fix(frontend): keep a draft-only rename consistent with its storage key

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Wy24UHSVRZdDaPWiBay9MG
fix(frontend): keep autosaving a reopened draft-only item
2026-09-19 00:02:28 +00:00 · 2026-09-04 02:01:43 +02:00 · 2026-09-04 01:45:06 +02:00 · 2026-09-04 01:25:21 +02:00 · 2026-09-04 00:59:21 +02:00 · 2026-09-04 00:53:52 +02:00
1371 changed files with 26340 additions and 114100 deletions
@@ -1,6 +1,6 @@
 ---
 name: local-review-codex
-description: Run the CI Codex PR review locally against this branch's unpushed work (committed + uncommitted) before pushing. Same policy and reasoning effort as the codex-pr-review GitHub action, on a newer model.
+description: Run the CI Codex PR review locally against this branch's unpushed work (committed + uncommitted) before pushing. Same policy, model, and reasoning effort as the codex-pr-review GitHub action.
 ---

 # Local Codex Review (pre-push)
@@ -11,18 +11,17 @@ before the PR exists. Use this before `git push` on a non-trivial change.

 **Correspondence with CI** — identical:
 - Policy: `REVIEW.md` (severity triage, public-surface checklist, AGENTS.md compliance, test coverage).
- Reasoning effort: `model_reasoning_effort="xhigh"`.
+- Model: `gpt-5.6-sol`, `model_reasoning_effort="xhigh"`.
 - Output: markdown starting with `## Codex Review`, findings tagged P0 / P1 / P2 with file:line.

 **Differences from CI** — local-only:
- Model is `gpt-6-astra`; CI stays on `gpt-5.6-sol`. Not an oversight to reconcile: `gpt-6-astra` is confirmed on the ChatGPT auth `codex login` uses locally, while CI authenticates with `OPENAI_API_KEY` (`codex-pr-review.yml` prefers it over `CODEX_AUTH_JSON`) and that tier is unverified for the model. Move CI once API access is confirmed, or once CI switches to `CODEX_AUTH_JSON`.
 - Scope is the current branch vs `main` at the merge-base, **including uncommitted changes** (CI reviews a pushed PR diff).
 - Sandbox is `read-only` (CI uses `danger-full-access` on an ephemeral runner). Codex reads the diff and files but cannot modify your working tree.
 - Fresh context is inherent: `codex exec` is a separate cold process, so it does not anchor on the current chat session — the same reason `local-review` insists on a subagent.

 ## Prerequisites

- `codex` CLI **>= 0.153.4** installed and authed via `codex login` (an `OPENAI_API_KEY` in the environment takes priority and may not reach `gpt-6-astra` — see the model note above). Older CLIs reject the model with "requires a newer version of Codex"; `run.sh` checks the version up front. Upgrade with `npm install --global @openai/codex@0.153.4` (may need `sudo` for a global install). This matches the pin in `.github/workflows/codex-pr-review.yml` — the CLI version is the same on both sides, only the model differs.
+- `codex` CLI **>= 0.144.1** installed and authed (`codex login` or `OPENAI_API_KEY`). Older CLIs reject `gpt-5.6-sol` with "requires a newer version of Codex". Upgrade with `npm install --global @openai/codex@0.144.1` (may need `sudo` for a global install). Keep this in sync with the pin in `.github/workflows/codex-pr-review.yml`.
 - `git fetch` the base ref if it's stale, so the merge-base is accurate.

 ## Run
@@ -1,44 +1,21 @@
 #!/usr/bin/env bash
 # Local Codex review — mirrors the .github/workflows/codex-pr-review.yml CI job,
 # but scoped to this branch's unpushed work (committed + uncommitted) so you can
-# review before pushing. Same policy (REVIEW.md) and reasoning effort (xhigh) as CI.
-#
-# The model deliberately differs from CI: gpt-6-astra is confirmed available on the
-# ChatGPT auth `codex login` uses here, but CI authenticates with OPENAI_API_KEY and
-# that tier is unverified for it, so codex-pr-review.yml stays on gpt-5.6-sol.
+# review before pushing. Same policy (REVIEW.md), same model (gpt-5.6-sol) and
+# reasoning effort (xhigh) as CI. Runs read-only: Codex cannot modify your tree.
 #
 # Usage: run.sh [BASE_REF]   (BASE_REF defaults to "main")
 set -euo pipefail

-MODEL="gpt-6-astra"
-CODEX_MIN="0.153.4"
-
 BASE_REF="${1:-main}"
 REPO_ROOT="$(git rev-parse --show-toplevel)"
 cd "$REPO_ROOT"

 if ! command -v codex >/dev/null 2>&1; then
-  echo "codex CLI not found. Install with: npm install --global @openai/codex@$CODEX_MIN" >&2
+  echo "codex CLI not found. Install with: npm install --global @openai/codex@0.144.1" >&2
  exit 1
 fi

-# Older CLIs reject the model with an error that never names the CLI version as the
-# cause, so check it up front rather than letting the exec fail opaquely. The `|| true`
-# keeps an unrecognised --version format from aborting under `set -e`: an unparseable
-# version means "cannot tell", which must fall through to the exec, not kill the review.
-CODEX_VER="$(codex --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || true)"
-if [ -n "$CODEX_VER" ] && [ "$(printf '%s\n%s\n' "$CODEX_MIN" "$CODEX_VER" | sort -V | head -1)" != "$CODEX_MIN" ]; then
-  echo "codex $CODEX_VER is too old for $MODEL (need >= $CODEX_MIN). Upgrade with: npm install --global @openai/codex@$CODEX_MIN" >&2
-  exit 1
-fi
-
-# codex prefers OPENAI_API_KEY over the ChatGPT credentials `codex login` stores, and
-# that tier is not confirmed for $MODEL — the resulting failure names the model, not the
-# auth that selected it.
-if [ -n "${OPENAI_API_KEY:-}" ]; then
-  echo "warning: OPENAI_API_KEY is set and takes priority over 'codex login' credentials; $MODEL may be unavailable on that tier." >&2
-fi
-
 # Resolve the base to a concrete commit, preferring a local ref but falling back to
 # the remote-tracking ref — checkouts (CI, single-branch clones) often have only
 # origin/main, not a local main.
@@ -103,7 +80,7 @@ EOF

 codex exec \
  -C "$REPO_ROOT" \
-  -m "$MODEL" \
+  -m gpt-5.6-sol \
  -c 'model_reasoning_effort="xhigh"' \
  -s read-only \
  -o "$OUT" \
@@ -1,56 +0,0 @@
-name: Sign image and attach provenance
-description: >
-  Keyless-signs a pushed image digest with cosign (index and per-arch
-  manifests) and records SLSA provenance as a GitHub artifact attestation
-  pushed to the registry. SBOMs are not generated here: the build step embeds
-  them as BuildKit attestation manifests (depot `sbom: true`), which the index
-  signature then covers. The calling job must already be logged in to the
-  registry and must have id-token: write, attestations: write and
-  packages: write permissions (write-all covers all three).
-inputs:
-  image:
-    description: "Fully-qualified image name without tag, e.g. ghcr.io/windmill-labs/windmill"
-    required: true
-  digest:
-    description: "Pushed manifest digest (sha256:...) from build-push-action"
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Preflight
-      shell: bash
-      env:
-        DIGEST: ${{ inputs.digest }}
-      run: |
-        if [ -z "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" ]; then
-          echo "::error::No OIDC token available; the calling job needs id-token: write"
-          exit 1
-        fi
-        case "$DIGEST" in
-          sha256:*) ;;
-          *)
-            echo "::error::digest '$DIGEST' is not a sha256: digest"
-            exit 1
-            ;;
-        esac
-
-    # cosign v2 writes the classic sha256-<digest>.sig tag format that the
-    # installed base of cosign clients can verify; v3's bundle format cannot be
-    # verified by v2 clients yet, so stay on v2 until v3 verification is common.
-    - uses: sigstore/cosign-installer@v4.1.2
-      with:
-        cosign-release: "v2.6.5"
-
-    - name: Cosign keyless sign (index + per-arch manifests)
-      shell: bash
-      env:
-        IMAGE: ${{ inputs.image }}
-        DIGEST: ${{ inputs.digest }}
-      run: cosign sign --yes --recursive "${IMAGE}@${DIGEST}"
-
-    - name: SLSA provenance (GitHub artifact attestation)
-      uses: actions/attest-build-provenance@v4
-      with:
-        subject-name: ${{ inputs.image }}
-        subject-digest: ${{ inputs.digest }}
-        push-to-registry: true
@@ -12,7 +12,6 @@ sed -i '' -e "/^export const VERSION =/s/= .*/= \"v$VERSION\";/" ${root_dirpath}
 sed -i '' -e "/version: /s/: .*/: $VERSION/" ${root_dirpath}/backend/windmill-api/openapi.yaml
 sed -i '' -e "/version: /s/: .*/: $VERSION/" ${root_dirpath}/openflow.openapi.yaml
 sed -i '' -e "/\"version\": /s/: .*,/: \"$VERSION\",/" ${root_dirpath}/typescript-client/package.json
-sed -i '' -e "/\"version\": /s/: .*,/: \"$VERSION\",/" ${root_dirpath}/chat-sdk/package.json
 sed -i '' -e "/\"version\": /s/: .*,/: \"$VERSION\",/" ${root_dirpath}/frontend/package.json
 sed -i '' -e "/^version =/s/= .*/= \"$VERSION\"/" ${root_dirpath}/python-client/wmill/pyproject.toml
 sed -i '' -e "/^windmill-api =/s/= .*/= \"\\^$VERSION\"/" ${root_dirpath}/python-client/wmill/pyproject.toml
@@ -13,7 +13,6 @@ sed -i -e "/version: /s/: .*/: $VERSION/" ${root_dirpath}/backend/windmill-api/o
 sed -i -e "/version: /s/: .*/: $VERSION/" ${root_dirpath}/openflow.openapi.yaml
 sed -i -e "/\"version\": /s/: .*,/: \"$VERSION\",/" ${root_dirpath}/typescript-client/package.json
 sed -i -e "/\"version\": /s/: .*,/: \"$VERSION\",/" ${root_dirpath}/typescript-client/jsr.json
-sed -i -e "/\"version\": /s/: .*,/: \"$VERSION\",/" ${root_dirpath}/chat-sdk/package.json
 sed -i -e "/\"version\": /s/: .*,/: \"$VERSION\",/" ${root_dirpath}/frontend/package.json
 sed -i -e "/\"version\": /s/: .*,/: \"$VERSION\",/" ${root_dirpath}/windmill-yaml-validator/package.json
 sed -i -e "/^version =/s/= .*/= \"$VERSION\"/" ${root_dirpath}/python-client/wmill/pyproject.toml
@@ -34,5 +33,3 @@ cd ${root_dirpath}/frontend && npm i --package-lock-only --ignore-scripts
 # The CLI installs this package on every `bun install`, which would otherwise rewrite the
 # lockfile's version and leave a dirty tree.
 cd ${root_dirpath}/windmill-yaml-validator && npm i --package-lock-only --ignore-scripts
-
-cd ${root_dirpath}/chat-sdk && npm i --package-lock-only --ignore-scripts
@@ -13,13 +13,9 @@ permissions:
  contents: read
  id-token: write
  packages: write
-  attestations: write

 jobs:
  publish_cli:
-    # a tag-targeted dispatch would republish the release tags unsigned,
-    # un-verifying the release; to republish a release, re-push its tag
-    if: github.event_name == 'push' || !startsWith(github.ref, 'refs/tags/')
    runs-on: ubicloud
    steps:
      - uses: actions/checkout@v4
@@ -46,23 +42,14 @@ jobs:
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push publicly
-        id: docker_build
        uses: depot/build-push-action@v1
        with:
          file: "./docker/DockerfileCli"
          platforms: linux/amd64,linux/arm64
          push: true
-          sbom: ${{ startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push' }}
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
            ${{ steps.meta.outputs.tags }}
          labels: |
            ${{ steps.meta.outputs.labels }}
            org.opencontainers.image.licenses=AGPLv3
-
-      - name: Sign and attest release image
-        if: startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push'
-        uses: ./.github/actions/sign-attest-image
-        with:
-          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          digest: ${{ steps.docker_build.outputs.digest }}
@@ -219,7 +219,7 @@ jobs:

      - name: Install Codex CLI
        if: steps.codex_config.outputs.enabled == 'true' && steps.pr.outputs.skip != 'true'
-        run: npm install --global @openai/codex@0.153.4
+        run: npm install --global @openai/codex@0.144.1

      - name: Configure Codex auth
        if: steps.codex_config.outputs.enabled == 'true' && steps.pr.outputs.skip != 'true'
@@ -86,13 +86,11 @@ jobs:
            type=semver,pattern={{major}}.{{minor}}

      - name: Build and push publicly
-        id: docker_build
        uses: depot/build-push-action@v1
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
-          sbom: ${{ startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push' }}
          build-args: |
            features=ce
            WM_BUILD_VERSION=${{ github.sha }}
@@ -102,13 +100,6 @@ jobs:
          labels: |
            ${{ steps.meta-public.outputs.labels }}

-      - name: Sign and attest release image
-        if: startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push'
-        uses: ./.github/actions/sign-attest-image
-        with:
-          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          digest: ${{ steps.docker_build.outputs.digest }}
-
  build_ee:
    runs-on: ubicloud
    if: (github.event_name != 'workflow_dispatch') || github.event.inputs.ee
@@ -158,13 +149,11 @@ jobs:
          ./backend/substitute_ee_code.sh --copy --dir ./windmill-ee-private

      - name: Build and push publicly ee
-        id: docker_build
        uses: depot/build-push-action@v1
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
-          sbom: ${{ startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push' }}
          build-args: |
            features=ee
            WM_BUILD_VERSION=${{ github.sha }}
@@ -175,13 +164,6 @@ jobs:
            ${{ steps.meta-ee-public.outputs.labels }}
            org.opencontainers.image.licenses=Windmill-Enterprise-License

-      - name: Sign and attest release image
-        if: startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push'
-        uses: ./.github/actions/sign-attest-image
-        with:
-          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee
-          digest: ${{ steps.docker_build.outputs.digest }}
-
  attach_amd64_binary_to_release:
    needs: [build, build_ee]
    runs-on: ubicloud
@@ -376,21 +358,6 @@ jobs:
          docker buildx imagetools create ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEV_SHA }} --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
          docker buildx imagetools create ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEV_SHA }} --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:main

-      - uses: sigstore/cosign-installer@v4.1.2
-        if: startsWith(github.ref, 'refs/tags/v')
-        with:
-          cosign-release: "v2.6.5"
-      # end-to-end release guard: the version tag pushed by this run must
-      # verify against this exact run's identity (the mutable :latest/:dev
-      # tags race with concurrent main builds, so they are not asserted here)
-      - name: Verify release image is signed
-        if: startsWith(github.ref, 'refs/tags/v')
-        run: |
-          cosign verify \
-            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
-            --certificate-identity "https://github.com/windmill-labs/windmill/.github/workflows/docker-image.yml@${GITHUB_REF}" \
-            "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${GITHUB_REF_NAME#v}"
-
  tag_latest_ee:
    runs-on: ubicloud
    needs: [run_integration_test, build_ee]
@@ -412,21 +379,6 @@ jobs:
          docker buildx imagetools create ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:${{ env.DEV_SHA }} --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:latest
          docker buildx imagetools create ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:${{ env.DEV_SHA }} --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:main

-      - uses: sigstore/cosign-installer@v4.1.2
-        if: startsWith(github.ref, 'refs/tags/v')
-        with:
-          cosign-release: "v2.6.5"
-      # end-to-end release guard: the version tag pushed by this run must
-      # verify against this exact run's identity (the mutable :latest/:dev
-      # tags race with concurrent main builds, so they are not asserted here)
-      - name: Verify release ee image is signed
-        if: startsWith(github.ref, 'refs/tags/v')
-        run: |
-          cosign verify \
-            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
-            --certificate-identity "https://github.com/windmill-labs/windmill/.github/workflows/docker-image.yml@${GITHUB_REF}" \
-            "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:${GITHUB_REF_NAME#v}"
-
  verify_ee_image_vulnerabilities:
    runs-on: ubicloud
    needs: [tag_latest_ee]
@@ -541,13 +493,11 @@ jobs:
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push publicly ee
-        id: docker_build
        uses: depot/build-push-action@v1
        with:
          context: .
          platforms: linux/amd64
          push: true
-          sbom: ${{ startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push' }}
          file: "./docker/DockerfileCuda"
          tags: |
            ${{ steps.meta-ee-public.outputs.tags }}
@@ -555,13 +505,6 @@ jobs:
            ${{ steps.meta-ee-public.outputs.labels }}
            org.opencontainers.image.licenses=Windmill-Enterprise-License

-      - name: Sign and attest release image
-        if: startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push'
-        uses: ./.github/actions/sign-attest-image
-        with:
-          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee-cuda
-          digest: ${{ steps.docker_build.outputs.digest }}
-
  build_slim:
    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
    needs: [build]
@@ -594,26 +537,17 @@ jobs:
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push publicly ee
-        id: docker_build
        uses: depot/build-push-action@v1
        with:
          context: .
          platforms: linux/amd64
          push: true
-          sbom: ${{ startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push' }}
          file: "./docker/DockerfileSlim"
          tags: |
            ${{ steps.meta-ee-public.outputs.tags }}
          labels: |
            ${{ steps.meta-ee-public.outputs.labels }}

-      - name: Sign and attest release image
-        if: startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push'
-        uses: ./.github/actions/sign-attest-image
-        with:
-          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-slim
-          digest: ${{ steps.docker_build.outputs.digest }}
-
  build_ee_slim:
    needs: [build_ee]
    runs-on: ubicloud
@@ -648,13 +582,11 @@ jobs:
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push publicly ee
-        id: docker_build
        uses: depot/build-push-action@v1
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
-          sbom: ${{ startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push' }}
          file: "./docker/DockerfileSlimEe"
          tags: |
            ${{ steps.meta-ee-public.outputs.tags }}
@@ -662,13 +594,6 @@ jobs:
            ${{ steps.meta-ee-public.outputs.labels }}
            org.opencontainers.image.licenses=Windmill-Enterprise-License

