawer | undefined = $state()
 	let is_flow: boolean = $state(false)
@@ -88,7 +101,13 @@
 	let pathError = $state('')
 	let mode = $state<TriggerMode>('enabled')
 	let dirtyPath = $state(false)
-	let can_write = $state(true)
+	let permsPath = $state<string | undefined>(undefined)
+	let permsForWrite = $state<Record<string, boolean> | undefined>(undefined)
+	// The acting user in the operating workspace arrives asynchronously, and an unknown user
+	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
+	const can_write = $derived(
+		permsPath === undefined ? true : canWrite(permsPath, permsForWrite ?? {}, actingUser)
+	)
 	let drawerLoading = $state(true)
 	let showLoading = $state(false)
 	let initialConfig: Record<string, any> | undefined = undefined
@@ -158,6 +177,8 @@
 		defaultConfig?: Record<string, any>,
 		fixedScriptPath_?: string
 	) {
+		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
+		operatingUser.forgetFailures()
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100) // Do not show loading spinner for the first 100ms
@@ -236,6 +257,8 @@
 	}
 
 	function loadTriggerConfig(cfg?: Record<string, any>): void {
+		// The loaded trigger says what it runs; an opener's `isFlow` is only its guess.
+		if (cfg?.is_flow !== undefined) itemKind = cfg.is_flow ? 'flow' : 'script'
 		script_path = cfg?.script_path
 		initialScriptPath = cfg?.script_path
 		is_flow = cfg?.is_flow
@@ -249,7 +272,8 @@
 		autoCommit = cfg?.auto_commit ?? true
 		mode = cfg?.mode ?? 'enabled'
 		extra_perms = cfg?.extra_perms
-		can_write = canWrite(path, cfg?.extra_perms, $userStore)
+		permsPath = path
+		permsForWrite = cfg?.extra_perms
 		error_handler_path = cfg?.error_handler_path
 		error_handler_args = cfg?.error_handler_args ?? {}
 		retry = cfg?.retry
@@ -417,36 +441,44 @@
 	/>
 {/if}
 
-{#if useDrawer}
+{#snippet drawerBody()}
+	<DrawerContent
+		hideClose={inline && !onClose}
+		fullScreen={!inline}
+		bannerReserved={draftSync.hasBaseline}
+		title={edit
+			? can_write
+				? `Edit Kafka trigger ${initialPath}`
+				: `Kafka trigger ${initialPath}`
+			: 'New Kafka trigger'}
+		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
+	>
+		{#snippet actions()}
+			{@render actionsButtons('sm')}
+		{/snippet}
+		{#snippet banner()}
+			<LocalDraftBanner
+				show={draftSync.hasDraft}
+				getDeployed={() => draftSync.deployed}
+				reserveSpace={draftSync.hasBaseline}
+				getCurrent={() => draftSync.current}
+				onDiscard={() => draftSync.resetToDeployed(initialPath)}
+				disabled={!can_write}
+			/>
+		{/snippet}
+		{@render config()}
+	</DrawerContent>
+{/snippet}
+
+{#if useDrawer && inline}
+	{@render drawerBody()}
+{:else if useDrawer}
 	<Drawer
 		size="800px"
 		bind:this={drawer}
 		on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.kafka.path)}
 	>
-		<DrawerContent
-			bannerReserved={draftSync.hasBaseline}
-			title={edit
-				? can_write
-					? `Edit Kafka trigger ${initialPath}`
-					: `Kafka trigger ${initialPath}`
-				: 'New Kafka trigger'}
-			on:close={drawer.closeDrawer}
-		>
-			{#snippet actions()}
-				{@render actionsButtons('sm')}
-			{/snippet}
-			{#snippet banner()}
-				<LocalDraftBanner
-					show={draftSync.hasDraft}
-					getDeployed={() => draftSync.deployed}
-					reserveSpace={draftSync.hasBaseline}
-					getCurrent={() => draftSync.current}
-					onDiscard={() => draftSync.resetToDeployed(initialPath)}
-					disabled={!can_write}
-				/>
-			{/snippet}
-			{@render config()}
-		</DrawerContent>
+		{@render drawerBody()}
 	</Drawer>
 {:else}
 	<Section label={!customLabel ? 'Kafka trigger' : ''} headerClass="grow min-w-0 h-[30px]">
@@ -543,7 +575,7 @@
 						bind:scriptPath={script_path}
 						{initialScriptPath}
 						canWrite={can_write}
-						isOperator={!!$userStore?.operator}
+						isOperator={!!actingUser?.operator}
 					>
 						{#snippet createButton()}
 							{#if emptyString(script_path)}
@@ -552,7 +584,9 @@
 									variant="accent"
 									size="xs"
 									disabled={!can_write}
-									href={itemKind === 'flow' ? '/flows/add?hub=65' : '/scripts/add?hub=hub%2F19659'}
+									href={operatingHref(
+										itemKind === 'flow' ? '/flows/add?hub=65' : '/scripts/add?hub=hub%2F19659'
+									)}
 									target="_blank">Create from template</Button
 								>
 							{/if}
diff --git a/frontend/src/lib/components/triggers/kafka/KafkaTriggersConfigSection.svelte b/frontend/src/lib/components/triggers/kafka/KafkaTriggersConfigSection.svelte
index 4cf4225fd9..c6e5c56c74 100644
--- a/frontend/src/lib/components/triggers/kafka/KafkaTriggersConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/kafka/KafkaTriggersConfigSection.svelte
@@ -3,11 +3,10 @@
 	import Section from '$lib/components/Section.svelte'
 	import Subsection from '$lib/components/Subsection.svelte'
 	import SchemaForm from '../../SchemaForm.svelte'
-	import { workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import TestTriggerConnection from '../TestTriggerConnection.svelte'
 	import TestingBadge from '../testingBadge.svelte'
 	import { untrack } from 'svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		path: string
@@ -26,8 +25,8 @@
 		can_write = true,
 		showTestingBadge = false
 	}: Props = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	const kafkaConfigSchema = {
 		$schema: 'http://json-schema.org/draft-07/schema#',
@@ -103,7 +102,6 @@
 					/>
 				</Subsection>
 			</div>
-
 		</div>
 	</Section>
 </div>
diff --git a/frontend/src/lib/components/triggers/mqtt/MqttEditorConfigSection.svelte b/frontend/src/lib/components/triggers/mqtt/MqttEditorConfigSection.svelte
index 0381417c03..4f31a9c891 100644
--- a/frontend/src/lib/components/triggers/mqtt/MqttEditorConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/mqtt/MqttEditorConfigSection.svelte
@@ -16,8 +16,7 @@
 	import Tooltip from '$lib/components/Tooltip.svelte'
 	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import TestingBadge from '../testingBadge.svelte'
-	import { workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		can_write?: boolean
@@ -39,8 +38,8 @@
 		showTestingBadge = false
 	}: Props = $props()
 
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	const isValidSubscribeTopics = (subscribe_topics: MqttSubscribeTopic[]): boolean => {
 		if (
diff --git a/frontend/src/lib/components/triggers/mqtt/MqttTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/mqtt/MqttTriggerEditorInner.svelte
index f25e841fc1..3627bd2d4d 100644
--- a/frontend/src/lib/components/triggers/mqtt/MqttTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/mqtt/MqttTriggerEditorInner.svelte
@@ -10,8 +10,7 @@
 	import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
 	import Path from '$lib/components/Path.svelte'
 	import TriggerRunnablePicker from '$lib/components/triggers/TriggerRunnablePicker.svelte'
-	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+	import { usedTriggerKinds } from '$lib/stores'
 	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import Section from '$lib/components/Section.svelte'
@@ -46,9 +45,18 @@
 	import { deepEqual } from 'fast-equals'
 	import { useTriggerDraftSync } from '../useTriggerDraftSync.svelte'
 	import LocalDraftBanner from '$lib/components/LocalDraftBanner.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace,
+		useOperatingWorkspaceHref
+	} from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		useDrawer?: boolean
+		/** With `useDrawer`, render the drawer's content in place, filling the parent, with no drawer or close button. */
+		inline?: boolean
+		/** With `inline`, closes whatever hosts the editor; the header has a close button only when set. */
+		onClose?: () => void
 		description?: Snippet | undefined
 		hideTarget?: boolean
 		hideTooltips?: boolean
@@ -67,6 +75,8 @@
 
 	let {
 		useDrawer = true,
+		inline = false,
+		onClose = undefined,
 		description = undefined,
 		hideTarget = false,
 		hideTooltips = false,
@@ -82,8 +92,11 @@
 		onReset = undefined,
 		cloudDisabled = false
 	}: Props = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	const operatingHref = useOperatingWorkspaceHref()
+	const wsId = $derived($operatingWorkspace)
 
 	let mqtt_resource_path: string = $state('')
 	let drawer: Drawer | undefined = $state(undefined)
@@ -98,7 +111,13 @@
 	let pathError = $state('')
 	let mode = $state<TriggerMode>('enabled')
 	let dirtyPath = $state(false)
-	let can_write = $state(true)
+	let permsPath = $state<string | undefined>(undefined)
+	let permsForWrite = $state<Record<string, boolean> | undefined>(undefined)
+	// The acting user in the operating workspace arrives asynchronously, and an unknown user
+	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
+	const can_write = $derived(
+		permsPath === undefined ? true : canWrite(permsPath, permsForWrite ?? {}, actingUser)
+	)
 	let drawerLoading = $state(true)
 	let showLoading = $state(false)
 	let subscribe_topics: MqttSubscribeTopic[] = $state([])
@@ -153,6 +172,8 @@
 		defaultConfig?: Record<string, any>,
 		fixedScriptPath_?: string
 	) {
+		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
+		operatingUser.forgetFailures()
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100) // Do not show loading spinner for the first 100ms
@@ -232,6 +253,8 @@
 	}
 
 	async function loadTriggerConfig(cfg?: Record<string, any>): Promise<void> {
+		// The loaded trigger says what it runs; an opener's `isFlow` is only its guess.
+		if (cfg?.is_flow !== undefined) itemKind = cfg.is_flow ? 'flow' : 'script'
 		try {
 			mqtt_resource_path = cfg?.mqtt_resource_path
 			subscribe_topics = cfg?.subscribe_topics
@@ -244,7 +267,8 @@
 			v3_config = cfg?.v3_config ?? DEFAULT_V3_CONFIG
 			v5_config = cfg?.v5_config ?? DEFAULT_V5_CONFIG
 			client_id = cfg?.client_id ?? ''
-			can_write = canWrite(cfg?.path, cfg?.extra_perms, $userStore)
+			permsPath = cfg?.path
+			permsForWrite = cfg?.extra_perms
 			error_handler_path = cfg?.error_handler_path
 			error_handler_args = cfg?.error_handler_args ?? {}
 			retry = cfg?.retry
@@ -391,36 +415,44 @@
 	/>
 {/if}
 
-{#if useDrawer}
+{#snippet drawerBody()}
+	<DrawerContent
+		hideClose={inline && !onClose}
+		fullScreen={!inline}
+		bannerReserved={draftSync.hasBaseline}
+		title={edit
+			? can_write
+				? `Edit MQTT trigger ${initialPath}`
+				: `MQTT trigger ${initialPath}`
+			: 'New MQTT trigger'}
+		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
+	>
+		{#snippet actions()}
+			{@render actionsSnippet()}
+		{/snippet}
+		{#snippet banner()}
+			<LocalDraftBanner
+				show={draftSync.hasDraft}
+				getDeployed={() => draftSync.deployed}
+				reserveSpace={draftSync.hasBaseline}
+				getCurrent={() => draftSync.current}
+				onDiscard={() => draftSync.resetToDeployed(initialPath)}
+				disabled={!can_write}
+			/>
+		{/snippet}
+		{@render config()}
+	</DrawerContent>
+{/snippet}
+
+{#if useDrawer && inline}
+	{@render drawerBody()}
+{:else if useDrawer}
 	<Drawer
 		size="800px"
 		bind:this={drawer}
 		on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.mqtt.path)}
 	>
-		<DrawerContent
-			bannerReserved={draftSync.hasBaseline}
-			title={edit
-				? can_write
-					? `Edit MQTT trigger ${initialPath}`
-					: `MQTT trigger ${initialPath}`
-				: 'New MQTT trigger'}
-			on:close={drawer.closeDrawer}
-		>
-			{#snippet actions()}
-				{@render actionsSnippet()}
-			{/snippet}
-			{#snippet banner()}
-				<LocalDraftBanner
-					show={draftSync.hasDraft}
-					getDeployed={() => draftSync.deployed}
-					reserveSpace={draftSync.hasBaseline}
-					getCurrent={() => draftSync.current}
-					onDiscard={() => draftSync.resetToDeployed(initialPath)}
-					disabled={!can_write}
-				/>
-			{/snippet}
-			{@render config()}
-		</DrawerContent>
+		{@render drawerBody()}
 	</Drawer>
 {:else}
 	<Section label={!customLabel ? 'MQTT trigger' : ''} headerClass="grow min-w-0 h-[30px]">
@@ -517,7 +549,7 @@
 						bind:scriptPath={script_path}
 						{initialScriptPath}
 						canWrite={can_write}
-						isOperator={!!$userStore?.operator}
+						isOperator={!!actingUser?.operator}
 					>
 						{#snippet createButton()}
 							{#if emptyString(script_path)}
@@ -526,7 +558,9 @@
 									variant="accent"
 									size="xs"
 									disabled={!can_write}
-									href={itemKind === 'flow' ? '/flows/add?hub=61' : '/scripts/add?hub=hub%2F19655'}
+									href={operatingHref(
+										itemKind === 'flow' ? '/flows/add?hub=61' : '/scripts/add?hub=hub%2F19655'
+									)}
 									target="_blank"
 								>
 									Create from template
diff --git a/frontend/src/lib/components/triggers/native/NativeTriggerEditor.svelte b/frontend/src/lib/components/triggers/native/NativeTriggerEditor.svelte
index b7bf3fa567..677bfe857c 100644
--- a/frontend/src/lib/components/triggers/native/NativeTriggerEditor.svelte
+++ b/frontend/src/lib/components/triggers/native/NativeTriggerEditor.svelte
@@ -8,7 +8,7 @@
 		getTemplatePath,
 		saveNativeTriggerFromCfg
 	} from './utils'
-	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
+	import { usedTriggerKinds } from '$lib/stores'
 	import { canWrite, emptyString, sendUserToast } from '$lib/utils'
 	import { Button } from '$lib/components/common'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
@@ -27,6 +27,14 @@
 	import { deepEqual } from 'fast-equals'
 	import type { Snippet } from 'svelte'
 	import Alert from '$lib/components/common/alert/Alert.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	interface Props {
 		service: NativeServiceName
@@ -102,7 +110,15 @@
 	let isFlow = $state(false)
 	let summary = $state('')
 	let externalId = $state<string | null>(null)
-	let can_write = $state(true)
+	let permsScriptPath = $state<string | undefined>(undefined)
+	// A verdict that does not come from a loaded trigger: a new one is writable, and a trigger
+	// that failed to load is not.
+	let writeVerdict = $state<boolean | undefined>(undefined)
+	// Derived, not snapshotted at load: the acting user's role arrives on its own schedule, and
+	// a trigger that loaded first would otherwise stay read-only until reopened.
+	const can_write = $derived(
+		writeVerdict ?? (permsScriptPath === undefined || canWrite(permsScriptPath, {}, actingUser))
+	)
 	let originalConfig = $state<Record<string, any> | undefined>(undefined)
 	let initialConfig = $state<Record<string, any> | undefined>(undefined)
 	let loadError = $state<string | undefined>(undefined)
@@ -131,7 +147,8 @@
 		externalId = null
 		loadingConfig = false
 		loadingForm = false
-		can_write = true
+		writeVerdict = true
+		permsScriptPath = undefined
 		originalConfig = undefined
 		initialConfig = undefined
 		summary = ''
@@ -159,7 +176,8 @@
 		externalId = null
 		loadingConfig = false
 		loadingForm = false
-		can_write = true
+		writeVerdict = true
+		permsScriptPath = undefined
 		originalConfig = undefined
 		initialConfig = undefined
 		summary = nativeTrigger.summary ?? ''
@@ -204,7 +222,7 @@
 
 		try {
 			const fullTrigger = await NativeTriggerService.getNativeTrigger({
-				workspace: $workspaceStore!,
+				workspace: $operatingWorkspace!,
 				serviceName: service,
 				externalId: externalIdOrPath
 			})
@@ -212,7 +230,8 @@
 			serviceConfig = (fullTrigger.service_config as Record<string, any>) || {}
 			scriptPath = fullTrigger.script_path
 			initialScriptPath = fullTrigger.script_path
-			can_write = canWrite(fullTrigger.script_path, {}, $userStore)
+			permsScriptPath = fullTrigger.script_path
+			writeVerdict = undefined
 			summary = fullTrigger.summary ?? ''
 			externalData = fullTrigger.external_data
 			externalError = fullTrigger.external_error ?? undefined
@@ -230,7 +249,7 @@
 			// The service form is not rendered in the error state, so nothing else will ever
 			// clear its loading flag or narrow the permission left over from the last trigger.
 			loadingForm = false
-			can_write = false
+			writeVerdict = false
 			retryEdit = () => openEdit(externalIdOrPath, nis_flow, defaultValues)
 		} finally {
 			clearTimeout(loadingTimeout)
@@ -308,7 +327,7 @@
 		enabled = next
 		try {
 			await NativeTriggerService.setNativeTriggerEnabled({
-				workspace: $workspaceStore!,
+				workspace: $operatingWorkspace!,
 				serviceName: service,
 				externalId,
 				requestBody: { enabled: next }
@@ -335,7 +354,7 @@
 			// before anything can pause it again.
 			isRecreate ? { ...saveCfg, enabled } : saveCfg,
 			!isNew,
-			$workspaceStore!,
+			$operatingWorkspace!,
 			usedTriggerKinds
 		)
 		if (newExternalId) {
@@ -345,7 +364,7 @@
 				if (isRecreate && oldExternalIdToDelete) {
 					try {
 						await NativeTriggerService.deleteNativeTrigger({
-							workspace: $workspaceStore!,
+							workspace: $operatingWorkspace!,
 							serviceName: service,
 							externalId: oldExternalIdToDelete
 						})
@@ -515,7 +534,7 @@
 							bind:itemKind
 							kinds={['script']}
 							allowFlow={true}
-							allowEdit={!$userStore?.operator}
+							allowEdit={!actingUser?.operator}
 							clearable
 						/>
 						{#if emptyString(scriptPath)}
diff --git a/frontend/src/lib/components/triggers/native/NativeTriggerTable.svelte b/frontend/src/lib/components/triggers/native/NativeTriggerTable.svelte
index 6f28875b17..098cc18ce3 100644
--- a/frontend/src/lib/components/triggers/native/NativeTriggerTable.svelte
+++ b/frontend/src/lib/components/triggers/native/NativeTriggerTable.svelte
@@ -4,7 +4,7 @@
 	import type { ExtendedNativeTrigger } from './utils'
 	import { getServiceConfig } from './utils'
 	import { canWrite, sendUserToast } from '$lib/utils'
-	import { userStore, workspaceStore } from '$lib/stores'
+	import { userStore } from '$lib/stores'
 	import TriggerModeToggle from '$lib/components/triggers/TriggerModeToggle.svelte'
 	import Skeleton from '$lib/components/common/skeleton/Skeleton.svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
@@ -16,6 +16,9 @@
 	import Alert from '$lib/components/common/alert/Alert.svelte'
 	import GoogleDriveIcon from '$lib/components/icons/GoogleDriveIcon.svelte'
 	import GoogleCalendarIcon from '$lib/components/icons/GoogleCalendarIcon.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	type TriggerW = ExtendedNativeTrigger & { marked?: any }
 
@@ -51,7 +54,7 @@
 		const enabled = mode === 'enabled'
 		try {
 			await NativeTriggerService.setNativeTriggerEnabled({
-				workspace: $workspaceStore!,
+				workspace: $operatingWorkspace!,
 				serviceName: service,
 				externalId: trigger.external_id,
 				requestBody: { enabled }
@@ -76,7 +79,7 @@
 		isDeleting = true
 		try {
 			await NativeTriggerService.deleteNativeTrigger({
-				workspace: $workspaceStore!,
+				workspace: $operatingWorkspace!,
 				serviceName: service,
 				externalId: triggerToDelete.external_id
 			})
diff --git a/frontend/src/lib/components/triggers/native/services/github/GitHubTriggerForm.svelte b/frontend/src/lib/components/triggers/native/services/github/GitHubTriggerForm.svelte
index 5e31dfc33c..27add7f797 100644
--- a/frontend/src/lib/components/triggers/native/services/github/GitHubTriggerForm.svelte
+++ b/frontend/src/lib/components/triggers/native/services/github/GitHubTriggerForm.svelte
@@ -4,9 +4,11 @@
 	import MultiSelect from '$lib/components/select/MultiSelect.svelte'
 	import { NativeTriggerService } from '$lib/gen/services.gen'
 	import type { GithubRepoEntry } from '$lib/gen/types.gen'
-	import { workspaceStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
 	import { Loader2 } from 'lucide-svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		serviceConfig: Record<string, any>
@@ -57,14 +59,14 @@
 	let selectedEvents = $state<string[]>(externalData?.events ?? serviceConfig.events ?? ['push'])
 
 	async function loadRepos() {
-		if (!$workspaceStore) {
+		if (!$operatingWorkspace) {
 			repos = []
 			return
 		}
 		loading = true
 		try {
 			repos = await NativeTriggerService.listGithubRepos({
-				workspace: $workspaceStore
+				workspace: $operatingWorkspace
 			})
 		} catch (err: any) {
 			console.error('Failed to load GitHub repositories:', err)
@@ -76,7 +78,7 @@
 	}
 
 	$effect(() => {
-		if ($workspaceStore) {
+		if ($operatingWorkspace) {
 			loadRepos()
 		}
 	})
diff --git a/frontend/src/lib/components/triggers/native/services/google/GoogleCalendarPicker.svelte b/frontend/src/lib/components/triggers/native/services/google/GoogleCalendarPicker.svelte
index 98c23f8755..f4c6d9894b 100644
--- a/frontend/src/lib/components/triggers/native/services/google/GoogleCalendarPicker.svelte
+++ b/frontend/src/lib/components/triggers/native/services/google/GoogleCalendarPicker.svelte
@@ -1,11 +1,13 @@
 <script lang="ts">
 	import { NativeTriggerService } from '$lib/gen/services.gen'
 	import type { GoogleCalendarEntry } from '$lib/gen/types.gen'
-	import { workspaceStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/utils'
 	import { Badge } from '$lib/components/common'
 	import { Loader2, X, RefreshCw } from 'lucide-svelte'
 	import GoogleCalendarIcon from '$lib/components/icons/GoogleCalendarIcon.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		calendarId: string
@@ -13,22 +15,18 @@
 		disabled?: boolean
 	}
 
-	let {
-		calendarId = $bindable(),
-		calendarName = $bindable(),
-		disabled = false
-	}: Props = $props()
+	let { calendarId = $bindable(), calendarName = $bindable(), disabled = false }: Props = $props()
 
 	let calendars = $state<GoogleCalendarEntry[]>([])
 	let loading = $state(false)
 
 	async function loadCalendars() {
-		if (!$workspaceStore) return
+		if (!$operatingWorkspace) return
 
 		loading = true
 		try {
 			calendars = await NativeTriggerService.listGoogleCalendars({
-				workspace: $workspaceStore
+				workspace: $operatingWorkspace
 			})
 			if (calendarId && !calendarName) {
 				const found = calendars.find((c) => c.id === calendarId)
@@ -55,7 +53,7 @@
 	}
 
 	$effect(() => {
-		if ($workspaceStore) {
+		if ($operatingWorkspace) {
 			loadCalendars()
 		}
 	})
diff --git a/frontend/src/lib/components/triggers/native/services/google/GoogleDrivePicker.svelte b/frontend/src/lib/components/triggers/native/services/google/GoogleDrivePicker.svelte
index 359dfc3536..597eb7d514 100644
--- a/frontend/src/lib/components/triggers/native/services/google/GoogleDrivePicker.svelte
+++ b/frontend/src/lib/components/triggers/native/services/google/GoogleDrivePicker.svelte
@@ -1,23 +1,16 @@
 <script lang="ts">
 	import { NativeTriggerService } from '$lib/gen/services.gen'
 	import type { GoogleDriveFile, SharedDriveEntry } from '$lib/gen/types.gen'
-	import { workspaceStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/utils'
 	import { Button } from '$lib/components/common'
-	import {
-		Loader2,
-		Folder,
-		File,
-		ChevronRight,
-		Search,
-		X,
-		RefreshCw,
-		Check
-	} from 'lucide-svelte'
+	import { Loader2, Folder, File, ChevronRight, Search, X, RefreshCw, Check } from 'lucide-svelte'
 	import GoogleDriveIcon from '$lib/components/icons/GoogleDriveIcon.svelte'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
 	import { Debounced, watch } from 'runed'
 	import { untrack } from 'svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		resourceId: string
@@ -25,11 +18,7 @@
 		disabled?: boolean
 	}
 
-	let {
-		resourceId = $bindable(),
-		resourceName = $bindable(),
-		disabled = false
-	}: Props = $props()
+	let { resourceId = $bindable(), resourceName = $bindable(), disabled = false }: Props = $props()
 
 	type BreadcrumbItem = { id: string; name: string }
 	type DriveTab = 'my_drive' | 'shared_with_me' | 'shared_drives'
@@ -49,7 +38,7 @@
 	let loadVersion = 0
 
 	async function loadFiles(pageToken?: string) {
-		if (!$workspaceStore) return
+		if (!$operatingWorkspace) return
 
 		const version = ++loadVersion
 
@@ -63,7 +52,7 @@
 
 		try {
 			const params: Parameters<typeof NativeTriggerService.listGoogleDriveFiles>[0] = {
-				workspace: $workspaceStore,
+				workspace: $operatingWorkspace,
 				pageToken
 			}
 
@@ -101,7 +90,7 @@
 	}
 
 	async function loadSharedDrives() {
-		if (!$workspaceStore) return
+		if (!$operatingWorkspace) return
 
 		loadingFiles = true
 		files = []
@@ -109,7 +98,7 @@
 
 		try {
 			sharedDrives = await NativeTriggerService.listGoogleSharedDrives({
-				workspace: $workspaceStore
+				workspace: $operatingWorkspace
 			})
 		} catch (err: any) {
 			sendUserToast(`Failed to load shared drives: ${err.body || err.message}`, true)
@@ -161,7 +150,7 @@
 
 	// Initial load when workspace is available
 	$effect(() => {
-		if ($workspaceStore) {
+		if ($operatingWorkspace) {
 			untrack(() => loadFiles())
 		}
 	})
@@ -169,28 +158,37 @@
 	// React to debounced search changes (skip initial)
 	watch(
 		() => debouncedSearch.current,
-		() => { loadFiles() },
+		() => {
+			loadFiles()
+		},
 		{ lazy: true }
 	)
 </script>
 
 <div class="flex flex-col gap-2 border rounded-md p-2 bg-surface">
 	{#if resourceId}
-		<div class="flex items-center gap-2 px-2 py-1 rounded bg-surface-selected text-secondary text-xs border">
+		<div
+			class="flex items-center gap-2 px-2 py-1 rounded bg-surface-selected text-secondary text-xs border"
+		>
 			<GoogleDriveIcon width="14px" height="14px" />
 			<span>
 				Selected: <strong>{resourceName || resourceId}</strong>
 			</span>
 			<button
 				class="ml-auto text-tertiary hover:text-secondary"
-				onclick={() => { resourceId = ''; resourceName = '' }}
+				onclick={() => {
+					resourceId = ''
+					resourceName = ''
+				}}
 				{disabled}
 			>
 				<X size={14} />
 			</button>
 		</div>
 	{:else}
-		<div class="flex items-center gap-2 px-2 py-1 rounded text-tertiary text-xs border border-dashed">
+		<div
+			class="flex items-center gap-2 px-2 py-1 rounded text-tertiary text-xs border border-dashed"
+		>
 			<GoogleDriveIcon width="14px" height="14px" />
 			<span>No file selected</span>
 		</div>
@@ -198,21 +196,27 @@
 
 	<div class="flex items-center gap-1 text-2xs">
 		<button
-			class="px-2 py-0.5 rounded {activeTab === 'my_drive' ? 'bg-surface-selected font-semibold' : 'hover:bg-surface-hover'}"
+			class="px-2 py-0.5 rounded {activeTab === 'my_drive'
+				? 'bg-surface-selected font-semibold'
+				: 'hover:bg-surface-hover'}"
 			onclick={() => switchTab('my_drive')}
 			{disabled}
 		>
 			My Drive
 		</button>
 		<button
-			class="px-2 py-0.5 rounded {activeTab === 'shared_with_me' ? 'bg-surface-selected font-semibold' : 'hover:bg-surface-hover'}"
+			class="px-2 py-0.5 rounded {activeTab === 'shared_with_me'
+				? 'bg-surface-selected font-semibold'
+				: 'hover:bg-surface-hover'}"
 			onclick={() => switchTab('shared_with_me')}
 			{disabled}
 		>
 			Shared with me
 		</button>
 		<button
-			class="px-2 py-0.5 rounded {activeTab === 'shared_drives' ? 'bg-surface-selected font-semibold' : 'hover:bg-surface-hover'}"
+			class="px-2 py-0.5 rounded {activeTab === 'shared_drives'
+				? 'bg-surface-selected font-semibold'
+				: 'hover:bg-surface-hover'}"
 			onclick={() => switchTab('shared_drives')}
 			{disabled}
 		>
@@ -222,7 +226,10 @@
 		<button
 			class="p-1 text-tertiary hover:text-secondary"
 			title="Refresh"
-			onclick={() => activeTab === 'shared_drives' && currentParentId === 'root' ? loadSharedDrives() : loadFiles()}
+			onclick={() =>
+				activeTab === 'shared_drives' && currentParentId === 'root'
+					? loadSharedDrives()
+					: loadFiles()}
 			{disabled}
 		>
 			<RefreshCw size={12} />
@@ -237,7 +244,10 @@
 				size="xs"
 				class="!pl-7"
 			/>
-			<Search size={14} class="absolute left-2 top-1/2 -translate-y-1/2 text-tertiary pointer-events-none" />
+			<Search
+				size={14}
+				class="absolute left-2 top-1/2 -translate-y-1/2 text-tertiary pointer-events-none"
+			/>
 			{#if searchQuery}
 				<button
 					class="absolute right-2 top-1/2 -translate-y-1/2 text-tertiary hover:text-secondary"
@@ -277,9 +287,7 @@
 			</div>
 		{:else if activeTab === 'shared_drives' && currentParentId === 'root'}
 			{#if sharedDrives.length === 0}
-				<div class="text-center py-4 text-xs text-tertiary">
-					No shared drives found
-				</div>
+				<div class="text-center py-4 text-xs text-tertiary"> No shared drives found </div>
 			{:else}
 				{#each sharedDrives as drive (drive.id)}
 					<div
diff --git a/frontend/src/lib/components/triggers/native/services/nextcloud/NextcloudTriggerForm.svelte b/frontend/src/lib/components/triggers/native/services/nextcloud/NextcloudTriggerForm.svelte
index c282797b9b..780ccde9e8 100644
--- a/frontend/src/lib/components/triggers/native/services/nextcloud/NextcloudTriggerForm.svelte
+++ b/frontend/src/lib/components/triggers/native/services/nextcloud/NextcloudTriggerForm.svelte
@@ -1,13 +1,15 @@
 <script lang="ts">
 	import { NativeTriggerService } from '$lib/gen/services.gen'
 	import type { NextCloudEventType } from '$lib/gen/types.gen'
-	import { workspaceStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/utils'
 	import { Button } from '$lib/components/common'
 	import SchemaForm from '$lib/components/SchemaForm.svelte'
 	import Section from '$lib/components/Section.svelte'
 	import { Loader2 } from 'lucide-svelte'
 	import { getNextcloudSchema } from '../../utils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		serviceConfig: Record<string, any>
@@ -38,7 +40,7 @@
 	let eventsError = $state<string | undefined>(undefined)
 
 	async function loadAvailableEvents() {
-		if (!$workspaceStore) {
+		if (!$operatingWorkspace) {
 			availableEvents = []
 			return
 		}
@@ -47,7 +49,7 @@
 		eventsError = undefined
 		try {
 			const events = await NativeTriggerService.listNextCloudEvents({
-				workspace: $workspaceStore!
+				workspace: $operatingWorkspace!
 			})
 			availableEvents = events
 			serviceSchema = getNextcloudSchema(events)
@@ -84,7 +86,7 @@
 	let externalDataApplied = $state(false)
 
 	$effect(() => {
-		if ($workspaceStore) {
+		if ($operatingWorkspace) {
 			loadAvailableEvents()
 		}
 	})
diff --git a/frontend/src/lib/components/triggers/nats/NatsTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/nats/NatsTriggerEditorInner.svelte
index 1ee7b9c594..045f7155d3 100644
--- a/frontend/src/lib/components/triggers/nats/NatsTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/nats/NatsTriggerEditorInner.svelte
@@ -10,8 +10,7 @@
 	import Path from '$lib/components/Path.svelte'
 	import TriggerRunnablePicker from '$lib/components/triggers/TriggerRunnablePicker.svelte'
 	import { NatsTriggerService, type ErrorHandler, type Retry, type TriggerMode } from '$lib/gen'
-	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+	import { usedTriggerKinds } from '$lib/stores'
 	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import Section from '$lib/components/Section.svelte'
@@ -32,9 +31,18 @@
 	import LocalDraftBanner from '$lib/components/LocalDraftBanner.svelte'
 	import TriggerSuspendedJobsAlert from '../TriggerSuspendedJobsAlert.svelte'
 	import TriggerSuspendedJobsModal from '../TriggerSuspendedJobsModal.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace,
+		useOperatingWorkspaceHref
+	} from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		useDrawer?: boolean
+		/** With `useDrawer`, render the drawer's content in place, filling the parent, with no drawer or close button. */
+		inline?: boolean
+		/** With `inline`, closes whatever hosts the editor; the header has a close button only when set. */
+		onClose?: () => void
 		description?: Snippet | undefined
 		hideTarget?: boolean
 		hideTooltips?: boolean
@@ -54,6 +62,8 @@
 
 	let {
 		useDrawer = true,
+		inline = false,
+		onClose = undefined,
 		description = undefined,
 		hideTarget = false,
 		hideTooltips = false,
@@ -69,8 +79,11 @@
 		onDelete = undefined,
 		onReset = undefined
 	}: Props = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	const operatingHref = useOperatingWorkspaceHref()
+	const wsId = $derived($operatingWorkspace)
 
 	let drawer: Drawer | undefined = $state(undefined)
 	let is_flow: boolean = $state(false)
@@ -83,7 +96,13 @@
 	let path: string = $state('')
 	let pathError = $state('')
 	let dirtyPath = $state(false)
-	let can_write = $state(true)
+	let permsPath = $state<string | undefined>(undefined)
+	let permsForWrite = $state<Record<string, boolean> | undefined>(undefined)
+	// The acting user in the operating workspace arrives asynchronously, and an unknown user
+	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
+	const can_write = $derived(
+		permsPath === undefined ? true : canWrite(permsPath, permsForWrite ?? {}, actingUser)
+	)
 	let drawerLoading = $state(true)
 	let showLoading = $state(false)
 	let defaultValues: Record<string, any> | undefined = $state(undefined)
@@ -141,6 +160,8 @@
 		defaultConfig?: Record<string, any>,
 		fixedScriptPath_?: string
 	) {
+		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
+		operatingUser.forgetFailures()
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100) // Do not show loading spinner for the first 100ms
@@ -225,6 +246,8 @@
 	}
 
 	async function loadTriggerConfig(cfg?: Record<string, any>): Promise<void> {
+		// The loaded trigger says what it runs; an opener's `isFlow` is only its guess.
+		if (cfg?.is_flow !== undefined) itemKind = cfg.is_flow ? 'flow' : 'script'
 		script_path = cfg?.script_path
 		initialScriptPath = cfg?.script_path
 		is_flow = cfg?.is_flow
@@ -238,7 +261,8 @@
 			consumer_name: useJetstream ? cfg?.consumer_name || '' : undefined
 		}
 		mode = cfg?.mode ?? 'enabled'
-		can_write = canWrite(cfg?.path, cfg?.extra_perms, $userStore)
+		permsPath = cfg?.path
+		permsForWrite = cfg?.extra_perms
 		error_handler_path = cfg?.error_handler_path
 		error_handler_args = cfg?.error_handler_args ?? {}
 		retry = cfg?.retry
@@ -388,36 +412,44 @@
 	/>
 {/if}
 
-{#if useDrawer}
+{#snippet drawerBody()}
+	<DrawerContent
+		hideClose={inline && !onClose}
+		fullScreen={!inline}
+		bannerReserved={draftSync.hasBaseline}
+		title={edit
+			? can_write
+				? `Edit NATS trigger ${initialPath}`
+				: `NATS trigger ${initialPath}`
+			: 'New NATS trigger'}
+		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
+	>
+		{#snippet actions()}
+			{@render actionsSnippet()}
+		{/snippet}
+		{#snippet banner()}
+			<LocalDraftBanner
+				show={draftSync.hasDraft}
+				getDeployed={() => draftSync.deployed}
+				reserveSpace={draftSync.hasBaseline}
+				getCurrent={() => draftSync.current}
+				onDiscard={() => draftSync.resetToDeployed(initialPath)}
+				disabled={!can_write}
+			/>
+		{/snippet}
+		{@render config()}
+	</DrawerContent>
+{/snippet}
+
+{#if useDrawer && inline}
+	{@render drawerBody()}
+{:else if useDrawer}
 	<Drawer
 		size="800px"
 		bind:this={drawer}
 		on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.nats.path)}
 	>
-		<DrawerContent
-			bannerReserved={draftSync.hasBaseline}
-			title={edit
-				? can_write
-					? `Edit NATS trigger ${initialPath}`
-					: `NATS trigger ${initialPath}`
-				: 'New NATS trigger'}
-			on:close={drawer.closeDrawer}
-		>
-			{#snippet actions()}
-				{@render actionsSnippet()}
-			{/snippet}
-			{#snippet banner()}
-				<LocalDraftBanner
-					show={draftSync.hasDraft}
-					getDeployed={() => draftSync.deployed}
-					reserveSpace={draftSync.hasBaseline}
-					getCurrent={() => draftSync.current}
-					onDiscard={() => draftSync.resetToDeployed(initialPath)}
-					disabled={!can_write}
-				/>
-			{/snippet}
-			{@render config()}
-		</DrawerContent>
+		{@render drawerBody()}
 	</Drawer>
 {:else}
 	<Section label={!customLabel ? 'NATS trigger' : ''} headerClass="grow min-w-0 h-[30px]">
@@ -512,7 +544,7 @@
 						bind:scriptPath={script_path}
 						{initialScriptPath}
 						canWrite={can_write}
-						isOperator={!!$userStore?.operator}
+						isOperator={!!actingUser?.operator}
 					>
 						{#snippet createButton()}
 							{#if emptyString(script_path)}
@@ -520,7 +552,9 @@
 									btnClasses="ml-4"
 									variant="accent"
 									size="xs"
-									href={itemKind === 'flow' ? '/flows/add?hub=66' : '/scripts/add?hub=hub%2F19663'}
+									href={operatingHref(
+										itemKind === 'flow' ? '/flows/add?hub=66' : '/scripts/add?hub=hub%2F19663'
+									)}
 									target="_blank"
 								>
 									Create from template
diff --git a/frontend/src/lib/components/triggers/nats/NatsTriggersConfigSection.svelte b/frontend/src/lib/components/triggers/nats/NatsTriggersConfigSection.svelte
index 2c459770d0..4d81cf4ff6 100644
--- a/frontend/src/lib/components/triggers/nats/NatsTriggersConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/nats/NatsTriggersConfigSection.svelte
@@ -1,13 +1,12 @@
 <script lang="ts">
 	import Section from '$lib/components/Section.svelte'
 	import Subsection from '$lib/components/Subsection.svelte'
-	import { workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import ResourcePicker from '$lib/components/ResourcePicker.svelte'
 	import SchemaForm from '$lib/components/SchemaForm.svelte'
 	import TestTriggerConnection from '../TestTriggerConnection.svelte'
 	import TestingBadge from '../testingBadge.svelte'
 	import { createEventDispatcher, untrack } from 'svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		defaultValues?: Record<string, any> | undefined
@@ -35,8 +34,8 @@
 		can_write = true,
 		showTestingBadge = false
 	}: Props = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	let otherArgsValid = $state(false)
 	let globalError = $derived(
diff --git a/frontend/src/lib/components/triggers/postgres/CheckPostgresRequirement.svelte b/frontend/src/lib/components/triggers/postgres/CheckPostgresRequirement.svelte
index 194d932c7a..5da889320d 100644
--- a/frontend/src/lib/components/triggers/postgres/CheckPostgresRequirement.svelte
+++ b/frontend/src/lib/components/triggers/postgres/CheckPostgresRequirement.svelte
@@ -2,10 +2,9 @@
 	import { Button } from '$lib/components/common'
 	import Tooltip from '$lib/components/Tooltip.svelte'
 	import { PostgresTriggerService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import { sendUserToast } from '$lib/toast'
 	import { emptyString } from '$lib/utils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	let loadingConfiguration = $state(false)
 
@@ -49,14 +48,14 @@
 	}
 
 	interface Props {
-		can_write: boolean;
-		postgres_resource_path: string;
-		checkConnection?: any | undefined;
+		can_write: boolean
+		postgres_resource_path: string
+		checkConnection?: any | undefined
 	}
 
-	let { can_write, postgres_resource_path, checkConnection = undefined }: Props = $props();
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	let { can_write, postgres_resource_path, checkConnection = undefined }: Props = $props()
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 </script>
 
 {#if postgres_resource_path}
diff --git a/frontend/src/lib/components/triggers/postgres/PostgresTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/postgres/PostgresTriggerEditorInner.svelte
index ecfbd0a081..546b4d2457 100644
--- a/frontend/src/lib/components/triggers/postgres/PostgresTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/postgres/PostgresTriggerEditorInner.svelte
@@ -18,8 +18,7 @@
 		type Retry,
 		type TriggerMode
 	} from '$lib/gen'
-	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+	import { usedTriggerKinds } from '$lib/stores'
 	import { canWrite, emptyString, emptyStringTrimmed, sendUserToast } from '$lib/utils'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import Section from '$lib/components/Section.svelte'
@@ -54,9 +53,18 @@
 	import { useTriggerDraftSync } from '../useTriggerDraftSync.svelte'
 	import LocalDraftBanner from '$lib/components/LocalDraftBanner.svelte'
 	import { capitalize } from '$lib/utils'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace,
+		useOperatingWorkspaceHref
+	} from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		useDrawer?: boolean
+		/** With `useDrawer`, render the drawer's content in place, filling the parent, with no drawer or close button. */
+		inline?: boolean
+		/** With `inline`, closes whatever hosts the editor; the header has a close button only when set. */
+		onClose?: () => void
 		description?: Snippet | undefined
 		hideTarget?: boolean
 		isEditor?: boolean
@@ -75,6 +83,8 @@
 
 	let {
 		useDrawer = true,
+		inline = false,
+		onClose = undefined,
 		description = undefined,
 		hideTarget = false,
 		isEditor = false,
@@ -90,8 +100,11 @@
 		onDelete = undefined,
 		onReset = undefined
 	}: Props = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	const operatingHref = useOperatingWorkspaceHref()
+	const wsId = $derived($operatingWorkspace)
 
 	let drawer: Drawer | undefined = $state(undefined)
 	let is_flow: boolean = $state(false)
@@ -104,7 +117,13 @@
 	let path: string = $state('')
 	let pathError = $state('')
 	let dirtyPath: boolean = $state(false)
-	let can_write: boolean = $state(true)
+	let permsPath = $state<string | undefined>(undefined)
+	let permsForWrite = $state<Record<string, boolean> | undefined>(undefined)
+	// The acting user in the operating workspace arrives asynchronously, and an unknown user
+	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
+	const can_write = $derived(
+		permsPath === undefined ? true : canWrite(permsPath, permsForWrite ?? {}, actingUser)
+	)
 	let drawerLoading: boolean = $state(true)
 	let showLoading: boolean = $state(false)
 	let postgres_resource_path: string = $state('')
@@ -242,6 +261,8 @@
 		defaultConfig?: Record<string, any>,
 		fixedScriptPath_?: string
 	) {
+		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
+		operatingUser.forgetFailures()
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100) // Do not show loading spinner for the first 100ms
@@ -361,6 +382,8 @@
 	}
 
 	async function loadTriggerConfig(cfg?: Record<string, any>): Promise<void> {
+		// The loaded trigger says what it runs; an opener's `isFlow` is only its guess.
+		if (cfg?.is_flow !== undefined) itemKind = cfg.is_flow ? 'flow' : 'script'
 		script_path = cfg?.script_path
 		initialScriptPath = cfg?.script_path
 		is_flow = cfg?.is_flow
@@ -368,7 +391,8 @@
 		postgres_resource_path = cfg?.postgres_resource_path
 		publication_name = cfg?.publication_name
 		replication_slot_name = cfg?.replication_slot_name
-		can_write = canWrite(path, cfg?.extra_perms, $userStore)
+		permsPath = path
+		permsForWrite = cfg?.extra_perms
 		transaction_to_track = [...cfg?.publication?.transaction_to_track]
 		relations = cfg?.publication?.table_to_track ?? []
 		error_handler_path = cfg?.error_handler_path
@@ -491,7 +515,7 @@
 					postgres_resource_path
 				}
 			})
-			window.open(`${base}/scripts/add?id=${templateId}`)
+			window.open(operatingHref(`${base}/scripts/add?id=${templateId}`))
 			loading = false
 		} catch (error) {
 			loading = false
@@ -572,34 +596,42 @@
 	/>
 {/if}
 
-{#if useDrawer}
+{#snippet drawerBody()}
+	<DrawerContent
+		hideClose={inline && !onClose}
+		fullScreen={!inline}
+		bannerReserved={draftSync.hasBaseline}
+		title={edit
+			? can_write
+				? `Edit Postgres trigger ${initialPath}`
+				: `Postgres trigger ${initialPath}`
+			: 'New Postgres trigger'}
+		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
+	>
+		{#snippet actions()}{@render actionsSnippet()}{/snippet}
+		{#snippet banner()}
+			<LocalDraftBanner
+				show={draftSync.hasDraft}
+				getDeployed={() => draftSync.deployed}
+				reserveSpace={draftSync.hasBaseline}
+				getCurrent={() => draftSync.current}
+				onDiscard={() => draftSync.resetToDeployed(initialPath)}
+				disabled={!can_write}
+			/>
+		{/snippet}
+		{@render content()}
+	</DrawerContent>
+{/snippet}
+
+{#if useDrawer && inline}
+	{@render drawerBody()}
+{:else if useDrawer}
 	<Drawer
 		size="800px"
 		bind:this={drawer}
 		on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.postgres.path)}
 	>
-		<DrawerContent
-			bannerReserved={draftSync.hasBaseline}
-			title={edit
-				? can_write
-					? `Edit Postgres trigger ${initialPath}`
-					: `Postgres trigger ${initialPath}`
-				: 'New Postgres trigger'}
-			on:close={drawer.closeDrawer}
-		>
-			{#snippet actions()}{@render actionsSnippet()}{/snippet}
-			{#snippet banner()}
-				<LocalDraftBanner
-					show={draftSync.hasDraft}
-					getDeployed={() => draftSync.deployed}
-					reserveSpace={draftSync.hasBaseline}
-					getCurrent={() => draftSync.current}
-					onDiscard={() => draftSync.resetToDeployed(initialPath)}
-					disabled={!can_write}
-				/>
-			{/snippet}
-			{@render content()}
-		</DrawerContent>
+		{@render drawerBody()}
 	</Drawer>
 {:else}
 	<Section label={!customLabel ? 'Postgres trigger' : ''} headerClass="grow min-w-0 h-[30px]">
@@ -696,7 +728,7 @@
 						bind:scriptPath={script_path}
 						{initialScriptPath}
 						canWrite={can_write}
-						isOperator={!!$userStore?.operator}
+						isOperator={!!actingUser?.operator}
 						promptText="Pick a script or flow to be triggered "
 						promptClass="text-xs text-primary"
 					>
diff --git a/frontend/src/lib/components/triggers/postgres/PublicationPicker.svelte b/frontend/src/lib/components/triggers/postgres/PublicationPicker.svelte
index a7a06b04d4..fdf24b5757 100644
--- a/frontend/src/lib/components/triggers/postgres/PublicationPicker.svelte
+++ b/frontend/src/lib/components/triggers/postgres/PublicationPicker.svelte
@@ -1,25 +1,24 @@
 <script lang="ts">
-	import { run } from 'svelte/legacy';
+	import { run } from 'svelte/legacy'
 
 	import { Button } from '$lib/components/common'
 	import Select from '$lib/components/select/Select.svelte'
 	import { safeSelectItems } from '$lib/components/select/utils.svelte'
 	import type { Relations } from '$lib/gen'
 	import { PostgresTriggerService } from '$lib/gen/services.gen'
-	import { workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import { sendUserToast } from '$lib/toast'
 	import { emptyString } from '$lib/utils'
 	import { RefreshCw } from 'lucide-svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
-		items?: string[];
-		can_write?: boolean;
-		publication_name?: string;
-		postgres_resource_path?: string;
-		relations?: Relations[] | undefined;
-		transaction_to_track?: string[];
-		disabled?: boolean;
+		items?: string[]
+		can_write?: boolean
+		publication_name?: string
+		postgres_resource_path?: string
+		relations?: Relations[] | undefined
+		transaction_to_track?: string[]
+		disabled?: boolean
 	}
 
 	let {
@@ -30,9 +29,9 @@
 		relations = $bindable(undefined),
 		transaction_to_track = $bindable([]),
 		disabled = false
-	}: Props = $props();
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	}: Props = $props()
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	let loadingPublication: boolean = $state(false)
 	let deletingPublication: boolean = $state(false)
@@ -113,7 +112,7 @@
 	listDatabasePublication()
 	run(() => {
 		publication_name && getAllRelations()
-	});
+	})
 </script>
 
 <div class="flex gap-1">
diff --git a/frontend/src/lib/components/triggers/postgres/SlotPicker.svelte b/frontend/src/lib/components/triggers/postgres/SlotPicker.svelte
index ef3ac720ef..4ea985f0e7 100644
--- a/frontend/src/lib/components/triggers/postgres/SlotPicker.svelte
+++ b/frontend/src/lib/components/triggers/postgres/SlotPicker.svelte
@@ -3,17 +3,16 @@
 	import Select from '$lib/components/select/Select.svelte'
 	import { safeSelectItems } from '$lib/components/select/utils.svelte'
 	import { PostgresTriggerService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import { sendUserToast } from '$lib/toast'
 	import { emptyString } from '$lib/utils'
 	import { RefreshCw } from 'lucide-svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
-		edit: boolean;
-		replication_slot_name?: string;
-		postgres_resource_path?: string;
-		disabled?: boolean;
+		edit: boolean
+		replication_slot_name?: string
+		postgres_resource_path?: string
+		disabled?: boolean
 	}
 
 	let {
@@ -21,9 +20,9 @@
 		replication_slot_name = $bindable(''),
 		postgres_resource_path = '',
 		disabled = false
-	}: Props = $props();
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	}: Props = $props()
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	let deletingSlot: boolean = $state(false)
 	let loadingSlot: boolean = $state(false)
diff --git a/frontend/src/lib/components/triggers/scheduled/utils.ts b/frontend/src/lib/components/triggers/scheduled/utils.ts
index a0a1b8daad..064116a194 100644
--- a/frontend/src/lib/components/triggers/scheduled/utils.ts
+++ b/frontend/src/lib/components/triggers/scheduled/utils.ts
@@ -1,33 +1,33 @@
-import { JobService, ScheduleService } from "$lib/gen"
-import { sendUserToast } from "$lib/utils"
+import { JobService, ScheduleService } from '$lib/gen'
+import { sendUserToast } from '$lib/utils'
 
 export async function runScheduleNow(
-    path: string,
-    schedulePath: string,
-    isFlow: boolean,
-    workspace_id: string
+	path: string,
+	schedulePath: string,
+	isFlow: boolean,
+	workspace_id: string
 ): Promise<void> {
-    try {
-        const runByPath = isFlow ? JobService.runFlowByPath : JobService.runScriptByPath
-        const args = (
-            await ScheduleService.getSchedule({
-                workspace: workspace_id,
-                path: schedulePath
-            })
-        ).args
-        const run = await runByPath({
-            path,
-            requestBody: args ?? {},
-            workspace: workspace_id
-        })
+	try {
+		const runByPath = isFlow ? JobService.runFlowByPath : JobService.runScriptByPath
+		const { args, tag } = await ScheduleService.getSchedule({
+			workspace: workspace_id,
+			path: schedulePath
+		})
+		const run = await runByPath({
+			path,
+			requestBody: args ?? {},
+			workspace: workspace_id,
+			// scheduled flows run on the flow's own tag, like the cron path
+			tag: (!isFlow && tag) || undefined
+		})
 
-        sendUserToast(`Schedule ${path} will run now`, false, [
-            {
-                label: 'Go to the run page',
-                callback: () => window.open('/run/' + run + '?workspace=' + workspace_id, '_blank')
-            }
-        ])
-    } catch (err) {
-        sendUserToast(`Cannot run schedule now: ${err.body}`, true)
-    }
-}
\ No newline at end of file
+		sendUserToast(`Schedule ${path} will run now`, false, [
+			{
+				label: 'Go to the run page',
+				callback: () => window.open('/run/' + run + '?workspace=' + workspace_id, '_blank')
+			}
+		])
+	} catch (err) {
+		sendUserToast(`Cannot run schedule now: ${err.body}`, true)
+	}
+}
diff --git a/frontend/src/lib/components/triggers/schedules/ScheduleEditorInner.svelte b/frontend/src/lib/components/triggers/schedules/ScheduleEditorInner.svelte
index 9745654676..c4a5724ecf 100644
--- a/frontend/src/lib/components/triggers/schedules/ScheduleEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/schedules/ScheduleEditorInner.svelte
@@ -13,8 +13,11 @@
 	import LabelsInput from '$lib/components/LabelsInput.svelte'
 	import Required from '$lib/components/Required.svelte'
 	import ScriptPicker from '$lib/components/ScriptPicker.svelte'
+	import { loadSchema } from '$lib/infer'
 	import PipelineLockedRunnableInfo from '$lib/components/triggers/PipelineLockedRunnableInfo.svelte'
-	import ErrorOrRecoveryHandler from '$lib/components/ErrorOrRecoveryHandler.svelte'
+	import ErrorOrRecoveryHandler, {
+		handlerFullPath
+	} from '$lib/components/ErrorOrRecoveryHandler.svelte'
 	import Toggle from '$lib/components/Toggle.svelte'
 	import Tooltip from '$lib/components/Tooltip.svelte'
 	import Dropdown from '$lib/components/DropdownV2.svelte'
@@ -29,7 +32,7 @@
 		type Schedule,
 		type ErrorHandler
 	} from '$lib/gen'
-	import { enterpriseLicense, workspaceStore } from '$lib/stores'
+	import { enterpriseLicense } from '$lib/stores'
 	import { canWrite, emptyString, formatCron, sendUserToast, cronV1toV2 } from '$lib/utils'
 	import { base } from '$lib/base'
 	import Section from '$lib/components/Section.svelte'
@@ -49,11 +52,13 @@
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
 	import { twMerge } from 'tailwind-merge'
 	import PermissionedAsLine from '../PermissionedAsLine.svelte'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import { useActingUser } from '$lib/actingUser.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	let {
 		useDrawer = true,
+		inline = false,
+		onClose = undefined,
 		hideTarget = false,
 		docDescription = undefined,
 		allowDraft = false,
@@ -108,7 +113,7 @@
 	// already-bound script. We swap the runnable ScriptPicker for a read-only
 	// viewer so the trigger can't be silently reassigned off the pipeline.
 	let fixedScriptPath = $state('')
-	let runnable: Script | Flow | undefined = $state()
+	let runnable: Pick<Script | Flow, 'schema'> | undefined = $state()
 	let args: Record<string, any> = $state({})
 	let loading = $state(false)
 	let drawerLoading = $state(true)
@@ -136,8 +141,8 @@
 	let selectedPermissionedAs = $state<string | undefined>(undefined)
 	let preservePermissionedAs = $state(false)
 
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 	// `undefined` while the lookup is in flight or after it failed; the checks below then
 	// refuse rather than fall back to rights that belong to another workspace.
 	const acting = useActingUser(() => wsId)
@@ -157,9 +162,9 @@
 				emptyString(errorHandlerExtraArgs['channel'])) ||
 			!can_write
 	)
-	// Carry the acting workspace onto "create from template" routes when a
-	// session override is set, so the script is created in the session workspace.
-	const wsParam = $derived(triggerWs?.() ? `&workspace=${encodeURIComponent(wsId!)}` : '')
+	// Carry the acting workspace onto "create from template" routes, so the script is created
+	// in the workspace this schedule lives in.
+	const wsParam = $derived(wsId ? `&workspace=${encodeURIComponent(wsId)}` : '')
 	const scheduleCfg = $derived.by(getScheduleCfg)
 
 	const draftSync = useTriggerDraftSync({
@@ -414,6 +419,8 @@
 			try {
 				if (is_flow) {
 					runnable = await FlowService.getFlowByPath({ workspace: wsId!, path: p })
+				} else if (p.startsWith('hub/')) {
+					runnable = await loadSchema(wsId!, p, 'hubscript')
 				} else {
 					runnable = await ScriptService.getScriptByPath({ workspace: wsId!, path: p })
 				}
@@ -437,7 +444,7 @@
 					path:
 						errorHandlerPath == undefined
 							? undefined
-							: `${errorHandleritemKind}/${errorHandlerPath}`,
+							: handlerFullPath(errorHandlerSelected, errorHandleritemKind, errorHandlerPath),
 					extra_args: errorHandlerExtraArgs,
 					number_of_occurence: failedTimes,
 					number_of_occurence_exact: failedExact,
@@ -466,7 +473,11 @@
 					path:
 						recoveryHandlerPath === undefined
 							? undefined
-							: `${recoveryHandlerItemKind}/${recoveryHandlerPath}`,
+							: handlerFullPath(
+									recoveryHandlerSelected,
+									recoveryHandlerItemKind,
+									recoveryHandlerPath
+								),
 					extra_args: recoveryHandlerExtraArgs,
 					number_of_occurence: recoveredTimes
 				}
@@ -493,7 +504,7 @@
 					path:
 						successHandlerPath === undefined
 							? undefined
-							: `${successHandlerItemKind}/${successHandlerPath}`,
+							: handlerFullPath(successHandlerSelected, successHandlerItemKind, successHandlerPath),
 					extra_args: successHandlerExtraArgs,
 					number_of_occurence: recoveredTimes
 				}
@@ -635,15 +646,18 @@
 		const handlerMap = {
 			error: {
 				teams: '/workspace-or-schedule-error-handler-teams',
-				slack: '/workspace-or-schedule-error-handler-slack'
+				slack: '/workspace-or-schedule-error-handler-slack',
+				email: '/workspace-or-error-handler-email'
 			},
 			recovery: {
 				teams: '/schedule-recovery-handler-teams',
-				slack: '/schedule-recovery-handler-slack'
+				slack: '/schedule-recovery-handler-slack',
+				email: '/workspace-or-error-handler-email'
 			},
 			success: {
 				teams: '/schedule-success-handler-teams',
-				slack: '/schedule-success-handler-slack'
+				slack: '/schedule-success-handler-slack',
+				email: '/workspace-or-error-handler-email'
 			}
 		}
 
@@ -689,17 +703,19 @@
 			is_flow: is_flow,
 			args: args,
 			enabled: enabled,
-			on_failure: errorHandlerPath ? `${errorHandleritemKind}/${errorHandlerPath}` : undefined,
+			on_failure: errorHandlerPath
+				? handlerFullPath(errorHandlerSelected, errorHandleritemKind, errorHandlerPath)
+				: undefined,
 			on_failure_times: failedTimes,
 			on_failure_exact: failedExact,
 			on_failure_extra_args: errorHandlerPath ? errorHandlerExtraArgs : undefined,
 			on_recovery: recoveryHandlerPath
-				? `${recoveryHandlerItemKind}/${recoveryHandlerPath}`
+				? handlerFullPath(recoveryHandlerSelected, recoveryHandlerItemKind, recoveryHandlerPath)
 				: undefined,
 			on_recovery_times: recoveredTimes,
 			on_recovery_extra_args: recoveryHandlerPath ? recoveryHandlerExtraArgs : {},
 			on_success: successHandlerPath
-				? `${successHandlerItemKind}/${successHandlerPath}`
+				? handlerFullPath(successHandlerSelected, successHandlerItemKind, successHandlerPath)
 				: undefined,
 			on_success_extra_args: successHandlerPath ? successHandlerExtraArgs : {},
 			ws_error_handler_muted: wsErrorHandlerMuted,
@@ -967,6 +983,7 @@
 							initialPath={initialScriptPath}
 							kinds={['script']}
 							allowFlow={true}
+							allowHub={true}
 							allowRefresh={can_write}
 							bind:itemKind
 							bind:scriptPath={script_path}
@@ -1420,34 +1437,42 @@
 	</div>
 {/snippet}
 
-{#if useDrawer}
+{#snippet drawerBody()}
+	<DrawerContent
+		hideClose={inline && !onClose}
+		fullScreen={!inline}
+		bannerReserved={draftSync.hasBaseline}
+		title={edit
+			? can_write
+				? `Edit schedule ${initialPath}`
+				: `View schedule ${initialPath}`
+			: 'New schedule'}
+		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
+	>
+		{#snippet actions()}
+			<div class="flex flex-row gap-4 items-center">
+				{@render saveButton()}
+			</div>
+		{/snippet}
+		{#snippet banner()}
+			<LocalDraftBanner
+				show={draftSync.hasDraft}
+				getDeployed={() => draftSync.deployed}
+				reserveSpace={draftSync.hasBaseline}
+				getCurrent={() => draftSync.current}
+				onDiscard={() => draftSync.resetToDeployed(initialPath)}
+				disabled={!can_write}
+			/>
+		{/snippet}
+		{@render content()}
+	</DrawerContent>
+{/snippet}
+
+{#if useDrawer && inline}
+	{@render drawerBody()}
+{:else if useDrawer}
 	<Drawer size="900px" bind:this={drawer} on:close={() => clearPageDrawerAnchor(SCHEDULES_PATH)}>
-		<DrawerContent
-			bannerReserved={draftSync.hasBaseline}
-			title={edit
-				? can_write
-					? `Edit schedule ${initialPath}`
-					: `View schedule ${initialPath}`
-				: 'New schedule'}
-			on:close={drawer.closeDrawer}
-		>
-			{#snippet actions()}
-				<div class="flex flex-row gap-4 items-center">
-					{@render saveButton()}
-				</div>
-			{/snippet}
-			{#snippet banner()}
-				<LocalDraftBanner
-					show={draftSync.hasDraft}
-					getDeployed={() => draftSync.deployed}
-					reserveSpace={draftSync.hasBaseline}
-					getCurrent={() => draftSync.current}
-					onDiscard={() => draftSync.resetToDeployed(initialPath)}
-					disabled={!can_write}
-				/>
-			{/snippet}
-			{@render content()}
-		</DrawerContent>
+		{@render drawerBody()}
 	</Drawer>
 {:else}
 	<Section label={!customLabel ? 'Schedule' : ''} headerClass="grow min-w-0 h-[30px]">
diff --git a/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorConfigSection.svelte b/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorConfigSection.svelte
index 6aa7b025cc..7a648ab63b 100644
--- a/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorConfigSection.svelte
@@ -13,11 +13,10 @@
 	import VariableEditor from '$lib/components/VariableEditor.svelte'
 	import { Button } from '$lib/components/common'
 	import { VariableService, type AwsAuthResourceType } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import TestingBadge from '../testingBadge.svelte'
 	import MultiSelect from '$lib/components/select/MultiSelect.svelte'
 	import { safeSelectItems } from '$lib/components/select/utils.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		can_write?: boolean
@@ -40,8 +39,8 @@
 		message_attributes = $bindable([]),
 		showTestingBadge = false
 	}: Props = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	async function loadVariables() {
 		return await VariableService.listVariable({ workspace: wsId ?? '' })
diff --git a/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorInner.svelte
index 75b5f60cb9..5521eca4c3 100644
--- a/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorInner.svelte
@@ -8,8 +8,7 @@
 	import Drawer from '$lib/components/common/drawer/Drawer.svelte'
 	import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
 	import Path from '$lib/components/Path.svelte'
-	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+	import { usedTriggerKinds } from '$lib/stores'
 	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import { Loader2 } from 'lucide-svelte'
@@ -38,9 +37,18 @@
 	import { deepEqual } from 'fast-equals'
 	import { useTriggerDraftSync } from '../useTriggerDraftSync.svelte'
 	import LocalDraftBanner from '$lib/components/LocalDraftBanner.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace,
+		useOperatingWorkspaceHref
+	} from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		useDrawer?: boolean
+		/** With `useDrawer`, render the drawer's content in place, filling the parent, with no drawer or close button. */
+		inline?: boolean
+		/** With `inline`, closes whatever hosts the editor; the header has a close button only when set. */
+		onClose?: () => void
 		description?: Snippet | undefined
 		hideTarget?: boolean
 		hideTooltips?: boolean
@@ -59,6 +67,8 @@
 
 	let {
 		useDrawer = true,
+		inline = false,
+		onClose = undefined,
 		description = undefined,
 		hideTarget = false,
 		hideTooltips = false,
@@ -74,8 +84,11 @@
 		onDelete = undefined,
 		onReset = undefined
 	}: Props = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	const operatingHref = useOperatingWorkspaceHref()
+	const wsId = $derived($operatingWorkspace)
 
 	let drawer: Drawer | undefined = $state(undefined)
 	let is_flow: boolean = $state(false)
@@ -89,7 +102,13 @@
 	let pathError = $state('')
 	let mode = $state<TriggerMode>('enabled')
 	let dirtyPath = $state(false)
-	let can_write = $state(true)
+	let permsPath = $state<string | undefined>(undefined)
+	let permsForWrite = $state<Record<string, boolean> | undefined>(undefined)
+	// The acting user in the operating workspace arrives asynchronously, and an unknown user
+	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
+	const can_write = $derived(
+		permsPath === undefined ? true : canWrite(permsPath, permsForWrite ?? {}, actingUser)
+	)
 	let drawerLoading = $state(true)
 	let showLoading = $state(false)
 	let aws_resource_path: string = $state('')
@@ -136,6 +155,8 @@
 		defaultConfig?: Record<string, any>,
 		fixedScriptPath_?: string
 	) {
+		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
+		operatingUser.forgetFailures()
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100) // Do not show loading spinner for the first 100ms
@@ -214,6 +235,8 @@
 	}
 
 	async function loadTriggerConfig(cfg?: Record<string, any>): Promise<void> {
+		// The loaded trigger says what it runs; an opener's `isFlow` is only its guess.
+		if (cfg?.is_flow !== undefined) itemKind = cfg.is_flow ? 'flow' : 'script'
 		try {
 			script_path = cfg?.script_path
 			initialScriptPath = cfg?.script_path
@@ -224,7 +247,8 @@
 			path = cfg?.path
 			mode = cfg?.mode ?? 'enabled'
 			aws_auth_resource_type = cfg?.aws_auth_resource_type
-			can_write = canWrite(cfg?.path, cfg?.extra_perms, $userStore)
+			permsPath = cfg?.path
+			permsForWrite = cfg?.extra_perms
 			error_handler_path = cfg?.error_handler_path
 			error_handler_args = cfg?.error_handler_args ?? {}
 			retry = cfg?.retry
@@ -370,36 +394,44 @@
 	/>
 {/if}
 
-{#if useDrawer}
+{#snippet drawerBody()}
+	<DrawerContent
+		hideClose={inline && !onClose}
+		fullScreen={!inline}
+		bannerReserved={draftSync.hasBaseline}
+		title={edit
+			? can_write
+				? `Edit SQS trigger ${initialPath}`
+				: `SQS trigger ${initialPath}`
+			: 'New SQS trigger'}
+		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
+	>
+		{#snippet actions()}
+			{@render actionsSnippet()}
+		{/snippet}
+		{#snippet banner()}
+			<LocalDraftBanner
+				show={draftSync.hasDraft}
+				getDeployed={() => draftSync.deployed}
+				reserveSpace={draftSync.hasBaseline}
+				getCurrent={() => draftSync.current}
+				onDiscard={() => draftSync.resetToDeployed(initialPath)}
+				disabled={!can_write}
+			/>
+		{/snippet}
+		{@render config()}
+	</DrawerContent>
+{/snippet}
+
+{#if useDrawer && inline}
+	{@render drawerBody()}
+{:else if useDrawer}
 	<Drawer
 		size="800px"
 		bind:this={drawer}
 		on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.sqs.path)}
 	>
-		<DrawerContent
-			bannerReserved={draftSync.hasBaseline}
-			title={edit
-				? can_write
-					? `Edit SQS trigger ${initialPath}`
-					: `SQS trigger ${initialPath}`
-				: 'New SQS trigger'}
-			on:close={drawer.closeDrawer}
-		>
-			{#snippet actions()}
-				{@render actionsSnippet()}
-			{/snippet}
-			{#snippet banner()}
-				<LocalDraftBanner
-					show={draftSync.hasDraft}
-					getDeployed={() => draftSync.deployed}
-					reserveSpace={draftSync.hasBaseline}
-					getCurrent={() => draftSync.current}
-					onDiscard={() => draftSync.resetToDeployed(initialPath)}
-					disabled={!can_write}
-				/>
-			{/snippet}
-			{@render config()}
-		</DrawerContent>
+		{@render drawerBody()}
 	</Drawer>
 {:else}
 	<Section label={!customLabel ? 'SQS trigger' : ''} headerClass="grow min-w-0 h-[30px]">
@@ -496,7 +528,7 @@
 						bind:scriptPath={script_path}
 						{initialScriptPath}
 						canWrite={can_write}
-						isOperator={!!$userStore?.operator}
+						isOperator={!!actingUser?.operator}
 						promptText="Pick a script or flow to be triggered "
 					>
 						{#snippet createButton()}
@@ -506,7 +538,9 @@
 									variant="accent"
 									size="xs"
 									disabled={!can_write}
-									href={itemKind === 'flow' ? '/flows/add?hub=59' : '/scripts/add?hub=hub%2F19657'}
+									href={operatingHref(
+										itemKind === 'flow' ? '/flows/add?hub=59' : '/scripts/add?hub=hub%2F19657'
+									)}
 									target="_blank"
 								>
 									Create from template
diff --git a/frontend/src/lib/components/triggers/triggerListConfig.ts b/frontend/src/lib/components/triggers/triggerListConfig.ts
new file mode 100644
index 0000000000..9e5b24c8f2
--- /dev/null
+++ b/frontend/src/lib/components/triggers/triggerListConfig.ts
@@ -0,0 +1,506 @@
+import {
+	AmqpTriggerService,
+	AzureTriggerService,
+	EmailTriggerService,
+	GcpTriggerService,
+	HttpTriggerService,
+	KafkaTriggerService,
+	MqttTriggerService,
+	NatsTriggerService,
+	PostgresTriggerService,
+	SqsTriggerService,
+	WebsocketTriggerService,
+	type AmqpTrigger,
+	type AzureTrigger,
+	type EmailTrigger,
+	type GcpTrigger,
+	type HttpTrigger,
+	type KafkaTrigger,
+	type MqttTrigger,
+	type NatsTrigger,
+	type PostgresTrigger,
+	type SqsTrigger,
+	type TriggerMode,
+	type UserDraftItemKind,
+	type WebsocketTrigger
+} from '$lib/gen'
+import type { TriggerKind as UsedTriggerKind } from '$lib/components/triggers'
+import type { TriggerKind } from '$lib/components/sessions/previewPaths'
+
+type AnyTrigger =
+	| HttpTrigger
+	| WebsocketTrigger
+	| PostgresTrigger
+	| KafkaTrigger
+	| NatsTrigger
+	| MqttTrigger
+	| AmqpTrigger
+	| SqsTrigger
+	| GcpTrigger
+	| AzureTrigger
+	| EmailTrigger
+type KeysOfUnion<T> = T extends unknown ? keyof T : never
+type FieldOf<T, K extends PropertyKey> = T extends unknown
+	? K extends keyof T
+		? T[K]
+		: never
+	: never
+
+/** A row of any trigger list: the fields every kind shares, plus every kind's own as optional,
+ * so a field read by one kind's branch is still checked against the generated types. */
+export type TriggerRow = Pick<
+	HttpTrigger,
+	'path' | 'script_path' | 'is_flow' | 'mode' | 'edited_by' | 'edited_at'
+> & {
+	[K in Exclude<
+		KeysOfUnion<AnyTrigger>,
+		'path' | 'script_path' | 'is_flow' | 'mode' | 'edited_by' | 'edited_at'
+	>]?: FieldOf<AnyTrigger, K>
+}
+
+type Call<A> = (a: A) => Promise<unknown>
+
+export type TriggerListConfig = {
+	/** Page title, and the kind's plural name in the cloud alert. */
+	title: string
+	tooltip: string
+	documentationLink?: string
+	/** Follows "New" on the create button. */
+	newLabel: string
+	searchPlaceholder: string
+	/** The "Filter by path of" choice naming the trigger itself. */
+	filterLabel: string
+	empty: {
+		title: string
+		description: string
+		actionLabel: string
+		aiId: string
+		aiDescription: string
+	}
+	/** Disabled in the multi-tenant cloud. */
+	cloudDisabled: boolean
+	/** Hidden from operators unless the workspace grants them triggers. */
+	operatorGate: boolean
+	/** Creating and deleting are for admins only. */
+	adminOnly: boolean
+	usedKind: UsedTriggerKind
+	deployKind: UsedTriggerKind
+	shareKind: string
+	draftKind: UserDraftItemKind
+	/** Kinds holding a live connection: polled, with a status dot. Each message is followed by
+	 * the error or state it reports. */
+	status?: {
+		starting: string
+		notConnected: string
+		disabled: string
+		connected: string
+		/** Reports a connection whose server is going away. */
+		shuttingDown: boolean
+		/** The server stamps a ping; without one, a connected server counts as alive. */
+		pings: boolean
+	}
+	/** Mode changes run through the fork-conflict check, under this name. Kinds whose runtime
+	 * address is workspace-prefixed skip it: a fork and its parent never collide. */
+	forkConflictLabel?: string
+	/** Toast a mode change that went through, as "<Mode> <label> <path>". */
+	modeToastLabel?: string
+	/** A failed mode change, followed by ": <error>". */
+	modeError: (verb: 'enable' | 'disable' | 'suspend') => string
+	/** Report a delete through a toast, as "Successfully deleted <label>: <path>". */
+	deleteToastLabel?: string
+	/** Report a failed delete through a toast. */
+	catchDelete: boolean
+	list: (a: { workspace: string; includeDraftOnly?: boolean }) => Promise<TriggerRow[]>
+	setMode: Call<{
+		workspace: string
+		path: string
+		requestBody: { mode: TriggerMode; force?: boolean }
+	}>
+	remove: Call<{ workspace: string; path: string }>
+}
+
+const brokerTooltip = (name: string) =>
+	`Windmill can connect to an ${name} broker, subscribe to specific topics, and trigger scripts or flows based on those topics.`
+
+const consumerStatus = {
+	starting: 'Consumer is starting...',
+	notConnected: 'Consumer is not connected',
+	disabled: 'Consumer was disabled because of an error',
+	connected: 'Consumer is connected',
+	shuttingDown: false,
+	pings: true
+}
+
+export const TRIGGER_LIST_CONFIG: Record<TriggerKind, TriggerListConfig> = {
+	http: {
+		title: 'Custom HTTP routes',
+		tooltip:
+			'Every script and flow already has a canonical HTTP API endpoint/webhook attached to it, this is to create additional parametrizable ones.',
+		documentationLink: 'https://www.windmill.dev/docs/core_concepts/http_routing',
+		newLabel: 'route',
+		searchPlaceholder: 'Search routes',
+		filterLabel: 'Route',
+		empty: {
+			title: 'No custom HTTP routes yet',
+			description:
+				'Every script and flow already has a canonical HTTP endpoint attached to it. These are additional parametrizable ones.',
+			actionLabel: 'Add a route',
+			aiId: 'routes-empty-add',
+			aiDescription: 'Add route'
+		},
+		cloudDisabled: false,
+		operatorGate: true,
+		adminOnly: false,
+		usedKind: 'routes',
+		deployKind: 'routes',
+		shareKind: 'http_trigger',
+		draftKind: 'trigger_http',
+		modeError: (verb) => `Cannot ${verb} http trigger`,
+		deleteToastLabel: 'HTTP route',
+		catchDelete: true,
+		list: (a) => HttpTriggerService.listHttpTriggers(a),
+		setMode: (a) => HttpTriggerService.setHttpTriggerMode(a),
+		remove: (a) => HttpTriggerService.deleteHttpTrigger(a)
+	},
+	websocket: {
+		title: 'WebSocket triggers',
+		tooltip: 'Windmill can listen to WebSocket events and trigger scripts or flows based on them.',
+		newLabel: 'WebSocket trigger',
+		searchPlaceholder: 'Search WS triggers',
+		filterLabel: 'WS trigger',
+		empty: {
+			title: 'No WebSocket triggers yet',
+			description:
+				'Windmill can listen to WebSocket events and trigger scripts or flows based on them.',
+			actionLabel: 'Add a WebSocket trigger',
+			aiId: 'websocket-triggers-empty-add',
+			aiDescription: 'Add WebSocket trigger'
+		},
+		cloudDisabled: true,
+		operatorGate: false,
+		adminOnly: false,
+		usedKind: 'websockets',
+		deployKind: 'websockets',
+		shareKind: 'websocket_trigger',
+		draftKind: 'trigger_websocket',
+		status: {
+			starting: 'WebSocket is starting...',
+			notConnected: 'WebSocket is not connected',
+			disabled: 'WebSocket was disabled because of an error',
+			connected: 'WebSocket is connected',
+			shuttingDown: true,
+			pings: true
+		},
+		forkConflictLabel: 'websocket trigger',
+		modeToastLabel: 'websocket trigger',
+		modeError: (verb) => `Cannot ${verb} websocket trigger`,
+		catchDelete: false,
+		list: (a) => WebsocketTriggerService.listWebsocketTriggers(a),
+		setMode: (a) => WebsocketTriggerService.setWebsocketTriggerMode(a),
+		remove: (a) => WebsocketTriggerService.deleteWebsocketTrigger(a)
+	},
+	postgres: {
+		title: 'Postgres triggers',
+		tooltip:
+			'Windmill enables real-time responsiveness by listening to specific database transactions—such as inserts, updates, and deletes—and automatically triggering scripts or workflows in response.',
+		newLabel: 'Postgres trigger',
+		searchPlaceholder: 'Search Postgres triggers',
+		filterLabel: 'Postgres trigger',
+		empty: {
+			title: 'No Postgres triggers yet',
+			description:
+				'Windmill can listen to database transactions — inserts, updates and deletes — and trigger scripts or flows in response.',
+			actionLabel: 'Add a Postgres trigger',
+			aiId: 'postgres-triggers-empty-add',
+			aiDescription: 'Add Postgres trigger'
+		},
+		cloudDisabled: true,
+		operatorGate: false,
+		adminOnly: false,
+		usedKind: 'postgres',
+		deployKind: 'postgres',
+		shareKind: 'postgres_trigger',
+		draftKind: 'trigger_postgres',
+		status: {
+			starting: 'Postgres trigger is starting...',
+			notConnected: 'Could not connect to database',
+			disabled: 'Disabled because of an error',
+			connected: 'Connected to database',
+			shuttingDown: true,
+			pings: false
+		},
+		forkConflictLabel: 'postgres trigger',
+		modeToastLabel: 'postgres trigger',
+		modeError: () => 'Cannot change postgres trigger mode',
+		catchDelete: false,
+		list: (a) => PostgresTriggerService.listPostgresTriggers(a),
+		setMode: (a) => PostgresTriggerService.setPostgresTriggerMode(a),
+		remove: (a) => PostgresTriggerService.deletePostgresTrigger(a)
+	},
+	kafka: {
+		title: 'Kafka triggers',
+		tooltip: 'Windmill can consume kafka events and trigger scripts or flows based on them.',
+		newLabel: 'Kafka trigger',
+		searchPlaceholder: 'Search Kafka triggers',
+		filterLabel: 'Kafka trigger',
+		empty: {
+			title: 'No Kafka triggers yet',
+			description: 'Windmill can consume kafka events and trigger scripts or flows based on them.',
+			actionLabel: 'Add a Kafka trigger',
+			aiId: 'kafka-triggers-empty-add',
+			aiDescription: 'Add Kafka trigger'
+		},
+		cloudDisabled: true,
+		operatorGate: true,
+		adminOnly: false,
+		usedKind: 'kafka',
+		deployKind: 'kafka',
+		shareKind: 'kafka_trigger',
+		draftKind: 'trigger_kafka',
+		status: consumerStatus,
+		forkConflictLabel: 'Kafka trigger',
+		modeError: (verb) => `Cannot ${verb} Kafka trigger`,
+		catchDelete: false,
+		list: (a) => KafkaTriggerService.listKafkaTriggers(a),
+		setMode: (a) => KafkaTriggerService.setKafkaTriggerMode(a),
+		remove: (a) => KafkaTriggerService.deleteKafkaTrigger(a)
+	},
+	nats: {
+		title: 'NATS triggers',
+		tooltip: 'Windmill can consume NATS events and trigger scripts or flows based on them.',
+		newLabel: 'NATS trigger',
+		searchPlaceholder: 'Search NATS triggers',
+		filterLabel: 'NATS trigger',
+		empty: {
+			title: 'No NATS triggers yet',
+			description: 'Windmill can consume NATS events and trigger scripts or flows based on them.',
+			actionLabel: 'Add a NATS trigger',
+			aiId: 'nats-triggers-empty-add',
+			aiDescription: 'Add NATS trigger'
+		},
+		cloudDisabled: true,
+		operatorGate: true,
+		adminOnly: false,
+		usedKind: 'nats',
+		deployKind: 'nats',
+		shareKind: 'nats_trigger',
+		draftKind: 'trigger_nats',
+		status: consumerStatus,
+		forkConflictLabel: 'NATS trigger',
+		modeError: (verb) => `Cannot ${verb} NATS trigger`,
+		catchDelete: false,
+		list: (a) => NatsTriggerService.listNatsTriggers(a),
+		setMode: (a) => NatsTriggerService.setNatsTriggerMode(a),
+		remove: (a) => NatsTriggerService.deleteNatsTrigger(a)
+	},
+	sqs: {
+		title: 'SQS triggers',
+		tooltip: 'SQS trigger',
+		newLabel: 'SQS trigger',
+		searchPlaceholder: 'Search SQS triggers',
+		filterLabel: 'SQS trigger',
+		empty: {
+			title: 'No SQS triggers yet',
+			description:
+				'Windmill can consume messages from an SQS queue and trigger scripts or flows on each one.',
+			actionLabel: 'Add an SQS trigger',
+			aiId: 'sqs-triggers-empty-add',
+			aiDescription: 'Add SQS trigger'
+		},
+		cloudDisabled: true,
+		operatorGate: false,
+		adminOnly: false,
+		usedKind: 'sqs',
+		deployKind: 'sqs',
+		shareKind: 'sqs_trigger',
+		draftKind: 'trigger_sqs',
+		status: {
+			starting: 'SQS trigger is starting...',
+			notConnected: 'Could not connect to SQS',
+			disabled: 'Disabled because of an error',
+			connected: 'Connected to SQS',
+			shuttingDown: true,
+			pings: false
+		},
+		forkConflictLabel: 'SQS trigger',
+		modeError: (verb) => `Cannot ${verb} sqs trigger`,
+		catchDelete: true,
+		list: (a) => SqsTriggerService.listSqsTriggers(a),
+		setMode: (a) => SqsTriggerService.setSqsTriggerMode(a),
+		remove: (a) => SqsTriggerService.deleteSqsTrigger(a)
+	},
+	gcp: {
+		title: 'GCP Pub/Sub triggers',
+		tooltip: 'GCP Pub/Sub trigger',
+		newLabel: 'GCP Pub/Sub trigger',
+		searchPlaceholder: 'Search triggers',
+		filterLabel: 'GCP Pub/Sub trigger',
+		empty: {
+			title: 'No GCP Pub/Sub triggers yet',
+			description:
+				'Windmill can subscribe to a GCP Pub/Sub topic and trigger scripts or flows on each message.',
+			actionLabel: 'Add a GCP Pub/Sub trigger',
+			aiId: 'gcp-triggers-empty-add',
+			aiDescription: 'Add GCP Pub/Sub trigger'
+		},
+		cloudDisabled: true,
+		operatorGate: false,
+		adminOnly: false,
+		usedKind: 'gcp',
+		deployKind: 'gcp',
+		shareKind: 'gcp_trigger',
+		draftKind: 'trigger_gcp',
+		status: {
+			starting: 'GCP Pub/Sub trigger is starting...',
+			notConnected: 'Could not connect to GCP Pub/Sub',
+			disabled: 'Disabled because of an error',
+			connected: 'Connected to GCP Pub/Sub',
+			shuttingDown: true,
+			pings: false
+		},
+		forkConflictLabel: 'GCP Pub/Sub trigger',
+		modeError: (verb) => `Cannot ${verb} GCP Pub/Sub trigger`,
+		catchDelete: false,
+		list: (a) => GcpTriggerService.listGcpTriggers(a),
+		setMode: (a) => GcpTriggerService.setGcpTriggerMode(a),
+		remove: (a) => GcpTriggerService.deleteGcpTrigger(a)
+	},
+	azure: {
+		title: 'Azure Event Grid triggers',
+		tooltip: 'Azure Event Grid trigger',
+		newLabel: 'Azure Event Grid trigger',
+		searchPlaceholder: 'Search triggers',
+		filterLabel: 'Azure Event Grid trigger',
+		empty: {
+			title: 'No Azure Event Grid triggers yet',
+			description:
+				'Windmill can subscribe to an Azure Event Grid topic and trigger scripts or flows on each event.',
+			actionLabel: 'Add an Azure Event Grid trigger',
+			aiId: 'azure-triggers-empty-add',
+			aiDescription: 'Add Azure Event Grid trigger'
+		},
+		cloudDisabled: true,
+		operatorGate: false,
+		adminOnly: false,
+		usedKind: 'azure',
+		deployKind: 'azure',
+		shareKind: 'azure_trigger',
+		draftKind: 'trigger_azure',
+		status: {
+			starting: 'Azure Event Grid trigger is starting...',
+			notConnected: 'Could not connect to Azure Event Grid',
+			disabled: 'Disabled because of an error',
+			connected: 'Connected to Azure Event Grid',
+			shuttingDown: true,
+			pings: false
+		},
+		forkConflictLabel: 'Azure trigger',
+		modeError: (verb) => `Cannot ${verb} Azure Event Grid trigger`,
+		catchDelete: false,
+		list: (a) => AzureTriggerService.listAzureTriggers(a),
+		setMode: (a) => AzureTriggerService.setAzureTriggerMode(a),
+		remove: (a) => AzureTriggerService.deleteAzureTrigger(a)
+	},
+	mqtt: {
+		title: 'MQTT triggers',
+		tooltip: brokerTooltip('MQTT'),
+		newLabel: 'MQTT trigger',
+		searchPlaceholder: 'Search MQTT triggers',
+		filterLabel: 'MQTT trigger',
+		empty: {
+			title: 'No MQTT triggers yet',
+			description: brokerTooltip('MQTT'),
+			actionLabel: 'Add an MQTT trigger',
+			aiId: 'mqtt-triggers-empty-add',
+			aiDescription: 'Add MQTT trigger'
+		},
+		cloudDisabled: true,
+		operatorGate: false,
+		adminOnly: false,
+		usedKind: 'mqtt',
+		deployKind: 'mqtt',
+		shareKind: 'mqtt_trigger',
+		draftKind: 'trigger_mqtt',
+		status: {
+			starting: 'MQTT trigger is starting...',
+			notConnected: 'MQTT trigger is not connected',
+			disabled: 'MQTT trigger was disabled because of an error',
+			connected: 'MQTT trigger is connected',
+			shuttingDown: true,
+			pings: true
+		},
+		forkConflictLabel: 'MQTT trigger',
+		modeToastLabel: 'MQTT trigger',
+		modeError: (verb) => `Cannot ${verb} mqtt trigger`,
+		catchDelete: false,
+		list: (a) => MqttTriggerService.listMqttTriggers(a),
+		setMode: (a) => MqttTriggerService.setMqttTriggerMode(a),
+		remove: (a) => MqttTriggerService.deleteMqttTrigger(a)
+	},
+	amqp: {
+		title: 'AMQP triggers',
+		tooltip: brokerTooltip('AMQP'),
+		newLabel: 'AMQP trigger',
+		searchPlaceholder: 'Search AMQP triggers',
+		filterLabel: 'AMQP trigger',
+		empty: {
+			title: 'No AMQP triggers yet',
+			description: brokerTooltip('AMQP'),
+			actionLabel: 'Add an AMQP trigger',
+			aiId: 'amqp-triggers-empty-add',
+			aiDescription: 'Add AMQP trigger'
+		},
+		cloudDisabled: true,
+		operatorGate: false,
+		adminOnly: false,
+		usedKind: 'amqp',
+		deployKind: 'amqp',
+		shareKind: 'amqp_trigger',
+		draftKind: 'trigger_amqp',
+		status: {
+			starting: 'AMQP trigger is starting...',
+			notConnected: 'AMQP trigger is not connected',
+			disabled: 'AMQP trigger was disabled because of an error',
+			connected: 'AMQP trigger is connected',
+			shuttingDown: true,
+			pings: true
+		},
+		forkConflictLabel: 'AMQP trigger',
+		modeToastLabel: 'AMQP trigger',
+		modeError: (verb) => `Cannot ${verb} amqp trigger`,
+		catchDelete: false,
+		list: (a) => AmqpTriggerService.listAmqpTriggers(a),
+		setMode: (a) => AmqpTriggerService.setAmqpTriggerMode(a),
+		remove: (a) => AmqpTriggerService.deleteAmqpTrigger(a)
+	},
+	email: {
+		title: 'Custom email triggers',
+		tooltip:
+			'Every script and flow already has a canonical email trigger attached to it, this is to create additional parametrizable ones.',
+		documentationLink: 'https://www.windmill.dev/docs/advanced/email_triggers',
+		newLabel: 'email trigger',
+		searchPlaceholder: 'Search email triggers',
+		filterLabel: 'Email',
+		empty: {
+			title: 'No custom email triggers yet',
+			description:
+				'Every script and flow already has a canonical email trigger attached to it. These are additional parametrizable ones.',
+			actionLabel: 'Add an email trigger',
+			aiId: 'email-triggers-empty-add',
+			aiDescription: 'Add email trigger'
+		},
+		cloudDisabled: false,
+		operatorGate: true,
+		adminOnly: true,
+		usedKind: 'emails',
+		deployKind: 'routes',
+		shareKind: 'email_trigger',
+		draftKind: 'trigger_email',
+		modeError: (verb) => `Cannot ${verb} email trigger`,
+		deleteToastLabel: 'Email trigger',
+		catchDelete: true,
+		list: (a) => EmailTriggerService.listEmailTriggers(a),
+		setMode: (a) => EmailTriggerService.setEmailTriggerMode(a),
+		remove: (a) => EmailTriggerService.deleteEmailTrigger(a)
+	}
+}
diff --git a/frontend/src/lib/components/triggers/triggerWorkspace.ts b/frontend/src/lib/components/triggers/triggerWorkspace.ts
deleted file mode 100644
index 290db9da37..0000000000
--- a/frontend/src/lib/components/triggers/triggerWorkspace.ts
+++ /dev/null
@@ -1,29 +0,0 @@
-import { getContext, setContext } from 'svelte'
-
-const TRIGGER_WORKSPACE_KEY = 'triggerWorkspace'
-
-/**
- * Context seam letting the native-trigger editors operate on a workspace other
- * than the globally-active `$workspaceStore`. An AI session can run against a
- * (possibly forked) workspace that differs from the nav workspace WITHOUT
- * switching `$workspaceStore` (see `SessionPicker`), so a host that embeds the
- * trigger editors in that context registers a resolver here.
- *
- * Every workspace-scoped backend call / navigation inside the trigger subtree
- * reads its workspace via {@link getTriggerWorkspace} and falls back to
- * `$workspaceStore` when no resolver is set — the default everywhere outside
- * such a host, so behavior there is unchanged. Mirrors the AI chat manager's
- * `operatingWorkspace` resolver.
- */
-export function setTriggerWorkspace(resolver: () => string | undefined): void {
-	setContext(TRIGGER_WORKSPACE_KEY, resolver)
-}
-
-/**
- * The trigger-workspace resolver set by an embedding host, or `undefined` when
- * none is set (fall back to `$workspaceStore`). Read once during component init;
- * use in a `$derived`: `const ws = $derived(triggerWs?.() ?? $workspaceStore)`.
- */
-export function getTriggerWorkspace(): (() => string | undefined) | undefined {
-	return getContext<(() => string | undefined) | undefined>(TRIGGER_WORKSPACE_KEY)
-}
diff --git a/frontend/src/lib/components/triggers/webhook/WebhooksCapture.svelte b/frontend/src/lib/components/triggers/webhook/WebhooksCapture.svelte
index b6392bf41b..18a95d01c6 100644
--- a/frontend/src/lib/components/triggers/webhook/WebhooksCapture.svelte
+++ b/frontend/src/lib/components/triggers/webhook/WebhooksCapture.svelte
@@ -4,9 +4,11 @@
 	import { isObject } from '$lib/utils'
 	import CopyableCodeBlock from '../../details/CopyableCodeBlock.svelte'
 	import CaptureSection, { type CaptureInfo } from '../CaptureSection.svelte'
-	import { workspaceStore } from '$lib/stores'
 	import { Url } from '$lib/components/common'
 	import { fade } from 'svelte/transition'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		isFlow?: boolean
@@ -33,7 +35,7 @@
 	)
 
 	let captureUrl = $derived(
-		`${location.origin}/api/w/${$workspaceStore}/capture_u/webhook/${
+		`${location.origin}/api/w/${$operatingWorkspace}/capture_u/webhook/${
 			isFlow ? 'flow' : 'script'
 		}/${path}`
 	)
diff --git a/frontend/src/lib/components/triggers/webhook/WebhooksConfigSection.svelte b/frontend/src/lib/components/triggers/webhook/WebhooksConfigSection.svelte
index 36bb8e36d5..9033aab3cf 100644
--- a/frontend/src/lib/components/triggers/webhook/WebhooksConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/webhook/WebhooksConfigSection.svelte
@@ -18,11 +18,11 @@
 	// import { page } from '$app/state'
 	import { base } from '$lib/base'
 	import TriggerTokens from '../TriggerTokens.svelte'
-	import { workspaceStore, userStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+	import { userStore } from '$lib/stores'
 	import UserSettings from '../../UserSettings.svelte'
 	import { generateRandomString } from '$lib/utils'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		isFlow?: boolean
@@ -43,8 +43,8 @@
 		triggerTokens = $bindable(undefined),
 		scopes = []
 	}: Props = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	const WEBHOOK_BASE_URL = $derived(`${location.origin}${base}/api/w/${wsId}/jobs`)
 
diff --git a/frontend/src/lib/components/triggers/websocket/WebsocketCapture.svelte b/frontend/src/lib/components/triggers/websocket/WebsocketCapture.svelte
index 7fb8307c33..49421d6de5 100644
--- a/frontend/src/lib/components/triggers/websocket/WebsocketCapture.svelte
+++ b/frontend/src/lib/components/triggers/websocket/WebsocketCapture.svelte
@@ -35,23 +35,21 @@
 		{captureLoading}
 	>
 		{#snippet description()}
-			
-				{#if captureInfo.active}
-					{#if captureInfo.connectionInfo?.connected}
-						<p in:fade={{ duration: 100, delay: 50 }} out:fade={{ duration: 50 }}>
-							Listenning to websocket events...
-						</p>
-					{:else}
-						<p in:fade={{ duration: 100, delay: 50 }} out:fade={{ duration: 50 }}>
-							Connecting to websocket...
-						</p>
-					{/if}
+			{#if captureInfo.active}
+				{#if captureInfo.connectionInfo?.connected}
+					<p in:fade={{ duration: 100, delay: 50 }} out:fade={{ duration: 50 }}>
+						Listenning to websocket events...
+					</p>
 				{:else}
 					<p in:fade={{ duration: 100, delay: 50 }} out:fade={{ duration: 50 }}>
-						Start capturing to listen to websocket events.
+						Connecting to websocket...
 					</p>
 				{/if}
-			
-			{/snippet}
+			{:else}
+				<p in:fade={{ duration: 100, delay: 50 }} out:fade={{ duration: 50 }}>
+					Start capturing to listen to websocket events.
+				</p>
+			{/if}
+		{/snippet}
 	</CaptureSection>
 {/if}
diff --git a/frontend/src/lib/components/triggers/websocket/WebsocketEditorConfigSection.svelte b/frontend/src/lib/components/triggers/websocket/WebsocketEditorConfigSection.svelte
index 2549ed4c85..50ef769ce2 100644
--- a/frontend/src/lib/components/triggers/websocket/WebsocketEditorConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/websocket/WebsocketEditorConfigSection.svelte
@@ -8,9 +8,9 @@
 	import { sendUserToast } from '$lib/utils'
 	import type { Schema } from '$lib/common'
 	import { FlowService, ScriptService, type Flow, type Script } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import TestTriggerConnection from '../TestTriggerConnection.svelte'
 	import TestingBadge from '$lib/components/triggers/testingBadge.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		url: string | undefined
@@ -31,6 +31,8 @@
 		isValid = $bindable(false),
 		showTestingBadge = false
 	}: Props = $props()
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	let areRunnableArgsValid: boolean = $state(true)
 
@@ -42,11 +44,11 @@
 				try {
 					let scriptOrFlow: Script | Flow = url.startsWith('$flow:')
 						? await FlowService.getFlowByPath({
-								workspace: $workspaceStore!,
+								workspace: wsId!,
 								path: url.split(':')[1]
 							})
 						: await ScriptService.getScriptByPath({
-								workspace: $workspaceStore!,
+								workspace: wsId!,
 								path: url.split(':')[1]
 							})
 					urlRunnableSchema = scriptOrFlow.schema as Schema
diff --git a/frontend/src/lib/components/triggers/websocket/WebsocketTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/websocket/WebsocketTriggerEditorInner.svelte
index e255b7b552..7248aa858c 100644
--- a/frontend/src/lib/components/triggers/websocket/WebsocketTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/websocket/WebsocketTriggerEditorInner.svelte
@@ -24,7 +24,7 @@
 		type ErrorHandler,
 		type TriggerMode
 	} from '$lib/gen'
-	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
+	import { usedTriggerKinds } from '$lib/stores'
 	import { canWrite, emptySchema, emptyString, sendUserToast } from '$lib/utils'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import Section from '$lib/components/Section.svelte'
@@ -53,9 +53,18 @@
 	import TriggerSuspendedJobsAlert from '../TriggerSuspendedJobsAlert.svelte'
 	import TriggerSuspendedJobsModal from '../TriggerSuspendedJobsModal.svelte'
 	import { capitalize } from '$lib/utils'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace,
+		useOperatingWorkspaceHref
+	} from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		useDrawer?: boolean
+		/** With `useDrawer`, render the drawer's content in place, filling the parent, with no drawer or close button. */
+		inline?: boolean
+		/** With `inline`, closes whatever hosts the editor; the header has a close button only when set. */
+		onClose?: () => void
 		description?: Snippet | undefined
 		hideTarget?: boolean
 		hideTooltips?: boolean
@@ -75,6 +84,8 @@
 
 	let {
 		useDrawer = true,
+		inline = false,
+		onClose = undefined,
 		description = undefined,
 		hideTarget = false,
 		hideTooltips = false,
@@ -90,6 +101,11 @@
 		onReset = undefined,
 		cloudDisabled = false
 	}: Props = $props()
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	const operatingHref = useOperatingWorkspaceHref()
+	const wsId = $derived($operatingWorkspace)
 
 	let drawer: Drawer | undefined = $state()
 	let is_flow: boolean = $state(false)
@@ -114,7 +130,13 @@
 	let heartbeat_message = $state('')
 	let heartbeat_state_field = $state('')
 	let dirtyPath = $state(false)
-	let can_write = $state(true)
+	let permsPath = $state<string | undefined>(undefined)
+	let permsForWrite = $state<Record<string, boolean> | undefined>(undefined)
+	// The acting user in the operating workspace arrives asynchronously, and an unknown user
+	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
+	const can_write = $derived(
+		permsPath === undefined ? true : canWrite(permsPath, permsForWrite ?? {}, actingUser)
+	)
 	let drawerLoading = $state(true)
 	let showLoading = $state(false)
 	let initialConfig: Record<string, any> | undefined = undefined
@@ -139,7 +161,7 @@
 	const draftSync = useTriggerDraftSync({
 		itemKind: 'trigger_websocket',
 		path: () => initialPath,
-		workspace: () => $workspaceStore,
+		workspace: () => wsId,
 		drawerLoading: () => drawerLoading,
 		getCfg: () => websocketCfg,
 		applyCfg: loadTriggerConfig,
@@ -179,6 +201,8 @@
 		isFlow: boolean,
 		defaultConfig?: Record<string, any>
 	) {
+		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
+		operatingUser.forgetFailures()
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100) // Do not show loading spinner for the first 100ms
@@ -256,6 +280,8 @@
 	}
 
 	function loadTriggerConfig(cfg?: Record<string, any>): void {
+		// The loaded trigger says what it runs; an opener's `isFlow` is only its guess.
+		if (cfg?.is_flow !== undefined) itemKind = cfg.is_flow ? 'flow' : 'script'
 		script_path = cfg?.script_path
 		initialScriptPath = cfg?.script_path
 		is_flow = cfg?.is_flow
@@ -272,7 +298,8 @@
 		heartbeat_interval_secs = hb?.interval_secs ?? 41
 		heartbeat_message = hb?.message ?? ''
 		heartbeat_state_field = hb?.state_field ?? ''
-		can_write = canWrite(path, cfg?.extra_perms, $userStore)
+		permsPath = path
+		permsForWrite = cfg?.extra_perms
 		error_handler_path = cfg?.error_handler_path
 		error_handler_args = cfg?.error_handler_args ?? {}
 		retry = cfg?.retry
@@ -320,7 +347,7 @@
 			return { overlay: undefined, noDeployed: false }
 		}
 		const s = await WebsocketTriggerService.getWebsocketTrigger({
-			workspace: $workspaceStore!,
+			workspace: wsId!,
 			path: initialPath,
 			getDraft: true
 		})
@@ -348,8 +375,8 @@
 			try {
 				let schema: Schema | undefined = emptySchema()
 				let scriptOrFlow: Script | Flow = is_flow
-					? await FlowService.getFlowByPath({ workspace: $workspaceStore!, path })
-					: await ScriptService.getScriptByPath({ workspace: $workspaceStore!, path })
+					? await FlowService.getFlowByPath({ workspace: wsId!, path })
+					: await ScriptService.getScriptByPath({ workspace: wsId!, path })
 				schema = scriptOrFlow.schema as Schema
 				if (schema && schema.properties) {
 					initialMessageRunnableSchemas[(is_flow ? 'flow/' : '') + path] = schema
@@ -380,7 +407,7 @@
 			initialPath,
 			saveCfg,
 			edit,
-			$workspaceStore!,
+			wsId!,
 			usedTriggerKinds
 		)
 		if (isSaved) {
@@ -412,7 +439,7 @@
 				(force) =>
 					WebsocketTriggerService.setWebsocketTriggerMode({
 						path: initialPath,
-						workspace: $workspaceStore ?? '',
+						workspace: wsId ?? '',
 						requestBody: { mode: newMode, force }
 					}),
 				'websocket trigger'
@@ -458,36 +485,44 @@
 	/>
 {/if}
 