-      - name: Sign and attest release image
-        if: startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push'
-        uses: ./.github/actions/sign-attest-image
-        with:
-          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee-slim
-          digest: ${{ steps.docker_build.outputs.digest }}
-
  build_full:
    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
    needs: [build]
@@ -701,26 +626,17 @@ jobs:
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push publicly
-        id: docker_build
        uses: depot/build-push-action@v1
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
-          sbom: ${{ startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push' }}
          file: "./docker/DockerfileFull"
          tags: |
            ${{ steps.meta-public.outputs.tags }}
          labels: |
            ${{ steps.meta-public.outputs.labels }}

-      - name: Sign and attest release image
-        if: startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push'
-        uses: ./.github/actions/sign-attest-image
-        with:
-          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-full
-          digest: ${{ steps.docker_build.outputs.digest }}
-
  build_ee_full:
    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
    needs: [build_ee]
@@ -753,23 +669,14 @@ jobs:
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push publicly ee
-        id: docker_build
        uses: depot/build-push-action@v1
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
-          sbom: ${{ startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push' }}
          file: "./docker/DockerfileFullEe"
          tags: |
            ${{ steps.meta-ee-public.outputs.tags }}
          labels: |
            ${{ steps.meta-ee-public.outputs.labels }}
            org.opencontainers.image.licenses=Windmill-Enterprise-License
-
-      - name: Sign and attest release image
-        if: startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push'
-        uses: ./.github/actions/sign-attest-image
-        with:
-          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee-full
-          digest: ${{ steps.docker_build.outputs.digest }}
@@ -9,8 +9,6 @@ on:
  push:
    paths:
      - "frontend/**"
-      # The flow chat compiles the chat SDK's source in (svelte.config.js alias).
-      - "chat-sdk/src/**"
      - ".github/workflows/frontend-check.yml"

 jobs:
@@ -17,17 +17,6 @@ jobs:
      - run: cd typescript-client && ./publish.sh --access public && cd ..
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-  publish_chat_sdk:
-    runs-on: ubicloud-standard-8
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v3
-        with:
-          node-version: "20.x"
-          registry-url: "https://registry.npmjs.org"
-      - run: cd chat-sdk && npm ci && npm run build && npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
  publish_cli:
    runs-on: ubicloud-standard-8
    steps:
@@ -84,9 +84,6 @@ jobs:

  publish_extra:
    needs: [sleep, test_extra]
-    # a tag-targeted dispatch would republish the release tags unsigned,
-    # un-verifying the release; to republish a release, re-push its tag
-    if: github.event_name == 'push' || !startsWith(github.ref, 'refs/tags/')
    runs-on: ubicloud-standard-8
    steps:
      - uses: actions/checkout@v4
@@ -115,24 +112,15 @@ jobs:
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push publicly
-        id: docker_build
        uses: depot/build-push-action@v1
        with:
          context: .
          file: ./docker/DockerfileExtra
          platforms: linux/amd64,linux/arm64
          push: true
-          sbom: ${{ startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push' }}
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
            ${{ steps.meta.outputs.tags }}
          labels: |
            ${{ steps.meta.outputs.labels }}
            org.opencontainers.image.licenses=AGPLv3
-
-      - name: Sign and attest release image
-        if: startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push'
-        uses: ./.github/actions/sign-attest-image
-        with:
-          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          digest: ${{ steps.docker_build.outputs.digest }}
@@ -32,25 +32,6 @@ jobs:
        working-directory: ./typescript-client
        run: bun test --timeout 120000 tests/

-  chat-sdk:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: latest
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20.x"
-
-      - name: Run tests
-        working-directory: ./chat-sdk
-        run: npm ci && npm run check && bun test
-
  python-client:
    runs-on: ubuntu-latest
    steps:
@@ -1,3 +1,3 @@
 {
-  ".": "1.815.0"
+  ".": "1.803.0"
 }
@@ -30,18 +30,14 @@ Open-source platform for internal tools, workflows, API integrations, background
  reaches the DB only through the API, so `Connection::Http` paths are never taken by a plain
  `cargo run`; a normal build cannot start one at all.
 - **Enterprise**: `docs/enterprise.md` — EE file conventions and PR workflow
- **Auth surface**: `docs/auth-surface.md` — credential precedence, session/cache invalidation
-  scope, which token labels email their owner at expiry, how OAuth login matches `login_type`, and
-  that every superadmin route refuses `$WM_TOKEN`. Read before designing anything that creates
-  users, tokens or sessions.
 - **Product telemetry**: `docs/feature-telemetry.md` — when to instrument a new feature with
  `feature_usage`, and the four-step recipe. An unregistered `(feature, kind)` pair is dropped
  silently, so frontend-only instrumentation records nothing.
 - **Backend patterns**: use the `rust-backend` skill when writing Rust code
 - **Frontend patterns**: use the `svelte-frontend` skill when writing Svelte code. Do NOT edit svelte files unless you have read that skill.
 - **Frontend UUIDs**: do not call `crypto.randomUUID()` in frontend code. Import `randomUUID` from `$lib/utils/uuid` instead.
- **Code review**: review the current PR or branch against the shared review policy in `REVIEW.md` (severity triage, public-surface checklist, AGENTS.md compliance, test-coverage assessment). The skill at `.agents/skills/local-review/SKILL.md` orchestrates it. All three CLIs auto-discover the same SKILL — Claude reads `.claude/skills/` (symlinked to the canonical `.agents/skills/` file), Codex and Pi read `.agents/skills/` directly. Invoke with `/local-review` in Claude Code, `$local-review` (or `/skills` selector) in Codex, or `pi --skill local-review` / `/skill:local-review` in Pi. For a Codex-driven pass that mirrors the `codex-pr-review` GitHub action against your unpushed work (committed + uncommitted) before you push, use `/local-review-codex` (`.agents/skills/local-review-codex/`) — same `REVIEW.md` policy and `xhigh` reasoning, on `gpt-6-astra` rather than the action's `gpt-5.6-sol`; requires the `codex` CLI >= 0.153.4.
- **Domain guides**: `.claude/skills/native-trigger/`
+- **Code review**: review the current PR or branch against the shared review policy in `REVIEW.md` (severity triage, public-surface checklist, AGENTS.md compliance, test-coverage assessment). The skill at `.agents/skills/local-review/SKILL.md` orchestrates it. All three CLIs auto-discover the same SKILL — Claude reads `.claude/skills/` (symlinked to the canonical `.agents/skills/` file), Codex and Pi read `.agents/skills/` directly. Invoke with `/local-review` in Claude Code, `$local-review` (or `/skills` selector) in Codex, or `pi --skill local-review` / `/skill:local-review` in Pi. For a Codex-driven pass that mirrors the `codex-pr-review` GitHub action against your unpushed work (committed + uncommitted) before you push, use `/local-review-codex` (`.agents/skills/local-review-codex/`) — same `REVIEW.md` policy, `gpt-5.6-sol`, `xhigh` reasoning; requires the `codex` CLI >= 0.144.1.
+- **Domain guides**: `.claude/skills/native-trigger/` and `frontend/tutorial-system-guide.mdc`
 - **Brand/UI guidelines**: `frontend/brand-guidelines.md`
 - **Domain vocabulary**: `CONTEXT.md` — the words this codebase uses for its own concepts (step, step setting, trigger step, …). Name things the way it does.
 - **CLI commands**: when adding/modifying/removing a command, subcommand, option, or description in `cli/src/commands/`, run `python system_prompts/generate.py` to refresh `system_prompts/auto-generated/` and `cli/src/guidance/skills.gen.ts`. The CLI docs the agents use to operate `wmill` are derived from the source — stale generated files give agents the wrong flags.
@@ -1,315 +1,5 @@
 # Changelog