-{#if useDrawer}
+{#snippet drawerBody()}
+	<DrawerContent
+		hideClose={inline && !onClose}
+		fullScreen={!inline}
+		bannerReserved={draftSync.hasBaseline}
+		title={edit
+			? can_write
+				? `Edit WebSocket trigger ${initialPath}`
+				: `WebSocket trigger ${initialPath}`
+			: 'New WebSocket trigger'}
+		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
+	>
+		{#snippet actions()}
+			{@render actionsButtons()}
+		{/snippet}
+		{#snippet banner()}
+			<LocalDraftBanner
+				show={draftSync.hasDraft}
+				getDeployed={() => draftSync.deployed}
+				reserveSpace={draftSync.hasBaseline}
+				getCurrent={() => draftSync.current}
+				onDiscard={() => draftSync.resetToDeployed(initialPath)}
+				disabled={!can_write}
+			/>
+		{/snippet}
+		{@render config()}
+	</DrawerContent>
+{/snippet}
+
+{#if useDrawer && inline}
+	{@render drawerBody()}
+{:else if useDrawer}
 	<Drawer
 		size="800px"
 		bind:this={drawer}
 		on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.websocket.path)}
 	>
-		<DrawerContent
-			bannerReserved={draftSync.hasBaseline}
-			title={edit
-				? can_write
-					? `Edit WebSocket trigger ${initialPath}`
-					: `WebSocket trigger ${initialPath}`
-				: 'New WebSocket trigger'}
-			on:close={drawer.closeDrawer}
-		>
-			{#snippet actions()}
-				{@render actionsButtons()}
-			{/snippet}
-			{#snippet banner()}
-				<LocalDraftBanner
-					show={draftSync.hasDraft}
-					getDeployed={() => draftSync.deployed}
-					reserveSpace={draftSync.hasBaseline}
-					getCurrent={() => draftSync.current}
-					onDiscard={() => draftSync.resetToDeployed(initialPath)}
-					disabled={!can_write}
-				/>
-			{/snippet}
-			{@render config()}
-		</DrawerContent>
+		{@render drawerBody()}
 	</Drawer>
 {:else}
 	<Section label={!customLabel ? 'WebSocket trigger' : ''} headerClass="grow min-w-0 h-[30px]">
@@ -589,7 +624,7 @@
 								bind:itemKind
 								bind:scriptPath={script_path}
 								allowRefresh={can_write}
-								allowEdit={!$userStore?.operator}
+								allowEdit={!actingUser?.operator}
 								clearable
 							/>
 							{#if emptyString(script_path)}
@@ -598,7 +633,9 @@
 									variant="accent"
 									size="xs"
 									disabled={!can_write}
-									href={itemKind === 'flow' ? '/flows/add?hub=64' : '/scripts/add?hub=hub%2F19660'}
+									href={operatingHref(
+										itemKind === 'flow' ? '/flows/add?hub=64' : '/scripts/add?hub=hub%2F19660'
+									)}
 									target="_blank"
 								>
 									Create from template
diff --git a/frontend/src/lib/components/variables/VariablesList.svelte b/frontend/src/lib/components/variables/VariablesList.svelte
new file mode 100644
index 0000000000..66f293a11d
--- /dev/null
+++ b/frontend/src/lib/components/variables/VariablesList.svelte
@@ -0,0 +1,759 @@
+<script lang="ts">
+	import { getLocalDraftHint } from '$lib/localDraftHints.svelte'
+	import CenteredPage from '$lib/components/CenteredPage.svelte'
+	import {
+		Alert,
+		Badge,
+		Button,
+		EmptyState,
+		Skeleton,
+		Tab,
+		TabFade,
+		Tabs
+	} from '$lib/components/common'
+	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
+	import { OauthService, VariableService, WorkspaceService } from '$lib/gen'
+	import ContextualVariableEditor from '$lib/components/ContextualVariableEditor.svelte'
+	import DeployWorkspaceDrawer from '$lib/components/DeployWorkspaceDrawer.svelte'
+	import Dropdown from '$lib/components/DropdownV2.svelte'
+	import NoDirectDeployAlert from '$lib/components/NoDirectDeployAlert.svelte'
+	import PageHeader from '$lib/components/PageHeader.svelte'
+	import Popover from '$lib/components/Popover.svelte'
+	import FilterSearchbar, {
+		hasActiveFilters,
+		useUrlSyncedFilterInstance
+	} from '$lib/components/FilterSearchbar.svelte'
+	import { buildVariablesFilterSchema } from '$lib/components/variables/variablesFilter'
+	import SharedBadge from '$lib/components/SharedBadge.svelte'
+	import DraftBadge from '$lib/components/DraftBadge.svelte'
+	import InheritedLabels from '$lib/components/InheritedLabels.svelte'
+	import ShareModal from '$lib/components/ShareModal.svelte'
+	import Cell from '$lib/components/table/Cell.svelte'
+	import DataTable from '$lib/components/table/DataTable.svelte'
+	import Head from '$lib/components/table/Head.svelte'
+	import Row from '$lib/components/table/Row.svelte'
+	import TableSimple from '$lib/components/TableSimple.svelte'
+	import Tooltip from '$lib/components/Tooltip.svelte'
+	import VariableEditor from '$lib/components/VariableEditor.svelte'
+	import type { ContextualVariable, ListableVariable, WorkspaceDeployUISettings } from '$lib/gen'
+	import { enterpriseLicense, userWorkspaces } from '$lib/stores'
+	import { sendUserToast } from '$lib/toast'
+	import { canWrite, isOwner, truncate } from '$lib/utils'
+	import { isDeployable, ALL_DEPLOYABLE } from '$lib/utils_deployable'
+	import {
+		Plus,
+		FileUp,
+		Link,
+		Pen,
+		RefreshCw,
+		Shield,
+		Trash,
+		Building,
+		DollarSign,
+		EyeOff,
+		Circle,
+		SearchX
+	} from 'lucide-svelte'
+	import { untrack } from 'svelte'
+	import { page } from '$app/stores'
+	import { useHostedPage } from '$lib/components/hostedPage'
+	import {
+		useOperatingWorkspace,
+		useOperatingUser
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const hosted = useHostedPage()
+
+	function editVariable(path: string) {
+		if (hosted) hosted.openItem(path)
+		else variableEditor?.editVariable(path)
+	}
+
+	type ListableVariableW = ListableVariable & { canWrite: boolean }
+
+	let variables = $state(undefined) as ListableVariableW[] | undefined
+	let showCreateButtons = $state(false)
+
+	// Collect unique values for filter autocomplete
+	let allPaths: string[] = $state([])
+	let allOwners: string[] = $state([])
+	let allLabels: string[] = $state([])
+
+	// FilterSearchbar setup
+	let userFoldersFilterType = $derived(
+		operatingUser.current?.is_super_admin && operatingUser.current.username.includes('@')
+			? 'only f/*'
+			: operatingUser.current?.is_admin || operatingUser.current?.is_super_admin
+				? 'u/username and f/*'
+				: undefined
+	)
+	let variablesFilterSchema = $derived(
+		buildVariablesFilterSchema({
+			paths: allPaths,
+			owners: allOwners,
+			labels: allLabels,
+			showUserFoldersFilter: userFoldersFilterType !== undefined,
+			userFoldersLabel:
+				userFoldersFilterType === 'only f/*'
+					? 'Only f/*'
+					: `Only u/${operatingUser.current?.username} and f/*`
+		})
+	)
+	let filters = useUrlSyncedFilterInstance(untrack(() => variablesFilterSchema))
+	// A link can carry the user folders filter to someone it is not offered to, where it would sit
+	// set with no chip to clear it. Dropped only once a user is actually known: `resolved` holds for
+	// the navigation workspace even while its user is still loading.
+	$effect(() => {
+		if (!operatingUser.resolved($operatingWorkspace) || !operatingUser.current) return
+		if (userFoldersFilterType !== undefined) return
+		if (!filters.val.user_folders_only) return
+		untrack(() => {
+			const { user_folders_only: _, ...rest } = filters.val
+			filters.val = rest
+		})
+	})
+	let itemFolders = $derived(
+		Array.from(
+			new Set(
+				(variables ?? [])
+					.map((x) => x.path.split('/').slice(0, 2).join('/'))
+					.filter((x) => x.startsWith('f/'))
+			)
+		)
+			.sort()
+			.map((f) => f.replace(/^f\//, ''))
+	)
+	let folderPresets = $derived([
+		...itemFolders.map((f) => ({ name: `f/${f}`, value: `path_start:\\ f/${f}/` })),
+		...allLabels.map((l) => ({ name: l, value: `label:\\ ${l}` })),
+		...(!variablesFilterSchema.user_folders_only.hidden
+			? [
+					{
+						name: variablesFilterSchema.user_folders_only.label ?? '?',
+						value: 'user_folders_only:\\ true'
+					}
+				]
+			: [])
+	])
+	let contextualVariables: ContextualVariable[] = $state([])
+	let shareModal: ShareModal | undefined = $state()
+	let variableEditor: VariableEditor | undefined = $state()
+	let contextualVariableEditor: ContextualVariableEditor | undefined = $state()
+	let loading = $state({
+		contextual: true
+	})
+
+	let deleteConfirmedCallback: (() => void) | undefined = $state(undefined)
+	let deleteIsLinked = $state(false)
+	let open = $derived(Boolean(deleteConfirmedCallback))
+
+	// Filter variables client-side for user folder filtering (admin feature)
+	let filteredItems = $derived.by(() => {
+		let items = variables
+		if (filters.val.user_folders_only && items) {
+			items = items.filter((item) => {
+				if (userFoldersFilterType === 'only f/*') return item.path.startsWith('f/')
+				if (userFoldersFilterType === 'u/username and f/*')
+					return (
+						item.path.startsWith('f/') ||
+						item.path.startsWith(`u/${operatingUser.current?.username}/`)
+					)
+				return true
+			})
+		}
+		return items
+	})
+
+	// If relative, the dropdown is positioned relative to its button
+	async function loadVariables(): Promise<void> {
+		const currentFilters = filters.val
+
+		// Build API parameters from filters.
+		// `includeDraftOnly` surfaces per-user drafts at paths that have
+		// no deployed variable — appended server-side when no narrowing
+		// filter is set, so the user sees AI-agent-created drafts on
+		// the home page.
+		const apiParams: any = {
+			workspace: $operatingWorkspace!,
+			includeDraftOnly: true
+		}
+
+		if (currentFilters.path) {
+			apiParams.path = currentFilters.path
+		}
+		if (currentFilters.path_start) {
+			apiParams.pathStart = currentFilters.path_start
+		}
+		if (currentFilters.description) {
+			apiParams.description = currentFilters.description
+		}
+		if (currentFilters.value) {
+			apiParams.value = currentFilters.value
+		}
+		if (currentFilters.owner) {
+			apiParams.pathStart = currentFilters.owner
+		}
+		if (currentFilters._default_) {
+			apiParams.broadFilter = currentFilters._default_
+		}
+		if (currentFilters.label) {
+			apiParams.label = currentFilters.label
+		}
+
+		const result = (await VariableService.listVariable(apiParams)).map((x) => {
+			return {
+				canWrite:
+					canWrite(x.path, x.extra_perms!, operatingUser.current) &&
+					x.workspace_id == $operatingWorkspace,
+				...x
+			}
+		})
+
+		// Extract unique values for autocomplete
+		allPaths = Array.from(new Set(result.map((x) => x.path))).sort()
+		allOwners = Array.from(
+			new Set(result.map((x) => x.path.split('/').slice(0, 2).join('/')))
+		).sort()
+		allLabels = Array.from(
+			new Set(result.flatMap((x) => [...(x.labels ?? []), ...(x.inherited_labels ?? [])]))
+		).sort()
+
+		variables = result
+	}
+
+	// Reload variables when filters change
+	$effect(() => {
+		filters.val
+		if ($operatingWorkspace) {
+			untrack(() => loadVariables())
+		}
+	})
+
+	let deployUiSettings: WorkspaceDeployUISettings | undefined = $state(undefined)
+
+	async function getDeployUiSettings() {
+		if (!$enterpriseLicense) {
+			deployUiSettings = ALL_DEPLOYABLE
+			return
+		}
+		let settings = await WorkspaceService.getPublicSettings({ workspace: $operatingWorkspace! })
+		deployUiSettings = settings.deploy_ui ?? ALL_DEPLOYABLE
+	}
+	getDeployUiSettings()
+
+	async function loadContextualVariables(): Promise<void> {
+		contextualVariables = await VariableService.listContextualVariables({
+			workspace: $operatingWorkspace!
+		})
+		loading.contextual = false
+	}
+
+	async function deleteVariable(path: string, account?: number): Promise<void> {
+		if (account) {
+			OauthService.disconnectAccount({ workspace: $operatingWorkspace!, id: account })
+		}
+		await VariableService.deleteVariable({ workspace: $operatingWorkspace!, path })
+		loadVariables()
+		sendUserToast(`Variable ${path} was deleted`)
+	}
+
+	$effect(() => {
+		if ($operatingWorkspace && operatingUser.current) {
+			untrack(() => {
+				loadVariables()
+				loadContextualVariables()
+			})
+		}
+	})
+	let tab: 'workspace' | 'contextual' = $state('workspace')
+
+	let activeFilters = $derived(hasActiveFilters(filters.val))
+
+	let deploymentDrawer: DeployWorkspaceDrawer | undefined = $state()
+
+	async function deleteContextualVariable(row: { name: string }) {
+		await WorkspaceService.setEnvironmentVariable({
+			workspace: $operatingWorkspace!,
+			requestBody: {
+				name: row.name,
+				value: undefined
+			}
+		})
+		loadContextualVariables()
+		sendUserToast(
+			`Custom contextual variable ${row.name} was deleted. It may take up to a few minutes to update.`
+		)
+		setTimeout(() => {
+			loadContextualVariables()
+		}, 5000)
+	}
+
+	// Deep link: #<path> opens that variable's edit drawer. Reactive rather than
+	// onMount so a hash change on the already-mounted page (e.g. the AI session
+	// preview re-pointing its tab) opens the drawer too. Row links pre-set
+	// handledHash: their onclick already opens the drawer.
+	let handledHash = ''
+	$effect(() => {
+		// A host opens rows itself, and the document's hash is not this page's.
+		if (hosted) return
+		const hash = $page.url.hash
+		// Only item paths are drawer targets: the same hash also carries global
+		// drawers like #superadmin-settings, which must not be looked up as a variable.
+		if (!/^#[ufg]\//.test(hash)) {
+			// Navigating away from a drawer target must clear the tracker, or
+			// re-targeting the same item later would be skipped as already handled.
+			handledHash = ''
+			return
+		}
+		if (hash === handledHash || !variableEditor) return
+		handledHash = hash
+		variableEditor.editVariable(hash.slice(1))
+	})
+</script>
+
+<DeployWorkspaceDrawer bind:this={deploymentDrawer} />
+
+{#if operatingUser.current?.operator && $operatingWorkspace && !$userWorkspaces.find((_) => _.id === $operatingWorkspace)?.operator_settings?.variables}
+	<div class="bg-red-100 border-l-4 border-red-600 text-orange-700 p-4 m-4 mt-12" role="alert">
+		<p class="font-bold">Unauthorized</p>
+		<p>Page not available for operators</p>
+	</div>
+{:else}
+	<CenteredPage>
+		<PageHeader
+			title="Variables"
+			tooltip="Save and permission strings to be reused in Scripts and Flows."
+			documentationLink="https://www.windmill.dev/docs/core_concepts/variables_and_secrets"
+		>
+			{#if showCreateButtons}
+				<div class="flex flex-row justify-end">
+					{#if tab == 'contextual' && (operatingUser.current?.is_admin || operatingUser.current?.is_super_admin)}
+						<Button
+							unifiedSize="md"
+							variant="accent"
+							startIcon={{ icon: Plus }}
+							on:click={() => contextualVariableEditor?.initNew()}
+						>
+							New&nbsp;contextual&nbsp;variable
+						</Button>
+					{:else}
+						<Button
+							unifiedSize="md"
+							variant="accent"
+							startIcon={{ icon: Plus }}
+							on:click={() => variableEditor?.initNew()}
+						>
+							New&nbsp;variable
+						</Button>
+					{/if}
+				</div>
+			{/if}
+		</PageHeader>
+		<NoDirectDeployAlert onUpdateCanEditStatus={(v) => (showCreateButtons = v)} />
+
+		<VariableEditor
+			bind:this={variableEditor}
+			workspace={$operatingWorkspace}
+			on:create={loadVariables}
+		/>
+		<ContextualVariableEditor
+			bind:this={contextualVariableEditor}
+			on:update={loadContextualVariables}
+		/>
+		<ShareModal
+			bind:this={shareModal}
+			on:change={() => {
+				loadVariables()
+			}}
+		/>
+
+		<div class="flex gap-2 justify-between items-center">
+			<Tabs bind:selected={tab}>
+				<Tab value="workspace" label="Workspace" icon={Building} />
+				<Tab value="contextual" label="Contextual" icon={DollarSign}>
+					{#snippet extra()}
+						<Tooltip
+							documentationLink="https://www.windmill.dev/docs/core_concepts/variables_and_secrets#contextual-variables"
+						>
+							Contextual variables are passed as environment variables when running a script and
+							depends on the execution context.
+						</Tooltip>
+					{/snippet}
+				</Tab>
+			</Tabs>
+			{#if tab == 'workspace'}
+				<FilterSearchbar
+					class="grow max-w-[26rem]"
+					schema={variablesFilterSchema}
+					bind:value={filters.val}
+					placeholder="Filter variables..."
+					presets={folderPresets}
+				/>
+			{/if}
+		</div>
+		<TabFade key={tab}>
+			{#if tab == 'workspace'}
+				<div class="relative overflow-x-auto pb-40 mt-4">
+					{#if !filteredItems}
+						<Skeleton layout={[0.5, [2], 1]} />
+						{#each new Array(3) as _}
+							<Skeleton layout={[[3.5], 0.5]} />
+						{/each}
+					{:else if filteredItems.length == 0}
+						{#if activeFilters}
+							<EmptyState
+								icon={SearchX}
+								title="No variables found"
+								description="No variable matches the current filters. Try clearing or widening them."
+							/>
+						{:else}
+							<EmptyState
+								icon={DollarSign}
+								title="No variables yet"
+								description="Variables store values and secrets that your scripts, flows and apps can read at runtime."
+								action={showCreateButtons
+									? {
+											label: 'Add a variable',
+											icon: Plus,
+											onClick: () => variableEditor?.initNew(),
+											aiId: 'variables-empty-add-variable',
+											aiDescription: 'Add variable'
+										}
+									: undefined}
+							/>
+						{/if}
+					{:else}
+						<DataTable size="xs">
+							<Head>
+								<tr>
+									<Cell head first class="!px-0" />
+									<Cell head>Path</Cell>
+									<Cell head>Value</Cell>
+									<Cell head>Description</Cell>
+									<Cell head>Status</Cell>
+									<Cell head last actions>Actions</Cell>
+								</tr>
+							</Head>
+							<tbody class="divide-y">
+								{#each filteredItems as { path, value, is_secret, description, extra_perms, canWrite, account, is_refreshed, is_expired, refresh_error, is_linked, labels, inherited_labels, ws_specific, draft_only, is_draft }}
+									{@const hasDraft =
+										getLocalDraftHint($operatingWorkspace, 'variable', path) ?? is_draft}
+									<Row>
+										<Cell class="!px-0 text-center w-12" first>
+											<SharedBadge {canWrite} extraPerms={extra_perms} />
+										</Cell>
+										<Cell>
+											<div class="flex items-center gap-2">
+												<a
+													class="break-all"
+													id="edit-{path}"
+													onclick={() => {
+														handledHash = `#${path}`
+														editVariable(path)
+													}}
+													href="#{path}"
+												>
+													{path}{hasDraft ? '*' : ''}
+												</a>
+												<DraftBadge {draft_only} is_draft={hasDraft} />
+												{#if labels?.length}
+													{#each labels as label}
+														<Badge
+															color="blue"
+															small
+															class="px-1"
+															title="Label: {label}"
+															clickable
+															onclick={() => {
+																const arr = (filters.val.label ?? '').split(',').filter(Boolean)
+																const idx = arr.indexOf(label)
+																if (idx >= 0) arr.splice(idx, 1)
+																else arr.push(label)
+																const newFilters = { ...filters.val }
+																if (arr.length) newFilters.label = arr.join(',')
+																else delete newFilters.label
+																filters.val = newFilters
+															}}>{label}</Badge
+														>
+													{/each}
+												{/if}
+												<InheritedLabels labels={inherited_labels} />
+											</div>
+										</Cell>
+										<Cell>
+											<span class="inline-flex flex-row items-center gap-2">
+												<div class="text-xs break-words">
+													{#if value}
+														{truncate(value, 20)}
+													{:else}
+														&lowast;&lowast;&lowast;&lowast;
+													{/if}
+												</div>
+												{#if is_secret}
+													<Popover notClickable>
+														<EyeOff size={12} />
+														{#snippet text()}
+															<span>This item is secret</span>
+														{/snippet}
+													</Popover>
+												{/if}
+											</span>
+										</Cell>
+										<Cell class="break-words">
+											<span class="text-xs text-primary">{truncate(description ?? '', 50)} </span>
+										</Cell>
+
+										<Cell class="text-center">
+											<div class="flex flex-row items-center gap-4">
+												{#if is_linked}
+													<Popover notClickable>
+														<Link size={16} />
+														{#snippet text()}
+															<div>
+																This variable is linked with a resource of the same path. They are
+																deleted and renamed together.
+															</div>
+														{/snippet}
+													</Popover>
+												{/if}
+												{#if account}
+													<Popover notClickable>
+														<RefreshCw size={16} />
+														{#snippet text()}
+															<div>
+																This OAuth token will be kept up-to-date in the background by
+																Windmill using its refresh token
+															</div>
+														{/snippet}
+													</Popover>
+												{/if}
+
+												{#if is_refreshed}
+													<div class="">
+														{#if refresh_error}
+															<Popover notClickable>
+																<!-- isolate: confine the ping indicator's z-50 to a local stacking context
+											     so it can't paint over anything that scrolls past it -->
+																<div
+																	class="relative inline-flex justify-center items-center w-4 h-4 isolate"
+																>
+																	<Circle
+																		class="text-red-600 animate-ping absolute z-50 w-4 h-4 fill-current"
+																		size={12}
+																	/>
+																	<Circle
+																		class="text-red-600 relative inline-flex fill-current "
+																		size={12}
+																	/>
+																</div>
+
+																{#snippet text()}
+																	<div>
+																		Latest exchange of the refresh token did not succeed. Error: {refresh_error}
+																	</div>
+																{/snippet}
+															</Popover>
+														{:else if is_expired}
+															<Popover notClickable>
+																<Circle
+																	class="text-yellow-600 animate-[pulse_5s_linear_infinite] fill-current"
+																	size={12}
+																/>
+																{#snippet text()}
+																	<div>
+																		The access_token is expired, it will get renewed the next time
+																		this variable is fetched or you can request is to be refreshed
+																		in the dropdown on the right.
+																	</div>
+																{/snippet}
+															</Popover>
+														{:else}
+															<Popover notClickable>
+																<Circle
+																	class="text-green-600 animate-[pulse_5s_linear_infinite] fill-current"
+																	size={12}
+																/>
+																{#snippet text()}
+																	<div>
+																		The variable was connected through OAuth and the token is not
+																		expired.
+																	</div>
+																{/snippet}
+															</Popover>
+														{/if}
+													</div>
+												{/if}
+											</div>
+										</Cell>
+										<Cell last actions shouldStopPropagation>
+											<Dropdown
+												items={() => {
+													let owner = isOwner(path, operatingUser.current, $operatingWorkspace)
+													return [
+														{
+															displayName: 'Edit',
+															icon: Pen,
+															action: () => editVariable(path),
+															disabled: !canWrite || !showCreateButtons
+														},
+														{
+															displayName: 'Delete',
+															icon: Trash,
+															type: 'delete',
+															action: (event) => {
+																if (event['shiftKey']) {
+																	deleteVariable(path, account)
+																} else {
+																	deleteIsLinked = is_linked ?? false
+																	deleteConfirmedCallback = () => {
+																		deleteVariable(path, account)
+																	}
+																}
+															},
+															disabled: !owner || !showCreateButtons
+														},
+														...(!ws_specific &&
+														isDeployable(is_secret ? 'secret' : 'variable', path, deployUiSettings)
+															? [
+																	{
+																		displayName: 'Deploy to prod/staging',
+																		icon: FileUp,
+																		action: () => {
+																			deploymentDrawer?.openDrawer(path, 'variable')
+																		}
+																	}
+																]
+															: []),
+														{
+															displayName: 'Permissions',
+															action: () => {
+																shareModal?.openDrawer(path, 'variable')
+															},
+															icon: Shield
+														},
+														...(account != undefined
+															? [
+																	{
+																		displayName: 'Refresh token',
+																		icon: RefreshCw,
+																		action: async () => {
+																			await OauthService.refreshToken({
+																				workspace: $operatingWorkspace ?? '',
+																				id: account ?? 0,
+																				requestBody: {
+																					path
+																				}
+																			})
+																			sendUserToast('Token refreshed')
+																			loadVariables()
+																		}
+																	}
+																]
+															: [])
+													]
+												}}
+											/>
+										</Cell>
+									</Row>
+								{/each}
+							</tbody>
+						</DataTable>
+					{/if}
+				</div>
+			{:else if tab == 'contextual'}
+				<div class="overflow-auto">
+					{#if loading.contextual}
+						<Skeleton layout={[0.5, [2], 1]} />
+						{#each new Array(8) as _}
+							<Skeleton layout={[[2.8], 0.5]} />
+						{/each}
+					{:else}
+						<PageHeader title="Custom contextual variables" primary={false} />
+						{#if contextualVariables.filter((x) => x.is_custom).length === 0}
+							<EmptyState
+								icon={DollarSign}
+								title="No custom contextual variables yet"
+								description="Custom contextual variables are passed as environment variables to every script run in this workspace."
+								action={showCreateButtons &&
+								(operatingUser.current?.is_admin || operatingUser.current?.is_super_admin)
+									? {
+											label: 'Add a contextual variable',
+											icon: Plus,
+											onClick: () => contextualVariableEditor?.initNew(),
+											aiId: 'variables-empty-add-contextual-variable',
+											aiDescription: 'Add contextual variable'
+										}
+									: undefined}
+							/>
+						{:else}
+							<TableSimple
+								headers={['Name', 'Value']}
+								data={contextualVariables.filter((x) => x.is_custom)}
+								keys={['name', 'value']}
+								getRowActions={operatingUser.current?.is_admin ||
+								operatingUser.current?.is_super_admin
+									? (row) => {
+											return [
+												{
+													displayName: 'Edit',
+													action: () => contextualVariableEditor?.editVariable(row.name, row.value)
+												},
+												{
+													displayName: 'Delete',
+													type: 'delete',
+													action: () => {
+														deleteContextualVariable(row)
+													}
+												}
+											]
+										}
+									: undefined}
+							/>
+						{/if}
+						<PageHeader title="Contextual variables" primary={false} />
+						<TableSimple
+							headers={['Name', 'Example of value', 'Description']}
+							data={contextualVariables.filter((x) => !x.is_custom)}
+							keys={['name', 'value', 'description']}
+						/>
+					{/if}
+				</div>
+			{/if}
+		</TabFade>
+	</CenteredPage>
+{/if}
+
+<ConfirmationModal
+	{open}
+	title="Remove variable"
+	confirmationText="Remove"
+	trashbin
+	on:canceled={() => {
+		deleteConfirmedCallback = undefined
+	}}
+	on:confirmed={() => {
+		if (deleteConfirmedCallback) {
+			deleteConfirmedCallback()
+		}
+		deleteConfirmedCallback = undefined
+	}}
+>
+	<div class="flex flex-col w-full space-y-4">
+		<span>Are you sure you want to remove this variable?</span>
+		{#if deleteIsLinked}
+			<Alert type="warning" title="Linked resource">
+				This variable is linked with a resource of the same path. The linked resource will also be
+				deleted.
+			</Alert>
+		{/if}
+		<Alert type="info" title="Bypass confirmation">
+			<div>
+				You can press
+				<Badge color="dark-gray">SHIFT</Badge>
+				while removing a variable to bypass confirmation.
+			</div>
+		</Alert>
+	</div>
+</ConfirmationModal>
diff --git a/frontend/src/lib/components/variables/variablesFilter.ts b/frontend/src/lib/components/variables/variablesFilter.ts
index 5f7ce1e51a..d609182da0 100644
--- a/frontend/src/lib/components/variables/variablesFilter.ts
+++ b/frontend/src/lib/components/variables/variablesFilter.ts
@@ -64,15 +64,14 @@ export function buildVariablesFilterSchema({
 			icon: Tag,
 			description: 'Filter by label (comma-separated for multiple)'
 		},
-		...(showUserFoldersFilter
-			? {
-					user_folders_only: {
-						type: 'boolean' as const,
-						label: userFoldersLabel || 'User folders only',
-						icon: Users,
-						description: 'Show only variables in user folders'
-					}
-				}
-			: {})
+		// The key stays for every role, hidden where the filter does not apply: the list's URL sync
+		// reads the key set once, before the acting user that gates it may have loaded.
+		user_folders_only: {
+			type: 'boolean' as const,
+			label: userFoldersLabel || 'User folders only',
+			icon: Users,
+			description: 'Show only variables in user folders',
+			hidden: !showUserFoldersFilter
+		}
 	} satisfies FilterSchemaRec
 }
diff --git a/frontend/src/lib/components/wizards/AppPicker.svelte b/frontend/src/lib/components/wizards/AppPicker.svelte
index e6ee5b3f25..17f384c71d 100644
--- a/frontend/src/lib/components/wizards/AppPicker.svelte
+++ b/frontend/src/lib/components/wizards/AppPicker.svelte
@@ -1,18 +1,25 @@
 <script lang="ts">
 	import { getContext, onMount } from 'svelte'
 	import DarkModeObserver from '../DarkModeObserver.svelte'
-	import { userStore, workspaceStore } from '$lib/stores'
 	import { AppService, type ListableApp } from '$lib/gen'
 	import { canWrite } from '$lib/utils'
 	import type { AppViewerContext } from '../apps/types'
 	import Alert from '../common/alert/Alert.svelte'
 	import Select from '../select/Select.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	interface Props {
-		value?: string;
+		value?: string
 	}
 
-	let { value = $bindable('') }: Props = $props();
+	let { value = $bindable('') }: Props = $props()
 	let darkMode = $state(false)
 
 	const { appPath } = getContext<AppViewerContext>('AppViewerContext')
@@ -20,17 +27,17 @@
 	let apps: ListableApp[] = $state([])
 
 	async function loadApps(): Promise<void> {
-		apps = (await AppService.listApps({ workspace: $workspaceStore!, includeDraftOnly: true })).map(
-			(app: ListableApp) => {
-				return {
-					canWrite:
-						canWrite(app.path!, app.extra_perms!, $userStore) &&
-						app.workspace_id == $workspaceStore &&
-						!$userStore?.operator,
-					...app
-				}
+		apps = (
+			await AppService.listApps({ workspace: $operatingWorkspace!, includeDraftOnly: true })
+		).map((app: ListableApp) => {
+			return {
+				canWrite:
+					canWrite(app.path!, app.extra_perms!, actingUser) &&
+					app.workspace_id == $operatingWorkspace &&
+					!actingUser?.operator,
+				...app
 			}
-		)
+		})
 	}
 
 	onMount(() => {
diff --git a/frontend/src/lib/components/workspaceSettings/AISettings.svelte b/frontend/src/lib/components/workspaceSettings/AISettings.svelte
index 14d27cab18..05159e3057 100644
--- a/frontend/src/lib/components/workspaceSettings/AISettings.svelte
+++ b/frontend/src/lib/components/workspaceSettings/AISettings.svelte
@@ -11,7 +11,17 @@
 	import { workspaceStore } from '$lib/stores'
 	import { copilotInfo } from '$lib/aiStore'
 	import { sendUserToast } from '$lib/toast'
-	import { AI_PROVIDERS, fetchAvailableModels, providerSupportsWebSearch } from '../copilot/lib'
+	import {
+		AI_PROVIDERS,
+		fetchAvailableModels,
+		getModelMaxTokens,
+		providerSupportsWebSearch
+	} from '../copilot/lib'
+	import {
+		getKnownModelContextWindow,
+		getModelContextWindowFromTable
+	} from '../copilot/modelConfig'
+	import { resolveRequestReasoning } from '../copilot/reasoningRegistry'
 	import { supportsAutocomplete } from '../copilot/utils'
 	import TestAiKey from '../copilot/TestAIKey.svelte'
 	import Label from '../Label.svelte'
@@ -77,6 +87,7 @@
 	let metadataModel: string | undefined = $state(undefined)
 	let customPrompts: Record<string, string> = $state({})
 	let maxTokensPerModel: Record<string, number> = $state({})
+	let contextWindowPerModel: Record<string, number> = $state({})
 	let modelPricing: Record<string, ModelPriceOverride> = $state({})
 	let usingOpenaiClientCredentialsOauth = $state(false)
 	let workspaceOverrideEditorOpened = $state(false)
@@ -91,6 +102,7 @@
 	let initialMetadataModel: string | undefined = $state(undefined)
 	let initialCustomPrompts: Record<string, string> = $state({})
 	let initialMaxTokensPerModel: Record<string, number> = $state({})
+	let initialContextWindowPerModel: Record<string, number> = $state({})
 	let initialModelPricing: Record<string, ModelPriceOverride> = $state({})
 	let initialPrompts: Record<string, string> = $state({})
 	let initialCopilotDisabled = $state(false)
@@ -122,6 +134,7 @@
 		codeCompletionModel = config?.code_completion_model?.model
 		customPrompts = clone(config?.custom_prompts ?? {})
 		maxTokensPerModel = clone(config?.max_tokens_per_model ?? {})
+		contextWindowPerModel = clone(config?.context_window_per_model ?? {})
 		modelPricing = clone(config?.model_pricing ?? {})
 		copilotDisabled = config?.copilot_disabled === true
 		sessionsStorageDisabled = config?.sessions_storage_disabled === true
@@ -140,6 +153,7 @@
 		initialCodeCompletionModel = codeCompletionModel
 		initialCustomPrompts = clone(customPrompts)
 		initialMaxTokensPerModel = clone(maxTokensPerModel)
+		initialContextWindowPerModel = clone(contextWindowPerModel)
 		initialModelPricing = clone(modelPricing)
 		initialPrompts = clone(customPrompts)
 		initialCopilotDisabled = copilotDisabled
@@ -159,6 +173,7 @@
 		codeCompletionModel = initialCodeCompletionModel
 		customPrompts = clone(initialCustomPrompts)
 		maxTokensPerModel = clone(initialMaxTokensPerModel)
+		contextWindowPerModel = clone(initialContextWindowPerModel)
 		modelPricing = clone(initialModelPricing)
 		copilotDisabled = initialCopilotDisabled
 		sessionsStorageDisabled = initialSessionsStorageDisabled
@@ -197,6 +212,7 @@
 			codeCompletionModel !== initialCodeCompletionModel ||
 			JSON.stringify(customPrompts) !== JSON.stringify(initialCustomPrompts) ||
 			JSON.stringify(maxTokensPerModel) !== JSON.stringify(initialMaxTokensPerModel) ||
+			JSON.stringify(contextWindowPerModel) !== JSON.stringify(initialContextWindowPerModel) ||
 			JSON.stringify(modelPricing) !== JSON.stringify(initialModelPricing) ||
 			copilotDisabled !== initialCopilotDisabled ||
 			sessionsStorageDisabled !== initialSessionsStorageDisabled ||
@@ -319,6 +335,8 @@
 					custom_prompts: Object.keys(custom_prompts).length > 0 ? custom_prompts : undefined,
 					max_tokens_per_model:
 						Object.keys(maxTokensPerModel).length > 0 ? maxTokensPerModel : undefined,
+					context_window_per_model:
+						Object.keys(contextWindowPerModel).length > 0 ? contextWindowPerModel : undefined,
 					model_pricing: Object.keys(modelPricing).length > 0 ? modelPricing : undefined,
 					copilot_disabled,
 					sessions_storage_disabled,
@@ -625,7 +643,32 @@
 			{/if}
 		</div>
 
-		<ModelTokenLimits {aiProviders} bind:maxTokensPerModel />
+		<ModelTokenLimits
+			{aiProviders}
+			bind:limits={maxTokensPerModel}
+			label="Model output limits"
+			description="Configure maximum token limits for each model. These limits apply to all AI chat interactions in the workspace."
+			min={1}
+			max={2_000_000}
+			getDefault={(provider, model) => ({
+				// What a chat sends at the default effort; the budget depends on it.
+				tokens: getModelMaxTokens(provider, model, resolveRequestReasoning({ provider, model })),
+				assumed: false
+			})}
+		/>
+
+		<ModelTokenLimits
+			{aiProviders}
+			bind:limits={contextWindowPerModel}
+			label="Model context windows"
+			description="The context size AI chat plans for with each model: older messages are summarized as a conversation nears it. Set it for models the built-in list does not know, such as local models served through Custom AI."
+			min={1024}
+			max={10_000_000}
+			getDefault={(_, model) => ({
+				tokens: getModelContextWindowFromTable(model),
+				assumed: getKnownModelContextWindow(model) === undefined
+			})}
+		/>
 
 		<SettingCard label="Custom system prompts" description={promptDescription}>
 			<div class="flex items-center gap-2 pt-1">
diff --git a/frontend/src/lib/components/workspaceSettings/CreateWorkspaceInner.svelte b/frontend/src/lib/components/workspaceSettings/CreateWorkspaceInner.svelte
index 22a2fc889b..d0f86b36ad 100644
--- a/frontend/src/lib/components/workspaceSettings/CreateWorkspaceInner.svelte
+++ b/frontend/src/lib/components/workspaceSettings/CreateWorkspaceInner.svelte
@@ -161,6 +161,19 @@
 			(!workspaceIsFork(baseWorkspaceId, forkableWorkspaces) ||
 				!!baseWorkspaceEntry.is_dev_workspace)
 	)
+	const baseForkMembersResource = resource(
+		() => (isFork ? baseWorkspaceId : undefined),
+		async (ws, _prev, { signal }) => {
+			if (!ws) return undefined
+			const settings = await WorkspaceService.getPublicSettings({ workspace: ws })
+			if (signal.aborted) throw new DOMException('superseded', 'AbortError')
+			return { ws, adds: settings.add_admins_and_developers_to_forks }
+		}
+	)
+	let baseAddsAdminsAndDevelopers = $derived(
+		baseForkMembersResource.current?.ws === baseWorkspaceId &&
+			!!baseForkMembersResource.current?.adds
+	)
 	// Ask the server whether a dev already exists: the caller may not be a member of this prod's dev,
 	// so the client workspace list can't see it and would offer an invalid "create dev" action.
 	const devWorkspaceResource = resource(
@@ -367,7 +380,7 @@
 			failedSyncJobs = []
 			forkCreationError = ''
 
-			// Clone datatables BEFORE creating the workspace fork
+			// Each data table copy is confirmed first; the fork request makes the copies
 			if (forkDatatableSection) {
 				const queue = forkDatatableSection.buildCloneQueue(prefixed_id)
 				if (queue.length > 0) {
@@ -383,6 +396,15 @@
 	}
 
 	async function completeFork(prefixed_id: string): Promise<void> {
+		// The fork request makes these copies, and drops them if the fork is not created
+		const forkedDatatables = forkDatatableSection
+			? forkDatatableSection.getConfirmedCloneJobs().map((job) => ({
+					name: job.name,
+					new_dbname: job._newDbName,
+					fork_behavior: job.behavior
+				}))
+			: []
+
 		let gitSyncJobIds: string[]
 		try {
 			gitSyncJobIds = await WorkspaceService.createWorkspaceForkGitBranch({
@@ -391,6 +413,9 @@
 					id: prefixed_id,
 					name,
 					color: colorEnabled && workspaceColor ? workspaceColor : undefined,
+					// Sent in this first phase too, so a clone the fork would refuse is refused before
+					// any branch is created.
+					forked_datatables: forkedDatatables,
 					is_dev_workspace: createAsDevWorkspace,
 					dev_workspace_label: createAsDevWorkspace ? devWorkspaceLabel : undefined,
 					// Send the lock intent in this first phase too so the backend can reject a non-admin's
@@ -444,14 +469,6 @@
 			return
 		}
 
-		// Build forked_datatables info from completed clone jobs
-		const forkedDatatables = forkDatatableSection
-			? forkDatatableSection.getCompletedCloneJobs().map((job) => ({
-					name: job.name,
-					new_dbname: job._newDbName
-				}))
-			: []
-
 		try {
 			await WorkspaceService.createWorkspaceFork({
 				workspace: baseWorkspaceId!,
@@ -929,6 +946,12 @@
 						disabled={createAsDevWorkspace}
 					/>
 				</label>
+				{#if baseAddsAdminsAndDevelopers && !(createAsDevWorkspace && copyMembers)}
+					<Alert type="info" size="xs" title="Admins and developers join this fork">
+						{baseWorkspaceId} adds its admins and developers to every new fork, with the role they have
+						there.
+					</Alert>
+				{/if}
 			{/if}
 			{#if isFork}
 				<ForkDatatableSection
diff --git a/frontend/src/lib/components/workspaceSettings/DataTableMigrationsButton.svelte b/frontend/src/lib/components/workspaceSettings/DataTableMigrationsButton.svelte
index fc9bddcf4e..f9dd3dda02 100644
--- a/frontend/src/lib/components/workspaceSettings/DataTableMigrationsButton.svelte
+++ b/frontend/src/lib/components/workspaceSettings/DataTableMigrationsButton.svelte
@@ -26,7 +26,12 @@
 	import Portal from '$lib/components/Portal.svelte'
 	import DropdownV2 from '../DropdownV2.svelte'
 	import MissingWorkerTagAlert from '../jobs/MissingWorkerTagAlert.svelte'
-	import { superadmin, userStore } from '$lib/stores'
+	import { superadmin } from '$lib/stores'
+	import { useOperatingUser } from '$lib/components/operatingWorkspace.svelte'
+	import { parseMigrationRole, withMigrationRole } from '../datatableMigrationRole'
+
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	let {
 		workspace,
@@ -56,7 +61,7 @@
 	let generatingInitial = $state(false)
 
 	// Only workspace admins and super admins can opt a data table in or out.
-	const canManage = $derived(!!$userStore?.is_admin || !!$superadmin)
+	const canManage = $derived(!!actingUser?.is_admin || !!$superadmin)
 
 	let newMigrationModal = $state<NewDataTableMigrationModal | undefined>(undefined)
 	let newMigrationOpen = $state(false)
@@ -84,8 +89,9 @@
 
 	function startAddDownMigration() {
 		// Same transaction frame the new-migration modal starts from, so the down
-		// applies atomically.
-		downDraft = DOWN_TEMPLATE
+		// applies atomically. It rolls back as the role the up ran as.
+		const upRole = viewMigration ? parseMigrationRole(viewMigration.code_up) : undefined
+		downDraft = withMigrationRole(DOWN_TEMPLATE, upRole?.kind === 'role' ? upRole.role : undefined)
 		addingDown = true
 	}
 
@@ -167,6 +173,10 @@
 		loadMigrations()
 	}
 
+	export function open() {
+		openList()
+	}
+
 	// Open the list modal and the detail view for a specific migration. Used to
 	// jump to a just-created migration from the "See migration" toast action.
 	export async function openMigration(timestamp: number) {
diff --git a/frontend/src/lib/components/workspaceSettings/DataTablePermissionsButton.svelte b/frontend/src/lib/components/workspaceSettings/DataTablePermissionsButton.svelte
new file mode 100644
index 0000000000..1a08de1351
--- /dev/null
+++ b/frontend/src/lib/components/workspaceSettings/DataTablePermissionsButton.svelte
@@ -0,0 +1,441 @@
+<script lang="ts">
+	import { Alert, Badge, Button, Drawer, DrawerContent } from '../common'
+	import Select from '../select/Select.svelte'
+	import MultiSelect from '../select/MultiSelect.svelte'
+	import Toggle from '../Toggle.svelte'
+	import Tooltip from '../Tooltip.svelte'
+	import CloseButton from '../common/CloseButton.svelte'
+	import Checkbox from '../common/checkbox/Checkbox.svelte'
+	import Cell from '../table/Cell.svelte'
+	import DataTable from '../table/DataTable.svelte'
+	import Head from '../table/Head.svelte'
+	import Row from '../table/Row.svelte'
+	import { KeyRound } from 'lucide-svelte'
+	import {
+		FolderService,
+		GroupService,
+		SettingService,
+		UserService,
+		WorkspaceService,
+		type DatatablePermissions,
+		type InstanceDatatableRole
+	} from '$lib/gen'
+	import { superadmin } from '$lib/stores'
+	import { sendUserToast } from '$lib/toast'
+	import { deepEqual } from 'fast-equals'
+	import { ADMIN_DATATABLE_ROLE, isDatatableRoleName } from '../dbTypes'
+	import PgAclEditor from '../datatableAcl/PgAclEditor.svelte'
+	import InstanceRolesButton from './InstanceRolesButton.svelte'
+
+	let {
+		workspace,
+		datatable,
+		disabled = false,
+		hideTrigger = false,
+		onSaved
+	}: {
+		workspace: string
+		datatable: string
+		disabled?: boolean
+		/** Mount the drawer without its button, for a caller that opens it with `open()`. */
+		hideTrigger?: boolean
+		/** Called once a save went through, so a caller showing the roles can read them again. */
+		onSaved?: () => void
+	} = $props()
+
+	// `id` is the instance role's catalog id (or the reserved `admin`), which is what the tenant
+	// lists are keyed by — so renaming a role instance-side moves nothing here. A row without an id
+	// names a role the instance does not define yet: it cannot be saved until a superadmin creates
+	// it, and takes the new role's id once they have.
+	type EditedRole = { id: string | undefined; name: string | undefined; tenants: string[] }
+	type Edited = { permissioned: boolean; roles: EditedRole[]; defaultRoleId: string }
+
+	let drawerOpen = $state(false)
+	let loading = $state(false)
+	let saving = $state(false)
+	let loadError = $state<string | undefined>(undefined)
+	let info = $state<DatatablePermissions | undefined>(undefined)
+
+	let permissioned = $state(false)
+	let roles = $state<EditedRole[]>([])
+	let defaultRoleId = $state(ADMIN_DATATABLE_ROLE)
+	/** The last loaded state, to detect unsaved changes against. */
+	let saved = $state<Edited>({
+		permissioned: false,
+		roles: [],
+		defaultRoleId: ADMIN_DATATABLE_ROLE
+	})
+
+	// Tenants name principals of the workspace that governs the data table, which is not
+	// necessarily the one we are browsing from.
+	let tenantItems = $state<{ value: string; label: string; group: string }[]>([])
+
+	const editable = $derived(!!info?.editable)
+	const governing = $derived(info?.governing_workspace_id)
+	// The instance catalog, read again after the instance roles drawer changes it.
+	let catalog = $state<InstanceDatatableRole[] | undefined>(undefined)
+	const availableRoles: InstanceDatatableRole[] = $derived(catalog ?? info?.available_roles ?? [])
+	const unusedRoles = $derived(availableRoles.filter((r) => !roles.some((row) => row.id === r.id)))
+	const pendingRoles = $derived(roles.filter((r) => r.id === undefined))
+	let instanceRoles: InstanceRolesButton | undefined = $state(undefined)
+
+	const roleKey = (role: EditedRole) => role.id ?? `pending:${role.name}`
+
+	const hasUnsavedChanges = $derived(
+		!deepEqual($state.snapshot(saved), {
+			permissioned,
+			roles: $state.snapshot(roles) as EditedRole[],
+			defaultRoleId
+		})
+	)
+
+	async function load() {
+		loading = true
+		loadError = undefined
+		try {
+			const res = await WorkspaceService.getDatatablePermissions({
+				workspace,
+				datatableName: datatable
+			})
+			const loaded: EditedRole[] = res.roles
+				.map((r) => ({ id: r.id, name: r.name, tenants: [...(r.tenants ?? [])] }))
+				.sort(
+					(a, b) => Number(b.id === ADMIN_DATATABLE_ROLE) - Number(a.id === ADMIN_DATATABLE_ROLE)
+				)
+			// A data table never put under roles comes back with none; admin is what turning the toggle
+			// on starts from.
+			if (!loaded.some((r) => r.id === ADMIN_DATATABLE_ROLE)) {
+				loaded.unshift({ id: ADMIN_DATATABLE_ROLE, name: ADMIN_DATATABLE_ROLE, tenants: [] })
+			}
+			info = res
+			catalog = undefined
+			permissioned = res.permissioned
+			roles = loaded
+			defaultRoleId = res.default_role
+			saved = structuredClone({ permissioned, roles: loaded, defaultRoleId })
+			await loadTenantItems(res.governing_workspace_id ?? workspace)
+		} catch (e) {
+			loadError = e?.body ?? e?.message ?? String(e)
+		} finally {
+			loading = false
+		}
+	}
+
+	async function loadTenantItems(ws: string) {
+		try {
+			const [users, groups, folders] = await Promise.all([
+				UserService.listUsernames({ workspace: ws }),
+				GroupService.listGroupNames({ workspace: ws }),
+				FolderService.listFolderNames({ workspace: ws })
+			])
+			tenantItems = [
+				{ value: '*', label: 'Everyone', group: 'Anyone in the workspace' },
+				...users.map((u) => ({ value: `u/${u}`, label: u, group: 'Users' })),
+				...groups.map((g) => ({ value: `g/${g}`, label: g, group: 'Groups' })),
+				...folders.map((f) => ({ value: `f/${f}`, label: f, group: 'Folders' }))
+			]
+		} catch {
+			// A fork member may not be able to list the governing workspace's principals. The
+			// tenants they cannot name are still shown, they just cannot pick new ones.
+			tenantItems = []
+		}
+	}
+
+	function addRole(id: string) {
+		const role = availableRoles.find((r) => r.id === id)
+		if (!role) return
+		roles.push({ id: role.id, name: role.name, tenants: [] })
+	}
+
+	/** Adds a role by name: the instance's role of that name, or a pending row for one it does not
+	 * define yet. */
+	function addRoleByName(typed: string) {
+		const name = typed.trim()
+		if (!isDatatableRoleName(name) || name.toLowerCase() === ADMIN_DATATABLE_ROLE) {
+			sendUserToast(
+				`'${name}' cannot be a data table role name: use letters, digits, '_' and '-'`,
+				true
+			)
+			return
+		}
+		if (roles.some((r) => r.name === name)) return
+		const existing = availableRoles.find((r) => r.name === name)
+		roles.push({ id: existing?.id, name, tenants: [] })
+	}
+
+	function removeRole(role: EditedRole) {
+		const key = roleKey(role)
+		roles = roles.filter((r) => roleKey(r) !== key)
+		if (role.id !== undefined && defaultRoleId === role.id) defaultRoleId = ADMIN_DATATABLE_ROLE
+	}
+
+	/** Reads the instance catalog again and gives each pending row the id of the role now defined
+	 * under its name. */
+	async function refreshCatalog() {
+		let fresh: InstanceDatatableRole[]
+		try {
+			fresh = await SettingService.listInstanceDatatableRoles()
+		} catch (e) {
+			sendUserToast(e?.body ?? e?.message ?? String(e), true)
+			return
+		}
+		catalog = fresh
+		for (const row of roles) {
+			if (row.id !== undefined) continue
+			const created = fresh.find((r) => r.name === row.name)
+			if (created) row.id = created.id
+		}
+	}
+
+	async function save() {
+		saving = true
+		try {
+			const msg = await WorkspaceService.setDatatablePermissions({
+				workspace,
+				datatableName: datatable,
+				requestBody: {
+					permissioned,
+					default_role: defaultRoleId,
+					roles: roles.map((r) => ({ id: r.id!, tenants: $state.snapshot(r.tenants) }))
+				}
+			})
+			sendUserToast(msg)
+			await load()
+			onSaved?.()
+		} catch (e) {
+			sendUserToast(e?.body ?? e?.message ?? String(e), true)
+		} finally {
+			saving = false
+		}
+	}
+
+	export function open() {
+		drawerOpen = true
+		load()
+	}
+</script>
+
+{#if !hideTrigger}
+	<Button
+		unifiedSize="sm"
+		variant="default"
+		startIcon={{ icon: KeyRound }}
+		iconOnly
+		{disabled}
+		title={disabled ? 'Save settings first' : 'Roles: who may connect as which Postgres role'}
+		on:click={open}
+	/>
+{/if}
+
+<Drawer bind:open={drawerOpen} size="900px">
+	<DrawerContent
+		title="Roles — {datatable}"
+		on:close={() => (drawerOpen = false)}
+		tooltip="A data table role is a Postgres login. A job that names one connects as it, and Postgres decides what it may touch — grant it privileges under Access. Roles are defined for the whole instance; here you say who may use each one on this data table."
+	>
+		{#snippet titleExtra()}
+			<Badge color="blue" small>Beta</Badge>
+		{/snippet}
+		{#if loadError}
+			<Alert type="error" title="Could not load roles" size="xs">{loadError}</Alert>
+		{:else if loading && !info}
+			<span class="text-sm text-secondary">Loading…</span>
+		{:else}
+			<div class="flex flex-col gap-4">
+				<Toggle
+					bind:checked={permissioned}
+					disabled={!editable || !info?.supported}
+					options={{
+						right: 'Put this data table under roles',
+						rightTooltip:
+							'Off, every job connects as admin — the connection that owns every table. On, every job resolves to a role, and a caller no tenant covers is refused.'
+					}}
+				/>
+
+				{#if !info?.supported}
+					<Alert type="info" title="Not available on this data table" size="xs">
+						A data table role is a Postgres login on the Windmill instance's own database, so only a
+						data table backed by that database can use one. This one is backed by a PostgreSQL
+						resource — grant access on that server directly.
+					</Alert>
+				{:else if info?.clone_of}
+					<Alert type="info" title="Governed by {info.clone_of.workspace_id}" size="xs">
+						This data table is a clone of <span class="font-mono">{info.clone_of.datatable}</span>
+						in workspace <span class="font-mono">{info.clone_of.workspace_id}</span>, so it takes
+						its roles from there. You are evaluated as a member of that workspace.
+					</Alert>
+				{:else if governing}
+					<Alert type="info" title="Governed by {governing}" size="xs">
+						This data table points at the one in workspace <span class="font-mono">{governing}</span
+						>, so its roles are decided there. You are evaluated as a member of that workspace.
+					</Alert>
+				{:else if !editable}
+					<Alert type="info" title="Read only" size="xs">
+						Only admins of this workspace can change who may use which role.
+					</Alert>
+				{/if}
+
+				{#if info?.ungoverned_reachers?.length}
+					<Alert type="warning" title="Other workspaces reach this database" size="xs">
+						These data tables point at the same database with their own entry, so what you set here
+						does not reach them:
+						<ul class="mt-1 list-disc list-inside font-mono">
+							{#each info.ungoverned_reachers as reacher (`${reacher.workspace_id}/${reacher.datatable}`)}
+								<li>{reacher.workspace_id} / {reacher.datatable}</li>
+							{/each}
+						</ul>
+					</Alert>
+				{/if}
+
+				{#if permissioned}
+					{#if editable && availableRoles.length === 0}
+						<Alert type="warning" title="No role defined on this instance" size="xs">
+							Only <span class="font-mono">admin</span> can be used until a superadmin creates a data
+							table role. Type a name below to add one.
+						</Alert>
+					{/if}
+
+					<DataTable>
+						<Head>
+							<tr>
+								<Cell head first>
+									Role
+									<Tooltip>
+										admin is the connection the data table used before roles, so it owns every
+										existing object and cannot be removed. Every other role is a login defined for
+										the whole instance, with only the privileges granted to it under Access.
+									</Tooltip>
+								</Cell>
+								<Cell head>
+									Tenants
+									<Tooltip>
+										Users, groups and folders allowed to connect as this role. Workspace admins can
+										use every role.
+									</Tooltip>
+								</Cell>
+								<Cell head>
+									Default
+									<Tooltip>
+										The role a job gets when it names none — no `-- role` annotation, no `?role=` in
+										the reference. Callers still have to be one of its tenants.
+									</Tooltip>
+								</Cell>
+								<Cell head last />
+							</tr>
+						</Head>
+						<tbody class="divide-y bg-surface-tertiary">
+							{#each roles as role (roleKey(role))}
+								{@const isAdmin = role.id === ADMIN_DATATABLE_ROLE}
+								<Row>
+									<Cell first class="w-56 align-top">
+										<div class="flex flex-col gap-0.5 pt-1.5">
+											<span class="font-mono text-xs text-emphasis">{role.name ?? role.id}</span>
+											{#if !role.name}
+												<span class="text-2xs text-secondary italic">
+													no longer defined on this instance
+												</span>
+											{:else if role.id === undefined}
+												<Alert type="warning" title="This role does not exist yet" size="xs">
+													{#if $superadmin}
+														<div class="flex flex-col items-start gap-1">
+															<span>Create it on the instance to use it here.</span>
+															<Button
+																unifiedSize="xs"
+																variant="default"
+																on:click={() => instanceRoles?.open(role.name)}
+															>
+																Create it
+															</Button>
+														</div>
+													{:else}
+														Only a superadmin can create it on the instance.
+													{/if}
+												</Alert>
+											{/if}
+										</div>
+									</Cell>
+									<Cell class="align-top">
+										<MultiSelect
+											items={tenantItems}
+											bind:value={role.tenants}
+											groupBy={(item) => item.group}
+											disabled={!editable}
+											placeholder="Nobody — add users, groups or folders"
+										/>
+									</Cell>
+									<Cell class="w-20 align-top">
+										<div class="flex justify-center pt-2">
+											<Checkbox
+												checked={role.id !== undefined && defaultRoleId === role.id}
+												disabled={!editable || role.id === undefined}
+												title="Use this role when a job names none"
+												onChange={() => {
+													if (role.id !== undefined) defaultRoleId = role.id
+												}}
+											/>
+										</div>
+									</Cell>
+									<Cell last class="w-10 align-top">
+										{#if editable && !isAdmin}
+											<CloseButton small on:close={() => removeRole(role)} />
+										{/if}
+									</Cell>
+								</Row>
+							{/each}
+							{#if editable}
+								<Row class="!border-0">
+									<Cell colspan={4} class="pt-2 pb-2">
+										<div class="flex justify-center">
+											<Select
+												items={unusedRoles.map((r) => ({
+													value: r.id,
+													label: r.enabled ? r.name : `${r.name} (disabled)`
+												}))}
+												placeholder="+ Add a role"
+												bind:value={
+													() => undefined,
+													(id) => {
+														if (id) addRole(id)
+													}
+												}
+												onCreateItem={addRoleByName}
+												class="w-64"
+											/>
+										</div>
+									</Cell>
+								</Row>
+							{/if}
+						</tbody>
+					</DataTable>
+				{/if}
+			</div>
+
+			{#if info?.supported && !hasUnsavedChanges}
+				<div class="mt-6 pt-6 border-t">
+					<PgAclEditor {workspace} {datatable} target={{ kind: 'database' }} />
+				</div>
+			{/if}
+		{/if}
+
+		{#snippet actions()}
+			{#if editable}
+				<Button
+					variant="accent"
+					unifiedSize="md"
+					disabled={!hasUnsavedChanges || loading || !!loadError || pendingRoles.length > 0}
+					title={pendingRoles.length > 0
+						? 'Create the roles that do not exist yet, or remove them'
+						: undefined}
+					loading={saving}
+					on:click={save}
+				>
+					Save
+				</Button>
+			{/if}
+		{/snippet}
+	</DrawerContent>
+</Drawer>
+
+{#if $superadmin}
+	<InstanceRolesButton bind:this={instanceRoles} hideTrigger onChanged={refreshCatalog} />
+{/if}
diff --git a/frontend/src/lib/components/workspaceSettings/DataTableRolesSection.svelte b/frontend/src/lib/components/workspaceSettings/DataTableRolesSection.svelte
new file mode 100644
index 0000000000..b863dac06b
--- /dev/null
+++ b/frontend/src/lib/components/workspaceSettings/DataTableRolesSection.svelte
@@ -0,0 +1,211 @@
+<script lang="ts">
+	import { Alert, Badge, Button } from '../common'
+	import CloseButton from '../common/CloseButton.svelte'
+	import TextInput from '../text_input/TextInput.svelte'
+	import Toggle from '../Toggle.svelte'
+	import ConfirmationModal from '../common/confirmationModal/ConfirmationModal.svelte'
+	import { createAsyncConfirmationModal } from '../common/confirmationModal/asyncConfirmationModal.svelte'
+	import Cell from '../table/Cell.svelte'
+	import DataTable from '../table/DataTable.svelte'
+	import Head from '../table/Head.svelte'
+	import Row from '../table/Row.svelte'
+	import { Pencil, Plus } from 'lucide-svelte'
+	import { SettingService, type InstanceDatatableRole } from '$lib/gen'
+	import { sendUserToast } from '$lib/toast'
+
+	let {
+		initialName = '',
+		onChanged
+	}: {
+		/** Prefills the name of the role to add. */
+		initialName?: string
+		/** Called after every change to the catalog, whether or not it went through. */
+		onChanged?: () => void
+	} = $props()
+
+	let roles = $state<InstanceDatatableRole[]>([])
+	let loading = $state(true)
+	let loadError = $state<string | undefined>(undefined)
+	let busy = $state(false)
+	// svelte-ignore state_referenced_locally
+	let newName = $state(initialName)
+	/** Which role's name is being edited, and to what. */
+	let renaming = $state<{ id: string; name: string } | undefined>(undefined)
+
+	const confirmationModal = createAsyncConfirmationModal()
+
+	async function load() {
+		loading = true
+		loadError = undefined
+		try {
+			roles = await SettingService.listInstanceDatatableRoles()
+		} catch (e) {
+			loadError = e?.body ?? e?.message ?? String(e)
+		} finally {
+			loading = false
+		}
+	}
+	load()
+
+	async function run(fn: () => Promise<unknown>, success: string) {
+		busy = true
+		try {
+			await fn()
+			sendUserToast(success)
+		} catch (e) {
+			sendUserToast(e?.body ?? e?.message ?? String(e), true)
+		} finally {
+			// Reloaded whether or not it worked: the login toggle is driven by what the server
+			// holds, so a failed flip has to snap back rather than sit there claiming it landed.
+			await load()
+			busy = false
+			onChanged?.()
+		}
+	}
+
+	async function create() {
+		const name = newName.trim()
+		if (!name) return
+		await run(
+			() =>
+				SettingService.createInstanceDatatableRole({
+					requestBody: { name }
+				}),
+			`Created the data table role ${name}`
+		)
+		newName = ''
+	}
+
+	async function remove(role: InstanceDatatableRole) {
+		const confirmed = await confirmationModal.ask({
+			title: `Delete the role ${role.name}?`,
+			children:
+				'Everything it owns in every instance database is handed back to the admin connection, its grants are dropped, and it is removed from every data table that named it. This cannot be undone.',
+			confirmationText: 'Delete role'
+		})
+		if (!confirmed) return
+		await run(
+			() => SettingService.deleteInstanceDatatableRole({ id: role.id }),
+			`Deleted the data table role ${role.name}`
+		)
+	}
+</script>
+
+<ConfirmationModal {...confirmationModal.props} />
+
+<div class="flex flex-col gap-2">
+	{#if loadError}
+		<Alert type="error" title="Could not load the instance roles" size="xs">{loadError}</Alert>
+	{:else}
+		<DataTable>
+			<Head>
+				<tr>
+					<Cell head first>Name</Cell>
+					<Cell head>Login</Cell>
+					<Cell head last></Cell>
+				</tr>
+			</Head>
+			<tbody class="divide-y bg-surface-tertiary">
+				{#if loading}
+					<Row>
+						<Cell colspan={3} class="text-center py-4 text-secondary text-xs">Loading…</Cell>
+					</Row>
+				{:else if roles.length === 0}
+					<Row>
+						<Cell colspan={3} class="text-center py-4 text-secondary text-xs">
+							No data table role yet. Every job connects as
+							<span class="font-mono">admin</span>.
+						</Cell>
+					</Row>
+				{/if}
+				{#each roles as role (role.id)}
+					<Row>
+						<Cell first class="w-64">
+							{#if renaming?.id === role.id}
+								<div class="flex gap-1 items-center">
+									<TextInput bind:value={renaming.name} inputProps={{ placeholder: 'Name' }} />
+									<Button
+										unifiedSize="xs"
+										variant="accent"
+										disabled={busy}
+										on:click={async () => {
+											const name = renaming?.name?.trim()
+											renaming = undefined
+											if (name && name !== role.name) {
+												await run(
+													() =>
+														SettingService.updateInstanceDatatableRole({
+															id: role.id,
+															requestBody: { name }
+														}),
+													`Renamed the data table role to ${name}`
+												)
+											}
+										}}
+									>
+										Rename
+									</Button>
+									<CloseButton small on:close={() => (renaming = undefined)} />
+								</div>
+							{:else}
+								<div class="flex items-center gap-1">
+									<span class="font-mono text-sm">{role.name}</span>
+									<Button
+										unifiedSize="2xs"
+										variant="subtle"
+										startIcon={{ icon: Pencil }}
+										iconOnly
+										title="Rename this role"
+										on:click={() => (renaming = { id: role.id, name: role.name })}
+									/>
+								</div>
+							{/if}
+						</Cell>
+						<Cell>
+							<div class="flex items-center gap-2">
+								<Toggle
+									checked={role.enabled}
+									disabled={busy}
+									on:change={(e) =>
+										run(
+											() =>
+												SettingService.updateInstanceDatatableRole({
+													id: role.id,
+													requestBody: { enabled: e.detail }
+												}),
+											e.detail ? `Enabled ${role.name}` : `Disabled ${role.name}`
+										)}
+								/>
+								{#if !role.enabled}
+									<Badge color="gray">Cannot log in</Badge>
+								{/if}
+							</div>
+						</Cell>
+						<Cell last class="w-12">
+							<CloseButton small on:close={() => remove(role)} />
+						</Cell>
+					</Row>
+				{/each}
+				<Row class="!border-0">
+					<Cell colspan={3} class="pt-0 pb-2">
+						<div class="flex gap-2 items-center">
+							<TextInput
+								bind:value={newName}
+								inputProps={{ placeholder: 'analytics', id: 'new-datatable-role' }}
+							/>
+							<Button
+								unifiedSize="sm"
+								variant="default"
+								startIcon={{ icon: Plus }}
+								disabled={busy || !newName.trim()}
+								on:click={create}
+							>
+								Add role
+							</Button>
+						</div>
+					</Cell>
+				</Row>
+			</tbody>
+		</DataTable>
+	{/if}
+</div>
diff --git a/frontend/src/lib/components/workspaceSettings/DataTableSettings.svelte b/frontend/src/lib/components/workspaceSettings/DataTableSettings.svelte
index bb97e434f6..ebc4bd8a7f 100644
--- a/frontend/src/lib/components/workspaceSettings/DataTableSettings.svelte
+++ b/frontend/src/lib/components/workspaceSettings/DataTableSettings.svelte
@@ -12,6 +12,10 @@
 				resource_type: 'postgresql' | 'instance'
 				resource_path?: string | undefined
 			}
+			/** Set on a fork's entry: it names the workspace whose data table governs this one, and
+			 * owns no database of its own. Read-only here — only forking writes it, and the server
+			 * carries it across a save rather than taking it from this form. */
+			reference?: { workspace_id: string; datatable: string }
 		}[]
 	}
 
@@ -24,7 +28,10 @@
 				s.dataTables.push({
 					id: randomUUID(),
 					name,
-					...rest
+					...rest,
+					// A pointer entry owns no database. The row renders read-only in that case, so this
+					// placeholder is never shown or sent.
+					database: rest.database ?? { resource_type: 'instance' }
 				})
 			}
 		}
@@ -38,6 +45,12 @@
 			const database = dataTable.database
 			if (dataTable.name in s.datatables)
 				throw 'Settings contain duplicate dataTable name: ' + dataTable.name
+			// A pointer owns no database, so it has nothing to validate and nothing to send: the
+			// server keeps the stored reference whatever this payload says.
+			if (dataTable.reference) {
+				s.datatables[dataTable.name] = {}
+				continue
+			}
 			if (!database.resource_path) throw 'No resource selected for ' + dataTable.name
 			if (database.resource_type === 'instance' && database.resource_path === 'windmill')
 				throw dataTable.name + ' database cannot be called "windmill"'
@@ -51,12 +64,11 @@
 </script>
 
 <script lang="ts">
-	import { Plus, PlugZap } from 'lucide-svelte'
+	import { History, KeyRound, Plus, PlugZap, Trash2 } from 'lucide-svelte'
+	import DropdownV2 from '../DropdownV2.svelte'
 
 	import Button from '../common/button/Button.svelte'
 
-	import CloseButton from '../common/CloseButton.svelte'
-
 	import ResourcePicker from '../ResourcePicker.svelte'
 	import SettingsPageHeader from '../settings/SettingsPageHeader.svelte'
 	import Select from '../select/Select.svelte'
@@ -79,7 +91,7 @@
 		type GetSettingsResponse,
 		type TestDataTableConnectionResponse
 	} from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
+	import { enterpriseLicense, superadmin, workspaceStore } from '$lib/stores'
 	import { createAsyncConfirmationModal } from '../common/confirmationModal/asyncConfirmationModal.svelte'
 	import ConfirmationModal from '../common/confirmationModal/ConfirmationModal.svelte'
 	import { resource } from 'runed'
@@ -87,8 +99,10 @@
 	import { Popover } from '../meltComponents'
 	import ExploreAssetButton from '../ExploreAssetButton.svelte'
 	import DataTableMigrationsButton from './DataTableMigrationsButton.svelte'
+	import DataTablePermissionsButton from './DataTablePermissionsButton.svelte'
+	import InstanceRolesButton from './InstanceRolesButton.svelte'
 	import { deepEqual } from 'fast-equals'
-	import { clone } from '$lib/utils'
+	import { clone, onlyAlphaNumAndUnderscore } from '$lib/utils'
 	import SettingsFooter from './SettingsFooter.svelte'
 	import Alert from '../common/alert/Alert.svelte'
 	import MissingWorkerTagAlert from '../jobs/MissingWorkerTagAlert.svelte'
@@ -208,12 +222,28 @@
 			const deleted_datatables = dataTableSettings.dataTables
 				.filter((d) => !tempIds.has(d.id))
 				.map((d) => d.name)
-			await WorkspaceService.editDataTableConfig({
+			const result = await WorkspaceService.editDataTableConfig({
 				workspace: $workspaceStore!,
 				requestBody: { settings, renames, deleted_datatables }
 			})
 			dataTableSettings = clone(tempSettings)
-			sendUserToast('Data table settings saved successfully')
+			// A delete can leave another workspace's data table governed by nothing. Swallowing
+			// that is what made it silent for the person who caused it.
+			const stranded = result?.stranded_references ?? []
+			if (stranded.length > 0) {
+				sendUserToast(
+					`These data tables were governed by one you deleted and no longer resolve: ${stranded
+						.map((s) => `${s.workspace_id}/${s.datatable}`)
+						.join(', ')}. Their databases still exist; a superadmin can point them at another ` +
+						`workspace's data table.`,
+					'warning',
+					[],
+					undefined,
+					20000
+				)
+			} else {
+				sendUserToast('Data table settings saved successfully')
+			}
 		} catch (e) {
 			sendUserToast(e, true)
 			console.error('Error saving data table settings', e)
@@ -253,6 +283,9 @@
 	}
 
 	let confirmationModal = createAsyncConfirmationModal()
+	// Each mounts its own modal or drawer; the row menu opens them.
+	let migrationsButtons = $state<Record<string, DataTableMigrationsButton | undefined>>({})
+	let permissionsButtons = $state<Record<string, DataTablePermissionsButton | undefined>>({})
 	let dirtyMap = $derived.by(() => {
 		const map: Record<string, boolean> = {}
 		for (let i = 0; i < tempSettings.dataTables.length; i++) {
@@ -284,7 +317,13 @@
 	title="Data tables"
 	description="Relational storage the whole workspace shares under one name. Scripts, flows and apps address it as <span class='font-mono'>datatable://main</span> instead of picking a PostgreSQL resource, so nobody needs access to the credentials to query it, and you can point that name at another database without touching a line of code. Browse and edit tables, and version schema changes as migrations, from here."
 	link="https://www.windmill.dev/docs/core_concepts/persistent_storage/data_tables"
-/>
+>
+	{#snippet actions()}
+		{#if $superadmin && $enterpriseLicense && !isCloudHosted()}
+			<InstanceRolesButton />
+		{/if}
+	{/snippet}
+</SettingsPageHeader>
 
 {#if isCloudHosted()}
 	<Alert type="info" title="Instance database not available on cloud" class="mb-4" size="xs">
@@ -350,71 +389,103 @@
 		{#each tempSettings.dataTables as dataTable, dataTableIndex (dataTable.id)}
 			<Row>
 				<Cell first class="w-48 relative">
-					<TextInput bind:value={dataTable.name} inputProps={{ placeholder: 'Name', id: 'name' }} />
+					{#if dataTable.reference}
+						<span class="font-mono text-sm">{dataTable.name}</span>
+					{:else}
+						<TextInput
+							bind:value={dataTable.name}
+							inputProps={{ placeholder: 'Name', id: 'name' }}
+						/>
+					{/if}
 				</Cell>
 				<Cell>
-					<div class="flex gap-2">
-						<div class="relative">
-							{#if dataTable.database.resource_type === 'instance'}
-								<Tooltip wrapperClass="absolute mt-[0.6rem] right-2 z-20" placement="bottom-start">
-									Use Windmill's PostgreSQL instance
-								</Tooltip>
-							{/if}
-							<Select
-								items={[
-									{ value: 'postgresql', label: 'PostgreSQL' },
-									{
-										value: 'instance',
-										label: 'Instance',
-										disabled: isCloudHosted(),
-										subtitle: $isCustomInstanceDbEnabled
-											? undefined
-											: isCloudHosted()
-												? 'Not available on cloud'
-												: 'Superadmin only'
-									}
-								]}
-								bind:value={
-									() => dataTable.database.resource_type,
-									(resource_type) => {
-										dataTable.database = {
-											resource_type,
-											resource_path:
-												resource_type === 'instance' ? defaultInstanceDbName() : undefined
+					{#if dataTable.reference}
+						<div class="flex items-center gap-1 text-sm text-secondary">
+							<span>Governed by</span>
+							<span class="font-mono">{dataTable.reference.workspace_id}</span>
+							<span>/</span>
+							<span class="font-mono">{dataTable.reference.datatable}</span>
+							<Tooltip>
+								This fork uses its parent's data table rather than a copy of it, so the database and
+								its roles are decided in that workspace.
+							</Tooltip>
+						</div>
+					{:else}
+						<div class="flex gap-2">
+							<div class="relative">
+								{#if dataTable.database.resource_type === 'instance'}
+									<Tooltip
+										wrapperClass="absolute mt-[0.6rem] right-2 z-20"
+										placement="bottom-start"
+									>
+										Use Windmill's PostgreSQL instance
+									</Tooltip>
+								{/if}
+								<Select
+									items={[
+										{ value: 'postgresql', label: 'PostgreSQL' },
+										{
+											value: 'instance',
+											label: 'Instance',
+											disabled: isCloudHosted(),
+											subtitle: $isCustomInstanceDbEnabled
+												? undefined
+												: isCloudHosted()
+													? 'Not available on cloud'
+													: 'Superadmin only'
+										}
+									]}
+									bind:value={
+										() => dataTable.database.resource_type,
+										(resource_type) => {
+											dataTable.database = {
+												resource_type,
+												resource_path:
+													resource_type === 'instance' ? defaultInstanceDbName() : undefined
+											}
 										}
 									}
-								}
-								id="database-type-select"
-								class="w-28"
-							/>
-						</div>
-						<div class="flex items-center gap-1 w-80 relative">
-							{#if dataTable.database.resource_type !== 'instance'}
-								<ResourcePicker
-									class="flex-1"
-									bind:value={dataTable.database.resource_path}
-									resourceType={dataTable.database.resource_type}
+									id="database-type-select"
+									class="w-28"
 								/>
-							{:else}
-								<CustomInstanceDbSelect
-									class="flex-1"
-									{confirmationModal}
-									{customInstanceDbs}
-									bind:value={dataTable.database.resource_path}
-									tag="datatable"
-								/>
-							{/if}
+							</div>
+							<div class="flex items-center gap-1 w-80 relative">
+								{#if dataTable.database.resource_type !== 'instance'}
+									<ResourcePicker
+										class="flex-1"
+										bind:value={dataTable.database.resource_path}
+										resourceType={dataTable.database.resource_type}
+									/>
+								{:else}
+									<CustomInstanceDbSelect
+										class="flex-1"
+										{confirmationModal}
+										{customInstanceDbs}
+										bind:value={dataTable.database.resource_path}
+										tag="datatable"
+									/>
+								{/if}
+							</div>
 						</div>
-					</div>
+					{/if}
 				</Cell>
 
 				<Cell class="whitespace-nowrap">
 					<div class="flex gap-2">
 						<DataTableMigrationsButton
+							bind:this={migrationsButtons[dataTable.name]}
+							hideTrigger
 							workspace={$workspaceStore ?? ''}
 							datatable={dataTable.name}
-							disabled={!!dirtyMap[dataTable.name]}
 						/>
+						{#if $enterpriseLicense && !isCloudHosted()}
+							<DataTablePermissionsButton
+								bind:this={permissionsButtons[dataTable.name]}
+								hideTrigger
+								workspace={$workspaceStore ?? ''}
+								datatable={dataTable.name}
+							/>
+						{/if}
 						<Button
 							size="xs"
 							color="light"
@@ -448,7 +519,41 @@
 					</div>
 				</Cell>
 				<Cell class="w-12">
-					<CloseButton small on:close={() => removeDataTable(dataTableIndex)} />
+					<DropdownV2
+						items={() => [
+							{
+								displayName: 'Migrations',
+								icon: History,
+								// Both act on the saved data table, which unsaved edits are not.
+								disabled: !!dirtyMap[dataTable.name],
+								tooltip: dirtyMap[dataTable.name] ? 'Save the settings first' : undefined,
+								action: () => migrationsButtons[dataTable.name]?.open()
+							},
+							...($enterpriseLicense && !isCloudHosted()
+								? [
+										{
+											displayName: 'Roles',
+											icon: KeyRound,
+											disabled: !!dirtyMap[dataTable.name],
+											tooltip: dirtyMap[dataTable.name] ? 'Save the settings first' : undefined,
+											action: () => permissionsButtons[dataTable.name]?.open()
+										}
+									]
+								: []),
+							// A fork's pointer entry is written by forking and kept by the server, not this form.
+							...(dataTable.reference
+								? []
+								: [
+										{
+											displayName: 'Remove',
+											icon: Trash2,
+											type: 'delete' as const,
+											action: () => removeDataTable(dataTableIndex)
+										}
+									])
+						]}
+						btnId={'datatable-settings-actions-' + onlyAlphaNumAndUnderscore(dataTable.name)}
+					/>
 				</Cell>
 			</Row>
 		{/each}
diff --git a/frontend/src/lib/components/workspaceSettings/FilterList.svelte b/frontend/src/lib/components/workspaceSettings/FilterList.svelte
index fccc59681d..599015aa49 100644
--- a/frontend/src/lib/components/workspaceSettings/FilterList.svelte
+++ b/frontend/src/lib/components/workspaceSettings/FilterList.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
-	import { Plus, X } from 'lucide-svelte'
+	import MultiSelect from '../select/MultiSelect.svelte'
+	import { safeSelectItems } from '../select/utils.svelte'
 
 	let {
 		title = '',
@@ -8,20 +9,12 @@
 		placeholder = 'Add filter (e.g. f/**)'
 	} = $props()
 
-	let newItem = $state('')
-	let inputRef: HTMLInputElement | null = $state(null)
+	let multiSelect = $state<MultiSelect<{ label?: string; value: any }> | undefined>(undefined)
+	const searchText = $derived(multiSelect?.getFilteredInputText())
 
-	function addItem() {
-		const value = newItem.trim()
-		if (value && !items.includes(value)) {
-			items = [...items, value]
-			newItem = ''
-			inputRef?.focus()
-		}
-	}
-
-	function removeItem(idx: number) {
-		items = items.filter((_, i) => i !== idx)
+	function addItem(filter: string) {
+		const value = filter.trim()
+		if (value && !items.includes(value)) items = [...items, value]
 	}
 </script>
 
@@ -33,34 +26,14 @@
 		{/if}
 	</div>
 
-	<div class="flex flex-wrap gap-2 items-center mb-1">
-		{#each items as item, idx (item)}
-			<span class="flex items-center bg-gray-100 rounded-full px-3 py-1 text-xs text-gray-700">
-				{item}
-				<button
-					class="ml-2 text-gray-400 hover:text-red-500 focus:outline-none"
-					onclick={() => removeItem(idx)}
-					aria-label="Remove filter"
-				>
-					<X size={14} />
-				</button>
-			</span>
-		{/each}
-
-		<input
-			bind:this={inputRef}
-			class="border border-gray-300 rounded-full px-3 py-1 text-xs focus:outline-none focus:ring-2 focus:ring-primary"
-			{placeholder}
-			value={newItem}
-			oninput={(e) => (newItem = e.currentTarget.value)}
-			onkeydown={(e) => e.key === 'Enter' && (addItem(), e.preventDefault())}
-		/>
-		<button
-			class="ml-1 text-primary hover:bg-primary/10 rounded-full p-1"
-			onclick={addItem}
-			aria-label="Add filter"
-		>
-			<Plus size={14} />
-		</button>
-	</div>
+	<MultiSelect
+		bind:this={multiSelect}
+		items={safeSelectItems(items)}
+		bind:value={items}
+		{placeholder}
+		searchPlaceholder={placeholder}
+		noItemsMsg="Type a path to add it as a filter"
+		onCreateItem={addItem}
+		createText={searchText ? `Add filter: ${searchText}` : 'Add filter'}
+	/>
 </div>
diff --git a/frontend/src/lib/components/workspaceSettings/ForkDatatableSection.svelte b/frontend/src/lib/components/workspaceSettings/ForkDatatableSection.svelte
index c060c1d1ed..9627e4a026 100644
--- a/frontend/src/lib/components/workspaceSettings/ForkDatatableSection.svelte
+++ b/frontend/src/lib/components/workspaceSettings/ForkDatatableSection.svelte
@@ -1,33 +1,21 @@
 <script module lang="ts">
-	export type ForkStep = {
-		label: string
-		status: 'pending' | 'running' | 'done' | 'error'
-		error?: string
-	}
-
 	export type DatatableCloneJob = {
 		name: string
 		resourceType: string
 		behavior: 'schema_only' | 'schema_and_data'
-		steps: ForkStep[]
 		_newDbName: string
-		_isInstance: boolean
-		_sourceWorkspace: string
-		_targetWorkspace: string
-		_resourcePath: string
 	}
 </script>
 
 <script lang="ts">
 	import { WorkspaceService } from '$lib/gen'
-	import { workspaceStore, userStore } from '$lib/stores'
+	import { workspaceStore, userStore, enterpriseLicense } from '$lib/stores'
 	import { isCloudHosted } from '$lib/cloud'
 	import { resource } from 'runed'
 	import Select from '../select/Select.svelte'
 	import Label from '../Label.svelte'
 	import Alert from '../common/alert/Alert.svelte'
 	import ConfirmationModal from '../common/confirmationModal/ConfirmationModal.svelte'
-	import { Check, X, Loader2 } from 'lucide-svelte'
 
 	interface Props {
 		// Workspace whose datatables are cloned into the fork (the fork's base). Falls back to the
@@ -52,111 +40,46 @@
 	let cloneModalOpen = $state(false)
 	let currentCloneJob: DatatableCloneJob | undefined = $state(undefined)
 	let cloneQueue: DatatableCloneJob[] = $state([])
-	let cloneRunning = $state(false)
 
 	export function hasDatatables(): boolean {
 		return (allDatatables.current?.length ?? 0) > 0
 	}
 
 	export function buildCloneQueue(targetWorkspaceId: string): DatatableCloneJob[] {
+		// A fork attempt starts here: what an earlier attempt confirmed is not this one's to send.
+		confirmedJobs = []
 		return (allDatatables.current ?? [])
 			.filter((dt) => {
 				const behavior = datatableBehaviors[dt.name] ?? 'keep_original'
 				return behavior !== 'keep_original'
 			})
-			.map((dt) => {
-				const behavior = datatableBehaviors[dt.name] as 'schema_only' | 'schema_and_data'
-				const isInstance = dt.resource_type === 'instance'
-				const newDbName = `${targetWorkspaceId.replace(/-/g, '_')}__${dt.name}`
-
-				const steps: ForkStep[] = [
-					{
-						label: `CREATE DATABASE "${newDbName}"`,
-						status: 'pending'
-					},
-					{
-						label: `pg_dump → pg_import (${behavior === 'schema_only' ? 'schema only' : 'schema + data'})`,
-						status: 'pending'
-					}
-				]
-
-				return {
-					name: dt.name,
-					resourceType: dt.resource_type,
-					behavior,
-					steps,
-					_newDbName: newDbName,
-					_isInstance: isInstance,
-					_sourceWorkspace: effectiveSource!,
-					_targetWorkspace: targetWorkspaceId,
-					_resourcePath: dt.resource_path
-				}
-			})
+			.map((dt) => ({
+				name: dt.name,
+				resourceType: dt.resource_type,
+				behavior: datatableBehaviors[dt.name] as 'schema_only' | 'schema_and_data',
+				// A dev workspace's id has no `wm-fork-` prefix; its copies are named like a fork's
+				_newDbName: `wm_fork_${targetWorkspaceId.replace(/^wm-fork-/, '').replace(/-/g, '_')}__${dt.name}`
+			}))
 	}
 
-	let completedJobs: DatatableCloneJob[] = $state([])
+	let confirmedJobs: DatatableCloneJob[] = $state([])
 
+	// Each clone is only confirmed here: the fork request makes the copies, and drops them if the
+	// fork is not created.
 	export function startCloning(queue: DatatableCloneJob[]) {
-		completedJobs = []
+		confirmedJobs = []
 		cloneQueue = queue
 		currentCloneJob = cloneQueue[0]
 		cloneModalOpen = true
 	}
 
-	export function getCompletedCloneJobs(): DatatableCloneJob[] {
-		return completedJobs
-	}
-
-	async function executeCloneJob(job: DatatableCloneJob) {
-		cloneRunning = true
-		let stepIdx = 0
-
-		// Step 1: Create the database
-		job.steps[stepIdx].status = 'running'
-		try {
-			await WorkspaceService.createPgDatabase({
-				workspace: job._sourceWorkspace,
-				requestBody: {
-					source: `datatable://${job.name}`,
-					target_dbname: job._newDbName
-				}
-			})
-			job.steps[stepIdx].status = 'done'
-		} catch (e: any) {
-			job.steps[stepIdx].status = 'error'
-			job.steps[stepIdx].error = e?.body ?? e?.message ?? String(e)
-			cloneRunning = false
-			return
-		}
-		stepIdx++
-
-		// Step 2: Import data
-		job.steps[stepIdx].status = 'running'
-		try {
-			await WorkspaceService.importPgDatabase({
-				workspace: job._sourceWorkspace,
-				requestBody: {
-					source: `datatable://${job.name}`,
-					target: `datatable://${job.name}`,
-					target_dbname_override: job._newDbName,
-					fork_behavior: job.behavior
-				}
-			})
-			job.steps[stepIdx].status = 'done'
-		} catch (e: any) {
-			job.steps[stepIdx].status = 'error'
-			job.steps[stepIdx].error = e?.body ?? e?.message ?? String(e)
-			cloneRunning = false
-			return
-		}
-		stepIdx++
-
-		cloneRunning = false
+	export function getConfirmedCloneJobs(): DatatableCloneJob[] {
+		return confirmedJobs
 	}
 
 	function advanceCloneQueue() {
 		if (currentCloneJob) {
-			completedJobs.push(currentCloneJob)
+			confirmedJobs.push(currentCloneJob)
 		}
 		const idx = cloneQueue.indexOf(currentCloneJob!)
 		if (idx < cloneQueue.length - 1) {
@@ -189,11 +112,20 @@
 							(v) => (datatableBehaviors[dt.name] = v)
 						}
 						items={[
-							{ value: 'keep_original', label: 'Keep original' },
-							{ value: 'schema_only', label: 'Clone schema only' },
-							...(!isCloudHosted() && $userStore?.is_admin
-								? [{ value: 'schema_and_data', label: 'Clone schema and data' }]
-								: [])
+							{
+								value: 'keep_original',
+								label: dt.permissioned ? 'Keep original (under roles)' : 'Keep original'
+							},
+							// A copy of a data table under roles carries the source's owners and grants,
+							// which only the Enterprise Edition replays: elsewhere the server refuses it.
+							...(dt.permissioned && !$enterpriseLicense
+								? []
+								: [
+										{ value: 'schema_only', label: 'Clone schema only' },
+										...(!isCloudHosted() && $userStore?.is_admin
+											? [{ value: 'schema_and_data', label: 'Clone schema and data' }]
+											: [])
+									])
 						]}
 					/>
 				</div>
@@ -205,13 +137,9 @@
 {#if cloneModalOpen && currentCloneJob}
 	<ConfirmationModal
 		title="Clone datatable: {currentCloneJob.name}"
-		confirmationText={cloneRunning ? 'Running...' : 'Start'}
+		confirmationText="Confirm"
 		open={cloneModalOpen}
-		loading={cloneRunning}
-		onConfirmed={async () => {
-			await executeCloneJob(currentCloneJob!)
-			advanceCloneQueue()
-		}}
+		onConfirmed={advanceCloneQueue}
 		onCanceled={() => {
 			cloneModalOpen = false
 			currentCloneJob = undefined
@@ -233,39 +161,16 @@
 
 		{#if currentCloneJob.resourceType === 'instance'}
 			<p class="text-xs text-secondary mt-2">
-				This will run <code
-					>CREATE DATABASE {currentCloneJob.steps[0]?.label.match(/"([^"]+)"/)?.[1] ?? ''}</code
-				> on the Windmill PostgreSQL instance.
+				Creating the fork will run <code>CREATE DATABASE {currentCloneJob._newDbName}</code> on the Windmill
+				PostgreSQL instance. A data table under roles keeps its owners and grants in the copy, and its
+				roles stay decided where they are decided today.
 			</p>
 		{:else}
 			<p class="text-xs text-secondary mt-2">
-				This will run <code>CREATE DATABASE</code> on the resource's PostgreSQL server.
+				Creating the fork will run <code>CREATE DATABASE {currentCloneJob._newDbName}</code> on the resource's
+				PostgreSQL server.
 			</p>
 		{/if}
-
-		<div class="mt-4 flex flex-col gap-2">
-			{#each currentCloneJob.steps as step}
-				<div class="flex items-center gap-2 text-xs">
-					{#if step.status === 'done'}
-						<Check class="w-4 h-4 shrink-0 text-green-500" />
-					{:else if step.status === 'running'}
-						<Loader2 class="w-4 h-4 shrink-0 animate-spin text-blue-500" />
-					{:else if step.status === 'error'}
-						<X class="w-4 h-4 shrink-0 text-red-500" />
-					{:else}
-						<div class="w-4 h-4 shrink-0 rounded-full border border-gray-300"></div>
-					{/if}
-					<span
-						class:text-tertiary={step.status === 'pending'}
-						class:font-medium={step.status === 'running'}
-					>
-						{step.label}
-					</span>
-				</div>
-				{#if step.error}
-					<p class="text-2xs text-red-500 ml-6">{step.error}</p>
-				{/if}
-			{/each}
-		</div>
+		<p class="text-xs text-secondary mt-2"> If the fork cannot be created, the copy is dropped. </p>
 	</ConfirmationModal>
 {/if}
diff --git a/frontend/src/lib/components/workspaceSettings/GitSyncFilterSettings.svelte b/frontend/src/lib/components/workspaceSettings/GitSyncFilterSettings.svelte
index dcbef04a51..87409a8134 100644
--- a/frontend/src/lib/components/workspaceSettings/GitSyncFilterSettings.svelte
+++ b/frontend/src/lib/components/workspaceSettings/GitSyncFilterSettings.svelte
@@ -1,13 +1,10 @@
 <script lang="ts">
 	import Toggle from '$lib/components/Toggle.svelte'
-	import { Filter, ChevronDown } from 'lucide-svelte'
 	import Tooltip from '$lib/components/Tooltip.svelte'
 	import FilterList from './FilterList.svelte'
-	import { Tabs, Tab, Button, Section } from '$lib/components/common'
+	import { Tabs, Tab, Section } from '$lib/components/common'
 	import type { GitSyncObjectType } from '$lib/gen'
 	import { workspaceStore } from '$lib/stores'
-	import { twMerge } from 'tailwind-merge'
-	import { slide } from 'svelte/transition'
 
 	type GitSyncTypeMap = {
 		scripts: boolean
@@ -46,12 +43,11 @@
 		isInitialSetup = false,
 		requiresMigration = false,
 		actions = undefined,
-		useIndividualBranch = false
+		useIndividualBranch = false,
+		title = 'Filter settings',
+		subtitle = undefined
 	} = $props()
 
-	// Component state
-	let collapsed = $state(false)
-
 	// Determine if component should be editable or read-only
 	const isEditable = $derived(isInitialSetup || requiresMigration)
 
@@ -123,12 +119,10 @@
 	}
 </script>
 
-<div class="rounded-lg shadow-sm border p-0 w-full">
-	<!-- Card Header -->
-	<div class="flex items-center justify-between min-h-10 px-4 py-1 border-b">
+<div class="w-full">
+	<div class="flex flex-col gap-0.5">
 		<div class="flex items-center gap-2">
-			<Filter size={14} class="text-primary" />
-			<span class="font-semibold text-xs text-emphasis">Git Sync filter settings</span>
+			<h4 class="font-semibold text-sm text-emphasis">{title}</h4>
 			{#if isLegacyRepo}
 				<Tooltip>
 					This repository uses legacy configuration format and inherits settings from
@@ -142,22 +136,14 @@
 				</Tooltip>
 			{/if}
 		</div>
-		<Button
-			unifiedSize="sm"
-			variant="subtle"
-			startIcon={{
-				icon: ChevronDown,
-				classes: twMerge('transition duration-150', collapsed ? '' : 'rotate-180')
-			}}
-			onClick={() => (collapsed = !collapsed)}
-			iconOnly
-		/>
+		{#if subtitle}
+			{@render subtitle()}
+		{/if}
 	</div>
-	{#if !collapsed}
 		{#if isEditable}
 			<!-- Editable mode -->
-			<div class="px-4 py-2" transition:slide={{ duration: 150 }}>
-				<div class="grid grid-cols-1 md:grid-cols-2 md:gap-32">
+			<div class="py-2">
+				<div class="grid grid-cols-1 md:grid-cols-2 md:gap-8">
 					<div class="flex flex-col gap-2">
 						<Tabs bind:selected={filtersTab}>
 							<Tab value="includes" label="Includes"></Tab>
@@ -337,14 +323,9 @@
 					</div>
 				</div>
 			</div>
-			<div class="mt-6 p-2 border-t">
-				<div class="text-xs text-primary mb-2">
-					{isInitialSetup ? 'Configure initial sync settings' : 'Review migration settings'}
-				</div>
-			</div>
 		{:else}
 			<!-- Read-only view -->
-			<div class="px-4 py-2">
+			<div class="py-2">
 				<div class="grid grid-cols-1 md:grid-cols-2 md:gap-8">
 					<div class="flex flex-col gap-3">
 						<div>
@@ -454,5 +435,4 @@ git push
 				</div>
 			</div>
 		{/if}
-	{/if}
 </div>
diff --git a/frontend/src/lib/components/workspaceSettings/InstanceRolesButton.svelte b/frontend/src/lib/components/workspaceSettings/InstanceRolesButton.svelte
new file mode 100644
index 0000000000..e4e2726935
--- /dev/null
+++ b/frontend/src/lib/components/workspaceSettings/InstanceRolesButton.svelte
@@ -0,0 +1,48 @@
+<script lang="ts">
+	import { Badge, Button, Drawer, DrawerContent } from '../common'
+	import { Users } from 'lucide-svelte'
+	import DataTableRolesSection from './DataTableRolesSection.svelte'
+
+	let {
+		hideTrigger = false,
+		onChanged
+	}: {
+		/** Mount the drawer without its button, for a caller that opens it with `open()`. */
+		hideTrigger?: boolean
+		/** Called after every change to the instance roles. */
+		onChanged?: () => void
+	} = $props()
+
+	let drawer: Drawer | undefined = $state(undefined)
+	let prefill = $state('')
+	// Remounts the section on each open, so the prefilled name is the one just asked for.
+	let openCount = $state(0)
+
+	/** Opens the drawer, with `name` prefilled as the role to add. */
+	export function open(name = '') {
+		prefill = name
+		openCount++
+		drawer?.openDrawer()
+	}
+</script>
+
+{#if !hideTrigger}
+	<Button unifiedSize="sm" variant="default" startIcon={{ icon: Users }} on:click={() => open()}>
+		Instance roles
+	</Button>
+{/if}
+
+<Drawer bind:this={drawer} size="700px">
+	<DrawerContent
+		title="Instance roles"
+		on:close={() => drawer?.closeDrawer()}
+		tooltip="A data table role is a real Postgres login on this instance, shared by every instance database. A job that names one connects as it, and Postgres decides what it may touch. Which people may use a role on a given data table, and what it may do there, is set per data table, in its roles drawer."
+	>
+		{#snippet titleExtra()}
+			<Badge color="blue" small>Beta</Badge>
+		{/snippet}
+		{#key openCount}
+			<DataTableRolesSection initialName={prefill} {onChanged} />
+		{/key}
+	</DrawerContent>
+</Drawer>
diff --git a/frontend/src/lib/components/workspaceSettings/ModelPricing.svelte b/frontend/src/lib/components/workspaceSettings/ModelPricing.svelte
index 85824c1c95..5adc268474 100644
--- a/frontend/src/lib/components/workspaceSettings/ModelPricing.svelte
+++ b/frontend/src/lib/components/workspaceSettings/ModelPricing.svelte
@@ -4,7 +4,7 @@
 	import TextInput from '../text_input/TextInput.svelte'
 	import { getKnownModelPrice, inheritedCacheRates } from '../copilot/modelPricing'
 	import { modelKey } from '../copilot/modelConfig'
-	import { stripLegacyThinkingSuffix } from '../copilot/reasoningRegistry'
+	import { chatModelsByProvider } from './perModelSettings'
 	import { ChevronDown, ChevronUp } from 'lucide-svelte'
 	import { slide } from 'svelte/transition'
 	import SettingCard from '../instanceSettings/SettingCard.svelte'
@@ -25,28 +25,7 @@
 	let errors = $state<Record<string, string>>({})
 	let collapsedProviders = $state<Record<string, boolean>>({})
 
-	// Rates are keyed by the id the chat reports usage under, and `setCopilotInfo`
-	// strips the deprecated `/thinking` suffix before the chat ever sees a model. A
-	// row built from the raw config would save an override under a key nothing
-	// reports, so it would sit in settings looking applied and never price anything.
-	// Stripping can collapse two configured slots onto one model, hence the dedupe.
-	const modelsByProvider = $derived(
-		Object.entries(aiProviders).reduce(
-			(acc, [provider, config]) => {
-				const seen = new Set<string>()
-				acc[provider] = config.models.flatMap((configured) => {
-					const model = stripLegacyThinkingSuffix(configured)
-					if (seen.has(model)) {
-						return []
-					}
-					seen.add(model)
-					return [{ provider: provider as AIProvider, model }]
-				})
-				return acc
-			},
-			{} as Record<string, Array<{ provider: AIProvider; model: string }>>
-		)
-	)
+	const modelsByProvider = $derived(chatModelsByProvider(aiProviders))
 
 	type Field = 'input' | 'output' | 'cache_read' | 'cache_write'
 	type CacheField = Extract<Field, 'cache_read' | 'cache_write'>
@@ -228,13 +207,13 @@
 										{#if overridden}
 											<div class="text-xs text-tertiary flex flex-row items-center gap-2">
 												<span>Overriding the built-in price</span>
-												<button
-													type="button"
-													class="text-xs text-blue-500 hover:underline"
+												<Button
+													variant="subtle"
+													unifiedSize="2xs"
 													onclick={() => resetModel(provider as AIProvider, model)}
 												>
 													Reset
-												</button>
+												</Button>
 											</div>
 										{/if}
 										{#if errors[key]}
diff --git a/frontend/src/lib/components/workspaceSettings/ModelTokenLimits.svelte b/frontend/src/lib/components/workspaceSettings/ModelTokenLimits.svelte
index 7ad9034e3b..5b76430148 100644
--- a/frontend/src/lib/components/workspaceSettings/ModelTokenLimits.svelte
+++ b/frontend/src/lib/components/workspaceSettings/ModelTokenLimits.svelte
@@ -1,176 +1,158 @@
 <script lang="ts">
 	import type { AIConfig, AIProvider } from '$lib/gen'
 	import { Badge, Button } from '../common'
-	import { getModelMaxTokens } from '../copilot/lib'
+	import TextInput from '../text_input/TextInput.svelte'
+	import { modelKey } from '../copilot/modelConfig'
 	import { ChevronDown, ChevronUp } from 'lucide-svelte'
 	import { slide } from 'svelte/transition'
 	import SettingCard from '../instanceSettings/SettingCard.svelte'
-
-	const MAX_TOKENS_LIMIT = 2000000
+	import { chatModelsByProvider } from './perModelSettings'
 
 	let {
 		aiProviders,
-		maxTokensPerModel = $bindable()
+		limits = $bindable(),
+		label,
+		description,
+		min,
+		max,
+		getDefault
 	}: {
 		aiProviders: Exclude<AIConfig['providers'], undefined>
-		maxTokensPerModel: Record<string, number>
+		/** Overrides keyed `provider:model`; a model on its default has no entry. */
+		limits: Record<string, number>
+		label: string
+		description: string
+		min: number
+		max: number
+		/**
+		 * What a model gets without an override, shown as the empty field's placeholder.
+		 * `assumed` marks a guess for a model the built-in table does not know.
+		 */
+		getDefault: (provider: AIProvider, model: string) => { tokens: number; assumed: boolean }
 	} = $props()
 
 	let errors = $state<Record<string, string>>({})
-	let collapsedProviders = $state<Record<string, boolean>>({})
-
-	// Group available models by provider
-	const modelsByProvider = $derived(
-		Object.entries(aiProviders).reduce(
-			(acc, [provider, config]) => {
-				acc[provider] = config.models.map((model) => ({
-					provider: provider as AIProvider,
-					model
-				}))
-				return acc
-			},
-			{} as Record<string, Array<{ provider: AIProvider; model: string }>>
-		)
+	let collapsedProviders = $derived<Record<string, boolean>>(
+		Object.fromEntries(Object.keys(aiProviders).map((provider) => [provider, true]))
 	)
 
-	function getModelKey(provider: AIProvider, model: string): string {
-		return `${provider}:${model}`
+	const modelsByProvider = $derived(chatModelsByProvider(aiProviders))
+
+	function isOverridden(provider: AIProvider, model: string): boolean {
+		return limits[modelKey(provider, model)] !== undefined
 	}
 
-	function getDefaultTokensForModel(provider: AIProvider, model: string): number {
-		return getModelMaxTokens(provider, model)
-	}
-
-	function getCurrentTokensForModel(provider: AIProvider, model: string): number {
-		const modelKey = getModelKey(provider, model)
-		return maxTokensPerModel[modelKey] ?? getDefaultTokensForModel(provider, model)
-	}
-
-	function updateTokensForModel(provider: AIProvider, model: string, tokens: number) {
-		const modelKey = getModelKey(provider, model)
-		if (tokens < 1 || tokens > MAX_TOKENS_LIMIT) {
-			errors[modelKey] = 'Token limit must be between 1 and ' + MAX_TOKENS_LIMIT
+	function updateTokens(provider: AIProvider, model: string, tokens: number) {
+		const key = modelKey(provider, model)
+		if (!Number.isInteger(tokens) || tokens < min || tokens > max) {
+			errors[key] = `Must be a whole number between ${min} and ${max}`
 			return
 		}
-
-		const defaultTokens = getDefaultTokensForModel(provider, model)
-
-		if (tokens === defaultTokens) {
-			// Remove from object if it's the default value
-			const newSettings = { ...maxTokensPerModel }
-			delete newSettings[modelKey]
-			maxTokensPerModel = newSettings
-		} else {
-			maxTokensPerModel = {
-				...maxTokensPerModel,
-				[modelKey]: tokens
-			}
-		}
-		errors[modelKey] = ''
+		limits = { ...limits, [key]: tokens }
+		errors[key] = ''
 	}
 
-	function resetModelToDefault(provider: AIProvider, model: string) {
-		const modelKey = getModelKey(provider, model)
-		const newSettings = { ...maxTokensPerModel }
-		delete newSettings[modelKey]
-		maxTokensPerModel = newSettings
-	}
-
-	function isModelAtDefault(provider: AIProvider, model: string): boolean {
-		const currentTokens = getCurrentTokensForModel(provider, model)
-		const defaultTokens = getDefaultTokensForModel(provider, model)
-		return currentTokens === defaultTokens
+	function resetModel(provider: AIProvider, model: string) {
+		const key = modelKey(provider, model)
+		const next = { ...limits }
+		delete next[key]
+		limits = next
+		errors[key] = ''
 	}
 
 	function toggleProvider(provider: string) {
-		collapsedProviders[provider] = !collapsedProviders[provider]
+		collapsedProviders = { ...collapsedProviders, [provider]: !collapsedProviders[provider] }
 	}
 
-	function hasCustomSettings(provider: string, models: Array<{ model: string }>): boolean {
-		return models.some((m) => !isModelAtDefault(provider as AIProvider, m.model))
+	function hasOverrides(provider: string, models: Array<{ model: string }>): boolean {
+		return models.some((m) => isOverridden(provider as AIProvider, m.model))
 	}
-
-	$effect(() => {
-		// Initialize collapsedProviders to true for all providers
-		collapsedProviders = {
-			...Object.fromEntries(Object.keys(aiProviders).map((provider) => [provider, true]))
-		}
-	})
 </script>
 
 {#if Object.keys(aiProviders).length > 0}
-	<SettingCard
-		label="Model output limits"
-		description="Configure maximum token limits for each model. These limits apply to all AI chat interactions in the workspace."
-	>
+	<SettingCard {label} {description}>
 		<div class="flex flex-col gap-3">
-			{#each Object.entries(modelsByProvider).filter(([provider, models]) => models.length > 0) as [provider, models]}
+			{#each Object.entries(modelsByProvider).filter(([_, models]) => models.length > 0) as [provider, models] (provider)}
 				{@const isExpanded = !collapsedProviders[provider]}
-				{@const hasCustom = hasCustomSettings(provider, models)}
 				<div class="border rounded-md bg-surface-tertiary">
-					<button
-						type="button"
+					<Button
+						variant="subtle"
+						unifiedSize="sm"
 						onclick={() => toggleProvider(provider)}
-						class="w-full px-4 py-1 min-h-8 flex items-center justify-between hover:bg-surface-hover transition-colors rounded-t-md"
+						wrapperClasses="w-full"
+						btnClasses="w-full px-4 min-h-8 justify-between rounded-t-md rounded-b-none"
+						endIcon={{ icon: isExpanded ? ChevronUp : ChevronDown }}
 					>
 						<div class="flex items-center gap-2">
 							<h4 class="font-medium text-xs capitalize">{provider}</h4>
-							{#if hasCustom}
+							{#if hasOverrides(provider, models)}
 								<Badge color="blue">Modified</Badge>
 							{/if}
 						</div>
-						{#if isExpanded}
-							<ChevronUp size={16} class="text-gray-500" />
-						{:else}
-							<ChevronDown size={16} class="text-gray-500" />
-						{/if}
-					</button>
+					</Button>
 
 					{#if isExpanded}
 						<div transition:slide|local={{ duration: 200 }} class="p-4 border-t">
 							<div class="space-y-3">
-								{#each models as { model }}
-									{@const currentTokens = getCurrentTokensForModel(provider as AIProvider, model)}
-									{@const defaultTokens = getDefaultTokensForModel(provider as AIProvider, model)}
-									{@const isAtDefault = isModelAtDefault(provider as AIProvider, model)}
+								{#each models as { model } (model)}
+									{@const key = modelKey(provider as AIProvider, model)}
+									{@const fallback = getDefault(provider as AIProvider, model)}
+									{@const overridden = isOverridden(provider as AIProvider, model)}
 									<div class="flex flex-col gap-1">
 										<div class="flex items-center gap-3">
 											<div class="flex-1 min-w-0">
 												<span class="text-xs text-primary truncate block">{model}</span>
 											</div>
 											<div class="flex items-center gap-2">
-												<input
-													type="number"
-													min="1"
-													max={MAX_TOKENS_LIMIT}
-													value={currentTokens}
-													oninput={(e) => {
-														const value = parseInt(e.currentTarget.value)
-														if (!isNaN(value)) {
-															updateTokensForModel(provider as AIProvider, model, value)
-														}
-													}}
-													class="w-20 px-2 py-1 text-xs text-center border border-gray-200 dark:border-gray-700 rounded bg-surface focus:outline-none focus:ring-2 focus:ring-blue-500 focus:border-transparent"
-												/>
+												<div class="w-28">
+													<TextInput
+														value={limits[key] ?? ''}
+														size="sm"
+														error={!!errors[key]}
+														inputProps={{
+															type: 'number',
+															min,
+															max,
+															step: 1,
+															placeholder: String(fallback.tokens),
+															oninput: (e: Event & { currentTarget: HTMLInputElement }) => {
+																if (e.currentTarget.value === '') {
+																	resetModel(provider as AIProvider, model)
+																	return
+																}
+																const value = Number(e.currentTarget.value)
+																if (!isNaN(value)) {
+																	updateTokens(provider as AIProvider, model, value)
+																}
+															},
+															onblur: (e: Event & { currentTarget: HTMLInputElement }) => {
+																// Resync a value the state refused, so what is shown is what is stored.
+																e.currentTarget.value = String(limits[key] ?? '')
+																errors[key] = ''
+															}
+														}}
+													/>
+												</div>
 												<span class="text-xs text-secondary whitespace-nowrap">tokens</span>
 											</div>
 										</div>
-										{#if !isAtDefault}
-											<div class="text-xs text-primary flex flex-row items-center gap-1">
-												<span>Default: {defaultTokens} tokens</span>
+										{#if overridden}
+											<div class="text-xs text-tertiary flex flex-row items-center gap-2">
+												<span>
+													{fallback.assumed ? 'Assumed' : 'Default'}: {fallback.tokens.toLocaleString()}
+													tokens
+												</span>
 												<Button
-													variant="default"
-													unifiedSize="xs"
-													onclick={() => resetModelToDefault(provider as AIProvider, model)}
+													variant="subtle"
+													unifiedSize="2xs"
+													onclick={() => resetModel(provider as AIProvider, model)}
 												>
 													Reset
 												</Button>
 											</div>
-											{#if errors[getModelKey(provider as AIProvider, model)]}
-												<div class="text-xs text-red-500"
-													>{errors[getModelKey(provider as AIProvider, model)]}</div
-												>
-											{/if}
+										{/if}
+										{#if errors[key]}
+											<div class="text-xs text-red-500">{errors[key]}</div>
 										{/if}
 									</div>
 								{/each}
diff --git a/frontend/src/lib/components/workspaceSettings/NewDataTableMigrationModal.svelte b/frontend/src/lib/components/workspaceSettings/NewDataTableMigrationModal.svelte
index d16f948b88..04cf841b28 100644
--- a/frontend/src/lib/components/workspaceSettings/NewDataTableMigrationModal.svelte
+++ b/frontend/src/lib/components/workspaceSettings/NewDataTableMigrationModal.svelte
@@ -8,12 +8,17 @@
 	import TextInput from '../text_input/TextInput.svelte'
 	import SimpleEditor from '../SimpleEditor.svelte'
 	import { WorkspaceService, type DatatableMigration } from '$lib/gen'
+	import { listUsableDatatableRoles } from '../datatableUsableRoles'
 	import { sendUserToast } from '$lib/toast'
 	import { tick } from 'svelte'
 	import ConfirmationModal from '../common/confirmationModal/ConfirmationModal.svelte'
 	import { createAsyncConfirmationModal } from '../common/confirmationModal/asyncConfirmationModal.svelte'
 	import Portal from '$lib/components/Portal.svelte'
 	import { fetchPendingMigrations, outOfOrderRunMessage } from './datatableMigrationUtils'
+	import Select from '../select/Select.svelte'
+	import { parseMigrationRole, withMigrationRole } from '../datatableMigrationRole'
+	import { ADMIN_DATATABLE_ROLE } from '../dbTypes'
+	import { resource } from 'runed'
 
 	let {
 		workspace,
@@ -50,6 +55,8 @@
 	let tab = $state('up')
 	let name = $state('')
 	let nameInput = $state<TextInput>()
+	let upEditor = $state<SimpleEditor | undefined>()
+	let downEditor = $state<SimpleEditor | undefined>()
 	// A valid migration name is non-empty and limited to letters, digits, '_' and '-'.
 	const MIGRATION_NAME_RE = /^[a-zA-Z0-9_-]+$/
 	let nameInvalid = $derived(!MIGRATION_NAME_RE.test(name.trim()))
@@ -60,6 +67,96 @@
 
 	const confirmationModal = createAsyncConfirmationModal()
 
+	// The role lives in the SQL as its `-- role <name>` annotation, so the code is the single
+	// source of truth and the Select is a view onto it: reading parses, writing rewrites the
+	// annotation.
+	const usableRoles = resource(
+		() => [workspace, datatable] as const,
+		async ([ws, dt]) => {
+			try {
+				return await listUsableDatatableRoles(ws, dt)
+			} catch (e) {
+				console.error('Failed to load data table roles:', e)
+				return null
+			}
+		}
+	)
+	// Not a valid role name, so it cannot collide with one.
+	const NO_ROLE = '(no role)'
+	let declaredUp = $derived(parseMigrationRole(codeUp))
+	let declaredDown = $derived(enableDown ? parseMigrationRole(codeDown) : undefined)
+	let malformedLine = $derived(
+		declaredUp.kind === 'malformed'
+			? declaredUp.line
+			: declaredDown?.kind === 'malformed'
+				? declaredDown.line
+				: undefined
+	)
+	const roleOf = (d: typeof declaredUp) => (d.kind === 'role' ? d.role : undefined)
+	// A rollback runs as the role its own SQL names: under another role than the up migration it
+	// typically cannot touch what the up created.
+	let sqlProblem = $derived(
+		malformedLine !== undefined
+			? malformedMessage(malformedLine)
+			: declaredDown !== undefined && roleOf(declaredDown) !== roleOf(declaredUp)
+				? `The down migration runs as ${roleOf(declaredDown) ?? 'admin (no role)'} but the up migration as ${roleOf(declaredUp) ?? 'admin (no role)'}: make their role annotations match`
+				: undefined
+	)
+	let selectedRole = $derived(declaredUp.kind === 'role' ? declaredUp.role : NO_ROLE)
+	let permissioned = $derived(!!usableRoles.current?.permissioned)
+	// No annotation runs as admin, which the server allows exactly to those who may use `admin`.
+	let adminUsable = $derived(!!usableRoles.current?.roles.includes(ADMIN_DATATABLE_ROLE))
+	let roleItems = $derived.by(() => {
+		const usable = usableRoles.current
+		if (!usable?.permissioned) return []
+		const names = usable.roles.filter((r) => r !== ADMIN_DATATABLE_ROLE)
+		// A role the SQL names but the caller cannot use is still shown, or the picker would
+		// misreport what the migration runs as.
+		if (declaredUp.kind === 'role' && !names.includes(declaredUp.role)) {
+			names.push(declaredUp.role)
+		}
+		const items = names.map((r) => ({
+			value: r,
+			label: r === usable.default_role ? `${r} (default)` : r
+		}))
+		if (adminUsable || declaredUp.kind === 'none') {
+			items.push({
+				value: NO_ROLE,
+				label: 'No role — runs as admin with full access'
+			})
+		}
+		return items
+	})
+
+	function setRole(value: string | undefined) {
+		const role = value === NO_ROLE ? undefined : value
+		codeUp = withMigrationRole(codeUp, role)
+		// Up and down agree: a rollback run as another role could fail on objects it does not own.
+		if (enableDown) codeDown = withMigrationRole(codeDown, role)
+		// Assigning the bound value does not repaint the editor, and its next keystroke would write
+		// the stale text back.
+		upEditor?.setCode(codeUp)
+		if (enableDown) downEditor?.setCode(codeDown)
+	}
+
+	// Set by `open` when the SQL names no role yet: the data table's default is written once its
+	// roles are known.
+	let applyDefaultRole = $state(false)
+	$effect(() => {
+		// `undefined` until the first answer lands; `null` when it failed.
+		const usable = usableRoles.current
+		if (!applyDefaultRole || !isOpen || usableRoles.loading || usable === undefined) return
+		applyDefaultRole = false
+		if (!usable?.permissioned || declaredUp.kind !== 'none') return
+		const role =
+			usable.default_role !== ADMIN_DATATABLE_ROLE && usable.roles.includes(usable.default_role)
+				? usable.default_role
+				: usable.default_role === ADMIN_DATATABLE_ROLE && adminUsable
+					? undefined
+					: usable.roles.find((r) => r !== ADMIN_DATATABLE_ROLE)
+		if (role !== undefined) setRole(role)
+	})
+
 	// Frame the migration body in an explicit transaction so it applies atomically.
 	function wrapInTransaction(body: string): string {
 		return `BEGIN;\n\n${body}\n\nEND;`
@@ -72,15 +169,35 @@
 	}
 	const PLACEHOLDER = wrapInTransaction('-- Add your migration here')
 
+	function malformedMessage(line: string): string {
+		return `Malformed role annotation \`${line}\`: write it as \`-- role <name>\`, or pick the role above`
+	}
+
 	export function open(prefill?: { name?: string; codeUp?: string; codeDown?: string }) {
+		// Roles and the default can have changed since the last open (the roles drawer sits next
+		// to this modal), and the default role is written from this answer.
+		usableRoles.refetch()
 		name = prefill?.name ?? ''
 		// Start from the transaction template; when prefilled from detected DDL,
-		// wrap that DDL in the same BEGIN; ... END; frame.
-		codeUp = prefill?.codeUp
-			? wrapInTransaction(ensureTrailingSemicolon(prefill.codeUp))
-			: PLACEHOLDER
+		// wrap that DDL in the same BEGIN; ... END; frame. A role the prefill declares is taken
+		// out first and put back on top: below `BEGIN;` it would not be read.
+		const prefillRole = prefill?.codeUp ? parseMigrationRole(prefill.codeUp) : undefined
+		if (prefill?.codeUp) {
+			const wrapped = wrapInTransaction(
+				ensureTrailingSemicolon(withMigrationRole(prefill.codeUp, undefined))
+			)
+			codeUp =
+				prefillRole?.kind === 'role'
+					? withMigrationRole(wrapped, prefillRole.role)
+					: prefillRole?.kind === 'malformed'
+						? `${prefillRole.line}\n${wrapped}`
+						: wrapped
+		} else {
+			codeUp = PLACEHOLDER
+		}
 		codeDown = prefill?.codeDown ?? PLACEHOLDER
 		enableDown = (prefill?.codeDown ?? '') !== ''
+		applyDefaultRole = prefillRole === undefined || prefillRole.kind === 'none'
 		tab = 'up'
 		isOpen = true
 		// Focus the name field once the modal content has rendered.
@@ -96,6 +213,10 @@
 			sendUserToast("Invalid migration name: use only letters, digits, '_' and '-'", true)
 			return
 		}
+		if (sqlProblem !== undefined) {
+			sendUserToast(sqlProblem, true)
+			return
+		}
 		if (run) {
 			// A new migration gets the highest timestamp, so any still-pending
 			// migration is earlier: running only this one applies it out of order.
@@ -176,29 +297,65 @@
 	closeOnOutsideClick={false}
 >
 	<div class="flex flex-col gap-3 w-full grow min-h-0">
-		<TextInput
-			bind:this={nameInput}
-			bind:value={name}
-			error={nameInvalid}
-			inputProps={{ placeholder: 'Migration name (e.g. add_index_to_customers)' }}
-		/>
+		<div class="flex gap-2 items-center">
+			<TextInput
+				bind:this={nameInput}
+				bind:value={name}
+				error={nameInvalid}
+				class="grow"
+				inputProps={{ placeholder: 'Migration name (e.g. add_index_to_customers)' }}
+			/>
+			{#if permissioned}
+				<Select
+					transformInputSelectedText={(s) => `Role: ${s}`}
+					items={roleItems}
+					bind:value={() => selectedRole, (r) => setRole(r)}
+					placeholder="Role"
+					class="w-72"
+				/>
+			{/if}
+		</div>
+		{#if sqlProblem !== undefined}
+			<p class="text-xs text-red-500">{sqlProblem}</p>
+		{:else if permissioned && usableRoles.current?.roles.length === 0}
+			<p class="text-xs text-secondary">
+				You can't use any role of this data table, so a migration you create can't be run.
+			</p>
+		{/if}
 		<Tabs bind:selected={tab} class="grow min-h-0">
 			<Tab value="up" label="Up" />
 			<Tab value="down" label="Down" />
 			{#snippet content()}
 				<TabContent value="up" class="h-80 border rounded-md overflow-hidden">
-					<SimpleEditor class="h-full" lang="sql" bind:code={codeUp} />
+					<SimpleEditor bind:this={upEditor} class="h-full" lang="sql" bind:code={codeUp} />
 				</TabContent>
 				<TabContent value="down" class="h-80">
 					<div class="flex flex-col gap-2 h-full">
 						<Toggle
-							bind:checked={enableDown}
+							bind:checked={
+								() => enableDown,
+								(checked) => {
+									enableDown = checked
+									// The down editor is created by this toggle, so it reads the rewritten text.
+									if (checked) {
+										codeDown = withMigrationRole(
+											codeDown,
+											declaredUp.kind === 'role' ? declaredUp.role : undefined
+										)
+									}
+								}
+							}
 							options={{ right: 'Enable down migration' }}
 							size="sm"
 						/>
 						{#if enableDown}
 							<div class="grow min-h-0 border rounded-md overflow-hidden">
-								<SimpleEditor class="h-full" lang="sql" bind:code={codeDown} />
+								<SimpleEditor
+									bind:this={downEditor}
+									class="h-full"
+									lang="sql"
+									bind:code={codeDown}
+								/>
 							</div>
 						{/if}
 					</div>
@@ -209,7 +366,7 @@
 			<Button
 				variant="accent"
 				size="sm"
-				disabled={creating}
+				disabled={creating || sqlProblem !== undefined}
 				on:click={() => create(true)}
 				dropdownItems={[
 					{
diff --git a/frontend/src/lib/components/workspaceSettings/instanceDbSteps.ts b/frontend/src/lib/components/workspaceSettings/instanceDbSteps.ts
index dd465626f4..c11a205116 100644
--- a/frontend/src/lib/components/workspaceSettings/instanceDbSteps.ts
+++ b/frontend/src/lib/components/workspaceSettings/instanceDbSteps.ts
@@ -84,6 +84,11 @@ export function instanceDbSteps(dbname: string, status: CustomInstanceDb | undef
 				(status?.logs.replication_user_error
 					? `\n\nError: ${status.logs.replication_user_error}`
 					: '')
+		},
+		{
+			title: 'Connect as custom_instance_user',
+			status: status?.logs.user_connect,
+			description: `The steps above run as the user in DATABASE_URL, but data tables and DuckLake catalogs on ${dbname} log in as custom_instance_user. This checks that login reaches the database too. A connection pooler that routes on the login name, such as Supabase's shared pooler, refuses it: use your own Postgres database instead, or point DATABASE_URL at the Postgres server directly.`
 		}
 	]
 }
diff --git a/frontend/src/lib/components/workspaceSettings/perModelSettings.ts b/frontend/src/lib/components/workspaceSettings/perModelSettings.ts
new file mode 100644
index 0000000000..a83da75540
--- /dev/null
+++ b/frontend/src/lib/components/workspaceSettings/perModelSettings.ts
@@ -0,0 +1,24 @@
+import type { AIConfig, AIProvider } from '$lib/gen'
+import { stripLegacyThinkingSuffix } from '../copilot/reasoningRegistry'
+
+/**
+ * The rows of a per-model setting, grouped by provider. Settings are keyed by the id
+ * the chat reads them under, and `setCopilotInfo` strips the deprecated `/thinking`
+ * suffix before the chat ever sees a model. A row built from the raw config would
+ * save a value under a key nothing reads, so it would sit in settings looking applied
+ * and never take effect. Stripping can collapse two configured slots onto one model,
+ * hence the dedupe.
+ */
+export function chatModelsByProvider(
+	aiProviders: Exclude<AIConfig['providers'], undefined>
+): Record<string, Array<{ provider: AIProvider; model: string }>> {
+	return Object.fromEntries(
+		Object.entries(aiProviders).map(([provider, config]) => [
+			provider,
+			[...new Set(config.models.map(stripLegacyThinkingSuffix))].map((model) => ({
+				provider: provider as AIProvider,
+				model
+			}))
+		])
+	)
+}
diff --git a/frontend/src/lib/components/workspaceTree.test.ts b/frontend/src/lib/components/workspaceTree.test.ts
index 3e1dabd7a5..f9c00b4d7b 100644
--- a/frontend/src/lib/components/workspaceTree.test.ts
+++ b/frontend/src/lib/components/workspaceTree.test.ts
@@ -373,6 +373,23 @@ describe('buildWorkspaceTree', () => {
 			expect(admin.children.map((c) => c.key)).toEqual([leafKeyFor('app', 'u/admin/draft_abc')])
 		})
 
+		it('keeps one leaf per draft when two drafts share a friendly path', () => {
+			const a = { ...item('flow', 'u/admin/draft_a'), draftPath: 'u/admin/fond_flow' }
+			const b = { ...item('flow', 'u/admin/draft_b'), draftPath: 'u/admin/fond_flow' }
+			const tree = buildWorkspaceTree({
+				loaded: { flow: [a, b] },
+				kinds: ['flow'],
+				loadingKind: {},
+				// b's extra first, so a friendly-path match would fold it into a;
+				// the repeat of a stands for a stale snapshot re-keyed twice.
+				extraItemsByKind: { flow: [{ ...b }, { ...a }, { ...a }] }
+			})
+			const admin = findBranch(tree, dirKey('flow', 'u/admin'))
+			expect(admin.children.map((c) => c.key).sort()).toEqual(
+				[leafKeyFor('flow', 'u/admin/draft_a'), leafKeyFor('flow', 'u/admin/draft_b')].sort()
+			)
+		})
+
 		it('folds a mid-rename live extra into the stale loaded row: one storage-keyed leaf under the typed folder', () => {
 			// Session picker while a rename's autosave is pending: listApps still
 			// carries the pre-rename friendly path, the live cell extra (re-keyed to
diff --git a/frontend/src/lib/components/workspaceTree.ts b/frontend/src/lib/components/workspaceTree.ts
index 3a922ef45b..9475b58af5 100644
--- a/frontend/src/lib/components/workspaceTree.ts
+++ b/frontend/src/lib/components/workspaceTree.ts
@@ -136,13 +136,17 @@ function dirToBranch(
 	}
 }
 
-/** Merge AI-created in-memory drafts (or any caller-provided extras) into a
- * kind's loaded list. The chat tools / session previews scaffold items via
- * `UserDraft` before the user deploys; those should be navigable from the
- * picker. An extra matching a loaded item (by storage or friendly path — else
- * one draft renders as two leaves) is folded into it: the loaded row wins on
- * backend metadata (summary etc.), but the extra's `draftPath` is overlaid
- * when set — a live editor cell knows a rename before the backend list does. */
+/** Merge the session's drafts (or any caller-provided extras) into a kind's
+ * loaded list, so drafts the backend listing does not show yet (unsaved
+ * cells, a rename typed in a live editor) stay navigable. An extra matching
+ * a loaded item is folded into it: the loaded row wins on backend metadata
+ * (summary etc.), but the extra's `draftPath` is overlaid when set — a live
+ * editor cell knows a rename before the backend list does.
+ *
+ * Match on the storage path first. The friendly path is only a fallback for
+ * an extra still keyed by it, and each extra is claimed once: several drafts
+ * can share one friendly path, and an extra folded into the wrong row would
+ * leave its own row's extra over, rendering a second leaf with that row's key. */
 function withExtras(
 	items: WorkspaceItem[],
 	k: WorkspaceItemKind,
@@ -150,16 +154,30 @@ function withExtras(
 ): WorkspaceItem[] {
 	const extras = extraItemsByKind?.[k]
 	if (!extras || extras.length === 0) return items
-	const leftover = new Set(extras)
-	const merged = items.map((it) => {
-		const ex = extras.find((d) => itemMatchesPath(it, d.path) || itemMatchesPath(it, d.draftPath))
+	const byPath = new Map<string, WorkspaceItem>()
+	for (const d of extras) if (!byPath.has(d.path)) byPath.set(d.path, d)
+	const claimed = new Set<WorkspaceItem>()
+	const exact = items.map((it) => {
+		const ex = byPath.get(it.path)
+		if (ex) claimed.add(ex)
+		return ex
+	})
+	const merged = items.map((it, i) => {
+		let ex = exact[i]
+		if (!ex && it.draftPath !== undefined) {
+			const byFriendly = byPath.get(it.draftPath)
+			if (byFriendly && !claimed.has(byFriendly)) {
+				ex = byFriendly
+				claimed.add(ex)
+			}
+		}
 		if (!ex) return it
-		leftover.delete(ex)
 		return ex.draftPath !== undefined && ex.draftPath !== it.draftPath
 			? { ...it, draftPath: ex.draftPath }
 			: it
 	})
-	return leftover.size > 0 ? merged.concat([...leftover]) : merged
+	const leftover = [...byPath.values()].filter((d) => !claimed.has(d))
+	return leftover.length > 0 ? merged.concat(leftover) : merged
 }
 
 /** Build the workspace drill tree.
@@ -187,8 +205,8 @@ export function buildWorkspaceTree(opts: {
 	 * loading state (e.g. chat picker, which preloads eagerly) can omit it. */
 	loadingKind?: Partial<Record<WorkspaceItemKind, boolean>>
 	/** Per-kind extras to merge into the loaded list before tree-building
-	 * (e.g. AI-created localStorage drafts surfaced by the workspace adapter).
-	 * Extras whose path matches an already-loaded item are dropped. */
+	 * (e.g. the session's drafts from `listGlobalDrafts`, keyed by storage
+	 * path). An extra matching an already-loaded item is folded into it. */
 	extraItemsByKind?: Partial<Record<WorkspaceItemKind, WorkspaceItem[]>>
 	layout?: 'by-kind' | 'flat'
 }): DrillNode<WorkspaceItem>[] {
diff --git a/frontend/src/lib/draftConflictSession.svelte.ts b/frontend/src/lib/draftConflictSession.svelte.ts
new file mode 100644
index 0000000000..d377b92dfd
--- /dev/null
+++ b/frontend/src/lib/draftConflictSession.svelte.ts
@@ -0,0 +1,65 @@
+import { untrack } from 'svelte'
+
+/**
+ * Identity for one editing session's conflict resolution.
+ *
+ * An editor outlives what it shows, so an awaited step cannot tell from the workspace and path
+ * alone whether it still speaks for what is on screen: both come back to the values it started
+ * with when the user returns to where they were. Every resolution takes a token and checks it
+ * before touching shared editor state.
+ */
+export function createDraftConflictSession() {
+	let generation = $state(0)
+	/** The token of the resolution in flight, or 0. A token rather than a flag: one left over from
+	 *  a closed session must not clear the busy state of the session that replaced it. */
+	let inFlight = $state(0)
+
+	return {
+		/** A resolution started in the current session is in flight. Ending a session clears it, so
+		 *  a reopened editor never shows buttons that only a stale request settling can re-enable. */
+		get busy(): boolean {
+			return inFlight !== 0
+		},
+		/** Claim the session for a resolution about to start. */
+		start(): number {
+			inFlight = ++generation
+			return inFlight
+		},
+		/** Whether `token` still speaks for the editor. */
+		holds(token: number): boolean {
+			return token === generation
+		},
+		/** Release `token`'s claim. A stale token is ignored. */
+		finish(token: number): void {
+			if (inFlight === token) inFlight = 0
+		},
+		/** Nothing outstanding speaks for this editor any more: a different item, a different
+		 *  session on the same one, or the component going away. */
+		end(): void {
+			generation++
+			inFlight = 0
+		}
+	}
+}
+
+/**
+ * A session for an editor that swaps what it shows in place, `scopeOf` naming what that currently
+ * is. Leaving a scope and coming back is a new session, so the change itself ends the old one:
+ * afterwards every value a resolution captured before the switch reads as current again, and no
+ * later comparison could tell it apart from one that never left.
+ */
+export function useDraftConflictSession(scopeOf: () => unknown) {
+	const session = createDraftConflictSession()
+
+	let lastScope = untrack(scopeOf)
+	$effect(() => {
+		const next = scopeOf()
+		untrack(() => {
+			if (next === lastScope) return
+			lastScope = next
+			session.end()
+		})
+	})
+
+	return session
+}
diff --git a/frontend/src/lib/draftConflictSession.test.ts b/frontend/src/lib/draftConflictSession.test.ts
new file mode 100644
index 0000000000..88e62f44de
--- /dev/null
+++ b/frontend/src/lib/draftConflictSession.test.ts
@@ -0,0 +1,31 @@
+import { describe, it, expect } from 'vitest'
+
+import { createDraftConflictSession } from './draftConflictSession.svelte'
+
+/**
+ * A resolution the user has walked away from must neither speak for what replaced it nor hold its
+ * buttons disabled until it settles.
+ */
+describe('createDraftConflictSession', () => {
+	it('frees the next session from a resolution the last one left in flight', () => {
+		const session = createDraftConflictSession()
+
+		const stale = session.start()
+		expect(session.busy).toBe(true)
+
+		session.end()
+		expect(session.busy).toBe(false)
+		expect(session.holds(stale)).toBe(false)
+
+		const fresh = session.start()
+		expect(session.busy).toBe(true)
+		expect(session.holds(fresh)).toBe(true)
+
+		// The stale request settles last: it must not release the live session's claim.
+		session.finish(stale)
+		expect(session.busy).toBe(true)
+
+		session.finish(fresh)
+		expect(session.busy).toBe(false)
+	})
+})
diff --git a/frontend/src/lib/editorFontSize.svelte.ts b/frontend/src/lib/editorFontSize.svelte.ts
index 13d99915e3..96519b0aac 100644
--- a/frontend/src/lib/editorFontSize.svelte.ts
+++ b/frontend/src/lib/editorFontSize.svelte.ts
@@ -1,25 +1,25 @@
 // Reactive Monaco font sizes that follow the global `:root` font-size
-// breakpoint set in `frontend/src/lib/assets/app.css` (18px at ≥1760px).
+// breakpoint set in `frontend/src/lib/assets/app.css` (18px on screens ≥1760px).
 // The values mirror Tailwind's `text-xs` (0.75rem) computed pixel size so
 // editors visually match the surrounding UI.
 
-const LARGE_VIEWPORT_QUERY = '(min-width: 1760px)'
+const LARGE_SCREEN_QUERY = '(min-device-width: 1760px)'
 
-let isLargeViewport = $state(false)
+let isLargeScreen = $state(false)
 
 if (typeof window !== 'undefined') {
-	const mq = window.matchMedia(LARGE_VIEWPORT_QUERY)
-	isLargeViewport = mq.matches
+	const mq = window.matchMedia(LARGE_SCREEN_QUERY)
+	isLargeScreen = mq.matches
 	mq.addEventListener('change', (e) => {
-		isLargeViewport = e.matches
+		isLargeScreen = e.matches
 	})
 }
 
 export const editorFontSize = {
 	get regular(): number {
-		return isLargeViewport ? 13.5 : 12
+		return isLargeScreen ? 13.5 : 12
 	},
 	get small(): number {
-		return isLargeViewport ? 12 : 11
+		return isLargeScreen ? 12 : 11
 	}
 }
diff --git a/frontend/src/lib/hubPaths.json b/frontend/src/lib/hubPaths.json
index dfa0be57c1..831380748e 100644
--- a/frontend/src/lib/hubPaths.json
+++ b/frontend/src/lib/hubPaths.json
@@ -1,6 +1,6 @@
 {
 	"gitSyncTest": "hub/28950/git-repo-test-read-write-windmill",
-	"gitInitRepo": "hub/28957/git-sync-init-repository-windmill",
+	"gitInitRepo": "hub/28970/git-sync-init-repository-windmill",
 	"slackErrorHandler": "hub/28794/workspace-or-schedule-error-handler-slack",
 	"emailErrorHandler": "hub/19795/workspace-or-error-handler-email",
 	"slackRecoveryHandler": "hub/28791/slack/schedule-recovery-handler-slack",
diff --git a/frontend/src/lib/instanceUi.ts b/frontend/src/lib/instanceUi.ts
new file mode 100644
index 0000000000..b9b87d139c
--- /dev/null
+++ b/frontend/src/lib/instanceUi.ts
@@ -0,0 +1,9 @@
+import { writable } from 'svelte/store'
+import type { GetInstanceUiResponse } from '$lib/gen'
+
+/**
+ * The last `/settings/instance_ui` response: the announcement banner and accent color.
+ * `undefined` until one lands, and left as is when a fetch fails, so a transient error
+ * never retracts an announcement still in force. Written only by `InstanceUiSync`.
+ */
+export const instanceUi = writable<GetInstanceUiResponse | undefined>(undefined)
diff --git a/frontend/src/lib/logout.test.ts b/frontend/src/lib/logout.test.ts
new file mode 100644
index 0000000000..160bce9934
--- /dev/null
+++ b/frontend/src/lib/logout.test.ts
@@ -0,0 +1,28 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+vi.mock('./onboardingProfile', () => ({ noteSessionEmail: vi.fn() }))
+vi.mock('./components/sidebar/accountSetup.svelte', () => ({
+	accountSetup: { reset: vi.fn() }
+}))
+vi.mock('./storeUtils', () => ({ clearStores: vi.fn() }))
+vi.mock('$lib/gen', () => ({ UserService: { logout: vi.fn(async () => {}) } }))
+
+import { clearUser } from './logout'
+
+describe('clearUser', () => {
+	beforeEach(() => {
+		sessionStorage.clear()
+		vi.clearAllMocks()
+	})
+
+	// Logging out while impersonating must not leave the impersonator's own token behind.
+	it('drops the impersonation token backup', async () => {
+		sessionStorage.setItem('pre_impersonation_token', 'a-token')
+		sessionStorage.setItem('pre_impersonation_email', 'admin@windmill.dev')
+
+		await clearUser()
+
+		expect(sessionStorage.getItem('pre_impersonation_token')).toBeNull()
+		expect(sessionStorage.getItem('pre_impersonation_email')).toBeNull()
+	})
+})
diff --git a/frontend/src/lib/logout.ts b/frontend/src/lib/logout.ts
index 1c0915dfa9..58fce16fe3 100644
--- a/frontend/src/lib/logout.ts
+++ b/frontend/src/lib/logout.ts
@@ -6,11 +6,24 @@ import { clearStores } from './storeUtils'
 // Note: logout and logoutWithRedirect have been moved to logoutKit.ts
 // as they depend on SvelteKit navigation
 
+// The impersonation backup holds the impersonator's own auth token, so it must go on
+// logout too, not only when impersonation is ended from the banner — otherwise a usable
+// token stays readable for the lifetime of the tab.
+function clearImpersonationFromStorage(): void {
+	try {
+		sessionStorage.removeItem('pre_impersonation_token')
+		sessionStorage.removeItem('pre_impersonation_email')
+	} catch (e) {
+		console.error('error interacting with session storage', e)
+	}
+}
+
 export async function clearUser() {
 	try {
 		noteSessionEmail(undefined)
 		accountSetup.reset()
 		clearStores()
+		clearImpersonationFromStorage()
 		await UserService.logout()
 	} catch (error) {}
 }
diff --git a/frontend/src/lib/mcpAuth.ts b/frontend/src/lib/mcpAuth.ts
new file mode 100644
index 0000000000..beadd737bd
--- /dev/null
+++ b/frontend/src/lib/mcpAuth.ts
@@ -0,0 +1,20 @@
+import { SettingService } from '$lib/gen'
+
+/**
+ * Whether the instance refuses `?token=` on the MCP endpoints. When it does, an MCP URL is
+ * handed over bare and the client reaches it by completing the OAuth flow, so nothing in the
+ * UI should offer to mint a token for one.
+ *
+ * Deliberately uncached: callers read it at the moment an MCP URL is asked for, so a superadmin
+ * flipping the setting does not leave open tabs handing out URLs the server now refuses.
+ *
+ * Throws rather than falling back, so the caller picks the safe default. Guessing `false`
+ * here would mint a non-expiring token for a URL the server may refuse.
+ */
+export async function mcpTokenUrlDisabled(): Promise<boolean> {
+	return (
+		((await SettingService.getGlobal({
+			key: 'mcp_disable_token_query_param'
+		})) as boolean | null) ?? false
+	)
+}
diff --git a/frontend/src/lib/mcpEndpointTools.ts b/frontend/src/lib/mcpEndpointTools.ts
index a9e2b9f3b2..2197998857 100644
--- a/frontend/src/lib/mcpEndpointTools.ts
+++ b/frontend/src/lib/mcpEndpointTools.ts
@@ -708,6 +708,10 @@ export const mcpEndpointTools: EndpointTool[] = [
                 "content": {
                         "type": "string"
                 },
+                "schema": {
+                        "type": "object",
+                        "description": "JSON Schema of the arguments of `main`, which is what a run form and an MCP tool offer. Omitted (or `{}`), it is inferred from `content` for TypeScript, Python, Go, Bash, PowerShell, SQL, GraphQL and Ansible scripts. For other languages, or code that does not parse, a new script gets none. A new version of an existing script also keeps what the previous version's schema says about each argument, or that whole schema when nothing can be inferred. A dbt script always takes its schema from its descriptor, whatever is sent."
+                },
                 "language": {
                         "type": "string",
                         "description": "Possible values: python3, deno, go, bash, powershell, postgresql, mysql, bigquery, snowflake, mssql, oracledb, graphql, nativets, bun, php, rust, ansible, csharp, nu, java, ruby, rlang, duckdb, bunnative, dbt"
@@ -764,6 +768,10 @@ export const mcpEndpointTools: EndpointTool[] = [
                 "content": {
                         "type": "string"
                 },
+                "schema": {
+                        "type": "object",
+                        "description": "JSON Schema of the arguments of `main`, which is what a run form and an MCP tool offer. Omitted (or `{}`), it is inferred from `content` for TypeScript, Python, Go, Bash, PowerShell, SQL, GraphQL and Ansible scripts. For other languages, or code that does not parse, a new script gets none. A new version of an existing script also keeps what the previous version's schema says about each argument, or that whole schema when nothing can be inferred. A dbt script always takes its schema from its descriptor, whatever is sent."
+                },
                 "language": {
                         "type": "string",
                         "description": "Possible values: python3, deno, go, bash, powershell, postgresql, mysql, bigquery, snowflake, mssql, oracledb, graphql, nativets, bun, php, rust, ansible, csharp, nu, java, ruby, rlang, duckdb, bunnative, dbt"
@@ -1031,10 +1039,12 @@ export const mcpEndpointTools: EndpointTool[] = [
                         "description": "Detailed documentation for this flow"
                 },
                 "value": {
-                        "type": "object"
+                        "type": "object",
+                        "description": "The flow structure containing modules and optional preprocessor/failure handlers"
                 },
                 "schema": {
-                        "type": "object"
+                        "type": "object",
+                        "description": "JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"
                 },
                 "path": {
                         "type": "string"
@@ -1087,10 +1097,12 @@ export const mcpEndpointTools: EndpointTool[] = [
                         "description": "Detailed documentation for this flow"
                 },
                 "value": {
-                        "type": "object"
+                        "type": "object",
+                        "description": "The flow structure containing modules and optional preprocessor/failure handlers"
                 },
                 "schema": {
-                        "type": "object"
+                        "type": "object",
+                        "description": "JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"
                 },
                 "tag": {
                         "type": "string"
diff --git a/frontend/src/lib/remoteDeploy.test.ts b/frontend/src/lib/remoteDeploy.test.ts
new file mode 100644
index 0000000000..7064dc83b6
--- /dev/null
+++ b/frontend/src/lib/remoteDeploy.test.ts
@@ -0,0 +1,44 @@
+import { describe, it, expect, beforeEach, vi, afterEach } from 'vitest'
+import { PENDING_TTL_MS, remoteDeployAuthorizeUrl, takePendingConnect } from './remoteDeploy'
+
+const target = { base_url: 'https://prod.example.com', workspace_id: 'prod' }
+
+function startConnect(workspace = 'dev'): string {
+	const url = new URL(remoteDeployAuthorizeUrl(target, workspace, '/deploy/flow/f/a'))
+	return url.searchParams.get('state')!
+}
+
+describe('remote deploy connect state', () => {
+	beforeEach(() => {
+		localStorage.clear()
+		vi.stubGlobal('window', { location: { origin: 'https://dev.example.com' } })
+	})
+	afterEach(() => {
+		vi.useRealTimers()
+		vi.unstubAllGlobals()
+	})
+
+	// The state is what keeps any other page from planting a token as the user's.
+	it('matches only the state it issued, and only once', () => {
+		const state = startConnect()
+		expect(takePendingConnect('forged')).toBeUndefined()
+		expect(takePendingConnect(state)).toMatchObject({ workspace: 'dev', target })
+		expect(takePendingConnect(state)).toBeUndefined()
+	})
+
+	it('keeps concurrent attempts apart', () => {
+		const first = startConnect('dev')
+		const second = startConnect('staging')
+		expect(takePendingConnect(first)?.workspace).toBe('dev')
+		expect(takePendingConnect(second)?.workspace).toBe('staging')
+	})
+
+	it('expires an attempt left unfinished, and drops it from storage', () => {
+		vi.useFakeTimers()
+		const abandoned = startConnect()
+		vi.advanceTimersByTime(PENDING_TTL_MS + 60_000)
+		startConnect()
+		expect(localStorage.length).toBe(1)
+		expect(takePendingConnect(abandoned)).toBeUndefined()
+	})
+})
diff --git a/frontend/src/lib/remoteDeploy.ts b/frontend/src/lib/remoteDeploy.ts
new file mode 100644
index 0000000000..ad887504fb
--- /dev/null
+++ b/frontend/src/lib/remoteDeploy.ts
@@ -0,0 +1,101 @@
+import { base } from '$lib/base'
+import type { RemoteDeployConnection, RemoteDeployTarget } from '$lib/gen'
+import { randomSecret } from '$lib/utils/uuid'
+
+/**
+ * The workspace argument that aims a generated-client call at `workspace`'s deploy target on
+ * another instance. The client fills `{workspace}` with `encodeURI`, which keeps the slashes, so
+ * `/w/{workspace}/flows/create` reaches `/w/<workspace>/remote_deploy/proxy/<key>/flows/create`,
+ * which the backend forwards to the remote workspace with the caller's token for it.
+ */
+export function remoteDeployWorkspace(
+	workspace: string,
+	connection: RemoteDeployConnection
+): string {
+	return `${workspace}/remote_deploy/proxy/${connection.proxy_key}`
+}
+
+export function remoteDeployLabel(target: RemoteDeployTarget): string {
+	return `${target.workspace_id} on ${remoteHost(target.base_url)}`
+}
+
+export function remoteHost(url: string): string {
+	try {
+		return new URL(url).host
+	} catch {
+		return url
+	}
+}
+
+// Connecting by signing in on the remote: the drawer opens the remote's authorize page, which mints
+// a token and sends it back in the fragment of `CALLBACK_PATH`; that page stores it through
+// `connect` and tells the drawer on `CHANNEL`.
+
+/** The path the remote's authorize page only ever sends a token to. */
+export const CALLBACK_PATH = '/remote_deploy/callback'
+export const CHANNEL = 'windmill-remote-deploy'
+const PENDING_PREFIX = 'remote-deploy-connect:'
+export const PENDING_TTL_MS = 15 * 60_000
+
+type PendingConnect = {
+	workspace: string
+	/** Sent back with the token, so it only reaches the instance it came from. */
+	target: RemoteDeployTarget
+	returnTo: string
+	at: number
+}
+
+export type RemoteDeployEvent =
+	| { type: 'connected'; workspace: string }
+	| { type: 'failed'; workspace: string; error: string }
+
+/**
+ * The remote authorize URL for connecting `workspace`. Records a `state` for the callback to
+ * check: without it, any page could send this instance a token of its choosing to store as the
+ * user's, and their deploys would land on the remote as someone else. `localStorage` rather than
+ * `sessionStorage`, because the callback runs in the window the remote sends back to, which is
+ * not always this one; one entry per attempt, so two tabs connecting at once do not cancel out.
+ */
+export function remoteDeployAuthorizeUrl(
+	target: RemoteDeployTarget,
+	workspace: string,
+	returnTo: string
+): string {
+	dropExpiredConnects()
+	const state = randomSecret(16)
+	const pending: PendingConnect = { workspace, target, returnTo, at: Date.now() }
+	localStorage.setItem(PENDING_PREFIX + state, JSON.stringify(pending))
+	const params = new URLSearchParams({
+		workspace: target.workspace_id,
+		callback: `${window.location.origin}${base}${CALLBACK_PATH}`,
+		state
+	})
+	return `${target.base_url}/user/remote_deploy_authorize?${params}`
+}
+
+/** An attempt abandoned before its callback would otherwise stay in storage for good. */
+function dropExpiredConnects() {
+	for (let i = localStorage.length - 1; i >= 0; i--) {
+		const key = localStorage.key(i)
+		if (!key?.startsWith(PENDING_PREFIX)) continue
+		let at = 0
+		try {
+			at = JSON.parse(localStorage.getItem(key) ?? '{}').at ?? 0
+		} catch {}
+		if (Date.now() - at > PENDING_TTL_MS) localStorage.removeItem(key)
+	}
+}
+
+/** The attempt `state` names, used once: a replayed callback finds nothing to match. */
+export function takePendingConnect(state: string): PendingConnect | undefined {
+	const key = PENDING_PREFIX + state
+	let pending: PendingConnect | undefined
+	try {
+		pending = JSON.parse(localStorage.getItem(key) ?? 'null') ?? undefined
+	} catch {}
+	localStorage.removeItem(key)
+	if (!pending || Date.now() - pending.at > PENDING_TTL_MS) {
+		return undefined
+	}
+	return pending
+}
diff --git a/frontend/src/lib/svelte5UtilsKit.svelte.ts b/frontend/src/lib/svelte5UtilsKit.svelte.ts
index 7b6420ab7e..d77b96df06 100644
--- a/frontend/src/lib/svelte5UtilsKit.svelte.ts
+++ b/frontend/src/lib/svelte5UtilsKit.svelte.ts
@@ -3,6 +3,8 @@
 
 import { z } from 'zod'
 import { serializeParam } from '$lib/utils/serializeParam'
+import { untrack } from 'svelte'
+import { useHostedPage } from '$lib/components/hostedPage'
 
 export type SearchParamsResult<S extends z.ZodType> =
 	S extends z.ZodObject<infer Shape>
@@ -58,12 +60,14 @@ function deserializeParam(raw: string, fieldSchema: z.ZodType): unknown {
 export function useSearchParams<S extends z.ZodType>(schema: S): SearchParamsResult<S> {
 	const shape: Record<string, z.ZodType> = (schema as any).shape ?? {}
 	const keys = Object.keys(shape)
+	const hosted = useHostedPage()
+	const currentSearch = () => (hosted ? hosted.search : window.location.search)
 
 	// Reactive snapshot of search params - one $state cell per key
 	const values: Record<string, unknown> = $state(
 		Object.fromEntries(
 			keys.map((k) => {
-				const raw = new URLSearchParams(window.location.search).get(k)
+				const raw = new URLSearchParams(untrack(currentSearch)).get(k)
 				const parsed = raw != null ? deserializeParam(raw, shape[k]) : null
 				return [k, parsed]
 			})
@@ -71,7 +75,7 @@ export function useSearchParams<S extends z.ZodType>(schema: S): SearchParamsRes
 	)
 
 	function syncFromUrl() {
-		const sp = new URLSearchParams(window.location.search)
+		const sp = new URLSearchParams(currentSearch())
 		for (const k of keys) {
 			const raw = sp.get(k)
 			const parsed = raw != null ? deserializeParam(raw, shape[k]) : null
@@ -79,8 +83,13 @@ export function useSearchParams<S extends z.ZodType>(schema: S): SearchParamsRes
 		}
 	}
 
-	// Keep in sync when the user navigates back/forward
+	// Keep in sync when the user navigates back/forward, or the host re-points the page
 	$effect(() => {
+		if (hosted) {
+			hosted.search
+			untrack(syncFromUrl)
+			return
+		}
 		window.addEventListener('popstate', syncFromUrl)
 		return () => window.removeEventListener('popstate', syncFromUrl)
 	})
@@ -94,12 +103,16 @@ export function useSearchParams<S extends z.ZodType>(schema: S): SearchParamsRes
 			},
 			set(v: unknown) {
 				;(values as any)[key] = v
-				const sp = new URLSearchParams(window.location.search)
+				const sp = new URLSearchParams(untrack(currentSearch))
 				if (v == null) {
 					sp.delete(key)
 				} else {
 					sp.set(key, serializeParam(v))
 				}
+				if (hosted) {
+					hosted.setSearch(sp.size ? `?${sp}` : '')
+					return
+				}
 				const hash = window.location.hash
 				const newUrl = sp.toString()
 					? `${window.location.pathname}?${sp}${hash}`
diff --git a/frontend/src/lib/tokenExpiration.test.ts b/frontend/src/lib/tokenExpiration.test.ts
new file mode 100644
index 0000000000..0119bf32ad
--- /dev/null
+++ b/frontend/src/lib/tokenExpiration.test.ts
@@ -0,0 +1,35 @@
+import { describe, expect, it } from 'vitest'
+import { MAX_TOKEN_EXPIRATION_DAYS_BOUND, parseMaxTokenExpirationDays } from './tokenExpiration'
+
+// The same table as `parse_max_token_expiration_days`'s test in windmill-common. A mismatch makes
+// the token form announce a ceiling the server does not apply, or hide one it does.
+describe('parseMaxTokenExpirationDays', () => {
+	it.each([
+		[7, 7],
+		// jsonb keeps `7.0` as written; the server reads an integral float as whole days.
+		[7.0, 7],
+		['7', 7],
+		[' 30 ', 30],
+		['+7', 7],
+		[MAX_TOKEN_EXPIRATION_DAYS_BOUND, MAX_TOKEN_EXPIRATION_DAYS_BOUND]
+	])('reads %j as a ceiling of %j days', (stored, days) => {
+		expect(parseMaxTokenExpirationDays(stored)).toBe(days)
+	})
+
+	it.each([
+		7.5,
+		0,
+		-3,
+		// `str::parse::<i64>` refuses these, however JavaScript's `Number` reads them.
+		'7.0',
+		'1e1',
+		'0x7',
+		'',
+		MAX_TOKEN_EXPIRATION_DAYS_BOUND + 1,
+		'99999999999999999999',
+		null,
+		true
+	])('reads %j as no ceiling', (stored) => {
+		expect(parseMaxTokenExpirationDays(stored)).toBeUndefined()
+	})
+})
diff --git a/frontend/src/lib/tokenExpiration.ts b/frontend/src/lib/tokenExpiration.ts
new file mode 100644
index 0000000000..a88ea1a9fd
--- /dev/null
+++ b/frontend/src/lib/tokenExpiration.ts
@@ -0,0 +1,25 @@
+/** Largest `max_token_expiration_days` read as a ceiling, about 2,700 years. Mirrors
+ * `MAX_TOKEN_EXPIRATION_DAYS_BOUND` in windmill-common. */
+export const MAX_TOKEN_EXPIRATION_DAYS_BOUND = 1_000_000
+
+/**
+ * The ceiling a stored `max_token_expiration_days` value sets, or `undefined` for none.
+ *
+ * Must accept exactly what `parse_max_token_expiration_days` (windmill-common) accepts: a whole
+ * number of days within the bound, stored as a JSON number or as a string of digits. Anything
+ * looser and the token form hides "No expiration" on an instance whose server caps nothing.
+ */
+export function parseMaxTokenExpirationDays(value: unknown): number | undefined {
+	const days =
+		typeof value === 'number'
+			? value
+			: typeof value === 'string' && /^[+-]?\d+$/.test(value.trim())
+				? Number(value.trim())
+				: undefined
+	return days !== undefined &&
+		Number.isInteger(days) &&
+		days >= 1 &&
+		days <= MAX_TOKEN_EXPIRATION_DAYS_BOUND
+		? days
+		: undefined
+}
diff --git a/frontend/src/lib/userDraftDbSyncer.svelte.ts b/frontend/src/lib/userDraftDbSyncer.svelte.ts
index 0e8257023d..e383213cfe 100644
--- a/frontend/src/lib/userDraftDbSyncer.svelte.ts
+++ b/frontend/src/lib/userDraftDbSyncer.svelte.ts
@@ -214,6 +214,13 @@ const syncLocked = new Map<string, (() => void) | undefined>()
  */
 const conflicts = new SvelteMap<string, DraftConflictInfo>()
 
+/**
+ * Per-key listeners fired when a save lands at a path other than the key's:
+ * the item was moved while the editor was open, and the server put the save
+ * where the move took its drafts. The editor follows too (see `onRelocated`).
+ */
+const relocationListeners = new Map<string, Set<(newPath: string) => void>>()
+
 /**
  * Draft keys whose last save threw (network / 5xx) → extracted error
  * message. Cleared on the next success. Drives the AutosaveIndicator's
@@ -333,6 +340,13 @@ async function postSave(opts: UserDraftDbSyncerSaveOpts): Promise<void> {
 		// cached state the same way an upsert does. Listener errors must never
 		// make a committed save read as failed.
 		notifyAnySaved({ workspace: opts.workspace, itemKind: opts.itemKind, path: opts.path })
+		// The item had moved and the write landed where its drafts went — a discard
+		// included, since the editor that sent it is on a path the item has left. Last,
+		// so the editor that reacts (by leaving this path) sees a settled key.
+		if (resp.path && resp.path !== opts.path) {
+			const listeners = relocationListeners.get(key)
+			if (listeners) for (const l of [...listeners]) l(resp.path)
+		}
 	} catch (e) {
 		console.error('UserDraftDbSyncer.save failed', e)
 		// Leave pending opts in place so the next attempt retries the same
@@ -614,6 +628,28 @@ export const UserDraftDbSyncer = {
 		conflicts.delete(draftKey(query.workspace, query.itemKind, query.path))
 	},
 
+	/**
+	 * Subscribe to saves for a draft key that landed at another path: the item
+	 * was moved while this editor was open. Fired with the path the save landed
+	 * at, after the save is fully accounted for. Returns an
+	 * unsubscribe.
+	 */
+	onRelocated(query: UserDraftLastSyncQuery, listener: (newPath: string) => void): () => void {
+		const key = draftKey(query.workspace, query.itemKind, query.path)
+		let set = relocationListeners.get(key)
+		if (!set) {
+			set = new Set()
+			relocationListeners.set(key, set)
+		}
+		set.add(listener)
+		return () => {
+			const s = relocationListeners.get(key)
+			if (!s) return
+			s.delete(listener)
+			if (s.size === 0) relocationListeners.delete(key)
+		}
+	},
+
 	/**
 	 * Force-save: bypass the `last_sync` check and overwrite the server row
 	 * (conflict modal's "Overwrite the remote"). Resolves once the key's save
@@ -687,5 +723,35 @@ export const UserDraftDbSyncer = {
 		const key = draftKey(query.workspace, query.itemKind, query.path)
 		pendingSaveOpts.delete(key)
 		debouncer.cancel(key)
+	},
+
+	/**
+	 * The value parked for this key, wrapped so a parked delete (`null`) stays distinguishable
+	 * from nothing parked at all. While a conflict stands this is the version the server refused,
+	 * which is to say this tab's own: an editor opening on the key takes it over the server's
+	 * draft, which is the version that did the refusing.
+	 */
+	peekPending(query: UserDraftLastSyncQuery): { value: unknown } | undefined {
+		const parked = pendingSaveOpts.get(draftKey(query.workspace, query.itemKind, query.path))
+		return parked ? { value: parked.value } : undefined
+	},
+
+	/**
+	 * Stop scheduling saves for this key and wait until nothing for it is still in flight.
+	 * Cancelling alone cannot stop a POST the runner already started, and such a POST settles
+	 * *after* the caller has moved on — a rejected one re-raising the conflict it was told to
+	 * resolve. Await this before installing a baseline that would make a stale payload acceptable.
+	 *
+	 * What is parked is deliberately left alone: a refused save keeps its payload here, and while
+	 * the conflict stands that is the only copy of the edit outside the editor's own memory. A
+	 * caller that gives up half way must leave it recoverable, so dropping it is the committing
+	 * caller's job, via `dropPending`, once it has something to replace it with.
+	 */
+	async quiesce(query: UserDraftLastSyncQuery): Promise<void> {
+		const key = draftKey(query.workspace, query.itemKind, query.path)
+		debouncer.cancel(key)
+		await runner.settled(key)
+		// A save that landed while we waited can have scheduled the next one.
+		debouncer.cancel(key)
 	}
 }
diff --git a/frontend/src/lib/userDraftQuiesce.test.ts b/frontend/src/lib/userDraftQuiesce.test.ts
new file mode 100644
index 0000000000..b6c38740da
--- /dev/null
+++ b/frontend/src/lib/userDraftQuiesce.test.ts
@@ -0,0 +1,126 @@
+import { describe, it, expect, afterEach, vi } from 'vitest'
+
+// Mocked so a test can hold a POST in flight: that window is the whole point of `quiesce`,
+// which exists to wait one out rather than return while it is still going.
+const updateDraft = vi.fn(async (..._args: any[]) => ({
+	status: 'saved' as const,
+	current_timestamp: '2020-01-01T00:00:00Z'
+}))
+
+vi.mock('./gen', () => ({
+	DraftService: { updateDraft: (...a: unknown[]) => updateDraft(...(a as [])) }
+}))
+vi.mock('./gen/core/OpenAPI', () => ({ OpenAPI: { BASE: '' } }))
+vi.mock('./localDraftHints.svelte', () => ({ setLocalDraftHint: vi.fn() }))
+
+import { UserDraftDbSyncer } from './userDraftDbSyncer.svelte'
+
+function deferred<T = void>() {
+	let resolve!: (v: T) => void
+	const promise = new Promise<T>((res) => (resolve = res))
+	return { promise, resolve }
+}
+
+afterEach(() => {
+	vi.clearAllMocks()
+	updateDraft.mockResolvedValue({ status: 'saved', current_timestamp: '2020-01-01T00:00:00Z' })
+})
+
+/**
+ * Resolving a draft conflict installs a fresh baseline. Anything of the old version still in the
+ * air when that lands would be made acceptable by it, and a rejected one re-raises the conflict
+ * just resolved — so the resolution waits for the key to go quiet first. What it must NOT do is
+ * discard the payload while waiting: a refused save keeps it here, and until the resolution
+ * commits it is the only copy of the edit outside the editor's own memory.
+ */
+describe('UserDraftDbSyncer.quiesce', () => {
+	it('waits for a save already in flight', async () => {
+		const q = { workspace: 'w', itemKind: 'variable' as const, path: 'u/me/quiesce_a' }
+		const inFlight = deferred()
+		let settledBeforeQuiesceReturned = false
+		updateDraft.mockImplementationOnce(async () => {
+			await inFlight.promise
+			settledBeforeQuiesceReturned = true
+			return { status: 'saved', current_timestamp: '2020-01-01T00:00:00Z' }
+		})
+
+		// In flight, not awaited: the POST is held open by the mock above.
+		const saving = UserDraftDbSyncer.save({ ...q, value: { v: 'in flight' }, immediate: true })
+
+		let quiesced = false
+		const quiescing = UserDraftDbSyncer.quiesce(q).then(() => (quiesced = true))
+		// A full macrotask, not a microtask: anything that merely yields would have resolved by
+		// now, so this is what tells "waited for the POST" apart from "waited for nothing".
+		await new Promise((r) => setTimeout(r, 0))
+		expect(quiesced).toBe(false)
+
+		inFlight.resolve()
+		await quiescing
+		await saving
+		expect(settledBeforeQuiesceReturned).toBe(true)
+	})
+
+	it('keeps a refused payload recoverable, until the resolution that replaces it says otherwise', async () => {
+		const q = { workspace: 'w', itemKind: 'variable' as const, path: 'u/me/quiesce_b' }
+		// Refused, so the payload stays parked — the state a conflict resolution starts from.
+		updateDraft.mockResolvedValueOnce({
+			status: 'conflict',
+			current_timestamp: '2020-01-02T00:00:00Z'
+		})
+		await UserDraftDbSyncer.save({ ...q, value: { v: 'refused' }, immediate: true })
+		expect(UserDraftDbSyncer.getConflict(q).conflict).toBeTruthy()
+
+		await UserDraftDbSyncer.quiesce(q)
+
+		// A resolution abandoned here (the editor closed while quiescing) must leave the edit
+		// somewhere it can still be sent. Flushing is how that payload is observed, since the
+		// parked opts themselves are private to the syncer.
+		updateDraft.mockClear()
+		await UserDraftDbSyncer.flush(q)
+		expect(updateDraft).toHaveBeenCalledTimes(1)
+		expect(updateDraft.mock.calls[0][0]).toMatchObject({ requestBody: { value: { v: 'refused' } } })
+
+		// Only the caller that has something to put in its place drops it.
+		UserDraftDbSyncer.dropPending(q)
+		updateDraft.mockClear()
+		await UserDraftDbSyncer.flush(q)
+		expect(updateDraft).not.toHaveBeenCalled()
+	})
+
+	it('keeps a parked delete distinguishable from nothing parked', async () => {
+		const q = { workspace: 'w', itemKind: 'variable' as const, path: 'u/me/quiesce_delete' }
+
+		expect(UserDraftDbSyncer.peekPending(q)).toBeUndefined()
+
+		// Reverting to the deployed value, or discarding, parks a delete. Refused, it stays
+		// parked — and a resolution reading it has to keep meaning "remove the row", not fall
+		// back to whatever the server holds.
+		updateDraft.mockResolvedValueOnce({
+			status: 'conflict',
+			current_timestamp: '2020-01-02T00:00:00Z'
+		})
+		await UserDraftDbSyncer.save({ ...q, value: null, immediate: true })
+
+		expect(UserDraftDbSyncer.peekPending(q)).toEqual({ value: null })
+	})
+
+	it('cancels a debounced autosave so it cannot displace the write that follows', async () => {
+		const q = { workspace: 'w', itemKind: 'variable' as const, path: 'u/me/quiesce_c' }
+		vi.useFakeTimers()
+		try {
+			// Debounced rather than immediate: this is the autosave a resolution has to call off, or
+			// it fires mid-resolution and, being conditional, is refused.
+			void UserDraftDbSyncer.save({ ...q, value: { v: 'queued' } })
+
+			await UserDraftDbSyncer.quiesce(q)
+			updateDraft.mockClear()
+
+			// Past the debouncer's 10s ceiling, so a schedule that survived has certainly fired.
+			// Real time would not reach it: the test would pass with the cancelling removed.
+			await vi.advanceTimersByTimeAsync(11000)
+			expect(updateDraft).not.toHaveBeenCalled()
+		} finally {
+			vi.useRealTimers()
+		}
+	})
+})
diff --git a/frontend/src/lib/utils.ts b/frontend/src/lib/utils.ts
index 512e5643a6..b90751b9d3 100644
--- a/frontend/src/lib/utils.ts
+++ b/frontend/src/lib/utils.ts
@@ -1442,6 +1442,7 @@ const CLEANED_VALUE_KEYS = new Set([
 	'draft_only',
 	'draft_saved_at',
 	'draft_created_at',
+	'draft_base',
 	'is_draft',
 	'other_drafts_users',
 	'created_at',
@@ -1676,6 +1677,8 @@ export type Item = {
 	iconColor?: string
 	/** Extra props for `icon`, for an icon that does not take lucide's `size`. */
 	iconProps?: Record<string, any>
+	customSubmenu?: import('svelte').Component<any>
+	customSubmenuProps?: Record<string, unknown>
 	href?: string
 	hrefTarget?: '_blank' | '_self' | '_parent' | '_top'
 	disabled?: boolean
diff --git a/frontend/src/lib/components/copilot/chat/safeHref.test.ts b/frontend/src/lib/utils/safeHref.test.ts
similarity index 100%
rename from frontend/src/lib/components/copilot/chat/safeHref.test.ts
rename to frontend/src/lib/utils/safeHref.test.ts
diff --git a/frontend/src/lib/components/copilot/chat/safeHref.ts b/frontend/src/lib/utils/safeHref.ts
similarity index 57%
rename from frontend/src/lib/components/copilot/chat/safeHref.ts
rename to frontend/src/lib/utils/safeHref.ts
index 3acdabb464..1d583fa2f7 100644
--- a/frontend/src/lib/components/copilot/chat/safeHref.ts
+++ b/frontend/src/lib/utils/safeHref.ts
@@ -1,10 +1,8 @@
 const SAFE_PROTOCOLS = ['http:', 'https:', 'mailto:']
 
 /**
- * The href a rendered markdown link may carry, or undefined for one that must be dropped.
- *
- * Markdown reaches the chat renderers from a model, and from another member for a shared
- * artifact, and `svelte-exmarkdown` passes `javascript:` and `data:` hrefs through untouched.
+ * The href a link built from untrusted content may carry, or undefined for one that must be
+ * dropped: `javascript:`, `data:` and any other non-navigating scheme.
  * Relative links resolve against `base` (the page), so they stay.
  */
 export function safeHref(href: string | undefined, base: string): string | undefined {
diff --git a/frontend/src/lib/utils_deployable.ts b/frontend/src/lib/utils_deployable.ts
index 7d517c3bb4..63ea88adcb 100644
--- a/frontend/src/lib/utils_deployable.ts
+++ b/frontend/src/lib/utils_deployable.ts
@@ -151,7 +151,10 @@ export async function getTriggersDeployData(
 	kind: TriggerKind,
 	path: string,
 	workspace: string,
-	onBehalfOf?: string
+	onBehalfOf?: string,
+	/** Root URL of the instance the trigger is deployed to, when that is not this one. A GCP or
+	 * Azure push subscription posts to the instance serving the trigger, so it has to name that one. */
+	targetBaseUrl?: string
 ) {
 	const preservePermissionedAs = onBehalfOf !== undefined
 
@@ -247,7 +250,9 @@ export async function getTriggersDeployData(
 			...gcpTrigger,
 			delivery_config: gcpTrigger.delivery_config ?? undefined,
 			base_endpoint:
-				gcpTrigger.delivery_type === 'push' ? `${window.location.origin}${base}` : undefined,
+				gcpTrigger.delivery_type === 'push'
+					? (targetBaseUrl ?? `${window.location.origin}${base}`)
+					: undefined,
 			permissioned_as: onBehalfOf,
 			preserve_permissioned_as: preservePermissionedAs
 		}
@@ -311,6 +316,11 @@ export async function getTriggersDeployData(
 		return {
 			data: {
 				...azureTrigger,
+				// Not stored on the trigger, but a push subscription is created from it.
+				base_endpoint:
+					azureTrigger.azure_mode === 'namespace_pull'
+						? undefined
+						: (targetBaseUrl ?? `${window.location.origin}${base}`),
 				permissioned_as: onBehalfOf,
 				preserve_permissioned_as: preservePermissionedAs
 			},
diff --git a/frontend/src/lib/utils_draft_deploy.test.ts b/frontend/src/lib/utils_draft_deploy.test.ts
index 4495155f24..5f503989c8 100644
--- a/frontend/src/lib/utils_draft_deploy.test.ts
+++ b/frontend/src/lib/utils_draft_deploy.test.ts
@@ -41,30 +41,26 @@ import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
 // fabricates) the "started from an older deployed version" warning.
 
 describe('draftBaseIsStale', () => {
-	it('script: stale iff the draft parent_hash differs from the deployed hash', () => {
-		expect(draftBaseIsStale('script', { hash: 'v2', draft: { parent_hash: 'v1' } })).toBe(true)
-		expect(draftBaseIsStale('script', { hash: 'v2', draft: { parent_hash: 'v2' } })).toBe(false)
+	it('script: stale iff draft_base differs from the deployed hash', () => {
+		expect(draftBaseIsStale('script', { hash: 'v2', draft_base: 'v1' })).toBe(true)
+		expect(draftBaseIsStale('script', { hash: 'v2', draft_base: 'v2' })).toBe(false)
 	})
 
-	it('script: no base pointer or no head → not stale (nothing to compare)', () => {
+	it('script: no base or no head → not stale (nothing to compare)', () => {
 		expect(draftBaseIsStale('script', { hash: 'v2', draft: {} })).toBe(false)
-		expect(draftBaseIsStale('script', { draft: { parent_hash: 'v1' } })).toBe(false)
+		expect(draftBaseIsStale('script', { draft_base: 'v1' })).toBe(false)
 	})
 
-	it('flow: compares the pinned version_id against the deployed head', () => {
-		expect(draftBaseIsStale('flow', { version_id: 7, draft: { version_id: 5 } })).toBe(true)
-		expect(draftBaseIsStale('flow', { version_id: 7, draft: { version_id: 7 } })).toBe(false)
-		expect(draftBaseIsStale('flow', { version_id: 7, draft: {} })).toBe(false)
+	it('flow: compares draft_base against the deployed version_id as text', () => {
+		expect(draftBaseIsStale('flow', { version_id: 7, draft_base: '5' })).toBe(true)
+		expect(draftBaseIsStale('flow', { version_id: 7, draft_base: '7' })).toBe(false)
+		expect(draftBaseIsStale('flow', { version_id: 7 })).toBe(false)
 	})
 
-	it('app/raw_app: compares parent_version against the last of versions', () => {
-		expect(draftBaseIsStale('app', { versions: [1, 2, 3], draft: { parent_version: 2 } })).toBe(
-			true
-		)
-		expect(draftBaseIsStale('raw_app', { versions: [1, 2, 3], draft: { parent_version: 3 } })).toBe(
-			false
-		)
-		expect(draftBaseIsStale('app', { versions: [], draft: { parent_version: 2 } })).toBe(false)
+	it('app/raw_app: compares draft_base against the last of versions', () => {
+		expect(draftBaseIsStale('app', { versions: [1, 2, 3], draft_base: '2' })).toBe(true)
+		expect(draftBaseIsStale('raw_app', { versions: [1, 2, 3], draft_base: '3' })).toBe(false)
+		expect(draftBaseIsStale('app', { versions: [], draft_base: '2' })).toBe(false)
 	})
 
 	it('no draft on the response → not stale', () => {
diff --git a/frontend/src/lib/utils_draft_deploy.ts b/frontend/src/lib/utils_draft_deploy.ts
index 0d121d0627..31b973f9a5 100644
--- a/frontend/src/lib/utils_draft_deploy.ts
+++ b/frontend/src/lib/utils_draft_deploy.ts
@@ -262,7 +262,7 @@ export async function getDraftDiffValues(
 	// draft-table row (e.g. a flow created via createFlow(draft_only: true), like
 	// `u/admin/new`). There `draft` is null, so the draft side must fall back to
 	// the row's own value — otherwise the diff "after" is empty and nothing shows.
-	// Strip overlay metadata (is_draft / draft_saved_at / no_deployed /
+	// Strip overlay metadata (is_draft / draft_saved_at / draft_base / no_deployed /
 	// other_drafts_users) from the deployed side so the diff doesn't show the
 	// per-user markers as noise.
 	if (kind === 'script') {
@@ -271,6 +271,7 @@ export async function getDraftDiffValues(
 			draft,
 			is_draft: _i,
 			draft_saved_at: _c,
+			draft_base: _b,
 			no_deployed,
 			other_drafts_users: _o,
 			hash: _h,
@@ -289,6 +290,7 @@ export async function getDraftDiffValues(
 			draft,
 			is_draft: _i,
 			draft_saved_at: _c,
+			draft_base: _b,
 			no_deployed,
 			other_drafts_users: _o,
 			version_id: _v,
@@ -369,24 +371,24 @@ export async function getDraftDiffValues(
 
 /**
  * Whether a draft's base is stale: the deployed version the draft forked from
- * no longer matches the current deployed head — a newer version was deployed
- * after the draft began, so deploying the draft would silently revert it.
- * Scripts compare the draft's `parent_hash` vs the deployed `hash`; flows the
- * pinned `version_id` vs the deployed head `version_id`; apps (incl. raw) the
- * pinned `parent_version` vs the head of `versions`. `r` is the item fetched
- * with `get_draft=true`; only script/flow/app kinds carry a base pointer.
+ * (`draft_base`, text whatever the kind) no longer matches the current deployed
+ * head — a newer version was deployed after the draft began, so deploying the
+ * draft would silently revert it. The head is the deployed `hash` for scripts,
+ * `version_id` for flows, the last of `versions` for apps (incl. raw). `r` is
+ * the item fetched with `get_draft=true`.
  */
 export function draftBaseIsStale(draftKind: UserDraftItemKind, r: any): boolean {
-	const draft = r?.draft
-	if (!draft) return false
-	if (draftKind === 'script') {
-		return !!r.hash && !!draft.parent_hash && draft.parent_hash !== r.hash
-	}
-	if (draftKind === 'flow') {
-		return r.version_id != null && draft.version_id != null && draft.version_id !== r.version_id
-	}
-	const head = Array.isArray(r.versions) ? r.versions[r.versions.length - 1] : undefined
-	return head != null && draft.parent_version != null && draft.parent_version !== head
+	const base = r?.draft_base
+	if (base == null) return false
+	const head =
+		draftKind === 'script'
+			? r.hash
+			: draftKind === 'flow'
+				? r.version_id
+				: Array.isArray(r.versions)
+					? r.versions[r.versions.length - 1]
+					: undefined
+	return head != null && String(head) !== base
 }
 
 /** Fetch-and-test wrapper over `draftBaseIsStale` for one draft item. Returns
diff --git a/frontend/src/lib/utils_workspace_deploy.ts b/frontend/src/lib/utils_workspace_deploy.ts
index 228e32fc06..d56c1f6541 100644
--- a/frontend/src/lib/utils_workspace_deploy.ts
+++ b/frontend/src/lib/utils_workspace_deploy.ts
@@ -362,6 +362,11 @@ export interface DeployItemParams {
 	 * between the two probes. The result then carries `conflict`.
 	 */
 	createOnly?: boolean
+	/**
+	 * Root URL of the instance `workspaceTo` lives on, when the deploy crosses instances. Only what
+	 * a payload must state about where it landed needs it — a GCP or Azure push trigger's endpoint.
+	 */
+	targetBaseUrl?: string
 }
 
 /**
@@ -380,7 +385,8 @@ export async function deployItem(
 		additionalInformation,
 		onBehalfOf,
 		onBehalfOfPrincipal,
-		createOnly
+		createOnly,
+		targetBaseUrl
 	} = params
 
 	if (kind === 'trigger') {
@@ -399,7 +405,8 @@ export async function deployItem(
 				additionalInformation.triggers.kind,
 				path,
 				workspaceFrom,
-				onBehalfOf
+				onBehalfOf,
+				targetBaseUrl
 			)
 			if (alreadyExists) {
 				// Strip operational state so the update doesn't flip the target's
@@ -796,33 +803,25 @@ export function deployPermissionForKinds(
 }
 
 /**
- * Whether the current user may deploy into `workspace`. Mirrors `check_deploy_rules` in
+ * The workspace's deploy-protection rules alone. Mirrors `check_deploy_rules` in
  * windmill-common so the UI can disable the action with a reason instead of letting the
  * click 403: `DisableDirectDeployment` is evaluated before `RestrictDeployToDeployers`, so
  * the same message wins here as on the server when both block; admins and superadmins bypass
  * both rules, while `wm_deployers` members bypass only the latter.
  *
- * The operator refusal is not part of that mirror. The server refuses operators in the item
- * handlers instead, and for fewer kinds, so refusing them for everything here is deliberately
- * stricter than the server rather than a faithful copy of it.
+ * Separate from `checkDeployPermission`, which adds a blanket operator refusal: the server
+ * refuses operators per kind, in the item handlers, not in these rules.
  *
  * Fails open on any error — the server still enforces on the actual deploy.
- * Shared by the session dock and the compare page so both gate identically.
  */
-export async function checkDeployPermission(
+export async function checkDeployRules(
 	workspace: string,
-	/** Pre-fetched `whoami` for `workspace`, to save a round trip when the caller already has one. */
-	whoami?: User
+	/** Pre-fetched identity for `workspace`, to save a round trip. Narrowed to the fields
+	 * read so a caller holding a `UserExt` can pass it without a cast. */
+	whoami?: Pick<User, 'is_admin' | 'is_super_admin' | 'username' | 'groups'>
 ): Promise<DeployPermission> {
 	try {
 		const me = whoami ?? (await UserService.whoami({ workspace }))
-		if (me.operator) {
-			return {
-				ok: false,
-				reason: "You're an operator in this workspace — operators can't deploy",
-				refusedBy: 'operator'
-			}
-		}
 		const userInfo = {
 			is_admin: !!me.is_admin,
 			is_super_admin: !!me.is_super_admin,
@@ -870,6 +869,36 @@ export async function checkDeployPermission(
 	}
 }
 
+/**
+ * Whether the current user may deploy into `workspace` at all: the protection rules above,
+ * plus a refusal of every operator.
+ *
+ * That refusal is not part of the `check_deploy_rules` mirror. The server refuses operators
+ * in the item handlers instead, and for fewer kinds, so refusing them for everything here is
+ * deliberately stricter than the server rather than a faithful copy of it. A caller mirroring
+ * one handler wants `checkDeployRules`.
+ *
+ * Shared by the session dock and the compare page so both gate identically.
+ */
+export async function checkDeployPermission(
+	workspace: string,
+	whoami?: Pick<User, 'operator' | 'is_admin' | 'is_super_admin' | 'username' | 'groups'>
+): Promise<DeployPermission> {
+	try {
+		const me = whoami ?? (await UserService.whoami({ workspace }))
+		if (me.operator) {
+			return {
+				ok: false,
+				reason: "You're an operator in this workspace — operators can't deploy",
+				refusedBy: 'operator'
+			}
+		}
+		return await checkDeployRules(workspace, me)
+	} catch {
+		return { ok: true }
+	}
+}
+
 /**
  * Whether `me` may write at `path` in `workspace` — the per-item half of the deploy gate, which
  * `checkDeployPermission`'s workspace-level rules don't cover. Advisory only: it exists so the UI
diff --git a/frontend/src/routes/(root)/(logged)/+layout.svelte b/frontend/src/routes/(root)/(logged)/+layout.svelte
index d14cd2c2dc..25d2fd156f 100644
--- a/frontend/src/routes/(root)/(logged)/+layout.svelte
+++ b/frontend/src/routes/(root)/(logged)/+layout.svelte
@@ -13,6 +13,7 @@
 	} from '$lib/gen'
 	import { capitalize, classNames, getModifierKey, sendUserToast } from '$lib/utils'
 	import { useLocalStorageValue } from '$lib/svelte5Utils.svelte'
+	import { isSessionPreviewFrame } from '$lib/components/sessions/sessionMode.svelte'
 	import WorkspaceMenu from '$lib/components/sidebar/WorkspaceMenu.svelte'
 	import SidebarContent from '$lib/components/sidebar/SidebarContent.svelte'
 	import SettingsMenu from '$lib/components/sidebar/SettingsMenu.svelte'
@@ -80,6 +81,7 @@
 	import { pruneMeaninglessDrafts } from '$lib/userDraftPrune'
 	import DraftMigrationErrorModal from '$lib/components/DraftMigrationErrorModal.svelte'
 	import InstanceBanner from '$lib/components/InstanceBanner.svelte'
+	import InstanceUiSync from '$lib/components/InstanceUiSync.svelte'
 	import { onDestroy, setContext, untrack } from 'svelte'
 	import { base } from '$app/paths'
 	import { Menubar } from '$lib/components/meltComponents'
@@ -89,7 +91,11 @@
 	import SessionModeSwitch from '$lib/components/sessions/SessionModeSwitch.svelte'
 	import { isGlobalAiEnabled } from '$lib/components/copilot/chat/global/gate'
 	import { copilotInfo } from '$lib/aiStore'
-	import { parsePreviewItemRoute } from '$lib/components/sessions/previewPaths'
+	import {
+		isPageItemListPath,
+		parsePreviewItemRoute,
+		stripBase
+	} from '$lib/components/sessions/previewPaths'
 	import { rememberNavRoute } from '$lib/components/sessions/sessionSwitch.svelte'
 	import { sessionState } from '$lib/components/sessions/sessionState.svelte'
 	import { restoreSessionBackups } from '$lib/components/sessions/sessionMirror.svelte'
@@ -139,13 +145,14 @@
 	let isCollapsed = $state(collapsePref.val)
 
 	// Resizable desktop rail, sized in REM so it scales with the root font-size the
-	// same way the old `w-52`/`w-12` classes did — `:root` jumps to 18px past 1760px
-	// wide (app.css), which grows the rem-based button content; a fixed-px rail would
+	// same way the old `w-52`/`w-12` classes did — `:root` jumps to 18px on screens
+	// ≥1760px (app.css), which grows the rem-based button content; a fixed-px rail would
 	// not grow with it and the content would overflow. SIDEBAR_MIN_REM is the default
-	// expanded width (the old w-52); the handle only resizes when expanded and only
-	// widens from there — collapsing is the toggle button's job, not the drag's.
+	// expanded width (the old w-52); the handle only widens from there. Dragging the
+	// pointer into the snap zone at the screen's left edge collapses the rail.
 	const SIDEBAR_MIN_REM = 13
 	const SIDEBAR_COLLAPSED_REM = 3
+	const SIDEBAR_SNAP_COLLAPSE_REM = 6
 	// Root font-size in px, used to convert the pointer's clientX (px) into rem.
 	function rootFontPx(): number {
 		if (!BROWSER) return 16
@@ -168,11 +175,14 @@
 	// Width (in rem) the content offset must track: the icon strip when collapsed,
 	// the user-chosen width otherwise.
 	let railWidth = $derived(isCollapsed ? SIDEBAR_COLLAPSED_REM : sidebarWidth)
-	// Width transition shared by the rail and the content offset: none for the whole
-	// drag (the rail tracks the pointer 1:1 and hits the min as a hard wall, no
-	// friction), a plain ease only for the collapse/expand toggle.
+	// True for one transition's length after a drag crosses the snap zone's edge, so
+	// the collapse/expand eases before the rail goes back to tracking the pointer.
+	let sidebarSnapping = $state(false)
+	let sidebarSnapTimer: ReturnType<typeof setTimeout> | undefined
+	// Width transition shared by the rail and the content offset: none while a drag
+	// tracks the pointer 1:1, a plain ease for the toggle and the snap.
 	let sidebarTransitionClass = $derived(
-		resizingSidebar ? '' : 'transition-all duration-200 ease-in-out'
+		resizingSidebar && !sidebarSnapping ? '' : 'transition-all duration-200 ease-in-out'
 	)
 	// Set while a drag is live so it can be torn down if the layout unmounts
 	// mid-drag (otherwise the window listeners would leak).
@@ -191,12 +201,22 @@
 			handle.setPointerCapture(e.pointerId)
 		} catch {}
 		resizingSidebar = true
+		// Re-expanding a snap-collapsed rail restores the width it had before the drag.
+		const widthAtStart = sidebarWidth
+		const collapsedAtStart = isCollapsed
 		// The rail is fixed at left:0, so the pointer's clientX is the width — in px.
-		// Convert to rem (the unit the rail is sized in) via the root font-size. Pure
-		// resize: clamp at the min so the rail stops there like a wall (dragging left
-		// never collapses — that's the toggle button's job).
+		// Convert to rem (the unit the rail is sized in) via the root font-size. The
+		// rail clamps at the min like a wall, until the pointer reaches the snap zone.
 		const onMove = (ev: PointerEvent) => {
-			sidebarWidth = Math.max(SIDEBAR_MIN_REM, ev.clientX / rootFontPx())
+			const x = ev.clientX / rootFontPx()
+			const collapse = x < SIDEBAR_SNAP_COLLAPSE_REM
+			if (collapse !== isCollapsed) {
+				isCollapsed = collapse
+				sidebarSnapping = true
+				clearTimeout(sidebarSnapTimer)
+				sidebarSnapTimer = setTimeout(() => (sidebarSnapping = false), 200)
+			}
+			sidebarWidth = collapse ? widthAtStart : Math.max(SIDEBAR_MIN_REM, x)
 		}
 		// pointercancel (and unmount, via onDestroy) must clear the state too, or
 		// `resizingSidebar` sticks true — the overlay and handle highlight stay up
@@ -204,7 +224,10 @@
 		const stop = () => {
 			if (!resizingSidebar) return
 			resizingSidebar = false
+			clearTimeout(sidebarSnapTimer)
+			sidebarSnapping = false
 			widthPref.val = sidebarWidth
+			if (isCollapsed !== collapsedAtStart) collapsePref.val = isCollapsed
 			window.removeEventListener('pointermove', onMove)
 			window.removeEventListener('pointerup', stop)
 			window.removeEventListener('pointercancel', stop)
@@ -355,17 +378,6 @@
 		}
 	}
 
-	// True when this window is a sessions-preview iframe (embedded + nomenubar,
-	// which the preview always sets and stickies — see the menu-hide block above).
-	function isSessionPreviewEmbed(): boolean {
-		if (!embedded) return false
-		try {
-			return sessionStorage.getItem('nomenubar_embedded') === 'true'
-		} catch {
-			return false
-		}
-	}
-
 	// A job-detail navigation (/run/<id>) inside a preview tab should open the job in
 	// a NEW tab rather than navigate the current tab away from its page (e.g. clicking
 	// a job in the Runs tab keeps Runs put and opens the run beside it). Returns the
@@ -412,7 +424,7 @@
 		// instead of booting a second, disconnected editor in this frame. Cancel so
 		// the heavy editor never mounts here at all. Runs before the apps_raw reload
 		// below so a raw-app editor promotes rather than full-reloading the iframe.
-		if (isSessionPreviewEmbed()) {
+		if (isSessionPreviewFrame()) {
 			const target = previewEditorTarget(navigation.to?.url)
 			if (target) {
 				navigation.cancel()
@@ -424,6 +436,21 @@
 				} catch {}
 				return
 			}
+			// A list page mounts in process too, where its rows open as tabs of their own.
+			const listUrl = navigation.to?.url
+			if (listUrl && isPageItemListPath(stripBase(listUrl.pathname))) {
+				navigation.cancel()
+				const u = new URL(listUrl.href)
+				u.searchParams.delete('nomenubar')
+				u.searchParams.delete('workspace')
+				try {
+					window.parent.postMessage(
+						{ type: 'wm.session.openList', href: u.pathname + u.search + u.hash },
+						window.location.origin
+					)
+				} catch {}
+				return
+			}
 			const runTarget = previewRunTarget(navigation.to?.url)
 			if (runTarget) {
 				navigation.cancel()
@@ -1168,22 +1195,19 @@
 							class="flex-1 flex flex-col min-h-0 h-screen shadow-[inset_-1px_0_0_0_rgb(var(--color-border-light))] dark:shadow-[inset_-1px_0_0_0_#374151] [html.github-dark_&]:shadow-[inset_-1px_0_0_0_rgb(var(--color-border-light))]"
 							style:background-color={darkMode ? SIDEBAR_BG_DARK : SIDEBAR_BG}
 						>
-							{#if !isCollapsed}
-								<!-- Resize handle straddling the right edge, only while expanded:
-								     drag to widen (clamped at the min). Collapsing is the toggle
-								     button's job. -->
-								<div
-									role="separator"
-									aria-orientation="vertical"
-									aria-label="Resize sidebar"
-									title="Drag to resize"
-									class={classNames(
-										'absolute inset-y-0 -right-0.5 w-1.5 cursor-col-resize z-50 transition-colors',
-										resizingSidebar ? '' : 'hover:bg-surface-hover'
-									)}
-									onpointerdown={startSidebarResize}
-								></div>
-							{/if}
+							<!-- Resize handle straddling the right edge: drag to resize, into the
+							     left snap zone to collapse, or out of it to expand. -->
+							<div
+								role="separator"
+								aria-orientation="vertical"
+								aria-label="Resize sidebar"
+								title="Drag to resize"
+								class={classNames(
+									'absolute inset-y-0 -right-0.5 w-1.5 cursor-col-resize z-50 transition-colors',
+									resizingSidebar ? '' : 'hover:bg-surface-hover'
+								)}
+								onpointerdown={startSidebarResize}
+							></div>
 							<!-- Workspace picker as the sidebar header (replaces the Windmill logo).
 							     Kept in both modes: it scopes which workspace family's sessions
 							     the sessions sidebar shows. -->
@@ -1414,11 +1438,13 @@
 			</div>
 		{/if}
 		<div class="flex flex-col h-full w-full">
-			{#if isCloudHosted() && !menuHidden}
-				<!-- Announcements are a managed-cloud operations tool, so the component never
-				     mounts elsewhere: no fetch, no poll, no listener on a self-hosted instance.
-				     Also skipped when the menu is hidden — that is an embed or an OAuth
-				     callback, where the announcement would land inside someone else's page. -->
+			<!-- Not gated on `$enterpriseLicense`: it paints the cached accent before the license
+			     resolves, and checks the license itself. -->
+			<InstanceUiSync />
+			{#if $enterpriseLicense && !menuHidden}
+				<!-- Announcements are an EE feature, so the component never mounts on CE. Also
+				     skipped when the menu is hidden — that is an embed or an OAuth callback,
+				     where the announcement would land inside someone else's page. -->
 				<InstanceBanner />
 			{/if}
 			{#if $userStore?.is_service_account}
diff --git a/frontend/src/routes/(root)/(logged)/amqp_triggers/+page.svelte b/frontend/src/routes/(root)/(logged)/amqp_triggers/+page.svelte
index 360defa995..8a21a3a61f 100644
--- a/frontend/src/routes/(root)/(logged)/amqp_triggers/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/amqp_triggers/+page.svelte
@@ -1,570 +1,5 @@
 <script lang="ts">
-	import { getLocalDraftHint } from '$lib/localDraftHints.svelte'
-	import { run } from 'svelte/legacy'
-
-	import {
-		AmqpTriggerService,
-		WorkspaceService,
-		type AmqpTrigger,
-		type TriggerMode,
-		type WorkspaceDeployUISettings
-	} from '$lib/gen'
-	import {
-		canWrite,
-		capitalize,
-		displayDate,
-		getLocalSetting,
-		sendUserToast,
-		storeLocalSetting,
-		removeTriggerKindIfUnused
-	} from '$lib/utils'
-	import { withForkConflictRetry } from '$lib/utils/forkConflict'
-	import { base } from '$app/paths'
-	import { page } from '$app/stores'
-	import CenteredPage from '$lib/components/CenteredPage.svelte'
-	import { Alert, Badge, Button, EmptyState, Skeleton } from '$lib/components/common'
-	import Dropdown from '$lib/components/DropdownV2.svelte'
-	import PageHeader from '$lib/components/PageHeader.svelte'
-	import SharedBadge from '$lib/components/SharedBadge.svelte'
-	import DraftBadge from '$lib/components/DraftBadge.svelte'
-	import ShareModal from '$lib/components/ShareModal.svelte'
-	import Toggle from '$lib/components/Toggle.svelte'
-	import { enterpriseLicense, usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
-	import { Code, Eye, Pen, Plus, Shield, Trash, Circle, FileUp, Pause } from 'lucide-svelte'
-	import { goto } from '$lib/navigation'
-	import SearchItems from '$lib/components/SearchItems.svelte'
-	import NoItemFound from '$lib/components/home/NoItemFound.svelte'
-	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
-	import ListFilters from '$lib/components/home/ListFilters.svelte'
-	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
-	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
-	import { setQuery } from '$lib/navigation'
-	import { onDestroy, onMount } from 'svelte'
-	import Popover from '$lib/components/Popover.svelte'
-	import { isCloudHosted } from '$lib/cloud'
-	import AmqpTriggerEditor from '$lib/components/triggers/amqp/AmqpTriggerEditor.svelte'
-	import AmqpIcon from '$lib/components/icons/AmqpIcon.svelte'
-	import { ALL_DEPLOYABLE, isDeployable } from '$lib/utils_deployable'
-	import DeployWorkspaceDrawer from '$lib/components/DeployWorkspaceDrawer.svelte'
-	import TriggerModeToggle from '$lib/components/triggers/TriggerModeToggle.svelte'
-
-	type TriggerM = AmqpTrigger & { canWrite: boolean }
-
-	let triggers: TriggerM[] = $state([])
-	let shareModal: ShareModal | undefined = $state()
-	let loading = $state(true)
-	let deploymentDrawer: DeployWorkspaceDrawer | undefined = $state()
-	let deployUiSettings: WorkspaceDeployUISettings | undefined = $state(undefined)
-
-	async function getDeployUiSettings() {
-		if (!$enterpriseLicense) {
-			deployUiSettings = ALL_DEPLOYABLE
-			return
-		}
-		let settings = await WorkspaceService.getPublicSettings({ workspace: $workspaceStore! })
-		deployUiSettings = settings.deploy_ui ?? ALL_DEPLOYABLE
-	}
-	getDeployUiSettings()
-
-	async function loadTriggers(): Promise<void> {
-		triggers = (
-			await AmqpTriggerService.listAmqpTriggers({
-				workspace: $workspaceStore!,
-				includeDraftOnly: true
-			})
-		).map((x) => {
-			return { canWrite: canWrite(x.path, x.extra_perms!, $userStore), ...x }
-		})
-		$usedTriggerKinds = removeTriggerKindIfUnused(triggers.length, 'amqp', $usedTriggerKinds)
-		loading = false
-	}
-
-	let interval = setInterval(async () => {
-		try {
-			const newTriggers = await AmqpTriggerService.listAmqpTriggers({
-				workspace: $workspaceStore!
-			})
-			for (let i = 0; i < triggers.length; i++) {
-				const newTrigger = newTriggers.find((x) => x.path === triggers[i].path)
-				if (newTrigger) {
-					triggers[i] = {
-						...triggers[i],
-						error: newTrigger.error,
-						last_server_ping: newTrigger.last_server_ping,
-						mode: newTrigger.mode,
-						server_id: newTrigger.server_id
-					}
-				}
-			}
-		} catch (err) {
-			console.error(err)
-		}
-	}, 5000)
-
-	onDestroy(() => {
-		clearInterval(interval)
-	})
-
-	async function onToggleMode(path: string, mode: TriggerMode): Promise<boolean> {
-		let committed = false
-		try {
-			const ok = await withForkConflictRetry(
-				(force) =>
-					AmqpTriggerService.setAmqpTriggerMode({
-						path,
-						workspace: $workspaceStore!,
-						requestBody: { mode, force }
-					}),
-				'AMQP trigger'
-			)
-			if (ok) {
-				sendUserToast(`${capitalize(mode)} AMQP trigger ${path}`)
-				loadTriggers()
-			}
-			committed = ok
-		} catch (err) {
-			sendUserToast(
-				`Cannot ${mode === 'enabled' ? 'enable' : mode === 'disabled' ? 'disable' : 'suspend'} amqp trigger: ${err.body}`,
-				true
-			)
-			loadTriggers()
-		}
-		return committed
-	}
-
-	run(() => {
-		if ($workspaceStore && $userStore) {
-			loadTriggers()
-		}
-	})
-	let amqpTriggerEditor: AmqpTriggerEditor | undefined = $state()
-
-	let hashHandled = false
-	$effect(() => {
-		if (!hashHandled && triggers.length > 0 && amqpTriggerEditor) {
-			let hash = $page.url.hash
-			if (hash.length > 1) {
-				let path = hash.slice(1)
-				let trigger = triggers.find((t) => t.path === path)
-				if (trigger) {
-					hashHandled = true
-					amqpTriggerEditor?.openEdit(path, trigger.is_flow)
-				}
-			}
-		}
-	})
-
-	let filteredItems: (TriggerM & { marked?: any })[] | undefined = $state([])
-	let items: typeof filteredItems | undefined = $state([])
-	let preFilteredItems: typeof filteredItems | undefined = $state([])
-	let filter = $state('')
-	let ownerFilter: string | undefined = $state(undefined)
-	let nbDisplayed = $state(15)
-
-	const TRIGGER_PATH_KIND_FILTER_SETTING = 'filter_path_of'
-	const FILTER_USER_FOLDER_SETTING_NAME = 'user_and_folders_only'
-	let selectedFilterKind = $state(
-		(getLocalSetting(TRIGGER_PATH_KIND_FILTER_SETTING) as 'trigger' | 'script_flow') ?? 'trigger'
-	)
-	let filterUserFolders = $state(getLocalSetting(FILTER_USER_FOLDER_SETTING_NAME) == 'true')
-
-	run(() => {
-		storeLocalSetting(TRIGGER_PATH_KIND_FILTER_SETTING, selectedFilterKind)
-	})
-	run(() => {
-		storeLocalSetting(FILTER_USER_FOLDER_SETTING_NAME, filterUserFolders ? 'true' : undefined)
-	})
-
-	function filterItemsPathsBaseOnUserFilters(
-		item: TriggerM,
-		selectedFilterKind: 'trigger' | 'script_flow',
-		filterUserFolders: boolean
-	) {
-		if ($workspaceStore == 'admins') return true
-		if (filterUserFolders) {
-			if (selectedFilterKind === 'trigger') {
-				return (
-					!item.path.startsWith('u/') || item.path.startsWith('u/' + $userStore?.username + '/')
-				)
-			} else {
-				return (
-					!item.script_path.startsWith('u/') ||
-					item.script_path.startsWith('u/' + $userStore?.username + '/')
-				)
-			}
-		} else {
-			return true
-		}
-	}
-
-	run(() => {
-		preFilteredItems =
-			ownerFilter != undefined
-				? selectedFilterKind === 'trigger'
-					? triggers?.filter(
-							(x) =>
-								x.path.startsWith(ownerFilter + '/') &&
-								filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-						)
-					: triggers?.filter(
-							(x) =>
-								x.script_path.startsWith(ownerFilter + '/') &&
-								filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-						)
-				: triggers?.filter((x) =>
-						filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-					)
-	})
-
-	run(() => {
-		if ($workspaceStore) {
-			ownerFilter = undefined
-		}
-	})
-
-	let owners = $derived(
-		selectedFilterKind === 'trigger'
-			? Array.from(
-					new Set(filteredItems?.map((x) => x.path.split('/').slice(0, 2).join('/')) ?? [])
-				).sort()
-			: Array.from(
-					new Set(filteredItems?.map((x) => x.script_path.split('/').slice(0, 2).join('/')) ?? [])
-				).sort()
-	)
-
-	run(() => {
-		items = filter !== '' ? filteredItems : preFilteredItems
-	})
-
-	function updateQueryFilters(selectedFilterKind, filterUserFolders) {
-		setQuery(
-			TRIGGER_PATH_KIND_FILTER_SETTING,
-			selectedFilterKind,
-			window.location.hash || undefined
-		).then(() => {
-			setQuery(
-				FILTER_USER_FOLDER_SETTING_NAME,
-				String(filterUserFolders),
-				window.location.hash || undefined
-			)
-		})
-	}
-
-	function loadQueryFilters() {
-		let url = new URL(window.location.href)
-		let queryFilterKind = url.searchParams.get(TRIGGER_PATH_KIND_FILTER_SETTING)
-		let queryFilterUserFolders = url.searchParams.get(FILTER_USER_FOLDER_SETTING_NAME)
-		if (queryFilterKind) {
-			selectedFilterKind = queryFilterKind as 'trigger' | 'script_flow'
-		}
-		if (queryFilterUserFolders) {
-			filterUserFolders = queryFilterUserFolders == 'true'
-		}
-	}
-
-	onMount(() => {
-		loadQueryFilters()
-	})
-
-	run(() => {
-		updateQueryFilters(selectedFilterKind, filterUserFolders)
-	})
+	import TriggerList from '$lib/components/triggers/TriggerList.svelte'
 </script>
 