-## [1.815.0](https://github.com/windmill-labs/windmill/compare/v1.814.0...v1.815.0) (2026-09-18)
-
-
-### Features
-
-* add a workspace toggle that adds its admins and developers to new forks ([#11215](https://github.com/windmill-labs/windmill/issues/11215)) ([9d335de](https://github.com/windmill-labs/windmill/commit/9d335de87a4dbaa51038d55afe8d980761dcdfaf))
-* add an instance setting to refuse a token in MCP URLs ([#11162](https://github.com/windmill-labs/windmill/issues/11162)) ([37e493a](https://github.com/windmill-labs/windmill/commit/37e493ae66ed5c000ecac492d60fc0fdf4bda71f))
-* **ai-chat:** render get_run through the run tools' card ([#11204](https://github.com/windmill-labs/windmill/issues/11204)) ([6f9c4dc](https://github.com/windmill-labs/windmill/commit/6f9c4dc29455d13b0e64af05c2d6aa8bd5ff4fd6))
-* **ai-chat:** tell the chat which kind of app it is looking at ([#11208](https://github.com/windmill-labs/windmill/issues/11208)) ([c8c06d8](https://github.com/windmill-labs/windmill/commit/c8c06d8f79774abf109192e71a8b6fc37c7937ba))
-* attach files to a flow chat message ([#11185](https://github.com/windmill-labs/windmill/issues/11185)) ([c4c9677](https://github.com/windmill-labs/windmill/commit/c4c9677982b75c63d98ebf85b1904e0c341ba957))
-* **auth:** 2 h login links and a click-to-sign-in page for emailed ones ([#11203](https://github.com/windmill-labs/windmill/issues/11203)) ([5639187](https://github.com/windmill-labs/windmill/commit/5639187fec6d517a72e82df49d63d7438301127c))
-* cap user token expiration with an instance setting ([#11159](https://github.com/windmill-labs/windmill/issues/11159)) ([9320312](https://github.com/windmill-labs/windmill/commit/9320312eac56f944c4d31504601293ab4e816ccc))
-* flow chat job-backed detail, smooth streaming and answer chrome ([#11186](https://github.com/windmill-labs/windmill/issues/11186)) ([e2a91ca](https://github.com/windmill-labs/windmill/commit/e2a91ca2b141a0bee64ddfafe3cbf3ff86b6fb35))
-* put a data table's connection under Postgres roles ([#11020](https://github.com/windmill-labs/windmill/issues/11020)) ([0e807fb](https://github.com/windmill-labs/windmill/commit/0e807fb1dd80d7536ec144cd49445abc7961e504))
-* render an AI agent result as its answer, not as raw JSON ([#11051](https://github.com/windmill-labs/windmill/issues/11051)) ([a089928](https://github.com/windmill-labs/windmill/commit/a08992834d45d0211336f4fc32c3421646ca47c5))
-* support $flow_expr[...] dynamic tags on flow steps ([#11170](https://github.com/windmill-labs/windmill/issues/11170)) ([48f0025](https://github.com/windmill-labs/windmill/commit/48f00259c5e7361d3553dbcb809461e1cde96f8f))
-
-
-### Bug Fixes
-
-* **frontend:** inline only the package version, not the whole package.json ([#11191](https://github.com/windmill-labs/windmill/issues/11191)) ([813e486](https://github.com/windmill-labs/windmill/commit/813e486e166ac6215364817a7732b66f8dc1d463))
-* keep instance groups when editing auto-invite ([#11217](https://github.com/windmill-labs/windmill/issues/11217)) ([df61dea](https://github.com/windmill-labs/windmill/commit/df61dea5fa8b18d1e0044dc0db6702b053d5119f))
-* key the large root font size on screen width, not window width ([#11216](https://github.com/windmill-labs/windmill/issues/11216)) ([3b4e13d](https://github.com/windmill-labs/windmill/commit/3b4e13d1c564c6195e30b55b0671f7533e3ce408))
-* re-encrypt git sync secrets on workspace key rotation ([#11218](https://github.com/windmill-labs/windmill/issues/11218)) ([f0d66a4](https://github.com/windmill-labs/windmill/commit/f0d66a42eba27502767423af0c08b2ca1f16e8df))
-* re-point cloned fork identities that name nobody in the fork ([#11161](https://github.com/windmill-labs/windmill/issues/11161)) ([9690c44](https://github.com/windmill-labs/windmill/commit/9690c4462cf264a5577b87d07d465b5442b4e09d))
-* register the job token with the sensitive log masking system ([#10943](https://github.com/windmill-labs/windmill/issues/10943)) ([53afecd](https://github.com/windmill-labs/windmill/commit/53afecd4588247bc1812d3e68a30db1f3c3b2724))
-* show the New menu's description panel only on hover ([#11199](https://github.com/windmill-labs/windmill/issues/11199)) ([ecd0a6c](https://github.com/windmill-labs/windmill/commit/ecd0a6c77bc3a057b8072dbb0aca731e8bd3d882))
-* stop picker listing a draft twice when drafts share a friendly path ([#11214](https://github.com/windmill-labs/windmill/issues/11214)) ([72507d5](https://github.com/windmill-labs/windmill/commit/72507d52a021de8101794ee8f4a3392be1ba20c7))
-
-
-### Performance Improvements
-
-* count completed jobs on the v2_job_completed index with a timeout ([#11211](https://github.com/windmill-labs/windmill/issues/11211)) ([d1a2536](https://github.com/windmill-labs/windmill/commit/d1a25360b070994a31fb033707dbfde1fb553939))
-
-## [1.814.0](https://github.com/windmill-labs/windmill/compare/v1.813.0...v1.814.0) (2026-09-17)
-
-
-### Features
-
-* **ai-chat:** add list_workers and list_data_metrics global tools ([#11143](https://github.com/windmill-labs/windmill/issues/11143)) ([e954d33](https://github.com/windmill-labs/windmill/commit/e954d33613e4ff5027667eb8f646615d9bbd499d))
-* **ai-chat:** merge get_job_logs and get_flow_run_details into get_run ([#11172](https://github.com/windmill-labs/windmill/issues/11172)) ([5bb37ca](https://github.com/windmill-labs/windmill/commit/5bb37ca3388666fba72c55534e37f37bb3e9299e))
-* allow git sync auto-pull, promotion and PRs on Pro licenses ([#11173](https://github.com/windmill-labs/windmill/issues/11173)) ([02e47de](https://github.com/windmill-labs/windmill/commit/02e47de8b4c4f3f54753aabf8c67bc8e71ffb957))
-* badge chat-input flows on the home list ([#11164](https://github.com/windmill-labs/windmill/issues/11164)) ([3d08197](https://github.com/windmill-labs/windmill/commit/3d0819718221f885b61e73d02b43dcc853c7d02a))
-* collect flow conversations and agent memory once their last message goes ([#11178](https://github.com/windmill-labs/windmill/issues/11178)) ([23c24a9](https://github.com/windmill-labs/windmill/commit/23c24a9688d4c8c462f53221334d538280f16bca))
-* flow chat model picker on a shared model-settings component ([#11187](https://github.com/windmill-labs/windmill/issues/11187)) ([189793c](https://github.com/windmill-labs/windmill/commit/189793c2e4db7f1c853695ebcc895c1ec82ed19f))
-* keep flow inputs and seed the agent when chat mode is enabled ([#11177](https://github.com/windmill-labs/windmill/issues/11177)) ([68f2248](https://github.com/windmill-labs/windmill/commit/68f2248018fc218a090bf939e1eb22ff97d5bc22))
-* let plan mode search and read connected mcp servers ([#11205](https://github.com/windmill-labs/windmill/issues/11205)) ([5371519](https://github.com/windmill-labs/windmill/commit/5371519f0f5ce7750982dcdb374dca72115902e7))
-* let test_run_flow name the conversation of a chat-mode test run ([#11198](https://github.com/windmill-labs/windmill/issues/11198)) ([6e1ef93](https://github.com/windmill-labs/windmill/commit/6e1ef93f329cb396ffc3df3304d592e8fa0e0e71))
-* managed memory with an inherited or custom memory id per step ([#11118](https://github.com/windmill-labs/windmill/issues/11118)) ([c297ed0](https://github.com/windmill-labs/windmill/commit/c297ed0052d998fb8f063faa2a36c6eb03e327be))
-* render the flow chat through the shared session chat components ([#11175](https://github.com/windmill-labs/windmill/issues/11175)) ([a9ec0ae](https://github.com/windmill-labs/windmill/commit/a9ec0aec3ac0c6b0f7919d0eb2168816923826d7))
-* show flow step detail inside the graph tab on narrow detail layouts ([#11168](https://github.com/windmill-labs/windmill/issues/11168)) ([64dffe6](https://github.com/windmill-labs/windmill/commit/64dffe6106ad6a55b61a423c855a4b5b0cef533e))
-* store mcp tool call, result and reasoning on flow conversation rows ([#11176](https://github.com/windmill-labs/windmill/issues/11176)) ([a571117](https://github.com/windmill-labs/windmill/commit/a571117f3fd2cef14c920770645c60ee358fdfdd))
-* tell test flow conversations from deployed ones and rename a chat ([#11179](https://github.com/windmill-labs/windmill/issues/11179)) ([4eab995](https://github.com/windmill-labs/windmill/commit/4eab995cf7cf091a5e4640da4cb77e0921bb7fdf))
-
-
-### Bug Fixes
-
-* disable a schedule whose cron has no run left instead of panicking ([#11195](https://github.com/windmill-labs/windmill/issues/11195)) ([381d447](https://github.com/windmill-labs/windmill/commit/381d4470ef699ea82283742132e56556b95d2bd2))
-* skip expiry notifications for app embed and SDK tokens ([#11169](https://github.com/windmill-labs/windmill/issues/11169)) ([9d348f8](https://github.com/windmill-labs/windmill/commit/9d348f84c7830f36b6153472556fd70e3d84cd24))
-
-## [1.813.0](https://github.com/windmill-labs/windmill/compare/v1.812.0...v1.813.0) (2026-09-16)
-
-
-### Features
-
-* back AI sessions up to the workspace object storage ([#11116](https://github.com/windmill-labs/windmill/issues/11116)) ([796b6e5](https://github.com/windmill-labs/windmill/commit/796b6e5297d8cceb842ec097f33ec1c3115058bd))
-* delete a browser's copy of an AI session past its workspace retention ([#11156](https://github.com/windmill-labs/windmill/issues/11156)) ([a48ae65](https://github.com/windmill-labs/windmill/commit/a48ae656ae59d600311f81ef357d08df5226515a))
-* rename saved agents from the agent editor and flag broken links ([#11147](https://github.com/windmill-labs/windmill/issues/11147)) ([57a99f6](https://github.com/windmill-labs/windmill/commit/57a99f66a88f195cac8f583b59d69d627cc1ec1d))
-* retention for AI sessions on the object store and in the browser ([#11152](https://github.com/windmill-labs/windmill/issues/11152)) ([ee6d317](https://github.com/windmill-labs/windmill/commit/ee6d317e318fa8a1506fb18d51c45b627070627a))
-* return an ai agent step's thinking in its job result ([#11140](https://github.com/windmill-labs/windmill/issues/11140)) ([c4e878e](https://github.com/windmill-labs/windmill/commit/c4e878e8313a72a16bfbe81fbb3935ee7728ec6f))
-* stream reasoning summaries in AI agent Responses API steps ([#11124](https://github.com/windmill-labs/windmill/issues/11124)) ([b51c0ea](https://github.com/windmill-labs/windmill/commit/b51c0eabbe774c78a9cbf824a3df6528d970b8f6))
-
-
-### Bug Fixes
-
-* **apps:** re-check access in place after a password sign-in ([#11166](https://github.com/windmill-labs/windmill/issues/11166)) ([49d0310](https://github.com/windmill-labs/windmill/commit/49d0310ecc08040b6c6fa4f402584543d679e2e8))
-* **apps:** run-mode inline app component uses only pinned content ([#11135](https://github.com/windmill-labs/windmill/issues/11135)) ([781b5a5](https://github.com/windmill-labs/windmill/commit/781b5a57e81eb721d97d7b87e23dd84f23895400))
-* **cli:** keep the workspace color when settings are synced from git ([#11144](https://github.com/windmill-labs/windmill/issues/11144)) ([129c045](https://github.com/windmill-labs/windmill/commit/129c04559548cd1bcf67758ec416fb2a48e7b928))
-* **cli:** resolve lockgen imports through modules a push leaves alone ([#11160](https://github.com/windmill-labs/windmill/issues/11160)) ([54553b2](https://github.com/windmill-labs/windmill/commit/54553b2add6941395f03ca34ee24cf335a3b23c2))
-* dispatch workflow-as-code tasks from a deployed flow's inline step ([#11146](https://github.com/windmill-labs/windmill/issues/11146)) ([e8078f2](https://github.com/windmill-labs/windmill/commit/e8078f2a963166b09849650424583f5dcfd28a84))
-* keep sidebar confirmation dialogs from being confined to the rail ([#11158](https://github.com/windmill-labs/windmill/issues/11158)) ([b9b5988](https://github.com/windmill-labs/windmill/commit/b9b5988ebdf3edd75add445282977c516ef5ed51))
-* keep the instance users table's actions and header in view ([#11145](https://github.com/windmill-labs/windmill/issues/11145)) ([a9a9335](https://github.com/windmill-labs/windmill/commit/a9a9335a34a13ffd8cd2699adc92087b679548ca))
-* stop reading an array job result as wm_failure or http response ([#11154](https://github.com/windmill-labs/windmill/issues/11154)) ([9a8a9c4](https://github.com/windmill-labs/windmill/commit/9a8a9c480cf008761ec6ceaff694085a252a32ae))
-* walk the whole fork ancestry for app installations and fork conflicts ([#11151](https://github.com/windmill-labs/windmill/issues/11151)) ([73dc892](https://github.com/windmill-labs/windmill/commit/73dc892f9c9c840a5f0fb12fcbb28bbe0f38795f))
-* **worker:** bound cache transfers and import fetches in bun jobs ([#11138](https://github.com/windmill-labs/windmill/issues/11138)) ([31c4325](https://github.com/windmill-labs/windmill/commit/31c43255fdcc827c3fdf65e40238f8f3a83201cd))
-
-## [1.812.0](https://github.com/windmill-labs/windmill/compare/v1.811.1...v1.812.0) (2026-09-15)
-
-
-### Features
-
-* add per-route CORS origin allowlist for HTTP triggers ([#10833](https://github.com/windmill-labs/windmill/issues/10833)) ([d8d7332](https://github.com/windmill-labs/windmill/commit/d8d7332eb6d92f7a55b82890de5de4196039b40d))
-* **ai-sessions:** share session artifacts with the workspace by link ([#11115](https://github.com/windmill-labs/windmill/issues/11115)) ([57a134e](https://github.com/windmill-labs/windmill/commit/57a134e2de18e27b3c1d3066a60b892af1089b30))
-* **cli:** list, get and restore trashed items with wmill trash ([#11125](https://github.com/windmill-labs/windmill/issues/11125)) ([a95e950](https://github.com/windmill-labs/windmill/commit/a95e950529f6f01a220e09d322d5a4fb507ea694))
-* dynamic AI agent toolsets ([#11050](https://github.com/windmill-labs/windmill/issues/11050)) ([a78beff](https://github.com/windmill-labs/windmill/commit/a78beff743f6bb289805c263a8d32515bea9688f))
-* **git-sync:** gate GitHub PRs on Windmill CI test results (WIN-2051) ([#10096](https://github.com/windmill-labs/windmill/issues/10096)) ([80eba80](https://github.com/windmill-labs/windmill/commit/80eba80d6ed51753cfaa67310f1a0f5dd5ce0484))
-* pre-approved cloud accounts: login links, OAuth adoption, setup, and the trial bridge ([#10875](https://github.com/windmill-labs/windmill/issues/10875)) ([91e6dc3](https://github.com/windmill-labs/windmill/commit/91e6dc39ce795fafc2bed0d799b62c9880fd6430))
-* run a flow step test through the chat's argument form ([#11114](https://github.com/windmill-labs/windmill/issues/11114)) ([5d32b61](https://github.com/windmill-labs/windmill/commit/5d32b6106788b665e4752fcac63ff1ef457d604e))
-* store resource type display names and label hub integrations ([#11113](https://github.com/windmill-labs/windmill/issues/11113)) ([42f4896](https://github.com/windmill-labs/windmill/commit/42f489685bc87a8479818175c87b5a21b0c17998))
-* windmill-chat sdk for chat-mode flows in external frontends and raw apps ([#11117](https://github.com/windmill-labs/windmill/issues/11117)) ([e8c02c0](https://github.com/windmill-labs/windmill/commit/e8c02c04cdb1a3f199f3f0a8b53a839a53d4a1d9))
-
-
-### Bug Fixes
-
-* **ai-chat:** hide other users' MCP servers from the chat unless shared ([#11112](https://github.com/windmill-labs/windmill/issues/11112)) ([244ec13](https://github.com/windmill-labs/windmill/commit/244ec132914a6e689d7d79da9cf2cb39f920aaef))
-* **cli:** say where a sync push deleted variable or resource went ([#10851](https://github.com/windmill-labs/windmill/issues/10851)) ([d54a66f](https://github.com/windmill-labs/windmill/commit/d54a66f15c09c34f7a2b45c2e6e9649807a19265))
-* **cli:** stage a rewritten shared lockfile on git-sync deploy push ([#11126](https://github.com/windmill-labs/windmill/issues/11126)) ([75ee497](https://github.com/windmill-labs/windmill/commit/75ee497011dca076de0923ded9da8e23e08bfb84))
-* **flows:** stop re-evaluating skip_if once a loop is in progress ([#11008](https://github.com/windmill-labs/windmill/issues/11008)) ([56e21bc](https://github.com/windmill-labs/windmill/commit/56e21bce832182528562688acd13ec416e01ebfc))
-* **git-sync:** run auto-pull as the admin who enabled it ([#11121](https://github.com/windmill-labs/windmill/issues/11121)) ([69e6efd](https://github.com/windmill-labs/windmill/commit/69e6efd875e020779ea115c096331da8eae2ffe7))
-* keep a script draft's password marking through the chat's run form ([#11110](https://github.com/windmill-labs/windmill/issues/11110)) ([56dd940](https://github.com/windmill-labs/windmill/commit/56dd940e34b146c3ca25de7959b4fb618308eb86))
-* **python:** parse wheel RECORD paths as RFC 4180 csv fields ([#11133](https://github.com/windmill-labs/windmill/issues/11133)) ([9696308](https://github.com/windmill-labs/windmill/commit/96963080f1711192fe1d9bc4142c1710511504d4))
-* re-attach flow chat to the same job on SSE timeout instead of re-running it ([#11122](https://github.com/windmill-labs/windmill/issues/11122)) ([94c548c](https://github.com/windmill-labs/windmill/commit/94c548cd5dc43131e0471b0edabe496dff245862))
-* set the enclosing span's trace context on exported log records ([#11123](https://github.com/windmill-labs/windmill/issues/11123)) ([d0cac08](https://github.com/windmill-labs/windmill/commit/d0cac0807f1b6f4fc76d6e5f7e27e03d30abec8d))
-* skip instance group members that are not email addresses ([#11128](https://github.com/windmill-labs/windmill/issues/11128)) ([e3e638f](https://github.com/windmill-labs/windmill/commit/e3e638f7f587f0ee090d06436575b65a0860a855))
-* wake a WAC parent from every path that completes its child ([#11119](https://github.com/windmill-labs/windmill/issues/11119)) ([0b1e9c0](https://github.com/windmill-labs/windmill/commit/0b1e9c0dda2ae55c56b1e0de5c0419b4511b973f))
-
-## [1.811.1](https://github.com/windmill-labs/windmill/compare/v1.811.0...v1.811.1) (2026-09-13)
-
-
-### Bug Fixes
-
-* check kafka trigger topics against a set, not a one-pass iterator ([#11108](https://github.com/windmill-labs/windmill/issues/11108)) ([bf4fa2b](https://github.com/windmill-labs/windmill/commit/bf4fa2b174b8d4a5897b2aa0d108480442bd0e18))
-* let the hub_sync job read the uid and hub_base_url settings ([#11106](https://github.com/windmill-labs/windmill/issues/11106)) ([45102c8](https://github.com/windmill-labs/windmill/commit/45102c82659d86ca5ec6fd3aee57232f2348736c))
-
-## [1.811.0](https://github.com/windmill-labs/windmill/compare/v1.810.0...v1.811.0) (2026-09-12)
-
-
-### Features
-
-* make snowflake_oauth work as a dbt warehouse on every engine ([#11095](https://github.com/windmill-labs/windmill/issues/11095)) ([9fc50a2](https://github.com/windmill-labs/windmill/commit/9fc50a23fb75cb541c481247b7b25c206fb06d36))
-
-
-### Bug Fixes
-
-* accept any hub version of the git sync script in the token check ([#11099](https://github.com/windmill-labs/windmill/issues/11099)) ([670628b](https://github.com/windmill-labs/windmill/commit/670628b300ab119363adb5496ebfe3c6ccd80063))
-* bring back Publish to Hub for scripts ([#11097](https://github.com/windmill-labs/windmill/issues/11097)) ([864e5f0](https://github.com/windmill-labs/windmill/commit/864e5f02ec1c2dd16c74524f551f44485df10a20))
-* bundle deployed bun scripts whose only pin is on a dynamic import ([#11096](https://github.com/windmill-labs/windmill/issues/11096)) ([4afb9aa](https://github.com/windmill-labs/windmill/commit/4afb9aa677ac11d22e22e54bb6fd7881378b7005))
-* clear a stale git auto-pull failure and show the status time ([#11100](https://github.com/windmill-labs/windmill/issues/11100)) ([e877b5f](https://github.com/windmill-labs/windmill/commit/e877b5f2e81b1741aee90e843c8cccc22f9eef24))
-* stop a resource delete from taking variables it does not own ([#11102](https://github.com/windmill-labs/windmill/issues/11102)) ([2a21efa](https://github.com/windmill-labs/windmill/commit/2a21efa11b8307b331a8c20720028444dd3c62ff))
-
-## [1.810.0](https://github.com/windmill-labs/windmill/compare/v1.809.0...v1.810.0) (2026-09-11)
-
-
-### Features
-
-* **ai-sessions:** turn skills on by default, and group them by folder ([#11058](https://github.com/windmill-labs/windmill/issues/11058)) ([d8b9174](https://github.com/windmill-labs/windmill/commit/d8b9174235b97d0b4ef9f281e20e5704182d8dcb))
-* background and wait_seconds for run_script, skip preprocessor ([#11092](https://github.com/windmill-labs/windmill/issues/11092)) ([2939c2d](https://github.com/windmill-labs/windmill/commit/2939c2dd4b129640d87ef45c7a24c6f215a3239a))
-* give the chat the full MCP tool schema, and mark calls with the provider icon ([#11086](https://github.com/windmill-labs/windmill/issues/11086)) ([e7c6f85](https://github.com/windmill-labs/windmill/commit/e7c6f85553bd8efb0f7af0f488f615ac93c496ae))
-* let apps hide the viewer login status on public urls ([#11089](https://github.com/windmill-labs/windmill/issues/11089)) ([6056ec7](https://github.com/windmill-labs/windmill/commit/6056ec7148bce9f8ed171dd29f544696c335de7d))
-* remove the viewer login status badge from public apps ([#11090](https://github.com/windmill-labs/windmill/issues/11090)) ([75d7bee](https://github.com/windmill-labs/windmill/commit/75d7bee178886461fe49090d606a708f25c02d1a))
-* run a deployed flow through the chat's argument form ([#11085](https://github.com/windmill-labs/windmill/issues/11085)) ([b50de89](https://github.com/windmill-labs/windmill/commit/b50de8947908f1a5a4e9472afe6c0ecd25892e93))