-<DeployWorkspaceDrawer bind:this={deploymentDrawer} />
-<AmqpTriggerEditor onUpdate={loadTriggers} bind:this={amqpTriggerEditor} />
-
-<SearchItems
-	{filter}
-	items={preFilteredItems}
-	bind:filteredItems
-	f={(x) => (x.summary ?? '') + ' ' + x.path + ' (' + x.script_path + ')'}
-/>
-
-<CenteredPage>
-	<PageHeader
-		title="AMQP triggers"
-		tooltip="Windmill can connect to an AMQP broker, subscribe to specific topics, and trigger scripts or flows based on those topics."
-	>
-		<Button
-			unifiedSize="md"
-			variant="accent"
-			startIcon={{ icon: Plus }}
-			on:click={() => amqpTriggerEditor?.openNew(false)}
-		>
-			New&nbsp;AMQP trigger
-		</Button>
-	</PageHeader>
-
-	{#if isCloudHosted()}
-		<Alert title="Not compatible with multi-tenant cloud" type="warning">
-			AMQP triggers are disabled in the multi-tenant cloud.
-		</Alert>
-		<div class="py-4"></div>
-	{/if}
-	<div class="w-full h-full flex flex-col">
-		<div class="w-full pb-4 pt-6">
-			<input
-				type="text"
-				placeholder="Search AMQP triggers"
-				bind:value={filter}
-				class="search-item"
-			/>
-			<div class="flex flex-row items-center gap-2 mt-6">
-				<div class="text-sm shrink-0"> Filter by path of </div>
-				<ToggleButtonGroup bind:selected={selectedFilterKind}>
-					{#snippet children({ item })}
-						<ToggleButton value="trigger" label="AMQP trigger" icon={AmqpIcon} {item} />
-						<ToggleButton value="script_flow" label="Script/Flow" icon={Code} {item} />
-					{/snippet}
-				</ToggleButtonGroup>
-			</div>
-			<ListFilters syncQuery bind:selectedFilter={ownerFilter} filters={owners} />
-
-			<div class="flex flex-row items-center justify-end gap-4">
-				{#if $userStore?.is_super_admin && $userStore.username.includes('@')}
-					<Toggle size="xs" bind:checked={filterUserFolders} options={{ right: 'Only f/*' }} />
-				{:else if $userStore?.is_admin || $userStore?.is_super_admin}
-					<Toggle
-						size="xs"
-						bind:checked={filterUserFolders}
-						options={{ right: `Only u/${$userStore.username} and f/*` }}
-					/>
-				{/if}
-			</div>
-		</div>
-		{#if loading}
-			{#each new Array(6) as _}
-				<Skeleton layout={[[6], 0.4]} />
-			{/each}
-		{:else if !triggers?.length}
-			<EmptyState
-				icon={AmqpIcon}
-				title="No AMQP triggers yet"
-				description="Windmill can connect to an AMQP broker, subscribe to specific topics, and trigger scripts or flows based on those topics."
-				action={{
-					label: 'Add an AMQP trigger',
-					icon: Plus,
-					onClick: () => amqpTriggerEditor?.openNew(false),
-					aiId: 'amqp-triggers-empty-add',
-					aiDescription: 'Add AMQP trigger'
-				}}
-			/>
-		{:else if items?.length}
-			<div class="border rounded-md divide-y">
-				{#each items.slice(0, nbDisplayed) as { path, edited_by, edited_at, script_path, is_flow, extra_perms, canWrite, error, last_server_ping, server_id, mode, retry, error_handler_path, error_handler_args, labels, draft_only, is_draft } (path)}
-					{@const hasDraft = getLocalDraftHint($workspaceStore, 'trigger_amqp', path) ?? is_draft}
-					{@const href = `${is_flow ? '/flows/get' : '/scripts/get'}/${script_path}`}
-					{@const ping = last_server_ping ? new Date(last_server_ping) : undefined}
-					{@const pinging = ping && ping.getTime() > new Date().getTime() - 15 * 1000}
-					{@const effectiveMode = draft_only ? 'disabled' : mode}
-					{@const enabled = effectiveMode === 'enabled' || effectiveMode === 'suspended'}
-
-					<div
-						class="hover:bg-surface-hover w-full items-center px-4 py-2 gap-4 first-of-type:!border-t-0
-				first-of-type:rounded-t-md last-of-type:rounded-b-md flex flex-col"
-					>
-						<div class="w-full flex gap-5 items-center">
-							<RowIcon kind={is_flow ? 'flow' : 'script'} />
-
-							<a
-								href="#{path}"
-								onclick={() => amqpTriggerEditor?.openEdit(path, is_flow)}
-								class="min-w-0 grow hover:underline decoration-gray-400"
-							>
-								<div class="text-emphasis font-semibold text-xs truncate text-left">
-									{path}{hasDraft ? '*' : ''}
-								</div>
-								<div class="text-secondary text-xs truncate text-left font-light">
-									runnable: {script_path}
-								</div>
-							</a>
-
-							<div class="hidden lg:flex flex-row gap-1 items-center">
-								<SharedBadge {canWrite} extraPerms={extra_perms} />
-								{#if labels?.length}
-									{#each labels as label}
-										<Badge color="blue" small class="px-1" title="Label: {label}">{label}</Badge>
-									{/each}
-								{/if}
-							</div>
-
-							<div class="w-10">
-								{#if (enabled && (!pinging || error)) || (!enabled && error) || (enabled && !server_id)}
-									<Popover notClickable>
-										<span class="flex h-4 w-4">
-											<Circle
-												class="text-red-600 animate-ping absolute inline-flex fill-current"
-												size={12}
-											/>
-											<Circle class="text-red-600 relative inline-flex fill-current" size={12} />
-										</span>
-										{#snippet text()}
-											<div>
-												{#if enabled}
-													{#if !server_id}
-														AMQP trigger is starting...
-													{:else}
-														AMQP trigger is not connected{error ? ': ' + error : ''}
-													{/if}
-												{:else}
-													AMQP trigger was disabled because of an error: {error}
-												{/if}
-											</div>
-										{/snippet}
-									</Popover>
-								{:else if enabled}
-									<Popover notClickable>
-										<span class="flex h-4 w-4">
-											<Circle class="text-green-600 relative inline-flex fill-current" size={12} />
-										</span>
-										{#snippet text()}
-											<div>
-												AMQP trigger is connected{!server_id ? ' (shutting down...)' : ''}
-											</div>
-										{/snippet}
-									</Popover>
-								{/if}
-							</div>
-
-							<div class="flex items-center justify-end gap-2 shrink-0 min-w-[8rem]">
-								<DraftBadge {draft_only} is_draft={hasDraft} />
-								<TriggerModeToggle
-									disabled={draft_only}
-									title={draft_only
-										? 'Draft only: deploy the trigger to enable it'
-										: hasDraft
-											? 'Enables/disables the deployed trigger; the draft is not affected'
-											: undefined}
-									onToggleMode={(newMode) => onToggleMode(path, newMode)}
-									triggerMode={effectiveMode}
-									includeModalConfig={{
-										triggerPath: path,
-										triggerKind: 'amqp',
-										runnableConfig: {
-											path: script_path,
-											kind: is_flow ? 'flow' : 'script',
-											retry,
-											errorHandlerPath: error_handler_path,
-											errorHandlerArgs: error_handler_args
-										}
-									}}
-									{canWrite}
-									hideToggleLabels
-									hideDropdown
-								/>
-							</div>
-
-							<div class="flex gap-2 items-center justify-end">
-								<Button
-									on:click={() => amqpTriggerEditor?.openEdit(path, is_flow)}
-									unifiedSize="md"
-									startIcon={canWrite
-										? { icon: Pen }
-										: {
-												icon: Eye
-											}}
-									variant="subtle"
-								>
-									{canWrite ? 'Edit' : 'View'}
-								</Button>
-								<Dropdown
-									items={[
-										{
-											displayName: `View ${is_flow ? 'Flow' : 'Script'}`,
-											icon: Eye,
-											action: () => {
-												goto(href)
-											}
-										},
-										...(canWrite && !draft_only && mode !== 'suspended'
-											? [
-													{
-														displayName: 'Suspend job execution',
-														icon: Pause,
-														action: () => {
-															onToggleMode(path, 'suspended')
-														}
-													}
-												]
-											: []),
-										{
-											displayName: canWrite ? 'Edit' : 'View',
-											icon: canWrite ? Pen : Eye,
-											action: () => {
-												amqpTriggerEditor?.openEdit(path, is_flow)
-											}
-										},
-										...(isDeployable('trigger', path, deployUiSettings)
-											? [
-													{
-														displayName: 'Deploy to prod/staging',
-														icon: FileUp,
-														action: () => {
-															deploymentDrawer?.openDrawer(path, 'trigger', {
-																triggers: {
-																	kind: 'amqp'
-																}
-															})
-														}
-													}
-												]
-											: []),
-										{
-											displayName: 'Audit logs',
-											icon: Eye,
-											href: `${base}/audit_logs?resource=${path}`
-										},
-										{
-											displayName: 'Permissions',
-											icon: Shield,
-											action: () => {
-												shareModal?.openDrawer(path, 'amqp_trigger')
-											}
-										},
-										{
-											displayName: 'Delete',
-											type: 'delete',
-											icon: Trash,
-											disabled: !canWrite,
-											action: async () => {
-												await AmqpTriggerService.deleteAmqpTrigger({
-													workspace: $workspaceStore ?? '',
-													path
-												})
-												loadTriggers()
-											}
-										}
-									]}
-								/>
-							</div>
-						</div>
-						<div class="w-full flex justify-between items-baseline">
-							<div
-								class="flex flex-wrap text-[0.7em] text-primary gap-1 items-center justify-end truncate pr-2"
-								>{#if edited_by}<div class="truncate">edited by {edited_by}</div>{/if}<div
-									class="truncate">{edited_by ? 'the ' : ''}{displayDate(edited_at)}</div
-								></div
-							></div
-						>
-					</div>
-				{/each}
-			</div>
-		{:else}
-			<NoItemFound />
-		{/if}
-	</div>
-	{#if items && items?.length > 15 && nbDisplayed < items.length}
-		<span class="text-xs"
-			>{nbDisplayed} items out of {items.length}
-			<button class="ml-4" onclick={() => (nbDisplayed += 30)}>load 30 more</button></span
-		>
-	{/if}
-</CenteredPage>
-
-<ShareModal
-	bind:this={shareModal}
-	on:change={() => {
-		loadTriggers()
-	}}
-/>
+<TriggerList triggerKind="amqp" />
diff --git a/frontend/src/routes/(root)/(logged)/apps/edit/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/apps/edit/[...path]/+page.svelte
index 4490f70f39..e81dfb9e90 100644
--- a/frontend/src/routes/(root)/(logged)/apps/edit/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/apps/edit/[...path]/+page.svelte
@@ -51,8 +51,9 @@
 	let deployedAt = $state<string | undefined>(undefined)
 	// The app_version the draft was forked from (pinned), + the deployed head, for
 	// the precise staleness check in DraftEditorModals (vs the drifting timestamp).
-	let draftBaseVersion = $state<number | undefined>(undefined)
-	let deployedHeadVersion = $state<number | undefined>(undefined)
+	let draftBaseVersion = $state<string | undefined>(undefined)
+	let deployedHeadVersion = $state<string | undefined>(undefined)
+	let deployedBy = $state<string | undefined>(undefined)
 
 	/** Increments per `loadApp` call. Stale loads (e.g. when picker
 	 * navigation races a draft-discard reload) bail at the next checkpoint
@@ -90,6 +91,7 @@
 			// reused route and falsely trip the stale-draft modal.
 			draftBaseVersion = undefined
 			deployedHeadVersion = undefined
+			deployedBy = undefined
 			// Brand-new app: no deployed baseline, so never discard-on-equal.
 			deployedBaseline = undefined
 			const templatePath = page.url.searchParams.get('template')
@@ -274,13 +276,15 @@
 		// `no_deployed` — no baseline to be older than.
 		draftSavedAt = backendApp.draft_saved_at as string | undefined
 		deployedAt = backendApp.no_deployed ? undefined : (backendApp.created_at as string | undefined)
-		// `parent_version` rides on the persisted draft (pinned at fork); undefined
-		// for a pre-feature draft. Head = the last entry of the deployed `versions`.
-		draftBaseVersion = savedDraftApp?.parent_version
-		deployedHeadVersion =
+		deployedBy = backendApp.no_deployed ? undefined : (backendApp.created_by as string | undefined)
+		// The app_version the draft forked from; undefined for a draft never forked
+		// from a deploy. Head = the last entry of the deployed `versions`.
+		draftBaseVersion = backendApp.draft_base
+		const headVersion =
 			backendApp.no_deployed || !backendApp.versions
 				? undefined
 				: backendApp.versions[backendApp.versions.length - 1]
+		deployedHeadVersion = headVersion != null ? String(headVersion) : undefined
 		const backendApp_ = structuredClone(stateSnapshot(backendApp))
 		savedApp = {
 			summary: backendApp_.summary,
@@ -303,6 +307,11 @@
 		}
 		if (pendingLoad) {
 			backendApp = { ...backendApp, value: pendingLoad.value as App } as typeof backendApp
+			// Their draft's base, not ours: the prompt and the deploy guard read it, and
+			// deploying their content on our base would claim a version it never forked
+			// from. See /scripts/edit.
+			const theirs = (pendingLoad.value as App)?.parent_version
+			draftBaseVersion = theirs != null ? String(theirs) : undefined
 			if (hasOwnDraft) {
 				// AppEditor `migrateApp`s the value in place on mount (see its
 				// `migratedDeployedBaseline`), so the draft cell settles to the
@@ -330,7 +339,8 @@
 		// draft value. An existing own draft already carries it (preserved by the
 		// value swap above). `parent_version` is in DRAFT_COMPARE_IGNORED_FIELDS, so it
 		// never trips the autosave no-op / "unsaved changes" comparison.
-		if (!hasOwnDraft && !backendApp.no_deployed && backendApp.value) {
+		// Not after loading a teammate's draft either: that value carries their base.
+		if (!hasOwnDraft && !pendingLoad && !backendApp.no_deployed && backendApp.value) {
 			const versions = (backendApp as { versions?: number[] }).versions
 			const head = Array.isArray(versions) ? versions[versions.length - 1] : undefined
 			if (head != null) (backendApp.value as App).parent_version = head
@@ -444,6 +454,7 @@
 	{deployedAt}
 	{draftBaseVersion}
 	{deployedHeadVersion}
+	{deployedBy}
 	onLoadLatestDeploy={async () => {
 		if (!$workspaceStore) return
 		await runResetToDeployed({
@@ -484,6 +495,26 @@
 				{loadedFromDraft}
 				othersDraftsCount={otherDraftsUsers.length}
 				onOpenOthersDrafts={() => (othersModalOpen = true)}
+				onDeploy={({ version, head, headBy, headAt }) => {
+					// The editor stays open across a deploy and pins what it wrote onto the value
+					// itself. Keep that as the prompt's base while this deploy is the head, so
+					// the pair still describes the draft the next edit starts; a raced deploy
+					// leaves it unknown, or the pair would differ and open the prompt on the
+					// draft this deploy consumed.
+					draftBaseVersion = version != null && version === head ? String(version) : undefined
+					draftSavedAt = undefined
+					if (head != null) {
+						// Named by whoever deployed the head, not by the page load's author.
+						deployedHeadVersion = String(head)
+						deployedBy = headBy
+						deployedAt = headAt
+					}
+					// Another deploy landed on top of this one: there is no draft for the prompt
+					// to talk about, so say what happened instead.
+					if (version != null && head != null && version !== head) {
+						sendUserToast(`Version ${head} was deployed on top of yours (${version})`)
+					}
+				}}
 			/>
 		</div>
 	{/if}
diff --git a/frontend/src/routes/(root)/(logged)/apps_raw/edit/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/apps_raw/edit/[...path]/+page.svelte
index 78483c327a..769cfcb14f 100644
--- a/frontend/src/routes/(root)/(logged)/apps_raw/edit/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/apps_raw/edit/[...path]/+page.svelte
@@ -47,6 +47,9 @@
 		/** User-typed path the home list renders, set only when it differs
 		 *  from the deployed/seeded `savedApp.path`. */
 		draft_path?: string
+		/** The app_version the draft forked from; the server derives `draft.base`
+		 *  from it. */
+		parent_version?: number
 	}
 
 	let files: Record<string, string> | undefined = $state(undefined)
@@ -122,6 +125,7 @@
 			summary,
 			policy,
 			custom_path: savedApp?.custom_path,
+			parent_version: parentVersion,
 			// Persist the typed path as `draft_path` only when it actually differs
 			// from the current path — a `draft_path` equal to the baseline is a
 			// no-op that would block the draft from deduping against the deployed
@@ -165,6 +169,14 @@
 	let othersModalOpen = $state(false)
 	let draftSavedAt = $state<string | undefined>(undefined)
 	let deployedAt = $state<string | undefined>(undefined)
+	// The app_version the draft forked from, and the deployed head, for the exact
+	// staleness check (vs the drifting timestamps). `parentVersion` is what the
+	// bundle carries: an own draft keeps the version it forked from; a fresh
+	// checkout forks from the head.
+	let parentVersion = $state<number | undefined>(undefined)
+	let draftBaseVersion = $state<string | undefined>(undefined)
+	let deployedHeadVersion = $state<string | undefined>(undefined)
+	let deployedBy = $state<string | undefined>(undefined)
 	async function loadApp(opts: { getDraft?: boolean } = {}): Promise<void> {
 		const getDraft = opts.getDraft ?? true
 		const tok = ++loadAppToken
@@ -185,6 +197,10 @@
 			loadedFromDraft = false
 			draftSavedAt = undefined
 			deployedAt = undefined
+			parentVersion = undefined
+			draftBaseVersion = undefined
+			deployedHeadVersion = undefined
+			deployedBy = undefined
 			// `labels` is route-level state; reset it too so a fresh draft doesn't
 			// inherit (and then deploy) the previously-opened app's labels. The
 			// import branch re-seeds it via extractRawApp below.
@@ -301,6 +317,21 @@
 		// See /apps/edit's loader.
 		draftSavedAt = backendApp.draft_saved_at as string | undefined
 		deployedAt = backendApp.no_deployed ? undefined : (backendApp.created_at as string | undefined)
+		deployedBy = backendApp.no_deployed ? undefined : (backendApp.created_by as string | undefined)
+		// Head = the last entry of the deployed `versions`. The base the bundle
+		// carries is the draft's own; a draft that predates the base keeps none
+		// (stamping the head would hide whatever it is behind), and only a fresh
+		// checkout forks from the head.
+		const versions = backendApp.versions as number[] | undefined
+		const headVersion =
+			backendApp.no_deployed || !Array.isArray(versions) ? undefined : versions[versions.length - 1]
+		deployedHeadVersion = headVersion != null ? String(headVersion) : undefined
+		draftBaseVersion = backendApp.draft_base as string | undefined
+		parentVersion = hasOwnDraft
+			? draftBaseVersion != null
+				? Number(draftBaseVersion)
+				: undefined
+			: headVersion
 		// Deployed baseline for the autosave `discardIf`, captured BEFORE the swap
 		// below mutates `backendApp`. Mirrors the bundle `$effect`'s shape (minus
 		// the edit-only `draft_path`) so an unedited draft compares equal.
@@ -314,7 +345,8 @@
 						data: extractDataConfig(backendApp.value) ?? { ...DEFAULT_DATA },
 						summary: backendApp.summary ?? '',
 						policy: backendApp.policy,
-						custom_path: backendApp.custom_path
+						custom_path: backendApp.custom_path,
+						parent_version: parentVersion
 					})
 				) as RawAppDraft)
 		// The raw-app autosave stores a flat `RawAppDraft`, but this loader (and
@@ -393,6 +425,11 @@
 			data = v.data ?? { ...DEFAULT_DATA }
 			summary = v.summary ?? ''
 			policy = v.policy ?? {}
+			// Their draft's own fork base: the bundle is rebuilt from these pieces, so
+			// leaving `parentVersion` on ours would deploy their content claiming a base
+			// it never had.
+			parentVersion = v.parent_version
+			draftBaseVersion = v.parent_version != null ? String(v.parent_version) : undefined
 			newPath = v.draft_path ?? savedApp?.path ?? path
 			if (hasOwnDraft) {
 				OtherUserDraftLoad.beginOverlay({
@@ -409,6 +446,7 @@
 						summary,
 						policy,
 						custom_path: savedApp?.custom_path,
+						parent_version: parentVersion,
 						...(pendingDraftPath ? { draft_path: pendingDraftPath } : {})
 					} as RawAppDraft,
 					onResetToOwnDraft: () => loadApp({ getDraft: true })
@@ -497,7 +535,8 @@
 		aiChatManager.datatableCreationPolicy = {
 			enabled: !!result.data.datatable,
 			datatable: result.data.datatable,
-			schema: result.data.schema
+			schema: result.data.schema,
+			roles: result.data.roles
 		}
 		if (withPrompt && result.prompt) {
 			const prompt = result.prompt
@@ -549,6 +588,10 @@
 	bind:othersModalOpen
 	{draftSavedAt}
 	{deployedAt}
+	{draftBaseVersion}
+	{deployedHeadVersion}
+	{deployedBy}
+	onViewDiff={() => rawAppEditor?.openDiffDrawer()}
 	onLoadLatestDeploy={async () => {
 		// stopSync-bracketed; see /scripts/edit's restoreDeployed for the race.
 		if (!$workspaceStore) return
@@ -587,6 +630,56 @@
 				bind:savedApp
 				{diffDrawer}
 				newApp={isNewApp}
+				version={parentVersion ??
+					(deployedHeadVersion != null ? Number(deployedHeadVersion) : undefined)}
+				{draftBaseVersion}
+				onTakeLatest={draftBaseVersion
+					? async (shown?: string) => {
+							// The version the drawer showed as head; see /scripts/edit.
+							const head = Number(shown ?? deployedHeadVersion)
+							if (!Number.isFinite(head)) return
+							parentVersion = head
+							if (deployedBaseline) deployedBaseline = { ...deployedBaseline, parent_version: head }
+							draftBaseVersion = String(head)
+							// See /scripts/edit: the head this page knows moves with the base.
+							deployedHeadVersion = String(head)
+							// Persisted explicitly, as the script and flow routes do: the reactive
+							// bundle mirror is parked while auto-save is off, and a parked write is
+							// dropped on pagehide, so the new base would not survive a reload.
+							if (draftSync.draft) {
+								draftSync.draft = { ...draftSync.draft, parent_version: head }
+								if ($workspaceStore) {
+									await UserDraft.forcePersist('raw_app', page.params.path ?? '', {
+										workspace: $workspaceStore
+									})
+								}
+							}
+						}
+					: undefined}
+				onDeploy={({ version, head, headBy, headAt }) => {
+					// The version this deploy wrote is what the next autosave forks from, so the
+					// editor carries it; the prompt's own pair is what the loader knows, and this
+					// deploy consumed the draft it described, so the route holds no base until it
+					// loads again (the deploy guard covers that window).
+					parentVersion = version
+					// Keep the base the editor just pinned when this deploy is the head: the
+					// prompt has no draft to describe either way, and the drawer needs it to
+					// keep offering Take latest. A raced deploy leaves it unknown, since the
+					// pair would then differ and open the prompt on a draft that is gone.
+					draftBaseVersion = version != null && version === head ? String(version) : undefined
+					draftSavedAt = undefined
+					if (head != null) {
+						// Named by whoever deployed the head, not by the page load's author.
+						deployedHeadVersion = String(head)
+						deployedBy = headBy
+						deployedAt = headAt
+					}
+					// Another deploy landed on top of this one: there is no draft for the prompt
+					// to talk about, so say what happened instead.
+					if (version != null && head != null && version !== head) {
+						sendUserToast(`Version ${head} was deployed on top of yours (${version})`)
+					}
+				}}
 				onResetToDeployed={reloadDeployed}
 				{loadedFromDraft}
 				othersDraftsCount={otherDraftsUsers.length}
diff --git a/frontend/src/routes/(root)/(logged)/azure_triggers/+page.svelte b/frontend/src/routes/(root)/(logged)/azure_triggers/+page.svelte
index 11afa9f94b..2193288ccf 100644
--- a/frontend/src/routes/(root)/(logged)/azure_triggers/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/azure_triggers/+page.svelte
@@ -1,668 +1,5 @@
 <script lang="ts">
-	import { getLocalDraftHint } from '$lib/localDraftHints.svelte'
-	import { run } from 'svelte/legacy'
-
-	import {
-		AzureTriggerService,
-		WorkspaceService,
-		type AzureTrigger,
-		type WorkspaceDeployUISettings,
-		type TriggerMode
-	} from '$lib/gen'
-	import {
-		canWrite,
-		copyToClipboard,
-		displayDate,
-		getLocalSetting,
-		sendUserToast,
-		storeLocalSetting,
-		removeTriggerKindIfUnused
-	} from '$lib/utils'
-	import { withForkConflictRetry } from '$lib/utils/forkConflict'
-	import { base } from '$app/paths'
-	import { page } from '$app/stores'
-	import CenteredPage from '$lib/components/CenteredPage.svelte'
-	import { Alert, Button, EmptyState, Skeleton } from '$lib/components/common'
-	import Dropdown from '$lib/components/DropdownV2.svelte'
-	import PageHeader from '$lib/components/PageHeader.svelte'
-	import SharedBadge from '$lib/components/SharedBadge.svelte'
-	import DraftBadge from '$lib/components/DraftBadge.svelte'
-	import ShareModal from '$lib/components/ShareModal.svelte'
-	import Toggle from '$lib/components/Toggle.svelte'
-	import { enterpriseLicense, usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
-	import {
-		Code,
-		Eye,
-		Pen,
-		Plus,
-		Shield,
-		Trash,
-		Circle,
-		FileUp,
-		ClipboardCopy,
-		Pause
-	} from 'lucide-svelte'
-	import { goto } from '$lib/navigation'
-	import SearchItems from '$lib/components/SearchItems.svelte'
-	import NoItemFound from '$lib/components/home/NoItemFound.svelte'
-	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
-	import ListFilters from '$lib/components/home/ListFilters.svelte'
-	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
-	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
-	import { setQuery } from '$lib/navigation'
-	import { onDestroy, onMount } from 'svelte'
-	import Popover from '$lib/components/Popover.svelte'
-	import { isCloudHosted } from '$lib/cloud'
-	import { ALL_DEPLOYABLE, isDeployable } from '$lib/utils_deployable'
-	import DeployWorkspaceDrawer from '$lib/components/DeployWorkspaceDrawer.svelte'
-	import AzureTriggerEditor from '$lib/components/triggers/azure/AzureTriggerEditor.svelte'
-	import AzureIcon from '$lib/components/icons/AzureIcon.svelte'
-	import { getHttpRoute } from '$lib/components/triggers/http/utils'
-	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
-	import TriggerModeToggle from '$lib/components/triggers/TriggerModeToggle.svelte'
-
-	type TriggerD = AzureTrigger & { canWrite: boolean }
-
-	let triggers: TriggerD[] = $state([])
-	let shareModal: ShareModal | undefined = $state()
-	let loading = $state(true)
-	let deploymentDrawer: DeployWorkspaceDrawer | undefined = $state()
-	let deployUiSettings: WorkspaceDeployUISettings | undefined = $state(undefined)
-	let isDeleting = $state(false)
-	async function getDeployUiSettings() {
-		if (!$enterpriseLicense) {
-			deployUiSettings = ALL_DEPLOYABLE
-			return
-		}
-		let settings = await WorkspaceService.getPublicSettings({ workspace: $workspaceStore! })
-		deployUiSettings = settings.deploy_ui ?? ALL_DEPLOYABLE
-	}
-	getDeployUiSettings()
-	async function loadTriggers(): Promise<void> {
-		triggers = (
-			await AzureTriggerService.listAzureTriggers({
-				workspace: $workspaceStore!,
-				includeDraftOnly: true
-			})
-		).map((x) => {
-			return { canWrite: canWrite(x.path, x.extra_perms!, $userStore), ...x }
-		})
-		$usedTriggerKinds = removeTriggerKindIfUnused(triggers.length, 'azure', $usedTriggerKinds)
-		loading = false
-	}
-
-	let interval = setInterval(async () => {
-		try {
-			const newTriggers = await AzureTriggerService.listAzureTriggers({
-				workspace: $workspaceStore!
-			})
-			for (let i = 0; i < triggers.length; i++) {
-				const newTrigger = newTriggers.find((x) => x.path === triggers[i].path)
-				if (newTrigger) {
-					triggers[i] = {
-						...triggers[i],
-						error: newTrigger.error,
-						last_server_ping: newTrigger.last_server_ping,
-						mode: newTrigger.mode,
-						server_id: newTrigger.server_id
-					}
-				}
-			}
-		} catch (err) {
-			console.error(err)
-		}
-	}, 5000)
-
-	onDestroy(() => {
-		clearInterval(interval)
-	})
-
-	async function onToggleMode(path: string, mode: TriggerMode): Promise<boolean> {
-		let committed = false
-		try {
-			const ok = await withForkConflictRetry(
-				(force) =>
-					AzureTriggerService.setAzureTriggerMode({
-						path,
-						workspace: $workspaceStore!,
-						requestBody: { mode, force }
-					}),
-				'Azure trigger'
-			)
-			committed = ok
-			if (ok) loadTriggers()
-		} catch (err) {
-			sendUserToast(
-				`Cannot ${mode === 'enabled' ? 'enable' : mode === 'disabled' ? 'disable' : 'suspend'} Azure Event Grid trigger: ${err.body}`,
-				true
-			)
-			loadTriggers()
-		}
-		return committed
-	}
-
-	run(() => {
-		if ($workspaceStore && $userStore) {
-			loadTriggers()
-		}
-	})
-	let azureTriggerEditor: AzureTriggerEditor | undefined = $state()
-
-	let hashHandled = false
-	$effect(() => {
-		if (!hashHandled && triggers.length > 0 && azureTriggerEditor) {
-			let hash = $page.url.hash
-			if (hash.length > 1) {
-				let path = hash.slice(1)
-				let trigger = triggers.find((t) => t.path === path)
-				if (trigger) {
-					hashHandled = true
-					azureTriggerEditor?.openEdit(path, trigger.is_flow)
-				}
-			}
-		}
-	})
-
-	let filteredItems: (TriggerD & { marked?: any })[] | undefined = $state([])
-	let items: typeof filteredItems | undefined = $state([])
-	let preFilteredItems: typeof filteredItems | undefined = $state([])
-	let filter = $state('')
-	let ownerFilter: string | undefined = $state(undefined)
-	let nbDisplayed = $state(15)
-	let deleteAzureTriggerCallback: (() => Promise<void>) | undefined = $state(undefined)
-	let deleteSubscription = $state(false)
-	let subscriptionToDelete: string | undefined = $state(undefined)
-	let subscriptionDeletePayload:
-		| {
-				azure_mode: AzureTrigger['azure_mode']
-				scope_resource_id: string
-				topic_name?: string
-				subscription_name: string
-				azure_resource_path: string
-		  }
-		| undefined = $state(undefined)
-	const TRIGGER_PATH_KIND_FILTER_SETTING = 'filter_path_of'
-	const FILTER_USER_FOLDER_SETTING_NAME = 'user_and_folders_only'
-	let selectedFilterKind = $state(
-		(getLocalSetting(TRIGGER_PATH_KIND_FILTER_SETTING) as 'trigger' | 'script_flow') ?? 'trigger'
-	)
-	let filterUserFolders = $state(getLocalSetting(FILTER_USER_FOLDER_SETTING_NAME) == 'true')
-
-	run(() => {
-		storeLocalSetting(TRIGGER_PATH_KIND_FILTER_SETTING, selectedFilterKind)
-	})
-	run(() => {
-		storeLocalSetting(FILTER_USER_FOLDER_SETTING_NAME, filterUserFolders ? 'true' : undefined)
-	})
-
-	function filterItemsPathsBaseOnUserFilters(
-		item: TriggerD,
-		selectedFilterKind: 'trigger' | 'script_flow',
-		filterUserFolders: boolean
-	) {
-		if ($workspaceStore == 'admins') return true
-		if (filterUserFolders) {
-			if (selectedFilterKind === 'trigger') {
-				return (
-					!item.path.startsWith('u/') || item.path.startsWith('u/' + $userStore?.username + '/')
-				)
-			} else {
-				return (
-					!item.script_path.startsWith('u/') ||
-					item.script_path.startsWith('u/' + $userStore?.username + '/')
-				)
-			}
-		} else {
-			return true
-		}
-	}
-
-	run(() => {
-		preFilteredItems =
-			ownerFilter != undefined
-				? selectedFilterKind === 'trigger'
-					? triggers?.filter(
-							(x) =>
-								x.path.startsWith(ownerFilter + '/') &&
-								filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-						)
-					: triggers?.filter(
-							(x) =>
-								x.script_path.startsWith(ownerFilter + '/') &&
-								filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-						)
-				: triggers?.filter((x) =>
-						filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-					)
-	})
-
-	run(() => {
-		if ($workspaceStore) {
-			ownerFilter = undefined
-		}
-	})
-
-	let owners = $derived(
-		selectedFilterKind === 'trigger'
-			? Array.from(
-					new Set(filteredItems?.map((x) => x.path.split('/').slice(0, 2).join('/')) ?? [])
-				).sort()
-			: Array.from(
-					new Set(filteredItems?.map((x) => x.script_path.split('/').slice(0, 2).join('/')) ?? [])
-				).sort()
-	)
-
-	run(() => {
-		items = filter !== '' ? filteredItems : preFilteredItems
-	})
-
-	function updateQueryFilters(selectedFilterKind, filterUserFolders) {
-		setQuery(
-			TRIGGER_PATH_KIND_FILTER_SETTING,
-			selectedFilterKind,
-			window.location.hash || undefined
-		).then(() => {
-			setQuery(
-				FILTER_USER_FOLDER_SETTING_NAME,
-				String(filterUserFolders),
-				window.location.hash || undefined
-			)
-		})
-	}
-
-	function loadQueryFilters() {
-		let url = new URL(window.location.href)
-		let queryFilterKind = url.searchParams.get(TRIGGER_PATH_KIND_FILTER_SETTING)
-		let queryFilterUserFolders = url.searchParams.get(FILTER_USER_FOLDER_SETTING_NAME)
-		if (queryFilterKind) {
-			selectedFilterKind = queryFilterKind as 'trigger' | 'script_flow'
-		}
-		if (queryFilterUserFolders) {
-			filterUserFolders = queryFilterUserFolders == 'true'
-		}
-	}
-	onMount(() => {
-		loadQueryFilters()
-	})
-
-	run(() => {
-		updateQueryFilters(selectedFilterKind, filterUserFolders)
-	})
+	import TriggerList from '$lib/components/triggers/TriggerList.svelte'
 </script>
 
-<ConfirmationModal
-	open={Boolean(deleteAzureTriggerCallback)}
-	title="Delete Azure Event Grid trigger"
-	confirmationText="Remove"
-	loading={isDeleting}
-	on:canceled={() => {
-		deleteAzureTriggerCallback = undefined
-	}}
-	on:confirmed={async () => {
-		if (deleteAzureTriggerCallback) {
-			isDeleting = true
-			if (deleteSubscription && subscriptionDeletePayload) {
-				try {
-					const msg = await AzureTriggerService.deleteAzureSubscription({
-						workspace: $workspaceStore ?? '',
-						path: subscriptionDeletePayload.azure_resource_path,
-						requestBody: {
-							azure_mode: subscriptionDeletePayload.azure_mode,
-							scope_resource_id: subscriptionDeletePayload.scope_resource_id,
-							topic_name: subscriptionDeletePayload.topic_name,
-							subscription_name: subscriptionDeletePayload.subscription_name
-						}
-					})
-					sendUserToast(msg)
-				} catch (error) {
-					isDeleting = false
-					sendUserToast(error.body || error.message, true)
-					return
-				}
-			}
-			await deleteAzureTriggerCallback()
-		}
-		deleteAzureTriggerCallback = undefined
-		subscriptionToDelete = undefined
-		subscriptionDeletePayload = undefined
-	}}
->
-	<div class="flex flex-col w-full space-y-4">
-		<span>Are you sure you want to remove this trigger?</span>
-
-		{#if subscriptionToDelete}
-			<Toggle
-				options={{
-					left: `Also delete Azure subscription "${subscriptionToDelete}" on Azure?`
-				}}
-				bind:checked={deleteSubscription}
-			/>
-		{/if}
-	</div>
-</ConfirmationModal>
-
-<DeployWorkspaceDrawer bind:this={deploymentDrawer} />
-<AzureTriggerEditor onUpdate={loadTriggers} bind:this={azureTriggerEditor} />
-
-<SearchItems
-	{filter}
-	items={preFilteredItems}
-	bind:filteredItems
-	f={(x) => (x.summary ?? '') + ' ' + x.path + ' (' + x.script_path + ')'}
-/>
-
-<CenteredPage>
-	<PageHeader title="Azure Event Grid triggers" tooltip="Azure Event Grid trigger">
-		<Button
-			unifiedSize="md"
-			variant="accent"
-			startIcon={{ icon: Plus }}
-			on:click={() => azureTriggerEditor?.openNew(false)}
-		>
-			New&nbsp;Azure Event Grid trigger
-		</Button>
-	</PageHeader>
-
-	{#if isCloudHosted()}
-		<Alert title="Not compatible with multi-tenant cloud" type="warning">
-			Azure Event Grid triggers are disabled in the multi-tenant cloud.
-		</Alert>
-	{/if}
-	<div class="w-full h-full flex flex-col">
-		<div class="w-full pb-4 pt-6">
-			<input type="text" placeholder="Search triggers" bind:value={filter} class="search-item" />
-			<div class="flex flex-row items-center gap-2 mt-6">
-				<div class="text-sm shrink-0"> Filter by path of </div>
-				<ToggleButtonGroup bind:selected={selectedFilterKind}>
-					{#snippet children({ item })}
-						<ToggleButton
-							value="trigger"
-							label="Azure Event Grid trigger"
-							icon={AzureIcon}
-							{item}
-						/>
-						<ToggleButton value="script_flow" label="Script/Flow" icon={Code} {item} />
-					{/snippet}
-				</ToggleButtonGroup>
-			</div>
-			<ListFilters syncQuery bind:selectedFilter={ownerFilter} filters={owners} />
-
-			<div class="flex flex-row items-center justify-end gap-4">
-				{#if $userStore?.is_super_admin && $userStore.username.includes('@')}
-					<Toggle size="xs" bind:checked={filterUserFolders} options={{ right: 'Only f/*' }} />
-				{:else if $userStore?.is_admin || $userStore?.is_super_admin}
-					<Toggle
-						size="xs"
-						bind:checked={filterUserFolders}
-						options={{ right: `Only u/${$userStore.username} and f/*` }}
-					/>
-				{/if}
-			</div>
-		</div>
-		{#if loading}
-			{#each new Array(6) as _}
-				<Skeleton layout={[[6], 0.4]} />
-			{/each}
-		{:else if !triggers?.length}
-			<EmptyState
-				icon={AzureIcon}
-				title="No Azure Event Grid triggers yet"
-				description="Windmill can subscribe to an Azure Event Grid topic and trigger scripts or flows on each event."
-				action={{
-					label: 'Add an Azure Event Grid trigger',
-					icon: Plus,
-					onClick: () => azureTriggerEditor?.openNew(false),
-					aiId: 'azure-triggers-empty-add',
-					aiDescription: 'Add Azure Event Grid trigger'
-				}}
-			/>
-		{:else if items?.length}
-			<div class="border rounded-md divide-y">
-				{#each items.slice(0, nbDisplayed) as { azure_resource_path, azure_mode, scope_resource_id, topic_name, subscription_name, workspace_id, path, edited_by, error, edited_at, script_path, is_flow, extra_perms, canWrite, mode, server_id, retry, error_handler_path, error_handler_args, draft_only, is_draft } (path)}
-					{@const hasDraft = getLocalDraftHint($workspaceStore, 'trigger_azure', path) ?? is_draft}
-					{@const href = `${is_flow ? '/flows/get' : '/scripts/get'}/${script_path}`}
-					{@const ping = new Date()}
-					{@const pinging = ping && ping.getTime() > new Date().getTime() - 15 * 1000}
-					{@const effectiveMode = draft_only ? 'disabled' : mode}
-					{@const enabled = effectiveMode === 'enabled' || effectiveMode === 'suspended'}
-					{@const is_pull = azure_mode === 'namespace_pull'}
-					{@const topic_label = topic_name
-						? topic_name
-						: (scope_resource_id?.split('/')?.pop() ?? '')}
-
-					<div
-						class="hover:bg-surface-hover w-full items-center px-4 py-2 gap-4 first-of-type:!border-t-0
-				first-of-type:rounded-t-md last-of-type:rounded-b-md flex flex-col"
-					>
-						<div class="w-full flex gap-5 items-center">
-							<RowIcon kind={is_flow ? 'flow' : 'script'} />
-
-							<a
-								href="#{path}"
-								onclick={() => azureTriggerEditor?.openEdit(path, is_flow)}
-								class="min-w-0 grow hover:underline decoration-gray-400"
-							>
-								<div class="text-emphasis flex-wrap text-left text-xs font-semibold mb-1 truncate">
-									{path} - {topic_label} ({azure_mode}, {subscription_name}){hasDraft ? '*' : ''}
-								</div>
-								<div class="text-secondary text-xs truncate text-left font-light">
-									runnable: {script_path}
-								</div>
-							</a>
-
-							<div class="hidden lg:flex flex-row gap-1 items-center">
-								<SharedBadge {canWrite} extraPerms={extra_perms} />
-							</div>
-
-							{#if is_pull}
-								<div class="w-10">
-									{#if (enabled && (!pinging || error)) || (!enabled && error) || (enabled && !server_id)}
-										<Popover notClickable>
-											<span class="flex h-4 w-4">
-												<Circle
-													class="text-red-600 animate-ping absolute inline-flex fill-current"
-													size={12}
-												/>
-												<Circle class="text-red-600 relative inline-flex fill-current" size={12} />
-											</span>
-											{#snippet text()}
-												<div>
-													{#if enabled}
-														{#if !server_id}
-															Azure Event Grid trigger is starting...
-														{:else}
-															Could not connect to Azure Event Grid{error ? ': ' + error : ''}
-														{/if}
-													{:else}
-														Disabled because of an error: {error}
-													{/if}
-												</div>
-											{/snippet}
-										</Popover>
-									{:else if enabled}
-										<Popover notClickable>
-											<span class="flex h-4 w-4">
-												<Circle
-													class="text-green-600 relative inline-flex fill-current"
-													size={12}
-												/>
-											</span>
-											{#snippet text()}
-												<div>
-													Connected to Azure Event Grid{!server_id
-														? ' (shutting down...)'
-														: ''}</div
-												>
-											{/snippet}
-										</Popover>
-									{/if}
-								</div>
-							{/if}
-
-							<div class="flex items-center justify-end gap-2 shrink-0 min-w-[8rem]">
-								<DraftBadge {draft_only} is_draft={hasDraft} />
-								{#if is_pull}
-									<TriggerModeToggle
-										disabled={draft_only}
-										title={draft_only
-											? 'Draft only: deploy the trigger to enable it'
-											: hasDraft
-												? 'Enables/disables the deployed trigger; the draft is not affected'
-												: undefined}
-										onToggleMode={(newMode) => onToggleMode(path, newMode)}
-										triggerMode={effectiveMode}
-										includeModalConfig={{
-											triggerPath: path,
-											triggerKind: 'azure',
-											runnableConfig: {
-												path: script_path,
-												kind: is_flow ? 'flow' : 'script',
-												retry,
-												errorHandlerPath: error_handler_path,
-												errorHandlerArgs: error_handler_args
-											}
-										}}
-										{canWrite}
-										hideToggleLabels
-										hideDropdown
-									/>
-								{/if}
-							</div>
-
-							<div class="flex gap-2 items-center justify-end">
-								{#if !is_pull}
-									<Button
-										on:click={() =>
-											copyToClipboard(getHttpRoute('azure/w', path, true, workspace_id))}
-										variant="subtle"
-										size="xs"
-										startIcon={{ icon: ClipboardCopy }}
-									>
-										Copy URL
-									</Button>
-								{/if}
-								<Button
-									on:click={() => azureTriggerEditor?.openEdit(path, is_flow)}
-									size="xs"
-									startIcon={canWrite
-										? { icon: Pen }
-										: {
-												icon: Eye
-											}}
-									variant="subtle"
-								>
-									{canWrite ? 'Edit' : 'View'}
-								</Button>
-								<Dropdown
-									items={[
-										{
-											displayName: `View ${is_flow ? 'Flow' : 'Script'}`,
-											icon: Eye,
-											action: () => {
-												goto(href)
-											}
-										},
-										...(canWrite && !draft_only && mode !== 'suspended'
-											? [
-													{
-														displayName: 'Suspend job execution',
-														icon: Pause,
-														action: () => {
-															onToggleMode(path, 'suspended')
-														}
-													}
-												]
-											: []),
-										{
-											displayName: canWrite ? 'Edit' : 'View',
-											icon: canWrite ? Pen : Eye,
-											action: () => {
-												azureTriggerEditor?.openEdit(path, is_flow)
-											}
-										},
-										...(isDeployable('trigger', path, deployUiSettings)
-											? [
-													{
-														displayName: 'Deploy to prod/staging',
-														icon: FileUp,
-														action: () => {
-															deploymentDrawer?.openDrawer(path, 'trigger', {
-																triggers: {
-																	kind: 'azure'
-																}
-															})
-														}
-													}
-												]
-											: []),
-										{
-											displayName: 'Audit logs',
-											icon: Eye,
-											href: `${base}/audit_logs?resource=${path}`
-										},
-										{
-											displayName: 'Permissions',
-											icon: Shield,
-											action: () => {
-												shareModal?.openDrawer(path, 'azure_trigger')
-											}
-										},
-										{
-											displayName: 'Delete',
-											type: 'delete',
-											icon: Trash,
-											disabled: !canWrite,
-											action: async () => {
-												isDeleting = false
-												deleteSubscription = false
-												subscriptionToDelete = subscription_name
-												subscriptionDeletePayload = {
-													azure_mode,
-													scope_resource_id,
-													topic_name: topic_name ?? undefined,
-													subscription_name,
-													azure_resource_path
-												}
-												deleteAzureTriggerCallback = async () => {
-													const message = await AzureTriggerService.deleteAzureTrigger({
-														workspace: $workspaceStore ?? '',
-														path
-													})
-													sendUserToast(message)
-													loadTriggers()
-												}
-											}
-										}
-									]}
-								/>
-							</div>
-						</div>
-						<div class="w-full flex justify-between items-baseline">
-							<div
-								class="flex flex-wrap text-[0.7em] text-primary gap-1 items-center justify-end truncate pr-2"
-								>{#if edited_by}<div class="truncate">edited by {edited_by}</div>{/if}<div
-									class="truncate">{edited_by ? 'the ' : ''}{displayDate(edited_at)}</div
-								></div
-							></div
-						>
-					</div>
-				{/each}
-			</div>
-		{:else}
-			<NoItemFound />
-		{/if}
-	</div>
-	{#if items && items?.length > 15 && nbDisplayed < items.length}
-		<span class="text-xs"
-			>{nbDisplayed} items out of {items.length}
-			<button class="ml-4" onclick={() => (nbDisplayed += 30)}>load 30 more</button></span
-		>
-	{/if}
-</CenteredPage>
-
-<ShareModal
-	bind:this={shareModal}
-	on:change={() => {
-		loadTriggers()
-	}}
-/>
+<TriggerList triggerKind="azure" />
diff --git a/frontend/src/routes/(root)/(logged)/email_triggers/+page.svelte b/frontend/src/routes/(root)/(logged)/email_triggers/+page.svelte
index 87c9558dbb..8fb28777c8 100644
--- a/frontend/src/routes/(root)/(logged)/email_triggers/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/email_triggers/+page.svelte
@@ -1,553 +1,5 @@
 <script lang="ts">
-	import { getLocalDraftHint } from '$lib/localDraftHints.svelte'
-	import { run } from 'svelte/legacy'
-
-	import {
-		EmailTriggerService,
-		WorkspaceService,
-		type EmailTrigger,
-		type TriggerMode,
-		type WorkspaceDeployUISettings
-	} from '$lib/gen'
-	import {
-		canWrite,
-		copyToClipboard,
-		displayDate,
-		getLocalSetting,
-		storeLocalSetting,
-		removeTriggerKindIfUnused,
-		sendUserToast
-	} from '$lib/utils'
-	import { base } from '$app/paths'
-	import { page } from '$app/stores'
-	import CenteredPage from '$lib/components/CenteredPage.svelte'
-	import { Badge, Button, EmptyState, Skeleton } from '$lib/components/common'
-	import Dropdown from '$lib/components/DropdownV2.svelte'
-	import PageHeader from '$lib/components/PageHeader.svelte'
-	import SharedBadge from '$lib/components/SharedBadge.svelte'
-	import DraftBadge from '$lib/components/DraftBadge.svelte'
-	import ShareModal from '$lib/components/ShareModal.svelte'
-	import Toggle from '$lib/components/Toggle.svelte'
-	import {
-		userStore,
-		workspaceStore,
-		userWorkspaces,
-		enterpriseLicense,
-		usedTriggerKinds
-	} from '$lib/stores'
-	import {
-		Mail,
-		Code,
-		Eye,
-		Pen,
-		Plus,
-		Shield,
-		Trash,
-		FileUp,
-		ClipboardCopy,
-		Pause
-	} from 'lucide-svelte'
-	import { goto } from '$lib/navigation'
-	import SearchItems from '$lib/components/SearchItems.svelte'
-	import NoItemFound from '$lib/components/home/NoItemFound.svelte'
-	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
-	import ListFilters from '$lib/components/home/ListFilters.svelte'
-	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
-	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
-	import { setQuery } from '$lib/navigation'
-	import { onMount } from 'svelte'
-	import EmailTriggerEditor from '$lib/components/triggers/email/EmailTriggerEditor.svelte'
-	import DeployWorkspaceDrawer from '$lib/components/DeployWorkspaceDrawer.svelte'
-	import { ALL_DEPLOYABLE, isDeployable } from '$lib/utils_deployable'
-	import { getEmailAddress, getEmailDomain } from '$lib/components/triggers/email/utils'
-	import TriggerModeToggle from '$lib/components/triggers/TriggerModeToggle.svelte'
-
-	type TriggerW = EmailTrigger & { canWrite: boolean }
-
-	let triggers: TriggerW[] = $state([])
-	let shareModal: ShareModal | undefined = $state()
-	let loading = $state(true)
-	let deploymentDrawer: DeployWorkspaceDrawer | undefined = $state()
-	let deployUiSettings: WorkspaceDeployUISettings | undefined = $state(undefined)
-	let emailDomain: string | null = $state(null)
-
-	async function getDeployUiSettings() {
-		if (!$enterpriseLicense) {
-			deployUiSettings = ALL_DEPLOYABLE
-			return
-		}
-		let settings = await WorkspaceService.getPublicSettings({ workspace: $workspaceStore! })
-		deployUiSettings = settings.deploy_ui ?? ALL_DEPLOYABLE
-	}
-	getDeployUiSettings()
-	async function loadTriggers(): Promise<void> {
-		triggers = (
-			await EmailTriggerService.listEmailTriggers({
-				workspace: $workspaceStore!,
-				includeDraftOnly: true
-			})
-		).map((x) => {
-			return { canWrite: canWrite(x.path, x.extra_perms!, $userStore), ...x }
-		})
-		$usedTriggerKinds = removeTriggerKindIfUnused(triggers.length, 'emails', $usedTriggerKinds)
-		emailDomain = await getEmailDomain()
-		loading = false
-	}
-
-	run(() => {
-		if ($workspaceStore && $userStore) {
-			loadTriggers()
-		}
-	})
-	let emailTriggerEditor: EmailTriggerEditor | undefined = $state()
-
-	let hashHandled = false
-	$effect(() => {
-		if (!hashHandled && triggers.length > 0 && emailTriggerEditor) {
-			let hash = $page.url.hash
-			if (hash.length > 1) {
-				let path = hash.slice(1)
-				let trigger = triggers.find((t) => t.path === path)
-				if (trigger) {
-					hashHandled = true
-					emailTriggerEditor?.openEdit(path, trigger.is_flow)
-				}
-			}
-		}
-	})
-
-	let filteredItems: (TriggerW & { marked?: any })[] | undefined = $state([])
-	let items: typeof filteredItems | undefined = $state([])
-	let preFilteredItems: typeof filteredItems | undefined = $state([])
-	let filter = $state('')
-	let ownerFilter: string | undefined = $state(undefined)
-	let nbDisplayed = $state(15)
-
-	const TRIGGER_PATH_KIND_FILTER_SETTING = 'filter_path_of'
-	const FILTER_USER_FOLDER_SETTING_NAME = 'user_and_folders_only'
-	let selectedFilterKind = $state(
-		(getLocalSetting(TRIGGER_PATH_KIND_FILTER_SETTING) as 'trigger' | 'script_flow') ?? 'trigger'
-	)
-	let filterUserFolders = $state(getLocalSetting(FILTER_USER_FOLDER_SETTING_NAME) == 'true')
-
-	run(() => {
-		storeLocalSetting(TRIGGER_PATH_KIND_FILTER_SETTING, selectedFilterKind)
-	})
-	run(() => {
-		storeLocalSetting(FILTER_USER_FOLDER_SETTING_NAME, filterUserFolders ? 'true' : undefined)
-	})
-
-	function filterItemsPathsBaseOnUserFilters(
-		item: TriggerW,
-		selectedFilterKind: 'trigger' | 'script_flow',
-		filterUserFolders: boolean
-	) {
-		if ($workspaceStore == 'admins') return true
-		if (filterUserFolders) {
-			if (selectedFilterKind === 'trigger') {
-				return (
-					!item.path.startsWith('u/') || item.path.startsWith('u/' + $userStore?.username + '/')
-				)
-			} else {
-				return (
-					!item.script_path.startsWith('u/') ||
-					item.script_path.startsWith('u/' + $userStore?.username + '/')
-				)
-			}
-		} else {
-			return true
-		}
-	}
-
-	run(() => {
-		preFilteredItems =
-			ownerFilter != undefined
-				? selectedFilterKind === 'trigger'
-					? triggers?.filter(
-							(x) =>
-								x.path.startsWith(ownerFilter + '/') &&
-								filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-						)
-					: triggers?.filter(
-							(x) =>
-								x.script_path.startsWith(ownerFilter + '/') &&
-								filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-						)
-				: triggers?.filter((x) =>
-						filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-					)
-	})
-
-	run(() => {
-		if ($workspaceStore) {
-			ownerFilter = undefined
-		}
-	})
-
-	let owners = $derived(
-		selectedFilterKind === 'trigger'
-			? Array.from(
-					new Set(filteredItems?.map((x) => x.path.split('/').slice(0, 2).join('/')) ?? [])
-				).sort()
-			: Array.from(
-					new Set(
-						filteredItems
-							?.filter((x) => x.script_path)
-							.map((x) => x.script_path.split('/').slice(0, 2).join('/')) ?? []
-					)
-				).sort()
-	)
-
-	run(() => {
-		items = filter !== '' ? filteredItems : preFilteredItems
-	})
-
-	function updateQueryFilters(selectedFilterKind, filterUserFolders) {
-		setQuery(
-			TRIGGER_PATH_KIND_FILTER_SETTING,
-			selectedFilterKind,
-			window.location.hash || undefined
-		).then(() => {
-			setQuery(
-				FILTER_USER_FOLDER_SETTING_NAME,
-				String(filterUserFolders),
-				window.location.hash || undefined
-			)
-		})
-	}
-
-	function loadQueryFilters() {
-		let url = new URL(window.location.href)
-		let queryFilterKind = url.searchParams.get(TRIGGER_PATH_KIND_FILTER_SETTING)
-		let queryFilterUserFolders = url.searchParams.get(FILTER_USER_FOLDER_SETTING_NAME)
-		if (queryFilterKind) {
-			selectedFilterKind = queryFilterKind as 'trigger' | 'script_flow'
-		}
-		if (queryFilterUserFolders) {
-			filterUserFolders = queryFilterUserFolders == 'true'
-		}
-	}
-
-	async function onToggleMode(path: string, mode: TriggerMode): Promise<void> {
-		try {
-			// Email addresses are always workspace-prefixed (clone filter
-			// excludes workspaced_local_part=false) — no fork-conflict warning.
-			await EmailTriggerService.setEmailTriggerMode({
-				path,
-				workspace: $workspaceStore!,
-				requestBody: { mode }
-			})
-		} catch (err) {
-			sendUserToast(
-				`Cannot ` +
-					(mode === 'enabled' ? 'enable' : mode === 'disabled' ? 'disable' : 'suspend') +
-					` email trigger: ${err.body}`,
-				true
-			)
-		} finally {
-			loadTriggers()
-		}
-	}
-
-	onMount(() => {
-		loadQueryFilters()
-	})
-
-	run(() => {
-		updateQueryFilters(selectedFilterKind, filterUserFolders)
-	})
+	import TriggerList from '$lib/components/triggers/TriggerList.svelte'
 </script>
 
-<DeployWorkspaceDrawer bind:this={deploymentDrawer} />
-<EmailTriggerEditor onUpdate={loadTriggers} bind:this={emailTriggerEditor} />
-
-<SearchItems
-	{filter}
-	items={preFilteredItems}
-	bind:filteredItems
-	f={(x) => (x.summary ?? '') + ' ' + x.path + ' (' + x.script_path + ')'}
-/>
-
-{#if $userStore?.operator && $workspaceStore && !$userWorkspaces.find((_) => _.id === $workspaceStore)?.operator_settings?.triggers}
-	<div class="bg-red-100 border-l-4 border-red-600 text-orange-700 p-4 m-4 mt-12" role="alert">
-		<p class="font-bold">Unauthorized</p>
-		<p>Page not available for operators</p>
-	</div>
-{:else}
-	<CenteredPage>
-		<PageHeader
-			title="Custom email triggers"
-			tooltip="Every script and flow already has a canonical email trigger attached to it, this is to create additional parametrizable ones."
-			documentationLink="https://www.windmill.dev/docs/advanced/email_triggers"
-		>
-			{#if $userStore?.is_admin || $userStore?.is_super_admin}
-				<Button
-					unifiedSize="md"
-					variant="accent"
-					startIcon={{ icon: Plus }}
-					on:click={() => emailTriggerEditor?.openNew(false)}
-				>
-					New&nbsp;email trigger
-				</Button>
-			{/if}
-		</PageHeader>
-		<div class="w-full h-full flex flex-col">
-			<div class="w-full pb-4 pt-6">
-				<input
-					type="text"
-					placeholder="Search email triggers"
-					bind:value={filter}
-					class="search-item"
-				/>
-				<div class="flex flex-row items-center gap-2 mt-6">
-					<div class="text-sm shrink-0"> Filter by path of </div>
-					<ToggleButtonGroup bind:selected={selectedFilterKind}>
-						{#snippet children({ item })}
-							<ToggleButton small value="trigger" label="Email" icon={Mail} {item} />
-							<ToggleButton small value="script_flow" label="Script/Flow" icon={Code} {item} />
-						{/snippet}
-					</ToggleButtonGroup>
-				</div>
-				<ListFilters syncQuery bind:selectedFilter={ownerFilter} filters={owners} />
-
-				<div class="flex flex-row items-center justify-end gap-4">
-					{#if $userStore?.is_super_admin && $userStore.username.includes('@')}
-						<Toggle size="xs" bind:checked={filterUserFolders} options={{ right: 'Only f/*' }} />
-					{:else if $userStore?.is_admin || $userStore?.is_super_admin}
-						<Toggle
-							size="xs"
-							bind:checked={filterUserFolders}
-							options={{ right: `Only u/${$userStore.username} and f/*` }}
-						/>
-					{/if}
-				</div>
-			</div>
-			{#if loading}
-				{#each new Array(6) as _}
-					<Skeleton layout={[[6], 0.4]} />
-				{/each}
-			{:else if !triggers?.length}
-				<EmptyState
-					icon={Mail}
-					title="No custom email triggers yet"
-					description="Every script and flow already has a canonical email trigger attached to it. These are additional parametrizable ones."
-					action={$userStore?.is_admin || $userStore?.is_super_admin
-						? {
-								label: 'Add an email trigger',
-								icon: Plus,
-								onClick: () => emailTriggerEditor?.openNew(false),
-								aiId: 'email-triggers-empty-add',
-								aiDescription: 'Add email trigger'
-							}
-						: undefined}
-				/>
-			{:else if items?.length}
-				<div class="border rounded-md divide-y">
-					{#each items.slice(0, nbDisplayed) as { workspace_id, workspaced_local_part, path, edited_by, edited_at, script_path, is_flow, extra_perms, canWrite, marked, local_part, mode, retry, error_handler_path, error_handler_args, labels, draft_only, is_draft } (path)}
-						{@const hasDraft =
-							getLocalDraftHint($workspaceStore, 'trigger_email', path) ?? is_draft}
-						{@const effectiveMode = draft_only ? 'disabled' : mode}
-						{@const href = `${is_flow ? '/flows/get' : '/scripts/get'}/${script_path}`}
-						{@const emailAddress = getEmailAddress(
-							local_part,
-							workspaced_local_part ?? false,
-							workspace_id,
-							emailDomain ?? ''
-						)}
-
-						<div
-							class="hover:bg-surface-hover w-full items-center px-4 py-2 gap-4 first-of-type:!border-t-0
-				first-of-type:rounded-t-md last-of-type:rounded-b-md flex flex-col"
-						>
-							<div class="w-full flex gap-5 items-center">
-								<RowIcon kind={is_flow ? 'flow' : 'script'} />
-
-								<a
-									href="#{path}"
-									onclick={() => emailTriggerEditor?.openEdit(path, is_flow)}
-									class="min-w-0 grow hover:underline decoration-gray-400"
-								>
-									<div
-										class="text-emphasis flex-wrap text-left text-xs font-semibold mb-1 truncate"
-									>
-										{#if marked}
-											<span class="text-xs">
-												{@html marked}
-											</span>
-										{:else}
-											{emailAddress}
-										{/if}{hasDraft ? '*' : ''}
-									</div>
-									<div class="text-secondary text-xs truncate text-left font-light">
-										{path}
-									</div>
-									<div class="text-secondary text-xs truncate text-left font-light">
-										runnable: {script_path}
-									</div>
-								</a>
-
-								<div class="hidden lg:flex flex-row gap-1 items-center">
-									<SharedBadge {canWrite} extraPerms={extra_perms} />
-									{#if labels?.length}
-										{#each labels as label}
-											<Badge color="blue" small class="px-1" title="Label: {label}">{label}</Badge>
-										{/each}
-									{/if}
-								</div>
-
-								<div class="flex items-center justify-end gap-2 shrink-0 min-w-[8rem]">
-									<DraftBadge {draft_only} is_draft={hasDraft} />
-									<TriggerModeToggle
-										disabled={draft_only}
-										title={draft_only
-											? 'Draft only: deploy the trigger to enable it'
-											: hasDraft
-												? 'Enables/disables the deployed trigger; the draft is not affected'
-												: undefined}
-										onToggleMode={(newMode) => onToggleMode(path, newMode)}
-										triggerMode={effectiveMode}
-										includeModalConfig={{
-											triggerPath: path,
-											triggerKind: 'email',
-											runnableConfig: {
-												path: script_path,
-												kind: is_flow ? 'flow' : 'script',
-												retry,
-												errorHandlerPath: error_handler_path,
-												errorHandlerArgs: error_handler_args
-											}
-										}}
-										{canWrite}
-										hideToggleLabels
-										hideDropdown
-									/>
-								</div>
-
-								<div class="flex gap-2 items-center justify-end">
-									<Button
-										on:click={() => copyToClipboard(emailAddress)}
-										variant="subtle"
-										unifiedSize="md"
-										startIcon={{ icon: ClipboardCopy }}
-									>
-										Copy email address
-									</Button>
-									<Button
-										on:click={() => emailTriggerEditor?.openEdit(path, is_flow)}
-										unifiedSize="md"
-										startIcon={canWrite
-											? { icon: Pen }
-											: {
-													icon: Eye
-												}}
-										variant="subtle"
-									>
-										{canWrite ? 'Edit' : 'View'}
-									</Button>
-									<Dropdown
-										items={[
-											{
-												displayName: `View ${is_flow ? 'Flow' : 'Script'}`,
-												icon: Eye,
-												action: () => {
-													goto(href)
-												}
-											},
-											...(canWrite && !draft_only && mode !== 'suspended'
-												? [
-														{
-															displayName: 'Suspend job execution',
-															icon: Pause,
-															action: () => {
-																onToggleMode(path, 'suspended')
-															}
-														}
-													]
-												: []),
-											{
-												displayName: canWrite ? 'Edit' : 'View',
-												icon: canWrite ? Pen : Eye,
-												action: () => {
-													emailTriggerEditor?.openEdit(path, is_flow)
-												}
-											},
-											...(isDeployable('trigger', path, deployUiSettings)
-												? [
-														{
-															displayName: 'Deploy to prod/staging',
-															icon: FileUp,
-															action: () => {
-																deploymentDrawer?.openDrawer(path, 'trigger', {
-																	triggers: {
-																		kind: 'routes'
-																	}
-																})
-															}
-														}
-													]
-												: []),
-											{
-												displayName: 'Audit logs',
-												icon: Eye,
-												href: `${base}/audit_logs?resource=${path}`
-											},
-											{
-												displayName: 'Permissions',
-												icon: Shield,
-												action: () => {
-													shareModal?.openDrawer(path, 'email_trigger')
-												}
-											},
-											{
-												displayName: 'Delete',
-												type: 'delete',
-												icon: Trash,
-												disabled:
-													!canWrite || !($userStore?.is_admin || $userStore?.is_super_admin),
-												action: async () => {
-													try {
-														await EmailTriggerService.deleteEmailTrigger({
-															workspace: $workspaceStore ?? '',
-															path
-														})
-														sendUserToast(`Successfully deleted Email trigger: ${path}`)
-														loadTriggers()
-													} catch (error) {
-														sendUserToast(error.body || error.message, true)
-													}
-												}
-											}
-										]}
-									/>
-								</div>
-							</div>
-							<div class="w-full flex justify-between items-baseline">
-								<div
-									class="flex flex-wrap text-[0.7em] text-primary gap-1 items-center justify-end truncate pr-2"
-								>
-									{#if edited_by}<div class="truncate">edited by {edited_by}</div>{/if}
-									<div class="truncate">{edited_by ? 'at ' : ''}{displayDate(edited_at)}</div>
-								</div>
-							</div>
-						</div>
-					{/each}
-				</div>
-			{:else}
-				<NoItemFound />
-			{/if}
-		</div>
-		{#if items && items?.length > 15 && nbDisplayed < items.length}
-			<span class="text-xs"
-				>{nbDisplayed} items out of {items.length}
-				<button class="ml-4" onclick={() => (nbDisplayed += 30)}>load 30 more</button></span
-			>
-		{/if}
-	</CenteredPage>
-{/if}
-
-<ShareModal
-	bind:this={shareModal}
-	on:change={() => {
-		loadTriggers()
-	}}
-/>
+<TriggerList triggerKind="email" />
diff --git a/frontend/src/routes/(root)/(logged)/flows/edit/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/flows/edit/[...path]/+page.svelte
index 65a7c7f510..4d240cc24b 100644
--- a/frontend/src/routes/(root)/(logged)/flows/edit/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/flows/edit/[...path]/+page.svelte
@@ -58,7 +58,8 @@
 	let deployedAt = $state<string | undefined>(undefined)
 	// The flow_version the draft was forked from (pinned, doesn't drift), for the
 	// precise staleness check in DraftEditorModals + FlowBuilder's deploy guard.
-	let draftBaseVersion = $state<number | undefined>(undefined)
+	let draftBaseVersion = $state<string | undefined>(undefined)
+	let deployedBy = $state<string | undefined>(undefined)
 	// Editor-displayed path; defaults to the URL path. Cleared to '' in the
 	// `new_draft` branch so the Path widget's `initPath` seeds the friendly name.
 	let flowInitialPath = $state(page.params.path ?? '')
@@ -163,6 +164,7 @@
 			// bleed across the reused route and falsely trip the stale-draft modal.
 			version = undefined
 			draftBaseVersion = undefined
+			deployedBy = undefined
 			// Brand-new flow: no deployed baseline, so never discard-on-equal.
 			deployedBaseline = undefined
 			// Suspend autosave around the bootstrap cascade: the Path widget's
@@ -355,15 +357,23 @@
 		// is the deploy time (from `flow_version.created_at`), `draft_saved_at` the draft's.
 		draftSavedAt = backendFlow.draft_saved_at as string | undefined
 		deployedAt = backendFlow.edited_at as string | undefined
+		deployedBy = backendFlow.edited_by as string | undefined
 		// Layer the draft (`.draft`, if any) over the deployed payload at the field
 		// level. See /scripts/edit's loader for the rationale.
 		const { draft: draftFromBackend, ...deployedFlow } = backendFlow as any
-		// `version_id` rides on the persisted draft (pinned at fork); undefined for a
-		// pre-feature draft or when editing the deployed flow directly (no draft).
-		draftBaseVersion = draftFromBackend?.version_id as number | undefined
+		// The flow_version the draft forked from; undefined when editing the deployed
+		// flow directly (no draft) or for a draft never forked from a deploy.
+		draftBaseVersion = backendFlow.draft_base
 		const effectiveFlow: Flow = draftFromBackend
 			? ({ ...deployedFlow, ...draftFromBackend } as Flow)
 			: (deployedFlow as Flow)
+		// The merge above would hand a draft with no base the deployed one, and the next
+		// autosave would persist it as `draft.base`: a draft behind the deploy would read
+		// as up to date after one open. A draft keeps the base it has, unknown included
+		// (staleness then falls back to the timestamps).
+		if (draftFromBackend && (draftFromBackend as any).version_id == null) {
+			delete (effectiveFlow as any).version_id
+		}
 		savedFlow = structuredClone($state.snapshot(effectiveFlow)) as Flow
 		// Baseline for the autosave `discardIf`: the deployed flow WITHOUT the
 		// draft overlay (matches the unedited seed when no draft exists).
@@ -373,8 +383,11 @@
 		// Surface the saved `draft_path` to the Path widget so the topbar shows the
 		// pending name, not the `draft_{uuid}` URL. Else the widget seeds from the
 		// URL, the first edit clobbers `draft_path`, and the friendly name is lost.
+		// Otherwise the URL, set on every load: this route instance is reused when the
+		// editor follows its draft to a moved item, and the path it opened on is where
+		// deploy would look for the flow.
 		const renderedDraftPath = (effectiveFlow as any).draft_path as string | undefined
-		if (renderedDraftPath) flowInitialPath = renderedDraftPath
+		flowInitialPath = renderedDraftPath || (page.params.path ?? '')
 
 		// "Load another user's draft" handoff: render their value over the deployed
 		// metadata. Overlay mode (we have our own draft) never saves until the user
@@ -391,6 +404,14 @@
 			? ({ ...deployedFlow, ...(pendingLoad.value as object) } as Flow)
 			: effectiveFlow
 		flow = flowToRender
+		if (pendingLoad) {
+			// Their draft's base, not ours; see /scripts/edit. With none, the merge above
+			// would hand it the deployed one and the next save would persist that as its
+			// base, so it is dropped rather than inherited.
+			const theirs = (pendingLoad.value as { version_id?: number })?.version_id
+			draftBaseVersion = theirs != null ? String(theirs) : undefined
+			if (theirs == null) delete (flowToRender as any).version_id
+		}
 		if (pendingLoad && hasOwnDraft) {
 			OtherUserDraftLoad.beginOverlay({
 				workspace: $workspaceStore!,
@@ -506,7 +527,10 @@
 	{draftSavedAt}
 	{deployedAt}
 	{draftBaseVersion}
-	deployedHeadVersion={version}
+	deployedHeadVersion={version != null ? String(version) : undefined}
+	{deployedBy}
+	onViewDiff={() => flowBuilder?.openDiffDrawer()}
+	onBeforeRelocate={() => flowBuilder?.saveDraft()}
 	onLoadLatestDeploy={async () => {
 		// stopSync-bracketed; see /scripts/edit's restoreDeployed for the race.
 		if (!$workspaceStore) return
@@ -528,6 +552,18 @@
 	</div>
 {:else if renderEditor}
 	<FlowBuilder
+		onTakeLatest={draftBaseVersion
+			? async (shown?: string) => {
+					// The version the drawer showed as head; see /scripts/edit.
+					const head = shown != null ? Number(shown) : version
+					if (!draftSync.draft || head == null || !$workspaceStore) return
+					draftSync.draft = { ...draftSync.draft, version_id: head }
+					draftBaseVersion = String(head)
+					// See /scripts/edit: the head this page knows moves with the base.
+					version = head
+					await UserDraft.forcePersist('flow', flowDraftPath, { workspace: $workspaceStore })
+				}
+			: undefined}
 		onDeploy={(e) => {
 			// stopSync-bracketed immediate delete; see /scripts/edit's restoreDeployed.
 			if ($workspaceStore) {
@@ -557,6 +593,7 @@
 		{flowStore}
 		{flowStateStore}
 		bind:initialPath={flowInitialPath}
+		userDraftPath={page.params.path ?? ''}
 		liveEditorDraftStoragePath={flowDraftPath}
 		newFlow={isNewFlow}
 		{selectedId}
diff --git a/frontend/src/routes/(root)/(logged)/gcp_triggers/+page.svelte b/frontend/src/routes/(root)/(logged)/gcp_triggers/+page.svelte
index 24c7553378..3b61eb7801 100644
--- a/frontend/src/routes/(root)/(logged)/gcp_triggers/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/gcp_triggers/+page.svelte
@@ -1,654 +1,5 @@
 <script lang="ts">
-	import { getLocalDraftHint } from '$lib/localDraftHints.svelte'
-	import { run } from 'svelte/legacy'
-
-	import {
-		GcpTriggerService,
-		WorkspaceService,
-		type GcpTrigger,
-		type WorkspaceDeployUISettings,
-		type TriggerMode
-	} from '$lib/gen'
-	import {
-		canWrite,
-		copyToClipboard,
-		displayDate,
-		getLocalSetting,
-		sendUserToast,
-		storeLocalSetting,
-		removeTriggerKindIfUnused
-	} from '$lib/utils'
-	import { withForkConflictRetry } from '$lib/utils/forkConflict'
-	import { base } from '$app/paths'
-	import { page } from '$app/stores'
-	import CenteredPage from '$lib/components/CenteredPage.svelte'
-	import { Alert, Badge, Button, EmptyState, Skeleton } from '$lib/components/common'
-	import Dropdown from '$lib/components/DropdownV2.svelte'
-	import PageHeader from '$lib/components/PageHeader.svelte'
-	import SharedBadge from '$lib/components/SharedBadge.svelte'
-	import DraftBadge from '$lib/components/DraftBadge.svelte'
-	import ShareModal from '$lib/components/ShareModal.svelte'
-	import Toggle from '$lib/components/Toggle.svelte'
-	import { enterpriseLicense, usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
-	import {
-		Code,
-		Eye,
-		Pen,
-		Plus,
-		Shield,
-		Trash,
-		Circle,
-		FileUp,
-		ClipboardCopy,
-		Pause
-	} from 'lucide-svelte'
-	import { goto } from '$lib/navigation'
-	import SearchItems from '$lib/components/SearchItems.svelte'
-	import NoItemFound from '$lib/components/home/NoItemFound.svelte'
-	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
-	import ListFilters from '$lib/components/home/ListFilters.svelte'
-	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
-	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
-	import { setQuery } from '$lib/navigation'
-	import { onDestroy, onMount } from 'svelte'
-	import Popover from '$lib/components/Popover.svelte'
-	import { isCloudHosted } from '$lib/cloud'
-	import { ALL_DEPLOYABLE, isDeployable } from '$lib/utils_deployable'
-	import DeployWorkspaceDrawer from '$lib/components/DeployWorkspaceDrawer.svelte'
-	import GcpTriggerEditor from '$lib/components/triggers/gcp/GcpTriggerEditor.svelte'
-	import GoogleCloudIcon from '$lib/components/icons/GoogleCloudIcon.svelte'
-	import { getHttpRoute } from '$lib/components/triggers/http/utils'
-	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
-	import TriggerModeToggle from '$lib/components/triggers/TriggerModeToggle.svelte'
-
-	type TriggerD = GcpTrigger & { canWrite: boolean }
-
-	let triggers: TriggerD[] = $state([])
-	let shareModal: ShareModal | undefined = $state()
-	let loading = $state(true)
-	let deploymentDrawer: DeployWorkspaceDrawer | undefined = $state()
-	let deployUiSettings: WorkspaceDeployUISettings | undefined = $state(undefined)
-	let isDeleting = $state(false)
-	async function getDeployUiSettings() {
-		if (!$enterpriseLicense) {
-			deployUiSettings = ALL_DEPLOYABLE
-			return
-		}
-		let settings = await WorkspaceService.getPublicSettings({ workspace: $workspaceStore! })
-		deployUiSettings = settings.deploy_ui ?? ALL_DEPLOYABLE
-	}
-	getDeployUiSettings()
-	async function loadTriggers(): Promise<void> {
-		triggers = (
-			await GcpTriggerService.listGcpTriggers({
-				workspace: $workspaceStore!,
-				includeDraftOnly: true
-			})
-		).map((x) => {
-			return { canWrite: canWrite(x.path, x.extra_perms!, $userStore), ...x }
-		})
-		$usedTriggerKinds = removeTriggerKindIfUnused(triggers.length, 'gcp', $usedTriggerKinds)
-		loading = false
-	}
-
-	let interval = setInterval(async () => {
-		try {
-			const newTriggers = await GcpTriggerService.listGcpTriggers({
-				workspace: $workspaceStore!
-			})
-			for (let i = 0; i < triggers.length; i++) {
-				const newTrigger = newTriggers.find((x) => x.path === triggers[i].path)
-				if (newTrigger) {
-					triggers[i] = {
-						...triggers[i],
-						error: newTrigger.error,
-						last_server_ping: newTrigger.last_server_ping,
-						mode: newTrigger.mode,
-						server_id: newTrigger.server_id
-					}
-				}
-			}
-		} catch (err) {
-			console.error(err)
-		}
-	}, 5000)
-
-	onDestroy(() => {
-		clearInterval(interval)
-	})
-
-	async function onToggleMode(path: string, mode: TriggerMode): Promise<boolean> {
-		let committed = false
-		try {
-			const ok = await withForkConflictRetry(
-				(force) =>
-					GcpTriggerService.setGcpTriggerMode({
-						path,
-						workspace: $workspaceStore!,
-						requestBody: { mode, force }
-					}),
-				'GCP Pub/Sub trigger'
-			)
-			committed = ok
-			if (ok) loadTriggers()
-		} catch (err) {
-			sendUserToast(
-				`Cannot ${mode === 'enabled' ? 'enable' : mode === 'disabled' ? 'disable' : 'suspend'} GCP Pub/Sub trigger: ${err.body}`,
-				true
-			)
-			loadTriggers()
-		}
-		return committed
-	}
-
-	run(() => {
-		if ($workspaceStore && $userStore) {
-			loadTriggers()
-		}
-	})
-	let gcpTriggerEditor: GcpTriggerEditor | undefined = $state()
-
-	let hashHandled = false
-	$effect(() => {
-		if (!hashHandled && triggers.length > 0 && gcpTriggerEditor) {
-			let hash = $page.url.hash
-			if (hash.length > 1) {
-				let path = hash.slice(1)
-				let trigger = triggers.find((t) => t.path === path)
-				if (trigger) {
-					hashHandled = true
-					gcpTriggerEditor?.openEdit(path, trigger.is_flow)
-				}
-			}
-		}
-	})
-
-	let filteredItems: (TriggerD & { marked?: any })[] | undefined = $state([])
-	let items: typeof filteredItems | undefined = $state([])
-	let preFilteredItems: typeof filteredItems | undefined = $state([])
-	let filter = $state('')
-	let ownerFilter: string | undefined = $state(undefined)
-	let nbDisplayed = $state(15)
-	let deleteSubscription = $state(false)
-	let deleteSubscriptionCallback: (() => Promise<void>) | undefined = $state(undefined)
-	let deleteGcpTriggerCallback: (() => Promise<void>) | undefined = $state(undefined)
-	let subscriptionToDelete: string = $state('')
-	let currentTopic: string = $state('')
-	const TRIGGER_PATH_KIND_FILTER_SETTING = 'filter_path_of'
-	const FILTER_USER_FOLDER_SETTING_NAME = 'user_and_folders_only'
-	let selectedFilterKind = $state(
-		(getLocalSetting(TRIGGER_PATH_KIND_FILTER_SETTING) as 'trigger' | 'script_flow') ?? 'trigger'
-	)
-	let filterUserFolders = $state(getLocalSetting(FILTER_USER_FOLDER_SETTING_NAME) == 'true')
-
-	run(() => {
-		storeLocalSetting(TRIGGER_PATH_KIND_FILTER_SETTING, selectedFilterKind)
-	})
-	run(() => {
-		storeLocalSetting(FILTER_USER_FOLDER_SETTING_NAME, filterUserFolders ? 'true' : undefined)
-	})
-
-	function filterItemsPathsBaseOnUserFilters(
-		item: TriggerD,
-		selectedFilterKind: 'trigger' | 'script_flow',
-		filterUserFolders: boolean
-	) {
-		if ($workspaceStore == 'admins') return true
-		if (filterUserFolders) {
-			if (selectedFilterKind === 'trigger') {
-				return (
-					!item.path.startsWith('u/') || item.path.startsWith('u/' + $userStore?.username + '/')
-				)
-			} else {
-				return (
-					!item.script_path.startsWith('u/') ||
-					item.script_path.startsWith('u/' + $userStore?.username + '/')
-				)
-			}
-		} else {
-			return true
-		}
-	}
-
-	run(() => {
-		preFilteredItems =
-			ownerFilter != undefined
-				? selectedFilterKind === 'trigger'
-					? triggers?.filter(
-							(x) =>
-								x.path.startsWith(ownerFilter + '/') &&
-								filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-						)
-					: triggers?.filter(
-							(x) =>
-								x.script_path.startsWith(ownerFilter + '/') &&
-								filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-						)
-				: triggers?.filter((x) =>
-						filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-					)
-	})
-
-	run(() => {
-		if ($workspaceStore) {
-			ownerFilter = undefined
-		}
-	})
-
-	let owners = $derived(
-		selectedFilterKind === 'trigger'
-			? Array.from(
-					new Set(filteredItems?.map((x) => x.path.split('/').slice(0, 2).join('/')) ?? [])
-				).sort()
-			: Array.from(
-					new Set(filteredItems?.map((x) => x.script_path.split('/').slice(0, 2).join('/')) ?? [])
-				).sort()
-	)
-
-	run(() => {
-		items = filter !== '' ? filteredItems : preFilteredItems
-	})
-
-	function updateQueryFilters(selectedFilterKind, filterUserFolders) {
-		setQuery(
-			TRIGGER_PATH_KIND_FILTER_SETTING,
-			selectedFilterKind,
-			window.location.hash || undefined
-		).then(() => {
-			setQuery(
-				FILTER_USER_FOLDER_SETTING_NAME,
-				String(filterUserFolders),
-				window.location.hash || undefined
-			)
-		})
-	}
-
-	function loadQueryFilters() {
-		let url = new URL(window.location.href)
-		let queryFilterKind = url.searchParams.get(TRIGGER_PATH_KIND_FILTER_SETTING)
-		let queryFilterUserFolders = url.searchParams.get(FILTER_USER_FOLDER_SETTING_NAME)
-		if (queryFilterKind) {
-			selectedFilterKind = queryFilterKind as 'trigger' | 'script_flow'
-		}
-		if (queryFilterUserFolders) {
-			filterUserFolders = queryFilterUserFolders == 'true'
-		}
-	}
-	onMount(() => {
-		loadQueryFilters()
-	})
-
-	run(() => {
-		updateQueryFilters(selectedFilterKind, filterUserFolders)
-	})
+	import TriggerList from '$lib/components/triggers/TriggerList.svelte'
 </script>
 
-<ConfirmationModal
-	open={Boolean(deleteGcpTriggerCallback)}
-	title="Delete GCP Pub/Sub trigger"
-	confirmationText="Remove"
-	loading={isDeleting}
-	on:canceled={() => {
-		deleteGcpTriggerCallback = undefined
-	}}
-	on:confirmed={async () => {
-		if (deleteGcpTriggerCallback) {
-			isDeleting = true
-			if (deleteSubscription && deleteSubscriptionCallback) {
-				try {
-					await deleteSubscriptionCallback()
-				} catch (error) {
-					isDeleting = false
-					sendUserToast(error.body || error.message, true)
-					return
-				}
-			}
-			await deleteGcpTriggerCallback()
-		}
-		deleteGcpTriggerCallback = undefined
-	}}
->
-	<div class="flex flex-col w-full space-y-4">
-		<span>Are you sure you want to remove this trigger?</span>
-
-		<Toggle
-			options={{
-				left: `Delete subscription "${subscriptionToDelete}" subscribed to topic "${currentTopic}"?`
-			}}
-			bind:checked={deleteSubscription}
-		/>
-	</div>
-</ConfirmationModal>
-
-<DeployWorkspaceDrawer bind:this={deploymentDrawer} />
-<GcpTriggerEditor onUpdate={loadTriggers} bind:this={gcpTriggerEditor} />
-
-<SearchItems
-	{filter}
-	items={preFilteredItems}
-	bind:filteredItems
-	f={(x) => (x.summary ?? '') + ' ' + x.path + ' (' + x.script_path + ')'}
-/>
-
-<CenteredPage>
-	<PageHeader title="GCP Pub/Sub triggers" tooltip="GCP Pub/Sub trigger">
-		<Button
-			unifiedSize="md"
-			variant="accent"
-			startIcon={{ icon: Plus }}
-			on:click={() => gcpTriggerEditor?.openNew(false)}
-		>
-			New&nbsp;GCP Pub/Sub trigger
-		</Button>
-	</PageHeader>
-
-	{#if isCloudHosted()}
-		<Alert title="Not compatible with multi-tenant cloud" type="warning">
-			GCP Pub/Sub triggers are disabled in the multi-tenant cloud.
-		</Alert>
-	{/if}
-	<div class="w-full h-full flex flex-col">
-		<div class="w-full pb-4 pt-6">
-			<input type="text" placeholder="Search triggers" bind:value={filter} class="search-item" />
-			<div class="flex flex-row items-center gap-2 mt-6">
-				<div class="text-sm shrink-0"> Filter by path of </div>
-				<ToggleButtonGroup bind:selected={selectedFilterKind}>
-					{#snippet children({ item })}
-						<ToggleButton
-							value="trigger"
-							label="GCP Pub/Sub trigger"
-							icon={GoogleCloudIcon}
-							{item}
-						/>
-						<ToggleButton value="script_flow" label="Script/Flow" icon={Code} {item} />
-					{/snippet}
-				</ToggleButtonGroup>
-			</div>
-			<ListFilters syncQuery bind:selectedFilter={ownerFilter} filters={owners} />
-
-			<div class="flex flex-row items-center justify-end gap-4">
-				{#if $userStore?.is_super_admin && $userStore.username.includes('@')}
-					<Toggle size="xs" bind:checked={filterUserFolders} options={{ right: 'Only f/*' }} />
-				{:else if $userStore?.is_admin || $userStore?.is_super_admin}
-					<Toggle
-						size="xs"
-						bind:checked={filterUserFolders}
-						options={{ right: `Only u/${$userStore.username} and f/*` }}
-					/>
-				{/if}
-			</div>
-		</div>
-		{#if loading}
-			{#each new Array(6) as _}
-				<Skeleton layout={[[6], 0.4]} />
-			{/each}
-		{:else if !triggers?.length}
-			<EmptyState
-				icon={GoogleCloudIcon}
-				title="No GCP Pub/Sub triggers yet"
-				description="Windmill can subscribe to a GCP Pub/Sub topic and trigger scripts or flows on each message."
-				action={{
-					label: 'Add a GCP Pub/Sub trigger',
-					icon: Plus,
-					onClick: () => gcpTriggerEditor?.openNew(false),
-					aiId: 'gcp-triggers-empty-add',
-					aiDescription: 'Add GCP Pub/Sub trigger'
-				}}
-			/>
-		{:else if items?.length}
-			<div class="border rounded-md divide-y">
-				{#each items.slice(0, nbDisplayed) as { gcp_resource_path, project_id, topic_id, workspace_id, delivery_type, path, edited_by, error, edited_at, script_path, is_flow, extra_perms, canWrite, mode, server_id, subscription_id, retry, error_handler_path, error_handler_args, labels, draft_only, is_draft } (path)}
-					{@const hasDraft = getLocalDraftHint($workspaceStore, 'trigger_gcp', path) ?? is_draft}
-					{@const href = `${is_flow ? '/flows/get' : '/scripts/get'}/${script_path}`}
-					{@const ping = new Date()}
-					{@const pinging = ping && ping.getTime() > new Date().getTime() - 15 * 1000}
-					{@const effectiveMode = draft_only ? 'disabled' : mode}
-					{@const enabled = effectiveMode === 'enabled' || effectiveMode === 'suspended'}
-
-					<div
-						class="hover:bg-surface-hover w-full items-center px-4 py-2 gap-4 first-of-type:!border-t-0
-				first-of-type:rounded-t-md last-of-type:rounded-b-md flex flex-col"
-					>
-						<div class="w-full flex gap-5 items-center">
-							<RowIcon kind={is_flow ? 'flow' : 'script'} />
-
-							<a
-								href="#{path}"
-								onclick={() => gcpTriggerEditor?.openEdit(path, is_flow)}
-								class="min-w-0 grow hover:underline decoration-gray-400"
-							>
-								<div class="text-emphasis flex-wrap text-left text-xs font-semibold mb-1 truncate">
-									{path} - {topic_id}{hasDraft ? '*' : ''}
-								</div>
-								<div class="text-secondary text-xs truncate text-left font-light">
-									runnable: {script_path}
-								</div>
-							</a>
-
-							<div class="hidden lg:flex flex-row gap-1 items-center">
-								<SharedBadge {canWrite} extraPerms={extra_perms} />
-								{#if labels?.length}
-									{#each labels as label}
-										<Badge color="blue" small class="px-1" title="Label: {label}">{label}</Badge>
-									{/each}
-								{/if}
-							</div>
-
-							{#if delivery_type !== 'push'}
-								<div class="w-10">
-									{#if (enabled && (!pinging || error)) || (!enabled && error) || (enabled && !server_id)}
-										<Popover notClickable>
-											<span class="flex h-4 w-4">
-												<Circle
-													class="text-red-600 animate-ping absolute inline-flex fill-current"
-													size={12}
-												/>
-												<Circle class="text-red-600 relative inline-flex fill-current" size={12} />
-											</span>
-											{#snippet text()}
-												<div>
-													{#if enabled}
-														{#if !server_id}
-															GCP Pub/Sub trigger is starting...
-														{:else}
-															Could not connect to GCP Pub/Sub{error ? ': ' + error : ''}
-														{/if}
-													{:else}
-														Disabled because of an error: {error}
-													{/if}
-												</div>
-											{/snippet}
-										</Popover>
-									{:else if enabled}
-										<Popover notClickable>
-											<span class="flex h-4 w-4">
-												<Circle
-													class="text-green-600 relative inline-flex fill-current"
-													size={12}
-												/>
-											</span>
-											{#snippet text()}
-												<div>
-													Connected to GCP Pub/Sub{!server_id ? ' (shutting down...)' : ''}</div
-												>
-											{/snippet}
-										</Popover>
-									{/if}
-								</div>
-							{/if}
-
-							<div class="flex items-center justify-end gap-2 shrink-0 min-w-[8rem]">
-								<DraftBadge {draft_only} is_draft={hasDraft} />
-								{#if delivery_type !== 'push'}
-									<TriggerModeToggle
-										disabled={draft_only}
-										title={draft_only
-											? 'Draft only: deploy the trigger to enable it'
-											: hasDraft
-												? 'Enables/disables the deployed trigger; the draft is not affected'
-												: undefined}
-										onToggleMode={(newMode) => onToggleMode(path, newMode)}
-										triggerMode={effectiveMode}
-										includeModalConfig={{
-											triggerPath: path,
-											triggerKind: 'gcp',
-											runnableConfig: {
-												path: script_path,
-												kind: is_flow ? 'flow' : 'script',
-												retry,
-												errorHandlerPath: error_handler_path,
-												errorHandlerArgs: error_handler_args
-											}
-										}}
-										{canWrite}
-										hideToggleLabels
-										hideDropdown
-									/>
-								{/if}
-							</div>
-
-							<div class="flex gap-2 items-center justify-end">
-								{#if delivery_type === 'push'}
-									<Button
-										on:click={() =>
-											copyToClipboard(getHttpRoute('gcp/w', path, true, workspace_id))}
-										variant="subtle"
-										size="xs"
-										startIcon={{ icon: ClipboardCopy }}
-									>
-										Copy URL
-									</Button>
-								{/if}
-								<Button
-									on:click={() => gcpTriggerEditor?.openEdit(path, is_flow)}
-									size="xs"
-									startIcon={canWrite
-										? { icon: Pen }
-										: {
-												icon: Eye
-											}}
-									variant="subtle"
-								>
-									{canWrite ? 'Edit' : 'View'}
-								</Button>
-								<Dropdown
-									items={[
-										{
-											displayName: `View ${is_flow ? 'Flow' : 'Script'}`,
-											icon: Eye,
-											action: () => {
-												goto(href)
-											}
-										},
-										...(canWrite && !draft_only && mode !== 'suspended'
-											? [
-													{
-														displayName: 'Suspend job execution',
-														icon: Pause,
-														action: () => {
-															onToggleMode(path, 'suspended')
-														}
-													}
-												]
-											: []),
-										{
-											displayName: canWrite ? 'Edit' : 'View',
-											icon: canWrite ? Pen : Eye,
-											action: () => {
-												gcpTriggerEditor?.openEdit(path, is_flow)
-											}
-										},
-										...(isDeployable('trigger', path, deployUiSettings)
-											? [
-													{
-														displayName: 'Deploy to prod/staging',
-														icon: FileUp,
-														action: () => {
-															deploymentDrawer?.openDrawer(path, 'trigger', {
-																triggers: {
-																	kind: 'gcp'
-																}
-															})
-														}
-													}
-												]
-											: []),
-										{
-											displayName: 'Audit logs',
-											icon: Eye,
-											href: `${base}/audit_logs?resource=${path}`
-										},
-										{
-											displayName: 'Permissions',
-											icon: Shield,
-											action: () => {
-												shareModal?.openDrawer(path, 'gcp_trigger')
-											}
-										},
-										{
-											displayName: 'Delete',
-											type: 'delete',
-											icon: Trash,
-											disabled: !canWrite,
-											action: async () => {
-												isDeleting = false
-												deleteSubscription = false
-												subscriptionToDelete = subscription_id
-												currentTopic = topic_id
-												deleteSubscriptionCallback = async () => {
-													const requestBody = { subscription_id, project_id }
-													const message = gcp_resource_path
-														? await GcpTriggerService.deleteGcpSubscription({
-																workspace: $workspaceStore ?? '',
-																path: gcp_resource_path,
-																requestBody
-															})
-														: await GcpTriggerService.deleteGcpSubscriptionWithDefaultCredentials({
-																workspace: $workspaceStore ?? '',
-																requestBody
-															})
-													sendUserToast(message)
-												}
-												deleteGcpTriggerCallback = async () => {
-													const message = await GcpTriggerService.deleteGcpTrigger({
-														workspace: $workspaceStore ?? '',
-														path
-													})
-													sendUserToast(message)
-													loadTriggers()
-												}
-											}
-										}
-									]}
-								/>
-							</div>
-						</div>
-						<div class="w-full flex justify-between items-baseline">
-							<div
-								class="flex flex-wrap text-[0.7em] text-primary gap-1 items-center justify-end truncate pr-2"
-								>{#if edited_by}<div class="truncate">edited by {edited_by}</div>{/if}<div
-									class="truncate">{edited_by ? 'the ' : ''}{displayDate(edited_at)}</div
-								></div
-							></div
-						>
-					</div>
-				{/each}
-			</div>
-		{:else}
-			<NoItemFound />
-		{/if}
-	</div>
-	{#if items && items?.length > 15 && nbDisplayed < items.length}
-		<span class="text-xs"
-			>{nbDisplayed} items out of {items.length}
-			<button class="ml-4" onclick={() => (nbDisplayed += 30)}>load 30 more</button></span
-		>
-	{/if}
-</CenteredPage>
-
-<ShareModal
-	bind:this={shareModal}
-	on:change={() => {
-		loadTriggers()
-	}}
-/>
+<TriggerList triggerKind="gcp" />
diff --git a/frontend/src/routes/(root)/(logged)/kafka_triggers/+page.svelte b/frontend/src/routes/(root)/(logged)/kafka_triggers/+page.svelte
index 6ee790818a..c4d4f904f6 100644
--- a/frontend/src/routes/(root)/(logged)/kafka_triggers/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/kafka_triggers/+page.svelte
@@ -1,595 +1,5 @@
 <script lang="ts">
-	import { getLocalDraftHint } from '$lib/localDraftHints.svelte'
-	import { run } from 'svelte/legacy'
-
-	import {
-		KafkaTriggerService,
-		WorkspaceService,
-		type KafkaTrigger,
-		type TriggerMode,
-		type WorkspaceDeployUISettings
-	} from '$lib/gen'
-	import {
-		canWrite,
-		displayDate,
-		getLocalSetting,
-		sendUserToast,
-		storeLocalSetting,
-		removeTriggerKindIfUnused
-	} from '$lib/utils'
-	import { withForkConflictRetry } from '$lib/utils/forkConflict'
-	import { base } from '$app/paths'
-	import { page } from '$app/stores'
-	import CenteredPage from '$lib/components/CenteredPage.svelte'
-	import { Alert, Badge, Button, EmptyState, Skeleton } from '$lib/components/common'
-	import Dropdown from '$lib/components/DropdownV2.svelte'
-	import PageHeader from '$lib/components/PageHeader.svelte'
-	import SharedBadge from '$lib/components/SharedBadge.svelte'
-	import DraftBadge from '$lib/components/DraftBadge.svelte'
-	import ShareModal from '$lib/components/ShareModal.svelte'
-	import Toggle from '$lib/components/Toggle.svelte'
-	import {
-		userStore,
-		workspaceStore,
-		userWorkspaces,
-		enterpriseLicense,
-		usedTriggerKinds
-	} from '$lib/stores'
-	import { Code, Eye, Pen, Plus, Shield, Trash, Circle, FileUp, Pause } from 'lucide-svelte'
-	import { goto } from '$lib/navigation'
-	import SearchItems from '$lib/components/SearchItems.svelte'
-	import NoItemFound from '$lib/components/home/NoItemFound.svelte'
-	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
-	import ListFilters from '$lib/components/home/ListFilters.svelte'
-	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
-	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
-	import { setQuery } from '$lib/navigation'
-	import { onDestroy, onMount } from 'svelte'
-	import Popover from '$lib/components/Popover.svelte'
-	import { isCloudHosted } from '$lib/cloud'
-	import KafkaIcon from '$lib/components/icons/KafkaIcon.svelte'
-	import KafkaTriggerEditor from '$lib/components/triggers/kafka/KafkaTriggerEditor.svelte'
-	import { ALL_DEPLOYABLE, isDeployable } from '$lib/utils_deployable'
-	import DeployWorkspaceDrawer from '$lib/components/DeployWorkspaceDrawer.svelte'
-	import TriggerModeToggle from '$lib/components/triggers/TriggerModeToggle.svelte'
-
-	type TriggerW = KafkaTrigger & { canWrite: boolean }
-
-	let triggers: TriggerW[] = $state([])
-	let shareModal: ShareModal | undefined = $state()
-	let loading = $state(true)
-	let deploymentDrawer: DeployWorkspaceDrawer | undefined = $state()
-	let deployUiSettings: WorkspaceDeployUISettings | undefined = $state(undefined)
-
-	async function getDeployUiSettings() {
-		if (!$enterpriseLicense) {
-			deployUiSettings = ALL_DEPLOYABLE
-			return
-		}
-		let settings = await WorkspaceService.getPublicSettings({ workspace: $workspaceStore! })
-		deployUiSettings = settings.deploy_ui ?? ALL_DEPLOYABLE
-	}
-	getDeployUiSettings()
-
-	async function loadTriggers(): Promise<void> {
-		triggers = (
-			await KafkaTriggerService.listKafkaTriggers({
-				workspace: $workspaceStore!,
-				includeDraftOnly: true
-			})
-		).map((x) => {
-			return { canWrite: canWrite(x.path, x.extra_perms!, $userStore), ...x }
-		})
-		$usedTriggerKinds = removeTriggerKindIfUnused(triggers.length, 'kafka', $usedTriggerKinds)
-		loading = false
-	}
-
-	let interval = setInterval(async () => {
-		try {
-			const newTriggers = await KafkaTriggerService.listKafkaTriggers({
-				workspace: $workspaceStore!
-			})
-			for (let i = 0; i < triggers.length; i++) {
-				const newTrigger = newTriggers.find((x) => x.path === triggers[i].path)
-				if (newTrigger) {
-					triggers[i] = {
-						...triggers[i],
-						error: newTrigger.error,
-						last_server_ping: newTrigger.last_server_ping,
-						mode: newTrigger.mode,
-						server_id: newTrigger.server_id
-					}
-				}
-			}
-		} catch (err) {
-			console.error(err)
-		}
-	}, 5000)
-
-	onDestroy(() => {
-		clearInterval(interval)
-	})
-
-	async function onToggleMode(path: string, mode: TriggerMode): Promise<boolean> {
-		let committed = false
-		try {
-			const ok = await withForkConflictRetry(
-				(force) =>
-					KafkaTriggerService.setKafkaTriggerMode({
-						path,
-						workspace: $workspaceStore!,
-						requestBody: { mode, force }
-					}),
-				'Kafka trigger'
-			)
-			committed = ok
-			if (ok) loadTriggers()
-		} catch (err) {
-			sendUserToast(
-				`Cannot ` +
-					(mode === 'enabled' ? 'enable' : mode === 'disabled' ? 'disable' : 'suspend') +
-					` Kafka trigger: ${err.body}`,
-				true
-			)
-			loadTriggers()
-		}
-		return committed
-	}
-
-	run(() => {
-		if ($workspaceStore && $userStore) {
-			loadTriggers()
-		}
-	})
-	let kafkaTriggerEditor: KafkaTriggerEditor | undefined = $state()
-
-	let hashHandled = false
-	$effect(() => {
-		if (!hashHandled && triggers.length > 0 && kafkaTriggerEditor) {
-			let hash = $page.url.hash
-			if (hash.length > 1) {
-				let path = hash.slice(1)
-				let trigger = triggers.find((t) => t.path === path)
-				if (trigger) {
-					hashHandled = true
-					kafkaTriggerEditor?.openEdit(path, trigger.is_flow)
-				}
-			}
-		}
-	})
-
-	let filteredItems: (TriggerW & { marked?: any })[] | undefined = $state([])
-	let items: typeof filteredItems | undefined = $state([])
-	let preFilteredItems: typeof filteredItems | undefined = $state([])
-	let filter = $state('')
-	let ownerFilter: string | undefined = $state(undefined)
-	let nbDisplayed = $state(15)
-
-	const TRIGGER_PATH_KIND_FILTER_SETTING = 'filter_path_of'
-	const FILTER_USER_FOLDER_SETTING_NAME = 'user_and_folders_only'
-	let selectedFilterKind = $state(
-		(getLocalSetting(TRIGGER_PATH_KIND_FILTER_SETTING) as 'trigger' | 'script_flow') ?? 'trigger'
-	)
-	let filterUserFolders = $state(getLocalSetting(FILTER_USER_FOLDER_SETTING_NAME) == 'true')
-
-	run(() => {
-		storeLocalSetting(TRIGGER_PATH_KIND_FILTER_SETTING, selectedFilterKind)
-	})
-	run(() => {
-		storeLocalSetting(FILTER_USER_FOLDER_SETTING_NAME, filterUserFolders ? 'true' : undefined)
-	})
-
-	function filterItemsPathsBaseOnUserFilters(
-		item: TriggerW,
-		selectedFilterKind: 'trigger' | 'script_flow',
-		filterUserFolders: boolean
-	) {
-		if ($workspaceStore == 'admins') return true
-		if (filterUserFolders) {
-			if (selectedFilterKind === 'trigger') {
-				return (
-					!item.path.startsWith('u/') || item.path.startsWith('u/' + $userStore?.username + '/')
-				)
-			} else {
-				return (
-					!item.script_path.startsWith('u/') ||
-					item.script_path.startsWith('u/' + $userStore?.username + '/')
-				)
-			}
-		} else {
-			return true
-		}
-	}
-
-	run(() => {
-		preFilteredItems =
-			ownerFilter != undefined
-				? selectedFilterKind === 'trigger'
-					? triggers?.filter(
-							(x) =>
-								x.path.startsWith(ownerFilter + '/') &&
-								filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-						)
-					: triggers?.filter(
-							(x) =>
-								x.script_path.startsWith(ownerFilter + '/') &&
-								filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-						)
-				: triggers?.filter((x) =>
-						filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-					)
-	})
-
-	run(() => {
-		if ($workspaceStore) {
-			ownerFilter = undefined
-		}
-	})
-
-	let owners = $derived(
-		selectedFilterKind === 'trigger'
-			? Array.from(
-					new Set(filteredItems?.map((x) => x.path.split('/').slice(0, 2).join('/')) ?? [])
-				).sort()
-			: Array.from(
-					new Set(filteredItems?.map((x) => x.script_path.split('/').slice(0, 2).join('/')) ?? [])
-				).sort()
-	)
-
-	run(() => {
-		items = filter !== '' ? filteredItems : preFilteredItems
-	})
-
-	function updateQueryFilters(selectedFilterKind, filterUserFolders) {
-		setQuery(
-			TRIGGER_PATH_KIND_FILTER_SETTING,
-			selectedFilterKind,
-			window.location.hash || undefined
-		).then(() => {
-			setQuery(
-				FILTER_USER_FOLDER_SETTING_NAME,
-				String(filterUserFolders),
-				window.location.hash || undefined
-			)
-		})
-	}
-
-	function loadQueryFilters() {
-		let url = new URL(window.location.href)
-		let queryFilterKind = url.searchParams.get(TRIGGER_PATH_KIND_FILTER_SETTING)
-		let queryFilterUserFolders = url.searchParams.get(FILTER_USER_FOLDER_SETTING_NAME)
-		if (queryFilterKind) {
-			selectedFilterKind = queryFilterKind as 'trigger' | 'script_flow'
-		}
-		if (queryFilterUserFolders) {
-			filterUserFolders = queryFilterUserFolders == 'true'
-		}
-	}
-
-	onMount(() => {
-		loadQueryFilters()
-	})
-
-	run(() => {
-		updateQueryFilters(selectedFilterKind, filterUserFolders)
-	})
+	import TriggerList from '$lib/components/triggers/TriggerList.svelte'
 </script>
 
-<DeployWorkspaceDrawer bind:this={deploymentDrawer} />
-<KafkaTriggerEditor onUpdate={loadTriggers} bind:this={kafkaTriggerEditor} />
-
-<SearchItems
-	{filter}
-	items={preFilteredItems}
-	bind:filteredItems
-	f={(x) => (x.summary ?? '') + ' ' + x.path + ' (' + x.script_path + ')'}
-/>
-
-{#if $userStore?.operator && $workspaceStore && !$userWorkspaces.find((_) => _.id === $workspaceStore)?.operator_settings?.triggers}
-	<div class="bg-red-100 border-l-4 border-red-600 text-orange-700 p-4 m-4 mt-12" role="alert">
-		<p class="font-bold">Unauthorized</p>
-		<p>Page not available for operators</p>
-	</div>
-{:else}
-	<CenteredPage>
-		<PageHeader
-			title="Kafka triggers"
-			tooltip="Windmill can consume kafka events and trigger scripts or flows based on them."
-		>
-			<Button
-				unifiedSize="md"
-				variant="accent"
-				startIcon={{ icon: Plus }}
-				on:click={() => kafkaTriggerEditor?.openNew(false)}
-			>
-				New&nbsp;Kafka trigger
-			</Button>
-		</PageHeader>
-
-		{#if isCloudHosted()}
-			<Alert title="Not compatible with multi-tenant cloud" type="warning">
-				Kafka triggers are disabled in the multi-tenant cloud.
-			</Alert>
-			<div class="py-4"></div>
-		{/if}
-		<div class="w-full h-full flex flex-col">
-			<div class="w-full pb-4 pt-6">
-				<input
-					type="text"
-					placeholder="Search Kafka triggers"
-					bind:value={filter}
-					class="search-item"
-				/>
-				<div class="flex flex-row items-center gap-2 mt-6">
-					<div class="text-sm shrink-0"> Filter by path of </div>
-					<ToggleButtonGroup bind:selected={selectedFilterKind}>
-						{#snippet children({ item })}
-							<ToggleButton value="trigger" label="Kafka trigger" icon={KafkaIcon} {item} />
-							<ToggleButton value="script_flow" label="Script/Flow" icon={Code} {item} />
-						{/snippet}
-					</ToggleButtonGroup>
-				</div>
-				<ListFilters syncQuery bind:selectedFilter={ownerFilter} filters={owners} />
-
-				<div class="flex flex-row items-center justify-end gap-4">
-					{#if $userStore?.is_super_admin && $userStore.username.includes('@')}
-						<Toggle size="xs" bind:checked={filterUserFolders} options={{ right: 'Only f/*' }} />
-					{:else if $userStore?.is_admin || $userStore?.is_super_admin}
-						<Toggle
-							size="xs"
-							bind:checked={filterUserFolders}
-							options={{ right: `Only u/${$userStore.username} and f/*` }}
-						/>
-					{/if}
-				</div>
-			</div>
-			{#if loading}
-				{#each new Array(6) as _}
-					<Skeleton layout={[[6], 0.4]} />
-				{/each}
-			{:else if !triggers?.length}
-				<EmptyState
-					icon={KafkaIcon}
-					title="No Kafka triggers yet"
-					description="Windmill can consume Kafka events and trigger scripts or flows based on them."
-					action={{
-						label: 'Add a Kafka trigger',
-						icon: Plus,
-						onClick: () => kafkaTriggerEditor?.openNew(false),
-						aiId: 'kafka-triggers-empty-add',
-						aiDescription: 'Add Kafka trigger'
-					}}
-				/>
-			{:else if items?.length}
-				<div class="border rounded-md divide-y">
-					{#each items.slice(0, nbDisplayed) as { path, edited_by, edited_at, script_path, is_flow, kafka_resource_path, topics, extra_perms, canWrite, marked, server_id, error, last_server_ping, mode, retry, error_handler_path, error_handler_args, labels, draft_only, is_draft } (path)}
-						{@const hasDraft =
-							getLocalDraftHint($workspaceStore, 'trigger_kafka', path) ?? is_draft}
-						{@const href = `${is_flow ? '/flows/get' : '/scripts/get'}/${script_path}`}
-						{@const ping = last_server_ping ? new Date(last_server_ping) : undefined}
-						{@const pinging = ping && ping.getTime() > new Date().getTime() - 15 * 1000}
-						{@const effectiveMode = draft_only ? 'disabled' : mode}
-						{@const enabled = effectiveMode === 'enabled' || effectiveMode === 'suspended'}
-
-						<div
-							class="hover:bg-surface-hover w-full items-center px-4 py-2 gap-4 first-of-type:!border-t-0
-				first-of-type:rounded-t-md last-of-type:rounded-b-md flex flex-col"
-						>
-							<div class="w-full flex gap-5 items-center">
-								<RowIcon kind={is_flow ? 'flow' : 'script'} />
-
-								<a
-									href="#{path}"
-									onclick={() => kafkaTriggerEditor?.openEdit(path, is_flow)}
-									class="min-w-0 grow hover:underline decoration-gray-400"
-								>
-									<div
-										class="text-emphasis flex-wrap text-left text-xs font-semibold mb-1 truncate"
-									>
-										{#if marked}
-											<span class="text-xs">
-												{@html marked}
-											</span>
-										{:else}
-											{kafka_resource_path} - {topics.join(', ')}
-										{/if}{hasDraft ? '*' : ''}
-									</div>
-									<div class="text-secondary text-xs truncate text-left font-light">
-										{path}
-									</div>
-									<div class="text-secondary text-xs truncate text-left font-light">
-										runnable: {script_path}
-									</div>
-								</a>
-
-								<div class="hidden lg:flex flex-row gap-1 items-center">
-									<SharedBadge {canWrite} extraPerms={extra_perms} />
-									{#if labels?.length}
-										{#each labels as label}
-											<Badge color="blue" small class="px-1" title="Label: {label}">{label}</Badge>
-										{/each}
-									{/if}
-								</div>
-
-								<div class="w-10">
-									{#if (enabled && (!pinging || error)) || (!enabled && error) || (enabled && !server_id)}
-										<Popover notClickable>
-											<span class="flex h-4 w-4">
-												<Circle
-													class="text-red-600 animate-ping absolute inline-flex fill-current"
-													size={12}
-												/>
-												<Circle class="text-red-600 relative inline-flex fill-current" size={12} />
-											</span>
-											{#snippet text()}
-												<div>
-													{#if enabled}
-														{#if !server_id}
-															Consumer is starting...
-														{:else}
-															Consumer is not connected{error ? ': ' + error : ''}
-														{/if}
-													{:else}
-														Consumer was disabled because of an error: {error}
-													{/if}
-												</div>
-											{/snippet}
-										</Popover>
-									{:else if enabled}
-										<Popover notClickable>
-											<span class="flex h-4 w-4">
-												<Circle
-													class="text-green-600 relative inline-flex fill-current"
-													size={12}
-												/>
-											</span>
-											{#snippet text()}
-												<div> Consumer is connected </div>
-											{/snippet}
-										</Popover>
-									{/if}
-								</div>
-
-								<div class="flex items-center justify-end gap-2 shrink-0 min-w-[8rem]">
-									<DraftBadge {draft_only} is_draft={hasDraft} />
-									<TriggerModeToggle
-										disabled={draft_only}
-										title={draft_only
-											? 'Draft only: deploy the trigger to enable it'
-											: hasDraft
-												? 'Enables/disables the deployed trigger; the draft is not affected'
-												: undefined}
-										onToggleMode={(newMode) => onToggleMode(path, newMode)}
-										triggerMode={effectiveMode}
-										includeModalConfig={{
-											triggerPath: path,
-											triggerKind: 'kafka',
-											runnableConfig: {
-												path: script_path,
-												kind: is_flow ? 'flow' : 'script',
-												retry,
-												errorHandlerPath: error_handler_path,
-												errorHandlerArgs: error_handler_args
-											}
-										}}
-										{canWrite}
-										hideToggleLabels
-										hideDropdown
-									/>
-								</div>
-
-								<div class="flex gap-2 items-center justify-end">
-									<Button
-										on:click={() => kafkaTriggerEditor?.openEdit(path, is_flow)}
-										unifiedSize="md"
-										startIcon={canWrite
-											? { icon: Pen }
-											: {
-													icon: Eye
-												}}
-										variant="subtle"
-									>
-										{canWrite ? 'Edit' : 'View'}
-									</Button>
-									<Dropdown
-										size="md"
-										items={[
-											{
-												displayName: `View ${is_flow ? 'Flow' : 'Script'}`,
-												icon: Eye,
-												action: () => {
-													goto(href)
-												}
-											},
-											...(canWrite && !draft_only && mode !== 'suspended'
-												? [
-														{
-															displayName: 'Suspend job execution',
-															icon: Pause,
-															action: () => {
-																onToggleMode(path, 'suspended')
-															}
-														}
-													]
-												: []),
-											{
-												displayName: 'Delete',
-												type: 'delete',
-												icon: Trash,
-												disabled: !canWrite,
-												action: async () => {
-													await KafkaTriggerService.deleteKafkaTrigger({
-														workspace: $workspaceStore ?? '',
-														path
-													})
-													loadTriggers()
-												}
-											},
-											{
-												displayName: canWrite ? 'Edit' : 'View',
-												icon: canWrite ? Pen : Eye,
-												action: () => {
-													kafkaTriggerEditor?.openEdit(path, is_flow)
-												}
-											},
-											...(isDeployable('trigger', path, deployUiSettings)
-												? [
-														{
-															displayName: 'Deploy to prod/staging',
-															icon: FileUp,
-															action: () => {
-																deploymentDrawer?.openDrawer(path, 'trigger', {
-																	triggers: {
-																		kind: 'kafka'
-																	}
-																})
-															}
-														}
-													]
-												: []),
-											{
-												displayName: 'Audit logs',
-												icon: Eye,
-												href: `${base}/audit_logs?resource=${path}`
-											},
-											{
-												displayName: 'Permissions',
-												icon: Shield,
-												action: () => {
-													shareModal?.openDrawer(path, 'kafka_trigger')
-												}
-											}
-										]}
-									/>
-								</div>
-							</div>
-							<div class="w-full flex justify-between items-baseline">
-								<div
-									class="flex flex-wrap text-2xs font-normal text-secondary gap-1 items-center justify-end truncate pr-2"
-									>{#if edited_by}<div class="truncate">Edited by {edited_by}</div>{/if}<div
-										class="truncate">{edited_by ? 'the ' : ''}{displayDate(edited_at)}</div
-									></div
-								></div
-							>
-						</div>
-					{/each}
-				</div>
-			{:else}
-				<NoItemFound />
-			{/if}
-		</div>
-		{#if items && items?.length > 15 && nbDisplayed < items.length}
-			<span class="text-xs"
-				>{nbDisplayed} items out of {items.length}
-				<button class="ml-4" onclick={() => (nbDisplayed += 30)}>load 30 more</button></span
-			>
-		{/if}
-	</CenteredPage>
-{/if}
-
-<ShareModal
-	bind:this={shareModal}
-	on:change={() => {
-		loadTriggers()
-	}}
-/>
+<TriggerList triggerKind="kafka" />
diff --git a/frontend/src/routes/(root)/(logged)/mqtt_triggers/+page.svelte b/frontend/src/routes/(root)/(logged)/mqtt_triggers/+page.svelte
index 126dfda031..41c30157ff 100644
--- a/frontend/src/routes/(root)/(logged)/mqtt_triggers/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/mqtt_triggers/+page.svelte
@@ -1,570 +1,5 @@
 <script lang="ts">
-	import { getLocalDraftHint } from '$lib/localDraftHints.svelte'
-	import { run } from 'svelte/legacy'
-
-	import {
-		MqttTriggerService,
-		WorkspaceService,
-		type MqttTrigger,
-		type TriggerMode,
-		type WorkspaceDeployUISettings
-	} from '$lib/gen'
-	import {
-		canWrite,
-		capitalize,
-		displayDate,
-		getLocalSetting,
-		sendUserToast,
-		storeLocalSetting,
-		removeTriggerKindIfUnused
-	} from '$lib/utils'
-	import { withForkConflictRetry } from '$lib/utils/forkConflict'
-	import { base } from '$app/paths'
-	import { page } from '$app/stores'
-	import CenteredPage from '$lib/components/CenteredPage.svelte'
-	import { Alert, Badge, Button, EmptyState, Skeleton } from '$lib/components/common'
-	import Dropdown from '$lib/components/DropdownV2.svelte'
-	import PageHeader from '$lib/components/PageHeader.svelte'
-	import SharedBadge from '$lib/components/SharedBadge.svelte'
-	import DraftBadge from '$lib/components/DraftBadge.svelte'
-	import ShareModal from '$lib/components/ShareModal.svelte'
-	import Toggle from '$lib/components/Toggle.svelte'
-	import { enterpriseLicense, usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
-	import { Code, Eye, Pen, Plus, Shield, Trash, Circle, FileUp, Pause } from 'lucide-svelte'
-	import { goto } from '$lib/navigation'
-	import SearchItems from '$lib/components/SearchItems.svelte'
-	import NoItemFound from '$lib/components/home/NoItemFound.svelte'
-	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
-	import ListFilters from '$lib/components/home/ListFilters.svelte'
-	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
-	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
-	import { setQuery } from '$lib/navigation'
-	import { onDestroy, onMount } from 'svelte'
-	import Popover from '$lib/components/Popover.svelte'
-	import { isCloudHosted } from '$lib/cloud'
-	import MqttTriggerEditor from '$lib/components/triggers/mqtt/MqttTriggerEditor.svelte'
-	import MqttIcon from '$lib/components/icons/MqttIcon.svelte'
-	import { ALL_DEPLOYABLE, isDeployable } from '$lib/utils_deployable'
-	import DeployWorkspaceDrawer from '$lib/components/DeployWorkspaceDrawer.svelte'
-	import TriggerModeToggle from '$lib/components/triggers/TriggerModeToggle.svelte'
-
-	type TriggerM = MqttTrigger & { canWrite: boolean }
-
-	let triggers: TriggerM[] = $state([])
-	let shareModal: ShareModal | undefined = $state()
-	let loading = $state(true)
-	let deploymentDrawer: DeployWorkspaceDrawer | undefined = $state()
-	let deployUiSettings: WorkspaceDeployUISettings | undefined = $state(undefined)
-
-	async function getDeployUiSettings() {
-		if (!$enterpriseLicense) {
-			deployUiSettings = ALL_DEPLOYABLE
-			return
-		}
-		let settings = await WorkspaceService.getPublicSettings({ workspace: $workspaceStore! })
-		deployUiSettings = settings.deploy_ui ?? ALL_DEPLOYABLE
-	}
-	getDeployUiSettings()
-
-	async function loadTriggers(): Promise<void> {
-		triggers = (
-			await MqttTriggerService.listMqttTriggers({
-				workspace: $workspaceStore!,
-				includeDraftOnly: true
-			})
-		).map((x) => {
-			return { canWrite: canWrite(x.path, x.extra_perms!, $userStore), ...x }
-		})
-		$usedTriggerKinds = removeTriggerKindIfUnused(triggers.length, 'mqtt', $usedTriggerKinds)
-		loading = false
-	}
-
-	let interval = setInterval(async () => {
-		try {
-			const newTriggers = await MqttTriggerService.listMqttTriggers({
-				workspace: $workspaceStore!
-			})
-			for (let i = 0; i < triggers.length; i++) {
-				const newTrigger = newTriggers.find((x) => x.path === triggers[i].path)
-				if (newTrigger) {
-					triggers[i] = {
-						...triggers[i],
-						error: newTrigger.error,
-						last_server_ping: newTrigger.last_server_ping,
-						mode: newTrigger.mode,
-						server_id: newTrigger.server_id
-					}
-				}
-			}
-		} catch (err) {
-			console.error(err)
-		}
-	}, 5000)
-
-	onDestroy(() => {
-		clearInterval(interval)
-	})
-
-	async function onToggleMode(path: string, mode: TriggerMode): Promise<boolean> {
-		let committed = false
-		try {
-			const ok = await withForkConflictRetry(
-				(force) =>
-					MqttTriggerService.setMqttTriggerMode({
-						path,
-						workspace: $workspaceStore!,
-						requestBody: { mode, force }
-					}),
-				'MQTT trigger'
-			)
-			if (ok) {
-				sendUserToast(`${capitalize(mode)} MQTT trigger ${path}`)
-				loadTriggers()
-			}
-			committed = ok
-		} catch (err) {
-			sendUserToast(
-				`Cannot ${mode === 'enabled' ? 'enable' : mode === 'disabled' ? 'disable' : 'suspend'} mqtt trigger: ${err.body}`,
-				true
-			)
-			loadTriggers()
-		}
-		return committed
-	}
-
-	run(() => {
-		if ($workspaceStore && $userStore) {
-			loadTriggers()
-		}
-	})
-	let mqttTriggerEditor: MqttTriggerEditor | undefined = $state()
-
-	let hashHandled = false
-	$effect(() => {
-		if (!hashHandled && triggers.length > 0 && mqttTriggerEditor) {
-			let hash = $page.url.hash
-			if (hash.length > 1) {
-				let path = hash.slice(1)
-				let trigger = triggers.find((t) => t.path === path)
-				if (trigger) {
-					hashHandled = true
-					mqttTriggerEditor?.openEdit(path, trigger.is_flow)
-				}
-			}
-		}
-	})
-
-	let filteredItems: (TriggerM & { marked?: any })[] | undefined = $state([])
-	let items: typeof filteredItems | undefined = $state([])
-	let preFilteredItems: typeof filteredItems | undefined = $state([])
-	let filter = $state('')
-	let ownerFilter: string | undefined = $state(undefined)
-	let nbDisplayed = $state(15)
-
-	const TRIGGER_PATH_KIND_FILTER_SETTING = 'filter_path_of'
-	const FILTER_USER_FOLDER_SETTING_NAME = 'user_and_folders_only'
-	let selectedFilterKind = $state(
-		(getLocalSetting(TRIGGER_PATH_KIND_FILTER_SETTING) as 'trigger' | 'script_flow') ?? 'trigger'
-	)
-	let filterUserFolders = $state(getLocalSetting(FILTER_USER_FOLDER_SETTING_NAME) == 'true')
-
-	run(() => {
-		storeLocalSetting(TRIGGER_PATH_KIND_FILTER_SETTING, selectedFilterKind)
-	})
-	run(() => {
-		storeLocalSetting(FILTER_USER_FOLDER_SETTING_NAME, filterUserFolders ? 'true' : undefined)
-	})
-
-	function filterItemsPathsBaseOnUserFilters(
-		item: TriggerM,
-		selectedFilterKind: 'trigger' | 'script_flow',
-		filterUserFolders: boolean
-	) {
-		if ($workspaceStore == 'admins') return true
-		if (filterUserFolders) {
-			if (selectedFilterKind === 'trigger') {
-				return (
-					!item.path.startsWith('u/') || item.path.startsWith('u/' + $userStore?.username + '/')
-				)
-			} else {
-				return (
-					!item.script_path.startsWith('u/') ||
-					item.script_path.startsWith('u/' + $userStore?.username + '/')
-				)
-			}
-		} else {
-			return true
-		}
-	}
-
-	run(() => {
-		preFilteredItems =
-			ownerFilter != undefined
-				? selectedFilterKind === 'trigger'
-					? triggers?.filter(
-							(x) =>
-								x.path.startsWith(ownerFilter + '/') &&
-								filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-						)
-					: triggers?.filter(
-							(x) =>
-								x.script_path.startsWith(ownerFilter + '/') &&
-								filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-						)
-				: triggers?.filter((x) =>
-						filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-					)
-	})
-
-	run(() => {
-		if ($workspaceStore) {
-			ownerFilter = undefined
-		}
-	})
-
-	let owners = $derived(
-		selectedFilterKind === 'trigger'
-			? Array.from(
-					new Set(filteredItems?.map((x) => x.path.split('/').slice(0, 2).join('/')) ?? [])
-				).sort()
-			: Array.from(
-					new Set(filteredItems?.map((x) => x.script_path.split('/').slice(0, 2).join('/')) ?? [])
-				).sort()
-	)
-
-	run(() => {
-		items = filter !== '' ? filteredItems : preFilteredItems
-	})
-
-	function updateQueryFilters(selectedFilterKind, filterUserFolders) {
-		setQuery(
-			TRIGGER_PATH_KIND_FILTER_SETTING,
-			selectedFilterKind,
-			window.location.hash || undefined
-		).then(() => {
-			setQuery(
-				FILTER_USER_FOLDER_SETTING_NAME,
-				String(filterUserFolders),
-				window.location.hash || undefined
-			)
-		})
-	}
-
-	function loadQueryFilters() {
-		let url = new URL(window.location.href)
-		let queryFilterKind = url.searchParams.get(TRIGGER_PATH_KIND_FILTER_SETTING)
-		let queryFilterUserFolders = url.searchParams.get(FILTER_USER_FOLDER_SETTING_NAME)
-		if (queryFilterKind) {
-			selectedFilterKind = queryFilterKind as 'trigger' | 'script_flow'
-		}
-		if (queryFilterUserFolders) {
-			filterUserFolders = queryFilterUserFolders == 'true'
-		}
-	}
-
-	onMount(() => {
-		loadQueryFilters()
-	})
-
-	run(() => {
-		updateQueryFilters(selectedFilterKind, filterUserFolders)
-	})
+	import TriggerList from '$lib/components/triggers/TriggerList.svelte'
 </script>
 
-<DeployWorkspaceDrawer bind:this={deploymentDrawer} />
-<MqttTriggerEditor onUpdate={loadTriggers} bind:this={mqttTriggerEditor} />
-
-<SearchItems
-	{filter}
-	items={preFilteredItems}
-	bind:filteredItems
-	f={(x) => (x.summary ?? '') + ' ' + x.path + ' (' + x.script_path + ')'}
-/>
-
-<CenteredPage>
-	<PageHeader
-		title="MQTT triggers"
-		tooltip="Windmill can connect to an MQTT broker, subscribe to specific topics, and trigger scripts or flows based on those topics."
-	>
-		<Button
-			unifiedSize="md"
-			variant="accent"
-			startIcon={{ icon: Plus }}
-			on:click={() => mqttTriggerEditor?.openNew(false)}
-		>
-			New&nbsp;MQTT trigger
-		</Button>
-	</PageHeader>
-
-	{#if isCloudHosted()}
-		<Alert title="Not compatible with multi-tenant cloud" type="warning">
-			MQTT triggers are disabled in the multi-tenant cloud.
-		</Alert>
-		<div class="py-4"></div>
-	{/if}
-	<div class="w-full h-full flex flex-col">
-		<div class="w-full pb-4 pt-6">
-			<input
-				type="text"
-				placeholder="Search MQTT triggers"
-				bind:value={filter}
-				class="search-item"
-			/>
-			<div class="flex flex-row items-center gap-2 mt-6">
-				<div class="text-sm shrink-0"> Filter by path of </div>
-				<ToggleButtonGroup bind:selected={selectedFilterKind}>
-					{#snippet children({ item })}
-						<ToggleButton value="trigger" label="MQTT trigger" icon={MqttIcon} {item} />
-						<ToggleButton value="script_flow" label="Script/Flow" icon={Code} {item} />
-					{/snippet}
-				</ToggleButtonGroup>
-			</div>
-			<ListFilters syncQuery bind:selectedFilter={ownerFilter} filters={owners} />
-
-			<div class="flex flex-row items-center justify-end gap-4">
-				{#if $userStore?.is_super_admin && $userStore.username.includes('@')}
-					<Toggle size="xs" bind:checked={filterUserFolders} options={{ right: 'Only f/*' }} />
-				{:else if $userStore?.is_admin || $userStore?.is_super_admin}
-					<Toggle
-						size="xs"
-						bind:checked={filterUserFolders}
-						options={{ right: `Only u/${$userStore.username} and f/*` }}
-					/>
-				{/if}
-			</div>
-		</div>
-		{#if loading}
-			{#each new Array(6) as _}
-				<Skeleton layout={[[6], 0.4]} />
-			{/each}
-		{:else if !triggers?.length}
-			<EmptyState
-				icon={MqttIcon}
-				title="No MQTT triggers yet"
-				description="Windmill can connect to an MQTT broker, subscribe to specific topics, and trigger scripts or flows based on those topics."
-				action={{
-					label: 'Add an MQTT trigger',
-					icon: Plus,
-					onClick: () => mqttTriggerEditor?.openNew(false),
-					aiId: 'mqtt-triggers-empty-add',
-					aiDescription: 'Add MQTT trigger'
-				}}
-			/>
-		{:else if items?.length}
-			<div class="border rounded-md divide-y">
-				{#each items.slice(0, nbDisplayed) as { path, edited_by, edited_at, script_path, is_flow, extra_perms, canWrite, error, last_server_ping, server_id, mode, retry, error_handler_path, error_handler_args, labels, draft_only, is_draft } (path)}
-					{@const hasDraft = getLocalDraftHint($workspaceStore, 'trigger_mqtt', path) ?? is_draft}
-					{@const href = `${is_flow ? '/flows/get' : '/scripts/get'}/${script_path}`}
-					{@const ping = last_server_ping ? new Date(last_server_ping) : undefined}
-					{@const pinging = ping && ping.getTime() > new Date().getTime() - 15 * 1000}
-					{@const effectiveMode = draft_only ? 'disabled' : mode}
-					{@const enabled = effectiveMode === 'enabled' || effectiveMode === 'suspended'}
-
-					<div
-						class="hover:bg-surface-hover w-full items-center px-4 py-2 gap-4 first-of-type:!border-t-0
-				first-of-type:rounded-t-md last-of-type:rounded-b-md flex flex-col"
-					>
-						<div class="w-full flex gap-5 items-center">
-							<RowIcon kind={is_flow ? 'flow' : 'script'} />
-
-							<a
-								href="#{path}"
-								onclick={() => mqttTriggerEditor?.openEdit(path, is_flow)}
-								class="min-w-0 grow hover:underline decoration-gray-400"
-							>
-								<div class="text-emphasis font-semibold text-xs truncate text-left">
-									{path}{hasDraft ? '*' : ''}
-								</div>
-								<div class="text-secondary text-xs truncate text-left font-light">
-									runnable: {script_path}
-								</div>
-							</a>
-
-							<div class="hidden lg:flex flex-row gap-1 items-center">
-								<SharedBadge {canWrite} extraPerms={extra_perms} />
-								{#if labels?.length}
-									{#each labels as label}
-										<Badge color="blue" small class="px-1" title="Label: {label}">{label}</Badge>
-									{/each}
-								{/if}
-							</div>
-
-							<div class="w-10">
-								{#if (enabled && (!pinging || error)) || (!enabled && error) || (enabled && !server_id)}
-									<Popover notClickable>
-										<span class="flex h-4 w-4">
-											<Circle
-												class="text-red-600 animate-ping absolute inline-flex fill-current"
-												size={12}
-											/>
-											<Circle class="text-red-600 relative inline-flex fill-current" size={12} />
-										</span>
-										{#snippet text()}
-											<div>
-												{#if enabled}
-													{#if !server_id}
-														MQTT trigger is starting...
-													{:else}
-														MQTT trigger is not connected{error ? ': ' + error : ''}
-													{/if}
-												{:else}
-													MQTT trigger was disabled because of an error: {error}
-												{/if}
-											</div>
-										{/snippet}
-									</Popover>
-								{:else if enabled}
-									<Popover notClickable>
-										<span class="flex h-4 w-4">
-											<Circle class="text-green-600 relative inline-flex fill-current" size={12} />
-										</span>
-										{#snippet text()}
-											<div>
-												MQTT trigger is connected{!server_id ? ' (shutting down...)' : ''}
-											</div>
-										{/snippet}
-									</Popover>
-								{/if}
-							</div>
-
-							<div class="flex items-center justify-end gap-2 shrink-0 min-w-[8rem]">
-								<DraftBadge {draft_only} is_draft={hasDraft} />
-								<TriggerModeToggle
-									disabled={draft_only}
-									title={draft_only
-										? 'Draft only: deploy the trigger to enable it'
-										: hasDraft
-											? 'Enables/disables the deployed trigger; the draft is not affected'
-											: undefined}
-									onToggleMode={(newMode) => onToggleMode(path, newMode)}
-									triggerMode={effectiveMode}
-									includeModalConfig={{
-										triggerPath: path,
-										triggerKind: 'mqtt',
-										runnableConfig: {
-											path: script_path,
-											kind: is_flow ? 'flow' : 'script',
-											retry,
-											errorHandlerPath: error_handler_path,
-											errorHandlerArgs: error_handler_args
-										}
-									}}
-									{canWrite}
-									hideToggleLabels
-									hideDropdown
-								/>
-							</div>
-
-							<div class="flex gap-2 items-center justify-end">
-								<Button
-									on:click={() => mqttTriggerEditor?.openEdit(path, is_flow)}
-									unifiedSize="md"
-									startIcon={canWrite
-										? { icon: Pen }
-										: {
-												icon: Eye
-											}}
-									variant="subtle"
-								>
-									{canWrite ? 'Edit' : 'View'}
-								</Button>
-								<Dropdown
-									items={[
-										{
-											displayName: `View ${is_flow ? 'Flow' : 'Script'}`,
-											icon: Eye,
-											action: () => {
-												goto(href)
-											}
-										},
-										...(canWrite && !draft_only && mode !== 'suspended'
-											? [
-													{
-														displayName: 'Suspend job execution',
-														icon: Pause,
-														action: () => {
-															onToggleMode(path, 'suspended')
-														}
-													}
-												]
-											: []),
-										{
-											displayName: canWrite ? 'Edit' : 'View',
-											icon: canWrite ? Pen : Eye,
-											action: () => {
-												mqttTriggerEditor?.openEdit(path, is_flow)
-											}
-										},
-										...(isDeployable('trigger', path, deployUiSettings)
-											? [
-													{
-														displayName: 'Deploy to prod/staging',
-														icon: FileUp,
-														action: () => {
-															deploymentDrawer?.openDrawer(path, 'trigger', {
-																triggers: {
-																	kind: 'mqtt'
-																}
-															})
-														}
-													}
-												]
-											: []),
-										{
-											displayName: 'Audit logs',
-											icon: Eye,
-											href: `${base}/audit_logs?resource=${path}`
-										},
-										{
-											displayName: 'Permissions',
-											icon: Shield,
-											action: () => {
-												shareModal?.openDrawer(path, 'mqtt_trigger')
-											}
-										},
-										{
-											displayName: 'Delete',
-											type: 'delete',
-											icon: Trash,
-											disabled: !canWrite,
-											action: async () => {
-												await MqttTriggerService.deleteMqttTrigger({
-													workspace: $workspaceStore ?? '',
-													path
-												})
-												loadTriggers()
-											}
-										}
-									]}
-								/>
-							</div>
-						</div>
-						<div class="w-full flex justify-between items-baseline">
-							<div
-								class="flex flex-wrap text-[0.7em] text-primary gap-1 items-center justify-end truncate pr-2"
-								>{#if edited_by}<div class="truncate">edited by {edited_by}</div>{/if}<div
-									class="truncate">{edited_by ? 'the ' : ''}{displayDate(edited_at)}</div
-								></div
-							></div
-						>
-					</div>
-				{/each}
-			</div>
-		{:else}
-			<NoItemFound />
-		{/if}
-	</div>
-	{#if items && items?.length > 15 && nbDisplayed < items.length}
-		<span class="text-xs"
-			>{nbDisplayed} items out of {items.length}
-			<button class="ml-4" onclick={() => (nbDisplayed += 30)}>load 30 more</button></span
-		>
-	{/if}
-</CenteredPage>
-
-<ShareModal
-	bind:this={shareModal}
-	on:change={() => {
-		loadTriggers()
-	}}
-/>
+<TriggerList triggerKind="mqtt" />
diff --git a/frontend/src/routes/(root)/(logged)/nats_triggers/+page.svelte b/frontend/src/routes/(root)/(logged)/nats_triggers/+page.svelte
index 834869891a..ae96a52cfc 100644
--- a/frontend/src/routes/(root)/(logged)/nats_triggers/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/nats_triggers/+page.svelte
@@ -1,592 +1,5 @@
 <script lang="ts">
-	import { getLocalDraftHint } from '$lib/localDraftHints.svelte'
-	import { run } from 'svelte/legacy'
-
-	import {
-		NatsTriggerService,
-		WorkspaceService,
-		type NatsTrigger,
-		type TriggerMode,
-		type WorkspaceDeployUISettings
-	} from '$lib/gen'
-	import {
-		canWrite,
-		displayDate,
-		getLocalSetting,
-		sendUserToast,
-		storeLocalSetting,
-		removeTriggerKindIfUnused
-	} from '$lib/utils'
-	import { withForkConflictRetry } from '$lib/utils/forkConflict'
-	import { base } from '$app/paths'
-	import { page } from '$app/stores'
-	import CenteredPage from '$lib/components/CenteredPage.svelte'
-	import { Alert, Badge, Button, EmptyState, Skeleton } from '$lib/components/common'
-	import Dropdown from '$lib/components/DropdownV2.svelte'
-	import PageHeader from '$lib/components/PageHeader.svelte'
-	import SharedBadge from '$lib/components/SharedBadge.svelte'
-	import DraftBadge from '$lib/components/DraftBadge.svelte'
-	import ShareModal from '$lib/components/ShareModal.svelte'
-	import Toggle from '$lib/components/Toggle.svelte'
-	import {
-		userStore,
-		workspaceStore,
-		userWorkspaces,
-		enterpriseLicense,
-		usedTriggerKinds
-	} from '$lib/stores'
-	import { Code, Eye, Pen, Plus, Shield, Trash, Circle, FileUp, Pause } from 'lucide-svelte'
-	import { goto } from '$lib/navigation'
-	import SearchItems from '$lib/components/SearchItems.svelte'
-	import NoItemFound from '$lib/components/home/NoItemFound.svelte'
-	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
-	import ListFilters from '$lib/components/home/ListFilters.svelte'
-	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
-	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
-	import { setQuery } from '$lib/navigation'
-	import { onDestroy, onMount } from 'svelte'
-	import Popover from '$lib/components/Popover.svelte'
-	import { isCloudHosted } from '$lib/cloud'
-	import NatsIcon from '$lib/components/icons/NatsIcon.svelte'
-	import NatsTriggerEditor from '$lib/components/triggers/nats/NatsTriggerEditor.svelte'
-	import { ALL_DEPLOYABLE, isDeployable } from '$lib/utils_deployable'
-	import DeployWorkspaceDrawer from '$lib/components/DeployWorkspaceDrawer.svelte'
-	import TriggerModeToggle from '$lib/components/triggers/TriggerModeToggle.svelte'
-
-	type TriggerW = NatsTrigger & { canWrite: boolean }
-
-	let triggers: TriggerW[] = $state([])
-	let shareModal: ShareModal | undefined = $state()
-	let loading = $state(true)
-	let deploymentDrawer: DeployWorkspaceDrawer | undefined = $state()
-	let deployUiSettings: WorkspaceDeployUISettings | undefined = $state(undefined)
-
-	async function getDeployUiSettings() {
-		if (!$enterpriseLicense) {
-			deployUiSettings = ALL_DEPLOYABLE
-			return
-		}
-		let settings = await WorkspaceService.getPublicSettings({ workspace: $workspaceStore! })
-		deployUiSettings = settings.deploy_ui ?? ALL_DEPLOYABLE
-	}
-	getDeployUiSettings()
-	async function loadTriggers(): Promise<void> {
-		triggers = (
-			await NatsTriggerService.listNatsTriggers({
-				workspace: $workspaceStore!,
-				includeDraftOnly: true
-			})
-		).map((x) => {
-			return { canWrite: canWrite(x.path, x.extra_perms!, $userStore), ...x }
-		})
-		$usedTriggerKinds = removeTriggerKindIfUnused(triggers.length, 'nats', $usedTriggerKinds)
-		loading = false
-	}
-
-	let interval = setInterval(async () => {
-		try {
-			const newTriggers = await NatsTriggerService.listNatsTriggers({
-				workspace: $workspaceStore!
-			})
-			for (let i = 0; i < triggers.length; i++) {
-				const newTrigger = newTriggers.find((x) => x.path === triggers[i].path)
-				if (newTrigger) {
-					triggers[i] = {
-						...triggers[i],
-						error: newTrigger.error,
-						last_server_ping: newTrigger.last_server_ping,
-						mode: newTrigger.mode,
-						server_id: newTrigger.server_id
-					}
-				}
-			}
-		} catch (err) {
-			console.error(err)
-		}
-	}, 5000)
-
-	onDestroy(() => {
-		clearInterval(interval)
-	})
-
-	async function onToggleMode(path: string, mode: TriggerMode): Promise<boolean> {
-		let committed = false
-		try {
-			const ok = await withForkConflictRetry(
-				(force) =>
-					NatsTriggerService.setNatsTriggerMode({
-						path,
-						workspace: $workspaceStore!,
-						requestBody: { mode, force }
-					}),
-				'NATS trigger'
-			)
-			committed = ok
-			if (ok) loadTriggers()
-		} catch (err) {
-			sendUserToast(
-				`Cannot ` +
-					(mode === 'enabled' ? 'enable' : mode === 'disabled' ? 'disable' : 'suspend') +
-					` NATS trigger: ${err.body}`,
-				true
-			)
-			loadTriggers()
-		}
-		return committed
-	}
-
-	run(() => {
-		if ($workspaceStore && $userStore) {
-			loadTriggers()
-		}
-	})
-	let natsTriggerEditor: NatsTriggerEditor | undefined = $state()
-
-	let hashHandled = false
-	$effect(() => {
-		if (!hashHandled && triggers.length > 0 && natsTriggerEditor) {
-			let hash = $page.url.hash
-			if (hash.length > 1) {
-				let path = hash.slice(1)
-				let trigger = triggers.find((t) => t.path === path)
-				if (trigger) {
-					hashHandled = true
-					natsTriggerEditor?.openEdit(path, trigger.is_flow)
-				}
-			}
-		}
-	})
-
-	let filteredItems: (TriggerW & { marked?: any })[] | undefined = $state([])
-	let items: typeof filteredItems | undefined = $state([])
-	let preFilteredItems: typeof filteredItems | undefined = $state([])
-	let filter = $state('')
-	let ownerFilter: string | undefined = $state(undefined)
-	let nbDisplayed = $state(15)
-
-	const TRIGGER_PATH_KIND_FILTER_SETTING = 'filter_path_of'
-	const FILTER_USER_FOLDER_SETTING_NAME = 'user_and_folders_only'
-	let selectedFilterKind = $state(
-		(getLocalSetting(TRIGGER_PATH_KIND_FILTER_SETTING) as 'trigger' | 'script_flow') ?? 'trigger'
-	)
-	let filterUserFolders = $state(getLocalSetting(FILTER_USER_FOLDER_SETTING_NAME) == 'true')
-
-	run(() => {
-		storeLocalSetting(TRIGGER_PATH_KIND_FILTER_SETTING, selectedFilterKind)
-	})
-	run(() => {
-		storeLocalSetting(FILTER_USER_FOLDER_SETTING_NAME, filterUserFolders ? 'true' : undefined)
-	})
-
-	function filterItemsPathsBaseOnUserFilters(
-		item: TriggerW,
-		selectedFilterKind: 'trigger' | 'script_flow',
-		filterUserFolders: boolean
-	) {
-		if ($workspaceStore == 'admins') return true
-		if (filterUserFolders) {
-			if (selectedFilterKind === 'trigger') {
-				return (
-					!item.path.startsWith('u/') || item.path.startsWith('u/' + $userStore?.username + '/')
-				)
-			} else {
-				return (
-					!item.script_path.startsWith('u/') ||
-					item.script_path.startsWith('u/' + $userStore?.username + '/')
-				)
-			}
-		} else {
-			return true
-		}
-	}
-
-	run(() => {
-		preFilteredItems =
-			ownerFilter != undefined
-				? selectedFilterKind === 'trigger'
-					? triggers?.filter(
-							(x) =>
-								x.path.startsWith(ownerFilter + '/') &&
-								filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-						)
-					: triggers?.filter(
-							(x) =>
-								x.script_path.startsWith(ownerFilter + '/') &&
-								filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-						)
-				: triggers?.filter((x) =>
-						filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-					)
-	})
-
-	run(() => {
-		if ($workspaceStore) {
-			ownerFilter = undefined
-		}
-	})
-
-	let owners = $derived(
-		selectedFilterKind === 'trigger'
-			? Array.from(
-					new Set(filteredItems?.map((x) => x.path.split('/').slice(0, 2).join('/')) ?? [])
-				).sort()
-			: Array.from(
-					new Set(filteredItems?.map((x) => x.script_path.split('/').slice(0, 2).join('/')) ?? [])
-				).sort()
-	)
-
-	run(() => {
-		items = filter !== '' ? filteredItems : preFilteredItems
-	})
-
-	function updateQueryFilters(selectedFilterKind, filterUserFolders) {
-		setQuery(
-			TRIGGER_PATH_KIND_FILTER_SETTING,
-			selectedFilterKind,
-			window.location.hash || undefined
-		).then(() => {
-			setQuery(
-				FILTER_USER_FOLDER_SETTING_NAME,
-				String(filterUserFolders),
-				window.location.hash || undefined
-			)
-		})
-	}
-
-	function loadQueryFilters() {
-		let url = new URL(window.location.href)
-		let queryFilterKind = url.searchParams.get(TRIGGER_PATH_KIND_FILTER_SETTING)
-		let queryFilterUserFolders = url.searchParams.get(FILTER_USER_FOLDER_SETTING_NAME)
-		if (queryFilterKind) {
-			selectedFilterKind = queryFilterKind as 'trigger' | 'script_flow'
-		}
-		if (queryFilterUserFolders) {
-			filterUserFolders = queryFilterUserFolders == 'true'
-		}
-	}
-
-	onMount(() => {
-		loadQueryFilters()
-	})
-
-	run(() => {
-		updateQueryFilters(selectedFilterKind, filterUserFolders)
-	})
+	import TriggerList from '$lib/components/triggers/TriggerList.svelte'
 </script>
 
-<DeployWorkspaceDrawer bind:this={deploymentDrawer} />
-<NatsTriggerEditor onUpdate={loadTriggers} bind:this={natsTriggerEditor} />
-
-<SearchItems
-	{filter}
-	items={preFilteredItems}
-	bind:filteredItems
-	f={(x) => (x.summary ?? '') + ' ' + x.path + ' (' + x.script_path + ')'}
-/>
-
-{#if $userStore?.operator && $workspaceStore && !$userWorkspaces.find((_) => _.id === $workspaceStore)?.operator_settings?.triggers}
-	<div class="bg-red-100 border-l-4 border-red-600 text-orange-700 p-4 m-4 mt-12" role="alert">
-		<p class="font-bold">Unauthorized</p>
-		<p>Page not available for operators</p>
-	</div>
-{:else}
-	<CenteredPage>
-		<PageHeader
-			title="NATS triggers"
-			tooltip="Windmill can consume NATS events and trigger scripts or flows based on them."
-		>
-			<Button
-				unifiedSize="md"
-				variant="accent"
-				startIcon={{ icon: Plus }}
-				on:click={() => natsTriggerEditor?.openNew(false)}
-			>
-				New&nbsp;NATS trigger
-			</Button>
-		</PageHeader>
-
-		{#if isCloudHosted()}
-			<Alert title="Not compatible with multi-tenant cloud" type="warning">
-				NATS triggers are disabled in the multi-tenant cloud.
-			</Alert>
-			<div class="py-4"></div>
-		{/if}
-		<div class="w-full h-full flex flex-col">
-			<div class="w-full pb-4 pt-6">
-				<input
-					type="text"
-					placeholder="Search NATS triggers"
-					bind:value={filter}
-					class="search-item"
-				/>
-				<div class="flex flex-row items-center gap-2 mt-2">
-					<div class="text-xs font-semibold text-emphasis shrink-0"> Filter by path of </div>
-					<ToggleButtonGroup bind:selected={selectedFilterKind}>
-						{#snippet children({ item })}
-							<ToggleButton value="trigger" label="NATS trigger" icon={NatsIcon} {item} />
-							<ToggleButton value="script_flow" label="Script/Flow" icon={Code} {item} />
-						{/snippet}
-					</ToggleButtonGroup>
-				</div>
-				<ListFilters syncQuery bind:selectedFilter={ownerFilter} filters={owners} />
-
-				<div class="flex flex-row items-center justify-end gap-4">
-					{#if $userStore?.is_super_admin && $userStore.username.includes('@')}
-						<Toggle size="xs" bind:checked={filterUserFolders} options={{ right: 'Only f/*' }} />
-					{:else if $userStore?.is_admin || $userStore?.is_super_admin}
-						<Toggle
-							size="xs"
-							bind:checked={filterUserFolders}
-							options={{ right: `Only u/${$userStore.username} and f/*` }}
-						/>
-					{/if}
-				</div>
-			</div>
-			{#if loading}
-				{#each new Array(6) as _}
-					<Skeleton layout={[[6], 0.4]} />
-				{/each}
-			{:else if !triggers?.length}
-				<EmptyState
-					icon={NatsIcon}
-					title="No NATS triggers yet"
-					description="Windmill can consume NATS events and trigger scripts or flows based on them."
-					action={{
-						label: 'Add a NATS trigger',
-						icon: Plus,
-						onClick: () => natsTriggerEditor?.openNew(false),
-						aiId: 'nats-triggers-empty-add',
-						aiDescription: 'Add NATS trigger'
-					}}
-				/>
-			{:else if items?.length}
-				<div class="border rounded-md divide-y">
-					{#each items.slice(0, nbDisplayed) as { path, edited_by, edited_at, script_path, is_flow, nats_resource_path, subjects, extra_perms, canWrite, marked, server_id, error, last_server_ping, mode, retry, error_handler_path, error_handler_args, labels, draft_only, is_draft } (path)}
-						{@const hasDraft = getLocalDraftHint($workspaceStore, 'trigger_nats', path) ?? is_draft}
-						{@const href = `${is_flow ? '/flows/get' : '/scripts/get'}/${script_path}`}
-						{@const ping = last_server_ping ? new Date(last_server_ping) : undefined}
-						{@const pinging = ping && ping.getTime() > new Date().getTime() - 15 * 1000}
-						{@const effectiveMode = draft_only ? 'disabled' : mode}
-						{@const enabled = effectiveMode === 'enabled' || effectiveMode === 'suspended'}
-
-						<div
-							class="hover:bg-surface-hover w-full items-center px-4 py-2 gap-4 first-of-type:!border-t-0
-				first-of-type:rounded-t-md last-of-type:rounded-b-md flex flex-col"
-						>
-							<div class="w-full flex gap-5 items-center">
-								<RowIcon kind={is_flow ? 'flow' : 'script'} />
-
-								<a
-									href="#{path}"
-									onclick={() => natsTriggerEditor?.openEdit(path, is_flow)}
-									class="min-w-0 grow hover:underline decoration-gray-400"
-								>
-									<div
-										class="text-emphasis flex-wrap text-left text-xs font-semibold mb-1 truncate"
-									>
-										{#if marked}
-											<span class="text-xs">
-												{@html marked}
-											</span>
-										{:else}
-											{nats_resource_path} - {subjects.join(', ')}
-										{/if}{hasDraft ? '*' : ''}
-									</div>
-									<div class="text-secondary text-xs truncate text-left font-light">
-										{path}
-									</div>
-									<div class="text-secondary text-xs truncate text-left font-light">
-										runnable: {script_path}
-									</div>
-								</a>
-
-								<div class="hidden lg:flex flex-row gap-1 items-center">
-									<SharedBadge {canWrite} extraPerms={extra_perms} />
-									{#if labels?.length}
-										{#each labels as label}
-											<Badge color="blue" small class="px-1" title="Label: {label}">{label}</Badge>
-										{/each}
-									{/if}
-								</div>
-
-								<div class="w-10">
-									{#if (enabled && (!pinging || error)) || (!enabled && error) || (enabled && !server_id)}
-										<Popover notClickable>
-											<span class="flex h-4 w-4">
-												<Circle
-													class="text-red-600 animate-ping absolute inline-flex fill-current"
-													size={12}
-												/>
-												<Circle class="text-red-600 relative inline-flex fill-current" size={12} />
-											</span>
-											{#snippet text()}
-												<div>
-													{#if enabled}
-														{#if !server_id}
-															Consumer is starting...
-														{:else}
-															Consumer is not connected{error ? ': ' + error : ''}
-														{/if}
-													{:else}
-														Consumer was disabled because of an error: {error}
-													{/if}
-												</div>
-											{/snippet}
-										</Popover>
-									{:else if enabled}
-										<Popover notClickable>
-											<span class="flex h-4 w-4">
-												<Circle
-													class="text-green-600 relative inline-flex fill-current"
-													size={12}
-												/>
-											</span>
-											{#snippet text()}
-												<div> Consumer is connected </div>
-											{/snippet}
-										</Popover>
-									{/if}
-								</div>
-
-								<div class="flex items-center justify-end gap-2 shrink-0 min-w-[8rem]">
-									<DraftBadge {draft_only} is_draft={hasDraft} />
-									<TriggerModeToggle
-										disabled={draft_only}
-										title={draft_only
-											? 'Draft only: deploy the trigger to enable it'
-											: hasDraft
-												? 'Enables/disables the deployed trigger; the draft is not affected'
-												: undefined}
-										onToggleMode={(newMode) => onToggleMode(path, newMode)}
-										triggerMode={effectiveMode}
-										includeModalConfig={{
-											triggerPath: path,
-											triggerKind: 'nats',
-											runnableConfig: {
-												path: script_path,
-												kind: is_flow ? 'flow' : 'script',
-												retry,
-												errorHandlerPath: error_handler_path,
-												errorHandlerArgs: error_handler_args
-											}
-										}}
-										{canWrite}
-										hideToggleLabels
-										hideDropdown
-									/>
-								</div>
-
-								<div class="flex gap-2 items-center justify-end">
-									<Button
-										on:click={() => natsTriggerEditor?.openEdit(path, is_flow)}
-										unifiedSize="md"
-										startIcon={canWrite
-											? { icon: Pen }
-											: {
-													icon: Eye
-												}}
-										variant="subtle"
-									>
-										{canWrite ? 'Edit' : 'View'}
-									</Button>
-									<Dropdown
-										items={[
-											{
-												displayName: `View ${is_flow ? 'Flow' : 'Script'}`,
-												icon: Eye,
-												action: () => {
-													goto(href)
-												}
-											},
-											...(canWrite && !draft_only && mode !== 'suspended'
-												? [
-														{
-															displayName: 'Suspend job execution',
-															icon: Pause,
-															action: () => {
-																onToggleMode(path, 'suspended')
-															}
-														}
-													]
-												: []),
-											{
-												displayName: canWrite ? 'Edit' : 'View',
-												icon: canWrite ? Pen : Eye,
-												action: () => {
-													natsTriggerEditor?.openEdit(path, is_flow)
-												}
-											},
-											...(isDeployable('trigger', path, deployUiSettings)
-												? [
-														{
-															displayName: 'Deploy to prod/staging',
-															icon: FileUp,
-															action: () => {
-																deploymentDrawer?.openDrawer(path, 'trigger', {
-																	triggers: {
-																		kind: 'nats'
-																	}
-																})
-															}
-														}
-													]
-												: []),
-											{
-												displayName: 'Audit logs',
-												icon: Eye,
-												href: `${base}/audit_logs?resource=${path}`
-											},
-											{
-												displayName: 'Permissions',
-												icon: Shield,
-												action: () => {
-													shareModal?.openDrawer(path, 'nats_trigger')
-												}
-											},
-											{
-												displayName: 'Delete',
-												type: 'delete',
-												icon: Trash,
-												disabled: !canWrite,
-												action: async () => {
-													await NatsTriggerService.deleteNatsTrigger({
-														workspace: $workspaceStore ?? '',
-														path
-													})
-													loadTriggers()
-												}
-											}
-										]}
-									/>
-								</div>
-							</div>
-							<div class="w-full flex justify-between items-baseline">
-								<div
-									class="flex flex-wrap text-2xs text-secondary gap-1 items-center justify-end truncate pr-2"
-									>{#if edited_by}<div class="truncate">edited by {edited_by}</div>{/if}<div
-										class="truncate">{edited_by ? 'the ' : ''}{displayDate(edited_at)}</div
-									></div
-								></div
-							>
-						</div>
-					{/each}
-				</div>
-			{:else}
-				<NoItemFound />
-			{/if}
-		</div>
-		{#if items && items?.length > 15 && nbDisplayed < items.length}
-			<span class="text-xs"
-				>{nbDisplayed} items out of {items.length}
-				<button class="ml-4" onclick={() => (nbDisplayed += 30)}>load 30 more</button></span
-			>
-		{/if}
-	</CenteredPage>
-{/if}
-
-<ShareModal
-	bind:this={shareModal}
-	on:change={() => {
-		loadTriggers()
-	}}
-/>
+<TriggerList triggerKind="nats" />
diff --git a/frontend/src/routes/(root)/(logged)/postgres_triggers/+page.svelte b/frontend/src/routes/(root)/(logged)/postgres_triggers/+page.svelte
index d1c07a7e75..a25078abe1 100644
--- a/frontend/src/routes/(root)/(logged)/postgres_triggers/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/postgres_triggers/+page.svelte
@@ -1,674 +1,5 @@
 <script lang="ts">
-	import { getLocalDraftHint } from '$lib/localDraftHints.svelte'
-	import { run } from 'svelte/legacy'
-
-	import {
-		PostgresTriggerService,
-		WorkspaceService,
-		type PostgresTrigger,
-		type TriggerMode,
-		type WorkspaceDeployUISettings
-	} from '$lib/gen'
-	import {
-		canWrite,
-		displayDate,
-		getLocalSetting,
-		sendUserToast,
-		storeLocalSetting,
-		removeTriggerKindIfUnused,
-		capitalize
-	} from '$lib/utils'
-	import { withForkConflictRetry } from '$lib/utils/forkConflict'
-	import { base } from '$app/paths'
-	import { page } from '$app/stores'
-	import CenteredPage from '$lib/components/CenteredPage.svelte'
-	import { Alert, Badge, Button, EmptyState, Skeleton } from '$lib/components/common'
-	import Dropdown from '$lib/components/DropdownV2.svelte'
-	import PageHeader from '$lib/components/PageHeader.svelte'
-	import SharedBadge from '$lib/components/SharedBadge.svelte'
-	import DraftBadge from '$lib/components/DraftBadge.svelte'
-	import ShareModal from '$lib/components/ShareModal.svelte'
-	import Toggle from '$lib/components/Toggle.svelte'
-	import { enterpriseLicense, usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
-	import {
-		Code,
-		Eye,
-		Pen,
-		Plus,
-		Shield,
-		Trash,
-		Circle,
-		Database,
-		FileUp,
-		Pause
-	} from 'lucide-svelte'
-	import { goto } from '$lib/navigation'
-	import SearchItems from '$lib/components/SearchItems.svelte'
-	import NoItemFound from '$lib/components/home/NoItemFound.svelte'
-	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
-	import ListFilters from '$lib/components/home/ListFilters.svelte'
-	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
-	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
-	import { setQuery } from '$lib/navigation'
-	import { onDestroy, onMount } from 'svelte'
-	import Popover from '$lib/components/Popover.svelte'
-	import { isCloudHosted } from '$lib/cloud'
-	import PostgresTriggerEditor from '$lib/components/triggers/postgres/PostgresTriggerEditor.svelte'
-	import { ALL_DEPLOYABLE, isDeployable } from '$lib/utils_deployable'
-	import DeployWorkspaceDrawer from '$lib/components/DeployWorkspaceDrawer.svelte'
-	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
-	import TextInput from '$lib/components/text_input/TextInput.svelte'
-	import TriggerModeToggle from '$lib/components/triggers/TriggerModeToggle.svelte'
-
-	type TriggerD = PostgresTrigger & { canWrite: boolean }
-
-	let triggers: TriggerD[] = $state([])
-	let shareModal: ShareModal | undefined = $state()
-	let loading = $state(true)
-	let deploymentDrawer: DeployWorkspaceDrawer | undefined = $state()
-	let deployUiSettings: WorkspaceDeployUISettings | undefined = $state(undefined)
-
-	async function getDeployUiSettings() {
-		if (!$enterpriseLicense) {
-			deployUiSettings = ALL_DEPLOYABLE
-			return
-		}
-		let settings = await WorkspaceService.getPublicSettings({ workspace: $workspaceStore! })
-		deployUiSettings = settings.deploy_ui ?? ALL_DEPLOYABLE
-	}
-	getDeployUiSettings()
-	async function loadTriggers(): Promise<void> {
-		triggers = (
-			await PostgresTriggerService.listPostgresTriggers({
-				workspace: $workspaceStore!,
-				includeDraftOnly: true
-			})
-		).map((x) => {
-			return { canWrite: canWrite(x.path, x.extra_perms!, $userStore), ...x }
-		})
-		$usedTriggerKinds = removeTriggerKindIfUnused(triggers.length, 'postgres', $usedTriggerKinds)
-		loading = false
-	}
-
-	let interval = setInterval(async () => {
-		try {
-			const newTriggers = await PostgresTriggerService.listPostgresTriggers({
-				workspace: $workspaceStore!
-			})
-			for (let i = 0; i < triggers.length; i++) {
-				const newTrigger = newTriggers.find((x) => x.path === triggers[i].path)
-				if (newTrigger) {
-					triggers[i] = {
-						...triggers[i],
-						error: newTrigger.error,
-						last_server_ping: newTrigger.last_server_ping,
-						mode: newTrigger.mode,
-						server_id: newTrigger.server_id
-					}
-				}
-			}
-		} catch (err) {
-			console.error(err)
-		}
-	}, 5000)
-
-	onDestroy(() => {
-		clearInterval(interval)
-	})
-
-	async function onToggleMode(path: string, mode: TriggerMode): Promise<boolean> {
-		let committed = false
-		try {
-			const ok = await withForkConflictRetry(
-				(force) =>
-					PostgresTriggerService.setPostgresTriggerMode({
-						path,
-						workspace: $workspaceStore!,
-						requestBody: { mode, force }
-					}),
-				'postgres trigger'
-			)
-			if (ok) {
-				sendUserToast(`${capitalize(mode)} postgres trigger ${path}`)
-				loadTriggers()
-			}
-			committed = ok
-		} catch (err) {
-			sendUserToast(`Cannot change postgres trigger mode: ${err.body}`, true)
-			loadTriggers()
-		}
-		return committed
-	}
-
-	run(() => {
-		if ($workspaceStore && $userStore) {
-			loadTriggers()
-		}
-	})
-	let postgresTriggerEditor: PostgresTriggerEditor | undefined = $state()
-
-	let hashHandled = false
-	$effect(() => {
-		if (!hashHandled && triggers.length > 0 && postgresTriggerEditor) {
-			let hash = $page.url.hash
-			if (hash.length > 1) {
-				let path = hash.slice(1)
-				let trigger = triggers.find((t) => t.path === path)
-				if (trigger) {
-					hashHandled = true
-					postgresTriggerEditor?.openEdit(path, trigger.is_flow)
-				}
-			}
-		}
-	})
-
-	let filteredItems: (TriggerD & { marked?: any })[] | undefined = $state([])
-	let items: typeof filteredItems | undefined = $state([])
-	let preFilteredItems: typeof filteredItems | undefined = $state([])
-	let filter = $state('')
-	let ownerFilter: string | undefined = $state(undefined)
-	let nbDisplayed = $state(15)
-
-	let isDeleting: boolean = $state(false)
-	let deleteReplicationSlot: boolean = $state(false)
-	let deletePublication: boolean = $state(false)
-	let replicationSlotToDelete = $state('')
-	let publicationToDelete = $state('')
-	let deleteReplicationSlotCallback: (() => Promise<string>) | undefined = $state(undefined)
-	let deletePublicationCallback: (() => Promise<string>) | undefined = $state(undefined)
-	let deletePostgresTriggerCallback: (() => Promise<string>) | undefined = $state(undefined)
-
-	const TRIGGER_PATH_KIND_FILTER_SETTING = 'filter_path_of'
-	const FILTER_USER_FOLDER_SETTING_NAME = 'user_and_folders_only'
-	let selectedFilterKind = $state(
-		(getLocalSetting(TRIGGER_PATH_KIND_FILTER_SETTING) as 'trigger' | 'script_flow') ?? 'trigger'
-	)
-	let filterUserFolders = $state(getLocalSetting(FILTER_USER_FOLDER_SETTING_NAME) == 'true')
-
-	run(() => {
-		storeLocalSetting(TRIGGER_PATH_KIND_FILTER_SETTING, selectedFilterKind)
-	})
-	run(() => {
-		storeLocalSetting(FILTER_USER_FOLDER_SETTING_NAME, filterUserFolders ? 'true' : undefined)
-	})
-
-	function filterItemsPathsBaseOnUserFilters(
-		item: TriggerD,
-		selectedFilterKind: 'trigger' | 'script_flow',
-		filterUserFolders: boolean
-	) {
-		if ($workspaceStore == 'admins') return true
-		if (filterUserFolders) {
-			if (selectedFilterKind === 'trigger') {
-				return (
-					!item.path.startsWith('u/') || item.path.startsWith('u/' + $userStore?.username + '/')
-				)
-			} else {
-				return (
-					!item.script_path.startsWith('u/') ||
-					item.script_path.startsWith('u/' + $userStore?.username + '/')
-				)
-			}
-		} else {
-			return true
-		}
-	}
-
-	run(() => {
-		preFilteredItems =
-			ownerFilter != undefined
-				? selectedFilterKind === 'trigger'
-					? triggers?.filter(
-							(x) =>
-								x.path.startsWith(ownerFilter + '/') &&
-								filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-						)
-					: triggers?.filter(
-							(x) =>
-								x.script_path.startsWith(ownerFilter + '/') &&
-								filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-						)
-				: triggers?.filter((x) =>
-						filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-					)
-	})
-
-	run(() => {
-		if ($workspaceStore) {
-			ownerFilter = undefined
-		}
-	})
-
-	let owners = $derived(
-		selectedFilterKind === 'trigger'
-			? Array.from(
-					new Set(filteredItems?.map((x) => x.path.split('/').slice(0, 2).join('/')) ?? [])
-				).sort()
-			: Array.from(
-					new Set(filteredItems?.map((x) => x.script_path.split('/').slice(0, 2).join('/')) ?? [])
-				).sort()
-	)
-
-	run(() => {
-		items = filter !== '' ? filteredItems : preFilteredItems
-	})
-
-	function updateQueryFilters(selectedFilterKind, filterUserFolders) {
-		setQuery(
-			TRIGGER_PATH_KIND_FILTER_SETTING,
-			selectedFilterKind,
-			window.location.hash || undefined
-		).then(() => {
-			setQuery(
-				FILTER_USER_FOLDER_SETTING_NAME,
-				String(filterUserFolders),
-				window.location.hash || undefined
-			)
-		})
-	}
-
-	function loadQueryFilters() {
-		let url = new URL(window.location.href)
-		let queryFilterKind = url.searchParams.get(TRIGGER_PATH_KIND_FILTER_SETTING)
-		let queryFilterUserFolders = url.searchParams.get(FILTER_USER_FOLDER_SETTING_NAME)
-		if (queryFilterKind) {
-			selectedFilterKind = queryFilterKind as 'trigger' | 'script_flow'
-		}
-		if (queryFilterUserFolders) {
-			filterUserFolders = queryFilterUserFolders == 'true'
-		}
-	}
-
-	onMount(() => {
-		loadQueryFilters()
-	})
-
-	run(() => {
-		updateQueryFilters(selectedFilterKind, filterUserFolders)
-	})
+	import TriggerList from '$lib/components/triggers/TriggerList.svelte'
 </script>
 
-<ConfirmationModal
-	open={Boolean(deletePostgresTriggerCallback)}
-	title="Delete Postgres trigger"
-	confirmationText="Remove"
-	loading={isDeleting}
-	on:canceled={() => {
-		isDeleting = false
-		deletePostgresTriggerCallback = undefined
-	}}
-	on:confirmed={async () => {
-		if (deletePostgresTriggerCallback) {
-			let msg: string
-			isDeleting = true
-			if (deleteReplicationSlot && deleteReplicationSlotCallback) {
-				try {
-					msg = await deleteReplicationSlotCallback()
-					sendUserToast(msg)
-				} catch (error) {
-					isDeleting = false
-					sendUserToast(error.body || error.message, true)
-					return
-				}
-			}
-			if (deletePublication && deletePublicationCallback) {
-				try {
-					msg = await deletePublicationCallback()
-					sendUserToast(msg)
-				} catch (error) {
-					isDeleting = false
-					sendUserToast(error.body || error.message, true)
-					return
-				}
-			}
-			msg = await deletePostgresTriggerCallback()
-			sendUserToast(msg)
-		}
-		deletePostgresTriggerCallback = undefined
-	}}
->
-	<div class="flex flex-col w-full space-y-4">
-		<span>Are you sure you want to remove this trigger?</span>
-
-		<Toggle
-			options={{
-				left: `Delete the associated replication slot named: ${replicationSlotToDelete} ?`
-			}}
-			bind:checked={deleteReplicationSlot}
-		/>
-
-		<Toggle
-			options={{
-				left: `Delete the associated publication named: ${publicationToDelete} ?`
-			}}
-			bind:checked={deletePublication}
-		/>
-	</div>
-</ConfirmationModal>
-
-<DeployWorkspaceDrawer bind:this={deploymentDrawer} />
-<PostgresTriggerEditor onUpdate={loadTriggers} bind:this={postgresTriggerEditor} />
-
-<SearchItems
-	{filter}
-	items={preFilteredItems}
-	bind:filteredItems
-	f={(x) => (x.summary ?? '') + ' ' + x.path + ' (' + x.script_path + ')'}
-/>
-
-<CenteredPage>
-	<PageHeader
-		title="Postgres triggers"
-		tooltip="Windmill enables real-time responsiveness by listening to specific database transactions—such as inserts, updates, and deletes—and automatically triggering scripts or workflows in response."
-	>
-		<Button
-			unifiedSize="md"
-			variant="accent"
-			startIcon={{ icon: Plus }}
-			on:click={() => postgresTriggerEditor?.openNew(false)}
-		>
-			New&nbsp;Postgres trigger
-		</Button>
-	</PageHeader>
-
-	{#if isCloudHosted()}
-		<Alert title="Not compatible with multi-tenant cloud" type="warning">
-			Postgres triggers are disabled in the multi-tenant cloud.
-		</Alert>
-		<div class="py-4"></div>
-	{/if}
-	<div class="w-full h-full flex flex-col">
-		<div class="w-full pb-4 pt-6">
-			<TextInput
-				inputProps={{
-					placeholder: 'Search Postgres triggers',
-					class: 'search-item'
-				}}
-				bind:value={filter}
-			/>
-			<div class="flex flex-row items-center gap-2 mt-2">
-				<div class="text-xs font-semibold text-emphasis shrink-0"> Filter by path of </div>
-				<ToggleButtonGroup bind:selected={selectedFilterKind}>
-					{#snippet children({ item })}
-						<ToggleButton value="trigger" label="Postgres trigger" icon={Database} {item} />
-						<ToggleButton value="script_flow" label="Script/Flow" icon={Code} {item} />
-					{/snippet}
-				</ToggleButtonGroup>
-			</div>
-			<ListFilters syncQuery bind:selectedFilter={ownerFilter} filters={owners} />
-
-			<div class="flex flex-row items-center justify-end gap-4">
-				{#if $userStore?.is_super_admin && $userStore.username.includes('@')}
-					<Toggle size="xs" bind:checked={filterUserFolders} options={{ right: 'Only f/*' }} />
-				{:else if $userStore?.is_admin || $userStore?.is_super_admin}
-					<Toggle
-						size="xs"
-						bind:checked={filterUserFolders}
-						options={{ right: `Only u/${$userStore.username} and f/*` }}
-					/>
-				{/if}
-			</div>
-		</div>
-		{#if loading}
-			{#each new Array(6) as _}
-				<Skeleton layout={[[6], 0.4]} />
-			{/each}
-		{:else if !triggers?.length}
-			<EmptyState
-				icon={Database}
-				title="No Postgres triggers yet"
-				description="Windmill can listen to database transactions — inserts, updates and deletes — and trigger scripts or flows in response."
-				action={{
-					label: 'Add a Postgres trigger',
-					icon: Plus,
-					onClick: () => postgresTriggerEditor?.openNew(false),
-					aiId: 'postgres-triggers-empty-add',
-					aiDescription: 'Add Postgres trigger'
-				}}
-			/>
-		{:else if items?.length}
-			<div class="border rounded-md divide-y">
-				{#each items.slice(0, nbDisplayed) as { postgres_resource_path, publication_name, replication_slot_name, path, edited_by, error, edited_at, script_path, is_flow, extra_perms, canWrite, mode, server_id, retry, error_handler_path, error_handler_args, labels, draft_only, is_draft } (path)}
-					{@const hasDraft =
-						getLocalDraftHint($workspaceStore, 'trigger_postgres', path) ?? is_draft}
-					{@const href = `${is_flow ? '/flows/get' : '/scripts/get'}/${script_path}`}
-					{@const ping = new Date()}
-					{@const pinging = ping && ping.getTime() > new Date().getTime() - 15 * 1000}
-					{@const effectiveMode = draft_only ? 'disabled' : mode}
-					{@const enabled = effectiveMode === 'enabled' || effectiveMode === 'suspended'}
-
-					<div
-						class="hover:bg-surface-hover w-full items-center px-4 py-2 gap-4 first-of-type:!border-t-0
-				first-of-type:rounded-t-md last-of-type:rounded-b-md flex flex-col"
-					>
-						<div class="w-full flex gap-5 items-center">
-							<RowIcon kind={is_flow ? 'flow' : 'script'} />
-
-							<a
-								href="#{path}"
-								onclick={() => postgresTriggerEditor?.openEdit(path, is_flow)}
-								class="min-w-0 grow hover:underline decoration-gray-400"
-							>
-								<div class="text-emphasis flex-wrap text-left text-xs font-semibold mb-1 truncate">
-									{path}{hasDraft ? '*' : ''}
-								</div>
-								<div class="text-secondary text-xs truncate text-left font-light">
-									{postgres_resource_path}
-								</div>
-								<div class="text-secondary text-xs truncate text-left font-light">
-									runnable: {script_path}
-								</div>
-							</a>
-
-							<div class="hidden lg:flex flex-row gap-1 items-center">
-								<SharedBadge {canWrite} extraPerms={extra_perms} />
-								{#if labels?.length}
-									{#each labels as label}
-										<Badge color="blue" small class="px-1" title="Label: {label}">{label}</Badge>
-									{/each}
-								{/if}
-							</div>
-
-							<div class="w-10">
-								{#if (enabled && (!pinging || error)) || (!enabled && error) || (enabled && !server_id)}
-									<Popover notClickable>
-										<span class="flex h-4 w-4">
-											<Circle
-												class="text-red-600 animate-ping absolute inline-flex fill-current"
-												size={12}
-											/>
-											<Circle class="text-red-600 relative inline-flex fill-current" size={12} />
-										</span>
-										{#snippet text()}
-											<div>
-												{#if enabled}
-													{#if !server_id}
-														Postgres trigger is starting...
-													{:else}
-														Could not connect to database{error ? ': ' + error : ''}
-													{/if}
-												{:else}
-													Disabled because of an error: {error}
-												{/if}
-											</div>
-										{/snippet}
-									</Popover>
-								{:else if enabled}
-									<Popover notClickable>
-										<span class="flex h-4 w-4">
-											<Circle class="text-green-600 relative inline-flex fill-current" size={12} />
-										</span>
-										{#snippet text()}
-											<div> Connected to database{!server_id ? ' (shutting down...)' : ''}</div>
-										{/snippet}
-									</Popover>
-								{/if}
-							</div>
-
-							<div class="flex items-center justify-end gap-2 shrink-0 min-w-[8rem]">
-								<DraftBadge {draft_only} is_draft={hasDraft} />
-								<TriggerModeToggle
-									disabled={draft_only}
-									title={draft_only
-										? 'Draft only: deploy the trigger to enable it'
-										: hasDraft
-											? 'Enables/disables the deployed trigger; the draft is not affected'
-											: undefined}
-									onToggleMode={(newMode) => onToggleMode(path, newMode)}
-									triggerMode={effectiveMode}
-									includeModalConfig={{
-										triggerPath: path,
-										triggerKind: 'postgres',
-										runnableConfig: {
-											path: script_path,
-											kind: is_flow ? 'flow' : 'script',
-											retry,
-											errorHandlerPath: error_handler_path,
-											errorHandlerArgs: error_handler_args
-										}
-									}}
-									{canWrite}
-									hideToggleLabels
-									hideDropdown
-								/>
-							</div>
-
-							<div class="flex gap-2 items-center justify-end">
-								<Button
-									on:click={() => postgresTriggerEditor?.openEdit(path, is_flow)}
-									size="xs"
-									startIcon={canWrite
-										? { icon: Pen }
-										: {
-												icon: Eye
-											}}
-									variant="subtle"
-								>
-									{canWrite ? 'Edit' : 'View'}
-								</Button>
-								<Dropdown
-									items={[
-										{
-											displayName: `View ${is_flow ? 'Flow' : 'Script'}`,
-											icon: Eye,
-											action: () => {
-												goto(href)
-											}
-										},
-										...(canWrite && !draft_only && mode !== 'suspended'
-											? [
-													{
-														displayName: 'Suspend job execution',
-														icon: Pause,
-														action: () => {
-															onToggleMode(path, 'suspended')
-														}
-													}
-												]
-											: []),
-										{
-											displayName: 'Delete',
-											type: 'delete',
-											icon: Trash,
-											disabled: !canWrite,
-											action: async () => {
-												publicationToDelete = publication_name
-												replicationSlotToDelete = replication_slot_name
-												isDeleting = false
-												deletePublication = false
-												deleteReplicationSlot = false
-												deletePublicationCallback = async () => {
-													return await PostgresTriggerService.deletePostgresPublication({
-														workspace: $workspaceStore!,
-														path: postgres_resource_path,
-														publication: publication_name
-													})
-												}
-
-												deleteReplicationSlotCallback = async () => {
-													return await PostgresTriggerService.deletePostgresReplicationSlot({
-														workspace: $workspaceStore!,
-														path: postgres_resource_path,
-														requestBody: {
-															name: replication_slot_name
-														}
-													})
-												}
-
-												deletePostgresTriggerCallback = async () => {
-													const msg = await PostgresTriggerService.deletePostgresTrigger({
-														workspace: $workspaceStore ?? '',
-														path
-													})
-													loadTriggers()
-													return msg
-												}
-											}
-										},
-										{
-											displayName: canWrite ? 'Edit' : 'View',
-											icon: canWrite ? Pen : Eye,
-											action: () => {
-												postgresTriggerEditor?.openEdit(path, is_flow)
-											}
-										},
-										...(isDeployable('trigger', path, deployUiSettings)
-											? [
-													{
-														displayName: 'Deploy to prod/staging',
-														icon: FileUp,
-														action: () => {
-															deploymentDrawer?.openDrawer(path, 'trigger', {
-																triggers: {
-																	kind: 'postgres'
-																}
-															})
-														}
-													}
-												]
-											: []),
-										{
-											displayName: 'Audit logs',
-											icon: Eye,
-											href: `${base}/audit_logs?resource=${path}`
-										},
-										{
-											displayName: 'Permissions',
-											icon: Shield,
-											action: () => {
-												shareModal?.openDrawer(path, 'postgres_trigger')
-											}
-										}
-									]}
-								/>
-							</div>
-						</div>
-						<div class="w-full flex justify-between items-baseline">
-							<div
-								class="flex flex-wrap text-[0.7em] text-primary gap-1 items-center justify-end truncate pr-2"
-								>{#if edited_by}<div class="truncate">edited by {edited_by}</div>{/if}<div
-									class="truncate">{edited_by ? 'the ' : ''}{displayDate(edited_at)}</div
-								></div
-							></div
-						>
-					</div>
-				{/each}
-			</div>
-		{:else}
-			<NoItemFound />
-		{/if}
-	</div>
-	{#if items && items?.length > 15 && nbDisplayed < items.length}
-		<span class="text-xs"
-			>{nbDisplayed} items out of {items.length}
-			<button class="ml-4" onclick={() => (nbDisplayed += 30)}>load 30 more</button></span
-		>
-	{/if}
-</CenteredPage>
-
-<ShareModal
-	bind:this={shareModal}
-	on:change={() => {
-		loadTriggers()
-	}}
-/>
+<TriggerList triggerKind="postgres" />
diff --git a/frontend/src/routes/(root)/(logged)/remote_deploy/callback/+page.svelte b/frontend/src/routes/(root)/(logged)/remote_deploy/callback/+page.svelte
new file mode 100644
index 0000000000..c702f66471
--- /dev/null
+++ b/frontend/src/routes/(root)/(logged)/remote_deploy/callback/+page.svelte
@@ -0,0 +1,74 @@
+<script lang="ts">
+	import { goto, replaceState } from '$app/navigation'
+	import { page } from '$app/state'
+	import CenteredModal from '$lib/components/CenteredModal.svelte'
+	import { Alert, Button } from '$lib/components/common'
+	import { WorkspaceService } from '$lib/gen'
+	import { CHANNEL, takePendingConnect, type RemoteDeployEvent } from '$lib/remoteDeploy'
+	import { onMount } from 'svelte'
+	import { Loader2 } from 'lucide-svelte'
+
+	// Where the remote's authorize page sends the token it minted, in the fragment so that no server
+	// log or Referer ever holds it.
+	const fragment = new URLSearchParams(window.location.hash.slice(1))
+
+	let status: 'connecting' | 'connected' | 'failed' = $state('connecting')
+	let error: string | undefined = $state(undefined)
+	let returnTo: string | undefined = $state(undefined)
+
+	function announce(event: RemoteDeployEvent) {
+		const channel = new BroadcastChannel(CHANNEL)
+		channel.postMessage(event)
+		channel.close()
+	}
+
+	onMount(async () => {
+		// Nor the address bar and the history, once read.
+		replaceState(page.url.pathname, page.state)
+		const pending = takePendingConnect(fragment.get('state') ?? '')
+		if (!pending) {
+			status = 'failed'
+			error =
+				'This connection was not started from this browser, or took too long. Start again from the deploy drawer.'
+			return
+		}
+		returnTo = pending.returnTo
+		const token = fragment.get('token')
+		try {
+			if (!token) {
+				throw new Error(fragment.get('error') ?? 'The remote instance sent no token')
+			}
+			await WorkspaceService.connectRemoteDeploy({
+				workspace: pending.workspace,
+				requestBody: { token, target: pending.target }
+			})
+		} catch (e: any) {
+			const message: string = e?.body ?? e?.message ?? String(e)
+			status = 'failed'
+			error = message
+			announce({ type: 'failed', workspace: pending.workspace, error: message })
+			return
+		}
+		status = 'connected'
+		announce({ type: 'connected', workspace: pending.workspace })
+		// Only a window this instance opened can close itself; otherwise go back to where the
+		// connection was started.
+		window.close()
+		await goto(pending.returnTo)
+	})
+</script>
+
+<CenteredModal title="Connecting to the remote instance">
+	{#if status === 'connecting'}
+		<div class="flex justify-center py-6"><Loader2 class="animate-spin" /></div>
+	{:else if status === 'connected'}
+		<p class="text-sm text-primary text-center">Connected. You can close this tab.</p>
+	{:else}
+		<Alert type="error" title="Could not connect">{error}</Alert>
+		{#if returnTo}
+			<div class="flex justify-center pt-4">
+				<Button variant="default" unifiedSize="md" onclick={() => goto(returnTo!)}>Go back</Button>
+			</div>
+		{/if}
+	{/if}
+</CenteredModal>
diff --git a/frontend/src/routes/(root)/(logged)/resources/+page.svelte b/frontend/src/routes/(root)/(logged)/resources/+page.svelte
index be735f4901..8973bf83b4 100644
--- a/frontend/src/routes/(root)/(logged)/resources/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/resources/+page.svelte
@@ -1,1584 +1,5 @@
 <script lang="ts">
-	import { getLocalDraftHint } from '$lib/localDraftHints.svelte'
-	import { page } from '$app/state'
-	import AppConnect from '$lib/components/AppConnectDrawer.svelte'
-	import CenteredPage from '$lib/components/CenteredPage.svelte'
-	import { Alert, Badge, Button, EmptyState, Skeleton, Tab, TabFade } from '$lib/components/common'
-	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
-	import Drawer from '$lib/components/common/drawer/Drawer.svelte'
-	import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
-	import Tabs from '$lib/components/common/tabs/Tabs.svelte'
-	import DeployWorkspaceDrawer from '$lib/components/DeployWorkspaceDrawer.svelte'
-	import Dropdown from '$lib/components/DropdownV2.svelte'
-	import IconedResourceType from '$lib/components/IconedResourceType.svelte'
-	import PageHeader from '$lib/components/PageHeader.svelte'
-	import Popover from '$lib/components/Popover.svelte'
-	import Required from '$lib/components/Required.svelte'
-	import { resourceTypesStore } from '$lib/components/resourceTypesStore'
-	import SchemaViewer from '$lib/components/SchemaViewer.svelte'
-	import FilterSearchbar, {
-		hasActiveFilters,
-		useUrlSyncedFilterInstance,
-		type FilterInstanceRec
-	} from '$lib/components/FilterSearchbar.svelte'
-	import { buildResourcesFilterSchema } from '$lib/components/resources/resourcesFilter'
-	import { buildResourceTypesFilterSchema } from '$lib/components/resources/resourceTypesFilter'
-	import {
-		resourceTypeSearchText,
-		setResourceTypeDisplayNames,
-		sortResourceTypesByMatch
-	} from '$lib/components/resourceTypeDisplay'
-	import SharedBadge from '$lib/components/SharedBadge.svelte'
-	import DraftBadge from '$lib/components/DraftBadge.svelte'
-	import InheritedLabels from '$lib/components/InheritedLabels.svelte'
-	import ShareModal from '$lib/components/ShareModal.svelte'
-	import SimpleEditor from '$lib/components/SimpleEditor.svelte'
-	import SupabaseConnect from '$lib/components/SupabaseConnect.svelte'
-	import Cell from '$lib/components/table/Cell.svelte'
-	import DataTable from '$lib/components/table/DataTable.svelte'
-	import Head from '$lib/components/table/Head.svelte'
-	import Row from '$lib/components/table/Row.svelte'
-	import Toggle from '$lib/components/Toggle.svelte'
-	import Tooltip from '$lib/components/Tooltip.svelte'
-	import type { ResourceType, WorkspaceDeployUISettings } from '$lib/gen'
-	import { OauthService, ResourceService, WorkspaceService, type ListableResource } from '$lib/gen'
-	import { enterpriseLicense, userStore, workspaceStore, userWorkspaces } from '$lib/stores'
-	import { sendUserToast } from '$lib/toast'
-	import {
-		canWrite,
-		classNames,
-		debounce,
-		emptySchema,
-		removeMarkdown,
-		truncate,
-		validateFileExtension
-	} from '$lib/utils'
-	import { isDeployable, ALL_DEPLOYABLE } from '$lib/utils_deployable'
-
-	import { convert } from '@redocly/json-to-json-schema'
-	import {
-		Boxes,
-		Braces,
-		Building,
-		Circle,
-		Database,
-		FileUp,
-		Link,
-		Palette,
-		Pen,
-		Plus,
-		RotateCw,
-		Save,
-		SearchX,
-		Shield,
-		Trash,
-		Zap
-	} from 'lucide-svelte'
-	import { onMount, untrack } from 'svelte'
-	import autosize from '$lib/autosize'
-	import EditableSchemaWrapper from '$lib/components/schema/EditableSchemaWrapper.svelte'
-	import ResourceEditorDrawer from '$lib/components/ResourceEditorDrawer.svelte'
-	import {
-		agentEditorTarget,
-		closeAgentEditor,
-		openAgentEditor
-	} from '$lib/components/flows/agentEditorStore.svelte'
-	import { copilotInfo } from '$lib/aiStore'
-	import { setPageDrawerAnchor } from '$lib/components/sessions/pageDrawerSession'
-	import { RESOURCES_PATH } from '$lib/components/sessions/previewPaths'
-	import GfmMarkdown from '$lib/components/GfmMarkdown.svelte'
-	import ExploreAssetButton, {
-		assetCanBeExplored
-	} from '../../../../lib/components/ExploreAssetButton.svelte'
-	import NoDirectDeployAlert from '$lib/components/NoDirectDeployAlert.svelte'
-
-	type ResourceW = ListableResource & { canWrite: boolean; marked?: string }
-	type ResourceTypeW = ResourceType & { canWrite: boolean }
-
-	let cacheResources: ResourceW[] | undefined = $state()
-	let stateResources: ResourceW[] | undefined = $state()
-	let themeResources: ResourceW[] | undefined = $state()
-	let resources: ResourceW[] | undefined = $state()
-	let resourceTypes: ResourceTypeW[] | undefined = $state()
-
-	// Collect unique paths, types, owners for filter autocomplete
-	let allPaths: string[] = $state([])
-	let allResourceTypes: string[] = $state([])
-	let allOwners: string[] = $state([])
-	let allLabels: string[] = $state([])
-
-	let resourceTypeViewer: Drawer | undefined = $state(undefined)
-	let resourceTypeViewerObj = $state({
-		rt: '',
-		description: '',
-		schema: emptySchema(),
-		formatExtension: undefined as string | undefined,
-		isFileset: false
-	})
-
-	let resourceTypeDrawer: Drawer | undefined = $state(undefined)
-	let editResourceTypeDrawer: Drawer | undefined = $state(undefined)
-	let newResourceType = $state({
-		name: '',
-		schema: emptySchema(),
-		description: '',
-		formatExtension: undefined as string | undefined,
-		isFileset: undefined as boolean | undefined
-	})
-	let isNewResourceTypeNameValid: boolean = $state(false)
-	let resourceTypeNameExists: boolean = $state(false)
-
-	let editResourceType = $state({
-		name: '',
-		schema: emptySchema(),
-		description: '',
-		formatExtension: undefined as string | undefined,
-		isFileset: false
-	})
-	let resourceEditor: ResourceEditorDrawer | undefined = $state(undefined)
-
-	/** An `ai_agent` gets the agent editor rather than the generic resource form, which would
-	 *  render its configuration as raw JSON. Both write the same resource draft, so the choice is
-	 *  presentational and either can open a path the other left a draft at. */
-	function openResourceEditor(path: string, resourceType: string | undefined) {
-		if (resourceType === 'ai_agent') {
-			// The generic editor anchors itself from `initEdit`; this one has to, or the URL, a
-			// refresh, and the AI session's idea of where you are all miss the open agent. Claim the
-			// hash first so the deep-link effect does not treat our own write as a new navigation.
-			handledHash = `#/resource/${path}`
-			// One row at a time: the hash can retarget from a resource to an agent, and the two
-			// editors are separate overlays that would otherwise stack, the older one surfacing again
-			// when the newer is closed.
-			resourceEditor?.close?.({ keepAnchor: true })
-			openAgentEditor({ path })
-			setPageDrawerAnchor(RESOURCES_PATH, path)
-		} else {
-			closeAgentEditor()
-			resourceEditor?.initEdit?.(path)
-		}
-	}
-	let shareModal: ShareModal | undefined = $state(undefined)
-	let appConnect: AppConnect | undefined = $state(undefined)
-	let supabaseConnect: SupabaseConnect | undefined = $state(undefined)
-	let deleteConfirmedCallback: (() => void) | undefined = $state(undefined)
-	let deleteIsLinked = $state(false)
-	let deletePath = $state('')
-	let loading = $state({
-		resources: true,
-		types: true
-	})
-
-	let showCreateButtons = $state(false)
-
-	// FilterSearchbar setup
-	let userFoldersFilterType = $derived(
-		$userStore?.is_super_admin && $userStore.username.includes('@')
-			? 'only f/*'
-			: $userStore?.is_admin || $userStore?.is_super_admin
-				? 'u/username and f/*'
-				: undefined
-	)
-	let resourcesFilterSchema = $derived(
-		buildResourcesFilterSchema({
-			paths: allPaths,
-			resourceTypes: allResourceTypes,
-			owners: allOwners,
-			labels: allLabels,
-			showUserFoldersFilter: userFoldersFilterType !== undefined,
-			userFoldersLabel:
-				userFoldersFilterType === 'only f/*' ? 'Only f/*' : `Only u/${$userStore?.username} and f/*`
-		})
-	)
-	let filters = useUrlSyncedFilterInstance(untrack(() => resourcesFilterSchema))
-	let itemFolders = $derived(
-		Array.from(
-			new Set(
-				(resources ?? [])
-					.map((x) => x.path.split('/').slice(0, 2).join('/'))
-					.filter((x) => x.startsWith('f/'))
-			)
-		)
-			.sort()
-			.map((f) => f.replace(/^f\//, ''))
-	)
-	let resourceTypesFilterSchema = buildResourceTypesFilterSchema()
-	let resourceTypesFilters: {
-		val: Partial<FilterInstanceRec<typeof resourceTypesFilterSchema>>
-	} = $state({ val: {} })
-	let filteredResourceTypes = $derived.by(() => {
-		if (!resourceTypes) return resourceTypes
-		const f = resourceTypesFilters.val
-		// Bare search covers name and description together, like the add-resource drawer --
-		// `gdrive` is only findable as "google" through its description. The `name:` and
-		// `description:` facets stay scoped to their own field.
-		const defaultSearch = f._default_?.trim().toLowerCase()
-		const nameSearch = f.name?.toLowerCase()
-		const descSearch = f.description?.toLowerCase()
-		if (!defaultSearch && !nameSearch && !descSearch) return resourceTypes
-		const matched = resourceTypes.filter((rt) => {
-			if (
-				defaultSearch &&
-				!resourceTypeSearchText(rt.name, rt.description).toLowerCase().includes(defaultSearch)
-			)
-				return false
-			if (nameSearch && !rt.name.toLowerCase().includes(nameSearch)) return false
-			if (descSearch && !(rt.description ?? '').toLowerCase().includes(descSearch)) return false
-			return true
-		})
-		return sortResourceTypesByMatch(
-			matched,
-			defaultSearch ?? '',
-			(rt) => rt.name,
-			(rt) => rt.description
-		)
-	})
-
-	let folderPresets = $derived([
-		...itemFolders.map((f) => ({ name: `f/${f}`, value: `path_start:\\ f/${f}/` })),
-		...allLabels.map((l) => ({ name: l, value: `label:\\ ${l}` })),
-		...(resourcesFilterSchema.user_folders_only
-			? [
-					{
-						name: resourcesFilterSchema.user_folders_only.label ?? '?',
-						value: 'user_folders_only:\\ true'
-					}
-				]
-			: [])
-	])
-
-	async function loadResources(): Promise<void> {
-		resources = await loadResourceInternal(undefined, 'cache,state,app_theme')
-		loading.resources = false
-	}
-
-	async function loadCache(): Promise<void> {
-		cacheResources = await loadResourceInternal('cache', undefined)
-		loading.resources = false
-	}
-
-	async function loadState(): Promise<void> {
-		stateResources = await loadResourceInternal('state', undefined)
-		loading.resources = false
-	}
-
-	async function loadTheme(): Promise<void> {
-		themeResources = await loadResourceInternal('app_theme', undefined)
-		loading.resources = false
-	}
-
-	async function loadResourceInternal(
-		resourceType: string | undefined,
-		resourceTypeExclude: string | undefined
-	): Promise<ResourceW[]> {
-		const currentFilters = filters.val
-
-		// Build API parameters from filters.
-		// `includeDraftOnly` surfaces per-user drafts at paths that have
-		// no deployed resource — appended server-side when no narrowing
-		// filter is set, so the user sees AI-agent-created drafts on
-		// the home page.
-		const apiParams: any = {
-			workspace: $workspaceStore!,
-			resourceTypeExclude,
-			resourceType: resourceType || (currentFilters.resource_type as string | undefined),
-			includeDraftOnly: true
-		}
-
-		if (currentFilters.path) {
-			// path filter can be comma-separated for multiple values
-			apiParams.path = currentFilters.path
-		}
-		if (currentFilters.path_start) {
-			apiParams.pathStart = currentFilters.path_start
-		}
-		if (currentFilters.description) {
-			apiParams.description = currentFilters.description
-		}
-		if (currentFilters.value) {
-			apiParams.value = currentFilters.value
-		}
-		if (currentFilters.owner) {
-			apiParams.pathStart = currentFilters.owner
-		}
-		if (currentFilters._default_) {
-			apiParams.broadFilter = currentFilters._default_
-		}
-		if (currentFilters.label) {
-			apiParams.label = currentFilters.label
-		}
-
-		const result = (await ResourceService.listResource(apiParams)).map((x) => {
-			return {
-				canWrite:
-					canWrite(x.path, x.extra_perms!, $userStore) && $workspaceStore! == x.workspace_id,
-				...x
-			}
-		})
-
-		// Extract unique values for autocomplete
-		allPaths = Array.from(new Set(result.map((x) => x.path))).sort()
-		allResourceTypes = Array.from(new Set(result.map((x) => x.resource_type))).sort()
-		allOwners = Array.from(
-			new Set(result.map((x) => x.path.split('/').slice(0, 2).join('/')))
-		).sort()
-		allLabels = Array.from(
-			new Set(result.flatMap((x) => [...(x.labels ?? []), ...(x.inherited_labels ?? [])]))
-		).sort()
-
-		return result
-	}
-
-	async function loadResourceTypes(): Promise<void> {
-		const rows = await ResourceService.listResourceType({ workspace: $workspaceStore! })
-		setResourceTypeDisplayNames(rows)
-		resourceTypes = rows.map((x) => {
-			return {
-				canWrite: $workspaceStore! == x.workspace_id,
-				...x
-			}
-		})
-		loading.types = false
-	}
-
-	async function deleteResource(path: string, account?: number): Promise<void> {
-		if (account) {
-			OauthService.disconnectAccount({ workspace: $workspaceStore!, id: account })
-		}
-		// The response names the linked variables that went with it, which nothing else on the
-		// page would show.
-		sendUserToast(await ResourceService.deleteResource({ workspace: $workspaceStore!, path }))
-		reload()
-	}
-
-	async function addResourceType(): Promise<void> {
-		if (!newResourceType.isFileset) {
-			if (newResourceType.formatExtension === '') {
-				throw new Error('Invalid empty file extension (make sure it is selected)')
-			}
-			if (!validateFileExtension(newResourceType.formatExtension ?? 'txt')) {
-				throw new Error('Invalid file extension')
-			}
-		}
-		await ResourceService.createResourceType({
-			workspace: $workspaceStore!,
-			requestBody: {
-				name: (disableCustomPrefix ? '' : 'c_') + newResourceType.name,
-				schema: newResourceType.schema,
-				description: newResourceType.description,
-				format_extension: newResourceType.formatExtension,
-				is_fileset: newResourceType.isFileset
-			}
-		})
-		resourceTypeDrawer?.closeDrawer?.()
-		sendUserToast('Resource type created')
-		loadResourceTypes()
-		$resourceTypesStore = undefined
-	}
-
-	async function updateResourceType(): Promise<void> {
-		await ResourceService.updateResourceType({
-			workspace: $workspaceStore!,
-			path: editResourceType.name,
-			requestBody: {
-				schema: editResourceType.schema,
-				description: editResourceType.description
-			}
-		})
-		editResourceTypeDrawer?.closeDrawer?.()
-		sendUserToast('Resource type updated')
-		loadResourceTypes()
-	}
-
-	async function handleDeleteResourceType(name: string) {
-		try {
-			await ResourceService.deleteResourceType({ workspace: $workspaceStore!, path: name })
-			loadResourceTypes()
-		} catch (err) {
-			if (err.status === 400 && err.body.includes('foreign key')) {
-				sendUserToast(
-					`Could not delete resource type because there are resources attached to it. Delete resources using this type first.`,
-					true
-				)
-			} else {
-				sendUserToast(`Could not delete resource type: ${err?.body || err}`, true)
-			}
-		}
-	}
-
-	const startNewType = () => {
-		// Find a unique name by checking for duplicates and appending a number
-		const baseName = 'my_resource_type'
-		let uniqueName = baseName
-		let counter = 2
-
-		// Check if the base name or numbered variants exist
-		while (true) {
-			const fullName = (disableCustomPrefix ? '' : 'c_') + uniqueName
-			const exists = resourceTypes?.some((rt) => rt.name === fullName) ?? false
-
-			if (!exists) {
-				break
-			}
-
-			uniqueName = `${baseName}_${counter}`
-			counter++
-		}
-
-		newResourceType = {
-			name: uniqueName,
-			schema: emptySchema(),
-			description: '',
-			formatExtension: undefined,
-			isFileset: undefined
-		}
-		validateResourceTypeName()
-
-		resourceTypeDrawer?.openDrawer?.()
-	}
-
-	async function startEditResourceType(name: string) {
-		const rt = await ResourceService.getResourceType({ workspace: $workspaceStore!, path: name })
-		editResourceType = {
-			name: rt.name,
-			schema: rt.schema as any,
-			description: rt.description ?? '',
-			formatExtension: rt.format_extension,
-			isFileset: rt.is_fileset ?? false
-		}
-		editResourceTypeDrawer?.openDrawer?.()
-	}
-
-	onMount(() => {
-		const callback = page.url.searchParams.get('callback')
-		if (callback == 'supabase_wizard') {
-			supabaseConnect?.open?.()
-		}
-
-		const connect_app = page.url.searchParams.get('connect_app')
-		if (connect_app) {
-			const rt = connect_app ?? undefined
-			if (rt == 'undefined') {
-				appConnect?.open?.()
-			} else {
-				appConnect?.open?.(rt)
-			}
-		}
-	})
-
-	function openInferrer(): void {
-		inferrer?.openDrawer?.()
-	}
-
-	let disableCustomPrefix = $state(false)
-	let tab: 'workspace' | 'types' | 'states' | 'cache' | 'theme' = $state('workspace') as
-		| 'workspace'
-		| 'types'
-		| 'states'
-		| 'cache'
-		| 'theme'
-
-	let inferrer: Drawer | undefined = $state(undefined)
-	let inferrerJson = $state('')
-
-	function inferJson(): void {
-		try {
-			newResourceType.schema = {
-				$schema: undefined,
-				required: [],
-				properties: {},
-				...convert(JSON.parse(inferrerJson))
-			}
-		} catch (e) {
-			sendUserToast(`Invalid JSON: ${e}`, true)
-		}
-		inferrer?.closeDrawer?.()
-	}
-	let deploymentDrawer: DeployWorkspaceDrawer | undefined = $state(undefined)
-
-	async function reload() {
-		loading = {
-			resources: true,
-			types: true
-		}
-		if (tab == 'cache') {
-			await loadCache()
-		} else if (tab == 'states') {
-			await loadState()
-		} else if (tab == 'theme') {
-			await loadTheme()
-		} else {
-			await loadResources()
-		}
-		await loadResourceTypes()
-		loading = {
-			resources: false,
-			types: false
-		}
-	}
-
-	let deployUiSettings: WorkspaceDeployUISettings | undefined = $state(undefined)
-
-	async function getDeployUiSettings() {
-		if (!$enterpriseLicense) {
-			deployUiSettings = ALL_DEPLOYABLE
-			return
-		}
-		let settings = await WorkspaceService.getPublicSettings({ workspace: $workspaceStore! })
-		deployUiSettings = settings.deploy_ui ?? ALL_DEPLOYABLE
-	}
-	getDeployUiSettings()
-
-	function validateResourceTypeName() {
-		const snakeCaseRegex = /^[a-z0-9]+(_[a-z0-9]+)*$/
-		isNewResourceTypeNameValid = snakeCaseRegex.test(newResourceType.name)
-		checkResourceTypeNameExists.debounced()
-	}
-
-	const checkResourceTypeNameExists = debounce(() => {
-		if (!newResourceType.name) {
-			resourceTypeNameExists = false
-			return
-		}
-		const fullName = (disableCustomPrefix ? '' : 'c_') + newResourceType.name
-		resourceTypeNameExists = resourceTypes?.some((rt) => rt.name === fullName) ?? false
-	}, 300)
-
-	// Re-check when prefix setting changes
-	$effect(() => {
-		if (disableCustomPrefix !== undefined) {
-			checkResourceTypeNameExists.debounced()
-		}
-	})
-
-	function toSnakeCase() {
-		newResourceType.name = newResourceType.name
-			.replace(/([a-z0-9])([A-Z])/g, '$1_$2')
-			.replace(/[\W]+/g, '_')
-			.replace(/_+/g, '_')
-			.replace(/^_+|_+$/g, '')
-			.toLowerCase()
-		validateResourceTypeName()
-	}
-
-	let resourceNameToFileExtMap: Record<string, string> | undefined = undefined
-	let resourceNameToIsFilesetMap: Record<string, boolean> | undefined = undefined
-
-	let loadingResourceNameToFileExt = false
-	async function loadResourceNameToFileExtMap() {
-		if (resourceNameToFileExtMap != undefined) return
-		if (loadingResourceNameToFileExt) {
-			while (resourceNameToFileExtMap == undefined) {
-				console.log('waiting for resourceNameToFileExtMap')
-				await new Promise((resolve) => setTimeout(resolve, 100))
-			}
-			return
-		}
-		loadingResourceNameToFileExt = true
-		try {
-			const raw = (await ResourceService.fileResourceTypeToFileExtMap({
-				workspace: $workspaceStore!
-			})) as Record<string, string | { format_extension: string | null; is_fileset: boolean }>
-			resourceNameToFileExtMap = {}
-			resourceNameToIsFilesetMap = {}
-			for (const [k, v] of Object.entries(raw)) {
-				if (typeof v === 'string') {
-					resourceNameToFileExtMap[k] = v
-					resourceNameToIsFilesetMap![k] = false
-				} else {
-					if (v.format_extension) {
-						resourceNameToFileExtMap[k] = v.format_extension
-					}
-					resourceNameToIsFilesetMap![k] = v.is_fileset ?? false
-				}
-			}
-		} catch (e) {
-			console.error('Error loading resourceNameToFileExtMap', e)
-		} finally {
-			loadingResourceNameToFileExt = false
-		}
-	}
-
-	function resourceNameToFileExt(resourceName: string): string | undefined {
-		return resourceNameToFileExtMap?.[resourceName]
-	}
-
-	function resourceNameIsFileset(resourceName: string): boolean {
-		return resourceNameToIsFilesetMap?.[resourceName] ?? false
-	}
-
-	// Eagerly load the map
-	loadResourceNameToFileExtMap()
-
-	// Current resources based on tab
-	let currentResources = $derived(
-		tab == 'cache'
-			? cacheResources
-			: tab == 'states'
-				? stateResources
-				: tab == 'theme'
-					? themeResources
-					: resources
-	)
-
-	// Filter resources client-side for user folder filtering (admin feature)
-	let filteredItems = $derived.by(() => {
-		let items = currentResources
-		if (filters.val.user_folders_only && items) {
-			items = items.filter((item) => {
-				if (userFoldersFilterType === 'only f/*') return item.path.startsWith('f/')
-				if (userFoldersFilterType === 'u/username and f/*')
-					return item.path.startsWith('f/') || item.path.startsWith(`u/${$userStore?.username}/`)
-				return true
-			})
-		}
-		return items
-	})
-
-	// Reload resources when filters change
-	$effect(() => {
-		filters.val
-		if ($workspaceStore) {
-			untrack(() => {
-				if (tab === 'workspace') {
-					loadResources()
-				} else if (tab === 'theme') {
-					loadTheme()
-				} else if (tab === 'cache') {
-					loadCache()
-				} else if (tab === 'states') {
-					loadState()
-				}
-			})
-		}
-	})
-	$effect(() => {
-		if ($workspaceStore && $userStore) {
-			untrack(() => {
-				loadResources()
-				loadResourceTypes()
-			})
-		}
-	})
-
-	// Deep link: #/resource/<path> opens that resource's edit drawer. Reactive
-	// rather than onMount so a hash change on the already-mounted page (e.g. the
-	// AI session preview re-pointing its tab) opens the drawer too. Row links
-	// pre-set handledHash: their onclick already opens the drawer.
-	let handledHash = ''
-	$effect(() => {
-		const hash = page.url.hash
-		if (!hash.startsWith('#/resource/')) {
-			// Navigating away from a drawer target must clear the tracker, or
-			// re-targeting the same item later would be skipped as already handled.
-			handledHash = ''
-			return
-		}
-		if (hash === handledHash || !resourceEditor) return
-		// The type decides which editor opens, so wait for the list that carries it.
-		if (!resources) return
-		handledHash = hash
-		const path = hash.slice(11)
-		void openResourceFromHash(path)
-	})
-
-	/** The listing is narrowed by the active filters, so a deep-linked resource may not be in it.
-	 *  Treating that absence as "unknown type" would open the generic form, which materializes a
-	 *  default into every field the value omits and so writes a draft just by rendering. Ask the
-	 *  server instead. */
-	async function openResourceFromHash(path: string) {
-		let resourceType = resources?.find((r) => r.path === path)?.resource_type
-		if (resourceType === undefined) {
-			// The hash can move on while this is in flight, and two lookups can land out of order.
-			// Whichever resolves last must not open an editor the URL has already left.
-			const openingFor = handledHash
-			try {
-				resourceType = (await ResourceService.getResource({ workspace: $workspaceStore!, path }))
-					.resource_type
-			} catch (err) {
-				if (handledHash !== openingFor) return
-				// Opening the generic form on an unknown type is the very thing this avoids, so a
-				// failed lookup opens nothing at all. The hash stays claimed: the effect above reads
-				// it, so releasing it here would re-enter this lookup and toast on a loop. Clicking
-				// the row is the way to try again.
-				sendUserToast(`Could not open ${path}: ${err}`, true)
-				return
-			}
-			if (handledHash !== openingFor) return
-		}
-		openResourceEditor(path, resourceType)
-	}
-
-	let showTable = $derived(
-		tab == 'workspace' || tab == 'states' || tab == 'cache' || tab == 'theme'
-	)
-
-	let activeFilters = $derived(hasActiveFilters(filters.val))
-
-	const emptyStates: Record<string, { icon: any; title: string; description: string }> = {
-		workspace: {
-			icon: Boxes,
-			title: 'No resources yet',
-			description:
-				'Resources hold the connection settings and credentials your scripts, flows and apps use to reach external systems.'
-		},
-		states: {
-			icon: Database,
-			title: 'No states yet',
-			description:
-				'States appear here once a script stores data to keep it persistent between runs of the same trigger.'
-		},
-		cache: {
-			icon: Zap,
-			title: 'No cached results yet',
-			description:
-				'Cached results appear here once a flow step with caching enabled has run at least once.'
-		},
-		theme: {
-			icon: Palette,
-			title: 'No themes yet',
-			description:
-				'Themes are CSS for the legacy low-code app editor only. Add one from the CSS panel of an app — they cannot be created here.'
-		}
-	}
-	let emptyState = $derived(emptyStates[tab] ?? emptyStates.workspace)
+	import ResourcesList from '$lib/components/resources/ResourcesList.svelte'
 </script>
 