-* run a flow test through the chat's argument form ([#11069](https://github.com/windmill-labs/windmill/issues/11069)) ([172d6c2](https://github.com/windmill-labs/windmill/commit/172d6c275b92b39d13848b543df9db10148e94ef))
-
-
-### Bug Fixes
-
-* attach TLS to gRPC OTLP exporters for https endpoints ([#11078](https://github.com/windmill-labs/windmill/issues/11078)) ([f915ed6](https://github.com/windmill-labs/windmill/commit/f915ed6a46e14341ddb213e869090edb68763032))
-* **dbt:** stop dbt sending anonymous usage stats from workers ([#11091](https://github.com/windmill-labs/windmill/issues/11091)) ([d539e86](https://github.com/windmill-labs/windmill/commit/d539e8674f2bf92d6c10b182ed4a1073714062c0))
-* keep pinned import versions of imported scripts in bun lockfiles ([#11082](https://github.com/windmill-labs/windmill/issues/11082)) ([57f8b08](https://github.com/windmill-labs/windmill/commit/57f8b0826ad61cb118d0cafbbc9203327d858940))
-* let admins and background sync reach private git hosts ([#11084](https://github.com/windmill-labs/windmill/issues/11084)) ([fa53099](https://github.com/windmill-labs/windmill/commit/fa53099e2b87a8676c5d6a18e77844e17ff45efd))
-* serve instance env settings at the documented /settings/local path ([#11075](https://github.com/windmill-labs/windmill/issues/11075)) ([f8f7c00](https://github.com/windmill-labs/windmill/commit/f8f7c0009f32c1440566420725b12e78ca804b03))
-* show symlinked files in the git repo viewer ([#11081](https://github.com/windmill-labs/windmill/issues/11081)) ([e6d4f44](https://github.com/windmill-labs/windmill/commit/e6d4f44a6122dab47fbee2a2a2b4330a62841bed))
-* support gzip and zstd compression for OTLP export over gRPC ([#11077](https://github.com/windmill-labs/windmill/issues/11077)) ([b156778](https://github.com/windmill-labs/windmill/commit/b156778da24e3827f723e503f80df68de87ddf7e))
-* unpin only the specifiers in the bundle a bun modules run executes ([#11083](https://github.com/windmill-labs/windmill/issues/11083)) ([30ffdbe](https://github.com/windmill-labs/windmill/commit/30ffdbecc15270562ceed3030c50a1cf81b1195c))
-
-
-### Performance Improvements
-
-* lazy-load the low-code runtime on public app pages ([#11087](https://github.com/windmill-labs/windmill/issues/11087)) ([e651b4c](https://github.com/windmill-labs/windmill/commit/e651b4cd63c3bd64a8739c9f60c6dfa437f19b4b))
-
-## [1.809.0](https://github.com/windmill-labs/windmill/compare/v1.808.0...v1.809.0) (2026-09-10)
-
-
-### Features
-
-* add a minimal skin for the approval page and slack/teams ([#11061](https://github.com/windmill-labs/windmill/issues/11061)) ([63cb46d](https://github.com/windmill-labs/windmill/commit/63cb46d7bb9db1d996aa38e06bd3afebc60111bd))
-* live queue status per tag and bounded queue metric charts ([#11067](https://github.com/windmill-labs/windmill/issues/11067)) ([569adb8](https://github.com/windmill-labs/windmill/commit/569adb85c1885d289e80a70a166f0f74e6d5ba83))
-* **otel:** read the OTLP metrics temporality preference ([#11064](https://github.com/windmill-labs/windmill/issues/11064)) ([2f88769](https://github.com/windmill-labs/windmill/commit/2f8876908719b3640d7cfc9364a7b0f7145fc356))
-* **otel:** support standard OTEL resource attribute env vars ([#10974](https://github.com/windmill-labs/windmill/issues/10974)) ([0a40eea](https://github.com/windmill-labs/windmill/commit/0a40eea37a7dbde5fc4760d6333d81186dfee255))
-* report script metadata with no content file in wmill lint ([#11053](https://github.com/windmill-labs/windmill/issues/11053)) ([8820b9f](https://github.com/windmill-labs/windmill/commit/8820b9fc644c6620c50517cd0d902015e2e670e2))
-* show the workspace an operator is in, and let them switch ([#11059](https://github.com/windmill-labs/windmill/issues/11059)) ([385086f](https://github.com/windmill-labs/windmill/commit/385086ffc21c72cd07624584932a4a301c23a732))
-* tuck other users' spaces into a collapsible home tree row ([#11073](https://github.com/windmill-labs/windmill/issues/11073)) ([d87f089](https://github.com/windmill-labs/windmill/commit/d87f089288996af9ea7e3b017a5ef35d4ded880d))
-
-
-### Bug Fixes
-
-* **ai-chat:** test_run_flow could test a different flow than the one asked ([#11066](https://github.com/windmill-labs/windmill/issues/11066)) ([fa73539](https://github.com/windmill-labs/windmill/commit/fa73539839071491fb2cbad9242f52ad22b975bf))
-* bound list_jobs runtime and paginate runs on the sorted column ([#11072](https://github.com/windmill-labs/windmill/issues/11072)) ([f517402](https://github.com/windmill-labs/windmill/commit/f51740253871960b55ab2aa8989e8df3fbde0351))
-* **frontend:** clear the flow graph selection through xyflow's store ([#11056](https://github.com/windmill-labs/windmill/issues/11056)) ([b4be8bc](https://github.com/windmill-labs/windmill/commit/b4be8bc5354fbd3a47c267c331aaf603c0f90e6e))
-* **frontend:** recompute dataflow edges when selecting a step ([#11070](https://github.com/windmill-labs/windmill/issues/11070)) ([08d876a](https://github.com/windmill-labs/windmill/commit/08d876aebf32ebb995a8c1839aa87794c0176bed))
-* **frontend:** restore heading sizes in note markdown and keep group notes on id change ([#11047](https://github.com/windmill-labs/windmill/issues/11047)) ([e63072c](https://github.com/windmill-labs/windmill/commit/e63072c216383700a23504be89782f4c69657174))
-* give every table a primary key so the db can be logically replicated ([#11036](https://github.com/windmill-labs/windmill/issues/11036)) ([e62bfdc](https://github.com/windmill-labs/windmill/commit/e62bfdcd8c6f1389601ccd2b5809c5eff0ff262e))
-* keep an app's deployed policy on wmill push ([#11049](https://github.com/windmill-labs/windmill/issues/11049)) ([0af7675](https://github.com/windmill-labs/windmill/commit/0af7675588300863883a99c7f14bc53cafec8a7e))
-* refuse cross-site GET requests that run Hub scripts ([#11054](https://github.com/windmill-labs/windmill/issues/11054)) ([ab9efc8](https://github.com/windmill-labs/windmill/commit/ab9efc897cc94d61a67263772806b15e9225cece))
-* skip the deploy PR when the git sync push committed nothing ([#11076](https://github.com/windmill-labs/windmill/issues/11076)) ([8ecbd33](https://github.com/windmill-labs/windmill/commit/8ecbd339eef7314a93d599fcea4377299d4c493d))
-* space the trailing AI settings cards ([#11044](https://github.com/windmill-labs/windmill/issues/11044)) ([5d7eed1](https://github.com/windmill-labs/windmill/commit/5d7eed1c02b0966289cc8cca00a15d76dad187a5))
-* stop uv pip compile emitting lockfile annotations ([#11042](https://github.com/windmill-labs/windmill/issues/11042)) ([8aa8b7e](https://github.com/windmill-labs/windmill/commit/8aa8b7ee6c23f859f169637c0bfd3f8d964509e9))
-* surface why a private or untrusted git host is unreachable ([#11068](https://github.com/windmill-labs/windmill/issues/11068)) ([c57b18e](https://github.com/windmill-labs/windmill/commit/c57b18e46fcdd319213fe0a537cb18de418ca688))
-
-
-### Performance Improvements
-
-* index the FK columns that cascade on workspace delete ([#11052](https://github.com/windmill-labs/windmill/issues/11052)) ([9a563f6](https://github.com/windmill-labs/windmill/commit/9a563f6d72da28fe09b785cd0683e9698df72bba))
-* only write queue metrics when a tag's backlog changes ([#11055](https://github.com/windmill-labs/windmill/issues/11055)) ([9d75929](https://github.com/windmill-labs/windmill/commit/9d75929247ea2ec39286971fcbebf95d886194f3))
-
-## [1.808.0](https://github.com/windmill-labs/windmill/compare/v1.807.0...v1.808.0) (2026-09-09)
-
-
-### Features
-
-* run and test scripts from the AI chat through an argument form ([#11001](https://github.com/windmill-labs/windmill/issues/11001)) ([a6abf2c](https://github.com/windmill-labs/windmill/commit/a6abf2c8a744e9ee6acf4830cdfbb84f2f95cb36))
-
-## [1.807.0](https://github.com/windmill-labs/windmill/compare/v1.806.0...v1.807.0) (2026-09-09)
-
-
-### Features
-
-* add a dismissible instance-wide announcement banner ([#11037](https://github.com/windmill-labs/windmill/issues/11037)) ([abf4c6c](https://github.com/windmill-labs/windmill/commit/abf4c6c2348014ea4401b9be62b5b15e5800e879))
-* batch chained DDL statements into a single migration ([#11038](https://github.com/windmill-labs/windmill/issues/11038)) ([656e609](https://github.com/windmill-labs/windmill/commit/656e609595833bc854f845d35cf43157e76d732f))
-* create the cloud workspace in onboarding, and teach the empty home ([#10959](https://github.com/windmill-labs/windmill/issues/10959)) ([fd35b47](https://github.com/windmill-labs/windmill/commit/fd35b4765843879cb2254f402c142fd7510f1916))
-* link from the public run view to the authenticated run page ([#11041](https://github.com/windmill-labs/windmill/issues/11041)) ([09b81a9](https://github.com/windmill-labs/windmill/commit/09b81a9294bed2795a1a7b688d0b02e0a61957ea))
-* make guest access unavailable on the shared cloud ([#11040](https://github.com/windmill-labs/windmill/issues/11040)) ([0b63e0a](https://github.com/windmill-labs/windmill/commit/0b63e0a6929088ff25def4fd6547cf61668251a5))
-
-
-### Bug Fixes
-
-* ignore comments and continuations in python lockfiles ([#11035](https://github.com/windmill-labs/windmill/issues/11035)) ([90c4e10](https://github.com/windmill-labs/windmill/commit/90c4e1020a2ff896977648dd68b572413cea7709))
-* refetch an unparseable hub script cache entry instead of panicking ([#11033](https://github.com/windmill-labs/windmill/issues/11033)) ([88c3ebd](https://github.com/windmill-labs/windmill/commit/88c3ebdfc1325ffbea4521d854e71d231a6409c4))
-* stop a new AI session adopting a legacy sidebar chat ([#11039](https://github.com/windmill-labs/windmill/issues/11039)) ([1076b63](https://github.com/windmill-labs/windmill/commit/1076b638d987ba99c5c27e5478ca580534b9d572))
-
-## [1.806.0](https://github.com/windmill-labs/windmill/compare/v1.805.0...v1.806.0) (2026-09-08)
-
-
-### Features
-
-* bring gitlab repositories to parity for git sync ([#10938](https://github.com/windmill-labs/windmill/issues/10938)) ([9444049](https://github.com/windmill-labs/windmill/commit/9444049d6013c77a5f25f01a736eb5cd741fb3e6))
-* draw a dbt column trace, across projects and the pipeline boundary ([#11014](https://github.com/windmill-labs/windmill/issues/11014)) ([33f9828](https://github.com/windmill-labs/windmill/commit/33f9828c3ed15fe63fccedc1550584f15c0490ab))
-* durable dbt state per environment, and `--defer` onto it ([#10975](https://github.com/windmill-labs/windmill/issues/10975)) ([621fac5](https://github.com/windmill-labs/windmill/commit/621fac55abcd1859e8c8c06e5f4412e61bb85d59))
-* ingest dbt column lineage and real column schemas from the engine's parquet index ([#10977](https://github.com/windmill-labs/windmill/issues/10977)) ([0139467](https://github.com/windmill-labs/windmill/commit/0139467b01b82e4b3d474ca3f205358fa607d19a))
-* let a worker group override the dependency cache object store ([#11019](https://github.com/windmill-labs/windmill/issues/11019)) ([de98adf](https://github.com/windmill-labs/windmill/commit/de98adf055835ab7c4d6305e7d5d3bdab915876b))
-* **nativets:** bound fetch on a peer that never answers ([#11026](https://github.com/windmill-labs/windmill/issues/11026)) ([785277e](https://github.com/windmill-labs/windmill/commit/785277e0bb2ea77b71a89dd4d389d439dfcf9e03))
-* recognize `// volume:` mounts in PHP scripts ([#11018](https://github.com/windmill-labs/windmill/issues/11018)) ([f081fb1](https://github.com/windmill-labs/windmill/commit/f081fb10705cadf99e99dfa786d1cc2ebf0447db))
-* report a WAC task failure the workflow body never awaited ([#11017](https://github.com/windmill-labs/windmill/issues/11017)) ([3e3a41d](https://github.com/windmill-labs/windmill/commit/3e3a41d418d4ee3fe060bd3acf3324f311d89c8a))
-* retry a workflow-as-code task from its task options ([#11013](https://github.com/windmill-labs/windmill/issues/11013)) ([d3f305d](https://github.com/windmill-labs/windmill/commit/d3f305db982b7c5dc49babf9bec8b62adcd2557d))
-
-
-### Bug Fixes
-
-* chain redeploys onto a retired path's version history ([#11029](https://github.com/windmill-labs/windmill/issues/11029)) ([0b37226](https://github.com/windmill-labs/windmill/commit/0b372260787edb7e9627ad4fb6637ad5f1024e0a))
-* make the native trigger disable/enable toggle actually save ([#11024](https://github.com/windmill-labs/windmill/issues/11024)) ([448fce9](https://github.com/windmill-labs/windmill/commit/448fce93f743d5b2ef2a2d4496eb2ec238594a0a))
-* offload php signature parsing from async workers ([#11027](https://github.com/windmill-labs/windmill/issues/11027)) ([2cb02e3](https://github.com/windmill-labs/windmill/commit/2cb02e3b3398db49f16377dd79dde2dd6fb5cc02))
-* reduce php parser stack use in debug workers ([#11025](https://github.com/windmill-labs/windmill/issues/11025)) ([2ae8509](https://github.com/windmill-labs/windmill/commit/2ae8509b14f112c9ef5b71321e8fd52596a16c10))
-
-
-### Performance Improvements
-
-* reduce shared worker debug polling frames ([#11028](https://github.com/windmill-labs/windmill/issues/11028)) ([946756a](https://github.com/windmill-labs/windmill/commit/946756ae83deb4e7a93111edddbd4d98c596d5a9))
-
-## [1.805.0](https://github.com/windmill-labs/windmill/compare/v1.804.0...v1.805.0) (2026-09-07)
-
-
-### Features
-
-* **git-sync:** sync extra_perms for variables ([#11004](https://github.com/windmill-labs/windmill/issues/11004)) ([ee9e550](https://github.com/windmill-labs/windmill/commit/ee9e550a484fda286eeab43b7db5f314b8b2d0d9))
-* go to referenced row from foreign-keyed cells in the database manager ([#10998](https://github.com/windmill-labs/windmill/issues/10998)) ([e2b63d1](https://github.com/windmill-labs/windmill/commit/e2b63d177ae4e5c980cb5da34154540c90771b63))
-* let `// materialize` declare a `dbt://` warehouse-relation write ([#10978](https://github.com/windmill-labs/windmill/issues/10978)) ([c6e0302](https://github.com/windmill-labs/windmill/commit/c6e0302d7c1c60147f19d55a3923be8b1aa99c9c))
-* report resource type picks to the hub and rank pickers by popularity ([#10982](https://github.com/windmill-labs/windmill/issues/10982)) ([48a5615](https://github.com/windmill-labs/windmill/commit/48a56158c135c3b13a02f73b7b8438bc691f85b4))
-* run a linked AI agent's draft when testing a flow, and offer to deploy it ([#10993](https://github.com/windmill-labs/windmill/issues/10993)) ([7feaf61](https://github.com/windmill-labs/windmill/commit/7feaf619cf0ec021d66be14ef535cf2149bec58a))
-* show the new-tab icon on a chat path pill while the modifier is held ([#10976](https://github.com/windmill-labs/windmill/issues/10976)) ([5da4ea4](https://github.com/windmill-labs/windmill/commit/5da4ea43fbd01e43aa14e75dc597d7ce5d8797ab))
-
-
-### Bug Fixes
-
-* **cli:** keep permissioned_as on single-item push, as sync push does ([#11000](https://github.com/windmill-labs/windmill/issues/11000)) ([5f3f99b](https://github.com/windmill-labs/windmill/commit/5f3f99ba6915b7c5df663a30b35f4cd02050e728))
-* **cli:** say which workspace id is targeted, and when wmill.yaml is bypassed ([#11006](https://github.com/windmill-labs/windmill/issues/11006)) ([7643e9b](https://github.com/windmill-labs/windmill/commit/7643e9bd77c56f72596b8dca50801baf58984198))
-* **frontend:** no phantom draft when opening a CLI-pushed script ([#10997](https://github.com/windmill-labs/windmill/issues/10997)) ([1be390a](https://github.com/windmill-labs/windmill/commit/1be390aa878e15a58f530f3a878e8f9caeb89c43))
-* **frontend:** stop hover flicker on asset nodes shared with an overflow popover ([#10996](https://github.com/windmill-labs/windmill/issues/10996)) ([519a5c8](https://github.com/windmill-labs/windmill/commit/519a5c8bc70b44a7417e83c26c7b9c58b2c4fb9c))
-* let a draft-only schedule, trigger or resource be deleted ([#11010](https://github.com/windmill-labs/windmill/issues/11010)) ([8d0f475](https://github.com/windmill-labs/windmill/commit/8d0f4754e4e0c78696ee0c97ff2de3016ece3bac))
-* point the app viewer's edit button at the editor for the app's kind ([#11009](https://github.com/windmill-labs/windmill/issues/11009)) ([8f553ea](https://github.com/windmill-labs/windmill/commit/8f553eab353103fd8a28a00532e1766f133590de))
-* seed runs page filter defaults through the url so they survive sync ([#11005](https://github.com/windmill-labs/windmill/issues/11005)) ([f381acd](https://github.com/windmill-labs/windmill/commit/f381acdb37f66f5e272bc37938e69f734987d53f))
-* stop an untouched item's form from saving a draft nobody wrote ([#10964](https://github.com/windmill-labs/windmill/issues/10964)) ([c3f7f8a](https://github.com/windmill-labs/windmill/commit/c3f7f8a45830fb548aa628ebf6e2b6c95c6de67f))
-* write and read python job files as utf-8, not the platform locale ([#10994](https://github.com/windmill-labs/windmill/issues/10994)) ([670404f](https://github.com/windmill-labs/windmill/commit/670404ffe27fedc3858b46b0c6b3312fbe175e13))
-
-## [1.804.0](https://github.com/windmill-labs/windmill/compare/v1.803.0...v1.804.0) (2026-09-05)
-
-
-### Features
-
-* **ai-sessions:** replace the context panel with an assistant settings modal ([#10919](https://github.com/windmill-labs/windmill/issues/10919)) ([fda7b3f](https://github.com/windmill-labs/windmill/commit/fda7b3f086619e3716e5894c07be127104174f1d))
-* **frontend:** group the agent form and edit saved agents as drafts ([#10880](https://github.com/windmill-labs/windmill/issues/10880)) ([f037c73](https://github.com/windmill-labs/windmill/commit/f037c73d104fffe7bb2640a5b1f2a92154c85e06))
-* guest app execution mode, a role that takes no seat ([#10929](https://github.com/windmill-labs/windmill/issues/10929)) ([fce635d](https://github.com/windmill-labs/windmill/commit/fce635d3c4c8962f448140ceb55a00fb99012701))
-* guest JWT entry for embedded apps ([#10954](https://github.com/windmill-labs/windmill/issues/10954)) ([8aab503](https://github.com/windmill-labs/windmill/commit/8aab5034a68a4aafb264b0e86d000ef58f4a8511))
-* instrument sandbox isolation, data tables and in-flow script edits ([#10981](https://github.com/windmill-labs/windmill/issues/10981)) ([130a2f7](https://github.com/windmill-labs/windmill/commit/130a2f74083ba1bd308beeb86e2cbbaa41fd3345))
-* make S3 permission rules reorderable by drag and drop ([#10958](https://github.com/windmill-labs/windmill/issues/10958)) ([2257b05](https://github.com/windmill-labs/windmill/commit/2257b05b2857c7ae2b5ae0b4f9004e2d4e757925))
-* reconcile IdP instance groups from the SSO groups claim ([#10957](https://github.com/windmill-labs/windmill/issues/10957)) ([79426a1](https://github.com/windmill-labs/windmill/commit/79426a1a68a6b19e12af4633b8a79d07a103a106))
-
-
-### Bug Fixes
-
-* deploy a relocked script version only when its lock changed ([#10966](https://github.com/windmill-labs/windmill/issues/10966)) ([1113828](https://github.com/windmill-labs/windmill/commit/11138284acc4c1d8673e86823c7f74c9e1f419e6))
-* **frontend:** render ordered lists in markdown descriptions ([#10973](https://github.com/windmill-labs/windmill/issues/10973)) ([a0295b2](https://github.com/windmill-labs/windmill/commit/a0295b20c436fd3f2bd6a6d294ae3cee005391e8))
-* keep braces inside string tool arguments out of JSON depth count ([#10965](https://github.com/windmill-labs/windmill/issues/10965)) ([3e3d2a6](https://github.com/windmill-labs/windmill/commit/3e3d2a636334146014926841949372083e6e8516))
-* keep the instance user editor popover inside the viewport ([#10979](https://github.com/windmill-labs/windmill/issues/10979)) ([1901d31](https://github.com/windmill-labs/windmill/commit/1901d3193bfc6a9e29d0b7c5389fef44ff9d3687))
-* meter WAC compute per segment, not the whole sleep ([#10985](https://github.com/windmill-labs/windmill/issues/10985)) ([5428710](https://github.com/windmill-labs/windmill/commit/54287102b22dd17903cdd4b48c5828875e5b9be4))
-* name the extension to load when duckdb autoload hits the fence ([#10972](https://github.com/windmill-labs/windmill/issues/10972)) ([64b6798](https://github.com/windmill-labs/windmill/commit/64b679879936e2ddf4dbc2f90edbd56e3893bd83))
-* **oauth:** show the account chooser on an explicit Google/Microsoft login ([#10961](https://github.com/windmill-labs/windmill/issues/10961)) ([9f7908e](https://github.com/windmill-labs/windmill/commit/9f7908e2622647388768b574083cc48a6e1990f1))
-* patch critical CVEs in the worker image ([#10962](https://github.com/windmill-labs/windmill/issues/10962)) ([b100606](https://github.com/windmill-labs/windmill/commit/b100606da6a61f2dbcb24516363f43643bc917e3))
-* render the MCP OAuth consent page without a workspace ([#10988](https://github.com/windmill-labs/windmill/issues/10988)) ([ebfac29](https://github.com/windmill-labs/windmill/commit/ebfac29096f12c4da2df45d5d82db83d352f3426))
-* stand the WAC park down for a cancel that beat it to the row ([#10990](https://github.com/windmill-labs/windmill/issues/10990)) ([f977f5b](https://github.com/windmill-labs/windmill/commit/f977f5bf8b1ac70d3afbdc8ad6fcbe072cc51ebc))
-
 ## [1.803.0](https://github.com/windmill-labs/windmill/compare/v1.802.0...v1.803.0) (2026-09-03)


@@ -37,25 +37,6 @@ _Avoid_: argument field, param
 Any other place a property can be picked into: the loop iterator, skip and early-stop predicates, the retry condition, a branch predicate, timeout. Its prop picker opens in a popover from the connect button rather than taking a pane.
 _Avoid_: JS field, code input

-### Flow chat
-
-**Conversation**:
-One thread of messages against one chat-enabled flow, with its own agent memory. A flow has
-many; the chat shows one at a time.
-_Avoid_: thread, session (that names an AI session, a different thing), chat (that names the surface)
-
-**Turn**:
-One question and the answer to it: the run the question started, the handle that stops it,
-and the rows it is writing. At most one per conversation, and the chat is held for its whole
-length — from the moment the question takes the chat, before it has a job, until it is ended.
-_Avoid_: request, exchange, message round
-
-**Transcript**:
-The rows a conversation's chat holds. Not the conversation: it is the newest page plus
-whatever older pages the reader has scrolled back through, so a question it cannot answer
-from what it holds is one to ask the server rather than to guess at.
-_Avoid_: history, messages (too easily read as "all of them")
-
 ### Permissions

 **Member**:
@@ -73,8 +73,6 @@ COPY /backend/oauth_connect.json /backend/oauth_connect.json
 COPY /openflow.openapi.yaml /openflow.openapi.yaml
 COPY /backend/windmill-api/build_openapi.sh /backend/windmill-api/build_openapi.sh
 COPY /system_prompts/auto-generated /system_prompts/auto-generated
-# The flow chat imports the chat SDK's source (svelte.config.js alias `windmill-chat`).
-COPY /chat-sdk/src /chat-sdk/src

 RUN cd /backend/windmill-api && . ./build_openapi.sh
 COPY /backend/parsers/windmill-parser-wasm/pkg/ /backend/parsers/windmill-parser-wasm/pkg/
@@ -175,10 +175,6 @@ the decrypted value, exactly as against a real backend. The chat's read path pas
 Seed a recognizable secret (the existing fixture uses `sk_live_do_not_leak_me`) and
 assert it via `valueExcludes` to catch a leak.