-<ConfirmationModal
-	open={Boolean(deleteConfirmedCallback)}
-	title="Remove resource"
-	confirmationText="Remove"
-	trashbin
-	on:canceled={() => {
-		deleteConfirmedCallback = undefined
-	}}
-	on:confirmed={() => {
-		if (deleteConfirmedCallback) {
-			deleteConfirmedCallback()
-		}
-		deleteConfirmedCallback = undefined
-	}}
->
-	<div class="flex flex-col w-full space-y-4">
-		<span
-			>Are you sure you want to remove <span class="font-semibold break-all">{deletePath}</span
-			>?</span
-		>
-		{#if deleteIsLinked}
-			<Alert type="warning" title="Linked variable">
-				This resource is linked with a variable of the same path. That variable is deleted with it,
-				unless another resource still references it.
-			</Alert>
-		{/if}
-		<Alert type="info" title="Bypass confirmation">
-			<div>
-				You can press
-				<Badge color="dark-gray">SHIFT</Badge>
-				while removing a resource to bypass confirmation.
-			</div>
-		</Alert>
-	</div>
-</ConfirmationModal>
-
-<DeployWorkspaceDrawer bind:this={deploymentDrawer} />
-
-<Drawer bind:this={inferrer} size="800px">
-	<DrawerContent title="Infer type from JSON" on:close={() => inferrer?.toggleDrawer?.()}>
-		<SimpleEditor
-			bind:code={inferrerJson}
-			lang="json"
-			class="h-full"
-			fixedOverflowWidgets={false}
-		/>
-		{#snippet actions()}
-			<Button size="sm" on:click={inferJson}>Infer</Button>
-		{/snippet}
-	</DrawerContent>
-</Drawer>
-
-<Drawer bind:this={resourceTypeViewer} size="800px">
-	<DrawerContent title={resourceTypeViewerObj.rt} on:close={resourceTypeViewer.closeDrawer}>
-		{#snippet titleExtra()}
-			<IconedResourceType
-				name={resourceTypeViewerObj.rt}
-				formatExtension={resourceTypeViewerObj.formatExtension}
-				isFileset={resourceTypeViewerObj.isFileset}
-				silent
-				width="20px"
-				height="20px"
-			/>
-		{/snippet}
-		<div class="flex flex-col gap-6">
-			{#if resourceTypeViewerObj.description}
-				<GfmMarkdown md={resourceTypeViewerObj.description ?? ''} prose="sm" noPadding />
-			{/if}
-			{#if resourceTypeViewerObj.isFileset}
-				<Alert type="info" title="Fileset resource type">
-					This resource type represents a collection of files. Each file is identified by its
-					relative path and contains text content. In the CLI, filesets are stored as directories.
-				</Alert>
-			{:else if resourceTypeViewerObj.formatExtension}
-				<Alert
-					type="info"
-					title="Plain text file resource (.{resourceTypeViewerObj.formatExtension})"
-				>
-					This resource type represents a plain text file with a <b
-						>.{resourceTypeViewerObj.formatExtension}</b
-					>
-					extension. (e.g. <b>my_file.{resourceTypeViewerObj.formatExtension}</b>)
-				</Alert>
-			{:else}
-				<SchemaViewer schema={resourceTypeViewerObj.schema} />
-			{/if}
-		</div>
-	</DrawerContent>
-</Drawer>
-
-<Drawer bind:this={editResourceTypeDrawer} size="800px">
-	<DrawerContent title="Edit resource type" on:close={editResourceTypeDrawer.closeDrawer}>
-		{#snippet actions()}
-			<Button
-				startIcon={{ icon: Save }}
-				on:click={updateResourceType}
-				unifiedSize="md"
-				variant="accent">Update</Button
-			>
-		{/snippet}
-		<div class="flex flex-col gap-6">
-			<label for="inp">
-				<div class="mb-1 font-semibold text-emphasis text-xs gap-1 flex flex-row items-center"
-					>Name
-					<div class="flex flex-row items-center gap-x-4">
-						<div class="flex flex-row items-center">
-							<div class="inline-block">
-								<input
-									disabled
-									id="inp"
-									type="text"
-									bind:value={editResourceType.name}
-									class={classNames('!h-8  !border !border-gray-200')}
-								/>
-							</div>
-						</div>
-					</div>
-				</div></label
-			>
-			<label>
-				<div class="mb-1 font-semibold text-emphasis text-xs">Description</div>
-				<textarea use:autosize autocomplete="off" bind:value={editResourceType.description}
-				></textarea></label
-			>
-			<div>
-				{#if editResourceType.isFileset}
-					<Alert type="info" title="Fileset resource type">
-						This resource type represents a collection of files. The schema cannot be edited.
-					</Alert>
-				{:else if editResourceType.formatExtension}
-					<Alert type="info" title="Plain text file resource (.{editResourceType.formatExtension})">
-						This resource type represents a plain text file with a <b
-							>.{editResourceType.formatExtension}</b
-						>
-						extension. (e.g. <b>my_file.{editResourceType.formatExtension}</b>). The schema only
-						contains a `content` field and thus cannot be edited.
-					</Alert>
-				{:else}
-					<div class="mb-1 font-semibold text-emphasis text-xs">Schema</div>
-					<div class="flex flex-col gap-2">
-						<EditableSchemaWrapper bind:schema={editResourceType.schema} noPreview />
-					</div>
-				{/if}
-			</div>
-		</div>
-	</DrawerContent>
-</Drawer>
-
-<Drawer bind:this={resourceTypeDrawer} size="1200px">
-	<DrawerContent title="Create resource type" on:close={resourceTypeDrawer.closeDrawer}>
-		{#snippet actions()}
-			<Button
-				unifiedSize="md"
-				variant="accent"
-				startIcon={{ icon: Save }}
-				on:click={addResourceType}
-				disabled={!isNewResourceTypeNameValid || resourceTypeNameExists}>Save</Button
-			>
-		{/snippet}
-		<div class="flex flex-col gap-6">
-			<label for="inp">
-				<div class="mb-1 font-semibold text-emphasis text-xs gap-1 flex flex-row items-center"
-					>Name<Required required={true} /><Tooltip>
-						Resource types are synchronized with the official types on the hub regularly. The `c_`
-						prefix is to avoid name clashes with them.
-					</Tooltip></div
-				>
-				<div class="flex flex-row items-center gap-x-4">
-					<div class="flex flex-row items-center">
-						{#if !disableCustomPrefix}
-							<span
-								class="border border-r-0 rounded-l py-1 text-sm bg-surface-secondary inline-block w-8 h-8 px-2"
-							>
-								c_
-							</span>
-						{/if}
-
-						<div class="inline-block">
-							<input
-								id="inp"
-								type="text"
-								bind:value={newResourceType.name}
-								class={classNames('!h-8  !border ', !disableCustomPrefix ? '!rounded-l-none' : '')}
-								oninput={validateResourceTypeName}
-							/>
-						</div>
-					</div>
-					{#if $userStore?.is_admin || $userStore?.is_super_admin}
-						<Toggle
-							bind:checked={disableCustomPrefix}
-							options={{ right: 'disable c_ prefix (admin only)' }}
-						/>
-					{/if}
-				</div>
-				{#if newResourceType.name}
-					{#if !isNewResourceTypeNameValid}
-						<p class="mt-1 px-2 text-red-600 dark:text-red-400 text-2xs"
-							>Name must be snake_case!
-							<button onclick={toSnakeCase} class="text-blue-600">Fix...</button></p
-						>
-					{:else if resourceTypeNameExists}
-						<p class="mt-1 px-2 text-red-600 dark:text-red-400 text-2xs"
-							>A resource type with this name already exists!</p
-						>
-					{/if}
-				{/if}
-			</label>
-			<label>
-				<div class="mb-1 font-semibold text-emphasis text-xs">Description</div>
-				<textarea use:autosize autocomplete="off" bind:value={newResourceType.description}
-				></textarea></label
-			>
-			<div>
-				<div class="flex justify-between w-full items-center mb-1">
-					<div class="font-semibold text-emphasis text-xs">Schema</div>
-					<div class="w-full flex flex-row-reverse">
-						<Button
-							on:click={openInferrer}
-							unifiedSize="md"
-							variant="default"
-							startIcon={{ icon: Braces }}
-						>
-							Infer schema from a json value
-						</Button>
-					</div>
-				</div>
-
-				<div class="flex flex-col gap-2">
-					<EditableSchemaWrapper
-						bind:schema={newResourceType.schema}
-						bind:formatExtension={newResourceType.formatExtension}
-						bind:isFileset={newResourceType.isFileset}
-						fullHeight
-					/>
-				</div>
-			</div>
-		</div>
-	</DrawerContent>
-</Drawer>
-
-{#if $userStore?.operator && $workspaceStore && !$userWorkspaces.find((_) => _.id === $workspaceStore)?.operator_settings?.resources}
-	<div class="bg-red-100 border-l-4 border-red-600 text-orange-700 p-4 m-4 mt-12" role="alert">
-		<p class="font-bold">Unauthorized</p>
-		<p>Page not available for operators</p>
-	</div>
-{:else}
-	<CenteredPage>
-		<PageHeader
-			title="Resources"
-			tooltip="Save and permission rich objects (JSON) including credentials obtained through OAuth."
-			documentationLink="https://www.windmill.dev/docs/core_concepts/resources_and_types"
-		>
-			{#if showCreateButtons}
-				<div class="flex flex-row justify-end gap-4">
-					<Button
-						variant="default"
-						unifiedSize="md"
-						startIcon={{ icon: Plus }}
-						on:click={startNewType}
-						aiId="resources-add-resource-type"
-						aiDescription="Add resource type"
-					>
-						Add resource type
-					</Button>
-					<Button
-						unifiedSize="md"
-						variant="accent"
-						startIcon={{ icon: Boxes }}
-						on:click={() => appConnect?.open?.()}
-						aiId="resources-add-resource"
-						aiDescription="Add resource"
-					>
-						Add resource
-					</Button>
-				</div>
-			{/if}
-		</PageHeader>
-		<NoDirectDeployAlert onUpdateCanEditStatus={(v) => (showCreateButtons = v)} />
-		<div class="flex justify-between">
-			<Tabs
-				class="w-full"
-				bind:selected={tab}
-				on:selected={(e) => {
-					if (e.detail == 'cache') {
-						loading.resources = true
-						loadCache()
-					} else if (e.detail == 'states') {
-						loading.resources = true
-						loadState()
-					} else if (e.detail == 'theme') {
-						loading.resources = true
-						loadTheme()
-					}
-				}}
-			>
-				<Tab value="workspace" label="Workspace" icon={Building} />
-				<Tab value="types" label="Resource Types">
-					{#snippet extra()}
-						<Tooltip
-							documentationLink="https://www.windmill.dev/docs/core_concepts/resources_and_types"
-						>
-							Every resource has a Resource Type attached to it which contains its schema and make
-							it easy in scripts and flows to accept only resources of a specific resource type.
-						</Tooltip>
-					{/snippet}
-				</Tab>
-				<Tab value="states" label="States">
-					{#snippet extra()}
-						<Tooltip>
-							States are actually resources (but excluded from the Workspace tab for clarity).
-							States are used by scripts to keep data persistent between runs of the same script by
-							the same trigger (schedule or user)
-						</Tooltip>
-					{/snippet}
-				</Tab>
-				<Tab value="cache" label="Cache">
-					{#snippet extra()}
-						<Tooltip>
-							Cached results are actually resources (but excluded from the Workspace tab for
-							clarity). Cache are used by flows's step to cache result to avoid recomputing
-							unnecessarily
-						</Tooltip>
-					{/snippet}
-				</Tab>
-				<Tab value="theme" label="Theme">
-					{#snippet extra()}
-						<Tooltip>
-							Themes are actually resources (but excluded from the Workspace tab for clarity). They
-							are CSS for the legacy low-code app editor only, and are added from the CSS panel of
-							an app rather than from this page.
-						</Tooltip>
-					{/snippet}
-				</Tab>
-			</Tabs>
-			<div class="flex gap-2 grow justify-end">
-				<Button
-					unifiedSize="md"
-					iconOnly
-					onClick={reload}
-					startIcon={{
-						icon: RotateCw,
-						classes: loading.resources || loading.types ? 'animate-spin' : ''
-					}}
-				/>
-				{#if tab == 'types'}
-					<FilterSearchbar
-						schema={resourceTypesFilterSchema}
-						class="max-w-[26rem] grow"
-						bind:value={resourceTypesFilters.val}
-						placeholder="Filter resource types..."
-					/>
-				{:else}
-					<FilterSearchbar
-						schema={resourcesFilterSchema}
-						class="max-w-[26rem] grow"
-						bind:value={filters.val}
-						placeholder="Filter resources..."
-						presets={folderPresets}
-					/>
-				{/if}
-			</div>
-		</div>
-		<TabFade key={tab}>
-			{#if showTable}
-				<div class="overflow-x-auto pb-40 mt-4">
-					{#if loading.resources}
-						<Skeleton layout={[0.5, [2], 1]} />
-						{#each new Array(6) as _}
-							<Skeleton layout={[[4], 0.7]} />
-						{/each}
-					{:else if filteredItems?.length == 0}
-						{#if activeFilters}
-							<EmptyState
-								icon={SearchX}
-								title="No resources found"
-								description="No resource matches the current filters. Try clearing or widening them."
-							/>
-						{:else}
-							<EmptyState
-								icon={emptyState.icon}
-								title={emptyState.title}
-								description={emptyState.description}
-								action={tab == 'workspace' && showCreateButtons
-									? {
-											label: 'Add a resource',
-											icon: Boxes,
-											onClick: () => appConnect?.open?.(),
-											aiId: 'resources-empty-add-resource',
-											aiDescription: 'Add resource'
-										}
-									: undefined}
-							/>
-						{/if}
-					{:else}
-						<DataTable>
-							<Head>
-								<Row>
-									<Cell head first />
-									<Cell head>Path</Cell>
-									<Cell head>Resource type</Cell>
-									<Cell head>Description</Cell>
-									<Cell head>Status</Cell>
-									<Cell head last actions>Actions</Cell>
-								</Row>
-							</Head>
-							<tbody class="divide-y bg-surface">
-								{#if filteredItems}
-									{#each filteredItems as { path, description, resource_type, extra_perms, canWrite, is_oauth, is_linked, account, refresh_error, is_expired, marked, is_refreshed, labels, inherited_labels, ws_specific, draft_only, is_draft }}
-										{@const hasDraft =
-											getLocalDraftHint($workspaceStore, 'resource', path) ?? is_draft}
-										<Row>
-											<Cell first>
-												<SharedBadge {canWrite} extraPerms={extra_perms} />
-											</Cell>
-											<Cell>
-												<div class="flex items-center gap-2">
-													<a
-														class="break-all"
-														href="#/resource/{path}"
-														onclick={() => {
-															handledHash = `#/resource/${path}`
-															openResourceEditor(path, resource_type)
-														}}
-														>{#if marked}{@html marked}{:else}{path}{/if}{hasDraft ? '*' : ''}</a
-													>
-													<DraftBadge {draft_only} is_draft={hasDraft} />
-													{#if labels?.length}
-														<div class="flex items-center gap-0.5">
-															{#each labels as label}
-																<Badge
-																	color="blue"
-																	small
-																	class="px-1"
-																	title="Label: {label}"
-																	clickable
-																	onclick={() => {
-																		const arr = (filters.val.label ?? '').split(',').filter(Boolean)
-																		const idx = arr.indexOf(label)
-																		if (idx >= 0) arr.splice(idx, 1)
-																		else arr.push(label)
-																		const newFilters = { ...filters.val }
-																		if (arr.length) newFilters.label = arr.join(',')
-																		else delete newFilters.label
-																		filters.val = newFilters
-																	}}>{label}</Badge
-																>
-															{/each}
-														</div>
-													{/if}
-													<InheritedLabels labels={inherited_labels} />
-												</div>
-											</Cell>
-											<Cell>
-												<a
-													href="#{name}"
-													onclick={() => {
-														const linkedRt = resourceTypes?.find((rt) => rt.name === resource_type)
-														if (linkedRt) {
-															resourceTypeViewerObj = {
-																rt: linkedRt.name,
-																//@ts-ignore
-																schema: linkedRt.schema,
-																description: linkedRt.description ?? '',
-																formatExtension: linkedRt.format_extension,
-																isFileset: linkedRt.is_fileset ?? false
-															}
-															resourceTypeViewer?.openDrawer?.()
-														} else {
-															sendUserToast(
-																`Resource type ${resource_type} not found in workspace.`,
-																true
-															)
-														}
-													}}
-												>
-													<IconedResourceType
-														name={resource_type}
-														after={true}
-														formatExtension={resourceNameToFileExt(resource_type)}
-														isFileset={resourceNameIsFileset(resource_type)}
-													/>
-												</a>
-											</Cell>
-											<Cell>
-												<div class="flex items-center min-h-8 w-full min-w-0 max-w-[30rem]">
-													<span
-														class="text-primary text-xs whitespace-pre-wrap ellipsize-multi-line [-webkit-line-clamp:2]"
-														title={removeMarkdown(description ?? '')}
-													>
-														{removeMarkdown(truncate(description ?? '', 200))}
-													</span>
-												</div>
-											</Cell>
-											<Cell>
-												<div class="flex flex-row text-center">
-													<div class="w-10">
-														{#if is_linked}
-															<Popover>
-																<Link size={16} />
-																{#snippet text()}
-																	<div>
-																		This resource is linked with a variable of the same path. They
-																		are deleted and renamed together.
-																	</div>
-																{/snippet}
-															</Popover>
-														{/if}
-													</div>
-													<div class="w-10">
-														{#if is_refreshed}
-															<Popover>
-																<RotateCw />
-																{#snippet text()}
-																	<div>
-																		The OAuth token will be kept up-to-date in the background by
-																		Windmill using its refresh token
-																	</div>
-																{/snippet}
-															</Popover>
-														{/if}
-													</div>
-
-													{#if is_oauth}
-														<div class="w-10 pt-1.5">
-															{#if refresh_error}
-																<Popover>
-																	<Circle
-																		class="text-red-600 animate-[pulse_5s_linear_infinite] fill-current"
-																		size={12}
-																	/>
-																	{#snippet text()}
-																		<div>
-																			Latest exchange of the refresh token did not succeed. Error: {refresh_error}
-																		</div>
-																	{/snippet}
-																</Popover>
-															{:else if is_expired}
-																<Popover>
-																	<Circle
-																		class="text-yellow-600 animate-[pulse_5s_linear_infinite] fill-current"
-																		size={12}
-																	/>
-
-																	{#snippet text()}
-																		<div>
-																			The access_token is expired, it will get renewed the next time
-																			this variable is fetched or you can request is to be refreshed
-																			in the dropdown on the right.
-																		</div>
-																	{/snippet}
-																</Popover>
-															{:else}
-																<Popover>
-																	<Circle
-																		class="text-green-600 animate-[pulse_5s_linear_infinite] fill-current"
-																		size={12}
-																	/>
-																	{#snippet text()}
-																		<div>
-																			The resource was connected through OAuth and the token is not
-																			expired.
-																		</div>
-																	{/snippet}
-																</Popover>
-															{/if}
-														</div>
-													{/if}
-												</div>
-											</Cell>
-											<Cell last actions>
-												<div class="flex justify-end items-center gap-2">
-													{#if path && assetCanBeExplored({ kind: 'resource', path }, { resource_type }) && !$userStore?.operator}
-														<ExploreAssetButton
-															asset={{ kind: 'resource', path }}
-															_resourceMetadata={{ resource_type }}
-															class="w-24"
-														/>
-													{/if}
-													<Dropdown
-														class="w-fit"
-														items={[
-															{
-																displayName: 'Permissions',
-																icon: Shield,
-																action: () => {
-																	shareModal?.openDrawer?.(path, 'resource')
-																}
-															},
-															{
-																displayName: 'Edit',
-																icon: Pen,
-																disabled: !canWrite || !showCreateButtons,
-																action: () => {
-																	openResourceEditor(path, resource_type)
-																}
-															},
-															// The agent form covers an agent's configuration, not everything a
-															// resource carries: the workspace-specific toggle in particular is
-															// only in the generic editor. JSON rather than that editor's form,
-															// which would render the configuration field by field and write a
-															// default into every one the agent leaves unset. Both write the same
-															// draft row, so this is a second view of the same edits.
-															...(resource_type === 'ai_agent'
-																? [
-																		{
-																			displayName: 'Edit as JSON',
-																			icon: Braces,
-																			disabled: !canWrite || !showCreateButtons,
-																			action: () => {
-																				// The drawer anchors itself in the hash, which the deep-link
-																				// effect would then read and route back to the agent editor.
-																				// Claim it first, as the row's own link does.
-																				handledHash = `#/resource/${path}`
-																				resourceEditor?.initEdit?.(path, { json: true })
-																			}
-																		}
-																	]
-																: []),
-															...(!ws_specific && isDeployable('resource', path, deployUiSettings)
-																? [
-																		{
-																			displayName: 'Deploy to prod/staging',
-																			icon: FileUp,
-																			action: () => {
-																				deploymentDrawer?.openDrawer(path, 'resource')
-																			}
-																		}
-																	]
-																: []),
-															{
-																displayName: 'Delete',
-																disabled: !canWrite || !showCreateButtons,
-																icon: Trash,
-																type: 'delete',
-																action: (event) => {
-																	// TODO
-																	// @ts-ignore
-																	if (event?.shiftKey) {
-																		deleteResource(path, account)
-																	} else {
-																		deleteIsLinked = is_linked ?? false
-																		deletePath = path
-																		deleteConfirmedCallback = () => {
-																			deleteResource(path, account)
-																		}
-																	}
-																}
-															},
-															...(account != undefined
-																? [
-																		{
-																			displayName: 'Refresh token',
-																			icon: RotateCw,
-																			action: async () => {
-																				await OauthService.refreshToken({
-																					workspace: $workspaceStore ?? '',
-																					id: account ?? 0,
-																					requestBody: {
-																						path
-																					}
-																				})
-																				sendUserToast('Token refreshed')
-																				loadResources()
-																			}
-																		}
-																	]
-																: [])
-														]}
-													/>
-												</div></Cell
-											>
-										</Row>
-									{/each}
-								{/if}
-							</tbody>
-						</DataTable>
-					{/if}
-				</div>
-			{:else if tab == 'types'}
-				{#if loading.types}
-					<Skeleton layout={[0.5, [2], 1]} />
-					{#each new Array(6) as _}
-						<Skeleton layout={[[4], 0.7]} />
-					{/each}
-				{:else if filteredResourceTypes?.length == 0}
-					<div class="mt-4">
-						<EmptyState
-							icon={SearchX}
-							title="No resource types found"
-							description="No resource type matches the current filters. Try clearing or widening them."
-						/>
-					</div>
-				{:else}
-					<div class="overflow-auto mt-4">
-						<DataTable>
-							<Head>
-								<Row>
-									<Cell head first>Name</Cell>
-									<Cell head>Description</Cell>
-									<Cell head last actions>Actions</Cell>
-								</Row>
-							</Head>
-							<tbody class="divide-y bg-surface">
-								{#if filteredResourceTypes}
-									{#each filteredResourceTypes as { name, description, schema, canWrite, format_extension, is_fileset }}
-										<Row>
-											<Cell first>
-												<a
-													href="#{name}"
-													onclick={() => {
-														resourceTypeViewerObj = {
-															rt: name,
-															//@ts-ignore
-															schema: schema,
-															description: description ?? '',
-															formatExtension: format_extension,
-															isFileset: is_fileset ?? false
-														}
-
-														resourceTypeViewer?.openDrawer?.()
-													}}
-												>
-													<IconedResourceType
-														after={true}
-														{name}
-														formatExtension={format_extension}
-														isFileset={is_fileset}
-													/>
-												</a>
-											</Cell>
-											<Cell>
-												<!-- Fixed at two lines: min-h so short descriptions still set the same row
-													height as long ones, line-clamp so long ones cannot push the row taller.
-													title carries the whole thing, since the clamp hides the rest. -->
-												<div class="flex items-center min-h-8 w-full min-w-0 max-w-[30rem]">
-													<span
-														class="text-primary text-xs whitespace-pre-wrap ellipsize-multi-line [-webkit-line-clamp:2]"
-														title={removeMarkdown(description ?? '')}
-													>
-														{removeMarkdown(truncate(description ?? '', 200))}
-													</span>
-												</div>
-											</Cell>
-											<Cell last actions>
-												{#if !canWrite}
-													<!-- Badge is inline-flex, so it needs a right-aligning wrapper to sit
-														flush with the action buttons on the rows that have them. -->
-													<div class="flex justify-end">
-														<Badge>
-															Shared globally
-															<Tooltip>
-																This resource type is from the 'admins' workspace shared with all
-																workspaces
-															</Tooltip>
-														</Badge>
-													</div>
-												{:else if $userStore?.is_admin || $userStore?.is_super_admin}
-													<div class="flex flex-row-reverse gap-2">
-														<Button
-															size="xs"
-															variant="default"
-															disabled={!showCreateButtons}
-															btnClasses="border-0"
-															startIcon={{ icon: Trash }}
-															on:click={() => handleDeleteResourceType(name)}
-															destructive
-														>
-															Delete
-														</Button>
-														<Button
-															size="xs"
-															color="light"
-															disabled={!showCreateButtons}
-															startIcon={{ icon: Pen }}
-															on:click={() => startEditResourceType(name)}
-														>
-															Edit
-														</Button>
-													</div>
-												{:else}
-													<Badge>
-														Non Editable
-														<Tooltip>
-															Since resource types are shared with the whole workspace, only admins
-															can edit/delete them
-														</Tooltip>
-													</Badge>
-												{/if}
-											</Cell>
-										</Row>
-									{/each}
-								{/if}
-							</tbody>
-						</DataTable>
-					</div>
-				{/if}
-			{/if}
-		</TabFade>
-	</CenteredPage>
-{/if}
-
-<SupabaseConnect bind:this={supabaseConnect} on:refresh={loadResources} />
-<AppConnect bind:this={appConnect} on:refresh={loadResources} />
-
-<ResourceEditorDrawer
-	bind:this={resourceEditor}
-	workspace={$workspaceStore}
-	on:refresh={loadResources}
-	onRestored={loadResources}
-/>
-
-<ShareModal
-	bind:this={shareModal}
-	on:change={() => {
-		loadResources()
-	}}
-/>
-
-<!-- Same capabilities as from a flow step: the editor is the same one, so which surface opened it
-     must not decide whether its tools can be written with the copilot. -->
-<!-- Imported only once an agent is opened: the editor pulls in the flow editor, which is most of
-     this route's JavaScript and none of what the resources table needs. -->
-{#if agentEditorTarget()}
-	{#await import('$lib/components/flows/content/AgentEditorModal.svelte') then { default: AgentEditorModal }}
-		<AgentEditorModal
-			enableAi={$copilotInfo.enabled}
-			owns={(t) => t.host === undefined}
-			onRenamed={(from, to) => {
-				void loadResources()
-				// Only while the dialog still shows the agent: closed mid-request, it already cleared the
-				// anchor, and writing it back would reopen the editor on refresh.
-				if (agentEditorTarget()?.path !== from) return
-				// Claimed first, as a row click does, so the deep-link effect does not reopen it.
-				handledHash = `#/resource/${to}`
-				setPageDrawerAnchor(RESOURCES_PATH, to)
-			}}
-		/>
-	{/await}
-{/if}
+<ResourcesList />
diff --git a/frontend/src/routes/(root)/(logged)/routes/+page.svelte b/frontend/src/routes/(root)/(logged)/routes/+page.svelte
index 53de5457d1..a79a1a0471 100644
--- a/frontend/src/routes/(root)/(logged)/routes/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/routes/+page.svelte
@@ -1,592 +1,5 @@
 <script lang="ts">
-	import { getLocalDraftHint } from '$lib/localDraftHints.svelte'
-	import { run } from 'svelte/legacy'
-
-	import {
-		HttpTriggerService,
-		SettingService,
-		WorkspaceService,
-		type HttpTrigger,
-		type TriggerMode,
-		type WorkspaceDeployUISettings
-	} from '$lib/gen'
-	import {
-		canWrite,
-		copyToClipboard,
-		displayDate,
-		getLocalSetting,
-		storeLocalSetting,
-		removeTriggerKindIfUnused,
-		sendUserToast
-	} from '$lib/utils'
-	import { base } from '$app/paths'
-	import { page } from '$app/stores'
-	import CenteredPage from '$lib/components/CenteredPage.svelte'
-	import { Button, EmptyState, Skeleton } from '$lib/components/common'
-	import Dropdown from '$lib/components/DropdownV2.svelte'
-	import PageHeader from '$lib/components/PageHeader.svelte'
-	import SharedBadge from '$lib/components/SharedBadge.svelte'
-	import DraftBadge from '$lib/components/DraftBadge.svelte'
-	import ShareModal from '$lib/components/ShareModal.svelte'
-	import Toggle from '$lib/components/Toggle.svelte'
-	import {
-		userStore,
-		workspaceStore,
-		userWorkspaces,
-		enterpriseLicense,
-		usedTriggerKinds
-	} from '$lib/stores'
-	import {
-		Route,
-		Code,
-		Eye,
-		Pen,
-		Plus,
-		Shield,
-		Trash,
-		FileUp,
-		ClipboardCopy,
-		Pause
-	} from 'lucide-svelte'
-	import { goto } from '$lib/navigation'
-	import SearchItems from '$lib/components/SearchItems.svelte'
-	import NoItemFound from '$lib/components/home/NoItemFound.svelte'
-	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
-	import ListFilters from '$lib/components/home/ListFilters.svelte'
-	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
-	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
-	import { setQuery } from '$lib/navigation'
-	import { onMount } from 'svelte'
-	import RouteEditor from '$lib/components/triggers/http/RouteEditor.svelte'
-	import DeployWorkspaceDrawer from '$lib/components/DeployWorkspaceDrawer.svelte'
-	import { ALL_DEPLOYABLE, isDeployable } from '$lib/utils_deployable'
-	import { isCloudHosted } from '$lib/cloud'
-	import { getHttpRoute } from '$lib/components/triggers/http/utils'
-	import RoutesGenerator from '$lib/components/triggers/http/RoutesGenerator.svelte'
-	import OpenApiSpecGenerator from '$lib/components/triggers/http/OpenAPISpecGenerator.svelte'
-	import TriggerModeToggle from '$lib/components/triggers/TriggerModeToggle.svelte'
-
-	type TriggerW = HttpTrigger & { canWrite: boolean }
-
-	let triggers: TriggerW[] = $state([])
-	let shareModal: ShareModal | undefined = $state()
-	let loading = $state(true)
-	let openAPISpecGenerator: OpenApiSpecGenerator | undefined = $state()
-	let routesGenerator: RoutesGenerator | undefined = $state()
-	let deploymentDrawer: DeployWorkspaceDrawer | undefined = $state()
-	let deployUiSettings: WorkspaceDeployUISettings | undefined = $state(undefined)
-	let globalHttpWorkspacedRoute = $state(false)
-
-	async function loadGlobalHttpWorkspacedRouteSetting() {
-		try {
-			const setting = await SettingService.getGlobal({ key: 'http_route_workspaced_route' })
-			globalHttpWorkspacedRoute = (setting as boolean) ?? false
-		} catch {
-			globalHttpWorkspacedRoute = false
-		}
-	}
-
-	loadGlobalHttpWorkspacedRouteSetting()
-
-	async function getDeployUiSettings() {
-		if (!$enterpriseLicense) {
-			deployUiSettings = ALL_DEPLOYABLE
-			return
-		}
-		let settings = await WorkspaceService.getPublicSettings({ workspace: $workspaceStore! })
-		deployUiSettings = settings.deploy_ui ?? ALL_DEPLOYABLE
-	}
-	getDeployUiSettings()
-	async function loadTriggers(): Promise<void> {
-		triggers = (
-			await HttpTriggerService.listHttpTriggers({
-				workspace: $workspaceStore!,
-				includeDraftOnly: true
-			})
-		).map((x) => {
-			return { canWrite: canWrite(x.path, x.extra_perms!, $userStore), ...x }
-		})
-		$usedTriggerKinds = removeTriggerKindIfUnused(triggers.length, 'routes', $usedTriggerKinds)
-		loading = false
-	}
-
-	run(() => {
-		if ($workspaceStore && $userStore) {
-			loadTriggers()
-		}
-	})
-	let routeEditor: RouteEditor | undefined = $state()
-
-	let hashHandled = false
-	$effect(() => {
-		if (!hashHandled && triggers.length > 0 && routeEditor) {
-			let hash = $page.url.hash
-			if (hash.length > 1) {
-				let path = hash.slice(1)
-				let trigger = triggers.find((t) => t.path === path)
-				if (trigger) {
-					hashHandled = true
-					routeEditor?.openEdit(path, trigger.is_flow)
-				}
-			}
-		}
-	})
-
-	let filteredItems: (TriggerW & { marked?: any })[] | undefined = $state([])
-	let items: typeof filteredItems | undefined = $state([])
-	let preFilteredItems: typeof filteredItems | undefined = $state([])
-	let filter = $state('')
-	let ownerFilter: string | undefined = $state(undefined)
-	let nbDisplayed = $state(15)
-
-	const TRIGGER_PATH_KIND_FILTER_SETTING = 'filter_path_of'
-	const FILTER_USER_FOLDER_SETTING_NAME = 'user_and_folders_only'
-	let selectedFilterKind = $state(
-		(getLocalSetting(TRIGGER_PATH_KIND_FILTER_SETTING) as 'trigger' | 'script_flow') ?? 'trigger'
-	)
-	let filterUserFolders = $state(getLocalSetting(FILTER_USER_FOLDER_SETTING_NAME) == 'true')
-
-	run(() => {
-		storeLocalSetting(TRIGGER_PATH_KIND_FILTER_SETTING, selectedFilterKind)
-	})
-	run(() => {
-		storeLocalSetting(FILTER_USER_FOLDER_SETTING_NAME, filterUserFolders ? 'true' : undefined)
-	})
-
-	function filterItemsPathsBaseOnUserFilters(
-		item: TriggerW,
-		selectedFilterKind: 'trigger' | 'script_flow',
-		filterUserFolders: boolean
-	) {
-		if ($workspaceStore == 'admins') return true
-		if (filterUserFolders) {
-			if (selectedFilterKind === 'trigger') {
-				return (
-					!item.path.startsWith('u/') || item.path.startsWith('u/' + $userStore?.username + '/')
-				)
-			} else {
-				return (
-					!item.script_path.startsWith('u/') ||
-					item.script_path.startsWith('u/' + $userStore?.username + '/')
-				)
-			}
-		} else {
-			return true
-		}
-	}
-
-	run(() => {
-		preFilteredItems =
-			ownerFilter != undefined
-				? selectedFilterKind === 'trigger'
-					? triggers?.filter(
-							(x) =>
-								x.path.startsWith(ownerFilter + '/') &&
-								filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-						)
-					: triggers?.filter(
-							(x) =>
-								x.script_path.startsWith(ownerFilter + '/') &&
-								filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-						)
-				: triggers?.filter((x) =>
-						filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-					)
-	})
-
-	run(() => {
-		if ($workspaceStore) {
-			ownerFilter = undefined
-		}
-	})
-
-	let owners = $derived(
-		selectedFilterKind === 'trigger'
-			? Array.from(
-					new Set(filteredItems?.map((x) => x.path.split('/').slice(0, 2).join('/')) ?? [])
-				).sort()
-			: Array.from(
-					new Set(
-						filteredItems
-							?.filter((x) => x.script_path)
-							.map((x) => x.script_path.split('/').slice(0, 2).join('/')) ?? []
-					)
-				).sort()
-	)
-
-	run(() => {
-		items = filter !== '' ? filteredItems : preFilteredItems
-	})
-
-	function updateQueryFilters(selectedFilterKind, filterUserFolders) {
-		setQuery(
-			TRIGGER_PATH_KIND_FILTER_SETTING,
-			selectedFilterKind,
-			window.location.hash || undefined
-		).then(() => {
-			setQuery(
-				FILTER_USER_FOLDER_SETTING_NAME,
-				String(filterUserFolders),
-				window.location.hash || undefined
-			)
-		})
-	}
-
-	function loadQueryFilters() {
-		let url = new URL(window.location.href)
-		let queryFilterKind = url.searchParams.get(TRIGGER_PATH_KIND_FILTER_SETTING)
-		let queryFilterUserFolders = url.searchParams.get(FILTER_USER_FOLDER_SETTING_NAME)
-		if (queryFilterKind) {
-			selectedFilterKind = queryFilterKind as 'trigger' | 'script_flow'
-		}
-		if (queryFilterUserFolders) {
-			filterUserFolders = queryFilterUserFolders == 'true'
-		}
-	}
-
-	async function onToggleMode(path: string, mode: TriggerMode): Promise<void> {
-		try {
-			// HTTP routes are always workspace-prefixed at runtime, so fork
-			// and parent live at distinct URLs — no fork-conflict warning.
-			await HttpTriggerService.setHttpTriggerMode({
-				path,
-				workspace: $workspaceStore!,
-				requestBody: { mode }
-			})
-		} catch (err) {
-			sendUserToast(
-				`Cannot ` +
-					(mode === 'enabled' ? 'enable' : mode === 'disabled' ? 'disable' : 'suspend') +
-					` http trigger: ${err.body}`,
-				true
-			)
-		} finally {
-			loadTriggers()
-		}
-	}
-
-	onMount(() => {
-		loadQueryFilters()
-	})
-
-	run(() => {
-		updateQueryFilters(selectedFilterKind, filterUserFolders)
-	})
+	import TriggerList from '$lib/components/triggers/TriggerList.svelte'
 </script>
 
-<DeployWorkspaceDrawer bind:this={deploymentDrawer} />
-<RouteEditor onUpdate={loadTriggers} bind:this={routeEditor} />
-
-<RoutesGenerator closeFn={loadTriggers} bind:this={routesGenerator} />
-<OpenApiSpecGenerator bind:this={openAPISpecGenerator} />
-
-<SearchItems
-	{filter}
-	items={preFilteredItems}
-	bind:filteredItems
-	f={(x) => (x.summary ?? '') + ' ' + x.path + ' (' + x.script_path + ')'}
-/>
-
-{#if $userStore?.operator && $workspaceStore && !$userWorkspaces.find((_) => _.id === $workspaceStore)?.operator_settings?.triggers}
-	<div class="bg-red-100 border-l-4 border-red-600 text-orange-700 p-4 m-4 mt-12" role="alert">
-		<p class="font-bold">Unauthorized</p>
-		<p>Page not available for operators</p>
-	</div>
-{:else}
-	<CenteredPage>
-		<PageHeader
-			title="Custom HTTP routes"
-			tooltip="Every script and flow already has a canonical HTTP API endpoint/webhook attached to it, this is to create additional parametrizable ones."
-			documentationLink="https://www.windmill.dev/docs/core_concepts/http_routing"
-		>
-			<div class="flex flex-row gap-2">
-				<Button
-					unifiedSize="md"
-					variant="default"
-					startIcon={{ icon: Plus }}
-					on:click={() => {
-						routesGenerator?.openDrawer()
-					}}
-				>
-					From OpenAPI spec
-				</Button>
-				<Button
-					unifiedSize="md"
-					variant="default"
-					startIcon={{ icon: Plus }}
-					on:click={() => {
-						openAPISpecGenerator?.openDrawer()
-					}}
-				>
-					To OpenAPI spec
-				</Button>
-				<Button
-					unifiedSize="md"
-					variant="accent"
-					startIcon={{ icon: Plus }}
-					on:click={() => routeEditor?.openNew(false)}
-				>
-					New&nbsp;route
-				</Button>
-			</div>
-		</PageHeader>
-		<div class="w-full h-full flex flex-col">
-			<div class="w-full pb-4 pt-6">
-				<input type="text" placeholder="Search routes" bind:value={filter} class="search-item" />
-				<div class="flex flex-row items-center gap-2 mt-2">
-					<div class="text-xs font-semibold text-emphasis shrink-0"> Filter by path of </div>
-					<ToggleButtonGroup bind:selected={selectedFilterKind}>
-						{#snippet children({ item })}
-							<ToggleButton value="trigger" label="Route" icon={Route} {item} />
-							<ToggleButton value="script_flow" label="Script/Flow" icon={Code} {item} />
-						{/snippet}
-					</ToggleButtonGroup>
-				</div>
-				<ListFilters syncQuery bind:selectedFilter={ownerFilter} filters={owners} />
-
-				<div class="flex flex-row items-center justify-end gap-4">
-					{#if $userStore?.is_super_admin && $userStore.username.includes('@')}
-						<Toggle size="xs" bind:checked={filterUserFolders} options={{ right: 'Only f/*' }} />
-					{:else if $userStore?.is_admin || $userStore?.is_super_admin}
-						<Toggle
-							size="xs"
-							bind:checked={filterUserFolders}
-							options={{ right: `Only u/${$userStore.username} and f/*` }}
-						/>
-					{/if}
-				</div>
-			</div>
-			{#if loading}
-				{#each new Array(6) as _}
-					<Skeleton layout={[[6], 0.4]} />
-				{/each}
-			{:else if !triggers?.length}
-				<EmptyState
-					icon={Route}
-					title="No custom HTTP routes yet"
-					description="Every script and flow already has a canonical HTTP endpoint attached to it. These are additional parametrizable ones."
-					action={{
-						label: 'Add a route',
-						icon: Plus,
-						onClick: () => routeEditor?.openNew(false),
-						aiId: 'routes-empty-add',
-						aiDescription: 'Add route'
-					}}
-				/>
-			{:else if items?.length}
-				<div class="border rounded-md divide-y">
-					{#each items.slice(0, nbDisplayed) as { summary, workspace_id, workspaced_route, mode, path, edited_by, edited_at, script_path, route_path, is_flow, extra_perms, canWrite, marked, http_method, static_asset_config, retry, error_handler_path, error_handler_args, draft_only, is_draft } (path)}
-						{@const hasDraft = getLocalDraftHint($workspaceStore, 'trigger_http', path) ?? is_draft}
-						{@const effectiveMode = draft_only ? 'disabled' : mode}
-						{@const href = `${is_flow ? '/flows/get' : '/scripts/get'}/${script_path}`}
-
-						<div
-							class="bg-surface-tertiary hover:bg-surface-hover w-full items-center px-4 py-2 gap-4 first-of-type:!border-t-0
-				first-of-type:rounded-t-md last-of-type:rounded-b-md flex flex-col"
-						>
-							<div class="w-full flex gap-4 items-center">
-								<RowIcon kind={is_flow ? 'flow' : 'script'} />
-
-								<a
-									href="#{path}"
-									onclick={() => routeEditor?.openEdit(path, is_flow)}
-									class="min-w-0 grow hover:underline decoration-gray-400"
-								>
-									<div
-										class="text-emphasis font-semibold flex-wrap text-left text-xs mb-1 truncate"
-									>
-										{#if marked}
-											<span class="text-xs">
-												{@html marked}
-											</span>
-										{:else if summary}
-											{summary}
-										{:else}
-											{http_method.toUpperCase()}
-											/{isCloudHosted() || workspaced_route || globalHttpWorkspacedRoute
-												? workspace_id + '/' + route_path
-												: route_path}
-										{/if}{hasDraft ? '*' : ''}
-									</div>
-									<div class="text-secondary text-xs truncate text-left font-normal">
-										{path}
-									</div>
-									<div class="text-secondary text-xs truncate text-left font-normal">
-										{#if static_asset_config}
-											file: {static_asset_config.s3}
-										{:else}
-											runnable: {script_path}
-										{/if}
-									</div>
-								</a>
-
-								<div class="hidden lg:flex flex-row gap-1 items-center">
-									<SharedBadge {canWrite} extraPerms={extra_perms} />
-								</div>
-
-								<div class="flex items-center justify-end gap-2 shrink-0 min-w-[8rem]">
-									<DraftBadge {draft_only} is_draft={hasDraft} />
-									<TriggerModeToggle
-										disabled={draft_only}
-										title={draft_only
-											? 'Draft only: deploy the trigger to enable it'
-											: hasDraft
-												? 'Enables/disables the deployed trigger; the draft is not affected'
-												: undefined}
-										onToggleMode={(mode) => onToggleMode(path, mode)}
-										triggerMode={effectiveMode}
-										includeModalConfig={{
-											triggerPath: path,
-											triggerKind: 'http',
-											runnableConfig: {
-												path: script_path,
-												kind: is_flow ? 'flow' : 'script',
-												retry,
-												errorHandlerPath: error_handler_path,
-												errorHandlerArgs: error_handler_args
-											}
-										}}
-										{canWrite}
-										hideToggleLabels
-										hideDropdown
-									/>
-								</div>
-
-								<div class="flex gap-2 items-center justify-end">
-									<Button
-										on:click={() =>
-											copyToClipboard(
-												getHttpRoute(
-													'r',
-													route_path,
-													(workspaced_route ?? false) || globalHttpWorkspacedRoute,
-													workspace_id
-												)
-											)}
-										variant="subtle"
-										unifiedSize="md"
-										startIcon={{ icon: ClipboardCopy }}
-									>
-										Copy URL
-									</Button>
-									<Button
-										on:click={() => routeEditor?.openEdit(path, is_flow)}
-										unifiedSize="md"
-										startIcon={canWrite
-											? { icon: Pen }
-											: {
-													icon: Eye
-												}}
-										variant="subtle"
-									>
-										{canWrite ? 'Edit' : 'View'}
-									</Button>
-									<Dropdown
-										size="md"
-										items={[
-											{
-												displayName: `View ${is_flow ? 'Flow' : 'Script'}`,
-												icon: Eye,
-												action: () => {
-													goto(href)
-												}
-											},
-											...(canWrite && !draft_only && mode !== 'suspended'
-												? [
-														{
-															displayName: 'Suspend job execution',
-															icon: Pause,
-															action: () => {
-																onToggleMode(path, 'suspended')
-															}
-														}
-													]
-												: []),
-											{
-												displayName: canWrite ? 'Edit' : 'View',
-												icon: canWrite ? Pen : Eye,
-												action: () => {
-													routeEditor?.openEdit(path, is_flow)
-												}
-											},
-											...(isDeployable('trigger', path, deployUiSettings)
-												? [
-														{
-															displayName: 'Deploy to prod/staging',
-															icon: FileUp,
-															action: () => {
-																deploymentDrawer?.openDrawer(path, 'trigger', {
-																	triggers: {
-																		kind: 'routes'
-																	}
-																})
-															}
-														}
-													]
-												: []),
-											{
-												displayName: 'Audit logs',
-												icon: Eye,
-												href: `${base}/audit_logs?resource=${path}`
-											},
-											{
-												displayName: 'Permissions',
-												icon: Shield,
-												action: () => {
-													shareModal?.openDrawer(path, 'http_trigger')
-												}
-											},
-											{
-												displayName: 'Delete',
-												type: 'delete',
-												icon: Trash,
-												disabled: !canWrite,
-												action: async () => {
-													try {
-														await HttpTriggerService.deleteHttpTrigger({
-															workspace: $workspaceStore ?? '',
-															path
-														})
-														sendUserToast(`Successfully deleted HTTP route: ${path}`)
-														loadTriggers()
-													} catch (error) {
-														sendUserToast(error.body || error.message, true)
-													}
-												}
-											}
-										]}
-									/>
-								</div>
-							</div>
-							<div class="w-full flex justify-end items-baseline">
-								<div
-									class="flex flex-wrap text-2xs font-normal text-secondary gap-1 items-center justify-end truncate pr-2"
-								>
-									{#if edited_by}<div class="truncate">edited by {edited_by}</div>{/if}
-									<div class="truncate">{edited_by ? 'at ' : ''}{displayDate(edited_at)}</div>
-								</div>
-							</div>
-						</div>
-					{/each}
-				</div>
-			{:else}
-				<NoItemFound />
-			{/if}
-		</div>
-		{#if items && items?.length > 15 && nbDisplayed < items.length}
-			<span class="text-xs font-normal text-primary"
-				>{nbDisplayed} items out of {items.length}
-				<button class="ml-4 font-semibold text-emphasis" onclick={() => (nbDisplayed += 30)}
-					>load 30 more</button
-				></span
-			>
-		{/if}
-	</CenteredPage>
-{/if}
-
-<ShareModal
-	bind:this={shareModal}
-	on:change={() => {
-		loadTriggers()
-	}}
-/>
+<TriggerList triggerKind="http" />
diff --git a/frontend/src/routes/(root)/(logged)/run/[...run]/+page.svelte b/frontend/src/routes/(root)/(logged)/run/[...run]/+page.svelte
index 6e78801b8b..5fc7c1209d 100644
--- a/frontend/src/routes/(root)/(logged)/run/[...run]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/run/[...run]/+page.svelte
@@ -40,8 +40,10 @@
 		EllipsisVertical,
 		Share2,
 		Globe,
-		Users
+		Users,
+		Play
 	} from 'lucide-svelte'
+	import { forLater } from '$lib/forLater'
 
 	import { isJobResolvable } from '$lib/utils'
 	import {
@@ -152,12 +154,41 @@
 		string,
 		{ modules: import('$lib/gen').FlowModule[]; groups?: any[] }
 	> = $state({})
-	const restart = useNestedRestartState({
+	const selectedRestart = useNestedRestartState({
 		selectedJobStep: () => selectedJobStep,
 		job: () => job,
 		graphModuleStates: () => graphModuleStates,
 		expandedSubflows: () => expandedSubflows
 	})
+	// When the selection can't be restarted from (nothing clicked, Input/Result,
+	// a step inside a parallel loop), the button targets the top-level step that
+	// failed the run, so it is visible without hunting for it in a large graph.
+	// A continue-on-error step keeps its `Failure` status on a run that succeeds,
+	// so only a failed run counts, and its last `Failure` is the one that ended it.
+	const failedTopLevelStep = $derived.by(() => {
+		if (job?.type !== 'CompletedJob' || job.success !== false || job.canceled) return undefined
+		const failures = job.flow_status?.modules?.filter((m) => m.type === 'Failure') ?? []
+		return failures[failures.length - 1]?.id
+	})
+	const failedRestart = useNestedRestartState({
+		selectedJobStep: () => failedTopLevelStep,
+		job: () => job,
+		graphModuleStates: () => graphModuleStates,
+		expandedSubflows: () => expandedSubflows
+	})
+	const selectionRestartable = $derived(
+		selectedJobStep !== undefined &&
+			(selectedRestart.topLevelRestartable || selectedRestart.nestedRestartSupported)
+	)
+	const restartStep = $derived(selectionRestartable ? selectedJobStep : failedTopLevelStep)
+	const restart = $derived(selectionRestartable ? selectedRestart : failedRestart)
+	function canRestart(state: ReturnType<typeof useNestedRestartState>) {
+		return (
+			job?.type === 'CompletedJob' &&
+			job.job_kind === 'flow' &&
+			(state.topLevelRestartable || state.nestedRestartSupported)
+		)
+	}
 
 	let testIsLoading = $state(false)
 	let jobLoader: JobLoader | undefined = $state(undefined)
@@ -251,6 +282,27 @@
 		}
 	}
 
+	// A schedule's upcoming tick sits on a whole second and the backend refuses it; a tick
+	// deferred by a concurrency limit lands on a sub-second instant and can still start now.
+	let canRunNow = $derived(
+		job?.type === 'QueuedJob' &&
+			!job.running &&
+			!job.suspend &&
+			!!job.scheduled_for &&
+			forLater(job.scheduled_for) &&
+			!(job.schedule_path && new Date(job.scheduled_for).getMilliseconds() === 0)
+	)
+
+	async function runJobNow(id: string) {
+		try {
+			await JobService.runQueuedJobNow({ workspace: $workspaceStore!, id })
+			sendUserToast(`job ${id} will start as soon as a worker is available`)
+			getJob()
+		} catch (err) {
+			sendUserToast(`could not start job now: ${err?.body ?? err}`, true)
+		}
+	}
+
 	// Initialize view tab to logs since result is now outside tabs
 	function initView(): void {
 		// Result is now displayed outside tabs, so always default to logs
@@ -643,6 +695,36 @@
 	/>
 {/if}
 
+{#snippet flowRestartButton(
+	state: ReturnType<typeof useNestedRestartState>,
+	step: string,
+	triggerStyle: 'button' | 'link'
+)}
+	{#if job}
+		<FlowRestartButton
+			jobId={job.id}
+			selectedJobStep={step}
+			selectedJobStepType={state.selectedJobStepType}
+			restartBranchNames={state.restartBranchNames}
+			nestedPath={state.nestedRestartSupported ? state.nestedRestartPath : undefined}
+			nestedTopStepId={state.nestedRestartTopStepId}
+			nestedTopBranchOrIterationN={state.nestedRestartTopBranchOrIterationN}
+			presetIterationN={state.topLevelLoopIteration}
+			iterationCounts={state.iterationCounts}
+			nestedPathIterationCounts={state.nestedPathIterationCounts}
+			onRestartComplete={(newJobId) => {
+				goto('/run/' + newJobId + '?workspace=' + $workspaceStore)
+			}}
+			flowPath={job.script_path}
+			flowVersionId={job.script_hash ? parseInt(job.script_hash, 16) : undefined}
+			disabled={!$enterpriseLicense}
+			enterpriseOnly={!$enterpriseLicense}
+			{triggerStyle}
+			unifiedSize="sm"
+		/>
+	{/if}
+{/snippet}
+
 <Portal name="persistent-run">
 	<PersistentScriptDrawer bind:this={persistentScriptDrawer} />
 </Portal>
@@ -738,13 +820,13 @@
 						<Button
 							nonCaptureEvent
 							variant="default"
-							unifiedSize="md"
+							unifiedSize="sm"
 							startIcon={{ icon: Trash }}
 						/>
 					{/snippet}
 				</Dropdown>
 				{#if job?.job_kind === 'script' || job?.job_kind === 'flow'}
-					<Button href={runsHref} variant="default" unifiedSize="md" startIcon={{ icon: List }}>
+					<Button href={runsHref} variant="default" unifiedSize="sm" startIcon={{ icon: List }}>
 						View runs
 					</Button>
 				{/if}
@@ -772,7 +854,7 @@
 					]}
 				>
 					{#snippet buttonReplacement()}
-						<Button nonCaptureEvent variant="default" unifiedSize="md" startIcon={{ icon: Share2 }}>
+						<Button nonCaptureEvent variant="default" unifiedSize="sm" startIcon={{ icon: Share2 }}>
 							Share
 						</Button>
 					{/snippet}
@@ -794,7 +876,7 @@
 						class="h-auto"
 					>
 						{#snippet buttonReplacement()}
-							<Button nonCaptureEvent unifiedSize="md" variant="subtle">
+							<Button nonCaptureEvent unifiedSize="sm" variant="subtle">
 								<div class="flex flex-row items-center">
 									<EllipsisVertical size={14} />
 								</div>
@@ -805,7 +887,7 @@
 			{/if}
 			{#if isFlowPreview(job?.job_kind) || isScriptPreview(job?.job_kind)}
 				<Button
-					unifiedSize="md"
+					unifiedSize="sm"
 					variant="default"
 					startIcon={{ icon: GitBranch }}
 					on:click={forkPreview}
@@ -817,7 +899,7 @@
 			{/if}
 			{#if persistentScriptDefinition !== undefined}
 				<Button
-					unifiedSize="md"
+					unifiedSize="sm"
 					variant="default"
 					startIcon={{ icon: Activity }}
 					on:click={() => {
@@ -827,10 +909,21 @@
 					Current runs
 				</Button>
 			{/if}
+			{#if canRunNow}
+				<Button
+					unifiedSize="md"
+					variant="default"
+					startIcon={{ icon: Play }}
+					on:click={() => job?.id && runJobNow(job.id)}
+					title="Start this job now instead of at its scheduled time, skipping any remaining delay or sleep. It keeps the same id, and a concurrency limit is still enforced."
+				>
+					Run now
+				</Button>
+			{/if}
 			{#if job && job?.type != 'CompletedJob' && (!job?.schedule_path || job?.['running'] == true)}
 				{#if !forceCancel}
 					<Button
-						unifiedSize="md"
+						unifiedSize="sm"
 						variant="accent"
 						destructive
 						startIcon={{ icon: TimerOff }}
@@ -848,7 +941,7 @@
 					</Button>
 				{:else}
 					<Button
-						unifiedSize="md"
+						unifiedSize="sm"
 						variant="accent"
 						destructive
 						startIcon={{ icon: TimerOff }}
@@ -864,7 +957,7 @@
 			{/if}
 			{#if job?.schedule_path}
 				<Button
-					unifiedSize="md"
+					unifiedSize="sm"
 					variant="default"
 					on:click={() => {
 						if (!job || !job.schedule_path) {
@@ -875,26 +968,8 @@
 					startIcon={{ icon: Calendar }}>Edit schedule</Button
 				>
 			{/if}
-			{#if job?.type === 'CompletedJob' && job?.job_kind === 'flow' && selectedJobStep !== undefined && (restart.topLevelRestartable || restart.nestedRestartSupported) && job.id}
-				<FlowRestartButton
-					jobId={job.id}
-					{selectedJobStep}
-					selectedJobStepType={restart.selectedJobStepType}
-					restartBranchNames={restart.restartBranchNames}
-					nestedPath={restart.nestedRestartSupported ? restart.nestedRestartPath : undefined}
-					nestedTopStepId={restart.nestedRestartTopStepId}
-					nestedTopBranchOrIterationN={restart.nestedRestartTopBranchOrIterationN}
-					presetIterationN={restart.topLevelLoopIteration}
-					iterationCounts={restart.iterationCounts}
-					nestedPathIterationCounts={restart.nestedPathIterationCounts}
-					onRestartComplete={(newJobId) => {
-						goto('/run/' + newJobId + '?workspace=' + $workspaceStore)
-					}}
-					flowPath={job.script_path}
-					flowVersionId={job.script_hash ? parseInt(job.script_hash, 16) : undefined}
-					disabled={!$enterpriseLicense}
-					enterpriseOnly={!$enterpriseLicense}
-				/>
+			{#if restartStep !== undefined && canRestart(restart)}
+				{@render flowRestartButton(restart, restartStep, 'button')}
 			{/if}
 			{#if job?.job_kind === 'script' || job?.job_kind === 'script_hub' || job?.job_kind === 'flow'}
 				<Button
@@ -909,7 +984,7 @@
 								`#${computeSharableHash(job?.args, await getRerunTagOverride(job?.args))}`
 						)
 					}}
-					unifiedSize="md"
+					unifiedSize="sm"
 					variant="default"
 					startIcon={{ icon: RefreshCw }}
 					loading={runImmediatelyLoading}
@@ -936,10 +1011,9 @@
 							on:click={() => {
 								$initialArgsStore = job?.args
 							}}
-							unifiedSize="md"
+							unifiedSize="sm"
 							variant="default"
 							disabled={!showEditButton}
-							size="sm"
 							startIcon={{ icon: Pen }}>Edit</Button
 						>
 						{#if showEditButton}
@@ -951,7 +1025,7 @@
 									target: { kind: isScript ? 'script' : 'flow', path: job?.script_path ?? '' },
 									workspaceId: $workspaceStore ?? undefined
 								}}
-								btnProps={{ unifiedSize: 'md' }}
+								btnProps={{ unifiedSize: 'sm' }}
 							/>
 						{/if}
 					{/if}
@@ -962,9 +1036,8 @@
 								onEditInForkClick(e, isScript ? 'script' : 'flow', job?.script_path ?? '', {
 									hasHref: true
 								})}
-							unifiedSize="md"
+							unifiedSize="sm"
 							variant="default"
-							size="sm"
 							startIcon={{ icon: Pen }}>{editInForkLabel($workspaceStore, $userWorkspaces)}</Button
 						>
 					{/if}
@@ -973,7 +1046,7 @@
 			{#if job?.job_kind === 'script' || job?.job_kind === 'script_hub' || job?.job_kind === 'flow'}
 				<Button
 					href={viewHref}
-					unifiedSize="md"
+					unifiedSize="sm"
 					variant="accent"
 					startIcon={{
 						icon:
@@ -1024,7 +1097,18 @@
 					textPosition="bottom"
 					slim
 					showStepId
-				/>
+				>
+					{#snippet errorAction()}
+						{#if failedTopLevelStep}
+							<span>at step {failedTopLevelStep}</span>
+							{#if $enterpriseLicense && canRestart(failedRestart)}
+								<span>·</span>
+								{@render flowRestartButton(failedRestart, failedTopLevelStep, 'link')}
+								<span>on this flow version, or on a new one after you fix it</span>
+							{/if}
+						{/if}
+					{/snippet}
+				</FlowProgressBar>
 				{#if suspendStatus}
 					<FlowExecutionStatus
 						{job}
diff --git a/frontend/src/routes/(root)/(logged)/schedules/+page.svelte b/frontend/src/routes/(root)/(logged)/schedules/+page.svelte
index e403c981de..88b21bc34c 100644
--- a/frontend/src/routes/(root)/(logged)/schedules/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/schedules/+page.svelte
@@ -1,683 +1,5 @@
 <script lang="ts">
-	import { getLocalDraftHint } from '$lib/localDraftHints.svelte'
-	import {
-		ScheduleService,
-		type ScheduleWJobs,
-		type WorkspaceDeployUISettings,
-		WorkspaceService
-	} from '$lib/gen'
-	import { canWrite, displayDate, getLocalSetting, storeLocalSetting } from '$lib/utils'
-	import { withForkConflictRetry } from '$lib/utils/forkConflict'
-	import { base } from '$app/paths'
-	import CenteredPage from '$lib/components/CenteredPage.svelte'
-	import { Badge, Button, EmptyState, Skeleton } from '$lib/components/common'
-	import Dropdown from '$lib/components/DropdownV2.svelte'
-	import PageHeader from '$lib/components/PageHeader.svelte'
-	import Popover from '$lib/components/Popover.svelte'
-	import SharedBadge from '$lib/components/SharedBadge.svelte'
-	import DraftBadge from '$lib/components/DraftBadge.svelte'
-	import InheritedLabels from '$lib/components/InheritedLabels.svelte'
-	import ShareModal from '$lib/components/ShareModal.svelte'
-	import Toggle from '$lib/components/Toggle.svelte'
-	import { userStore, workspaceStore, userWorkspaces, enterpriseLicense } from '$lib/stores'
-	import {
-		Calendar,
-		Circle,
-		Copy,
-		Eye,
-		FileUp,
-		List,
-		Loader2,
-		Pen,
-		Play,
-		Plus,
-		SearchX,
-		Shield,
-		Trash
-	} from 'lucide-svelte'
-	import { goto } from '$lib/navigation'
-	import { sendUserToast } from '$lib/toast'
-	import FilterSearchbar, {
-		hasActiveFilters,
-		useUrlSyncedFilterInstance
-	} from '$lib/components/FilterSearchbar.svelte'
-	import { buildSchedulesFilterSchema } from '$lib/components/schedules/schedulesFilter'
-	import NoItemFound from '$lib/components/home/NoItemFound.svelte'
-	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
-	import JobPreview from '$lib/components/jobs/JobPreview.svelte'
-	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
-	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
-	import { untrack } from 'svelte'
-	import { page } from '$app/stores'
-	import DeployWorkspaceDrawer from '$lib/components/DeployWorkspaceDrawer.svelte'
-	import { ALL_DEPLOYABLE, isDeployable } from '$lib/utils_deployable'
-	import { runScheduleNow } from '$lib/components/triggers/scheduled/utils'
-	import ScheduleEditor from '$lib/components/triggers/schedules/ScheduleEditor.svelte'
-
-	type ScheduleW = ScheduleWJobs & { canWrite: boolean }
-
-	let schedules: ScheduleW[] = $state([])
-	let shareModal: ShareModal | undefined = $state()
-	let loading = $state(true)
-	let loadingSchedulesWithJobStats = $state(true)
-	let deploymentDrawer: DeployWorkspaceDrawer | undefined = $state()
-	let deployUiSettings: WorkspaceDeployUISettings | undefined = $state(undefined)
-
-	async function getDeployUiSettings() {
-		if (!$enterpriseLicense) {
-			deployUiSettings = ALL_DEPLOYABLE
-			return
-		}
-		let settings = await WorkspaceService.getPublicSettings({ workspace: $workspaceStore! })
-		deployUiSettings = settings.deploy_ui ?? ALL_DEPLOYABLE
-	}
-	getDeployUiSettings()
-	async function loadSchedules(): Promise<void> {
-		const currentFilters = filters.val
-
-		// Build API parameters from filters.
-		// `includeDraftOnly` surfaces per-user drafts at paths that have
-		// no deployed schedule — appended server-side when no narrowing
-		// filter is set, so the user sees AI-agent-created drafts on
-		// the home page.
-		const apiParams: any = {
-			workspace: $workspaceStore!,
-			includeDraftOnly: true
-		}
-
-		if (currentFilters.schedule_path) {
-			apiParams.schedulePath = currentFilters.schedule_path
-		}
-		if (currentFilters.path_start) {
-			apiParams.pathStart = currentFilters.path_start
-		}
-		if (currentFilters.path) {
-			apiParams.path = currentFilters.path
-		}
-		if (currentFilters.description) {
-			apiParams.description = currentFilters.description
-		}
-		if (currentFilters.summary) {
-			apiParams.summary = currentFilters.summary
-		}
-		if (currentFilters.args) {
-			apiParams.args = currentFilters.args
-		}
-		if (currentFilters._default_) {
-			apiParams.broadFilter = currentFilters._default_
-		}
-		if (currentFilters.label) {
-			apiParams.label = currentFilters.label
-		}
-
-		const result = (await ScheduleService.listSchedules(apiParams)).map((x) => {
-			return { canWrite: canWrite(x.path, x.extra_perms!, $userStore), ...x }
-		})
-
-		// Extract unique values for autocomplete
-		allPaths = Array.from(new Set(result.map((x) => x.path))).sort()
-		allScriptPaths = Array.from(new Set(result.map((x) => x.script_path))).sort()
-		allLabels = Array.from(
-			new Set(result.flatMap((x) => [...(x.labels ?? []), ...(x.inherited_labels ?? [])]))
-		).sort()
-
-		schedules = result
-		loading = false
-		// after the schedule core data has been loaded, load all the job stats
-		// TODO: we could potentially not reload the job stats on every call to loadSchedules, but for now it's
-		// simpler to always call it. Update if performance becomes an issue.
-		loadSchedulesWithJobStats()
-	}
-
-	// Reload schedules when filters change
-	$effect(() => {
-		filters.val
-		if ($workspaceStore) {
-			untrack(() => loadSchedules())
-		}
-	})
-
-	async function loadSchedulesWithJobStats(): Promise<void> {
-		loadingSchedulesWithJobStats = true
-		let schedulesWithJobsByPath = new Map<string, ScheduleW>()
-		let schedulesWithJobsList = await ScheduleService.listSchedulesWithJobs({
-			workspace: $workspaceStore!
-		})
-		schedulesWithJobsList.map((x) => {
-			schedulesWithJobsByPath[x.path] = x
-		})
-		for (let schedule of schedules) {
-			if (schedulesWithJobsByPath[schedule.path]) {
-				schedule.jobs = schedulesWithJobsByPath[schedule.path].jobs
-			}
-		}
-		loadingSchedulesWithJobStats = false
-	}
-
-	// Per-path counter bumped when a schedule toggle is cancelled or errors,
-	// to force-remount that row's <Toggle>. Toggle uses `bind:checked` on
-	// its native input; once the user clicks, the local checkbox state
-	// diverges from the parent's prop expression, and Svelte 5 prop
-	// reactivity won't push a same-valued prop back down. Re-mounting
-	// re-initializes from the prop. List-page rows don't optimistically
-	// flip `enabled`, so they need this nudge — but only the affected row,
-	// not all rows on the page.
-	let toggleResetVersions = $state<Record<string, number>>({})
-	function bumpToggleReset(path: string) {
-		toggleResetVersions[path] = (toggleResetVersions[path] ?? 0) + 1
-	}
-
-	async function setScheduleEnabled(path: string, enabled: boolean): Promise<void> {
-		try {
-			const ok = await withForkConflictRetry(
-				(force) =>
-					ScheduleService.setScheduleEnabled({
-						path,
-						workspace: $workspaceStore!,
-						requestBody: { enabled, force }
-					}),
-				'schedule'
-			)
-			if (ok) {
-				loadSchedules()
-			} else {
-				// Cancelled — nothing changed on the server, skip the reload
-				// (which would re-fetch job stats and flash the loading flag)
-				// and just nudge the toggle back to the prop value.
-				bumpToggleReset(path)
-			}
-		} catch (err) {
-			sendUserToast(`Cannot ` + (enabled ? 'enable' : 'disable') + ` schedule: ${err.body}`, true)
-			bumpToggleReset(path)
-			loadSchedules()
-		}
-	}
-
-	$effect(() => {
-		if ($workspaceStore && $userStore) {
-			untrack(() => {
-				loadSchedules()
-			})
-		}
-	})
-	let scheduleEditor: ScheduleEditor | undefined = $state()
-
-	// Deep link: #<path> opens that schedule's edit drawer. Tracks the last
-	// handled hash (not a one-shot flag) so a hash change on the already-mounted
-	// page (e.g. the AI session preview re-pointing its tab) opens the drawer
-	// too. Row links pre-set handledHash: their onclick already opens the drawer.
-	let handledHash = ''
-	$effect(() => {
-		const hash = $page.url.hash
-		if (hash.length <= 1) {
-			// Navigating away from a drawer target must clear the tracker, or
-			// re-targeting the same schedule later would be skipped as already handled.
-			handledHash = ''
-			return
-		}
-		if (hash === handledHash || schedules.length === 0 || !scheduleEditor) return
-		const path = hash.slice(1)
-		const schedule = schedules.find((s) => s.path === path)
-		if (schedule) {
-			handledHash = hash
-			scheduleEditor.openEdit(path, schedule.is_flow)
-		}
-	})
-
-	// Collect unique values for filter autocomplete
-	let allPaths: string[] = $state([])
-	let allScriptPaths: string[] = $state([])
-	let allLabels: string[] = $state([])
-
-	// FilterSearchbar setup
-	let userFoldersFilterType = $derived(
-		$userStore?.is_super_admin && $userStore.username.includes('@')
-			? 'only f/*'
-			: $userStore?.is_admin || $userStore?.is_super_admin
-				? 'u/username and f/*'
-				: undefined
-	)
-	let schedulesFilterSchema = $derived(
-		buildSchedulesFilterSchema({
-			paths: allPaths,
-			scriptPaths: allScriptPaths,
-			labels: allLabels,
-			showUserFoldersFilter: userFoldersFilterType !== undefined,
-			userFoldersLabel:
-				userFoldersFilterType === 'only f/*' ? 'Only f/*' : `Only u/${$userStore?.username} and f/*`
-		})
-	)
-	let filters = useUrlSyncedFilterInstance(untrack(() => schedulesFilterSchema))
-
-	let activeFilters = $derived(hasActiveFilters(filters.val))
-	let allFolders = $derived(
-		Array.from(
-			new Set(
-				(schedules ?? [])
-					.map((x) => x.path.split('/').slice(0, 2).join('/'))
-					.filter((x) => x.startsWith('f/'))
-			)
-		)
-			.sort()
-			.map((f) => f.replace(/^f\//, ''))
-	)
-	let presets = $derived([
-		...allFolders.map((f) => ({ name: `f/${f}`, value: `path_start:\\ f/${f}/` })),
-		...allLabels.map((l) => ({ name: l, value: `label:\\ ${l}` })),
-		...(schedulesFilterSchema.user_folders_only
-			? [
-					{
-						name: schedulesFilterSchema.user_folders_only.label ?? '?',
-						value: 'user_folders_only:\\ true'
-					}
-				]
-			: [])
-	])
-
-	let nbDisplayed = $state(15)
-	let filterEnabledDisabled: 'all' | 'enabled' | 'disabled' = $state('all')
-
-	const SCHEDULE_PATH_KIND_FILTER_SETTING = 'schedulePathKindFilter'
-	let selectedFilterKind = $state(
-		(getLocalSetting(SCHEDULE_PATH_KIND_FILTER_SETTING) as 'schedule' | 'script_flow') ?? 'schedule'
-	)
-
-	$effect(() => {
-		storeLocalSetting(SCHEDULE_PATH_KIND_FILTER_SETTING, selectedFilterKind)
-	})
-
-	function filterItemsPathsBaseOnUserFilters(
-		item: ScheduleW,
-		selectedFilterKind: 'schedule' | 'script_flow',
-		userFoldersOnly: boolean
-	) {
-		if (userFoldersOnly) {
-			if (selectedFilterKind === 'schedule') {
-				return (
-					!item.path.startsWith('u/') || item.path.startsWith('u/' + $userStore?.username + '/')
-				)
-			} else {
-				return (
-					!item.script_path.startsWith('u/') ||
-					item.script_path.startsWith('u/' + $userStore?.username + '/')
-				)
-			}
-		} else {
-			return true
-		}
-	}
-
-	function filterItemsBasedOnEnabledDisabled(
-		item: ScheduleW,
-		filterEnabledDisabled: 'all' | 'enabled' | 'disabled'
-	) {
-		// Draft-only rows have nothing deployed, so they read as disabled here
-		// too — matching the off, disabled toggle the row renders.
-		const enabled = !item.draft_only && item.enabled
-		if (filterEnabledDisabled === 'all') return true
-		if (filterEnabledDisabled === 'enabled') return enabled
-		if (filterEnabledDisabled === 'disabled') return !enabled
-	}
-
-	// Filter schedules client-side for enabled/disabled and user folders
-	let filteredItems = $derived.by(() => {
-		return schedules?.filter(
-			(x) =>
-				filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, !!filters.val.user_folders_only) &&
-				filterItemsBasedOnEnabledDisabled(x, filterEnabledDisabled)
-		)
-	})
-
-	let items = $derived(filteredItems)
+	import SchedulesList from '$lib/components/schedules/SchedulesList.svelte'
 </script>
 
-<DeployWorkspaceDrawer bind:this={deploymentDrawer} />
-<ScheduleEditor onUpdate={loadSchedules} bind:this={scheduleEditor} />
-
-{#if $userStore?.operator && $workspaceStore && !$userWorkspaces.find((_) => _.id === $workspaceStore)?.operator_settings?.schedules}
-	<div class="bg-red-100 border-l-4 border-red-600 text-orange-700 p-4 m-4 mt-12" role="alert">
-		<p class="font-bold">Unauthorized</p>
-		<p>Page not available for operators</p>
-	</div>
-{:else}
-	<CenteredPage>
-		<PageHeader
-			title="Schedules"
-			tooltip="Trigger Scripts and Flows according to a cron schedule"
-			documentationLink="https://www.windmill.dev/docs/core_concepts/scheduling"
-		>
-			<Button
-				size="lg"
-				variant="accent"
-				startIcon={{ icon: Plus }}
-				on:click={() => scheduleEditor?.openNew(false)}
-				aiId="schedules-add-schedule"
-				aiDescription="Add schedule"
-			>
-				New schedule
-			</Button>
-		</PageHeader>
-		<div class="w-full h-full flex flex-col">
-			<div class="flex flex-row items-center justify-end gap-4 pb-4">
-				<ToggleButtonGroup bind:selected={filterEnabledDisabled} class="w-fit">
-					{#snippet children({ item })}
-						<ToggleButton value="all" label="All" {item} />
-						<ToggleButton value="enabled" label="Enabled" {item} />
-						<ToggleButton value="disabled" label="Disabled" {item} />
-					{/snippet}
-				</ToggleButtonGroup>
-				<FilterSearchbar
-					schema={schedulesFilterSchema}
-					bind:value={filters.val}
-					class="grow max-w-[26rem]"
-					{presets}
-				/>
-			</div>
-			{#if loading}
-				{#each new Array(6) as _}
-					<Skeleton layout={[[6], 0.4]} />
-				{/each}
-			{:else if !schedules?.length}
-				{#if activeFilters}
-					<EmptyState
-						icon={SearchX}
-						title="No schedules found"
-						description="No schedule matches the current filters. Try clearing or widening them."
-					/>
-				{:else}
-					<EmptyState
-						icon={Calendar}
-						title="No schedules yet"
-						description="Schedules run a script or flow automatically on a cron expression."
-						action={{
-							label: 'Add a schedule',
-							icon: Plus,
-							onClick: () => scheduleEditor?.openNew(false),
-							aiId: 'schedules-empty-add',
-							aiDescription: 'Add schedule'
-						}}
-					/>
-				{/if}
-			{:else if items?.length}
-				<div class="border rounded-md divide-y">
-					{#each items.slice(0, nbDisplayed) as { path, error, summary, edited_by, edited_at, schedule, timezone, enabled, script_path, is_flow, extra_perms, canWrite, jobs, paused_until, labels, inherited_labels, draft_only, is_draft } (path)}
-						{@const hasDraft =
-							getLocalDraftHint($workspaceStore, 'trigger_schedule', path) ?? is_draft}
-						{@const href = `${is_flow ? '/flows/get' : '/scripts/get'}/${script_path}`}
-						{@const avg_s = jobs
-							? jobs.reduce((acc, x) => acc + x.duration_ms, 0) / jobs.length
-							: undefined}
-
-						<div
-							class="bg-surface-tertiary hover:bg-surface-hover w-full items-center px-4 py-2 gap-4 first-of-type:!border-t-0
-				first-of-type:rounded-t-md last-of-type:rounded-b-md flex flex-col"
-						>
-							<div class="w-full flex gap-4 items-center">
-								<RowIcon kind={is_flow ? 'flow' : 'script'} />
-
-								<a
-									href="#{path}"
-									onclick={() => {
-										handledHash = `#${path}`
-										scheduleEditor?.openEdit(path, is_flow)
-									}}
-									class="min-w-0 grow hover:underline decoration-gray-400"
-								>
-									<div
-										class="text-emphasis flex-wrap text-left text-xs font-semibold mb-1 truncate"
-									>
-										{summary || script_path}{hasDraft ? '*' : ''}
-									</div>
-									<div class="text-secondary text-xs truncate text-left">
-										schedule: {path}
-									</div>
-								</a>
-								{#if labels?.length}
-									{#each labels as label}
-										<Badge
-											color="blue"
-											small
-											class="px-1"
-											title="Label: {label}"
-											clickable
-											onclick={() => {
-												const arr = (filters.val.label ?? '').split(',').filter(Boolean)
-												const idx = arr.indexOf(label)
-												if (idx >= 0) arr.splice(idx, 1)
-												else arr.push(label)
-												const newFilters = { ...filters.val }
-												if (arr.length) newFilters.label = arr.join(',')
-												else delete newFilters.label
-												filters.val = newFilters
-											}}>{label}</Badge
-										>
-									{/each}
-								{/if}
-								<InheritedLabels labels={inherited_labels} />
-
-								{#if paused_until && new Date(paused_until) > new Date()}
-									<div class="pb-1">
-										<Badge color="yellow"
-											>Paused until {new Date(paused_until).toLocaleString()}</Badge
-										>
-									</div>
-								{/if}
-
-								<div class="gap-2 items-center hidden md:flex">
-									<Badge large color="blue">{schedule}</Badge>
-									<Badge small color="gray">{timezone}</Badge>
-								</div>
-
-								<div class="hidden lg:flex flex-row gap-1 items-center">
-									<SharedBadge {canWrite} extraPerms={extra_perms} />
-								</div>
-
-								<div class="w-10">
-									{#if error}
-										<Popover notClickable>
-											<span class="flex h-4 w-4">
-												<Circle
-													class="text-red-600 animate-ping absolute inline-flex fill-current"
-													size={12}
-												/>
-												<Circle class="text-red-600 relative inline-flex fill-current" size={12} />
-											</span>
-											{#snippet text()}
-												<div>
-													The schedule disabled itself because there was an error scheduling the
-													next job: {error}
-												</div>
-											{/snippet}
-										</Popover>
-									{/if}
-								</div>
-
-								<div class="flex items-center justify-end gap-2 shrink-0 min-w-[8rem]">
-									<DraftBadge {draft_only} is_draft={hasDraft} />
-									{#key toggleResetVersions[path] ?? 0}
-										<Toggle
-											disabled={draft_only}
-											options={{
-												title: draft_only
-													? 'Draft only: deploy the schedule to enable it'
-													: hasDraft
-														? 'Enables/disables the deployed schedule; the draft is not affected'
-														: undefined
-											}}
-											checked={!draft_only && enabled}
-											on:change={(e) => {
-												if (canWrite) {
-													setScheduleEnabled(path, e.detail)
-												} else {
-													sendUserToast('not enough permission', true)
-													// Permission denied — bump the row's reset
-													// counter so the Toggle remounts back to the
-													// prop value. Without this, the local
-													// `bind:checked` flip from the user's click
-													// stays stuck on.
-													bumpToggleReset(path)
-												}
-											}}
-										/>
-									{/key}
-								</div>
-								<div class="flex gap-2 items-center justify-end">
-									<Button
-										href={`${base}/runs/?schedule_path=${path}&job_trigger_kind=schedule&show_future_jobs=true`}
-										disabled={draft_only}
-										unifiedSize="md"
-										startIcon={{ icon: List }}
-										variant="subtle"
-									>
-										Runs
-									</Button>
-									<Button
-										on:click={() => scheduleEditor?.openEdit(path, is_flow)}
-										size="xs"
-										startIcon={{ icon: canWrite ? Pen : Eye }}
-										variant="subtle"
-									>
-										{canWrite ? 'Edit' : 'View'}
-									</Button>
-									<Dropdown
-										size="md"
-										items={[
-											{
-												displayName: `View ${is_flow ? 'Flow' : 'Script'}`,
-												icon: Eye,
-												action: () => {
-													goto(href)
-												}
-											},
-											{
-												displayName: `Duplicate schedule`,
-												icon: Copy,
-												action: () => {
-													scheduleEditor?.openNew(is_flow, script_path, path)
-												}
-											},
-											{
-												displayName: 'Delete',
-												type: 'delete',
-												icon: Trash,
-												disabled: !canWrite,
-												action: async () => {
-													await ScheduleService.deleteSchedule({
-														workspace: $workspaceStore ?? '',
-														path
-													})
-													loadSchedules()
-												}
-											},
-											{
-												displayName: canWrite ? 'Edit' : 'View',
-												icon: canWrite ? Pen : Eye,
-												action: () => {
-													scheduleEditor?.openEdit(path, is_flow)
-												}
-											},
-											...(isDeployable('trigger', path, deployUiSettings)
-												? [
-														{
-															displayName: 'Deploy to prod/staging',
-															icon: FileUp,
-															action: () => {
-																deploymentDrawer?.openDrawer(path, 'trigger', {
-																	triggers: {
-																		kind: 'schedules'
-																	}
-																})
-															}
-														}
-													]
-												: []),
-											{
-												displayName: 'View runs',
-												icon: List,
-												href: `${base}/runs/?schedule_path=${path}&job_trigger_kind=schedule&show_future_jobs=true`
-											},
-											{
-												displayName: 'Audit logs',
-												icon: Eye,
-												href: `${base}/audit_logs?resource=${path}`
-											},
-											{
-												displayName: 'Run now',
-												icon: Play,
-												action: () => {
-													runScheduleNow(script_path, path, is_flow, $workspaceStore!)
-												}
-											},
-											{
-												displayName: 'Permissions',
-												icon: Shield,
-												action: () => {
-													shareModal?.openDrawer(path, 'schedule')
-												}
-											}
-										]}
-									/>
-								</div>
-							</div>
-							<div class="w-full flex justify-between items-baseline">
-								{#if loadingSchedulesWithJobStats}
-									<div class="flex gap-1 ml-0.5 text-xs text-secondary items-center">
-										<Loader2 size={14} class="animate-spin" />
-										<span>Job stats loading...</span>
-									</div>
-								{:else}
-									<div class="flex gap-1.5 ml-0.5 items-baseline flex-row-reverse">
-										{#if avg_s}
-											<div class="pl-2 text-secondary text-xs"
-												>Avg: {(avg_s / 1000).toFixed(2)}s</div
-											>
-										{/if}
-										{#each jobs ?? [] as job}
-											{@const h = (avg_s ? job.duration_ms / avg_s : 1) * 7 + 3}
-											<a href="{base}/run/{job.id}?workspace={$workspaceStore}">
-												<JobPreview id={job.id} class="p-4">
-													<div>
-														<div
-															class="{job.success ? 'bg-green-300' : 'bg-red-300'} mx-auto w-1.5"
-															style="height: {h}px"
-														></div>
-														<!-- <div class="text-[0.6em] mt-0.5 text-center text-primary"
-														>{(job.duration_ms / 1000).toFixed(2)}s</div
-													> -->
-													</div>
-												</JobPreview>
-											</a>
-										{/each}
-									</div>
-								{/if}
-								<div
-									class="flex flex-wrap text-xs text-secondary gap-1 items-center justify-end truncate pr-2"
-									>{#if edited_by}<div class="truncate">edited by {edited_by}</div>{/if}<div
-										class="truncate">{edited_by ? 'the ' : ''}{displayDate(edited_at)}</div
-									></div
-								></div
-							>
-						</div>
-					{/each}
-				</div>
-			{:else}
-				<NoItemFound />
-			{/if}
-		</div>
-		{#if items && items?.length > 15 && nbDisplayed < items.length}
-			<div class="flex items-center gap-4 text-xs font-semibold text-emphasis">
-				<span>{nbDisplayed} items out of {items.length}</span>
-				<Button size="xs" variant="subtle" on:click={() => (nbDisplayed += 30)}>
-					Load 30 more
-				</Button>
-			</div>
-		{/if}
-	</CenteredPage>
-{/if}
-
-<ShareModal
-	bind:this={shareModal}
-	on:change={() => {
-		loadSchedules()
-	}}
-/>
+<SchedulesList />
diff --git a/frontend/src/routes/(root)/(logged)/scripts/edit/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/scripts/edit/[...path]/+page.svelte
index 4ee73f5207..49ad076d23 100644
--- a/frontend/src/routes/(root)/(logged)/scripts/edit/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/scripts/edit/[...path]/+page.svelte
@@ -70,9 +70,10 @@
 	// Page-level draft orchestration: autosave handle (re-keyed on nav via
 	// `draftPath`), live-editor-draft registry, `recordRemoteSync`, removal.
 	// `draftSync.draft` stays a stable lvalue for `bind:script`.
-	/** Deployed script this load (with `parent_hash` grafted to match the
-	 * unedited draft seed), the baseline the autosave `discardIf` compares
-	 * against. `undefined` for draft-only paths so they never self-destruct. */
+	/** Deployed script this load (with the same `parent_hash` the draft seed
+	 * carries, so an unedited draft compares equal), the baseline the autosave
+	 * `discardIf` compares against. `undefined` for draft-only paths so they
+	 * never self-destruct. */
 	let deployedBaseline = $state<EditableScript | undefined>(undefined)
 
 	const draftSync = usePageDraftSync<EditableScript>({
@@ -107,6 +108,11 @@
 	 *  (our draft is behind the latest deploy). Cleared between loads to re-fire. */
 	let draftSavedAt = $state<string | undefined>(undefined)
 	let deployedAt = $state<string | undefined>(undefined)
+	/** The hash the draft forked from, and the deployed head — the script
+	 *  equivalent of the flow/app version pair. Behind ⇔ the two differ. */
+	let draftBaseHash = $state<string | undefined>(undefined)
+	let deployedHeadHash = $state<string | undefined>(undefined)
+	let deployedBy = $state<string | undefined>(undefined)
 
 	// Remounts ScriptBuilder on nav: false while a reload runs, true once data is
 	// ready. A synchronous `{#key}` swap instead races Monaco's init against the
@@ -151,6 +157,9 @@
 			loadedFromDraft = false
 			draftSavedAt = undefined
 			deployedAt = undefined
+			draftBaseHash = undefined
+			deployedHeadHash = undefined
+			deployedBy = undefined
 			// Brand-new script: no deployed baseline, so never discard-on-equal.
 			deployedBaseline = undefined
 			const templatePath = page.url.searchParams.get('template')
@@ -332,15 +341,31 @@
 			// `created_at` is the latest deploy, `draft_saved_at` the draft's save.
 			draftSavedAt = backendScript.draft_saved_at as string | undefined
 			deployedAt = backendScript.created_at as string | undefined
+			deployedBy = backendScript.created_by as string | undefined
 			// Layer the draft (`.draft`, if any) over the deployed payload at the
 			// field level: the draft supplies editor state (content, summary, …),
 			// the deployed supplies metadata it lacks (hash, version markers).
 			const { draft: draftFromBackend, ...deployedScript } = backendScript as any
+			// Exact staleness, preferred over the timestamps: a draft carried across
+			// a move keeps its old save time while the move mints a fresh deploy, so
+			// the timestamps alone would call every carried draft stale.
+			draftBaseHash = backendScript.draft_base
+			// A draft-only script has no deployed hash to be behind: what comes back
+			// under `hash` is then the draft's own value, not a head.
+			deployedHeadHash = backendScript.no_deployed
+				? undefined
+				: (backendScript.hash as string | undefined)
 			const effectiveScript: EditableScript = draftFromBackend
 				? { ...deployedScript, ...draftFromBackend }
 				: (deployedScript as EditableScript)
 			savedScript = structuredClone($state.snapshot(effectiveScript))
-			const parentHash = topHash ?? backendScript.hash
+			// The draft's base is the version it forked from and only the user moves it
+			// (by discarding or rebasing). A draft keeps the base it has, unknown included
+			// (staleness then falls back to the timestamps); seeding the head over it here
+			// would let the next autosave persist the head as the base, so a draft behind
+			// the deploy would read as up to date after one open. Only a fresh checkout
+			// forks from the head.
+			const parentHash = topHash ?? (hasOwnDraft ? backendScript.draft_base : backendScript.hash)
 			// Baseline for the autosave `discardIf`: the deployed script with the
 			// same `parent_hash` graft the seed below applies and the schema as the
 			// mounted editor holds it, so the unedited draft compares equal.
@@ -363,11 +388,25 @@
 				OtherUserDraftLoad.clear($workspaceStore!, 'script', draftPath)
 			}
 			if (pendingLoad) {
+				const theirs = (pendingLoad.value as { parent_hash?: string })?.parent_hash
 				const loadedValue = {
 					...deployedScript,
 					...(pendingLoad.value as object),
-					parent_hash: parentHash
+					parent_hash: theirs
 				} as EditableScript
+				// Their draft's base, not ours: the prompt and the deploy guard read these,
+				// and deploying their content on our base would claim a version it never
+				// forked from. A draft that has none keeps none — seeding `parentHash`
+				// (the head, when we have no draft here) would mark their older content as
+				// forked from the current deploy and silence the stale prompt.
+				if (theirs == null) {
+					delete (loadedValue as { parent_hash?: string }).parent_hash
+					// The autosave's `discardIf` baseline has to carry the same lineage as the
+					// value, or an unedited copy of their content never compares equal to the
+					// deployed one and the draft can never discard itself.
+					if (deployedBaseline) delete (deployedBaseline as { parent_hash?: string }).parent_hash
+				}
+				draftBaseHash = theirs
 				if (hasOwnDraft) {
 					OtherUserDraftLoad.beginOverlay({
 						workspace: $workspaceStore!,
@@ -480,6 +519,11 @@
 	bind:othersModalOpen
 	{draftSavedAt}
 	{deployedAt}
+	draftBaseVersion={draftBaseHash}
+	deployedHeadVersion={deployedHeadHash}
+	{deployedBy}
+	onViewDiff={() => scriptBuilder?.openDiffDrawer()}
+	onBeforeRelocate={() => scriptBuilder?.saveDraft()}
 	onLoadLatestDeploy={async () => {
 		// stopSync-bracketed; see restoreDeployed for the race.
 		if (!$workspaceStore) return
@@ -499,6 +543,25 @@
 		bind:this={scriptBuilder}
 		{initialPath}
 		userDraftPath={draftPath}
+		{draftBaseHash}
+		onTakeLatest={draftBaseHash
+			? async (shown?: string) => {
+					// The version the drawer showed as head: it offers this action only when it
+					// has one, and adopting the head this page loaded with would claim the
+					// draft is up to date with a version that may not be the latest.
+					const head = shown ?? deployedHeadHash
+					if (!draftSync.draft || !head || !$workspaceStore) return
+					draftSync.draft = { ...draftSync.draft, parent_hash: head }
+					// The baseline mirrors the draft's base so an unedited draft still
+					// compares equal and the autosave can discard it.
+					if (deployedBaseline) deployedBaseline = { ...deployedBaseline, parent_hash: head }
+					draftBaseHash = head
+					// The head this page knows moves with it, or the prompt reopens comparing
+					// the fresh base against the stale head, the two the wrong way round.
+					deployedHeadHash = head
+					await UserDraft.forcePersist('script', draftPath, { workspace: $workspaceStore })
+				}
+			: undefined}
 		bind:script={draftSync.draft}
 		template={builderTemplate}
 		{lockedLanguage}
@@ -519,6 +582,13 @@
 		onDeploy={(e) => {
 			// "Deploy & Stay here" / lib: stay on the editor (just confirm).
 			if (e.stay) {
+				// `e.hash` is the hash the create call returned, so it names this deploy's own
+				// version with nothing to attribute (unlike an app, which has to read its
+				// version back). The builder re-pinned the draft to it, so the pair moves
+				// here too: otherwise Diff offers Take latest against a head the draft is
+				// already on.
+				draftBaseHash = e.hash
+				deployedHeadHash = e.hash
 				sendUserToast('Deployed')
 				return
 			}
diff --git a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
index 84bf9d4136..07b01a84d0 100644
--- a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
@@ -35,6 +35,7 @@
 		isTearingDownOpenSession,
 		selectSession,
 		sessionInCurrentFamily,
+		sessionPageHref,
 		sessionState,
 		type SessionPreviewTab
 	} from '$lib/components/sessions/sessionState.svelte'
@@ -61,12 +62,15 @@
 		artifactKey,
 		itemDisplayName,
 		matchPreviewPage,
+		pageItemUrl,
 		pageKey,
 		parseArtifactRoute,
-		parseRunFormRoute,
+		parsePageItemRoute,
+		type PageItemRef,
 		parsePreviewItemRoute,
 		previewLocationLabel,
 		resolvePreviewTab,
+		workspacePageHref,
 		type PreviewTarget
 	} from '$lib/components/sessions/previewRouter'
 	import {
@@ -74,6 +78,7 @@
 		tabsToReload,
 		viewerTabsToReload
 	} from '$lib/components/sessions/previewReload'
+	import { isPageItemListPath, stripBase } from '$lib/components/sessions/previewPaths'
 	import {
 		leafKeyFor,
 		loadKind,
@@ -110,7 +115,8 @@
 				() => import('$lib/components/sessions/ScriptEditorView.svelte'),
 				() => import('$lib/components/sessions/FlowEditorView.svelte'),
 				() => import('$lib/components/sessions/RawAppEditorView.svelte'),
-				() => import('$lib/components/sessions/PipelineEditorView.svelte')
+				() => import('$lib/components/sessions/PipelineEditorView.svelte'),
+				() => import('$lib/components/sessions/PageItemEditorView.svelte')
 			]
 			for (const load of loaders) {
 				if (disposed) return
@@ -129,28 +135,37 @@
 		}
 	})
 
-	const sessionName = $derived(page.url.searchParams.get('session_name') ?? '')
-
-	// Unfiltered resolution by name: drives the recovery effect below and the
-	// active-session lookup.
-	const sessionByName = $derived(
-		sessionName ? sessionState.sessions.find((s) => s.name === sessionName) : undefined
-	)
+	const sessionId = $derived(page.url.searchParams.get('session') ?? '')
+	// Links from before sessions were addressed by id name a per-browser `session-N`.
+	const legacySessionName = $derived(page.url.searchParams.get('session_name') ?? '')
+	const requestsSession = $derived(!!sessionId || !!legacySessionName)
 
 	// Opening a session deliberately does NOT switch the global workspace: the
 	// chat targets the session's own workspace via the manager's workspace
 	// resolver, so the user's active (navigation-mode) workspace is left alone.
 
-	// Resolve by name without applying the sidebar scope filter so an open
-	// chat survives within-family workspace switches.
-	const activeSession = $derived(sessionState.sessions.find((s) => s.name === sessionName))
+	// Resolved without applying the sidebar scope filter so an open chat survives
+	// within-family workspace switches.
+	const activeSession = $derived(
+		sessionId
+			? sessionState.sessions.find((s) => s.id === sessionId)
+			: legacySessionName
+				? sessionState.sessions.find((s) => s.name === legacySessionName)
+				: undefined
+	)
+
+	$effect(() => {
+		if (embedded || sessionId || !activeSession) return
+		const id = activeSession.id
+		untrack(() => void goto(sessionPageHref(id), { replaceState: true }))
+	})
 
 	// Family reconcile: a workspace switch can land this page with no session
 	// selected or with another family's session in the URL (the sidebar picker's
 	// link navigation keeps the route), and a chat must not bleed across
 	// families. Re-enter session mode scoped to the active family: keep the open
 	// chat when it belongs there, else its most recent active session, else a
-	// fresh one. A `session_name` that resolves to nothing is left to the
+	// fresh one. A `session` that resolves to nothing is left to the
 	// recovery effect below.
 	$effect(() => {
 		if (embedded || !sessionState.hydrated) return
@@ -163,15 +178,14 @@
 		$workspaceStore
 		$userWorkspaces
 		const current = activeSession
-		const shouldReenter = current ? !sessionInCurrentFamily(current) : !sessionName
+		const shouldReenter = current ? !sessionInCurrentFamily(current) : !requestsSession
 		if (!shouldReenter) return
 		untrack(() => void enterSessionMode({ replace: true }))
 	})
 
 	// Held across the swap so the session layout mounts once, after the navigation
-	// settles. A recovered session often takes the very name that was missing, so
-	// the URL resolves before `goto` returns; mounting the panes mid-navigation
-	// makes Splitpanes miss the collapsed pane's `maxSize: 0` and leave it open.
+	// settles: mounting the panes mid-navigation makes Splitpanes miss the collapsed
+	// pane's `maxSize: 0` and leave it open.
 	let recovering = $state(false)
 
 	// Bounds the wait for the workspace list the guard above needs. The list can
@@ -196,7 +210,7 @@
 		// they just deleted couldn't be found.
 		if (isTearingDownOpenSession()) return
 		if ($usersWorkspaceStore === undefined && !workspaceListOverdue) return
-		if (!sessionName || sessionByName) return
+		if (!requestsSession || activeSession) return
 		untrack(() => void recoverToNewSession())
 	})
 
@@ -222,19 +236,39 @@
 			// deep links the same way they react to picker clicks.
 			selectSession(session.id)
 			getOrCreateRuntime(session)
+			mountChat(session.id)
 		})
 	})
 
-	// Warm = sessions with a live runtime. The picker eagerly creates runtimes
-	// for its visible sessions, so this tracks whatever it shows. Keeping warm
-	// chats mounted (stacked, visibility-toggled) preserves their scroll/draft
-	// state across switches.
+	// Warm = sessions with a live runtime: the ones visited this page load plus
+	// any a chat tool or a running job started.
 	const warmSessions = $derived(
 		listRuntimes()
 			.map((r) => sessionState.sessions.find((s) => s.id === r.sessionId))
 			.filter((s): s is NonNullable<typeof s> => s != null)
 	)
 
+	// Chat columns stay mounted (stacked, visibility-toggled) so switching back
+	// keeps scroll position, MRU-capped like preview tabs: every mounted column
+	// is a full transcript in the DOM. Unmounting drops only the column — the
+	// runtime keeps the chat — so a column is kept while its composer holds
+	// unsent input (component-local) or its turn is running.
+	const MAX_MOUNTED_CHATS = 5
+	const mountedChatIds = new SvelteSet<string>()
+	function keepsChatMounted(id: string): boolean {
+		const m = getRuntime(id)?.manager
+		return !!m && (m.loading || m.sendInFlight || m.sendPending || m.hasUnsentInput)
+	}
+	function mountChat(id: string) {
+		mountedChatIds.delete(id)
+		mountedChatIds.add(id)
+		for (const oldest of [...mountedChatIds]) {
+			if (mountedChatIds.size <= MAX_MOUNTED_CHATS) break
+			if (oldest !== id && !keepsChatMounted(oldest)) mountedChatIds.delete(oldest)
+		}
+	}
+	const mountedChatSessions = $derived(warmSessions.filter((s) => mountedChatIds.has(s.id)))
+
 	// Mark the active session "seen" up to its current message count: arrive →
 	// clear unread; AI streams a new message while we're here → clear again. The
 	// effect depends only on the length, not the array contents, so token-by-token
@@ -258,7 +292,7 @@
 			const target = findEmptyLandingSession() ?? createSession()
 			selectSession(target.id)
 			markSessionRecovered(target.id)
-			await goto(`/sessions?session_name=${encodeURIComponent(target.name)}`, {
+			await goto(sessionPageHref(target.id), {
 				replaceState: true
 			})
 			await tick()
@@ -510,13 +544,9 @@
 	// Page path shown after the workspace breadcrumb — the active tab's observed
 	// location, so the breadcrumb tracks where the user browses inside the tab.
 	const displayPath = $derived(owner?.activeTab?.loc ?? owner?.activeTab?.url ?? `${base}/`)
-	// Artifacts have no workspace page, so "Open in workspace" can't resolve for them.
 	const activeArtifact = $derived(owner?.activeTab ? parseArtifactRoute(owner.activeTab.url) : null)
-	// Nor does a run form: it belongs to a chat, and its url is a scheme rather than a path,
-	// so the link would resolve to the tool call id as a route.
-	const activeTabHasNoWorkspacePage = $derived(
-		activeArtifact != null ||
-			(owner?.activeTab ? parseRunFormRoute(owner.activeTab.url) != null : false)
+	const activeWorkspaceHref = $derived(
+		owner?.activeTab ? workspacePageHref(owner.activeTab.loc || owner.activeTab.url) : `${base}/`
 	)
 	// The active session's artifacts, surfaced as an "Artifacts" branch in the
 	// preview pickers.
@@ -568,33 +598,35 @@
 		}
 	}
 
-	// Reload mounted preview tabs affected by a mutating chat tool. Editor and pipeline
-	// tabs self-sync from the store the chat mutates, so nothing reloads them. Two kinds
-	// do need telling, and each only when a tool actually changed what IT shows
-	// (toolReloadEffect): list-page tabs (schedules, resources, …), which are iframes, and
-	// tabs on an item's View side, which render the deployed version over the API. So a
-	// schedule write leaves the Resources tab alone, and a purely local tool (saving user
-	// instructions) reloads nothing.
+	// Reload mounted preview tabs affected by a mutating chat tool. Item and pipeline
+	// tabs are live editors that self-sync from the store the chat mutates, so nothing
+	// reloads them. Three kinds do need telling, each only when a tool actually changed
+	// what IT shows (toolReloadEffect): list-page tabs (schedules, resources, …), page
+	// item tabs, and tabs on an item's View side, which render the deployed version over
+	// the API. So a schedule write leaves the Resources tab alone, and a purely local
+	// tool (saving user instructions) reloads nothing.
 	const tabHosts: Record<string, PreviewTabHost | undefined> = {}
 
 	let reloadHandle: ReturnType<typeof setTimeout> | undefined
-	// Base-stripped list-page paths (e.g. `/schedules`) a chat round touched since
-	// the last flush — see toolReloadEffect for how tools map to pages.
-	let pendingPages = new Set<string>()
-	// Item paths whose DEPLOYED version a chat round changed. Only the View side of a tab
-	// reads that version, so these refresh those tabs and leave the editors alone.
-	let pendingItems = new Set<string>()
+	// Per workspace a chat round touched since the last flush: base-stripped list-page paths
+	// (e.g. `/schedules`, see toolReloadEffect), the page items its tools named, as tab urls,
+	// and the item paths whose deployed version changed. By workspace because a path names an
+	// item only within one: a write in one fork must not remount the same path's editor in a
+	// session on another.
+	let pending = new Map<string, { pages: Set<string>; items: Set<string>; deployed: Set<string> }>()
 
-	// Reload the mounted list-page tabs a chat round changed, across all warm
-	// sessions (a hidden preview would otherwise show pre-mutation content on
-	// return). tabsToReload picks only the tabs whose page is in `pages`.
-	function reloadTabs(pages: Set<string>, items: Set<string>) {
+	// Reload the mounted tabs a chat round changed in each warm session acting on that
+	// workspace (a hidden preview would otherwise show pre-mutation content on return).
+	function flushReload() {
+		const touched = pending
+		pending = new Map()
 		for (const s of warmSessions) {
+			const scope = touched.get(getEffectiveWorkspaceId(s) ?? $workspaceStore ?? '')
 			const owner = getRuntime(s.id)?.previewTabs
-			if (!owner) continue
+			if (!scope || !owner) continue
 			const affected = [
-				...tabsToReload(owner.tabs, pages),
-				...viewerTabsToReload(owner.tabs, items)
+				...tabsToReload(owner.tabs, scope.pages, scope.items),
+				...viewerTabsToReload(owner.tabs, scope.deployed)
 			]
 			for (const tab of affected) {
 				const key = tabKey(s.id, tab.id)
@@ -602,27 +634,26 @@
 			}
 		}
 	}
-	function flushReload() {
-		const pages = pendingPages
-		const items = pendingItems
-		pendingPages = new Set()
-		pendingItems = new Set()
-		reloadTabs(pages, items)
-	}
 	$effect(() => {
 		// Debounced so a burst of writes (the AI editing several files) reloads once.
-		setToolCompletionListener((name, args) => {
-			const { pages, items } = toolReloadEffect(name, args)
-			if (pages.length === 0 && items.length === 0) return
-			for (const p of pages) pendingPages.add(p)
-			for (const i of items) pendingItems.add(i)
+		setToolCompletionListener((name, args, workspace) => {
+			const { pages, items, deployed } = toolReloadEffect(name, args)
+			if (pages.length === 0 && deployed.length === 0) return
+			let scope = pending.get(workspace)
+			if (!scope)
+				pending.set(
+					workspace,
+					(scope = { pages: new Set(), items: new Set(), deployed: new Set() })
+				)
+			for (const p of pages) scope.pages.add(p)
+			for (const item of items) scope.items.add(pageItemUrl(item))
+			for (const d of deployed) scope.deployed.add(d)
 			clearTimeout(reloadHandle)
 			reloadHandle = setTimeout(flushReload, 500)
 		})
 		return () => {
 			clearTimeout(reloadHandle)
-			pendingPages = new Set()
-			pendingItems = new Set()
+			pending = new Map()
 			setToolCompletionListener(undefined)
 		}
 	})
@@ -640,6 +671,22 @@
 			o.open(target)
 		})
 	})
+	// Variables, resources, schedules and triggers the chat links to open as tabs of their
+	// own here, rather than in the drawers the layout opens them in elsewhere.
+	$effect(() => {
+		return registerToolDisplayActionHandler('open_created_resource', (action) => {
+			if (action.type !== 'open_created_resource') return
+			const ref: PageItemRef | undefined =
+				action.resource === 'trigger'
+					? action.triggerKind && {
+							kind: 'trigger',
+							triggerKind: action.triggerKind,
+							path: action.path
+						}
+					: { kind: action.resource, path: action.path }
+			if (ref) owner?.open({ type: 'pageitem', ref })
+		})
+	})
 
 	// Editor-style breadcrumb over the previewed page. We only render clickable
 	// segments when the preview is sitting on a script/flow/app route — for any
@@ -778,7 +825,8 @@
 		const path =
 			tab.friendlyPath ??
 			listedItemFor(tab, workspace)?.draftPath ??
-			parsePreviewItemRoute(tab.loc)?.itemPath
+			parsePreviewItemRoute(tab.loc)?.itemPath ??
+			parsePageItemRoute(tab.loc)?.path
 		return path && path !== label ? `${label}\n${path}` : label
 	}
 
@@ -824,6 +872,13 @@
 				owner?.navigate({ type: 'item', item })
 				return
 			}
+			// A preview frame navigating to a list page: re-point the active tab to the list
+			// mounted in process, whose rows open as tabs of their own.
+			if (d.type === 'wm.session.openList') {
+				if (typeof d.href !== 'string' || !isPageItemListPath(stripBase(d.href))) return
+				owner?.navigate({ type: 'page', href: d.href, label: previewLocationLabel(d.href) })
+				return
+			}
 			// A job clicked inside a preview tab: open the run detail in a NEW tab so the
 			// originating page (e.g. Runs) stays put. open() focuses an existing tab for
 			// the same run rather than duplicating it.
@@ -902,9 +957,9 @@
 		<div class="flex-1 flex items-center justify-center">
 			<Loader2 class="animate-spin" />
 		</div>
-	{:else if !sessionName}
+	{:else if !requestsSession}
 		<div class="p-8 text-secondary">No session selected — pick one in the sidebar.</div>
-	{:else if !sessionByName || recovering}
+	{:else if !activeSession || recovering}
 		<!-- A tick while recovery swaps in an empty session, or the length of a
 		     fork teardown's HTTP round trip while a delete holds recovery off. -->
 		<div class="flex-1 flex items-center justify-center">
@@ -926,11 +981,11 @@
 					class="flex-1 min-h-0 session-splitter {previewCollapsed ? 'splitter-off' : ''}"
 				>
 					{#if !fullscreen}
-						<!-- Chat column. Warm sessions stay mounted (stacked, visibility-toggled)
-					     so switching between them preserves chat scroll/draft state. -->
+						<!-- Chat column. Recently visited sessions stay mounted (stacked,
+					     visibility-toggled) — see mountChat. -->
 						<Pane bind:size={chatPaneSize} minSize={25} class="flex flex-col min-h-0">
 							<div class="relative flex-1 min-h-0">
-								{#each warmSessions as s (s.id)}
+								{#each mountedChatSessions as s (s.id)}
 									<div
 										class="absolute inset-0 flex flex-col {s.id === activeSession?.id
 											? 'z-10 opacity-100 pointer-events-auto'
@@ -982,20 +1037,16 @@
 								<!-- Open-in-full-page + full-screen toggle, floating over the top-right
 								     corner to mirror the collapse control. -->
 								<!-- Spans the tab strip's own height and centres within it, rather than
-							     being pinned a fixed distance from the top: the controls here are not
-							     all one height (the View|Edit toggle is taller than the icon buttons),
-							     so an offset that centres one leaves the rest — and the collapse
-							     button opposite — sitting off the strip's axis. -->
+							     being pinned a fixed distance from the top, so these controls sit on
+							     the same axis as the collapse button opposite. Its width is measured
+							     so the strip can reserve room and its tabs never scroll underneath. -->
 								<div
 									bind:clientWidth={previewActionsWidth}
 									class="absolute top-0 right-1 z-30 flex h-8 items-center gap-0.5"
 								>
-									{#if !activeTabHasNoWorkspacePage}
+									{#if activeWorkspaceHref}
 										<a
-											href={withWorkspaceParam(
-												owner?.activeTab?.loc || owner?.activeTab?.url || `${base}/`,
-												previewWorkspace
-											)}
+											href={withWorkspaceParam(activeWorkspaceHref, previewWorkspace)}
 											title="Open in workspace"
 											aria-label="Open in workspace"
 											class="inline-flex items-center justify-center w-6 h-6 rounded text-tertiary hover:text-primary hover:bg-surface-hover"
diff --git a/frontend/src/routes/(root)/(logged)/sqs_triggers/+page.svelte b/frontend/src/routes/(root)/(logged)/sqs_triggers/+page.svelte
index 912d171d86..0f4155d6b3 100644
--- a/frontend/src/routes/(root)/(logged)/sqs_triggers/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/sqs_triggers/+page.svelte
@@ -1,567 +1,5 @@
 <script lang="ts">
-	import { getLocalDraftHint } from '$lib/localDraftHints.svelte'
-	import { run } from 'svelte/legacy'
-
-	import {
-		SqsTriggerService,
-		WorkspaceService,
-		type SqsTrigger,
-		type TriggerMode,
-		type WorkspaceDeployUISettings
-	} from '$lib/gen'
-	import {
-		canWrite,
-		displayDate,
-		getLocalSetting,
-		sendUserToast,
-		storeLocalSetting,
-		removeTriggerKindIfUnused
-	} from '$lib/utils'
-	import { withForkConflictRetry } from '$lib/utils/forkConflict'
-	import { base } from '$app/paths'
-	import { page } from '$app/stores'
-	import CenteredPage from '$lib/components/CenteredPage.svelte'
-	import { Alert, Badge, Button, EmptyState, Skeleton } from '$lib/components/common'
-	import Dropdown from '$lib/components/DropdownV2.svelte'
-	import PageHeader from '$lib/components/PageHeader.svelte'
-	import SharedBadge from '$lib/components/SharedBadge.svelte'
-	import DraftBadge from '$lib/components/DraftBadge.svelte'
-	import ShareModal from '$lib/components/ShareModal.svelte'
-	import Toggle from '$lib/components/Toggle.svelte'
-	import { enterpriseLicense, usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
-	import { Code, Eye, Pen, Plus, Shield, Trash, Circle, FileUp, Pause } from 'lucide-svelte'
-	import { goto } from '$lib/navigation'
-	import SearchItems from '$lib/components/SearchItems.svelte'
-	import NoItemFound from '$lib/components/home/NoItemFound.svelte'
-	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
-	import ListFilters from '$lib/components/home/ListFilters.svelte'
-	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
-	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
-	import { setQuery } from '$lib/navigation'
-	import { onDestroy, onMount } from 'svelte'
-	import Popover from '$lib/components/Popover.svelte'
-	import { isCloudHosted } from '$lib/cloud'
-	import SqsTriggerEditor from '$lib/components/triggers/sqs/SqsTriggerEditor.svelte'
-	import { ALL_DEPLOYABLE, isDeployable } from '$lib/utils_deployable'
-	import DeployWorkspaceDrawer from '$lib/components/DeployWorkspaceDrawer.svelte'
-	import AwsIcon from '$lib/components/icons/AwsIcon.svelte'
-	import TriggerModeToggle from '$lib/components/triggers/TriggerModeToggle.svelte'
-
-	type TriggerD = SqsTrigger & { canWrite: boolean }
-
-	let triggers: TriggerD[] = $state([])
-	let shareModal: ShareModal | undefined = $state()
-	let loading = $state(true)
-	let deploymentDrawer: DeployWorkspaceDrawer | undefined = $state()
-	let deployUiSettings: WorkspaceDeployUISettings | undefined = $state(undefined)
-
-	async function getDeployUiSettings() {
-		if (!$enterpriseLicense) {
-			deployUiSettings = ALL_DEPLOYABLE
-			return
-		}
-		let settings = await WorkspaceService.getPublicSettings({ workspace: $workspaceStore! })
-		deployUiSettings = settings.deploy_ui ?? ALL_DEPLOYABLE
-	}
-	getDeployUiSettings()
-	async function loadTriggers(): Promise<void> {
-		triggers = (
-			await SqsTriggerService.listSqsTriggers({
-				workspace: $workspaceStore!,
-				includeDraftOnly: true
-			})
-		).map((x) => {
-			return { canWrite: canWrite(x.path, x.extra_perms!, $userStore), ...x }
-		})
-		$usedTriggerKinds = removeTriggerKindIfUnused(triggers.length, 'sqs', $usedTriggerKinds)
-		loading = false
-	}
-
-	let interval = setInterval(async () => {
-		try {
-			const newTriggers = await SqsTriggerService.listSqsTriggers({
-				workspace: $workspaceStore!
-			})
-			for (let i = 0; i < triggers.length; i++) {
-				const newTrigger = newTriggers.find((x) => x.path === triggers[i].path)
-				if (newTrigger) {
-					triggers[i] = {
-						...triggers[i],
-						error: newTrigger.error,
-						last_server_ping: newTrigger.last_server_ping,
-						mode: newTrigger.mode,
-						server_id: newTrigger.server_id
-					}
-				}
-			}
-		} catch (err) {
-			console.error(err)
-		}
-	}, 5000)
-
-	onDestroy(() => {
-		clearInterval(interval)
-	})
-
-	async function onToggleMode(path: string, mode: TriggerMode): Promise<boolean> {
-		let committed = false
-		try {
-			const ok = await withForkConflictRetry(
-				(force) =>
-					SqsTriggerService.setSqsTriggerMode({
-						path,
-						workspace: $workspaceStore!,
-						requestBody: { mode, force }
-					}),
-				'SQS trigger'
-			)
-			committed = ok
-			if (ok) loadTriggers()
-		} catch (err) {
-			sendUserToast(
-				`Cannot ` +
-					(mode === 'enabled' ? 'enable' : mode === 'disabled' ? 'disable' : 'suspend') +
-					` sqs trigger: ${err.body}`,
-				true
-			)
-			loadTriggers()
-		}
-		return committed
-	}
-
-	run(() => {
-		if ($workspaceStore && $userStore) {
-			loadTriggers()
-		}
-	})
-	let sqsTriggerEditor: SqsTriggerEditor | undefined = $state()
-
-	let hashHandled = false
-	$effect(() => {
-		if (!hashHandled && triggers.length > 0 && sqsTriggerEditor) {
-			let hash = $page.url.hash
-			if (hash.length > 1) {
-				let path = hash.slice(1)
-				let trigger = triggers.find((t) => t.path === path)
-				if (trigger) {
-					hashHandled = true
-					sqsTriggerEditor?.openEdit(path, trigger.is_flow)
-				}
-			}
-		}
-	})
-
-	let filteredItems: (TriggerD & { marked?: any })[] | undefined = $state([])
-	let items: typeof filteredItems | undefined = $state([])
-	let preFilteredItems: typeof filteredItems | undefined = $state([])
-	let filter = $state('')
-	let ownerFilter: string | undefined = $state(undefined)
-	let nbDisplayed = $state(15)
-
-	const TRIGGER_PATH_KIND_FILTER_SETTING = 'filter_path_of'
-	const FILTER_USER_FOLDER_SETTING_NAME = 'user_and_folders_only'
-	let selectedFilterKind = $state(
-		(getLocalSetting(TRIGGER_PATH_KIND_FILTER_SETTING) as 'trigger' | 'script_flow') ?? 'trigger'
-	)
-	let filterUserFolders = $state(getLocalSetting(FILTER_USER_FOLDER_SETTING_NAME) == 'true')
-
-	run(() => {
-		storeLocalSetting(TRIGGER_PATH_KIND_FILTER_SETTING, selectedFilterKind)
-	})
-	run(() => {
-		storeLocalSetting(FILTER_USER_FOLDER_SETTING_NAME, filterUserFolders ? 'true' : undefined)
-	})
-
-	function filterItemsPathsBaseOnUserFilters(
-		item: TriggerD,
-		selectedFilterKind: 'trigger' | 'script_flow',
-		filterUserFolders: boolean
-	) {
-		if ($workspaceStore == 'admins') return true
-		if (filterUserFolders) {
-			if (selectedFilterKind === 'trigger') {
-				return (
-					!item.path.startsWith('u/') || item.path.startsWith('u/' + $userStore?.username + '/')
-				)
-			} else {
-				return (
-					!item.script_path.startsWith('u/') ||
-					item.script_path.startsWith('u/' + $userStore?.username + '/')
-				)
-			}
-		} else {
-			return true
-		}
-	}
-
-	run(() => {
-		preFilteredItems =
-			ownerFilter != undefined
-				? selectedFilterKind === 'trigger'
-					? triggers?.filter(
-							(x) =>
-								x.path.startsWith(ownerFilter + '/') &&
-								filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-						)
-					: triggers?.filter(
-							(x) =>
-								x.script_path.startsWith(ownerFilter + '/') &&
-								filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-						)
-				: triggers?.filter((x) =>
-						filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-					)
-	})
-
-	run(() => {
-		if ($workspaceStore) {
-			ownerFilter = undefined
-		}
-	})
-
-	let owners = $derived(
-		selectedFilterKind === 'trigger'
-			? Array.from(
-					new Set(filteredItems?.map((x) => x.path.split('/').slice(0, 2).join('/')) ?? [])
-				).sort()
-			: Array.from(
-					new Set(filteredItems?.map((x) => x.script_path.split('/').slice(0, 2).join('/')) ?? [])
-				).sort()
-	)
-
-	run(() => {
-		items = filter !== '' ? filteredItems : preFilteredItems
-	})
-
-	function updateQueryFilters(selectedFilterKind, filterUserFolders) {
-		setQuery(
-			TRIGGER_PATH_KIND_FILTER_SETTING,
-			selectedFilterKind,
-			window.location.hash || undefined
-		).then(() => {
-			setQuery(
-				FILTER_USER_FOLDER_SETTING_NAME,
-				String(filterUserFolders),
-				window.location.hash || undefined
-			)
-		})
-	}
-
-	function loadQueryFilters() {
-		let url = new URL(window.location.href)
-		let queryFilterKind = url.searchParams.get(TRIGGER_PATH_KIND_FILTER_SETTING)
-		let queryFilterUserFolders = url.searchParams.get(FILTER_USER_FOLDER_SETTING_NAME)
-		if (queryFilterKind) {
-			selectedFilterKind = queryFilterKind as 'trigger' | 'script_flow'
-		}
-		if (queryFilterUserFolders) {
-			filterUserFolders = queryFilterUserFolders == 'true'
-		}
-	}
-
-	onMount(() => {
-		loadQueryFilters()
-	})
-
-	run(() => {
-		updateQueryFilters(selectedFilterKind, filterUserFolders)
-	})
+	import TriggerList from '$lib/components/triggers/TriggerList.svelte'
 </script>
 
-<DeployWorkspaceDrawer bind:this={deploymentDrawer} />
-<SqsTriggerEditor onUpdate={loadTriggers} bind:this={sqsTriggerEditor} />
-
-<SearchItems
-	{filter}
-	items={preFilteredItems}
-	bind:filteredItems
-	f={(x) => (x.summary ?? '') + ' ' + x.path + ' (' + x.script_path + ')'}
-/>
-
-<CenteredPage>
-	<PageHeader title="SQS triggers" tooltip="SQS trigger">
-		<Button
-			unifiedSize="md"
-			variant="accent"
-			startIcon={{ icon: Plus }}
-			on:click={() => sqsTriggerEditor?.openNew(false)}
-		>
-			New&nbsp;SQS trigger
-		</Button>
-	</PageHeader>
-
-	{#if isCloudHosted()}
-		<Alert title="Not compatible with multi-tenant cloud" type="warning">
-			SQS triggers are disabled in the multi-tenant cloud.
-		</Alert>
-		<div class="py-4"></div>
-	{/if}
-	<div class="w-full h-full flex flex-col">
-		<div class="w-full pb-4 pt-6">
-			<input
-				type="text"
-				placeholder="Search SQS triggers"
-				bind:value={filter}
-				class="search-item"
-			/>
-			<div class="flex flex-row items-center gap-2 mt-2">
-				<div class="text-sm shrink-0"> Filter by path of </div>
-				<ToggleButtonGroup bind:selected={selectedFilterKind}>
-					{#snippet children({ item })}
-						<ToggleButton value="trigger" label="SQS trigger" icon={AwsIcon} {item} />
-						<ToggleButton value="script_flow" label="Script/Flow" icon={Code} {item} />
-					{/snippet}
-				</ToggleButtonGroup>
-			</div>
-			<ListFilters syncQuery bind:selectedFilter={ownerFilter} filters={owners} />
-
-			<div class="flex flex-row items-center justify-end gap-4">
-				{#if $userStore?.is_super_admin && $userStore.username.includes('@')}
-					<Toggle size="xs" bind:checked={filterUserFolders} options={{ right: 'Only f/*' }} />
-				{:else if $userStore?.is_admin || $userStore?.is_super_admin}
-					<Toggle
-						size="xs"
-						bind:checked={filterUserFolders}
-						options={{ right: `Only u/${$userStore.username} and f/*` }}
-					/>
-				{/if}
-			</div>
-		</div>
-		{#if loading}
-			{#each new Array(6) as _}
-				<Skeleton layout={[[6], 0.4]} />
-			{/each}
-		{:else if !triggers?.length}
-			<EmptyState
-				icon={AwsIcon}
-				title="No SQS triggers yet"
-				description="Windmill can consume messages from an SQS queue and trigger scripts or flows on each one."
-				action={{
-					label: 'Add an SQS trigger',
-					icon: Plus,
-					onClick: () => sqsTriggerEditor?.openNew(false),
-					aiId: 'sqs-triggers-empty-add',
-					aiDescription: 'Add SQS trigger'
-				}}
-			/>
-		{:else if items?.length}
-			<div class="border rounded-md divide-y">
-				{#each items.slice(0, nbDisplayed) as { path, edited_by, error, edited_at, script_path, is_flow, extra_perms, canWrite, mode, server_id, retry, error_handler_path, error_handler_args, labels, draft_only, is_draft } (path)}
-					{@const hasDraft = getLocalDraftHint($workspaceStore, 'trigger_sqs', path) ?? is_draft}
-					{@const href = `${is_flow ? '/flows/get' : '/scripts/get'}/${script_path}`}
-					{@const ping = new Date()}
-					{@const pinging = ping && ping.getTime() > new Date().getTime() - 15 * 1000}
-					{@const effectiveMode = draft_only ? 'disabled' : mode}
-					{@const enabled = effectiveMode === 'enabled' || effectiveMode === 'suspended'}
-
-					<div
-						class="hover:bg-surface-hover w-full items-center px-4 py-2 gap-4 first-of-type:!border-t-0
-				first-of-type:rounded-t-md last-of-type:rounded-b-md flex flex-col"
-					>
-						<div class="w-full flex gap-5 items-center">
-							<RowIcon kind={is_flow ? 'flow' : 'script'} />
-
-							<a
-								href="#{path}"
-								onclick={() => sqsTriggerEditor?.openEdit(path, is_flow)}
-								class="min-w-0 grow hover:underline decoration-gray-400"
-							>
-								<div class="text-emphasis flex-wrap text-left text-xs font-semibold mb-1 truncate">
-									{path}{hasDraft ? '*' : ''}
-								</div>
-								<div class="text-secondary text-xs truncate text-left font-light"></div>
-								<div class="text-secondary text-xs truncate text-left font-light">
-									runnable: {script_path}
-								</div>
-							</a>
-
-							<div class="hidden lg:flex flex-row gap-1 items-center">
-								<SharedBadge {canWrite} extraPerms={extra_perms} />
-								{#if labels?.length}
-									{#each labels as label}
-										<Badge color="blue" small class="px-1" title="Label: {label}">{label}</Badge>
-									{/each}
-								{/if}
-							</div>
-
-							<div class="w-10">
-								{#if (enabled && (!pinging || error)) || (!enabled && error) || (enabled && !server_id)}
-									<Popover notClickable>
-										<span class="flex h-4 w-4">
-											<Circle
-												class="text-red-600 animate-ping absolute inline-flex fill-current"
-												size={12}
-											/>
-											<Circle class="text-red-600 relative inline-flex fill-current" size={12} />
-										</span>
-										{#snippet text()}
-											<div>
-												{#if enabled}
-													{#if !server_id}
-														SQS trigger is starting...
-													{:else}
-														Could not connect to SQS{error ? ': ' + error : ''}
-													{/if}
-												{:else}
-													Disabled because of an error: {error}
-												{/if}
-											</div>
-										{/snippet}
-									</Popover>
-								{:else if enabled}
-									<Popover notClickable>
-										<span class="flex h-4 w-4">
-											<Circle class="text-green-600 relative inline-flex fill-current" size={12} />
-										</span>
-										{#snippet text()}
-											<div> Connected to SQS{!server_id ? ' (shutting down...)' : ''}</div>
-										{/snippet}
-									</Popover>
-								{/if}
-							</div>
-
-							<div class="flex items-center justify-end gap-2 shrink-0 min-w-[8rem]">
-								<DraftBadge {draft_only} is_draft={hasDraft} />
-								<TriggerModeToggle
-									disabled={draft_only}
-									title={draft_only
-										? 'Draft only: deploy the trigger to enable it'
-										: hasDraft
-											? 'Enables/disables the deployed trigger; the draft is not affected'
-											: undefined}
-									onToggleMode={(newMode) => onToggleMode(path, newMode)}
-									triggerMode={effectiveMode}
-									includeModalConfig={{
-										triggerPath: path,
-										triggerKind: 'sqs',
-										runnableConfig: {
-											path: script_path,
-											kind: is_flow ? 'flow' : 'script',
-											retry,
-											errorHandlerPath: error_handler_path,
-											errorHandlerArgs: error_handler_args
-										}
-									}}
-									{canWrite}
-									hideToggleLabels
-									hideDropdown
-								/>
-							</div>
-
-							<div class="flex gap-2 items-center justify-end">
-								<Button
-									on:click={() => sqsTriggerEditor?.openEdit(path, is_flow)}
-									size="xs"
-									startIcon={canWrite
-										? { icon: Pen }
-										: {
-												icon: Eye
-											}}
-									variant="subtle"
-								>
-									{canWrite ? 'Edit' : 'View'}
-								</Button>
-								<Dropdown
-									items={[
-										{
-											displayName: `View ${is_flow ? 'Flow' : 'Script'}`,
-											icon: Eye,
-											action: () => {
-												goto(href)
-											}
-										},
-										...(canWrite && !draft_only && mode !== 'suspended'
-											? [
-													{
-														displayName: 'Suspend job execution',
-														icon: Pause,
-														action: () => {
-															onToggleMode(path, 'suspended')
-														}
-													}
-												]
-											: []),
-										{
-											displayName: canWrite ? 'Edit' : 'View',
-											icon: canWrite ? Pen : Eye,
-											action: () => {
-												sqsTriggerEditor?.openEdit(path, is_flow)
-											}
-										},
-										...(isDeployable('trigger', path, deployUiSettings)
-											? [
-													{
-														displayName: 'Deploy to prod/staging',
-														icon: FileUp,
-														action: () => {
-															deploymentDrawer?.openDrawer(path, 'trigger', {
-																triggers: {
-																	kind: 'sqs'
-																}
-															})
-														}
-													}
-												]
-											: []),
-										{
-											displayName: 'Audit logs',
-											icon: Eye,
-											href: `${base}/audit_logs?resource=${path}`
-										},
-										{
-											displayName: 'Permissions',
-											icon: Shield,
-											action: () => {
-												shareModal?.openDrawer(path, 'sqs_trigger')
-											}
-										},
-										{
-											displayName: 'Delete',
-											type: 'delete',
-											icon: Trash,
-											disabled: !canWrite,
-											action: async () => {
-												try {
-													await SqsTriggerService.deleteSqsTrigger({
-														workspace: $workspaceStore ?? '',
-														path
-													})
-													loadTriggers()
-												} catch (error) {
-													sendUserToast(error.body, true)
-												}
-											}
-										}
-									]}
-								/>
-							</div>
-						</div>
-						<div class="w-full flex justify-between items-baseline">
-							<div
-								class="flex flex-wrap text-[0.7em] text-primary gap-1 items-center justify-end truncate pr-2"
-								>{#if edited_by}<div class="truncate">edited by {edited_by}</div>{/if}<div
-									class="truncate">{edited_by ? 'the ' : ''}{displayDate(edited_at)}</div
-								></div
-							></div
-						>
-					</div>
-				{/each}
-			</div>
-		{:else}
-			<NoItemFound />
-		{/if}
-	</div>
-	{#if items && items?.length > 15 && nbDisplayed < items.length}
-		<span class="text-xs"
-			>{nbDisplayed} items out of {items.length}
-			<button class="ml-4" onclick={() => (nbDisplayed += 30)}>load 30 more</button></span
-		>
-	{/if}
-</CenteredPage>
-
-<ShareModal
-	bind:this={shareModal}
-	on:change={() => {
-		loadTriggers()
-	}}
-/>
+<TriggerList triggerKind="sqs" />
diff --git a/frontend/src/routes/(root)/(logged)/user/cli/+page.svelte b/frontend/src/routes/(root)/(logged)/user/cli/+page.svelte
index 8a67d7094a..010abe2bd8 100644
--- a/frontend/src/routes/(root)/(logged)/user/cli/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/user/cli/+page.svelte
@@ -14,7 +14,9 @@
 
 	async function authorizeToken(): Promise<void> {
 		const username = $userStore?.username
-		const label = username ? `cli-${username}` : 'cli'
+		// `cli-login:` is reserved in `is_user_token` (windmill-common): the CLI signs in again on
+		// its own once this token expires, so it must not email the user about it.
+		const label = `cli-login:${username ?? ''}`
 		const newToken = await UserService.createToken({
 			requestBody: {
 				label,
diff --git a/frontend/src/routes/(root)/(logged)/user/remote_deploy_authorize/+page.svelte b/frontend/src/routes/(root)/(logged)/user/remote_deploy_authorize/+page.svelte
new file mode 100644
index 0000000000..2362b7f116
--- /dev/null
+++ b/frontend/src/routes/(root)/(logged)/user/remote_deploy_authorize/+page.svelte
@@ -0,0 +1,132 @@
+<script lang="ts">
+	import { page } from '$app/state'
+	import { base } from '$lib/base'
+	import CenteredModal from '$lib/components/CenteredModal.svelte'
+	import { Alert, Button } from '$lib/components/common'
+	import { UserService } from '$lib/gen'
+	import { CALLBACK_PATH } from '$lib/remoteDeploy'
+	import { usersWorkspaceStore } from '$lib/stores'
+
+	// Another Windmill instance asks for a token to deploy into one workspace here as the signed-in
+	// user. It gets the token only if they authorize, and only at `callback`, whose origin they are
+	// shown: anyone can craft this link, so that origin is the whole decision.
+	const workspace = page.url.searchParams.get('workspace') ?? ''
+	const connectState = page.url.searchParams.get('state') ?? ''
+	const callback = parseCallback(page.url.searchParams.get('callback'))
+
+	function parseCallback(raw: string | null): URL | undefined {
+		try {
+			const url = new URL(raw ?? '')
+			const valid =
+				(url.protocol === 'https:' || url.protocol === 'http:') &&
+				url.pathname.endsWith(CALLBACK_PATH) &&
+				!url.search &&
+				!url.hash &&
+				!url.username &&
+				!url.password
+			return valid ? url : undefined
+		} catch {
+			return undefined
+		}
+	}
+
+	// A framing page could lay its own content over the Authorize button and have it clicked.
+	const framed = window.self !== window.top
+	// Left to the user rather than refused: internal instances often serve plain http.
+	const unencrypted =
+		callback?.protocol === 'http:' &&
+		!['localhost', '127.0.0.1', '[::1]'].includes(callback.hostname)
+	// Bounds a grant that went to the wrong place; reconnecting is one click.
+	const TOKEN_LIFETIME_MS = 90 * 24 * 3600 * 1000
+	const invalid = !callback || !workspace || !/^[A-Za-z0-9]{8,128}$/.test(connectState)
+
+	let error: string | undefined = $state(undefined)
+	let authorizing = $state(false)
+
+	function sendBack(params: Record<string, string>) {
+		const fragment = new URLSearchParams({ ...params, state: connectState })
+		window.location.replace(`${callback!.href}#${fragment}`)
+	}
+
+	async function authorize() {
+		authorizing = true
+		error = undefined
+		try {
+			await UserService.whoami({ workspace })
+			const token = await UserService.createToken({
+				requestBody: {
+					// Reserved in `is_user_token` (windmill-common), so its expiry sends no email: it is
+					// renewed by connecting again from the deploying instance, not managed here.
+					label: `remote-deploy:${callback!.host}`,
+					workspace_id: workspace,
+					expiration: new Date(Date.now() + TOKEN_LIFETIME_MS).toISOString()
+				}
+			})
+			sendBack({ token })
+		} catch (e: any) {
+			authorizing = false
+			error =
+				e?.status === 401 || e?.status === 404
+					? `You are not a member of workspace ${workspace} on this instance`
+					: (e?.body ?? e?.message ?? String(e))
+		}
+	}
+</script>
+
+<CenteredModal title="Authorize a deploy connection">
+	{#if framed}
+		<Alert type="error" title="Refused">
+			This page cannot be used inside another page. Open it in its own tab.
+		</Alert>
+	{:else if invalid}
+		<Alert type="error" title="Invalid request">
+			This authorization link is malformed. Start again from the deploy drawer of the other
+			instance.
+		</Alert>
+	{:else}
+		<div class="flex flex-col gap-4 text-sm text-primary">
+			<p>
+				<span class="font-semibold">{callback!.origin}</span> asks to deploy into workspace
+				<span class="font-semibold">{workspace}</span> on this instance as
+				<span class="font-semibold">{$usersWorkspaceStore?.email ?? 'you'}</span>.
+			</p>
+			<p class="text-secondary">
+				It will receive a token limited to that workspace, with your permissions in it, valid for up
+				to 90 days. Only authorize if you just started this from {callback!.host}. You can revoke
+				the token at any time in your account settings, under tokens.
+			</p>
+			{#if unencrypted}
+				<Alert type="warning" title="Unencrypted connection">
+					{callback!.origin} is served over plain http, so the token will cross the network unencrypted
+					on its way there.
+				</Alert>
+			{/if}
+			{#if error}
+				<Alert type="error" title="Could not authorize">{error}</Alert>
+			{/if}
+		</div>
+		<div class="flex flex-row justify-around pt-6 gap-x-1">
+			<Button
+				variant="default"
+				unifiedSize="lg"
+				onclick={() => sendBack({ error: 'Declined on the remote instance' })}
+			>
+				Decline
+			</Button>
+			<Button
+				variant="accent"
+				unifiedSize="lg"
+				loading={authorizing}
+				disabled={authorizing}
+				onclick={authorize}
+			>
+				Authorize
+			</Button>
+		</div>
+	{/if}
+	{#if framed || invalid}
+		<div class="flex justify-center pt-4">
+			<Button variant="default" unifiedSize="md" href={base}>Go to Windmill</Button>
+		</div>
+	{/if}
+</CenteredModal>
diff --git a/frontend/src/routes/(root)/(logged)/variables/+page.svelte b/frontend/src/routes/(root)/(logged)/variables/+page.svelte
index 873e812987..839695361e 100644
--- a/frontend/src/routes/(root)/(logged)/variables/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/variables/+page.svelte
@@ -1,722 +1,5 @@
 <script lang="ts">
-	import { getLocalDraftHint } from '$lib/localDraftHints.svelte'
-	import CenteredPage from '$lib/components/CenteredPage.svelte'
-	import {
-		Alert,
-		Badge,
-		Button,
-		EmptyState,
-		Skeleton,
-		Tab,
-		TabFade,
-		Tabs
-	} from '$lib/components/common'
-	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
-	import { OauthService, VariableService, WorkspaceService } from '$lib/gen'
-	import ContextualVariableEditor from '$lib/components/ContextualVariableEditor.svelte'
-	import DeployWorkspaceDrawer from '$lib/components/DeployWorkspaceDrawer.svelte'
-	import Dropdown from '$lib/components/DropdownV2.svelte'
-	import NoDirectDeployAlert from '$lib/components/NoDirectDeployAlert.svelte'
-	import PageHeader from '$lib/components/PageHeader.svelte'
-	import Popover from '$lib/components/Popover.svelte'
-	import FilterSearchbar, {
-		hasActiveFilters,
-		useUrlSyncedFilterInstance
-	} from '$lib/components/FilterSearchbar.svelte'
-	import { buildVariablesFilterSchema } from '$lib/components/variables/variablesFilter'
-	import SharedBadge from '$lib/components/SharedBadge.svelte'
-	import DraftBadge from '$lib/components/DraftBadge.svelte'
-	import InheritedLabels from '$lib/components/InheritedLabels.svelte'
-	import ShareModal from '$lib/components/ShareModal.svelte'
-	import Cell from '$lib/components/table/Cell.svelte'
-	import DataTable from '$lib/components/table/DataTable.svelte'
-	import Head from '$lib/components/table/Head.svelte'
-	import Row from '$lib/components/table/Row.svelte'
-	import TableSimple from '$lib/components/TableSimple.svelte'
-	import Tooltip from '$lib/components/Tooltip.svelte'
-	import VariableEditor from '$lib/components/VariableEditor.svelte'
-	import type { ContextualVariable, ListableVariable, WorkspaceDeployUISettings } from '$lib/gen'
-	import { enterpriseLicense, userStore, workspaceStore, userWorkspaces } from '$lib/stores'
-	import { sendUserToast } from '$lib/toast'
-	import { canWrite, isOwner, truncate } from '$lib/utils'
-	import { isDeployable, ALL_DEPLOYABLE } from '$lib/utils_deployable'
-	import {
-		Plus,
-		FileUp,
-		Link,
-		Pen,
-		RefreshCw,
-		Shield,
-		Trash,
-		Building,
-		DollarSign,
-		EyeOff,
-		Circle,
-		SearchX
-	} from 'lucide-svelte'
-	import { untrack } from 'svelte'
-	import { page } from '$app/stores'
-
-	type ListableVariableW = ListableVariable & { canWrite: boolean }
-
-	let variables = $state(undefined) as ListableVariableW[] | undefined
-	let showCreateButtons = $state(false)
-
-	// Collect unique values for filter autocomplete
-	let allPaths: string[] = $state([])
-	let allOwners: string[] = $state([])
-	let allLabels: string[] = $state([])
-
-	// FilterSearchbar setup
-	let userFoldersFilterType = $derived(
-		$userStore?.is_super_admin && $userStore.username.includes('@')
-			? 'only f/*'
-			: $userStore?.is_admin || $userStore?.is_super_admin
-				? 'u/username and f/*'
-				: undefined
-	)
-	let variablesFilterSchema = $derived(
-		buildVariablesFilterSchema({
-			paths: allPaths,
-			owners: allOwners,
-			labels: allLabels,
-			showUserFoldersFilter: userFoldersFilterType !== undefined,
-			userFoldersLabel:
-				userFoldersFilterType === 'only f/*' ? 'Only f/*' : `Only u/${$userStore?.username} and f/*`
-		})
-	)
-	let filters = useUrlSyncedFilterInstance(untrack(() => variablesFilterSchema))
-	let itemFolders = $derived(
-		Array.from(
-			new Set(
-				(variables ?? [])
-					.map((x) => x.path.split('/').slice(0, 2).join('/'))
-					.filter((x) => x.startsWith('f/'))
-			)
-		)
-			.sort()
-			.map((f) => f.replace(/^f\//, ''))
-	)
-	let folderPresets = $derived([
-		...itemFolders.map((f) => ({ name: `f/${f}`, value: `path_start:\\ f/${f}/` })),
-		...allLabels.map((l) => ({ name: l, value: `label:\\ ${l}` })),
-		...(variablesFilterSchema.user_folders_only
-			? [
-					{
-						name: variablesFilterSchema.user_folders_only.label ?? '?',
-						value: 'user_folders_only:\\ true'
-					}
-				]
-			: [])
-	])
-	let contextualVariables: ContextualVariable[] = $state([])
-	let shareModal: ShareModal | undefined = $state()
-	let variableEditor: VariableEditor | undefined = $state()
-	let contextualVariableEditor: ContextualVariableEditor | undefined = $state()
-	let loading = $state({
-		contextual: true
-	})
-
-	let deleteConfirmedCallback: (() => void) | undefined = $state(undefined)
-	let deleteIsLinked = $state(false)
-	let open = $derived(Boolean(deleteConfirmedCallback))
-
-	// Filter variables client-side for user folder filtering (admin feature)
-	let filteredItems = $derived.by(() => {
-		let items = variables
-		if (filters.val.user_folders_only && items) {
-			items = items.filter((item) => {
-				if (userFoldersFilterType === 'only f/*') return item.path.startsWith('f/')
-				if (userFoldersFilterType === 'u/username and f/*')
-					return item.path.startsWith('f/') || item.path.startsWith(`u/${$userStore?.username}/`)
-				return true
-			})
-		}
-		return items
-	})
-
-	// If relative, the dropdown is positioned relative to its button
-	async function loadVariables(): Promise<void> {
-		const currentFilters = filters.val
-
-		// Build API parameters from filters.
-		// `includeDraftOnly` surfaces per-user drafts at paths that have
-		// no deployed variable — appended server-side when no narrowing
-		// filter is set, so the user sees AI-agent-created drafts on
-		// the home page.
-		const apiParams: any = {
-			workspace: $workspaceStore!,
-			includeDraftOnly: true
-		}
-
-		if (currentFilters.path) {
-			apiParams.path = currentFilters.path
-		}
-		if (currentFilters.path_start) {
-			apiParams.pathStart = currentFilters.path_start
-		}
-		if (currentFilters.description) {
-			apiParams.description = currentFilters.description
-		}
-		if (currentFilters.value) {
-			apiParams.value = currentFilters.value
-		}
-		if (currentFilters.owner) {
-			apiParams.pathStart = currentFilters.owner
-		}
-		if (currentFilters._default_) {
-			apiParams.broadFilter = currentFilters._default_
-		}
-		if (currentFilters.label) {
-			apiParams.label = currentFilters.label
-		}
-
-		const result = (await VariableService.listVariable(apiParams)).map((x) => {
-			return {
-				canWrite: canWrite(x.path, x.extra_perms!, $userStore) && x.workspace_id == $workspaceStore,
-				...x
-			}
-		})
-
-		// Extract unique values for autocomplete
-		allPaths = Array.from(new Set(result.map((x) => x.path))).sort()
-		allOwners = Array.from(
-			new Set(result.map((x) => x.path.split('/').slice(0, 2).join('/')))
-		).sort()
-		allLabels = Array.from(
-			new Set(result.flatMap((x) => [...(x.labels ?? []), ...(x.inherited_labels ?? [])]))
-		).sort()
-
-		variables = result
-	}
-
-	// Reload variables when filters change
-	$effect(() => {
-		filters.val
-		if ($workspaceStore) {
-			untrack(() => loadVariables())
-		}
-	})
-
-	let deployUiSettings: WorkspaceDeployUISettings | undefined = $state(undefined)
-
-	async function getDeployUiSettings() {
-		if (!$enterpriseLicense) {
-			deployUiSettings = ALL_DEPLOYABLE
-			return
-		}
-		let settings = await WorkspaceService.getPublicSettings({ workspace: $workspaceStore! })
-		deployUiSettings = settings.deploy_ui ?? ALL_DEPLOYABLE
-	}
-	getDeployUiSettings()
-
-	async function loadContextualVariables(): Promise<void> {
-		contextualVariables = await VariableService.listContextualVariables({
-			workspace: $workspaceStore!
-		})
-		loading.contextual = false
-	}
-
-	async function deleteVariable(path: string, account?: number): Promise<void> {
-		if (account) {
-			OauthService.disconnectAccount({ workspace: $workspaceStore!, id: account })
-		}
-		await VariableService.deleteVariable({ workspace: $workspaceStore!, path })
-		loadVariables()
-		sendUserToast(`Variable ${path} was deleted`)
-	}
-
-	$effect(() => {
-		if ($workspaceStore && $userStore) {
-			untrack(() => {
-				loadVariables()
-				loadContextualVariables()
-			})
-		}
-	})
-	let tab: 'workspace' | 'contextual' = $state('workspace')
-
-	let activeFilters = $derived(hasActiveFilters(filters.val))
-
-	let deploymentDrawer: DeployWorkspaceDrawer | undefined = $state()
-
-	async function deleteContextualVariable(row: { name: string }) {
-		await WorkspaceService.setEnvironmentVariable({
-			workspace: $workspaceStore!,
-			requestBody: {
-				name: row.name,
-				value: undefined
-			}
-		})
-		loadContextualVariables()
-		sendUserToast(
-			`Custom contextual variable ${row.name} was deleted. It may take up to a few minutes to update.`
-		)
-		setTimeout(() => {
-			loadContextualVariables()
-		}, 5000)
-	}
-
-	// Deep link: #<path> opens that variable's edit drawer. Reactive rather than
-	// onMount so a hash change on the already-mounted page (e.g. the AI session
-	// preview re-pointing its tab) opens the drawer too. Row links pre-set
-	// handledHash: their onclick already opens the drawer.
-	let handledHash = ''
-	$effect(() => {
-		const hash = $page.url.hash
-		// Only item paths are drawer targets: the same hash also carries global
-		// drawers like #superadmin-settings, which must not be looked up as a variable.
-		if (!/^#[ufg]\//.test(hash)) {
-			// Navigating away from a drawer target must clear the tracker, or
-			// re-targeting the same item later would be skipped as already handled.
-			handledHash = ''
-			return
-		}
-		if (hash === handledHash || !variableEditor) return
-		handledHash = hash
-		variableEditor.editVariable(hash.slice(1))
-	})
+	import VariablesList from '$lib/components/variables/VariablesList.svelte'
 </script>
 
-<DeployWorkspaceDrawer bind:this={deploymentDrawer} />
-
-{#if $userStore?.operator && $workspaceStore && !$userWorkspaces.find((_) => _.id === $workspaceStore)?.operator_settings?.variables}
-	<div class="bg-red-100 border-l-4 border-red-600 text-orange-700 p-4 m-4 mt-12" role="alert">
-		<p class="font-bold">Unauthorized</p>
-		<p>Page not available for operators</p>
-	</div>
-{:else}
-	<CenteredPage>
-		<PageHeader
-			title="Variables"
-			tooltip="Save and permission strings to be reused in Scripts and Flows."
-			documentationLink="https://www.windmill.dev/docs/core_concepts/variables_and_secrets"
-		>
-			{#if showCreateButtons}
-				<div class="flex flex-row justify-end">
-					{#if tab == 'contextual' && ($userStore?.is_admin || $userStore?.is_super_admin)}
-						<Button
-							unifiedSize="md"
-							variant="accent"
-							startIcon={{ icon: Plus }}
-							on:click={() => contextualVariableEditor?.initNew()}
-						>
-							New&nbsp;contextual&nbsp;variable
-						</Button>
-					{:else}
-						<Button
-							unifiedSize="md"
-							variant="accent"
-							startIcon={{ icon: Plus }}
-							on:click={() => variableEditor?.initNew()}
-						>
-							New&nbsp;variable
-						</Button>
-					{/if}
-				</div>
-			{/if}
-		</PageHeader>
-		<NoDirectDeployAlert onUpdateCanEditStatus={(v) => (showCreateButtons = v)} />
-
-		<VariableEditor
-			bind:this={variableEditor}
-			workspace={$workspaceStore}
-			on:create={loadVariables}
-		/>
-		<ContextualVariableEditor
-			bind:this={contextualVariableEditor}
-			on:update={loadContextualVariables}
-		/>
-		<ShareModal
-			bind:this={shareModal}
-			on:change={() => {
-				loadVariables()
-			}}
-		/>
-
-		<div class="flex gap-2 justify-between items-center">
-			<Tabs bind:selected={tab}>
-				<Tab value="workspace" label="Workspace" icon={Building} />
-				<Tab value="contextual" label="Contextual" icon={DollarSign}>
-					{#snippet extra()}
-						<Tooltip
-							documentationLink="https://www.windmill.dev/docs/core_concepts/variables_and_secrets#contextual-variables"
-						>
-							Contextual variables are passed as environment variables when running a script and
-							depends on the execution context.
-						</Tooltip>
-					{/snippet}
-				</Tab>
-			</Tabs>
-			{#if tab == 'workspace'}
-				<FilterSearchbar
-					class="grow max-w-[26rem]"
-					schema={variablesFilterSchema}
-					bind:value={filters.val}
-					placeholder="Filter variables..."
-					presets={folderPresets}
-				/>
-			{/if}
-		</div>
-		<TabFade key={tab}>
-			{#if tab == 'workspace'}
-				<div class="relative overflow-x-auto pb-40 mt-4">
-					{#if !filteredItems}
-						<Skeleton layout={[0.5, [2], 1]} />
-						{#each new Array(3) as _}
-							<Skeleton layout={[[3.5], 0.5]} />
-						{/each}
-					{:else if filteredItems.length == 0}
-						{#if activeFilters}
-							<EmptyState
-								icon={SearchX}
-								title="No variables found"
-								description="No variable matches the current filters. Try clearing or widening them."
-							/>
-						{:else}
-							<EmptyState
-								icon={DollarSign}
-								title="No variables yet"
-								description="Variables store values and secrets that your scripts, flows and apps can read at runtime."
-								action={showCreateButtons
-									? {
-											label: 'Add a variable',
-											icon: Plus,
-											onClick: () => variableEditor?.initNew(),
-											aiId: 'variables-empty-add-variable',
-											aiDescription: 'Add variable'
-										}
-									: undefined}
-							/>
-						{/if}
-					{:else}
-						<DataTable size="xs">
-							<Head>
-								<tr>
-									<Cell head first class="!px-0" />
-									<Cell head>Path</Cell>
-									<Cell head>Value</Cell>
-									<Cell head>Description</Cell>
-									<Cell head>Status</Cell>
-									<Cell head last actions>Actions</Cell>
-								</tr>
-							</Head>
-							<tbody class="divide-y">
-								{#each filteredItems as { path, value, is_secret, description, extra_perms, canWrite, account, is_refreshed, is_expired, refresh_error, is_linked, labels, inherited_labels, ws_specific, draft_only, is_draft }}
-									{@const hasDraft =
-										getLocalDraftHint($workspaceStore, 'variable', path) ?? is_draft}
-									<Row>
-										<Cell class="!px-0 text-center w-12" first>
-											<SharedBadge {canWrite} extraPerms={extra_perms} />
-										</Cell>
-										<Cell>
-											<div class="flex items-center gap-2">
-												<a
-													class="break-all"
-													id="edit-{path}"
-													onclick={() => {
-														handledHash = `#${path}`
-														variableEditor?.editVariable(path)
-													}}
-													href="#{path}"
-												>
-													{path}{hasDraft ? '*' : ''}
-												</a>
-												<DraftBadge {draft_only} is_draft={hasDraft} />
-												{#if labels?.length}
-													{#each labels as label}
-														<Badge
-															color="blue"
-															small
-															class="px-1"
-															title="Label: {label}"
-															clickable
-															onclick={() => {
-																const arr = (filters.val.label ?? '').split(',').filter(Boolean)
-																const idx = arr.indexOf(label)
-																if (idx >= 0) arr.splice(idx, 1)
-																else arr.push(label)
-																const newFilters = { ...filters.val }
-																if (arr.length) newFilters.label = arr.join(',')
-																else delete newFilters.label
-																filters.val = newFilters
-															}}>{label}</Badge
-														>
-													{/each}
-												{/if}
-												<InheritedLabels labels={inherited_labels} />
-											</div>
-										</Cell>
-										<Cell>
-											<span class="inline-flex flex-row items-center gap-2">
-												<div class="text-xs break-words">
-													{#if value}
-														{truncate(value, 20)}
-													{:else}
-														&lowast;&lowast;&lowast;&lowast;
-													{/if}
-												</div>
-												{#if is_secret}
-													<Popover notClickable>
-														<EyeOff size={12} />
-														{#snippet text()}
-															<span>This item is secret</span>
-														{/snippet}
-													</Popover>
-												{/if}
-											</span>
-										</Cell>
-										<Cell class="break-words">
-											<span class="text-xs text-primary">{truncate(description ?? '', 50)} </span>
-										</Cell>
-
-										<Cell class="text-center">
-											<div class="flex flex-row items-center gap-4">
-												{#if is_linked}
-													<Popover notClickable>
-														<Link size={16} />
-														{#snippet text()}
-															<div>
-																This variable is linked with a resource of the same path. They are
-																deleted and renamed together.
-															</div>
-														{/snippet}
-													</Popover>
-												{/if}
-												{#if account}
-													<Popover notClickable>
-														<RefreshCw size={16} />
-														{#snippet text()}
-															<div>
-																This OAuth token will be kept up-to-date in the background by
-																Windmill using its refresh token
-															</div>
-														{/snippet}
-													</Popover>
-												{/if}
-
-												{#if is_refreshed}
-													<div class="">
-														{#if refresh_error}
-															<Popover notClickable>
-																<!-- isolate: confine the ping indicator's z-50 to a local stacking context
-											     so it can't paint over anything that scrolls past it -->
-																<div
-																	class="relative inline-flex justify-center items-center w-4 h-4 isolate"
-																>
-																	<Circle
-																		class="text-red-600 animate-ping absolute z-50 w-4 h-4 fill-current"
-																		size={12}
-																	/>
-																	<Circle
-																		class="text-red-600 relative inline-flex fill-current "
-																		size={12}
-																	/>
-																</div>
-
-																{#snippet text()}
-																	<div>
-																		Latest exchange of the refresh token did not succeed. Error: {refresh_error}
-																	</div>
-																{/snippet}
-															</Popover>
-														{:else if is_expired}
-															<Popover notClickable>
-																<Circle
-																	class="text-yellow-600 animate-[pulse_5s_linear_infinite] fill-current"
-																	size={12}
-																/>
-																{#snippet text()}
-																	<div>
-																		The access_token is expired, it will get renewed the next time
-																		this variable is fetched or you can request is to be refreshed
-																		in the dropdown on the right.
-																	</div>
-																{/snippet}
-															</Popover>
-														{:else}
-															<Popover notClickable>
-																<Circle
-																	class="text-green-600 animate-[pulse_5s_linear_infinite] fill-current"
-																	size={12}
-																/>
-																{#snippet text()}
-																	<div>
-																		The variable was connected through OAuth and the token is not
-																		expired.
-																	</div>
-																{/snippet}
-															</Popover>
-														{/if}
-													</div>
-												{/if}
-											</div>
-										</Cell>
-										<Cell last actions shouldStopPropagation>
-											<Dropdown
-												items={() => {
-													let owner = isOwner(path, $userStore, $workspaceStore)
-													return [
-														{
-															displayName: 'Edit',
-															icon: Pen,
-															action: () => variableEditor?.editVariable(path),
-															disabled: !canWrite || !showCreateButtons
-														},
-														{
-															displayName: 'Delete',
-															icon: Trash,
-															type: 'delete',
-															action: (event) => {
-																if (event['shiftKey']) {
-																	deleteVariable(path, account)
-																} else {
-																	deleteIsLinked = is_linked ?? false
-																	deleteConfirmedCallback = () => {
-																		deleteVariable(path, account)
-																	}
-																}
-															},
-															disabled: !owner || !showCreateButtons
-														},
-														...(!ws_specific &&
-														isDeployable(is_secret ? 'secret' : 'variable', path, deployUiSettings)
-															? [
-																	{
-																		displayName: 'Deploy to prod/staging',
-																		icon: FileUp,
-																		action: () => {
-																			deploymentDrawer?.openDrawer(path, 'variable')
-																		}
-																	}
-																]
-															: []),
-														{
-															displayName: 'Permissions',
-															action: () => {
-																shareModal?.openDrawer(path, 'variable')
-															},
-															icon: Shield
-														},
-														...(account != undefined
-															? [
-																	{
-																		displayName: 'Refresh token',
-																		icon: RefreshCw,
-																		action: async () => {
-																			await OauthService.refreshToken({
-																				workspace: $workspaceStore ?? '',
-																				id: account ?? 0,
-																				requestBody: {
-																					path
-																				}
-																			})
-																			sendUserToast('Token refreshed')
-																			loadVariables()
-																		}
-																	}
-																]
-															: [])
-													]
-												}}
-											/>
-										</Cell>
-									</Row>
-								{/each}
-							</tbody>
-						</DataTable>
-					{/if}
-				</div>
-			{:else if tab == 'contextual'}
-				<div class="overflow-auto">
-					{#if loading.contextual}
-						<Skeleton layout={[0.5, [2], 1]} />
-						{#each new Array(8) as _}
-							<Skeleton layout={[[2.8], 0.5]} />
-						{/each}
-					{:else}
-						<PageHeader title="Custom contextual variables" primary={false} />
-						{#if contextualVariables.filter((x) => x.is_custom).length === 0}
-							<EmptyState
-								icon={DollarSign}
-								title="No custom contextual variables yet"
-								description="Custom contextual variables are passed as environment variables to every script run in this workspace."
-								action={showCreateButtons && ($userStore?.is_admin || $userStore?.is_super_admin)
-									? {
-											label: 'Add a contextual variable',
-											icon: Plus,
-											onClick: () => contextualVariableEditor?.initNew(),
-											aiId: 'variables-empty-add-contextual-variable',
-											aiDescription: 'Add contextual variable'
-										}
-									: undefined}
-							/>
-						{:else}
-							<TableSimple
-								headers={['Name', 'Value']}
-								data={contextualVariables.filter((x) => x.is_custom)}
-								keys={['name', 'value']}
-								getRowActions={$userStore?.is_admin || $userStore?.is_super_admin
-									? (row) => {
-											return [
-												{
-													displayName: 'Edit',
-													action: () => contextualVariableEditor?.editVariable(row.name, row.value)
-												},
-												{
-													displayName: 'Delete',
-													type: 'delete',
-													action: () => {
-														deleteContextualVariable(row)
-													}
-												}
-											]
-										}
-									: undefined}
-							/>
-						{/if}
-						<PageHeader title="Contextual variables" primary={false} />
-						<TableSimple
-							headers={['Name', 'Example of value', 'Description']}
-							data={contextualVariables.filter((x) => !x.is_custom)}
-							keys={['name', 'value', 'description']}
-						/>
-					{/if}
-				</div>
-			{/if}
-		</TabFade>
-	</CenteredPage>
-{/if}
-
-<ConfirmationModal
-	{open}
-	title="Remove variable"
-	confirmationText="Remove"
-	trashbin
-	on:canceled={() => {
-		deleteConfirmedCallback = undefined
-	}}
-	on:confirmed={() => {
-		if (deleteConfirmedCallback) {
-			deleteConfirmedCallback()
-		}
-		deleteConfirmedCallback = undefined
-	}}
->
-	<div class="flex flex-col w-full space-y-4">
-		<span>Are you sure you want to remove this variable?</span>
-		{#if deleteIsLinked}
-			<Alert type="warning" title="Linked resource">
-				This variable is linked with a resource of the same path. The linked resource will also be
-				deleted.
-			</Alert>
-		{/if}
-		<Alert type="info" title="Bypass confirmation">
-			<div>
-				You can press
-				<Badge color="dark-gray">SHIFT</Badge>
-				while removing a variable to bypass confirmation.
-			</div>
-		</Alert>
-	</div>
-</ConfirmationModal>
+<VariablesList />
diff --git a/frontend/src/routes/(root)/(logged)/websocket_triggers/+page.svelte b/frontend/src/routes/(root)/(logged)/websocket_triggers/+page.svelte
index 35a167c296..176c2ccbe5 100644
--- a/frontend/src/routes/(root)/(logged)/websocket_triggers/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/websocket_triggers/+page.svelte
@@ -1,579 +1,5 @@
 <script lang="ts">
-	import { getLocalDraftHint } from '$lib/localDraftHints.svelte'
-	import { run } from 'svelte/legacy'
-
-	import {
-		WebsocketTriggerService,
-		WorkspaceService,
-		type WebsocketTrigger,
-		type TriggerMode,
-		type WorkspaceDeployUISettings
-	} from '$lib/gen'
-	import {
-		canWrite,
-		displayDate,
-		getLocalSetting,
-		sendUserToast,
-		storeLocalSetting,
-		removeTriggerKindIfUnused,
-		capitalize
-	} from '$lib/utils'
-	import { withForkConflictRetry } from '$lib/utils/forkConflict'
-	import { base } from '$app/paths'
-	import { page } from '$app/stores'
-	import CenteredPage from '$lib/components/CenteredPage.svelte'
-	import { Alert, Badge, Button, EmptyState, Skeleton } from '$lib/components/common'
-	import Dropdown from '$lib/components/DropdownV2.svelte'
-	import PageHeader from '$lib/components/PageHeader.svelte'
-	import SharedBadge from '$lib/components/SharedBadge.svelte'
-	import DraftBadge from '$lib/components/DraftBadge.svelte'
-	import ShareModal from '$lib/components/ShareModal.svelte'
-	import Toggle from '$lib/components/Toggle.svelte'
-	import { enterpriseLicense, usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
-	import { Unplug, Code, Eye, Pen, Plus, Shield, Trash, Circle, FileUp, Pause } from 'lucide-svelte'
-	import { goto } from '$lib/navigation'
-	import SearchItems from '$lib/components/SearchItems.svelte'
-	import NoItemFound from '$lib/components/home/NoItemFound.svelte'
-	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
-	import ListFilters from '$lib/components/home/ListFilters.svelte'
-	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
-	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
-	import { setQuery } from '$lib/navigation'
-	import { onDestroy, onMount } from 'svelte'
-	import Popover from '$lib/components/Popover.svelte'
-	import { isCloudHosted } from '$lib/cloud'
-	import WebsocketTriggerEditor from '$lib/components/triggers/websocket/WebsocketTriggerEditor.svelte'
-	import DeployWorkspaceDrawer from '$lib/components/DeployWorkspaceDrawer.svelte'
-	import { ALL_DEPLOYABLE, isDeployable } from '$lib/utils_deployable'
-	import TriggerModeToggle from '$lib/components/triggers/TriggerModeToggle.svelte'
-
-	type TriggerW = WebsocketTrigger & { canWrite: boolean }
-
-	let triggers: TriggerW[] = $state([])
-	let shareModal: ShareModal | undefined = $state()
-	let loading = $state(true)
-	let deploymentDrawer: DeployWorkspaceDrawer | undefined = $state()
-	let deployUiSettings: WorkspaceDeployUISettings | undefined = $state(undefined)
-
-	async function getDeployUiSettings() {
-		if (!$enterpriseLicense) {
-			deployUiSettings = ALL_DEPLOYABLE
-			return
-		}
-		let settings = await WorkspaceService.getPublicSettings({ workspace: $workspaceStore! })
-		deployUiSettings = settings.deploy_ui ?? ALL_DEPLOYABLE
-	}
-	getDeployUiSettings()
-	async function loadTriggers(): Promise<void> {
-		triggers = (
-			await WebsocketTriggerService.listWebsocketTriggers({
-				workspace: $workspaceStore!,
-				includeDraftOnly: true
-			})
-		).map((x) => {
-			return { canWrite: canWrite(x.path, x.extra_perms!, $userStore), ...x }
-		})
-		$usedTriggerKinds = removeTriggerKindIfUnused(triggers.length, 'websockets', $usedTriggerKinds)
-		loading = false
-	}
-
-	let interval = setInterval(async () => {
-		try {
-			const newTriggers = await WebsocketTriggerService.listWebsocketTriggers({
-				workspace: $workspaceStore!
-			})
-			for (let i = 0; i < triggers.length; i++) {
-				const newTrigger = newTriggers.find((x) => x.path === triggers[i].path)
-				if (newTrigger) {
-					triggers[i] = {
-						...triggers[i],
-						error: newTrigger.error,
-						last_server_ping: newTrigger.last_server_ping,
-						mode: newTrigger.mode,
-						server_id: newTrigger.server_id
-					}
-				}
-			}
-		} catch (err) {
-			console.error(err)
-		}
-	}, 5000)
-
-	onDestroy(() => {
-		clearInterval(interval)
-	})
-
-	async function onToggleMode(path: string, mode: TriggerMode): Promise<boolean> {
-		let committed = false
-		try {
-			const ok = await withForkConflictRetry(
-				(force) =>
-					WebsocketTriggerService.setWebsocketTriggerMode({
-						path,
-						workspace: $workspaceStore!,
-						requestBody: { mode, force }
-					}),
-				'websocket trigger'
-			)
-			if (ok) {
-				sendUserToast(`${capitalize(mode)} websocket trigger ${path}`)
-				loadTriggers()
-			}
-			committed = ok
-		} catch (err) {
-			sendUserToast(
-				`Cannot ` +
-					(mode === 'enabled' ? 'enable' : mode === 'disabled' ? 'disable' : 'suspend') +
-					` websocket trigger: ${err.body}`,
-				true
-			)
-			loadTriggers()
-		}
-		return committed
-	}
-
-	run(() => {
-		if ($workspaceStore && $userStore) {
-			loadTriggers()
-		}
-	})
-	let websocketTriggerEditor: WebsocketTriggerEditor | undefined = $state()
-
-	let hashHandled = false
-	$effect(() => {
-		if (!hashHandled && triggers.length > 0 && websocketTriggerEditor) {
-			let hash = $page.url.hash
-			if (hash.length > 1) {
-				let path = hash.slice(1)
-				let trigger = triggers.find((t) => t.path === path)
-				if (trigger) {
-					hashHandled = true
-					websocketTriggerEditor?.openEdit(path, trigger.is_flow)
-				}
-			}
-		}
-	})
-
-	let filteredItems: (TriggerW & { marked?: any })[] | undefined = $state([])
-	let items: typeof filteredItems | undefined = $state([])
-	let preFilteredItems: typeof filteredItems | undefined = $state([])
-	let filter = $state('')
-	let ownerFilter: string | undefined = $state(undefined)
-	let nbDisplayed = $state(15)
-
-	const TRIGGER_PATH_KIND_FILTER_SETTING = 'filter_path_of'
-	const FILTER_USER_FOLDER_SETTING_NAME = 'user_and_folders_only'
-	let selectedFilterKind = $state(
-		(getLocalSetting(TRIGGER_PATH_KIND_FILTER_SETTING) as 'trigger' | 'script_flow') ?? 'trigger'
-	)
-	let filterUserFolders = $state(getLocalSetting(FILTER_USER_FOLDER_SETTING_NAME) == 'true')
-
-	run(() => {
-		storeLocalSetting(TRIGGER_PATH_KIND_FILTER_SETTING, selectedFilterKind)
-	})
-	run(() => {
-		storeLocalSetting(FILTER_USER_FOLDER_SETTING_NAME, filterUserFolders ? 'true' : undefined)
-	})
-
-	function filterItemsPathsBaseOnUserFilters(
-		item: TriggerW,
-		selectedFilterKind: 'trigger' | 'script_flow',
-		filterUserFolders: boolean
-	) {
-		if ($workspaceStore == 'admins') return true
-		if (filterUserFolders) {
-			if (selectedFilterKind === 'trigger') {
-				return (
-					!item.path.startsWith('u/') || item.path.startsWith('u/' + $userStore?.username + '/')
-				)
-			} else {
-				return (
-					!item.script_path.startsWith('u/') ||
-					item.script_path.startsWith('u/' + $userStore?.username + '/')
-				)
-			}
-		} else {
-			return true
-		}
-	}
-
-	run(() => {
-		preFilteredItems =
-			ownerFilter != undefined
-				? selectedFilterKind === 'trigger'
-					? triggers?.filter(
-							(x) =>
-								x.path.startsWith(ownerFilter + '/') &&
-								filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-						)
-					: triggers?.filter(
-							(x) =>
-								x.script_path.startsWith(ownerFilter + '/') &&
-								filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-						)
-				: triggers?.filter((x) =>
-						filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
-					)
-	})
-
-	run(() => {
-		if ($workspaceStore) {
-			ownerFilter = undefined
-		}
-	})
-
-	let owners = $derived(
-		selectedFilterKind === 'trigger'
-			? Array.from(
-					new Set(filteredItems?.map((x) => x.path.split('/').slice(0, 2).join('/')) ?? [])
-				).sort()
-			: Array.from(
-					new Set(filteredItems?.map((x) => x.script_path.split('/').slice(0, 2).join('/')) ?? [])
-				).sort()
-	)
-
-	run(() => {
-		items = filter !== '' ? filteredItems : preFilteredItems
-	})
-
-	function updateQueryFilters(selectedFilterKind, filterUserFolders) {
-		setQuery(
-			TRIGGER_PATH_KIND_FILTER_SETTING,
-			selectedFilterKind,
-			window.location.hash || undefined
-		).then(() => {
-			setQuery(
-				FILTER_USER_FOLDER_SETTING_NAME,
-				String(filterUserFolders),
-				window.location.hash || undefined
-			)
-		})
-	}
-
-	function loadQueryFilters() {
-		let url = new URL(window.location.href)
-		let queryFilterKind = url.searchParams.get(TRIGGER_PATH_KIND_FILTER_SETTING)
-		let queryFilterUserFolders = url.searchParams.get(FILTER_USER_FOLDER_SETTING_NAME)
-		if (queryFilterKind) {
-			selectedFilterKind = queryFilterKind as 'trigger' | 'script_flow'
-		}
-		if (queryFilterUserFolders) {
-			filterUserFolders = queryFilterUserFolders == 'true'
-		}
-	}
-
-	onMount(() => {
-		loadQueryFilters()
-	})
-
-	run(() => {
-		updateQueryFilters(selectedFilterKind, filterUserFolders)
-	})
+	import TriggerList from '$lib/components/triggers/TriggerList.svelte'
 </script>
 
-<DeployWorkspaceDrawer bind:this={deploymentDrawer} />
-<WebsocketTriggerEditor onUpdate={loadTriggers} bind:this={websocketTriggerEditor} />
-
-<SearchItems
-	{filter}
-	items={preFilteredItems}
-	bind:filteredItems
-	f={(x) => (x.summary ?? '') + ' ' + x.path + ' (' + x.script_path + ')'}
-/>
-
-<CenteredPage>
-	<PageHeader
-		title="WebSocket triggers"
-		tooltip="Windmill can listen to WebSocket events and trigger scripts or flows based on them."
-	>
-		<Button
-			unifiedSize="md"
-			variant="accent"
-			startIcon={{ icon: Plus }}
-			on:click={() => websocketTriggerEditor?.openNew(false)}
-		>
-			New&nbsp;WebSocket trigger
-		</Button>
-	</PageHeader>
-
-	{#if isCloudHosted()}
-		<Alert title="Not compatible with multi-tenant cloud" type="warning">
-			WebSocket triggers are disabled in the multi-tenant cloud.
-		</Alert>
-		<div class="py-4"></div>
-	{/if}
-	<div class="w-full h-full flex flex-col">
-		<div class="w-full pb-4 pt-6">
-			<input type="text" placeholder="Search WS triggers" bind:value={filter} class="search-item" />
-			<div class="flex flex-row items-center gap-2 mt-2">
-				<div class="text-xs font-semibold text-emphasis shrink-0"> Filter by path of </div>
-				<ToggleButtonGroup bind:selected={selectedFilterKind}>
-					{#snippet children({ item })}
-						<ToggleButton value="trigger" label="WS trigger" icon={Unplug} {item} />
-						<ToggleButton value="script_flow" label="Script/Flow" icon={Code} {item} />
-					{/snippet}
-				</ToggleButtonGroup>
-			</div>
-			<ListFilters syncQuery bind:selectedFilter={ownerFilter} filters={owners} />
-
-			<div class="flex flex-row items-center justify-end gap-4">
-				{#if $userStore?.is_super_admin && $userStore.username.includes('@')}
-					<Toggle size="xs" bind:checked={filterUserFolders} options={{ right: 'Only f/*' }} />
-				{:else if $userStore?.is_admin || $userStore?.is_super_admin}
-					<Toggle
-						size="xs"
-						bind:checked={filterUserFolders}
-						options={{ right: `Only u/${$userStore.username} and f/*` }}
-					/>
-				{/if}
-			</div>
-		</div>
-		{#if loading}
-			{#each new Array(6) as _}
-				<Skeleton layout={[[6], 0.4]} />
-			{/each}
-		{:else if !triggers?.length}
-			<EmptyState
-				icon={Unplug}
-				title="No WebSocket triggers yet"
-				description="Windmill can listen to WebSocket events and trigger scripts or flows based on them."
-				action={{
-					label: 'Add a WebSocket trigger',
-					icon: Plus,
-					onClick: () => websocketTriggerEditor?.openNew(false),
-					aiId: 'websocket-triggers-empty-add',
-					aiDescription: 'Add WebSocket trigger'
-				}}
-			/>
-		{:else if items?.length}
-			<div class="border rounded-md divide-y">
-				{#each items.slice(0, nbDisplayed) as { path, edited_by, edited_at, script_path, url, is_flow, extra_perms, canWrite, marked, error, last_server_ping, server_id, mode, retry, error_handler_path, error_handler_args, labels, draft_only, is_draft } (path)}
-					{@const hasDraft =
-						getLocalDraftHint($workspaceStore, 'trigger_websocket', path) ?? is_draft}
-					{@const href = `${is_flow ? '/flows/get' : '/scripts/get'}/${script_path}`}
-					{@const ping = last_server_ping ? new Date(last_server_ping) : undefined}
-					{@const pinging = ping && ping.getTime() > new Date().getTime() - 15 * 1000}
-					{@const effectiveMode = draft_only ? 'disabled' : mode}
-					{@const enabled = effectiveMode === 'enabled' || effectiveMode === 'suspended'}
-
-					<div
-						class="hover:bg-surface-hover w-full items-center px-4 py-2 gap-4 first-of-type:!border-t-0
-				first-of-type:rounded-t-md last-of-type:rounded-b-md flex flex-col"
-					>
-						<div class="w-full flex gap-5 items-center">
-							<RowIcon kind={is_flow ? 'flow' : 'script'} />
-
-							<a
-								href="#{path}"
-								onclick={() => websocketTriggerEditor?.openEdit(path, is_flow)}
-								class="min-w-0 grow hover:underline decoration-gray-400"
-							>
-								<div class="text-emphasis flex-wrap text-left text-xs font-semibold mb-1 truncate">
-									{#if marked}
-										<span class="text-xs">
-											{@html marked}
-										</span>
-									{:else}
-										{url.startsWith('$script:')
-											? 'URL: ' + url.replace('$script:', 'result of script ')
-											: url.startsWith('$flow:')
-												? 'URL: ' + url.replace('$flow:', 'result of flow ')
-												: url}
-									{/if}{hasDraft ? '*' : ''}
-								</div>
-								<div class="text-secondary text-xs truncate text-left font-light">
-									{path}
-								</div>
-								<div class="text-secondary text-xs truncate text-left font-light">
-									runnable: {script_path}
-								</div>
-							</a>
-
-							<div class="hidden lg:flex flex-row gap-1 items-center">
-								<SharedBadge {canWrite} extraPerms={extra_perms} />
-								{#if labels?.length}
-									{#each labels as label}
-										<Badge color="blue" small class="px-1" title="Label: {label}">{label}</Badge>
-									{/each}
-								{/if}
-							</div>
-
-							<div class="w-10">
-								{#if (enabled && (!pinging || error)) || (!enabled && error) || (enabled && !server_id)}
-									<Popover notClickable>
-										<span class="flex h-4 w-4">
-											<Circle
-												class="text-red-600 animate-ping absolute inline-flex fill-current"
-												size={12}
-											/>
-											<Circle class="text-red-600 relative inline-flex fill-current" size={12} />
-										</span>
-										{#snippet text()}
-											<div>
-												{#if enabled}
-													{#if !server_id}
-														WebSocket is starting...
-													{:else}
-														WebSocket is not connected{error ? ': ' + error : ''}
-													{/if}
-												{:else}
-													WebSocket was disabled because of an error: {error}
-												{/if}
-											</div>
-										{/snippet}
-									</Popover>
-								{:else if enabled}
-									<Popover notClickable>
-										<span class="flex h-4 w-4">
-											<Circle class="text-green-600 relative inline-flex fill-current" size={12} />
-										</span>
-										{#snippet text()}
-											<div>
-												WebSocket is connected{!server_id ? ' (shutting down...)' : ''}
-											</div>
-										{/snippet}
-									</Popover>
-								{/if}
-							</div>
-
-							<div class="flex items-center justify-end gap-2 shrink-0 min-w-[8rem]">
-								<DraftBadge {draft_only} is_draft={hasDraft} />
-								<TriggerModeToggle
-									disabled={draft_only}
-									title={draft_only
-										? 'Draft only: deploy the trigger to enable it'
-										: hasDraft
-											? 'Enables/disables the deployed trigger; the draft is not affected'
-											: undefined}
-									onToggleMode={(newMode) => onToggleMode(path, newMode)}
-									triggerMode={effectiveMode}
-									includeModalConfig={{
-										triggerPath: path,
-										triggerKind: 'websocket',
-										runnableConfig: {
-											path: script_path,
-											kind: is_flow ? 'flow' : 'script',
-											retry,
-											errorHandlerPath: error_handler_path,
-											errorHandlerArgs: error_handler_args
-										}
-									}}
-									{canWrite}
-									hideToggleLabels
-									hideDropdown
-								/>
-							</div>
-
-							<div class="flex gap-2 items-center justify-end">
-								<Button
-									on:click={() => websocketTriggerEditor?.openEdit(path, is_flow)}
-									size="xs"
-									startIcon={canWrite
-										? { icon: Pen }
-										: {
-												icon: Eye
-											}}
-									variant="subtle"
-								>
-									{canWrite ? 'Edit' : 'View'}
-								</Button>
-								<Dropdown
-									items={[
-										{
-											displayName: `View ${is_flow ? 'Flow' : 'Script'}`,
-											icon: Eye,
-											action: () => {
-												goto(href)
-											}
-										},
-										...(canWrite && !draft_only && mode !== 'suspended'
-											? [
-													{
-														displayName: 'Suspend job execution',
-														icon: Pause,
-														action: () => {
-															onToggleMode(path, 'suspended')
-														}
-													}
-												]
-											: []),
-										{
-											displayName: canWrite ? 'Edit' : 'View',
-											icon: canWrite ? Pen : Eye,
-											action: () => {
-												websocketTriggerEditor?.openEdit(path, is_flow)
-											}
-										},
-										...(isDeployable('trigger', path, deployUiSettings)
-											? [
-													{
-														displayName: 'Deploy to prod/staging',
-														icon: FileUp,
-														action: () => {
-															deploymentDrawer?.openDrawer(path, 'trigger', {
-																triggers: {
-																	kind: 'websockets'
-																}
-															})
-														}
-													}
-												]
-											: []),
-										{
-											displayName: 'Audit logs',
-											icon: Eye,
-											href: `${base}/audit_logs?resource=${path}`
-										},
-										{
-											displayName: 'Permissions',
-											icon: Shield,
-											action: () => {
-												shareModal?.openDrawer(path, 'websocket_trigger')
-											}
-										},
-										{
-											displayName: 'Delete',
-											type: 'delete',
-											icon: Trash,
-											disabled: !canWrite,
-											action: async () => {
-												await WebsocketTriggerService.deleteWebsocketTrigger({
-													workspace: $workspaceStore ?? '',
-													path
-												})
-												loadTriggers()
-											}
-										}
-									]}
-								/>
-							</div>
-						</div>
-						<div class="w-full flex justify-between items-baseline">
-							<div
-								class="flex flex-wrap text-[0.7em] text-primary gap-1 items-center justify-end truncate pr-2"
-								>{#if edited_by}<div class="truncate">edited by {edited_by}</div>{/if}<div
-									class="truncate">{edited_by ? 'the ' : ''}{displayDate(edited_at)}</div
-								></div
-							></div
-						>
-					</div>
-				{/each}
-			</div>
-		{:else}
-			<NoItemFound />
-		{/if}
-	</div>
-	{#if items && items?.length > 15 && nbDisplayed < items.length}
-		<span class="text-xs"
-			>{nbDisplayed} items out of {items.length}
-			<button class="ml-4" onclick={() => (nbDisplayed += 30)}>load 30 more</button></span
-		>
-	{/if}
-</CenteredPage>
-
-<ShareModal
-	bind:this={shareModal}
-	on:change={() => {
-		loadTriggers()
-	}}
-/>
+<TriggerList triggerKind="websocket" />
diff --git a/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte b/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte
index 424aa0267e..f055e92ca3 100644
--- a/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte
@@ -8,8 +8,11 @@
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
 
 	import DeployToSetting from '$lib/components/DeployToSetting.svelte'
+	import RemoteDeployTargetSetting from '$lib/components/RemoteDeployTargetSetting.svelte'
 	import DevWorkspaceSetting from '$lib/components/DevWorkspaceSetting.svelte'
-	import ErrorOrRecoveryHandler from '$lib/components/ErrorOrRecoveryHandler.svelte'
+	import ErrorOrRecoveryHandler, {
+		handlerFullPath
+	} from '$lib/components/ErrorOrRecoveryHandler.svelte'
 	import PageHeader from '$lib/components/PageHeader.svelte'
 	import ScriptPicker from '$lib/components/ScriptPicker.svelte'
 
@@ -517,7 +520,7 @@
 				webhook = ''
 			}
 		} catch (error) {
-			sendUserToast(`Failed to save webhook: ${error}`, true)
+			sendUserToast(`Failed to save webhook: ${error?.body ?? error}`, true)
 		}
 	}
 
@@ -906,7 +909,7 @@
 			await WorkspaceService.editErrorHandler({
 				workspace: $workspaceStore!,
 				requestBody: {
-					path: `${errorHandlerItemKind}/${errorHandlerScriptPath}`,
+					path: handlerFullPath(errorHandlerSelected, errorHandlerItemKind, errorHandlerScriptPath),
 					extra_args: errorHandlerExtraArgs,
 					muted_on_cancel: errorHandlerMutedOnCancel,
 					muted_on_user_path: errorHandlerMutedOnUserPath,
@@ -1552,6 +1555,12 @@
 									</Button>
 								</div>
 							</div>
+							<!-- The other destination the lineage cannot express: a workspace on another
+							     instance. Its own section, since it needs a credential per person. -->
+							<div class="flex flex-col gap-2 max-w-2xl mt-8 pt-6 border-t">
+								<span class="text-xs font-semibold text-emphasis">Deploy to another instance</span>
+								<RemoteDeployTargetSetting />
+							</div>
 						{:else if tab == 'rulesets'}
 							<SettingsPageHeader
 								title="Workspace Protection Rulesets"
diff --git a/frontend/src/routes/kitchen_sink/+page.svelte b/frontend/src/routes/kitchen_sink/+page.svelte
index b3ae4ef196..e21f9da550 100644
--- a/frontend/src/routes/kitchen_sink/+page.svelte
+++ b/frontend/src/routes/kitchen_sink/+page.svelte
@@ -4,6 +4,7 @@
 	import TabContent from '$lib/components/common/tabs/TabContent.svelte'
 	import Tabs from '$lib/components/common/tabs/Tabs.svelte'
 	import DarkModeToggle from '$lib/components/sidebar/DarkModeToggle.svelte'
+	import Toggle from '$lib/components/Toggle.svelte'
 	import GfmMarkdown from '$lib/components/GfmMarkdown.svelte'
 	import AssistantMessage from '$lib/components/copilot/chat/AssistantMessage.svelte'
 	import type { DisplayMessage } from '$lib/components/copilot/chat/shared'
@@ -133,12 +134,23 @@ That's the full round-trip.`
 		role: 'assistant',
 		content: chatSampleContent
 	}
+
+	const toggleSizes = ['2xs', 'xs', 'sm', 'md'] as const
+	const toggleColors = ['blue', 'red', 'nord'] as const
+	// The knob's gap against the track border is thin enough that it only misreads once the
+	// track lands between device pixels, which needs a 1x screen. These offsets put one row of
+	// each size on every quarter-pixel so the worst case is on the page rather than left to
+	// whichever label widths a real view happens to have.
+	const subpixelOffsets = [0, 0.25, 0.5, 0.75]
+	let toggleChecked = $state(true)
+	let toggleDisabled = $state(false)
 </script>
 
 <DarkModeToggle forcedDarkMode={false} />
 
 <Tabs bind:selected={tab}>
 	<Tab value="button" label="Buttons" />
+	<Tab value="toggle" label="Toggles" />
 	<Tab value="markdown" label="Markdown" />
 	<Tab value="chat" label="AI Chat" />
 	<Tab value="scrollbar" label="Scrollbar" />
@@ -195,6 +207,77 @@ That's the full round-trip.`
 				<Button variant="default" {dropdownItems}>Lorem</Button>
 			</div>
 		</TabContent>
+		<TabContent value="toggle" class="p-4 flex gap-6 flex-col">
+			<div class="flex flex-row items-center gap-4">
+				<Toggle bind:checked={toggleChecked} options={{ right: 'Checked' }} size="xs" />
+				<Toggle bind:checked={toggleDisabled} options={{ right: 'Disabled' }} size="xs" />
+			</div>
+
+			<div>
+				<div class="font-bold text-md mb-2">Sizes</div>
+				<div class="flex flex-row items-center gap-6">
+					{#each toggleSizes as size}
+						<Toggle
+							{size}
+							checked={toggleChecked}
+							disabled={toggleDisabled}
+							options={{ right: size }}
+						/>
+					{/each}
+				</div>
+			</div>
+
+			<div>
+				<div class="font-bold text-md mb-2">Colors</div>
+				<div class="flex flex-row items-center gap-6">
+					{#each toggleColors as color}
+						<Toggle
+							{color}
+							checked={toggleChecked}
+							disabled={toggleDisabled}
+							options={{ right: color }}
+						/>
+					{/each}
+				</div>
+			</div>
+
+			<div>
+				<div class="font-bold text-md mb-2">Labels</div>
+				<div class="flex flex-row items-center gap-6">
+					<Toggle checked={toggleChecked} disabled={toggleDisabled} />
+					<Toggle
+						checked={toggleChecked}
+						disabled={toggleDisabled}
+						options={{ left: 'Left', right: 'Right' }}
+					/>
+					<Toggle
+						checked={toggleChecked}
+						disabled={toggleDisabled}
+						options={{ right: 'With a tooltip', rightTooltip: 'Tooltip body' }}
+					/>
+					<Toggle checked={toggleChecked} disabled eeOnly options={{ right: 'EE only' }} />
+				</div>
+			</div>
+
+			<div>
+				<div class="font-bold text-md mb-2">Quarter-pixel offsets</div>
+				<div class="text-xs text-tertiary mb-2">
+					Zoom a 1x screen in on these: the knob must keep a visible ring of track on every side in
+					both states. It reads as overflowing the track once that ring drops below a device pixel.
+				</div>
+				<div class="flex flex-col gap-2">
+					{#each toggleSizes as size}
+						<div class="flex flex-row items-center gap-6">
+							{#each subpixelOffsets as offset}
+								<div style="padding-left: {offset}px">
+									<Toggle {size} checked={toggleChecked} disabled={toggleDisabled} />
+								</div>
+							{/each}
+						</div>
+					{/each}
+				</div>
+			</div>
+		</TabContent>
 		<TabContent value="markdown" class="p-4">
 			<div class="text-xs text-tertiary mb-3">
 				The three <code>markdownProse</code> presets, same source. Each is sized for its own
diff --git a/frontend/src/routes/test_dev/diff-comparison/+page.svelte b/frontend/src/routes/test_dev/diff-comparison/+page.svelte
new file mode 100644
index 0000000000..c473dbcb64
--- /dev/null
+++ b/frontend/src/routes/test_dev/diff-comparison/+page.svelte
@@ -0,0 +1,139 @@
+<script lang="ts">
+	import { Button } from '$lib/components/common'
+	import DiffEditor from '$lib/components/DiffEditor.svelte'
+	import ToolCodeDiffView from '$lib/components/copilot/chat/ToolCodeDiffView.svelte'
+	import type { ToolCodeDiff } from '$lib/components/copilot/chat/shared'
+
+	type ComparisonCase = {
+		id: string
+		label: string
+		diff: ToolCodeDiff
+	}
+
+	const stableLines = Array.from(
+		{ length: 14 },
+		(_, index) => `	const stableValue${index + 1} = getStableValue(${index + 1})`
+	)
+
+	const cases: ComparisonCase[] = [
+		{
+			id: 'typescript-replacement',
+			label: 'TypeScript replacement',
+			diff: {
+				lang: 'typescript',
+				before: `export function greeting(name: string) {
+	return \`Hello, \${name}\`
+}`,
+				after: `export function greeting(name: string) {
+	const message = \`Hello, \${name}!\`
+	return message
+}`
+			}
+		},
+		{
+			id: 'long-unchanged-sections',
+			label: 'Long unchanged sections',
+			diff: {
+				lang: 'typescript',
+				before: [
+					'export function buildSummary() {',
+					...stableLines,
+					'\treturn formatSummary("draft")',
+					'}'
+				].join('\n'),
+				after: [
+					'export function buildSummary() {',
+					...stableLines,
+					'\treturn formatSummary("published")',
+					'}'
+				].join('\n')
+			}
+		},
+		{
+			id: 'json-structure',
+			label: 'JSON structure',
+			diff: {
+				lang: 'json',
+				before: `{
+	"name": "daily-report",
+	"schedule": "0 9 * * 1-5",
+	"enabled": false
+}`,
+				after: `{
+	"name": "daily-report",
+	"schedule": "0 9 * * 1-5",
+	"timezone": "Europe/Paris",
+	"enabled": true
+}`
+			}
+		},
+		{
+			id: 'python-add-remove',
+			label: 'Python additions and removals',
+			diff: {
+				lang: 'python',
+				before: `def notify(users):
+	for user in users:
+		send_email(user, "Weekly update")
+
+	return len(users)`,
+				after: `def notify(users):
+	active_users = [user for user in users if user.active]
+	for user in active_users:
+		send_email(user, "Your weekly update")
+
+	return len(active_users)`
+			}
+		}
+	]
+
+	let activeCaseId = $state(cases[0].id)
+	let activeCase = $derived(cases.find((item) => item.id === activeCaseId) ?? cases[0])
+</script>
+
+<svelte:head>
+	<title>Diff comparison</title>
+</svelte:head>
+
+<main class="mx-auto max-w-[1440px] p-6">
+	<div class="mb-5 flex flex-wrap gap-2">
+		{#each cases as item}
+			<Button
+				unifiedSize="xs"
+				variant="subtle"
+				selected={activeCaseId === item.id}
+				aria-pressed={activeCaseId === item.id}
+				onclick={() => (activeCaseId = item.id)}>{item.label}</Button
+			>
+		{/each}
+	</div>
+
+	<div class="grid gap-5 lg:grid-cols-2">
+		<section class="min-w-0">
+			<h1 class="mb-2 text-sm font-semibold">Monaco</h1>
+			<div class="h-[400px] overflow-hidden border border-slate-200 bg-white">
+				{#key activeCase.id}
+					<DiffEditor
+						className="h-full"
+						defaultLang={activeCase.diff.lang}
+						defaultModifiedLang={activeCase.diff.lang}
+						defaultOriginal={activeCase.diff.before}
+						defaultModified={activeCase.diff.after}
+						inlineDiff
+						open
+						readOnly
+					/>
+				{/key}
+			</div>
+		</section>
+
+		<section class="min-w-0">
+			<h2 class="mb-2 text-sm font-semibold">Native</h2>
+			<div class="h-[400px] overflow-auto border border-slate-200 bg-white">
+				{#key activeCase.id}
+					<ToolCodeDiffView diff={activeCase.diff} />
+				{/key}
+			</div>
+		</section>
+	</div>
+</main>
diff --git a/frontend/tailwind.config.cjs b/frontend/tailwind.config.cjs
index a5aea63715..5c623fbadc 100644
--- a/frontend/tailwind.config.cjs
+++ b/frontend/tailwind.config.cjs
@@ -603,6 +603,12 @@ const config = {
 					backgroundColor: 'rgb(var(--color-surface-primary))',
 					color: 'rgb(var(--color-text-primary))',
 
+					// Sidebar rail chrome — consumed via var(--sidebar-bg-light) (see sidebarChrome.ts).
+					// The `-base` vars hold the theme's color; the accent (accentColor.ts) tints
+					// `--sidebar-bg-*` from them, which a self-reference could not do.
+					'--sidebar-bg-light-base': '#F3F3F7',
+					'--sidebar-bg-light': 'var(--sidebar-bg-light-base)',
+
 					'--vscode-editorSuggestWidget-background': '#f3f3f3',
 					'--vscode-editorHoverWidget-foreground': '#616161',
 					'--vscode-editorHoverWidget-border': '#c8c8c8',
@@ -622,7 +628,8 @@ const config = {
 						...darkColorVariables,
 
 						// Sidebar rail chrome — consumed via var(--sidebar-bg-dark) (see sidebarChrome.ts).
-						'--sidebar-bg-dark': '#1e232e',
+						'--sidebar-bg-dark-base': '#1e232e',
+						'--sidebar-bg-dark': 'var(--sidebar-bg-dark-base)',
 
 						'--vscode-editorSuggestWidget-background': '#252526',
 						'--vscode-editorHoverWidget-foreground': '#cccccc',
@@ -638,7 +645,7 @@ const config = {
 						// GitHub's canvas.inset — the authentic recessed surface, sitting below
 						// the canvas (#0d1117) like the sidebar-vs-primary relationship in the
 						// default dark theme.
-						'--sidebar-bg-dark': '#010409',
+						'--sidebar-bg-dark-base': '#010409',
 
 						// Monaco popup chrome — the &.dark defaults above are VS Code's greys;
 						// override so the widgets match the GitHub Dark palette in this variant.
diff --git a/frontend/vite.config.js b/frontend/vite.config.js
index 0140c38739..36c353e28a 100644
--- a/frontend/vite.config.js
+++ b/frontend/vite.config.js
@@ -6,7 +6,10 @@ import mkcert from 'vite-plugin-mkcert'
 
 const file = fileURLToPath(new URL('package.json', import.meta.url))
 const json = readFileSync(file, 'utf8')
-const version = JSON.parse(json)
+// Only the version is exposed to the client (see `define` below). Defining the
+// whole parsed package.json would inline it — scripts, dependency lists, ... —
+// into every chunk that reads `__pkg__.version`.
+const { version } = JSON.parse(json)
 
 // The postinstall downloads the pinned UI Builder artifact into static/ui_builder,
 // which SvelteKit serves at /ui_builder. Serve that directly; only proxy to a
@@ -278,7 +281,7 @@ const config = {
 		assertAcyclicChunks(),
 		assertLeanPublicAppRoutes()
 	],
-	define: { __pkg__: version },
+	define: { '__pkg__.version': JSON.stringify(version) },
 	optimizeDeps: {
 		include: ['highlight.js', 'highlight.js/lib/core', 'monaco-vim'],
 		exclude: [
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 054896a5ce..79d2672f4a 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.814.0"
+wmill = ">=1.817.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/multiplayer/package-lock.json b/multiplayer/package-lock.json
index 0d8c1985ce..532dbd226e 100644
--- a/multiplayer/package-lock.json
+++ b/multiplayer/package-lock.json
@@ -47,9 +47,9 @@
       }
     },
     "node_modules/ws": {
-      "version": "8.19.0",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.19.0.tgz",
-      "integrity": "sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==",
+      "version": "8.21.3",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.3.tgz",
+      "integrity": "sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw==",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"
@@ -88,9 +88,9 @@
       }
     },
     "node_modules/y-websocket": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/y-websocket/-/y-websocket-3.0.0.tgz",
-      "integrity": "sha512-mUHy7AzkOZ834T/7piqtlA8Yk6AchqKqcrCXjKW8J1w2lPtRDjz8W5/CvXz9higKAHgKRKqpI3T33YkRFLkPtg==",
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/y-websocket/-/y-websocket-3.1.0.tgz",
+      "integrity": "sha512-ZNzwH84Ysxv7zjpFNZHjTJvrBZgcAqMljTe+6zrWciAML9LQ18aVylyPNH9faxCXqEOV8I0JY4TGtrIHFX+Xwg==",
       "license": "MIT",
       "dependencies": {
         "lib0": "^0.2.102",
@@ -109,9 +109,9 @@
       }
     },
     "node_modules/yjs": {
-      "version": "13.6.29",
-      "resolved": "https://registry.npmjs.org/yjs/-/yjs-13.6.29.tgz",
-      "integrity": "sha512-kHqDPdltoXH+X4w1lVmMtddE3Oeqq48nM40FD5ojTd8xYhQpzIDcfE2keMSU5bAgRPJBe225WTUdyUgj1DtbiQ==",
+      "version": "13.6.32",
+      "resolved": "https://registry.npmjs.org/yjs/-/yjs-13.6.32.tgz",
+      "integrity": "sha512-lfiJIIC4Xayt5ItynE407ehlE03pCjeOc4hkR4yxxvvNJ4kuiN25B0g+Qp8XagYz361LLL7DCzR5bvFJ81QKtQ==",
       "license": "MIT",
       "dependencies": {
         "lib0": "^0.2.99"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 73c11300d7..48f573bab1 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.814.0
+  version: 1.817.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index 7abe5afa7c..ad6c0e8bc1 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.814.0'
+    ModuleVersion     = '1.817.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index ad591ded27..baab12d832 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.814.0"
+version = "1.817.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/python-client/wmill/uv.lock b/python-client/wmill/uv.lock
index 6c1c3ab219..1c366b42bd 100644
--- a/python-client/wmill/uv.lock
+++ b/python-client/wmill/uv.lock
@@ -79,11 +79,11 @@ wheels = [
 
 [[package]]
 name = "idna"
-version = "3.11"
+version = "3.19"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/6f/6d/0703ccc57f3a7233505399edb88de3cbd678da106337b9fcde432b65ed60/idna-3.11.tar.gz", hash = "sha256:795dafcc9c04ed0c1fb032c2aa73654d8e8c5023a7df64a53f39190ada629902", size = 194582, upload-time = "2025-10-12T14:55:20.501Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/5f/f7/abb373e5757eaec4b922b92f97ec8d6d7e057cf06778247604fbc4e7c3f3/idna-3.19.tar.gz", hash = "sha256:5e0811a4383b21dc5838069f801c4fb62113b7447663d2530d2bd6e77b49bf15", size = 215237, upload-time = "2026-08-18T05:14:24.27Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/0e/61/66938bbb5fc52dbdf84594873d5b51fb1f7c7794e9c0f5bd885f30bc507b/idna-3.11-py3-none-any.whl", hash = "sha256:771a87f49d9defaf64091e6e6fe9c18d4833f140bd19464795bc32d966ca37ea", size = 71008, upload-time = "2025-10-12T14:55:18.883Z" },
+    { url = "https://files.pythonhosted.org/packages/57/b0/0e52c878c53f245edd3a11020f20979b3f490f245af532c7cae3027754b5/idna-3.19-py3-none-any.whl", hash = "sha256:815e7be7a7806d54abb586dc943addc79e8b2ee16915059658cbeff4b1b43bf4", size = 68550, upload-time = "2026-08-18T05:14:22.343Z" },
 ]
 
 [[package]]
@@ -115,16 +115,16 @@ wheels = [
 
 [[package]]
 name = "pygments"
-version = "2.19.2"
+version = "2.21.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/b0/77/a5b8c569bf593b0140bde72ea885a803b82086995367bf2037de0159d924/pygments-2.19.2.tar.gz", hash = "sha256:636cb2477cec7f8952536970bc533bc43743542f70392ae026374600add5b887", size = 4968631, upload-time = "2025-06-21T13:39:12.283Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/49/2e/ced460408999b33da6b31b0021b0f37d329e202d4169aeb164493778f25b/pygments-2.21.0.tar.gz", hash = "sha256:610ca751c9bc2492b38eb9a38a7fbc93edbbb2d7182edaf34e66ae493dee5c8c", size = 5005329, upload-time = "2026-08-17T08:02:48.824Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/c7/21/705964c7812476f378728bdf590ca4b771ec72385c533964653c68e86bdc/pygments-2.19.2-py3-none-any.whl", hash = "sha256:86540386c03d588bb81d44bc3928634ff26449851e99741617ecb9037ee5ec0b", size = 1225217, upload-time = "2025-06-21T13:39:07.939Z" },
+    { url = "https://files.pythonhosted.org/packages/71/46/17f022dd3e953bf20a04a028a21ec746d942f8d2af30fa0f124fa0e6a684/pygments-2.21.0-py3-none-any.whl", hash = "sha256:2363c69b61c4a97c838da3b130dcd6468f4848992b21a82f2a63ec34377137d9", size = 1250147, upload-time = "2026-08-17T08:02:44.912Z" },
 ]
 
 [[package]]
 name = "pytest"
-version = "9.0.2"
+version = "9.1.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "colorama", marker = "sys_platform == 'win32'" },
@@ -133,7 +133,7 @@ dependencies = [
     { name = "pluggy" },
     { name = "pygments" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/d1/db/7ef3487e0fb0049ddb5ce41d3a49c235bf9ad299b6a25d5780a89f19230f/pytest-9.0.2.tar.gz", hash = "sha256:75186651a92bd89611d1d9fc20f0b4345fd827c41ccd5c299a868a05d70edf11", size = 1568901, upload-time = "2025-12-06T21:30:51.014Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/e4/47/b9efed96c114afcfa3c9d3fe98a76a1d14c74a9e266d397cf6eb64be5e01/pytest-9.1.1.tar.gz", hash = "sha256:1088fbde8f2b49d95a549a195707afa7a76a3ce9bcadc26b6d71f0ffda5fe313", size = 1636369, upload-time = "2026-06-19T10:58:32.857Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/3b/ab/b3226f0bd7cdcf710fbede2b3548584366da3b19b5021e74f5bde2a8fa3f/pytest-9.0.2-py3-none-any.whl", hash = "sha256:711ffd45bf766d5264d487b917733b453d917afd2b0ad65223959f59089f875b", size = 374801, upload-time = "2025-12-06T21:30:49.154Z" },
+    { url = "https://files.pythonhosted.org/packages/24/25/1de2678b631f5a49215c6c96fff41ba892b0a34df68d6d80292b1b48aa7f/pytest-9.1.1-py3-none-any.whl", hash = "sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c", size = 386536, upload-time = "2026-06-19T10:58:31.347Z" },
 ]
diff --git a/python-client/wmill/wmill/client.py b/python-client/wmill/wmill/client.py
index dbc9d9b193..81e5b34e16 100644
--- a/python-client/wmill/wmill/client.py
+++ b/python-client/wmill/wmill/client.py
@@ -1430,16 +1430,19 @@ class Windmill:
             },
         )
 
-    def datatable(self, name: str = "main"):
+    def datatable(self, name: str = "main", *, role: Optional[str] = None):
         """Get a DataTable client for SQL queries.
 