-`toolExpect.toolCallArgs` entries support `sharedByAtLeast: <n>`: at least `n` recorded
-calls to that tool must carry the same non-blank string in the field. Use it for calls that
-have to share an identifier, like two test runs of one chat conversation.
-
 `toolExpect.toolCallArgs` entries additionally support `fieldMustBeAbsent: true`: no
 recorded call to that tool may pass the field at all (an explicit `null` counts as
 passing it). Use it for partial-update tools, where supplying a field the model could
@@ -1,5 +1,5 @@
+import { randomUUID } from 'node:crypto'
 import type { BackendValidationSettings } from '../../core/backendValidation'
-import { buildWorkspaceId } from './workspaceId'

 interface CompletedJobResultMaybe {
 	completed: boolean
@@ -24,6 +24,7 @@ export interface CompletedPreviewJob {
 const tokenCache = new Map<string, Promise<string>>()
 const sharedWorkspaceQueue = new Map<string, Promise<void>>()
 const managedSharedWorkspacePrefixes = ['f/evals/']
+const DEFAULT_WORKSPACE_PREFIX = 'ai-evals'

 export class BackendPreviewClient {
 	constructor(private readonly settings: BackendValidationSettings) {}
@@ -440,6 +441,16 @@ async function withSharedWorkspaceLock<T>(workspaceId: string, body: () => Promi
 	}
 }

+function buildWorkspaceId(caseId: string, attempt: number): string {
+	const caseSlug = caseId
+		.toLowerCase()
+		.replace(/[^a-z0-9-]+/g, '-')
+		.replace(/^-+|-+$/g, '')
+		.slice(0, 30)
+	const suffix = randomUUID().slice(0, 8)
+	return `${DEFAULT_WORKSPACE_PREFIX}-${caseSlug || 'case'}-a${attempt}-${suffix}`
+}
+
 function extractFolderName(path: string): string | null {
 	if (!path.startsWith('f/')) {
 		return null
@@ -132,10 +132,6 @@ export async function runEval<THelpers, TOutput>(
    setToolStatus: () => {},
    removeToolStatus: () => {},
    isPlanModeActive,
-    // Accepts the run form exactly as the model prefilled it: there is nobody here to
-    // edit the arguments, so a case can assert what the model proposed but never how
-    // it reacts to the user changing something.
-    requestRunArgs: async (_toolId, form) => form.args,
    onNewToken: (token: string) => {
      if (shouldEmitMessageStart) {
        onAssistantMessageStart?.();
@@ -11,7 +11,6 @@ import type {
 	Script
 } from '../../../frontend/src/lib/gen'
 import type {
-	DataMetric,
 	DataTableTables,
 	DataTableTableSchema,
 	EndpointTool,
@@ -49,16 +48,12 @@ export interface BenchmarkWorkspaceFlow {
 export interface BenchmarkWorkspaceApp {
 	path: string
 	summary: string
-	/** Defaults to true. Set false for a drag-and-drop app, which the chat can list
-	 * and read but has no tool to edit — its value is a grid, not files. */
-	rawApp?: boolean
 	value: {
-		files?: Record<string, string>
-		runnables?: Record<string, unknown>
+		files: Record<string, string>
+		runnables: Record<string, unknown>
 		data?: unknown
 		policy?: unknown
 		custom_path?: unknown
-		[key: string]: unknown
 	}
 }

@@ -97,7 +92,7 @@ export interface BenchmarkWorkspaceResource {
 }

 export interface BenchmarkWorkspaceJob {
-	/** Stable id so a case prompt can reference a specific run (e.g. for get_run). */
+	/** Stable id so a case prompt can reference a specific run (e.g. for get_job_logs). */
 	id?: string
 	jobKind?: CompletedJob['job_kind']
 	scriptPath?: string
@@ -105,8 +100,6 @@ export interface BenchmarkWorkspaceJob {
 	label?: string
 	success?: boolean
 	logs?: string
-	args?: Record<string, unknown>
-	result?: unknown
 }

 export interface BenchmarkWorkspaceRunnables {
@@ -117,9 +110,6 @@ export interface BenchmarkWorkspaceRunnables {
 	aiProviders?: BenchmarkWorkspaceAiProvider[]
 	resources?: BenchmarkWorkspaceResource[]
 	datatables?: BenchmarkDatatableSeed[]
-	/** DuckLake catalog names, as `list_ducklakes` reports them. */
-	ducklakes?: string[]
-	dataMetrics?: DataMetric[]
 	jobs?: BenchmarkWorkspaceJob[]
 }

@@ -166,7 +156,7 @@ export function registerBenchmarkWorkspaceRunnables(
 		...runnables,
 		datatables: runnables.datatables ? structuredClone(runnables.datatables) : undefined
 	})
-	// Seed any fixture jobs so list_runs / get_run have data to return.
+	// Seed any fixture jobs so list_runs / get_job_logs have data to return.
 	for (const seed of runnables.jobs ?? []) {
 		createBenchmarkCompletedJob({
 			workspace,
@@ -176,9 +166,7 @@ export function registerBenchmarkWorkspaceRunnables(
 			scriptPath: seed.scriptPath,
 			createdBy: seed.createdBy,
 			label: seed.label,
-			logs: seed.logs,
-			args: seed.args,
-			result: seed.result
+			logs: seed.logs
 		})
 	}
 }
@@ -493,33 +481,6 @@ export function getBenchmarkJobLogs(workspace: string, jobId: string): string {
 	return job.logs ?? ''
 }

-/**
- * Mirror `JobService.getFlowAllResults`, which get_run calls for the execution
- * tree. Fixture jobs are single runs with no steps, so only the root entry.
- */
-export function getBenchmarkFlowAllResults(workspace: string, jobId: string) {
-	const job = getBenchmarkCompletedJob(workspace, jobId)
-	if (!job) {
-		throw new Error(`Job "${jobId}" not found in benchmark workspace`)
-	}
-	return {
-		entries: [
-			{
-				job_id: jobId,
-				label: 'Flow',
-				kind: job.job_kind ?? 'script',
-				depth: 0,
-				sibling_index: 1,
-				sibling_count: 1,
-				status: job.success ? 'success' : 'failure',
-				success: job.success
-			}
-		],
-		truncated: false,
-		scope_filtered: false
-	}
-}
-
 // ============= Drafts (per-user, DB-backed in production) =============

 /**
@@ -681,27 +642,6 @@ export function listBenchmarkDatatables(workspace: string): DataTableTables[] |
 	}))
 }

-// ============= DuckLake catalogs and declared metrics =============
-
-/** Seeded DuckLake names, or `null` for a non-benchmark workspace. */
-export function listBenchmarkDucklakes(workspace: string): string[] | null {
-	const runnables = benchmarkWorkspaceRunnables.get(workspace)
-	return runnables ? (runnables.ducklakes ?? []) : null
-}
-
-/**
- * Seeded metric declarations, or `null` for a non-benchmark workspace.
- *
- * The `table` / `path_prefix` filters are ignored: which rows a filter selects is
- * `canonical_table_path`'s business and is pinned by `ducklakeTools.test.ts`.
- * Re-deriving it here would give the eval its own copy of that spec to drift from,
- * and the case this serves measures whether the model reaches for the tool at all.
- */
-export function listBenchmarkDataMetrics(workspace: string): DataMetric[] | null {
-	const runnables = benchmarkWorkspaceRunnables.get(workspace)
-	return runnables ? (runnables.dataMetrics ?? []) : null
-}
-
 export function getBenchmarkDatatableSchema(input: {
 	workspace: string
 	datatableName: string
@@ -869,29 +809,6 @@ export function runBenchmarkFlowByPath(input: {
 	})
 }

-/**
- * Mirror `JobService.runFlowPreview` for benchmark workspaces, including the server's
- * refusal of a chat-enabled flow run that names no conversation (`memory_id`).
- */
-export function runBenchmarkFlowPreview(input: {
-	workspace: string
-	memoryId?: string
-	requestBody?: { path?: string; value?: { chat_input_enabled?: boolean }; args?: unknown }
-}): string {
-	if (input.requestBody?.value?.chat_input_enabled && !input.memoryId) {
-		throw new Error('Bad request: memory_id is required for chat-enabled flows')
-	}
-	const args = (input.requestBody?.args ?? {}) as Record<string, unknown>
-	return createBenchmarkCompletedJob({
-		workspace: input.workspace,
-		jobKind: 'flowpreview',
-		success: true,
-		args,
-		result: { path: input.requestBody?.path, args, mocked: true },
-		logs: 'Mock benchmark flow preview completed successfully.'
-	})
-}
-
 export function previewBenchmarkSchedule(input: {
 	requestBody?: Record<string, unknown>
 }): Record<string, unknown> {
@@ -998,7 +915,7 @@ function buildBenchmarkListableApp(app: BenchmarkWorkspaceApp): ListableApp {
 		extra_perms: {},
 		edited_at: BENCHMARK_TIMESTAMP,
 		execution_mode: 'viewer',
-		raw_app: app.rawApp ?? true
+		raw_app: true
 	}
 }

@@ -1016,7 +933,7 @@ function buildBenchmarkApp(app: BenchmarkWorkspaceApp): AppWithLastVersion {
 		execution_mode: 'viewer',
 		extra_perms: {},
 		custom_path: app.value.custom_path as string | undefined,
-		raw_app: app.rawApp ?? true
+		raw_app: true
 	}
 }

@@ -62,7 +62,6 @@ vi.mock('$lib/gen', async () => {
 		getBenchmarkDatatableSchema,
 		getBenchmarkDraftForUser,
 		getBenchmarkFlowByPath,
-		getBenchmarkFlowAllResults,
 		getBenchmarkJobLogs,
 		getBenchmarkOwnDraft,
 		getBenchmarkScriptByHash,
@@ -76,9 +75,7 @@ vi.mock('$lib/gen', async () => {
 		listBenchmarkPlainResources,
 		listBenchmarkApps,
 		listBenchmarkDatatables,
-		listBenchmarkDataMetrics,
 		listBenchmarkDrafts,
-		listBenchmarkDucklakes,
 		listBenchmarkFlows,
 		listBenchmarkJobs,
 		listBenchmarkScripts,
@@ -89,8 +86,6 @@ vi.mock('$lib/gen', async () => {
 		previewBenchmarkSchedule,
 		runBenchmarkDatatableSql,
 		runBenchmarkFlowByPath,
-		runBenchmarkFlowPreview,
-		runBenchmarkScriptByPath,
 		runBenchmarkScriptPreview,
 		updateBenchmarkDraft,
 		listBenchmarkMcpTools
@@ -284,26 +279,6 @@ vi.mock('$lib/gen', async () => {
 				}
 				return runBenchmarkScriptPreview({ workspace: data.workspace, requestBody })
 			},
-			runScriptByPath: async (data: {
-				workspace: string
-				path: string
-				requestBody?: Record<string, unknown>
-			}) =>
-				hasBenchmarkWorkspace(data.workspace)
-					? runBenchmarkScriptByPath({
-							workspace: data.workspace,
-							path: data.path,
-							args: data.requestBody
-						})
-					: actual.JobService.runScriptByPath(data),
-			runFlowPreview: async (data: {
-				workspace: string
-				memoryId?: string
-				requestBody?: { path?: string; value?: { chat_input_enabled?: boolean }; args?: unknown }
-			}) =>
-				hasBenchmarkWorkspace(data.workspace)
-					? runBenchmarkFlowPreview(data)
-					: actual.JobService.runFlowPreview(data as any),
 			runFlowByPath: async (data: {
 				workspace: string
 				path: string
@@ -337,11 +312,7 @@ vi.mock('$lib/gen', async () => {
 			getJobLogs: async (data: { workspace: string; id: string }) =>
 				hasBenchmarkWorkspace(data.workspace)
 					? getBenchmarkJobLogs(data.workspace, data.id)
-					: actual.JobService.getJobLogs(data),
-			getFlowAllResults: async (data: { workspace: string; id: string }) =>
-				hasBenchmarkWorkspace(data.workspace)
-					? getBenchmarkFlowAllResults(data.workspace, data.id)
-					: actual.JobService.getFlowAllResults(data)
+					: actual.JobService.getJobLogs(data)
 		}),
 		WorkspaceService: wrapService(actual.WorkspaceService, {
 			getCopilotInfo: async (data: { workspace: string }) =>
@@ -352,10 +323,6 @@ vi.mock('$lib/gen', async () => {
 				hasBenchmarkWorkspace(data.workspace)
 					? (listBenchmarkDatatables(data.workspace) ?? [])
 					: actual.WorkspaceService.listDataTableTables(data),
-			listDucklakes: async (data: { workspace: string }) =>
-				hasBenchmarkWorkspace(data.workspace)
-					? (listBenchmarkDucklakes(data.workspace) ?? [])
-					: actual.WorkspaceService.listDucklakes(data),
 			getDataTableTableSchema: async (data: {
 				workspace: string
 				datatableName: string
@@ -371,12 +338,6 @@ vi.mock('$lib/gen', async () => {
 						})
 					: actual.WorkspaceService.getDataTableTableSchema(data)
 		}),
-		DataMetricService: wrapService(actual.DataMetricService, {
-			listDataMetrics: async (data: { workspace: string }) =>
-				hasBenchmarkWorkspace(data.workspace)
-					? { metrics: listBenchmarkDataMetrics(data.workspace) ?? [] }
-					: actual.DataMetricService.listDataMetrics(data)
-		}),
 		ScheduleService: wrapService(actual.ScheduleService, {
 			existsSchedule: async (data: { workspace: string; path: string }) =>
 				hasBenchmarkWorkspace(data.workspace) ? false : actual.ScheduleService.existsSchedule(data),
@@ -1,8 +1,9 @@
+import { randomUUID } from "node:crypto";
 import type { WindmillBackendSettings } from "../../core/windmillBackendSettings";
-import { buildWorkspaceId } from "./workspaceId";

 const tokenCache = new Map<string, Promise<string>>();
 const sharedWorkspaceQueue = new Map<string, Promise<void>>();
+const DEFAULT_WORKSPACE_PREFIX = "ai-evals";

 export class WindmillBackendClient {
  constructor(private readonly settings: WindmillBackendSettings) {}
@@ -178,6 +179,16 @@ async function withSharedWorkspaceLock<T>(
  }
 }

+function buildWorkspaceId(caseId: string, attempt: number): string {
+  const caseSlug = caseId
+    .toLowerCase()
+    .replace(/[^a-z0-9-]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, 30);
+  const suffix = randomUUID().slice(0, 8);
+  return `${DEFAULT_WORKSPACE_PREFIX}-${caseSlug || "case"}-a${attempt}-${suffix}`;
+}
+
 async function expectOk(response: Response, context: string): Promise<void> {
  if (response.ok) {
    return;
@@ -1,21 +0,0 @@
-import { describe, expect, it } from "bun:test";
-import { buildWorkspaceId } from "./workspaceId";
-
-describe("buildWorkspaceId", () => {
-  // `workspace.proper_id` rejects `--`, which a case id can carry itself and
-  // which truncating a slug on a hyphen produces once the suffix adds its own.
-  // One id per shape: cut landing on a hyphen, cut landing mid-word, no cut, and
-  // a doubled hyphen no cut ever reaches.
-  it("stays within the id length cap and the proper_id format", () => {
-    for (const caseId of [
-      "global-test6-secret-variable-draft",
-      "global-test23-datatable-query-select",
-      "short",
-      "global--test-foo",
-    ]) {
-      const id = buildWorkspaceId(caseId, 1);
-      expect(id.length).toBeLessThanOrEqual(50);
-      expect(id).toMatch(/^\w+(-\w+)*$/);
-    }
-  });
-});
@@ -1,22 +0,0 @@
-import { randomUUID } from "node:crypto";
-
-const DEFAULT_WORKSPACE_PREFIX = "ai-evals";
-
-// A workspace id must be at most 50 characters AND match `^\w+(-\w+)*$`
-// (`workspace.proper_id`), so the case slug yields to the random suffix that
-// makes the id unique, and no hyphen may end up doubled — neither one already in
-// the case id nor one a truncation leaves for the suffix to follow.
-const MAX_WORKSPACE_ID_LENGTH = 50;
-
-export function buildWorkspaceId(caseId: string, attempt: number): string {
-  const caseSlug = caseId
-    .toLowerCase()
-    .replace(/[^a-z0-9-]+/g, "-")
-    .replace(/-{2,}/g, "-")
-    .replace(/^-+|-+$/g, "");
-  const suffix = `-a${attempt}-${randomUUID().slice(0, 8)}`;
-  const head = `${DEFAULT_WORKSPACE_PREFIX}-${caseSlug || "case"}`;
-  return `${head
-    .slice(0, MAX_WORKSPACE_ID_LENGTH - suffix.length)
-    .replace(/-+$/, "")}${suffix}`;
-}
@@ -889,13 +889,13 @@
    draftCountExactly: 0
  toolExpect:
    requiredToolsUsed:
-      - get_run
+      - get_job_logs
    forbiddenToolsUsed:
      - deploy_workspace_item
      - delete_workspace_item
      - write_script
    toolCallArgs:
-      - tool: get_run
+      - tool: get_job_logs
        field: id
        stringIncludesAnyOf:
          - 01920000-0000-7000-8000-0000000000f1
@@ -906,34 +906,6 @@
    - fetches the logs for the requested job id
    - explains the failure from the returned logs (connection refused to the upstream API)