         Args:
             name: Database name (default: "main")
+            role: Connect as this data table role instead of the data table's default one.
+                Only meaningful on a data table under roles, and only for a role you are a
+                tenant of.
 
         Returns:
             DataTableClient instance
         """
-        return DataTableClient(self, name)
+        return DataTableClient(self, name, role=role)
 
     def ducklake(self, name: str = "main"):
         """Get a DuckLake client for DuckDB queries.
@@ -2278,16 +2281,17 @@ def username_to_email(username: str) -> str:
 
 
 @init_global_client
-def datatable(name: str = "main") -> DataTableClient:
+def datatable(name: str = "main", *, role: Optional[str] = None) -> DataTableClient:
     """Get a DataTable client for SQL queries.
 
     Args:
         name: Database name (default: "main")
+        role: Connect as this data table role instead of the data table's default one.
 
     Returns:
         DataTableClient instance
     """
-    return _client.datatable(name)
+    return _client.datatable(name, role=role)
 
 @init_global_client
 def ducklake(name: str = "main") -> DucklakeClient:
@@ -2362,17 +2366,28 @@ def stream_result(stream) -> None:
     for text in stream:
         append_to_result_stream(text)
 
+# Interpolated into a `-- role <name>` line, so a value carrying a newline could append
+# statements of its own. Mirrors the server's own role-name rule.
+_ROLE_NAME_RE = re.compile(r"^[A-Za-z0-9_-]{1,63}$")
+
+
 class DataTableClient:
     """Client for executing SQL queries against Windmill DataTables."""
 
-    def __init__(self, client: Windmill, name: str):
+    def __init__(self, client: Windmill, name: str, role: Optional[str] = None):
         """Initialize DataTableClient.
 
         Args:
             client: Windmill client instance
             name: DataTable name
+            role: Data table role to connect as, or None for the data table's default
         """
+        if role is not None and not _ROLE_NAME_RE.match(role):
+            raise ValueError(
+                f"Invalid data table role '{role}': only letters, digits, '_' and '-' are allowed"
+            )
         self.client = client
+        self.role = role
         self.name, self.schema = parse_sql_client_name(name)
     def query(self, sql: str, *args) -> SqlQuery:
         """Execute a SQL query against the DataTable.
@@ -2393,6 +2408,9 @@ class DataTableClient:
             args_dict[f"arg{i+1}"] = arg
             args_def += f"-- ${i+1} arg{i+1} ({infer_sql_type(arg)})\n"
         sql = args_def + sql
+        # Must lead: the executor's annotation parser stops at the first non-comment line.
+        if self.role is not None:
+            sql = f"-- role {self.role}\n" + sql
         return SqlQuery(
             sql,
             lambda sql: self.client.run_inline_script_preview(
diff --git a/rust-client/.gitignore b/rust-client/.gitignore
index 4924b1576c..777fcbdb05 100644
--- a/rust-client/.gitignore
+++ b/rust-client/.gitignore
@@ -1,3 +1,5 @@
 windmill-api/
 windmill_api/
 api/
+# library crate: the lockfile is regenerated by dev.nu and not consumed by downstream users
+Cargo.lock
diff --git a/rust-client/Cargo.lock b/rust-client/Cargo.lock
deleted file mode 100644
index 54464b9aa2..0000000000
--- a/rust-client/Cargo.lock
+++ /dev/null
@@ -1,1857 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 4
-
-[[package]]
-name = "addr2line"
-version = "0.24.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfbe277e56a376000877090da837660b4427aad530e3028d44e0bffe4f89a1c1"
-dependencies = [
- "gimli",
-]
-
-[[package]]
-name = "adler2"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "512761e0bb2578dd7380c6baaa0f4ce03e84f95e960231d1dec8bf4d7d6e2627"
-
-[[package]]
-name = "android-tzdata"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e999941b234f3131b00bc13c22d06e8c5ff726d1b6318ac7eb276997bbb4fef0"
-
-[[package]]
-name = "android_system_properties"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "anyhow"
-version = "1.0.98"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e16d2d3311acee920a9eb8d33b8cbc1787ce4a264e85f964c2404b969bdcd487"
-
-[[package]]
-name = "autocfg"
-version = "1.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
-
-[[package]]
-name = "backtrace"
-version = "0.3.75"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6806a6321ec58106fea15becdad98371e28d92ccbc7c8f1b3b6dd724fe8f1002"
-dependencies = [
- "addr2line",
- "cfg-if",
- "libc",
- "miniz_oxide",
- "object",
- "rustc-demangle",
- "windows-targets",
-]
-
-[[package]]
-name = "base64"
-version = "0.22.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
-
-[[package]]
-name = "bitflags"
-version = "2.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b8e56985ec62d17e9c1001dc89c88ecd7dc08e47eba5ec7c29c7b5eeecde967"
-
-[[package]]
-name = "bumpalo"
-version = "3.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1628fb46dfa0b37568d12e5edd512553eccf6a22a78e8bde00bb4aed84d5bdbf"
-
-[[package]]
-name = "bytes"
-version = "1.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
-
-[[package]]
-name = "cc"
-version = "1.2.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d487aa071b5f64da6f19a3e848e3578944b726ee5a4854b82172f02aa876bfdc"
-dependencies = [
- "shlex",
-]
-
-[[package]]
-name = "cfg-if"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
-
-[[package]]
-name = "cfg_aliases"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
-
-[[package]]
-name = "chrono"
-version = "0.4.41"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c469d952047f47f91b68d1cba3f10d63c11d73e4636f24f08daf0278abf01c4d"
-dependencies = [
- "android-tzdata",
- "iana-time-zone",
- "num-traits",
- "serde",
- "windows-link",
-]
-
-[[package]]
-name = "core-foundation-sys"
-version = "0.8.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
-
-[[package]]
-name = "darling"
-version = "0.20.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc7f46116c46ff9ab3eb1597a45688b6715c6e628b5c133e288e709a29bcb4ee"
-dependencies = [
- "darling_core",
- "darling_macro",
-]
-
-[[package]]
-name = "darling_core"
-version = "0.20.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d00b9596d185e565c2207a0b01f8bd1a135483d02d9b7b0a54b11da8d53412e"
-dependencies = [
- "fnv",
- "ident_case",
- "proc-macro2",
- "quote",
- "strsim",
- "syn",
-]
-
-[[package]]
-name = "darling_macro"
-version = "0.20.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead"
-dependencies = [
- "darling_core",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "deranged"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c9e6a11ca8224451684bc0d7d5a7adbf8f2fd6887261a1cfc3c0432f9d4068e"
-dependencies = [
- "powerfmt",
- "serde",
-]
-
-[[package]]
-name = "displaydoc"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "dyn-clone"
-version = "1.0.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c7a8fb8a9fbf66c1f703fe16184d10ca0ee9d23be5b4436400408ba54a95005"
-
-[[package]]
-name = "equivalent"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
-
-[[package]]
-name = "fnv"
-version = "1.0.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
-
-[[package]]
-name = "form_urlencoded"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13624c2627564efccf4934284bdd98cbaa14e79b0b5a141218e507b3a823456"
-dependencies = [
- "percent-encoding",
-]
-
-[[package]]
-name = "futures"
-version = "0.3.31"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65bc07b1a8bc7c85c5f2e110c476c7389b4554ba72af57d8445ea63a576b0876"
-dependencies = [
- "futures-channel",
- "futures-core",
- "futures-executor",
- "futures-io",
- "futures-sink",
- "futures-task",
- "futures-util",
-]
-
-[[package]]
-name = "futures-channel"
-version = "0.3.31"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dff15bf788c671c1934e366d07e30c1814a8ef514e1af724a602e8a2fbe1b10"
-dependencies = [
- "futures-core",
- "futures-sink",
-]
-
-[[package]]
-name = "futures-core"
-version = "0.3.31"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05f29059c0c2090612e8d742178b0580d2dc940c837851ad723096f87af6663e"
-
-[[package]]
-name = "futures-executor"
-version = "0.3.31"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e28d1d997f585e54aebc3f97d39e72338912123a67330d723fdbb564d646c9f"
-dependencies = [
- "futures-core",
- "futures-task",
- "futures-util",
-]
-
-[[package]]
-name = "futures-io"
-version = "0.3.31"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e5c1b78ca4aae1ac06c48a526a655760685149f0d465d21f37abfe57ce075c6"
-
-[[package]]
-name = "futures-macro"
-version = "0.3.31"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "futures-sink"
-version = "0.3.31"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e575fab7d1e0dcb8d0c7bcf9a63ee213816ab51902e6d244a95819acacf1d4f7"
-
-[[package]]
-name = "futures-task"
-version = "0.3.31"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f90f7dce0722e95104fcb095585910c0977252f286e354b5e3bd38902cd99988"
-
-[[package]]
-name = "futures-util"
-version = "0.3.31"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fa08315bb612088cc391249efdc3bc77536f16c91f6cf495e6fbe85b20a4a81"
-dependencies = [
- "futures-channel",
- "futures-core",
- "futures-io",
- "futures-macro",
- "futures-sink",
- "futures-task",
- "memchr",
- "pin-project-lite",
- "pin-utils",
- "slab",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
-dependencies = [
- "cfg-if",
- "js-sys",
- "libc",
- "wasi 0.11.1+wasi-snapshot-preview1",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4"
-dependencies = [
- "cfg-if",
- "js-sys",
- "libc",
- "r-efi",
- "wasi 0.14.2+wasi-0.2.4",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "gimli"
-version = "0.31.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
-
-[[package]]
-name = "hashbrown"
-version = "0.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
-
-[[package]]
-name = "hashbrown"
-version = "0.15.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "84b26c544d002229e640969970a2e74021aadf6e2f96372b9c58eff97de08eb3"
-
-[[package]]
-name = "hex"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
-
-[[package]]
-name = "http"
-version = "1.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4a85d31aea989eead29a3aaf9e1115a180df8282431156e533de47660892565"
-dependencies = [
- "bytes",
- "fnv",
- "itoa",
-]
-
-[[package]]
-name = "http-body"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
-dependencies = [
- "bytes",
- "http",
-]
-
-[[package]]
-name = "http-body-util"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
-dependencies = [
- "bytes",
- "futures-core",
- "http",
- "http-body",
- "pin-project-lite",
-]
-
-[[package]]
-name = "httparse"
-version = "1.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
-
-[[package]]
-name = "hyper"
-version = "1.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc2b571658e38e0c01b1fdca3bbbe93c00d3d71693ff2770043f8c29bc7d6f80"
-dependencies = [
- "bytes",
- "futures-channel",
- "futures-util",
- "http",
- "http-body",
- "httparse",
- "itoa",
- "pin-project-lite",
- "smallvec",
- "tokio",
- "want",
-]
-
-[[package]]
-name = "hyper-rustls"
-version = "0.27.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
-dependencies = [
- "http",
- "hyper",
- "hyper-util",
- "rustls",
- "rustls-pki-types",
- "tokio",
- "tokio-rustls",
- "tower-service",
- "webpki-roots",
-]
-
-[[package]]
-name = "hyper-util"
-version = "0.1.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc2fdfdbff08affe55bb779f33b053aa1fe5dd5b54c257343c17edfa55711bdb"
-dependencies = [
- "base64",
- "bytes",
- "futures-channel",
- "futures-core",
- "futures-util",
- "http",
- "http-body",
- "hyper",
- "ipnet",
- "libc",
- "percent-encoding",
- "pin-project-lite",
- "socket2",
- "tokio",
- "tower-service",
- "tracing",
-]
-
-[[package]]
-name = "iana-time-zone"
-version = "0.1.63"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0c919e5debc312ad217002b8048a17b7d83f80703865bbfcfebb0458b0b27d8"
-dependencies = [
- "android_system_properties",
- "core-foundation-sys",
- "iana-time-zone-haiku",
- "js-sys",
- "log",
- "wasm-bindgen",
- "windows-core",
-]
-
-[[package]]
-name = "iana-time-zone-haiku"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
-dependencies = [
- "cc",
-]
-
-[[package]]
-name = "icu_collections"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "200072f5d0e3614556f94a9930d5dc3e0662a652823904c3a75dc3b0af7fee47"
-dependencies = [
- "displaydoc",
- "potential_utf",
- "yoke",
- "zerofrom",
- "zerovec",
-]
-
-[[package]]
-name = "icu_locale_core"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0cde2700ccaed3872079a65fb1a78f6c0a36c91570f28755dda67bc8f7d9f00a"
-dependencies = [
- "displaydoc",
- "litemap",
- "tinystr",
- "writeable",
- "zerovec",
-]
-
-[[package]]
-name = "icu_normalizer"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "436880e8e18df4d7bbc06d58432329d6458cc84531f7ac5f024e93deadb37979"
-dependencies = [
- "displaydoc",
- "icu_collections",
- "icu_normalizer_data",
- "icu_properties",
- "icu_provider",
- "smallvec",
- "zerovec",
-]
-
-[[package]]
-name = "icu_normalizer_data"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00210d6893afc98edb752b664b8890f0ef174c8adbb8d0be9710fa66fbbf72d3"
-
-[[package]]
-name = "icu_properties"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "016c619c1eeb94efb86809b015c58f479963de65bdb6253345c1a1276f22e32b"
-dependencies = [
- "displaydoc",
- "icu_collections",
- "icu_locale_core",
- "icu_properties_data",
- "icu_provider",
- "potential_utf",
- "zerotrie",
- "zerovec",
-]
-
-[[package]]
-name = "icu_properties_data"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "298459143998310acd25ffe6810ed544932242d3f07083eee1084d83a71bd632"
-
-[[package]]
-name = "icu_provider"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03c80da27b5f4187909049ee2d72f276f0d9f99a42c306bd0131ecfe04d8e5af"
-dependencies = [
- "displaydoc",
- "icu_locale_core",
- "stable_deref_trait",
- "tinystr",
- "writeable",
- "yoke",
- "zerofrom",
- "zerotrie",
- "zerovec",
-]
-
-[[package]]
-name = "ident_case"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
-
-[[package]]
-name = "idna"
-version = "1.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "686f825264d630750a544639377bae737628043f20d38bbc029e8f29ea968a7e"
-dependencies = [
- "idna_adapter",
- "smallvec",
- "utf8_iter",
-]
-
-[[package]]
-name = "idna_adapter"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3acae9609540aa318d1bc588455225fb2085b9ed0c4f6bd0d9d5bcd86f1a0344"
-dependencies = [
- "icu_normalizer",
- "icu_properties",
-]
-
-[[package]]
-name = "indexmap"
-version = "1.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
-dependencies = [
- "autocfg",
- "hashbrown 0.12.3",
- "serde",
-]
-
-[[package]]
-name = "indexmap"
-version = "2.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cea70ddb795996207ad57735b50c5982d8844f38ba9ee5f1aedcfb708a2aa11e"
-dependencies = [
- "equivalent",
- "hashbrown 0.15.3",
- "serde",
-]
-
-[[package]]
-name = "ipnet"
-version = "2.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "469fb0b9cefa57e3ef31275ee7cacb78f2fdca44e4765491884a2b119d4eb130"
-
-[[package]]
-name = "iri-string"
-version = "0.7.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbc5ebe9c3a1a7a5127f920a418f7585e9e758e911d0466ed004f393b0e380b2"
-dependencies = [
- "memchr",
- "serde",
-]
-
-[[package]]
-name = "itoa"
-version = "1.0.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
-
-[[package]]
-name = "js-sys"
-version = "0.3.77"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1cfaf33c695fc6e08064efbc1f72ec937429614f25eef83af942d0e227c3a28f"
-dependencies = [
- "once_cell",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "libc"
-version = "0.2.172"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d750af042f7ef4f724306de029d18836c26c1765a54a6a3f094cbd23a7267ffa"
-
-[[package]]
-name = "litemap"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "241eaef5fd12c88705a01fc1066c48c4b36e0dd4377dcdc7ec3942cea7a69956"
-
-[[package]]
-name = "log"
-version = "0.4.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94"
-
-[[package]]
-name = "lru-slab"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
-
-[[package]]
-name = "memchr"
-version = "2.7.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
-
-[[package]]
-name = "mime"
-version = "0.3.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
-
-[[package]]
-name = "mime_guess"
-version = "2.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7c44f8e672c00fe5308fa235f821cb4198414e1c77935c1ab6948d3fd78550e"
-dependencies = [
- "mime",
- "unicase",
-]
-
-[[package]]
-name = "miniz_oxide"
-version = "0.8.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3be647b768db090acb35d5ec5db2b0e1f1de11133ca123b9eacf5137868f892a"
-dependencies = [
- "adler2",
-]
-
-[[package]]
-name = "mio"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78bed444cc8a2160f01cbcf811ef18cac863ad68ae8ca62092e8db51d51c761c"
-dependencies = [
- "libc",
- "wasi 0.11.1+wasi-snapshot-preview1",
- "windows-sys 0.59.0",
-]
-
-[[package]]
-name = "num-conv"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
-
-[[package]]
-name = "num-traits"
-version = "0.2.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
-dependencies = [
- "autocfg",
-]
-
-[[package]]
-name = "object"
-version = "0.36.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62948e14d923ea95ea2c7c86c71013138b66525b86bdc08d2dcc262bdb497b87"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "once_cell"
-version = "1.21.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
-
-[[package]]
-name = "percent-encoding"
-version = "2.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
-
-[[package]]
-name = "pin-project-lite"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
-
-[[package]]
-name = "pin-utils"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
-
-[[package]]
-name = "potential_utf"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5a7c30837279ca13e7c867e9e40053bc68740f988cb07f7ca6df43cc734b585"
-dependencies = [
- "zerovec",
-]
-
-[[package]]
-name = "powerfmt"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
-
-[[package]]
-name = "ppv-lite86"
-version = "0.2.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
-dependencies = [
- "zerocopy",
-]
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.95"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02b3e5e68a3a1a02aad3ec490a98007cbc13c37cbe84a3cd7b8e406d76e7f778"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "quinn"
-version = "0.11.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "626214629cda6781b6dc1d316ba307189c85ba657213ce642d9c77670f8202c8"
-dependencies = [
- "bytes",
- "cfg_aliases",
- "pin-project-lite",
- "quinn-proto",
- "quinn-udp",
- "rustc-hash",
- "rustls",
- "socket2",
- "thiserror",
- "tokio",
- "tracing",
- "web-time",
-]
-
-[[package]]
-name = "quinn-proto"
-version = "0.11.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49df843a9161c85bb8aae55f101bc0bac8bcafd637a620d9122fd7e0b2f7422e"
-dependencies = [
- "bytes",
- "getrandom 0.3.3",
- "lru-slab",
- "rand",
- "ring",
- "rustc-hash",
- "rustls",
- "rustls-pki-types",
- "slab",
- "thiserror",
- "tinyvec",
- "tracing",
- "web-time",
-]
-
-[[package]]
-name = "quinn-udp"
-version = "0.5.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcebb1209ee276352ef14ff8732e24cc2b02bbac986cd74a4c81bcb2f9881970"
-dependencies = [
- "cfg_aliases",
- "libc",
- "once_cell",
- "socket2",
- "tracing",
- "windows-sys 0.59.0",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.40"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "r-efi"
-version = "5.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
-
-[[package]]
-name = "rand"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fbfd9d094a40bf3ae768db9361049ace4c0e04a4fd6b359518bd7b73a73dd97"
-dependencies = [
- "rand_chacha",
- "rand_core",
-]
-
-[[package]]
-name = "rand_chacha"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
-dependencies = [
- "ppv-lite86",
- "rand_core",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
-dependencies = [
- "getrandom 0.3.3",
-]
-
-[[package]]
-name = "ref-cast"
-version = "1.0.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a0ae411dbe946a674d89546582cea4ba2bb8defac896622d6496f14c23ba5cf"
-dependencies = [
- "ref-cast-impl",
-]
-
-[[package]]
-name = "ref-cast-impl"
-version = "1.0.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1165225c21bff1f3bbce98f5a1f889949bc902d3575308cc7b0de30b4f6d27c7"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "reqwest"
-version = "0.12.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eabf4c97d9130e2bf606614eb937e86edac8292eaa6f422f995d7e8de1eb1813"
-dependencies = [
- "base64",
- "bytes",
- "futures-core",
- "futures-util",
- "http",
- "http-body",
- "http-body-util",
- "hyper",
- "hyper-rustls",
- "hyper-util",
- "js-sys",
- "log",
- "mime_guess",
- "percent-encoding",
- "pin-project-lite",
- "quinn",
- "rustls",
- "rustls-pki-types",
- "serde",
- "serde_json",
- "serde_urlencoded",
- "sync_wrapper",
- "tokio",
- "tokio-rustls",
- "tower",
- "tower-http",
- "tower-service",
- "url",
- "wasm-bindgen",
- "wasm-bindgen-futures",
- "web-sys",
- "webpki-roots",
-]
-
-[[package]]
-name = "ring"
-version = "0.17.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
-dependencies = [
- "cc",
- "cfg-if",
- "getrandom 0.2.16",
- "libc",
- "untrusted",
- "windows-sys 0.52.0",
-]
-
-[[package]]
-name = "rustc-demangle"
-version = "0.1.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
-
-[[package]]
-name = "rustc-hash"
-version = "2.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
-
-[[package]]
-name = "rustls"
-version = "0.23.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7160e3e10bf4535308537f3c4e1641468cd0e485175d6163087c0393c7d46643"
-dependencies = [
- "once_cell",
- "ring",
- "rustls-pki-types",
- "rustls-webpki",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "rustls-pki-types"
-version = "1.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "229a4a4c221013e7e1f1a043678c5cc39fe5171437c88fb47151a21e6f5b5c79"
-dependencies = [
- "web-time",
- "zeroize",
-]
-
-[[package]]
-name = "rustls-webpki"
-version = "0.103.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e4a72fe2bcf7a6ac6fd7d0b9e5cb68aeb7d4c0a0271730218b3e92d43b4eb435"
-dependencies = [
- "ring",
- "rustls-pki-types",
- "untrusted",
-]
-
-[[package]]
-name = "rustversion"
-version = "1.0.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a0d197bd2c9dc6e53b84da9556a69ba4cdfab8619eb41a8bd1cc2027a0f6b1d"
-
-[[package]]
-name = "ryu"
-version = "1.0.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
-
-[[package]]
-name = "schemars"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4cd191f9397d57d581cddd31014772520aa448f65ef991055d7f61582c65165f"
-dependencies = [
- "dyn-clone",
- "ref-cast",
- "serde",
- "serde_json",
-]
-
-[[package]]
-name = "serde"
-version = "1.0.219"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
-dependencies = [
- "serde_derive",
-]
-
-[[package]]
-name = "serde_derive"
-version = "1.0.219"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "serde_json"
-version = "1.0.140"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20068b6e96dc6c9bd23e01df8827e6c7e1f2fddd43c21810382803c136b99373"
-dependencies = [
- "itoa",
- "memchr",
- "ryu",
- "serde",
-]
-
-[[package]]
-name = "serde_repr"
-version = "0.1.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "175ee3e80ae9982737ca543e96133087cbd9a485eecc3bc4de9c1a37b47ea59c"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "serde_urlencoded"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
-dependencies = [
- "form_urlencoded",
- "itoa",
- "ryu",
- "serde",
-]
-
-[[package]]
-name = "serde_with"
-version = "3.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf65a400f8f66fb7b0552869ad70157166676db75ed8181f8104ea91cf9d0b42"
-dependencies = [
- "base64",
- "chrono",
- "hex",
- "indexmap 1.9.3",
- "indexmap 2.9.0",
- "schemars",
- "serde",
- "serde_derive",
- "serde_json",
- "serde_with_macros",
- "time",
-]
-
-[[package]]
-name = "serde_with_macros"
-version = "3.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81679d9ed988d5e9a5e6531dc3f2c28efbd639cbd1dfb628df08edea6004da77"
-dependencies = [
- "darling",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "serde_yaml"
-version = "0.9.34+deprecated"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47"
-dependencies = [
- "indexmap 2.9.0",
- "itoa",
- "ryu",
- "serde",
- "unsafe-libyaml",
-]
-
-[[package]]
-name = "shlex"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
-
-[[package]]
-name = "slab"
-version = "0.4.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f92a496fb766b417c996b9c5e57daf2f7ad3b0bebe1ccfca4856390e3d3bb67"
-dependencies = [
- "autocfg",
-]
-
-[[package]]
-name = "smallvec"
-version = "1.15.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
-
-[[package]]
-name = "socket2"
-version = "0.5.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
-dependencies = [
- "libc",
- "windows-sys 0.52.0",
-]
-
-[[package]]
-name = "stable_deref_trait"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3"
-
-[[package]]
-name = "strsim"
-version = "0.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
-
-[[package]]
-name = "subtle"
-version = "2.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
-
-[[package]]
-name = "syn"
-version = "2.0.101"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ce2b7fc941b3a24138a0a7cf8e858bfc6a992e7978a068a5c760deb0ed43caf"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "sync_wrapper"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
-dependencies = [
- "futures-core",
-]
-
-[[package]]
-name = "synstructure"
-version = "0.13.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "thiserror"
-version = "2.0.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "567b8a2dae586314f7be2a752ec7474332959c6460e02bde30d702a66d488708"
-dependencies = [
- "thiserror-impl",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "2.0.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f7cf42b4507d8ea322120659672cf1b9dbb93f8f2d4ecfd6e51350ff5b17a1d"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "time"
-version = "0.3.41"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a7619e19bc266e0f9c5e6686659d394bc57973859340060a69221e57dbc0c40"
-dependencies = [
- "deranged",
- "itoa",
- "num-conv",
- "powerfmt",
- "serde",
- "time-core",
- "time-macros",
-]
-
-[[package]]
-name = "time-core"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9e9a38711f559d9e3ce1cdb06dd7c5b8ea546bc90052da6d06bb76da74bb07c"
-
-[[package]]
-name = "time-macros"
-version = "0.2.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3526739392ec93fd8b359c8e98514cb3e8e021beb4e5f597b00a0221f8ed8a49"
-dependencies = [
- "num-conv",
- "time-core",
-]
-
-[[package]]
-name = "tinystr"
-version = "0.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d4f6d1145dcb577acf783d4e601bc1d76a13337bb54e6233add580b07344c8b"
-dependencies = [
- "displaydoc",
- "zerovec",
-]
-
-[[package]]
-name = "tinyvec"
-version = "1.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09b3661f17e86524eccd4371ab0429194e0d7c008abb45f7a7495b1719463c71"
-dependencies = [
- "tinyvec_macros",
-]
-
-[[package]]
-name = "tinyvec_macros"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
-
-[[package]]
-name = "tokio"
-version = "1.45.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75ef51a33ef1da925cea3e4eb122833cb377c61439ca401b770f54902b806779"
-dependencies = [
- "backtrace",
- "bytes",
- "libc",
- "mio",
- "pin-project-lite",
- "socket2",
- "tokio-macros",
- "windows-sys 0.52.0",
-]
-
-[[package]]
-name = "tokio-macros"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e06d43f1345a3bcd39f6a56dbb7dcab2ba47e68e8ac134855e7e2bdbaf8cab8"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "tokio-rustls"
-version = "0.26.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e727b36a1a0e8b74c376ac2211e40c2c8af09fb4013c60d910495810f008e9b"
-dependencies = [
- "rustls",
- "tokio",
-]
-
-[[package]]
-name = "tower"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d039ad9159c98b70ecfd540b2573b97f7f52c3e8d9f8ad57a24b916a536975f9"
-dependencies = [
- "futures-core",
- "futures-util",
- "pin-project-lite",
- "sync_wrapper",
- "tokio",
- "tower-layer",
- "tower-service",
-]
-
-[[package]]
-name = "tower-http"
-version = "0.6.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adc82fd73de2a9722ac5da747f12383d2bfdb93591ee6c58486e0097890f05f2"
-dependencies = [
- "bitflags",
- "bytes",
- "futures-util",
- "http",
- "http-body",
- "iri-string",
- "pin-project-lite",
- "tower",
- "tower-layer",
- "tower-service",
-]
-
-[[package]]
-name = "tower-layer"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
-
-[[package]]
-name = "tower-service"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
-
-[[package]]
-name = "tracing"
-version = "0.1.41"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "784e0ac535deb450455cbfa28a6f0df145ea1bb7ae51b821cf5e7927fdcfbdd0"
-dependencies = [
- "pin-project-lite",
- "tracing-core",
-]
-
-[[package]]
-name = "tracing-core"
-version = "0.1.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d12581f227e93f094d3af2ae690a574abb8a2b9b7a96e7cfe9647b2b617678"
-dependencies = [
- "once_cell",
-]
-
-[[package]]
-name = "try-lock"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
-
-[[package]]
-name = "unicase"
-version = "2.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75b844d17643ee918803943289730bec8aac480150456169e647ed0b576ba539"
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
-
-[[package]]
-name = "unsafe-libyaml"
-version = "0.2.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
-
-[[package]]
-name = "untrusted"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
-
-[[package]]
-name = "url"
-version = "2.5.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32f8b686cadd1473f4bd0117a5d28d36b1ade384ea9b5069a1c40aefed7fda60"
-dependencies = [
- "form_urlencoded",
- "idna",
- "percent-encoding",
-]
-
-[[package]]
-name = "utf8_iter"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
-
-[[package]]
-name = "uuid"
-version = "1.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3cf4199d1e5d15ddd86a694e4d0dffa9c323ce759fea589f00fef9d81cc1931d"
-dependencies = [
- "getrandom 0.3.3",
- "js-sys",
- "serde",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "want"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
-dependencies = [
- "try-lock",
-]
-
-[[package]]
-name = "wasi"
-version = "0.11.1+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
-
-[[package]]
-name = "wasi"
-version = "0.14.2+wasi-0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9683f9a5a998d873c0d21fcbe3c083009670149a8fab228644b8bd36b2c48cb3"
-dependencies = [
- "wit-bindgen-rt",
-]
-
-[[package]]
-name = "wasm-bindgen"
-version = "0.2.100"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1edc8929d7499fc4e8f0be2262a241556cfc54a0bea223790e71446f2aab1ef5"
-dependencies = [
- "cfg-if",
- "once_cell",
- "rustversion",
- "wasm-bindgen-macro",
-]
-
-[[package]]
-name = "wasm-bindgen-backend"
-version = "0.2.100"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f0a0651a5c2bc21487bde11ee802ccaf4c51935d0d3d42a6101f98161700bc6"
-dependencies = [
- "bumpalo",
- "log",
- "proc-macro2",
- "quote",
- "syn",
- "wasm-bindgen-shared",
-]
-
-[[package]]
-name = "wasm-bindgen-futures"
-version = "0.4.50"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "555d470ec0bc3bb57890405e5d4322cc9ea83cebb085523ced7be4144dac1e61"
-dependencies = [
- "cfg-if",
- "js-sys",
- "once_cell",
- "wasm-bindgen",
- "web-sys",
-]
-
-[[package]]
-name = "wasm-bindgen-macro"
-version = "0.2.100"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fe63fc6d09ed3792bd0897b314f53de8e16568c2b3f7982f468c0bf9bd0b407"
-dependencies = [
- "quote",
- "wasm-bindgen-macro-support",
-]
-
-[[package]]
-name = "wasm-bindgen-macro-support"
-version = "0.2.100"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ae87ea40c9f689fc23f209965b6fb8a99ad69aeeb0231408be24920604395de"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
- "wasm-bindgen-backend",
- "wasm-bindgen-shared",
-]
-
-[[package]]
-name = "wasm-bindgen-shared"
-version = "0.2.100"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a05d73b933a847d6cccdda8f838a22ff101ad9bf93e33684f39c1f5f0eece3d"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "web-sys"
-version = "0.3.77"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33b6dd2ef9186f1f2072e409e99cd22a975331a6b3591b12c764e0e55c60d5d2"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "web-time"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "webpki-roots"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8782dd5a41a24eed3a4f40b606249b3e236ca61adf1f25ea4d45c73de122b502"
-dependencies = [
- "rustls-pki-types",
-]
-
-[[package]]
-name = "windmill-api"
-version = "1.518.2"
-dependencies = [
- "reqwest",
- "serde",
- "serde_json",
- "serde_repr",
- "serde_with",
- "url",
- "uuid",
-]
-
-[[package]]
-name = "windows-core"
-version = "0.61.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0fdd3ddb90610c7638aa2b3a3ab2904fb9e5cdbecc643ddb3647212781c4ae3"
-dependencies = [
- "windows-implement",
- "windows-interface",
- "windows-link",
- "windows-result",
- "windows-strings",
-]
-
-[[package]]
-name = "windows-implement"
-version = "0.60.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a47fddd13af08290e67f4acabf4b459f647552718f683a7b415d290ac744a836"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "windows-interface"
-version = "0.59.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd9211b69f8dcdfa817bfd14bf1c97c9188afa36f4750130fcdf3f400eca9fa8"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "windows-link"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e6ad25900d524eaabdbbb96d20b4311e1e7ae1699af4fb28c17ae66c80d798a"
-
-[[package]]
-name = "windows-result"
-version = "0.3.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56f42bd332cc6c8eac5af113fc0c1fd6a8fd2aa08a0119358686e5160d0586c6"
-dependencies = [
- "windows-link",
-]
-
-[[package]]
-name = "windows-strings"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56e6c93f3a0c3b36176cb1327a4958a0353d5d166c2a35cb268ace15e91d3b57"
-dependencies = [
- "windows-link",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.52.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
-dependencies = [
- "windows-targets",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.59.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
-dependencies = [
- "windows-targets",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
-dependencies = [
- "windows_aarch64_gnullvm",
- "windows_aarch64_msvc",
- "windows_i686_gnu",
- "windows_i686_gnullvm",
- "windows_i686_msvc",
- "windows_x86_64_gnu",
- "windows_x86_64_gnullvm",
- "windows_x86_64_msvc",
-]
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
-
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
-
-[[package]]
-name = "wit-bindgen-rt"
-version = "0.39.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f42320e61fe2cfd34354ecb597f86f413484a798ba44a8ca1165c58d42da6c1"
-dependencies = [
- "bitflags",
-]
-
-[[package]]
-name = "wmill"
-version = "1.518.2"
-dependencies = [
- "anyhow",
- "futures",
- "once_cell",
- "serde",
- "serde_json",
- "serde_yaml",
- "thiserror",
- "tokio",
- "uuid",
- "windmill-api",
-]
-
-[[package]]
-name = "writeable"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea2f10b9bb0928dfb1b42b65e1f9e36f7f54dbdf08457afefb38afcdec4fa2bb"
-
-[[package]]
-name = "yoke"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f41bb01b8226ef4bfd589436a297c53d118f65921786300e427be8d487695cc"
-dependencies = [
- "serde",
- "stable_deref_trait",
- "yoke-derive",
- "zerofrom",
-]
-
-[[package]]
-name = "yoke-derive"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38da3c9736e16c5d3c8c597a9aaa5d1fa565d0532ae05e27c24aa62fb32c0ab6"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
- "synstructure",
-]
-
-[[package]]
-name = "zerocopy"
-version = "0.8.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1039dd0d3c310cf05de012d8a39ff557cb0d23087fd44cad61df08fc31907a2f"
-dependencies = [
- "zerocopy-derive",
-]
-
-[[package]]
-name = "zerocopy-derive"
-version = "0.8.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ecf5b4cc5364572d7f4c329661bcc82724222973f2cab6f050a4e5c22f75181"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "zerofrom"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50cc42e0333e05660c3587f3bf9d0478688e15d870fab3346451ce7f8c9fbea5"
-dependencies = [
- "zerofrom-derive",
-]
-
-[[package]]
-name = "zerofrom-derive"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
- "synstructure",
-]
-
-[[package]]
-name = "zeroize"
-version = "1.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde"
-
-[[package]]
-name = "zerotrie"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "36f0bbd478583f79edad978b407914f61b2972f5af6fa089686016be8f9af595"
-dependencies = [
- "displaydoc",
- "yoke",
- "zerofrom",
-]
-
-[[package]]
-name = "zerovec"
-version = "0.11.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a05eb080e015ba39cc9e23bbe5e7fb04d5fb040350f99f34e338d5fdd294428"
-dependencies = [
- "yoke",
- "zerofrom",
- "zerovec-derive",
-]
-
-[[package]]
-name = "zerovec-derive"
-version = "0.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b96237efa0c878c64bd89c436f661be4e46b2f3eff1ebb976f7ef2321d2f58f"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
diff --git a/system_prompts/auto-generated/prompts.ts b/system_prompts/auto-generated/prompts.ts
index 109a581dde..ba5f382651 100644
--- a/system_prompts/auto-generated/prompts.ts
+++ b/system_prompts/auto-generated/prompts.ts
@@ -1911,6 +1911,8 @@ parseS3Object(s3Object: S3Object): S3ObjectRecord
 /**
  * Create a SQL template function for PostgreSQL/datatable queries
  * @param name - Database/datatable name (default: "main")
+ * @param opts.role - Connect as this data table role instead of the data table's default one.
+ *   Only meaningful on a data table under roles, and only for a role you are a tenant of.
  * @returns SQL template function for building parameterized queries
  * @example
  * let sql = wmill.datatable()
@@ -1920,8 +1922,11 @@ parseS3Object(s3Object: S3Object): S3ObjectRecord
  *   SELECT * FROM friends
  *     WHERE name = \${name} AND age = \${age}::int
  * \`.fetch()
+ * @example
+ * // Read through a restricted role
+ * let sql = wmill.datatable("main", { role: "analytics" })
  */
-datatable(name: string = "main"): DatatableSqlTemplateFunction
+datatable(name: string = "main", opts?: DatatableOptions): DatatableSqlTemplateFunction
 
 /**
  * Create a SQL template function for DuckDB/ducklake queries
@@ -2436,10 +2441,13 @@ def send_teams_message(conversation_id: str, text: str, success: bool = True, ca
 # 
 # Args:
 #     name: Database name (default: "main")
+#     role: Connect as this data table role instead of the data table's default one.
+#         Only meaningful on a data table under roles, and only for a role you are a
+#         tenant of.
 # 
 # Returns:
 #     DataTableClient instance
-def datatable(name: str = 'main')
+def datatable(name: str = 'main', *, role: Optional[str] = None)
 
 # Get a DuckLake client for DuckDB queries.
 # 
@@ -2657,7 +2665,7 @@ def parse_sql_client_name(name: str) -> tuple[str, Optional[str]]
 # 
 #     @task(retry={"attempts": 3, "delay": 30, "multiplier": 2})
 #     async def call_api(payload: dict): ...
-def task(_func = None, path: Optional[str] = None, tag: Optional[str] = None, timeout: Optional[int] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None, retry: Optional[dict] = None)
+def task(_func = None, *, path: Optional[str] = None, tag: Optional[str] = None, timeout: Optional[int] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None, retry: Optional[dict] = None)
 
 # Create a task that dispatches to a separate Windmill script.
 # 
@@ -2670,7 +2678,7 @@ def task(_func = None, path: Optional[str] = None, tag: Optional[str] = None, ti
 #     @workflow
 #     async def main():
 #         data = await extract(url="https://...")
-def task_script(path: str, timeout: Optional[int] = None, tag: Optional[str] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None, retry: Optional[dict] = None)
+def task_script(path: str, *, timeout: Optional[int] = None, tag: Optional[str] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None, retry: Optional[dict] = None)
 
 # Create a task that dispatches to a separate Windmill flow.
 # 
@@ -2683,7 +2691,7 @@ def task_script(path: str, timeout: Optional[int] = None, tag: Optional[str] = N
 #     @workflow
 #     async def main():
 #         result = await pipeline(input=data)
-def task_flow(path: str, timeout: Optional[int] = None, tag: Optional[str] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None, retry: Optional[dict] = None)
+def task_flow(path: str, *, timeout: Optional[int] = None, tag: Optional[str] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None, retry: Optional[dict] = None)
 
 # Decorator marking an async function as a workflow-as-code entry point.
 # 
@@ -2748,7 +2756,7 @@ async def wait_for_approval(timeout: int = 1800, form: dict | None = None, self_
 #         ...
 # 
 #     results = await parallel(items, process, concurrency=5)
-async def parallel(items, fn, concurrency: Optional[int] = None)
+async def parallel(items, fn, *, concurrency: Optional[int] = None)
 
 # Commit Kafka offsets for a trigger with auto_commit disabled.
 # 
@@ -3195,6 +3203,8 @@ interface DatatableSqlTemplateFunction {
 
 Create a SQL template function for PostgreSQL/datatable queries
 @param name - Database/datatable name (default: "main")
+@param opts.role - Connect as this data table role instead of the data table's default one.
+  Only meaningful on a data table under roles, and only for a role you are a tenant of.
 @returns SQL template function for building parameterized queries
 @example
 let sql = wmill.datatable()
@@ -3204,8 +3214,12 @@ await sql\`
   SELECT * FROM friends
     WHERE name = \${name} AND age = \${age}::int
 \`.fetch()
+@example
+// Read through a restricted role
+let sql = wmill.datatable("main", { role: "analytics" })
 \`\`\`typescript
-function datatable(name: string = "main"): DatatableSqlTemplateFunction
+function datatable(name: string = "main",
+  opts?: DatatableOptions): DatatableSqlTemplateFunction
 \`\`\`
 `;
 
@@ -3217,10 +3231,11 @@ Import: \`import wmill\`
 # 
 # Args:
 #     name: Database name (default: "main")
+#     role: Connect as this data table role instead of the data table's default one.
 # 
 # Returns:
 #     DataTableClient instance
-def datatable(name: str = 'main') -> DataTableClient
+def datatable(name: str = 'main', *, role: Optional[str] = None) -> DataTableClient
 
 # Client for executing SQL queries against Windmill DataTables.
 class DataTableClient:
@@ -3229,7 +3244,8 @@ class DataTableClient:
     # Args:
     #     client: Windmill client instance
     #     name: DataTable name
-    def __init__(client: Windmill, name: str)
+    #     role: Data table role to connect as, or None for the data table's default
+    def __init__(client: Windmill, name: str, role: Optional[str] = None)
 
     # Execute a SQL query against the DataTable.
     # 
diff --git a/system_prompts/auto-generated/script.md b/system_prompts/auto-generated/script.md
index f278a67fba..afc064df40 100644
--- a/system_prompts/auto-generated/script.md
+++ b/system_prompts/auto-generated/script.md
@@ -2000,6 +2000,8 @@ parseS3Object(s3Object: S3Object): S3ObjectRecord
 /**
  * Create a SQL template function for PostgreSQL/datatable queries
  * @param name - Database/datatable name (default: "main")
+ * @param opts.role - Connect as this data table role instead of the data table's default one.
+ *   Only meaningful on a data table under roles, and only for a role you are a tenant of.
  * @returns SQL template function for building parameterized queries
  * @example
  * let sql = wmill.datatable()
@@ -2009,8 +2011,11 @@ parseS3Object(s3Object: S3Object): S3ObjectRecord
  *   SELECT * FROM friends
  *     WHERE name = ${name} AND age = ${age}::int
  * `.fetch()
+ * @example
+ * // Read through a restricted role
+ * let sql = wmill.datatable("main", { role: "analytics" })
  */
-datatable(name: string = "main"): DatatableSqlTemplateFunction
+datatable(name: string = "main", opts?: DatatableOptions): DatatableSqlTemplateFunction
 
 /**
  * Create a SQL template function for DuckDB/ducklake queries
@@ -2525,10 +2530,13 @@ def send_teams_message(conversation_id: str, text: str, success: bool = True, ca
 # 
 # Args:
 #     name: Database name (default: "main")
+#     role: Connect as this data table role instead of the data table's default one.
+#         Only meaningful on a data table under roles, and only for a role you are a
+#         tenant of.
 # 
 # Returns:
 #     DataTableClient instance
-def datatable(name: str = 'main')
+def datatable(name: str = 'main', *, role: Optional[str] = None)
 
 # Get a DuckLake client for DuckDB queries.
 # 
@@ -2746,7 +2754,7 @@ def parse_sql_client_name(name: str) -> tuple[str, Optional[str]]
 # 
 #     @task(retry={"attempts": 3, "delay": 30, "multiplier": 2})
 #     async def call_api(payload: dict): ...
-def task(_func = None, path: Optional[str] = None, tag: Optional[str] = None, timeout: Optional[int] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None, retry: Optional[dict] = None)
+def task(_func = None, *, path: Optional[str] = None, tag: Optional[str] = None, timeout: Optional[int] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None, retry: Optional[dict] = None)
 
 # Create a task that dispatches to a separate Windmill script.
 # 
@@ -2759,7 +2767,7 @@ def task(_func = None, path: Optional[str] = None, tag: Optional[str] = None, ti
 #     @workflow
 #     async def main():
 #         data = await extract(url="https://...")
-def task_script(path: str, timeout: Optional[int] = None, tag: Optional[str] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None, retry: Optional[dict] = None)
+def task_script(path: str, *, timeout: Optional[int] = None, tag: Optional[str] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None, retry: Optional[dict] = None)
 
 # Create a task that dispatches to a separate Windmill flow.
 # 
@@ -2772,7 +2780,7 @@ def task_script(path: str, timeout: Optional[int] = None, tag: Optional[str] = N
 #     @workflow
 #     async def main():
 #         result = await pipeline(input=data)
-def task_flow(path: str, timeout: Optional[int] = None, tag: Optional[str] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None, retry: Optional[dict] = None)
+def task_flow(path: str, *, timeout: Optional[int] = None, tag: Optional[str] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None, retry: Optional[dict] = None)
 
 # Decorator marking an async function as a workflow-as-code entry point.
 # 
@@ -2837,7 +2845,7 @@ async def wait_for_approval(timeout: int = 1800, form: dict | None = None, self_
 #         ...
 # 
 #     results = await parallel(items, process, concurrency=5)
-async def parallel(items, fn, concurrency: Optional[int] = None)
+async def parallel(items, fn, *, concurrency: Optional[int] = None)
 
 # Commit Kafka offsets for a trigger with auto_commit disabled.
 # 
diff --git a/system_prompts/auto-generated/sdks/datatable-python.md b/system_prompts/auto-generated/sdks/datatable-python.md
index 752019a9a3..3c7cdb1a09 100644
--- a/system_prompts/auto-generated/sdks/datatable-python.md
+++ b/system_prompts/auto-generated/sdks/datatable-python.md
@@ -6,10 +6,11 @@ Import: `import wmill`
 # 
 # Args:
 #     name: Database name (default: "main")
+#     role: Connect as this data table role instead of the data table's default one.
 # 
 # Returns:
 #     DataTableClient instance
-def datatable(name: str = 'main') -> DataTableClient
+def datatable(name: str = 'main', *, role: Optional[str] = None) -> DataTableClient
 
 # Client for executing SQL queries against Windmill DataTables.
 class DataTableClient:
@@ -18,7 +19,8 @@ class DataTableClient:
     # Args:
     #     client: Windmill client instance
     #     name: DataTable name
-    def __init__(client: Windmill, name: str)
+    #     role: Data table role to connect as, or None for the data table's default
+    def __init__(client: Windmill, name: str, role: Optional[str] = None)
 
     # Execute a SQL query against the DataTable.
     # 
diff --git a/system_prompts/auto-generated/sdks/datatable-typescript.md b/system_prompts/auto-generated/sdks/datatable-typescript.md
index 0256515911..9f6fc13341 100644
--- a/system_prompts/auto-generated/sdks/datatable-typescript.md
+++ b/system_prompts/auto-generated/sdks/datatable-typescript.md
@@ -62,6 +62,8 @@ interface DatatableSqlTemplateFunction {
 
 Create a SQL template function for PostgreSQL/datatable queries
 @param name - Database/datatable name (default: "main")
+@param opts.role - Connect as this data table role instead of the data table's default one.
+  Only meaningful on a data table under roles, and only for a role you are a tenant of.
 @returns SQL template function for building parameterized queries
 @example
 let sql = wmill.datatable()
@@ -71,6 +73,10 @@ await sql`
   SELECT * FROM friends
     WHERE name = ${name} AND age = ${age}::int
 `.fetch()
+@example
+// Read through a restricted role
+let sql = wmill.datatable("main", { role: "analytics" })
 ```typescript
-function datatable(name: string = "main"): DatatableSqlTemplateFunction
+function datatable(name: string = "main",
+  opts?: DatatableOptions): DatatableSqlTemplateFunction
 ```
diff --git a/system_prompts/auto-generated/sdks/python.md b/system_prompts/auto-generated/sdks/python.md
index 4f727c7d45..97db78b3d4 100644
--- a/system_prompts/auto-generated/sdks/python.md
+++ b/system_prompts/auto-generated/sdks/python.md
@@ -469,10 +469,13 @@ def send_teams_message(conversation_id: str, text: str, success: bool = True, ca
 # 
 # Args:
 #     name: Database name (default: "main")
+#     role: Connect as this data table role instead of the data table's default one.
+#         Only meaningful on a data table under roles, and only for a role you are a
+#         tenant of.
 # 
 # Returns:
 #     DataTableClient instance
-def datatable(name: str = 'main')
+def datatable(name: str = 'main', *, role: Optional[str] = None)
 
 # Get a DuckLake client for DuckDB queries.
 # 
@@ -690,7 +693,7 @@ def parse_sql_client_name(name: str) -> tuple[str, Optional[str]]
 # 
 #     @task(retry={"attempts": 3, "delay": 30, "multiplier": 2})
 #     async def call_api(payload: dict): ...
-def task(_func = None, path: Optional[str] = None, tag: Optional[str] = None, timeout: Optional[int] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None, retry: Optional[dict] = None)
+def task(_func = None, *, path: Optional[str] = None, tag: Optional[str] = None, timeout: Optional[int] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None, retry: Optional[dict] = None)
 
 # Create a task that dispatches to a separate Windmill script.
 # 
@@ -703,7 +706,7 @@ def task(_func = None, path: Optional[str] = None, tag: Optional[str] = None, ti
 #     @workflow
 #     async def main():
 #         data = await extract(url="https://...")
-def task_script(path: str, timeout: Optional[int] = None, tag: Optional[str] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None, retry: Optional[dict] = None)
+def task_script(path: str, *, timeout: Optional[int] = None, tag: Optional[str] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None, retry: Optional[dict] = None)
 
 # Create a task that dispatches to a separate Windmill flow.
 # 
@@ -716,7 +719,7 @@ def task_script(path: str, timeout: Optional[int] = None, tag: Optional[str] = N
 #     @workflow
 #     async def main():
 #         result = await pipeline(input=data)
-def task_flow(path: str, timeout: Optional[int] = None, tag: Optional[str] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None, retry: Optional[dict] = None)
+def task_flow(path: str, *, timeout: Optional[int] = None, tag: Optional[str] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None, retry: Optional[dict] = None)
 
 # Decorator marking an async function as a workflow-as-code entry point.
 # 
@@ -781,7 +784,7 @@ async def wait_for_approval(timeout: int = 1800, form: dict | None = None, self_
 #         ...
 # 
 #     results = await parallel(items, process, concurrency=5)
-async def parallel(items, fn, concurrency: Optional[int] = None)
+async def parallel(items, fn, *, concurrency: Optional[int] = None)
 
 # Commit Kafka offsets for a trigger with auto_commit disabled.
 # 
diff --git a/system_prompts/auto-generated/sdks/typescript.md b/system_prompts/auto-generated/sdks/typescript.md
index b764b38a9e..55f59b1f36 100644
--- a/system_prompts/auto-generated/sdks/typescript.md
+++ b/system_prompts/auto-generated/sdks/typescript.md
@@ -565,6 +565,8 @@ parseS3Object(s3Object: S3Object): S3ObjectRecord
 /**
  * Create a SQL template function for PostgreSQL/datatable queries
  * @param name - Database/datatable name (default: "main")
+ * @param opts.role - Connect as this data table role instead of the data table's default one.
+ *   Only meaningful on a data table under roles, and only for a role you are a tenant of.
  * @returns SQL template function for building parameterized queries
  * @example
  * let sql = wmill.datatable()
@@ -574,8 +576,11 @@ parseS3Object(s3Object: S3Object): S3ObjectRecord
  *   SELECT * FROM friends
  *     WHERE name = ${name} AND age = ${age}::int
  * `.fetch()
+ * @example
+ * // Read through a restricted role
+ * let sql = wmill.datatable("main", { role: "analytics" })
  */
-datatable(name: string = "main"): DatatableSqlTemplateFunction
+datatable(name: string = "main", opts?: DatatableOptions): DatatableSqlTemplateFunction
 
 /**
  * Create a SQL template function for DuckDB/ducklake queries
diff --git a/system_prompts/auto-generated/skills/raw-app/SKILL.md b/system_prompts/auto-generated/skills/raw-app/SKILL.md
index ed79172b9d..8c6b8e09da 100644
--- a/system_prompts/auto-generated/skills/raw-app/SKILL.md
+++ b/system_prompts/auto-generated/skills/raw-app/SKILL.md
@@ -172,6 +172,8 @@ data:
   tables:
     - main/users            # Table in public schema
     - main/app_schema:items # Table in specific schema
+  roles:                    # Optional: the role the app uses each datatable through
+    main: analyst
 ```
 
 **Table reference formats:**
@@ -179,6 +181,8 @@ data:
 - `<datatable>/<table>` — Specific table in public schema
 - `<datatable>/<schema>:<table>` — Table in specific schema
 
+**Roles:** when a datatable is under roles, its queries run as a role, which only reaches what it was granted. `roles` records the role the app uses each datatable through; the app's code must pass the same role: `wmill.datatable('main', { role: 'analyst' })` in TypeScript, `wmill.datatable('main', role='analyst')` in Python. A datatable without an entry is used as its default role.
+
 ## SQL Migrations (sql_to_apply/)
 
 The `sql_to_apply/` folder is for creating/modifying database tables during development.
diff --git a/system_prompts/auto-generated/skills/write-script-bun/SKILL.md b/system_prompts/auto-generated/skills/write-script-bun/SKILL.md
index c89a87fa5d..1d52d0a8a1 100644
--- a/system_prompts/auto-generated/skills/write-script-bun/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-bun/SKILL.md
@@ -736,6 +736,8 @@ parseS3Object(s3Object: S3Object): S3ObjectRecord
 /**
  * Create a SQL template function for PostgreSQL/datatable queries
  * @param name - Database/datatable name (default: "main")
+ * @param opts.role - Connect as this data table role instead of the data table's default one.
+ *   Only meaningful on a data table under roles, and only for a role you are a tenant of.
  * @returns SQL template function for building parameterized queries
  * @example
  * let sql = wmill.datatable()
@@ -745,8 +747,11 @@ parseS3Object(s3Object: S3Object): S3ObjectRecord
  *   SELECT * FROM friends
  *     WHERE name = ${name} AND age = ${age}::int
  * `.fetch()
+ * @example
+ * // Read through a restricted role
+ * let sql = wmill.datatable("main", { role: "analytics" })
  */
-datatable(name: string = "main"): DatatableSqlTemplateFunction
+datatable(name: string = "main", opts?: DatatableOptions): DatatableSqlTemplateFunction
 
 /**
  * Create a SQL template function for DuckDB/ducklake queries
diff --git a/system_prompts/auto-generated/skills/write-script-bunnative/SKILL.md b/system_prompts/auto-generated/skills/write-script-bunnative/SKILL.md
index 82911c1096..4943c11baa 100644
--- a/system_prompts/auto-generated/skills/write-script-bunnative/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-bunnative/SKILL.md
@@ -736,6 +736,8 @@ parseS3Object(s3Object: S3Object): S3ObjectRecord
 /**
  * Create a SQL template function for PostgreSQL/datatable queries
  * @param name - Database/datatable name (default: "main")
+ * @param opts.role - Connect as this data table role instead of the data table's default one.
+ *   Only meaningful on a data table under roles, and only for a role you are a tenant of.
  * @returns SQL template function for building parameterized queries
  * @example
  * let sql = wmill.datatable()
@@ -745,8 +747,11 @@ parseS3Object(s3Object: S3Object): S3ObjectRecord
  *   SELECT * FROM friends
  *     WHERE name = ${name} AND age = ${age}::int
  * `.fetch()
+ * @example
+ * // Read through a restricted role
+ * let sql = wmill.datatable("main", { role: "analytics" })
  */
-datatable(name: string = "main"): DatatableSqlTemplateFunction
+datatable(name: string = "main", opts?: DatatableOptions): DatatableSqlTemplateFunction
 
 /**
  * Create a SQL template function for DuckDB/ducklake queries
diff --git a/system_prompts/auto-generated/skills/write-script-deno/SKILL.md b/system_prompts/auto-generated/skills/write-script-deno/SKILL.md
index 95f528223d..fcc2d68847 100644
--- a/system_prompts/auto-generated/skills/write-script-deno/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-deno/SKILL.md
@@ -738,6 +738,8 @@ parseS3Object(s3Object: S3Object): S3ObjectRecord
 /**
  * Create a SQL template function for PostgreSQL/datatable queries
  * @param name - Database/datatable name (default: "main")
+ * @param opts.role - Connect as this data table role instead of the data table's default one.
+ *   Only meaningful on a data table under roles, and only for a role you are a tenant of.
  * @returns SQL template function for building parameterized queries
  * @example
  * let sql = wmill.datatable()
@@ -747,8 +749,11 @@ parseS3Object(s3Object: S3Object): S3ObjectRecord
  *   SELECT * FROM friends
  *     WHERE name = ${name} AND age = ${age}::int
  * `.fetch()
+ * @example
+ * // Read through a restricted role
+ * let sql = wmill.datatable("main", { role: "analytics" })
  */
-datatable(name: string = "main"): DatatableSqlTemplateFunction
+datatable(name: string = "main", opts?: DatatableOptions): DatatableSqlTemplateFunction
 
 /**
  * Create a SQL template function for DuckDB/ducklake queries
diff --git a/system_prompts/auto-generated/skills/write-script-python3/SKILL.md b/system_prompts/auto-generated/skills/write-script-python3/SKILL.md
index 1ccb376a9f..42916f7af5 100644
--- a/system_prompts/auto-generated/skills/write-script-python3/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-script-python3/SKILL.md
@@ -654,10 +654,13 @@ def send_teams_message(conversation_id: str, text: str, success: bool = True, ca
 # 
 # Args:
 #     name: Database name (default: "main")
+#     role: Connect as this data table role instead of the data table's default one.
+#         Only meaningful on a data table under roles, and only for a role you are a
+#         tenant of.
 # 
 # Returns:
 #     DataTableClient instance
-def datatable(name: str = 'main')
+def datatable(name: str = 'main', *, role: Optional[str] = None)
 
 # Get a DuckLake client for DuckDB queries.
 # 
@@ -875,7 +878,7 @@ def parse_sql_client_name(name: str) -> tuple[str, Optional[str]]
 # 
 #     @task(retry={"attempts": 3, "delay": 30, "multiplier": 2})
 #     async def call_api(payload: dict): ...
-def task(_func = None, path: Optional[str] = None, tag: Optional[str] = None, timeout: Optional[int] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None, retry: Optional[dict] = None)
+def task(_func = None, *, path: Optional[str] = None, tag: Optional[str] = None, timeout: Optional[int] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None, retry: Optional[dict] = None)
 
 # Create a task that dispatches to a separate Windmill script.
 # 
@@ -888,7 +891,7 @@ def task(_func = None, path: Optional[str] = None, tag: Optional[str] = None, ti
 #     @workflow
 #     async def main():
 #         data = await extract(url="https://...")
-def task_script(path: str, timeout: Optional[int] = None, tag: Optional[str] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None, retry: Optional[dict] = None)
+def task_script(path: str, *, timeout: Optional[int] = None, tag: Optional[str] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None, retry: Optional[dict] = None)
 
 # Create a task that dispatches to a separate Windmill flow.
 # 
@@ -901,7 +904,7 @@ def task_script(path: str, timeout: Optional[int] = None, tag: Optional[str] = N
 #     @workflow
 #     async def main():
 #         result = await pipeline(input=data)
-def task_flow(path: str, timeout: Optional[int] = None, tag: Optional[str] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None, retry: Optional[dict] = None)
+def task_flow(path: str, *, timeout: Optional[int] = None, tag: Optional[str] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None, retry: Optional[dict] = None)
 
 # Decorator marking an async function as a workflow-as-code entry point.
 # 
@@ -966,7 +969,7 @@ async def wait_for_approval(timeout: int = 1800, form: dict | None = None, self_
 #         ...
 # 
 #     results = await parallel(items, process, concurrency=5)
-async def parallel(items, fn, concurrency: Optional[int] = None)
+async def parallel(items, fn, *, concurrency: Optional[int] = None)
 
 # Commit Kafka offsets for a trigger with auto_commit disabled.
 # 
diff --git a/system_prompts/base/raw-app-cli.md b/system_prompts/base/raw-app-cli.md
index cd98e06ff5..030b958379 100644
--- a/system_prompts/base/raw-app-cli.md
+++ b/system_prompts/base/raw-app-cli.md
@@ -167,6 +167,8 @@ data:
   tables:
     - main/users            # Table in public schema
     - main/app_schema:items # Table in specific schema
+  roles:                    # Optional: the role the app uses each datatable through
+    main: analyst
 ```
 
 **Table reference formats:**
@@ -174,6 +176,8 @@ data:
 - `<datatable>/<table>` — Specific table in public schema
 - `<datatable>/<schema>:<table>` — Table in specific schema
 
+**Roles:** when a datatable is under roles, its queries run as a role, which only reaches what it was granted. `roles` records the role the app uses each datatable through; the app's code must pass the same role: `wmill.datatable('main', { role: 'analyst' })` in TypeScript, `wmill.datatable('main', role='analyst')` in Python. A datatable without an entry is used as its default role.
+
 ## SQL Migrations (sql_to_apply/)
 
 The `sql_to_apply/` folder is for creating/modifying database tables during development.
diff --git a/system_prompts/generate.py b/system_prompts/generate.py
index 439fb7df9f..2860b9d15c 100644
--- a/system_prompts/generate.py
+++ b/system_prompts/generate.py
@@ -223,7 +223,12 @@ def extract_py_functions(content: str) -> list[dict]:
         if args.vararg:
             params.append(f"*{args.vararg.arg}")
 
-        # Handle keyword-only args
+        # Handle keyword-only args. Same bare `*` as `_format_py_params`: without it the rendered
+        # signature reads as all-positional, and code written against this reference passes a
+        # keyword-only argument positionally and gets a TypeError.
+        if args.kwonlyargs and not args.vararg:
+            params.append('*')
+
         for i, arg in enumerate(args.kwonlyargs):
             param_str = arg.arg
             if arg.annotation:
@@ -1266,6 +1271,12 @@ def _format_py_params(node: ast.FunctionDef, skip_self: bool = False) -> str:
             vararg_str += f": {ast.unparse(args.vararg.annotation)}"
         params.append(vararg_str)
 
+    # A bare `*` before the keyword-only args, when nothing else already introduced them.
+    # Without it the rendered signature reads as all-positional, and a caller written against
+    # these docs passes a keyword-only argument positionally and gets a TypeError.
+    if args.kwonlyargs and not args.vararg:
+        params.append('*')
+
     for i, arg in enumerate(args.kwonlyargs):
         param_str = arg.arg
         if arg.annotation:
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index 753b906793..26441041a1 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.814.0",
+  "version": "1.817.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts", "./wacError.ts"]
diff --git a/typescript-client/package-lock.json b/typescript-client/package-lock.json
index 20b2270c6e..f881fc7308 100644
--- a/typescript-client/package-lock.json
+++ b/typescript-client/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "windmill-client",
-  "version": "1.999.21",
+  "version": "1.813.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "windmill-client",
-      "version": "1.999.21",
+      "version": "1.813.0",
       "license": "Apache 2.0",
       "devDependencies": {
         "@types/node": "^20.17.16",
@@ -480,9 +480,9 @@
       }
     },
     "node_modules/defu": {
-      "version": "6.1.4",
-      "resolved": "https://registry.npmjs.org/defu/-/defu-6.1.4.tgz",
-      "integrity": "sha512-mEQCMmwJu317oSz8CwdIOdwf3xMif1ttiM8LTufzc3g6kR+9Pe236twL8j3IYT1F7GfRgGcW6MWxzZjLIkuHIg==",
+      "version": "6.1.7",
+      "resolved": "https://registry.npmjs.org/defu/-/defu-6.1.7.tgz",
+      "integrity": "sha512-7z22QmUWiQ/2d0KkdYmANbRUVABpZ9SNYyH5vx6PZ+nE5bcC0l7uFvEfHlyld/HcGBFTL536ClDt3DEcSlEJAQ==",
       "dev": true,
       "license": "MIT"
     },
@@ -603,9 +603,9 @@
       "license": "MIT"
     },
     "node_modules/picomatch": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
-      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+      "version": "4.0.7",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz",
+      "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==",
       "dev": true,
       "license": "MIT",
       "engines": {
diff --git a/typescript-client/package.json b/typescript-client/package.json
index 327a37e3f5..4badfa307b 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.814.0",
+  "version": "1.817.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/typescript-client#readme",
diff --git a/typescript-client/sqlUtils.d.ts b/typescript-client/sqlUtils.d.ts
index c791c8833d..c7463bf7b0 100644
--- a/typescript-client/sqlUtils.d.ts
+++ b/typescript-client/sqlUtils.d.ts
@@ -85,7 +85,10 @@ export interface DatatableSqlTemplateFunction extends SqlTemplateFunction {
   query<T = any>(sql: string, ...params: any[]): SqlStatement<T>;
 }
 
-export declare function datatable(name: string): DatatableSqlTemplateFunction;
+export interface DatatableOptions {
+    role?: string;
+}
+export declare function datatable(name?: string, opts?: DatatableOptions): DatatableSqlTemplateFunction;
 export declare function ducklake(name: string): SqlTemplateFunction;
 
 export interface DucklakeMaterializeOptions {
diff --git a/typescript-client/sqlUtils.ts b/typescript-client/sqlUtils.ts
index 85c563095b..4c1ccd7ea4 100644
--- a/typescript-client/sqlUtils.ts
+++ b/typescript-client/sqlUtils.ts
@@ -108,11 +108,19 @@ export interface DatatableSqlTemplateFunction extends SqlTemplateFunction {
   query<T = any>(sql: string, ...params: any[]): SqlStatement<T>;
 }
 
+export interface DatatableOptions {
+  /** The data table role to connect as. Omit to get the data table's default role. */
+  role?: string;
+}
+
 // ---------------------------------------------------------------------------
 // Provider interface — captures what differs between datatable and ducklake
 // ---------------------------------------------------------------------------
 
 interface SqlProvider {
+  /** Leading annotation lines. Emitted before everything else: the executor's annotation parser
+   * stops at the first non-comment line. */
+  annotations(): string;
   formatArgDecl(argNum: number, argType: string): string;
   formatArgUsage(
     argNum: number,
@@ -125,11 +133,25 @@ interface SqlProvider {
   providerName: string;
 }
 
-function datatableProvider(name: string, schema?: string): SqlProvider {
+// Interpolated into a `-- role <name>` line, so a value carrying a newline could append
+// statements of its own. Mirrors the server's own role-name rule.
+const ROLE_NAME_RE = /^[A-Za-z0-9_-]{1,63}$/;
+
+function datatableProvider(
+  name: string,
+  schema?: string,
+  role?: string
+): SqlProvider {
+  if (role !== undefined && !ROLE_NAME_RE.test(role)) {
+    throw new Error(
+      `Invalid data table role '${role}': only letters, digits, '_' and '-' are allowed`
+    );
+  }
   return {
     providerName: "datatable",
     language: "postgresql",
     extraArgs: { database: `datatable://${name}` },
+    annotations: () => (role !== undefined ? `-- role ${role}\n` : ""),
     formatArgDecl: (argNum) => `-- $${argNum} arg${argNum}`,
     formatArgUsage: (argNum, explicitType, inferredType) =>
       explicitType !== undefined
@@ -144,6 +166,7 @@ function ducklakeProvider(name: string, schema?: string): SqlProvider {
     providerName: "ducklake",
     language: "duckdb",
     extraArgs: {},
+    annotations: () => "",
     formatArgDecl: (argNum, argType) => `-- $arg${argNum} (${argType})`,
     formatArgUsage: (argNum) => `$arg${argNum}`,
     // `USE dl."schema"` sets the active schema so unqualified tables resolve there.
@@ -272,7 +295,8 @@ function buildSqlTemplateFunction(provider: SqlProvider): SqlTemplateFunction {
         return provider.formatArgDecl(info.argNum, argType);
       });
 
-    let content = argDecls.length ? argDecls.join("\n") + "\n" : "";
+    let content = provider.annotations();
+    content += argDecls.length ? argDecls.join("\n") + "\n" : "";
     content += provider.preamble();
 
     // SQL body — inline raw values, reference params via provider syntax
@@ -322,6 +346,8 @@ function buildSqlTemplateFunction(provider: SqlProvider): SqlTemplateFunction {
 /**
  * Create a SQL template function for PostgreSQL/datatable queries
  * @param name - Database/datatable name (default: "main")
+ * @param opts.role - Connect as this data table role instead of the data table's default one.
+ *   Only meaningful on a data table under roles, and only for a role you are a tenant of.
  * @returns SQL template function for building parameterized queries
  * @example
  * let sql = wmill.datatable()
@@ -331,10 +357,16 @@ function buildSqlTemplateFunction(provider: SqlProvider): SqlTemplateFunction {
  *   SELECT * FROM friends
  *     WHERE name = ${name} AND age = ${age}::int
  * `.fetch()
+ * @example
+ * // Read through a restricted role
+ * let sql = wmill.datatable("main", { role: "analytics" })
  */
-export function datatable(name: string = "main"): DatatableSqlTemplateFunction {
+export function datatable(
+  name: string = "main",
+  opts?: DatatableOptions
+): DatatableSqlTemplateFunction {
   let { name: n, schema } = parseName(name);
-  let provider = datatableProvider(n, schema);
+  let provider = datatableProvider(n, schema, opts?.role);
   let sqlFn = buildSqlTemplateFunction(provider) as DatatableSqlTemplateFunction;
   // `.query(sql, ...params)` is for SQL strings that already contain
   // positional placeholders ($1, $2, ...). We DON'T go through the template
@@ -353,7 +385,10 @@ export function datatable(name: string = "main"): DatatableSqlTemplateFunction {
       .join("\n");
     let contentBody = sqlString;
     let content =
-      (argDecls ? argDecls + "\n" : "") + provider.preamble() + sqlString;
+      provider.annotations() +
+      (argDecls ? argDecls + "\n" : "") +
+      provider.preamble() +
+      sqlString;
     let args = {
       ...Object.fromEntries(
         params.map((v, i) => [`arg${i + 1}`, serializeArgValue(v)])
diff --git a/version.txt b/version.txt
index 9f38cdf20a..2edd9ebec3 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.814.0
+1.817.0
diff --git a/windmill-yaml-validator/package-lock.json b/windmill-yaml-validator/package-lock.json
index 0c9e94cd0a..e07061650d 100644
--- a/windmill-yaml-validator/package-lock.json
+++ b/windmill-yaml-validator/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "windmill-yaml-validator",
-  "version": "1.814.0",
+  "version": "1.817.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "windmill-yaml-validator",
-      "version": "1.814.0",
+      "version": "1.817.0",
       "license": "Apache 2.0",
       "dependencies": {
         "@stoplight/yaml": "^4.3.0",
@@ -20,28 +20,14 @@
         "typescript": "^5.0.0"
       }
     },
-    "node_modules/@ampproject/remapping": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/@ampproject/remapping/-/remapping-2.3.0.tgz",
-      "integrity": "sha512-30iZtAPgz+LTIYoeivqYo853f02jBYSd5uGnGpkFV0M3xOt9aN73erkgYAmZU43x4VfqcnLxW9Kpg3R5LC4YYw==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@jridgewell/gen-mapping": "^0.3.5",
-        "@jridgewell/trace-mapping": "^0.3.24"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
     "node_modules/@babel/code-frame": {
-      "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.27.1.tgz",
-      "integrity": "sha512-cjQ7ZlQ0Mv3b47hABuTevyTuYN4i+loJKGeV9flcCgIK37cCXRh+L1bd3iBHlynerhQ7BhCkn2BPbQUL+rGqFg==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.7.tgz",
+      "integrity": "sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-validator-identifier": "^7.27.1",
+        "@babel/helper-validator-identifier": "^7.29.7",
         "js-tokens": "^4.0.0",
         "picocolors": "^1.1.1"
       },
@@ -50,9 +36,9 @@
       }
     },
     "node_modules/@babel/compat-data": {
-      "version": "7.28.0",
-      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.28.0.tgz",
-      "integrity": "sha512-60X7qkglvrap8mn1lh2ebxXdZYtUcpd7gsmy9kLaBJ4i/WdY8PqTSdxyA8qraikqKQK5C1KRBKXqznrVapyNaw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.7.tgz",
+      "integrity": "sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -60,22 +46,22 @@
       }
     },
     "node_modules/@babel/core": {
-      "version": "7.28.0",
-      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.28.0.tgz",
-      "integrity": "sha512-UlLAnTPrFdNGoFtbSXwcGFQBtQZJCNjaN6hQNP3UPvuNXT1i82N26KL3dZeIpNalWywr9IuQuncaAfUaS1g6sQ==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.7.tgz",
+      "integrity": "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@ampproject/remapping": "^2.2.0",
-        "@babel/code-frame": "^7.27.1",
-        "@babel/generator": "^7.28.0",
-        "@babel/helper-compilation-targets": "^7.27.2",
-        "@babel/helper-module-transforms": "^7.27.3",
-        "@babel/helpers": "^7.27.6",
-        "@babel/parser": "^7.28.0",
-        "@babel/template": "^7.27.2",
-        "@babel/traverse": "^7.28.0",
-        "@babel/types": "^7.28.0",
+        "@babel/code-frame": "^7.29.7",
+        "@babel/generator": "^7.29.7",
+        "@babel/helper-compilation-targets": "^7.29.7",
+        "@babel/helper-module-transforms": "^7.29.7",
+        "@babel/helpers": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/template": "^7.29.7",
+        "@babel/traverse": "^7.29.7",
+        "@babel/types": "^7.29.7",
+        "@jridgewell/remapping": "^2.3.5",
         "convert-source-map": "^2.0.0",
         "debug": "^4.1.0",
         "gensync": "^1.0.0-beta.2",
@@ -91,14 +77,14 @@
       }
     },
     "node_modules/@babel/generator": {
-      "version": "7.28.0",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.28.0.tgz",
-      "integrity": "sha512-lJjzvrbEeWrhB4P3QBsH7tey117PjLZnDbLiQEKjQ/fNJTjuq4HSqgFA+UNSwZT8D7dxxbnuSBMsa1lrWzKlQg==",
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.8.tgz",
+      "integrity": "sha512-gZbepsdh3WDtgZKWL+vTPh71LSBrm/Y4/QDZBVCcYfmeTEEuoOYwlSy+G1StfJg+/Zy550u/3TATbm7qDbbMtg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/parser": "^7.28.0",
-        "@babel/types": "^7.28.0",
+        "@babel/parser": "^7.29.8",
+        "@babel/types": "^7.29.8",
         "@jridgewell/gen-mapping": "^0.3.12",
         "@jridgewell/trace-mapping": "^0.3.28",
         "jsesc": "^3.0.2"
@@ -108,14 +94,14 @@
       }
     },
     "node_modules/@babel/helper-compilation-targets": {
-      "version": "7.27.2",
-      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.27.2.tgz",
-      "integrity": "sha512-2+1thGUUWWjLTYTHZWK1n8Yga0ijBz1XAhUXcKy81rd5g6yh7hGqMp45v7cadSbEHc9G3OTv45SyneRN3ps4DQ==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.29.7.tgz",
+      "integrity": "sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/compat-data": "^7.27.2",
-        "@babel/helper-validator-option": "^7.27.1",
+        "@babel/compat-data": "^7.29.7",
+        "@babel/helper-validator-option": "^7.29.7",
         "browserslist": "^4.24.0",
         "lru-cache": "^5.1.1",
         "semver": "^6.3.1"
@@ -125,9 +111,9 @@
       }
     },
     "node_modules/@babel/helper-globals": {
-      "version": "7.28.0",
-      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.28.0.tgz",
-      "integrity": "sha512-+W6cISkXFa1jXsDEdYA8HeevQT/FULhxzR99pxphltZcVaugps53THCeiWA8SguxxpSp3gKPiuYfSWopkLQ4hw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.29.7.tgz",
+      "integrity": "sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -135,29 +121,29 @@
       }
     },
     "node_modules/@babel/helper-module-imports": {
-      "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.27.1.tgz",
-      "integrity": "sha512-0gSFWUPNXNopqtIPQvlD5WgXYI5GY2kP2cCvoT8kczjbfcfuIljTbcWrulD1CIPIX2gt1wghbDy08yE1p+/r3w==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.29.7.tgz",
+      "integrity": "sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/traverse": "^7.27.1",
-        "@babel/types": "^7.27.1"
+        "@babel/traverse": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/helper-module-transforms": {
-      "version": "7.27.3",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.27.3.tgz",
-      "integrity": "sha512-dSOvYwvyLsWBeIRyOeHXp5vPj5l1I011r52FM1+r1jCERv+aFXYk4whgQccYEGYxK2H3ZAIA8nuPkQ0HaUo3qg==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.29.7.tgz",
+      "integrity": "sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-module-imports": "^7.27.1",
-        "@babel/helper-validator-identifier": "^7.27.1",
-        "@babel/traverse": "^7.27.3"
+        "@babel/helper-module-imports": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7",
+        "@babel/traverse": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -177,9 +163,9 @@
       }
     },
     "node_modules/@babel/helper-string-parser": {
-      "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.27.1.tgz",
-      "integrity": "sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz",
+      "integrity": "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -187,9 +173,9 @@
       }
     },
     "node_modules/@babel/helper-validator-identifier": {
-      "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.27.1.tgz",
-      "integrity": "sha512-D2hP9eA+Sqx1kBZgzxZh0y1trbuU+JoDkiEwqhQ36nodYqJwyEIhPSdMNd7lOm/4io72luTPWH20Yda0xOuUow==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz",
+      "integrity": "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -197,9 +183,9 @@
       }
     },
     "node_modules/@babel/helper-validator-option": {
-      "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.27.1.tgz",
-      "integrity": "sha512-YvjJow9FxbhFFKDSuFnVCe2WxXk1zWc22fFePVNEaWJEu8IrZVlda6N0uHwzZrUM1il7NC9Mlp4MaJYbYd9JSg==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.29.7.tgz",
+      "integrity": "sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -207,27 +193,27 @@
       }
     },
     "node_modules/@babel/helpers": {
-      "version": "7.28.2",
-      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.28.2.tgz",
-      "integrity": "sha512-/V9771t+EgXz62aCcyofnQhGM8DQACbRhvzKFsXKC9QM+5MadF8ZmIm0crDMaz3+o0h0zXfJnd4EhbYbxsrcFw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.7.tgz",
+      "integrity": "sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/template": "^7.27.2",
-        "@babel/types": "^7.28.2"
+        "@babel/template": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/parser": {
-      "version": "7.28.0",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.28.0.tgz",
-      "integrity": "sha512-jVZGvOxOuNSsuQuLRTh13nU0AogFlw32w/MT+LV6D3sP5WdbW61E77RnkbaO2dUvmPAYrBDJXGn5gGS6tH4j8g==",
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.8.tgz",
+      "integrity": "sha512-E8lTAYNB1KW+FH+VGJuZM1ioAx2E6oVlvQFRrf5P8ZZmsiJXYAD9vTFV7yyEURNzgh1dFqMZuO6tUwcARbqFCA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/types": "^7.28.0"
+        "@babel/types": "^7.29.8"
       },
       "bin": {
         "parser": "bin/babel-parser.js"
@@ -476,33 +462,33 @@
       }
     },
     "node_modules/@babel/template": {
-      "version": "7.27.2",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.27.2.tgz",
-      "integrity": "sha512-LPDZ85aEJyYSd18/DkjNh4/y1ntkE5KwUHWTiqgRxruuZL2F1yuHligVHLvcHY2vMHXttKFpJn6LwfI7cw7ODw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.29.7.tgz",
+      "integrity": "sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.27.1",
-        "@babel/parser": "^7.27.2",
-        "@babel/types": "^7.27.1"
+        "@babel/code-frame": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/traverse": {
-      "version": "7.28.0",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.28.0.tgz",
-      "integrity": "sha512-mGe7UK5wWyh0bKRfupsUchrQGqvDbZDbKJw+kcRGSmdHVYrv+ltd0pnpDTVpiTqnaBru9iEvA8pz8W46v0Amwg==",
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.8.tgz",
+      "integrity": "sha512-I5z7H3bf/41ktsNVLtpN0wAa336HkqIHQ5BuPLEhTkt1jVSyZpeNKIzTgEWmlxjdg81R0IgUCcaE+Ok3NvrfZg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.27.1",
-        "@babel/generator": "^7.28.0",
-        "@babel/helper-globals": "^7.28.0",
-        "@babel/parser": "^7.28.0",
-        "@babel/template": "^7.27.2",
-        "@babel/types": "^7.28.0",
+        "@babel/code-frame": "^7.29.7",
+        "@babel/generator": "^7.29.8",
+        "@babel/helper-globals": "^7.29.7",
+        "@babel/parser": "^7.29.8",
+        "@babel/template": "^7.29.7",
+        "@babel/types": "^7.29.8",
         "debug": "^4.3.1"
       },
       "engines": {
@@ -510,14 +496,14 @@
       }
     },
     "node_modules/@babel/types": {
-      "version": "7.28.2",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.28.2.tgz",
-      "integrity": "sha512-ruv7Ae4J5dUYULmeXw1gmb7rYRz57OWCPM57pHojnLq/3Z1CK2lNSLTCVjxVk1F/TZHwOZZrOWi0ur95BbLxNQ==",
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.8.tgz",
+      "integrity": "sha512-Vj1jF3cPfxg7OAfoI7QnVKLoILlm2JF9pnVHrX8qx7AHMiYWT+NDAA7jChlNgRS4WTLc/fD1lXLmPixluj+3Gg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-string-parser": "^7.27.1",
-        "@babel/helper-validator-identifier": "^7.27.1"
+        "@babel/helper-string-parser": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -860,6 +846,17 @@
         "@jridgewell/trace-mapping": "^0.3.24"
       }
     },
+    "node_modules/@jridgewell/remapping": {
+      "version": "2.3.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz",
+      "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/gen-mapping": "^0.3.5",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      }
+    },
     "node_modules/@jridgewell/resolve-uri": {
       "version": "3.1.2",
       "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
@@ -1092,9 +1089,9 @@
       "license": "MIT"
     },
     "node_modules/ajv": {
-      "version": "8.17.1",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.17.1.tgz",
-      "integrity": "sha512-B/gBuNg5SiMTrPkC+A2+cW0RszwxYmn6VYxB/inlBStS5nx6xHIt/ehKRhIMhqusl7a8LjQoZnjCs5vhwxOQ1g==",
+      "version": "8.20.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
+      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
       "license": "MIT",
       "dependencies": {
         "fast-deep-equal": "^3.1.3",
@@ -1303,10 +1300,23 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/baseline-browser-mapping": {
+      "version": "2.11.24",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.24.tgz",
+      "integrity": "sha512-hYrgxie335U08WqICoGqKRzV1HFXv6zdxwJE4ekCb80CM9a0SVVsN4QPwT67RraRo+9h8IATk6uxHJw7QSkdOg==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "baseline-browser-mapping": "dist/cli.cjs"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
     "node_modules/brace-expansion": {
-      "version": "1.1.12",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+      "version": "1.1.21",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
+      "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1328,9 +1338,9 @@
       }
     },
     "node_modules/browserslist": {
-      "version": "4.25.1",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.25.1.tgz",
-      "integrity": "sha512-KGj0KoOMXLpSNkkEI6Z6mShmQy0bc1I+T7K9N81k4WWMrfz+6fQ6es80B/YLAeRoKvjYE1YSHHOW1qe9xIVzHw==",
+      "version": "4.29.0",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.29.0.tgz",
+      "integrity": "sha512-3GSvyjvDI4Dur1Meg2BekJquu5uF+9R9a1+5M1Mde192eZoXbeXjzgOsgqPS2V8D5wrrip0gR5Hf/GhWQ9ZzaA==",
       "dev": true,
       "funding": [
         {
@@ -1348,10 +1358,11 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "caniuse-lite": "^1.0.30001726",
-        "electron-to-chromium": "^1.5.173",
-        "node-releases": "^2.0.19",
-        "update-browserslist-db": "^1.1.3"
+        "baseline-browser-mapping": "^2.11.23",
+        "caniuse-lite": "^1.0.30001810",
+        "electron-to-chromium": "^1.5.427",
+        "node-releases": "^2.0.55",
+        "update-browserslist-db": "^1.3.3"
       },
       "bin": {
         "browserslist": "cli.js"
@@ -1411,9 +1422,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001731",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001731.tgz",
-      "integrity": "sha512-lDdp2/wrOmTRWuoB5DpfNkC0rJDU8DqRa6nYL6HK6sytw70QMopt/NIc/9SM7ylItlBWfACXk0tEn37UWM/+mg==",
+      "version": "1.0.30001810",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001810.tgz",
+      "integrity": "sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==",
       "dev": true,
       "funding": [
         {
@@ -1665,9 +1676,9 @@
       }
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.194",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.194.tgz",
-      "integrity": "sha512-SdnWJwSUot04UR51I2oPD8kuP2VI37/CADR1OHsFOUzZIvfWJBO6q11k5P/uKNyTT3cdOsnyjkrZ+DDShqYqJA==",
+      "version": "1.5.430",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.430.tgz",
+      "integrity": "sha512-e1QEj72Y4zd8RlNZVmoTg+iCOSVwpk05IOiiQwdrkwCSVlZfPthevErhE+nckGd2YbsXfp1SkisznhGVIXP2NQ==",
       "dev": true,
       "license": "ISC"
     },
@@ -1799,9 +1810,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.0.6",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.0.6.tgz",
-      "integrity": "sha512-Atfo14OibSv5wAp4VWNsFYE1AchQRTv9cBGWET4pZWHzYshFSS9NQI6I57rdKn9croWVMbYFbLhJ+yJvmZIIHw==",
+      "version": "3.1.8",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz",
+      "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==",
       "funding": [
         {
           "type": "github",
@@ -1835,9 +1846,9 @@
       }
     },
     "node_modules/filelist/node_modules/brace-expansion": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
-      "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+      "version": "2.1.7",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz",
+      "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1845,9 +1856,9 @@
       }
     },
     "node_modules/filelist/node_modules/minimatch": {
-      "version": "5.1.6",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.6.tgz",
-      "integrity": "sha512-lKwV/1brpG6mBUFHtb7NUmtABCb2WZZmm2wNiOA5hAb8VdCS4B3dtMWyvcoViccwAW/COERjXLt0zP1zXUN26g==",
+      "version": "5.1.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.9.tgz",
+      "integrity": "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -2857,9 +2868,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "3.14.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.1.tgz",
-      "integrity": "sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g==",
+      "version": "3.15.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz",
+      "integrity": "sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3044,9 +3055,9 @@
       }
     },
     "node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -3078,11 +3089,14 @@
       "license": "MIT"
     },
     "node_modules/node-releases": {
-      "version": "2.0.19",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.19.tgz",
-      "integrity": "sha512-xxOWJsBKtzAq7DY0J+DTzuz58K8e7sJbdgwkbMWQe8UYB6ekmsQ45q0M/tJDsGaZmbC+l7n57UV8Hl5tHxO9uw==",
+      "version": "2.0.55",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.55.tgz",
+      "integrity": "sha512-mIrE/Cw9y+9Au6dS5vDKDhQza9YvG6w+ZrS6X+ZzA7yFW/soAeaups4Qzn1bL6g5FVy8WtP79+0j82oPIbqRjQ==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
     },
     "node_modules/normalize-path": {
       "version": "3.0.0",
@@ -3252,9 +3266,9 @@
       "license": "ISC"
     },
     "node_modules/picomatch": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
-      "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
+      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3790,9 +3804,9 @@
       "license": "MIT"
     },
     "node_modules/update-browserslist-db": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.1.3.tgz",
-      "integrity": "sha512-UxhIZQ+QInVdunkDAaiazvvT/+fXL5Osr0JZlJulepYu6Jd7qJtDZjlur0emRlT71EN3ScPoE7gvsuIKKNavKw==",
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.3.tgz",
+      "integrity": "sha512-pJ2sYawQS0R/WI928Gj5GlPhTGzbMelq0+4INtSYNDV9ErKJcX6xjGWkoG/VnB3dpUm00zALaqkrUD77pO5TDQ==",
       "dev": true,
       "funding": [
         {
diff --git a/windmill-yaml-validator/package.json b/windmill-yaml-validator/package.json
index 7a15686549..01bb378dcd 100644
--- a/windmill-yaml-validator/package.json
+++ b/windmill-yaml-validator/package.json
@@ -1,6 +1,6 @@
 {
   "name": "windmill-yaml-validator",
-  "version": "1.814.0",
+  "version": "1.817.0",
   "description": "YAML validator for Windmill flow, schedule, and trigger files",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",