- id: global-run-args-and-result
-  prompt: |-
-    What was the run 01920000-0000-7000-8000-0000000000f2 called with, and what did it return?
-  initial: ai_evals/fixtures/frontend/global/initial/jobs_seed.json
-  runtime:
-    maxTurns: 6
-  validate:
-    draftCountExactly: 0
-  toolExpect:
-    requiredToolsUsed:
-      - get_run
-    forbiddenToolsUsed:
-      - test_run_script
-      - run_script
-      - deploy_workspace_item
-    toolCallArgs:
-      - tool: get_run
-        field: id
-        stringIncludesAnyOf:
-          - 01920000-0000-7000-8000-0000000000f2
-  # Read-only, so no draft for the global judge to score — validated on tool use
-  # and the deterministic argument check, like the neighbouring run cases.
-  skipJudge: true
-  judgeChecklist:
-    - reports the arguments the run was called with (region emea, 12 recipients)
-    - reports what the run returned (12 sent, 3 skipped)
-    - does not start a new run to find out
-
 # --- Page navigation (open_page) ---
 # The assistant should take the user to a Windmill page (Runs/Schedules) with the
 # right filters via open_page, rather than describing where to click or dumping the
@@ -1919,11 +1891,10 @@
    - when the lookup fails, tells the user instead of inventing table names
    - does not write scripts or resources to answer a read-only question

-# --- Dedicated tools preferred over the API catalog ---
-# The harness serves worker/queue reads itself (benchmark fetch handlers in
-# adapters/frontend), so these cases do not require an mcp-enabled eval backend.
-# The stale `api-catalog` in the id below is kept so results stay comparable
-# across benchmark runs.
+# --- API catalog (search_api_endpoints / call_api_get / call_api_endpoint) ---
+# The harness serves the catalog and the executed calls itself (mock
+# listMcpTools + benchmark fetch handlers in adapters/frontend), so these cases
+# do not require an mcp-enabled eval backend.

 - id: global-test30-api-catalog-workers
  prompt: |-
@@ -1935,42 +1906,23 @@
    draftCountExactly: 0
  toolExpect:
    requiredToolsUsed:
-      - list_workers
-    forbiddenToolsUsed:
+      - search_api_endpoints
      - call_api_get
+    forbiddenToolsUsed:
      - call_api_endpoint
      - write_script
      - deploy_workspace_item
+    toolCallArgs:
+      - tool: call_api_get
+        field: name
+        stringIncludesAnyOf:
+          - listWorkers
  # Read-only workspace inspection produces no draft; validate via tool use.
  skipJudge: true
  judgeChecklist:
-    - reads worker state through list_workers instead of guessing or fabricating
+    - discovers the workers endpoint through the API catalog instead of guessing or fabricating
    - reports worker status from the returned data

- id: global-test37-ducklake-declared-measure
-  prompt: |-
-    We track orders in the main ducklake. Write me a duckdb script that reports total
-    revenue by month. Keep it as a draft, don't deploy it.
-  initial: ai_evals/fixtures/frontend/global/initial/ducklake_orders_metrics.json
-  runtime:
-    maxTurns: 8
-  validate:
-    draftCountExactly: 1
-  toolExpect:
-    requiredToolsUsed:
-      - list_data_metrics
-    forbiddenToolsUsed:
-      - deploy_workspace_item
-      - delete_workspace_item
-  # The judge runs: the point is not that the tool was called but that the number it
-  # describes is the declared one. `revenue` excludes test rows, so an aggregate that
-  # reproduces it without the filter is plausible, runnable and wrong.
-  judgeChecklist:
-    - totals revenue with the declared sum over the amount column rather than an invented aggregate over a guessed column
-    - excludes test orders from the total, as the declared revenue measure does
-    - groups by month using the declared order_month expression over order_date
-    - does not introduce column names absent from the declarations
-
 - id: global-test31-draft-test-run-not-deployed
  prompt: |-
    Update `f/evals/global/format_greeting` so the provided name is uppercased in the greeting, then run it with name "ada" to check it works.
@@ -2022,170 +1974,6 @@
  judgeChecklist:
    - deletes the deployed script via delete_workspace_item rather than a raw API endpoint

- id: global-test33-run-deployed-script-with-form
-  prompt: |-
-    Run the deployed script `f/evals/global/format_greeting` for me with the name "ada".
-  initial: ai_evals/fixtures/frontend/global/initial/format_greeting_script.json
-  runtime:
-    maxTurns: 8
-    # A session chat is where the run card has a preview pane beside it; run_script
-    # itself is offered in every chat.
-    sessionChat: true
-  validate:
-    draftCountExactly: 0
-  toolExpect:
-    requiredToolsUsed:
-      - run_script
-      # A draft may declare different arguments than the deployed version being run, so
-      # the names to prefill have to come from the deployed schema.
-      - read_workspace_item
-    forbiddenToolsUsed:
-      - test_run_script
-      - call_api_endpoint
-      - write_script
-      - deploy_workspace_item
-    # An empty form pushes the work back onto the user, so the prefill is part of
-    # what the tool is for.
-    toolCallArgs:
-      - tool: run_script
-        field: args.name
-        stringIncludesAnyOf:
-          - ada
-  # Running produces no draft, and the judge cannot observe runs; validate via tool use.
-  skipJudge: true
-  judgeChecklist:
-    - runs the deployed script through run_script rather than a preview test run or a raw API endpoint
-    - passes the name "ada" so the confirmation form comes up prefilled
-
- id: global-test34-run-with-secret-from-variable
-  prompt: |-
-    Run the deployed `f/evals/global/billing_sync` for the account `acme` — use the billing
-    API token we already keep in the workspace.
-  initial: ai_evals/fixtures/frontend/global/initial/billing_sync_with_secret_arg.json
-  runtime:
-    maxTurns: 10
-    # A session chat is where the run card has a preview pane beside it; run_script
-    # itself is offered in every chat.
-    sessionChat: true
-  validate:
-    draftCountExactly: 0
-  toolExpect:
-    requiredToolsUsed:
-      - run_script
-    forbiddenToolsUsed:
-      - write_script
-      - deploy_workspace_item
-    # A secret argument is filled by naming the variable that holds it: the value stays in
-    # the variable and only its path travels. A literal reaches the job as a reference too,
-    # minted on the way in, but it stays in the tool call the model emitted.
-    toolCallArgs:
-      - tool: run_script
-        field: args.api_token
-        stringIncludesAnyOf:
-          - "$var:f/evals/global/stripe_api_token"
-      - tool: run_script
-        field: args.account
-        stringIncludesAnyOf:
-          - acme
-  # Running produces no draft, and the judge cannot observe runs; validate via tool use.
-  skipJudge: true
-  judgeChecklist:
-    - fills the secret argument with a reference to the existing workspace variable rather than a literal token
-    - passes the account "acme"
-    - does not invent or guess the token's value
-
- id: global-test35-run-deployed-flow-with-form
-  prompt: |-
-    Run the deployed flow `f/evals/global/notify_customer` for me — the customer is `acme`.
-  initial: ai_evals/fixtures/frontend/global/initial/notify_customer_flow.json
-  runtime:
-    maxTurns: 8
-    # A session chat is where the run card has a preview pane beside it; run_flow
-    # itself is offered in every chat.
-    sessionChat: true
-  validate:
-    draftCountExactly: 0
-  toolExpect:
-    requiredToolsUsed:
-      - run_flow
-      # A draft may declare different arguments than the deployed version being run, so
-      # the names to prefill have to come from the deployed schema.
-      - read_workspace_item
-    forbiddenToolsUsed:
-      - test_run_flow
-      - call_api_endpoint
-      - write_flow
-      - deploy_workspace_item
-    # An empty form pushes the work back onto the user, so the prefill is part of
-    # what the tool is for.
-    toolCallArgs:
-      - tool: run_flow
-        field: args.customer
-        stringIncludesAnyOf:
-          - acme
-  # Running produces no draft, and the judge cannot observe runs; validate via tool use.
-  skipJudge: true
-  judgeChecklist:
-    - runs the deployed flow through run_flow rather than a preview test run or a raw API endpoint
-    - passes the customer "acme" so the confirmation form comes up prefilled
-
- id: global-test36-draft-flow-test-run-not-deployed
-  prompt: |-
-    Update the `calculate_total` step of `f/evals/global/process_invoice` so it applies 8% tax and
-    returns `subtotal`, `tax` and `total`, then run it to check it works.
-    Keep it as an AI draft only; do not deploy or save it.
-  initial: ai_evals/fixtures/frontend/global/initial/process_invoice_flow.json
-  runtime:
-    maxTurns: 10
-  validate:
-    draftCountExactly: 1
-    requiredDrafts:
-      - type: flow
-        path: f/evals/global/process_invoice
-  toolExpect:
-    # A one-step flow is as well checked by running the step as the whole flow, so both
-    # count: what matters is that the run is against the draft.
-    requiredToolsAnyOf:
-      - [test_run_flow, test_run_step]
-    # The draft is what the user asked to check, and run_flow would run the deployed
-    # version instead — the edit would not be in what ran.
-    forbiddenToolsUsed:
-      - run_flow
-      - call_api_endpoint
-      - deploy_workspace_item
-  # The judge cannot observe runs, and the edit's content is already pinned by
-  # global-test5 on this fixture; what this case guards is where the run went.
-  skipJudge: true
-  judgeChecklist:
-    - creates an AI draft of f/evals/global/process_invoice applying 8% tax
-    - does not deploy or save the draft
-
- id: global-test38-chat-flow-follow-up-same-conversation
-  prompt: |-
-    I want to check that my support chat flow `f/evals/global/support_chat` remembers what was said.
-    Test it: first send "My name is Ada", then send "What is my name?" as a follow-up in the same chat.
-  initial: ai_evals/fixtures/frontend/global/initial/support_chat_flow.json
-  runtime:
-    maxTurns: 8
-  validate:
-    draftCountExactly: 0
-  toolExpect:
-    requiredToolsUsed:
-      - test_run_flow
-    # A chat flow's memory lives in its conversation, so a follow-up only reaches the first
-    # turn's history when both test runs name the same conversation.
-    toolCallArgs:
-      - tool: test_run_flow
-        field: memory_id
-        sharedByAtLeast: 2
-    forbiddenToolsUsed:
-      - run_flow
-      - deploy_workspace_item
-  # The judge cannot observe runs; what this case guards is the conversation the runs share.
-  skipJudge: true
-  judgeChecklist:
-    - test-runs the chat flow twice, the second message as a follow-up in the first run's conversation
-
 - id: global-undo-created-draft
  prompt: |-
    Create a draft Postgres resource at `u/admin/scratch_db` for host db.example.com port 5432, database `orders`, user `app`, and tell me what fields it ended up with.
@@ -2611,40 +2399,3 @@
  judgeChecklist:
    - runs the existing script rather than rewriting it
    - passes the GitHub resource as the bare string $res:f/evals/global/github_main
-
- id: global-drag-and-drop-app-not-editable
-  prompt: |-
-    Add a refresh button to the ops console app, and the same to the sales board app.
-  initial: ai_evals/fixtures/frontend/global/initial/apps_code_and_drag_and_drop.json
-  runtime:
-    maxTurns: 12
-  validate:
-    # One request, two apps, only one of them editable: the code app must come back with a
-    # draft and the drag-and-drop one must not. Refusing both, or editing both, fails here —
-    # which is what makes this a test of the distinction rather than of caution.
-    draftCountExactly: 1
-    requiredDrafts:
-      - type: app
-        path: f/evals/global/ops_console
-    forbiddenDrafts:
-      - type: app
-        path: f/evals/global/sales_board
-  toolExpect:
-    # Deliberately not constraining write_app_file/patch_app_file by argument: an entry there
-    # fails when its tool was never called, so naming both would fail on whichever the model
-    # did not pick. The draft assertions above cover the same ground, tool-agnostically.
-    forbiddenToolsUsed:
-      - init_app
-      - deploy_workspace_item
-      - delete_app_file
-      - delete_app_runnable
-  assistantExpect:
-    # A refusal leaves no draft for the judge to read, so the explanation is checked here.
-    # Only the app kind: substring tests cannot see paraphrase, and every wording of "I can't
-    # edit it" defeats a fixed list.
-    requiredMentionsAnyOf:
-      - - drag-and-drop
-        - drag and drop
-        - low-code
-        - no-code
-  skipJudge: true
@@ -182,13 +182,6 @@ export interface ToolCallArgumentRule {
   * the point is that the model filled it in at all rather than what it said.
   */
  nonEmpty?: boolean;
-  /**
-   * Existential over calls: at least this many recorded calls to `tool` carry the
-   * same non-blank string in `field`. Use when calls have to share an identifier —
-   * e.g. test runs that continue one conversation — while a retry with a rejected
-   * value in between is still acceptable.
-   */
-  sharedByAtLeast?: number;
  /**
   * Universal over calls: no recorded call to `tool` may pass `field` at all.
   * For partial-update tools, where supplying a field the model could not have
@@ -396,32 +396,6 @@ describe("validateToolExpectations", () => {
    expect(nonEmptyCheck?.details).toContain("blank on 1 of 2");
  });

-  it("requires sharedByAtLeast calls to carry one value, not merely a value each", () => {
-    const run = (ids: (string | undefined)[]) =>
-      validateToolExpectations({
-        run: {
-          success: true,
-          actual: {},
-          assistantMessageCount: 1,
-          toolCallCount: ids.length,
-          toolsUsed: ["test_run_flow"],
-          toolCallDetails: ids.map((memory_id) => ({
-            name: "test_run_flow",
-            arguments: { path: "f/chat", memory_id },
-          })),
-          skillsInvoked: [],
-        },
-        toolExpect: {
-          toolCallArgs: [{ tool: "test_run_flow", field: "memory_id", sharedByAtLeast: 2 }],
-        },
-      }).find((c) => c.name.includes("is shared by at least 2 calls"))?.passed;
-
-    expect(run(["a", "b"])).toBe(false);
-    expect(run(["a"])).toBe(false);
-    expect(run([undefined, undefined])).toBe(false);
-    expect(run(["rejected", "a", "a"])).toBe(true);
-  });
-
  it("passes nonEmpty when every call filled the field", () => {
    const checks = validateToolExpectations({
      run: {
@@ -320,23 +320,6 @@ export function validateToolExpectations(input: {
      );
    }

-    if (rule.sharedByAtLeast !== undefined) {
-      const counts = new Map<string, number>();
-      for (const value of values) {
-        if (typeof value === "string" && value.trim().length > 0) {
-          counts.set(value, (counts.get(value) ?? 0) + 1);
-        }
-      }
-      const mostShared = Math.max(0, ...counts.values());
-      checks.push(
-        check(
-          `${rule.tool}.${rule.field} is shared by at least ${rule.sharedByAtLeast} calls`,
-          mostShared >= rule.sharedByAtLeast,
-          `most calls sharing one value: ${mostShared}; values: ${summarizeToolValues(values)}`
-        )
-      );
-    }
-
    if (rule.fieldMustBeAbsent) {
      // Anything other than `undefined` was supplied — an explicit `null` is the
      // model passing the field, not omitting it.
@@ -1,30 +0,0 @@
-{
-  "user": {
-    "username": "admin",
-    "is_admin": true,
-    "folders": ["evals"],
-    "folders_read": ["evals"]
-  },
-  "workspace": {
-    "apps": [
-      {
-        "path": "f/evals/global/sales_board",
-        "summary": "Sales board",
-        "rawApp": false,
-        "value": {
-          "grid": []
-        }
-      },
-      {
-        "path": "f/evals/global/ops_console",
-        "summary": "Ops console",
-        "value": {
-          "files": {
-            "/App.tsx": "export default function App() {\n\treturn <div>Ops console</div>\n}\n"
-          },
-          "runnables": {}
-        }
-      }
-    ]
-  }
-}
@@ -1,37 +0,0 @@
-{
-  "workspace": {
-    "variables": [
-      {
-        "path": "f/evals/global/stripe_api_token",
-        "value": "sk_live_do_not_leak_me",
-        "is_secret": true,
-        "description": "Token used by the billing sync job",
-        "labels": ["billing"]
-      }
-    ],
-    "scripts": [
-      {
-        "path": "f/evals/global/billing_sync",
-        "summary": "Sync billing records",
-        "description": "Syncs billing records for one account, authenticating with an API token.",
-        "language": "bun",
-        "schema": {
-          "$schema": "https://json-schema.org/draft/2020-12/schema",
-          "type": "object",
-          "properties": {
-            "account": {
-              "type": "string"
-            },
-            "api_token": {
-              "type": "string",
-              "password": true,
-              "description": "API token to authenticate with"
-            }
-          },
-          "required": ["account", "api_token"]
-        },
-        "content": "export async function main(account: string, api_token: string) {\n  return `synced ${account}`\n}\n"
-      }
-    ]
-  }
-}
@@ -1,36 +0,0 @@
-{
-  "workspace": {
-    "ducklakes": ["main"],
-    "dataMetrics": [
-      {
-        "script_path": "f/analytics/orders_pipeline",
-        "table_path": "main/main.orders",
-        "kind": "measure",
-        "name": "revenue",
-        "expr": "sum(amount)",
-        "filter": "not is_test"
-      },
-      {
-        "script_path": "f/analytics/orders_pipeline",
-        "table_path": "main/main.orders",
-        "kind": "measure",
-        "name": "order_count",
-        "expr": "count(*)"
-      },
-      {
-        "script_path": "f/analytics/orders_pipeline",
-        "table_path": "main/main.orders",
-        "kind": "dimension",
-        "name": "order_month",
-        "expr": "date_trunc('month', order_date)"
-      },
-      {
-        "script_path": "f/analytics/orders_pipeline",
-        "table_path": "main/main.orders",
-        "kind": "dimension",
-        "name": "region",
-        "expr": "region"
-      }
-    ]
-  }
-}
@@ -15,8 +15,6 @@
        "jobKind": "script",
        "createdBy": "bob",
        "success": true,
-        "args": { "region": "emea", "dry_run": false, "recipients": 12 },
-        "result": { "sent": 12, "skipped": 3, "digest_url": "https://reports.example.com/d/2026-06-09" },
        "logs": "Generating daily digest...\nDigest emailed to 12 recipients\nDone in 1.2s"
      },
      {
@@ -1,40 +0,0 @@
-{
-  "workspace": {
-    "flows": [
-      {
-        "path": "f/evals/global/notify_customer",
-        "summary": "Notify a customer",
-        "description": "Sends a notification to the named customer.",
-        "schema": {
-          "$schema": "https://json-schema.org/draft/2020-12/schema",
-          "type": "object",
-          "properties": {
-            "customer": {
-              "type": "string"
-            }
-          },
-          "required": ["customer"]
-        },
-        "value": {
-          "modules": [
-            {
-              "id": "notify",
-              "summary": "Send the notification",
-              "value": {
-                "type": "rawscript",
-                "language": "bun",
-                "content": "export async function main(customer: string) {\n  return `Notified ${customer}`\n}\n",
-                "input_transforms": {
-                  "customer": {
-                    "type": "javascript",
-                    "expr": "flow_input.customer"
-                  }
-                }
-              }
-            }
-          ]
-        }
-      }
-    ]
-  }
-}
@@ -1,59 +0,0 @@
-{
-  "workspace": {
-    "flows": [
-      {
-        "path": "f/evals/global/support_chat",
-        "summary": "Support chat",
-        "description": "Answers customer questions in a chat, remembering earlier messages.",
-        "schema": {
-          "$schema": "https://json-schema.org/draft/2020-12/schema",
-          "type": "object",
-          "properties": {
-            "user_message": {
-              "type": "string",
-              "description": "Message from user"
-            }
-          },
-          "required": ["user_message"]
-        },
-        "value": {
-          "chat_input_enabled": true,
-          "modules": [
-            {
-              "id": "assistant",
-              "summary": "Support assistant",
-              "value": {
-                "type": "aiagent",
-                "tools": [],
-                "input_transforms": {
-                  "provider": {
-                    "type": "static",
-                    "value": {
-                      "kind": "anthropic",
-                      "model": "claude-haiku-4-5-20251001",
-                      "resource": "$res:f/evals/ai/anthropic"
-                    }
-                  },
-                  "user_message": {
-                    "type": "javascript",
-                    "expr": "flow_input.user_message"
-                  },
-                  "system_prompt": {
-                    "type": "static",
-                    "value": "You are a friendly support assistant. Keep answers short."
-                  },
-                  "memory": {
-                    "type": "static",
-                    "value": { "kind": "auto", "context_length": 10 }
-                  },
-                  "streaming": { "type": "static", "value": true },
-                  "output_type": { "type": "static", "value": "text" }
-                }
-              }
-            }
-          ]
-        }
-      }
-    ]
-  }
-}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT f.path\n                FROM workspace_runnable_dependencies wru \n                JOIN flow f\n                    ON wru.flow_path = f.path AND wru.workspace_id = f.workspace_id\n                WHERE wru.runnable_path = $1 AND wru.runnable_is_flow = $2 AND NOT wru.runnable_is_agent AND wru.workspace_id = $3",
+  "query": "SELECT f.path\n                FROM workspace_runnable_dependencies wru \n                JOIN flow f\n                    ON wru.flow_path = f.path AND wru.workspace_id = f.workspace_id\n                WHERE wru.runnable_path = $1 AND wru.runnable_is_flow = $2 AND wru.workspace_id = $3",
  "describe": {
    "columns": [
      {
@@ -20,5 +20,5 @@
      false
    ]
  },
-  "hash": "0c49b098051900b834cb791e37af2e38967680a77316ee9a53e67d70d7df9f63"
+  "hash": "00c0ae12b19ba495f307f0ce6b4833947c5b3fe45826fc5468e326d171d95236"
 }
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO metrics (id, value)\n                        VALUES ($1, to_jsonb((\n                            SELECT EXTRACT(EPOCH FROM now() - scheduled_for)\n                            FROM v2_job_queue\n                            WHERE tag = $2 AND running = false AND scheduled_for <= now() - ('3 seconds')::interval\n                            ORDER BY priority DESC NULLS LAST, scheduled_for LIMIT 1\n                        )))",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "00e63eab76d26e148b77e932848de74e8b0943d30481465da453942e299a128f"
+}
@@ -1,26 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT\n             COALESCE(dt.value->'database'->>'resource_type', 'unknown') AS \"kind!\",\n             COUNT(*)::BIGINT AS \"count!\"\n           FROM workspace_settings ws,\n                LATERAL jsonb_each(ws.datatable->'datatables') dt\n           WHERE jsonb_typeof(ws.datatable->'datatables') = 'object'\n           GROUP BY 1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "kind!",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 1,
-        "name": "count!",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      null,
-      null
-    ]
-  },
-  "hash": "0411a67eb9d88244fa654eda51123e16b5931c08c1073b09ab01dad205f161ed"
-}
@@ -1,43 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT s.hash as hash, dm.deployment_msg as deployment_msg, s.created_at as created_at, s.created_by as created_by\n        FROM script s LEFT JOIN deployment_metadata dm ON s.hash = dm.script_hash\n        WHERE s.workspace_id = $1 AND s.path = $2\n        ORDER by s.created_at DESC\n        LIMIT $3 OFFSET $4",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "hash",
-        "type_info": "Int8"
-      },
-      {
-        "ordinal": 1,
-        "name": "deployment_msg",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 2,
-        "name": "created_at",
-        "type_info": "Timestamptz"
-      },
-      {
-        "ordinal": 3,
-        "name": "created_by",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Int8",
-        "Int8"
-      ]
-    },
-    "nullable": [
-      false,
-      true,
-      false,
-      false
-    ]
-  },
-  "hash": "044310c0e7745867a24a9d3653ff29c87ce48ffd89fac070c8314556f884ce55"
-}
@@ -1,41 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO ai_shared_artifact\n               (workspace_id, artifact_id, email, created_by, name, kind, version, content)\n           VALUES ($1, $2, $3, $4, $5, $6, $7, $8)\n           ON CONFLICT (workspace_id, email, artifact_id) DO UPDATE\n           SET created_by = EXCLUDED.created_by,\n               name = EXCLUDED.name,\n               kind = EXCLUDED.kind,\n               version = EXCLUDED.version,\n               content = EXCLUDED.content,\n               shared_at = now()\n           RETURNING id, shared_at, (xmax = 0) AS \"inserted!\"",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Uuid"
-      },
-      {
-        "ordinal": 1,
-        "name": "shared_at",
-        "type_info": "Timestamptz"
-      },
-      {
-        "ordinal": 2,
-        "name": "inserted!",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar",
-        "Varchar",
-        "Varchar",
-        "Varchar",
-        "Varchar",
-        "Int4",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      null
-    ]
-  },
-  "hash": "0589cb0f96e17ecadae4923be70a6cf0148a9e10c1c4ad0f99312b8e99ec1b8a"
-}
@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT 1 AS one FROM workspace_settings WHERE workspace_id = $1 FOR UPDATE",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "one",
-        "type_info": "Int4"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "06abbf945bee93349ff88f64906b96ea1e853ef202510281427cfa9beeff81b3"
-}
@@ -1,50 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        SELECT\n            (SELECT MIN(day) FROM guest_activity) AS since,\n            (SELECT COUNT(DISTINCT email) FROM guest_activity\n             WHERE day > CURRENT_DATE - 30)::INT AS \"guest_count!\",\n            (SELECT COUNT(DISTINCT email) FROM guest_activity\n             WHERE jwt_entry AND day > CURRENT_DATE - 30)::INT AS \"guest_jwt_count!\",\n            (SELECT COUNT(DISTINCT workspace_id) FROM guest_activity\n             WHERE day > CURRENT_DATE - 30)::INT AS \"guest_workspace_count!\",\n            (SELECT COUNT(*) FROM workspace_settings ws JOIN workspace w ON w.id = ws.workspace_id\n             WHERE ws.guest_access_enabled AND NOT w.deleted)::INT AS \"guest_enabled_workspace_count!\",\n            (SELECT COUNT(*) FROM workspace WHERE NOT deleted)::INT AS \"workspace_count!\"\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "since",
-        "type_info": "Date"
-      },
-      {
-        "ordinal": 1,
-        "name": "guest_count!",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 2,
-        "name": "guest_jwt_count!",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 3,
-        "name": "guest_workspace_count!",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 4,
-        "name": "guest_enabled_workspace_count!",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 5,
-        "name": "workspace_count!",
-        "type_info": "Int4"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      null,
-      null,
-      null,
-      null,
-      null,
-      null
-    ]
-  },
-  "hash": "06af616fe4fc61a3b0dcd996a2a1e0e9ac63fc8756aeafac8d279841db117eac"
-}
@@ -1,17 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO dbt_node (workspace_id, script_path, script_hash, job_id, unique_id,\n                               resource_type, name, asset_path, tags)\n         VALUES ($1, $2, $3, $4, 'model.p.stock', 'model', 'stock',\n                 'u/a/wh/analytics/stock', '{}'),\n                ($1, $2, $3, $4, 'model.p.stock_daily', 'model', 'stock_daily',\n                 'u/a/wh/analytics/stock_daily', '{}')",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar",
-        "Int8",
-        "Uuid"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "06c1a79bfc24b17acbd79411295c718161d95f7ad65a26525c5f43241267608d"
-}
@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE workspace_settings ws\n           SET datatable = (\n               SELECT jsonb_set(ws.datatable, '{datatables}', jsonb_object_agg(\n                   dt.key,\n                   CASE WHEN dt.value->'reference'->>'workspace_id' = $1\n                             AND dt.value->'reference'->>'datatable' = $2\n                       THEN jsonb_set(dt.value, '{reference,datatable}', to_jsonb($3::text))\n                       ELSE dt.value END\n               ))\n               FROM jsonb_each(ws.datatable->'datatables') dt\n           )\n           WHERE EXISTS (\n               SELECT 1 FROM jsonb_each(COALESCE(ws.datatable->'datatables', '{}'::jsonb)) d\n               WHERE d.value->'reference'->>'workspace_id' = $1\n                 AND d.value->'reference'->>'datatable' = $2\n           )",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "06ce02cd7ce2f5a57355153edb573c242f9ba758db66e9a5e16f30e3e1494201"
-}
@@ -1,18 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO login_link (token_hash, email, rd, expiration, created_by)\n         VALUES ($1, $2, $3, $4, $5)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Bpchar",
-        "Varchar",
-        "Text",
-        "Timestamptz",
-        "Varchar"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "071de805623be166dddd2655f099bed4ebbf6a03ec5988acf072c83818d57a02"
-}
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM flow_conversation c\n              WHERE c.id = ANY($1)\n                AND c.workspace_id = $2\n                AND NOT EXISTS (\n                    SELECT 1 FROM flow_conversation_message m WHERE m.conversation_id = c.id\n                )",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "UuidArray",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "07a005f0f9e80a156cd2a5a0ae39a1fabeaa167818206a25abfe31d5582f942a"
-}
@@ -1,17 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE draft AS d\n           SET path = $3::text,\n               value = (\n                   SELECT CASE\n                       WHEN s.clean -> 'path' = to_jsonb($2::text)\n                         OR s.clean -> 'draft_path' = to_jsonb($2::text)\n                           THEN to_json(\n                               s.clean\n                               || CASE WHEN s.clean -> 'path' = to_jsonb($2::text)\n                                       THEN jsonb_build_object('path', $3::text)\n                                       ELSE '{}'::jsonb END\n                               || CASE WHEN s.clean -> 'draft_path' = to_jsonb($2::text)\n                                       THEN jsonb_build_object('draft_path', $3::text)\n                                       ELSE '{}'::jsonb END\n                           )\n                       ELSE d.value\n                   END\n                   FROM (SELECT replace(replace(replace(d.value::text, chr(92) || chr(92), chr(1)),\n                                                chr(92) || 'u0000', ''), chr(1), chr(92) || chr(92))::jsonb AS clean) s\n               )\n           WHERE d.workspace_id = $1\n             AND d.path = $2::text\n             AND d.typ::text = ANY($4::text[])",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Text",
-        "TextArray"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "09e3f8fa8a9e64048971983584bfa00ab137c70b73f381452cadfae6e1cda934"
-}
@@ -1,28 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT u.username, u.email FROM usr u WHERE u.workspace_id = $1 AND u.is_admin AND NOT u.operator AND NOT u.disabled AND NOT EXISTS (SELECT 1 FROM password p WHERE p.email = u.email AND p.disabled) ORDER BY u.username LIMIT 1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "username",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "email",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false
-    ]
-  },
-  "hash": "0c4dc0e9dc159fac7e41492c78a4e4e0b12b105d4475d7eba2d3a9573b93e388"
-}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "INSERT INTO workspace_settings (workspace_id, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url) SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url FROM workspace_settings WHERE workspace_id = $2",
+  "query": "INSERT INTO workspace_settings (workspace_id, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts) SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts FROM workspace_settings WHERE workspace_id = $2",
  "describe": {
    "columns": [],
    "parameters": {
@@ -11,5 +11,5 @@
    },
    "nullable": []
  },
-  "hash": "77d599e4f7c574dffac4824f37127c7ae2ef5f27d665ad9018f5cdea0f6f2cb1"
+  "hash": "0c5b02b6b70fb8fd2ab3e6c57897038750a44a67360d342b6ef705ef2e4d3007"
 }
@@ -1,71 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT value as \"value!: sqlx::types::Json<Box<serde_json::value::RawValue>>\",\n                  created_at, base\n           FROM draft\n           WHERE workspace_id = $1\n             AND (email = $2 OR email IS NULL)\n             AND path = $3\n             AND typ = $4\n           ORDER BY email NULLS LAST\n           LIMIT 1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "value!: sqlx::types::Json<Box<serde_json::value::RawValue>>",
-        "type_info": "Json"
-      },
-      {
-        "ordinal": 1,
-        "name": "created_at",
-        "type_info": "Timestamptz"
-      },
-      {
-        "ordinal": 2,
-        "name": "base",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Text",
-        {
-          "Custom": {
-            "name": "draft_kind",
-            "kind": {
-              "Enum": [
-                "script",
-                "flow",
-                "app",
-                "raw_app",
-                "resource",
-                "variable",
-                "trigger_schedule",
-                "trigger_webhook",
-                "trigger_default_email",
-                "trigger_email",
-                "trigger_http",
-                "trigger_websocket",
-                "trigger_postgres",
-                "trigger_kafka",
-                "trigger_nats",
-                "trigger_mqtt",
-                "trigger_sqs",
-                "trigger_gcp",
-                "trigger_azure",
-                "trigger_poll",
-                "trigger_cli",
-                "trigger_nextcloud",
-                "trigger_google",
-                "trigger_github",
-                "data_pipeline",
-                "trigger_amqp"
-              ]
-            }
-          }
-        }
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      true
-    ]
-  },
-  "hash": "0cc6770a81ecaecafe0d9b7100f94b329c4ec7978b016af4c964415e0c38396c"
-}
@@ -1,29 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT permissioned_as, permissioned_as_email FROM v2_job\n                 WHERE id = $1 AND workspace_id = $2",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "permissioned_as",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "permissioned_as_email",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false
-    ]
-  },
-  "hash": "0d10e0fa5cf4033c7d93c9ed56be8209046007917f44da954eccf2188e5bff1f"
-}
@@ -1,64 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE draft\n           SET path = $3,\n               -- Both path keys, not just the typed one: the editors mirror the\n               -- typed path into the other while it differs from the row's path,\n               -- and the loaders prefer the mirror — left naming the old location\n               -- it un-does this move on the next save. `create_missing = false`\n               -- on both, so a draft carrying only one keeps only one.\n               value = to_json(\n                   jsonb_set(\n                       jsonb_set(\n                           CASE WHEN $7::text IS NULL THEN to_jsonb(value)\n                                ELSE jsonb_set(to_jsonb(value), ARRAY['summary'], to_jsonb($7::text))\n                           END,\n                           ARRAY[$5::text], to_jsonb($3::text), false\n                       ),\n                       ARRAY[$8::text], to_jsonb($3::text), false\n                   )\n               )\n           WHERE workspace_id = $1\n             AND path = $2\n             AND typ = $4\n             AND email = $6\n             -- A pre-sanitizer NUL escape makes `to_jsonb` raise 22P05. Excluded\n             -- here so the statement can't 500; reported below instead. Unlike the\n             -- passive carry, rewriting the value IS this operation, so skipping it\n             -- silently would move the row and leave its typed path stale.\n             AND position(chr(92) || 'u0000' in replace(value::text, chr(92) || chr(92), '')) = 0\n             -- Skipped on a summary-only edit, where the \"target\" row is this\n             -- row and the guard would refuse the update against itself.\n             AND ($2 = $3 OR NOT EXISTS (\n                 SELECT 1 FROM draft o\n                 WHERE o.workspace_id = $1 AND o.path = $3 AND o.typ::text = ANY($9::text[])\n                   -- Of this kind only the caller's own row and the legacy one collide:\n                   -- teammates' drafts of one item share its path by design, but a deploy\n                   -- there wipes those two together, so a second would discard edits the\n                   -- caller never saw. The other app kind is a different item on the same\n                   -- deployed path, so it collides whoever owns it.\n                   AND (o.typ <> $4 OR o.email = $6 OR o.email IS NULL)\n             ))\n           RETURNING id",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Text",
-        {
-          "Custom": {
-            "name": "draft_kind",
-            "kind": {
-              "Enum": [
-                "script",
-                "flow",
-                "app",
-                "raw_app",
-                "resource",
-                "variable",
-                "trigger_schedule",
-                "trigger_webhook",
-                "trigger_default_email",
-                "trigger_email",
-                "trigger_http",
-                "trigger_websocket",
-                "trigger_postgres",
-                "trigger_kafka",
-                "trigger_nats",
-                "trigger_mqtt",
-                "trigger_sqs",
-                "trigger_gcp",
-                "trigger_azure",
-                "trigger_poll",
-                "trigger_cli",
-                "trigger_nextcloud",
-                "trigger_google",
-                "trigger_github",
-                "data_pipeline",
-                "trigger_amqp"
-              ]
-            }
-          }
-        },
-        "Text",
-        "Text",
-        "Text",
-        "Text",
-        "TextArray"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "0d9a83d77632bc0de19a48eddb7e6f80b2a41db4f1d352920d0c295ea3a018b1"
-}
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE v2_job_queue\n                     SET suspend = 0, suspend_until = NULL,\n                         started_at = coalesce(started_at, $2, now())\n                     WHERE id = $1",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Timestamptz"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "0e277240d2be50383ac53d844c71369067c41870be4561e1c26733ac30419801"
-}
@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO guest_activity (email, workspace_id, day, jwt_entry)\n         VALUES ($1, $2, CURRENT_DATE, true)\n         ON CONFLICT (email, workspace_id, day)\n         DO UPDATE SET jwt_entry = true, last_seen_at = now()\n         WHERE NOT guest_activity.jwt_entry\n         RETURNING 1 AS \"audited!\"",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "audited!",
-        "type_info": "Int4"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "0fc900f73ef119e4c89186cf120938a298bfe29afe1fd7111340252877f8b86c"
-}
@@ -1,17 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO dbt_column_edge (workspace_id, script_path, script_hash, job_id,\n                                      parent_unique_id, parent_column, child_unique_id,\n                                      child_column, lineage_kind)\n         VALUES ($1, $2, $3, $4, 'model.p.stock', 'sku', 'model.p.stock_daily', 'sku', 'copy')",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar",
-        "Int8",
-        "Uuid"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "1008ed150f30b56baf17b3c6e6bfc8ee144b14d564a3e589a60678b3e68effbf"
-}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO native_trigger (\n            external_id,\n            workspace_id,\n            service_name,\n            script_path,\n            is_flow,\n            webhook_token_hash,\n            service_config,\n            summary,\n            enabled\n        ) VALUES (\n            $1, $2, $3, $4, $5, $6, $7, $8, $9\n        )\n        ON CONFLICT (external_id, workspace_id, service_name)\n        DO UPDATE SET script_path = $4, is_flow = $5, webhook_token_hash = $6, service_config = $7, summary = $8, error = NULL, updated_at = NOW()\n        ",
+  "query": "\n        INSERT INTO native_trigger (\n            external_id,\n            workspace_id,\n            service_name,\n            script_path,\n            is_flow,\n            webhook_token_hash,\n            service_config,\n            summary\n        ) VALUES (\n            $1, $2, $3, $4, $5, $6, $7, $8\n        )\n        ON CONFLICT (external_id, workspace_id, service_name)\n        DO UPDATE SET script_path = $4, is_flow = $5, webhook_token_hash = $6, service_config = $7, summary = $8, error = NULL, updated_at = NOW()\n        ",
  "describe": {
    "columns": [],
    "parameters": {
@@ -23,11 +23,10 @@
        "Bool",
        "Varchar",
        "Jsonb",
-        "Varchar",
-        "Bool"
+        "Varchar"
      ]
    },
    "nullable": []
  },
-  "hash": "64dce306efc0d9989542dba5bf003dc94b9337a8d3b69805308258d1fa145e63"
+  "hash": "1048d1c95270ce1f36c02bce31a2bc8a88935c613bd213b7156299811377db8e"
 }
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE v2_job_queue SET suspend = $2, suspend_until = now() + interval '14 day' WHERE id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Int4"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "10af387fce25f6ea7af275e8e93b7ab1f2fc29a2ba79a39576551bdf66b592b6"
+}
@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM draft_move WHERE email = $1",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "11af34e5fe5b8ed59453d58628ed5fb3b2120835158f22d715b73460f6a55108"
-}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "\n        SELECT\n            external_id,\n            workspace_id,\n            service_name AS \"service_name!: ServiceName\",\n            script_path,\n            is_flow,\n            webhook_token_hash,\n            service_config,\n            error,\n            created_at,\n            updated_at,\n            summary,\n            enabled\n        FROM\n            native_trigger\n        WHERE\n            workspace_id = $1\n            AND service_name = $2\n            AND external_id = $3\n        ",
+  "query": "\n        SELECT\n            external_id,\n            workspace_id,\n            service_name AS \"service_name!: ServiceName\",\n            script_path,\n            is_flow,\n            webhook_token_hash,\n            service_config,\n            error,\n            created_at,\n            updated_at,\n            summary\n        FROM\n            native_trigger\n        WHERE\n            workspace_id = $1\n            AND service_name = $2\n            AND external_id = $3\n        ",
  "describe": {
    "columns": [
      {
@@ -68,11 +68,6 @@
        "ordinal": 10,
        "name": "summary",
        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 11,
-        "name": "enabled",
-        "type_info": "Bool"
      }
    ],
    "parameters": {
@@ -104,9 +99,8 @@
      true,
      false,
      false,
-      true,
-      false
+      true
    ]
  },
-  "hash": "c7766afaea3e187824698cae2b090af9f49ded98cd1824f1ac91cc5dbe709bc1"
+  "hash": "15014ce696cf2af4f719a537a4e3ca5b322cc130a35a91f8b8854f5ebdf25ad2"
 }
@@ -1,21 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO token\n            (token_hash, token_prefix, token, email, label, expiration, super_admin, scopes, workspace_id)\n            VALUES ($1, $2, $3, $4, $5, now() + ($6 || ' seconds')::interval, false, $7, $8)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar",
-        "Varchar",
-        "Varchar",
-        "Varchar",
-        "Text",
-        "TextArray",
-        "Varchar"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "1553608e0d5a9a9b22c1a2c200bf02200df0007291133033f2b9013c2e508fe1"
-}
@@ -1,19 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO git_sync_ci_test_check\n            (workspace_id, poster_workspace_id, head_sha, head_ref, repo_url,\n             repo_resource_path, check_run_id,\n             created_at, concluded, conclusion, concluded_at, github_posted)\n         VALUES ($1, $2, $3, $4, $5, $6, NULL, now(), false, NULL, NULL, false)\n         ON CONFLICT (workspace_id, repo_resource_path, head_sha) DO UPDATE SET\n            poster_workspace_id = EXCLUDED.poster_workspace_id,\n            head_ref = EXCLUDED.head_ref,\n            repo_url = EXCLUDED.repo_url,\n            check_run_id = NULL,\n            created_at = now(),\n            concluded = false,\n            conclusion = NULL,\n            concluded_at = NULL,\n            github_posted = false",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar",
-        "Varchar",
-        "Varchar",
-        "Text",
-        "Varchar"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "16c6e24ae06b52feed597a0c3d299107f989d50ea651546e964670cf99fd2de6"
-}
@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM dbt_column_edge\n          WHERE workspace_id = $1 AND script_path = $2 AND script_hash = $3",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Int8"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "178cb9cd8dfda66e878cd924f64a58ec742d7079703d417c886c8cf0a0e767a6"
-}
@@ -0,0 +1,26 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT COALESCE(username, split_part(email, '@', 1)) AS \"username!\", email FROM password WHERE super_admin = true AND disabled = false ORDER BY email LIMIT 1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "username!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "email",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      null,
+      false
+    ]
+  },
+  "hash": "17cdf02b4912078459526205849246fd2bdf9e3fce89852120aa4ad4ad6abfc3"
+}
@@ -1,49 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT a.id as app_id, av.id as version_id, dm.deployment_msg as deployment_msg,\n                av.created_by as created_by, av.created_at as created_at\n        FROM app a\n        JOIN LATERAL (\n            SELECT av2.id, COALESCE(v.ord, 0) AS ord\n            FROM app_version av2\n            LEFT JOIN unnest(a.versions) WITH ORDINALITY AS v(id, ord) ON v.id = av2.id\n            WHERE av2.app_id = a.id\n            ORDER BY ord DESC, av2.id DESC\n            LIMIT $3 OFFSET $4\n        ) page ON TRUE\n        JOIN app_version av ON av.id = page.id\n        LEFT JOIN deployment_metadata dm ON av.id = dm.app_version\n        WHERE a.workspace_id = $1 AND a.path = $2\n        ORDER BY page.ord DESC",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "app_id",
-        "type_info": "Int8"
-      },
-      {
-        "ordinal": 1,
-        "name": "version_id",
-        "type_info": "Int8"
-      },
-      {
-        "ordinal": 2,
-        "name": "deployment_msg",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 3,
-        "name": "created_by",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 4,
-        "name": "created_at",
-        "type_info": "Timestamptz"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Int8",
-        "Int8"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      true,
-      false,
-      false
-    ]
-  },
-  "hash": "18b38efcb141101192b372e7d7e7e47481877f3ab717682f3b84e665c95a5214"
-}
@@ -1,40 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT test_script_path, tested_item_path, tested_item_kind, has_wildcard AS \"has_wildcard!\" FROM ci_test_reference WHERE workspace_id = $1 ORDER BY test_script_path, tested_item_kind, tested_item_path",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "test_script_path",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "tested_item_path",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 2,
-        "name": "tested_item_kind",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 3,
-        "name": "has_wildcard!",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      true
-    ]
-  },
-  "hash": "18ba139acef81d4de18bf21755fa8605c3851b48bab4964c380538ada93f06a9"
-}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "INSERT INTO resource_type (workspace_id, name, schema, description, edited_at, created_by, format_extension, is_fileset, display_name)\n         SELECT $2, name, schema, description, edited_at, created_by, format_extension, is_fileset, display_name\n         FROM resource_type\n         WHERE workspace_id = $1",
+  "query": "INSERT INTO resource_type (workspace_id, name, schema, description, edited_at, created_by, format_extension, is_fileset)\n         SELECT $2, name, schema, description, edited_at, created_by, format_extension, is_fileset\n         FROM resource_type\n         WHERE workspace_id = $1",
  "describe": {
    "columns": [],
    "parameters": {
@@ -11,5 +11,5 @@
    },
    "nullable": []
  },
-  "hash": "86ad1e7ebe659f97877cc142c09676488dc6c80428e13e5db3c016e37072cfe4"
+  "hash": "1c2157ce14e90f0751d7f0a9f2dbb3c5a5789a32423e75260098a5300a4af986"
 }
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT id, conversation_id, message_type as \"message_type: MessageType\", content, job_id, created_at, created_seq, step_name, success, tool_arguments, tool_result, reasoning, attachments\n             FROM flow_conversation_message\n             WHERE conversation_id = $1\n               AND created_seq > $2\n             ORDER BY created_seq ASC\n             LIMIT $3\n             ",
+  "query": "SELECT id, conversation_id, message_type as \"message_type: MessageType\", content, job_id, created_at, created_seq, step_name, success\n             FROM (\n                SELECT id, conversation_id, message_type, content, job_id, created_at, created_seq, step_name, success\n                FROM flow_conversation_message\n                WHERE conversation_id = $1\n                ORDER BY created_seq DESC\n                LIMIT $2 OFFSET $3\n             ) AS messages\n             ORDER BY created_seq ASC\n             ",
  "describe": {
    "columns": [
      {
@@ -58,26 +58,6 @@
        "ordinal": 8,
        "name": "success",
        "type_info": "Bool"
-      },
-      {
-        "ordinal": 9,
-        "name": "tool_arguments",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 10,
-        "name": "tool_result",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 11,
-        "name": "reasoning",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 12,
-        "name": "attachments",
-        "type_info": "Jsonb"
      }
    ],
    "parameters": {
@@ -96,12 +76,8 @@
      false,
      false,
      true,
-      false,
-      true,
-      true,
-      true,
-      true
+      false
    ]
  },
-  "hash": "d6fa78c43b6c5f8040d7bccb29ad8627be1dac6fbe0097735a52f47c173f51c9"
+  "hash": "1c3473a0f9f6b6148b2c975f9f05bdefedf8a51c4e6ddf0eca367b9cc778d051"
 }
@@ -1,12 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE workspace_settings\n              SET dbt_warehouses = '{\"main\": {\"resource_path\": \"u/test-user/wh\"}}'::jsonb\n            WHERE workspace_id = 'test-workspace'",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": []
-  },
-  "hash": "1d8effff5dd1e4a177efed7366e84411c125cbfada861992e3d6032de635bad6"
-}
@@ -1,12 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO asset (workspace_id, path, kind, usage_access_type, usage_path, usage_kind)\n         VALUES ('test-workspace', 'main/analytics/marts', 'dbt', 'w', 'u/test-user/project',\n                 'script')",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": []
-  },
-  "hash": "1f7608defb5748db687145750520cb1059f63c1ea51db3471c213018b2983704"
-}
@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            SELECT (\n                SELECT elem\n                FROM jsonb_array_elements(git_credentials) AS elem\n                WHERE elem->>'repo_identity' = $2\n            )\n            FROM workspace_settings WHERE workspace_id = $1 FOR UPDATE\n            ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "elem",
-        "type_info": "Jsonb"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "1fc9a0aeabb0a33efc37167be3de72dc33ca421338e04277ac91c745351f89f3"
-}
@@ -1,32 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT\n             COUNT(*) FILTER (WHERE dt.value->>'migrations_enabled' = 'true')::BIGINT AS \"enabled!\",\n             COUNT(*) FILTER (WHERE dt.value->>'migrations_enabled' = 'false')::BIGINT AS \"disabled!\",\n             COUNT(*) FILTER (WHERE dt.value->>'migrations_enabled' IS NULL)::BIGINT AS \"unset!\"\n           FROM workspace_settings ws,\n                LATERAL jsonb_each(ws.datatable->'datatables') dt\n           WHERE jsonb_typeof(ws.datatable->'datatables') = 'object'",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "enabled!",
-        "type_info": "Int8"
-      },
-      {
-        "ordinal": 1,
-        "name": "disabled!",
-        "type_info": "Int8"
-      },
-      {
-        "ordinal": 2,
-        "name": "unset!",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      null,
-      null,
-      null
-    ]
-  },
-  "hash": "209c96d522f9683b39f053707568f9943111e0bac7d4fb478300f0cd8b799f23"
-}
@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO dbt_column_edge (workspace_id, script_path, script_hash, job_id,\n                                      parent_unique_id, parent_column, child_unique_id,\n                                      child_column, lineage_kind)\n         VALUES ($1, $2, $3, '00000000-0000-0000-0000-000000000000',\n                 'model.p.raw_orders', 'id', 'model.p.orders', 'order_id', 'copy'),\n                ($1, $2, $3, '00000000-0000-0000-0000-000000000000',\n                 'model.p.raw_orders', 'status', 'model.p.orders', 'order_id', 'scan')",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar",
-        "Int8"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "210441eb7bee09afd27a927e0e44ff3bc1143dab285e51a9b54b2c2f240b9a8c"
-}
@@ -1,26 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT\n             COUNT(*)::BIGINT AS \"total!\",\n             COUNT(DISTINCT (workspace_id, datatable))::BIGINT AS \"datatables!\"\n           FROM datatable_migrations",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "total!",
-        "type_info": "Int8"
-      },
-      {
-        "ordinal": 1,
-        "name": "datatables!",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      null,
-      null
-    ]
-  },
-  "hash": "2105d37be923a445933c899bb31523709f837b7e1969b7364f70cc2a60cdd520"
-}
@@ -1,20 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO resource_type (workspace_id, name, schema, description, format_extension, display_name, edited_at)\n             VALUES ('admins', $1, $2, $3, $4, $6, now())\n             ON CONFLICT (workspace_id, name) DO UPDATE\n             SET schema = EXCLUDED.schema, description = EXCLUDED.description,\n                 -- A fileset is a set of files, so it cannot also be one file.\n                 -- Create and update reject the pair; this writer bypasses both, so\n                 -- it declines the extension rather than persisting the forbidden\n                 -- combination onto a same-named local fileset.\n                 format_extension = CASE\n                     WHEN resource_type.is_fileset THEN NULL\n                     WHEN $5 THEN EXCLUDED.format_extension\n                     ELSE resource_type.format_extension END,\n                 display_name = CASE WHEN $7 THEN EXCLUDED.display_name ELSE resource_type.display_name END,\n                 edited_at = now()",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Jsonb",
-        "Text",
-        "Varchar",
-        "Bool",
-        "Varchar",
-        "Bool"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "212bf5b32de102a9c537907aaff04befc3a6596c258086805dd42f513ddb3ead"
-}
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO guest_activity (email, workspace_id, day)\n         VALUES ($1, $2, CURRENT_DATE)\n         ON CONFLICT (email, workspace_id, day)\n         DO UPDATE SET last_seen_at = now()",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "21e9629bdf5824b676bf88709f4fe0d9644b8d6a08d0c73daac73c48b5933afe"
-}
@@ -1,20 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO dbt_node (workspace_id, script_path, script_hash, job_id, unique_id,\n                               resource_type, name, asset_path, tags)\n         VALUES ($1, $2, $3, '00000000-0000-0000-0000-000000000000', 'source.q.' || $4,\n                 'source', $4, $5, '{}'),\n                ($1, $2, $3, '00000000-0000-0000-0000-000000000000', 'model.q.' || $6,\n                 'model', $6, $7, '{}')",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar",
-        "Int8",
-        "Text",
-        "Text",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "23151591ed03ea6d2b017e66f54115b2241215d660d25df7615c8b12d704e92c"
-}
@@ -1,18 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO draft_move (workspace_id, typ, old_path, new_path, email)\n             SELECT m.workspace_id, m.typ, m.old_path, $4, $5::text\n             FROM draft_move m\n             WHERE m.workspace_id = $1 AND m.typ::text = ANY($2::text[])\n               AND m.new_path = $3 AND m.email IS NULL\n               AND NOT EXISTS (\n                   SELECT 1 FROM draft_move o\n                   WHERE o.workspace_id = m.workspace_id AND o.typ = m.typ\n                     AND o.old_path = m.old_path AND o.email = $5::text\n               )",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "TextArray",
-        "Text",
-        "Varchar",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "232ff36c2d522383061cafbf9639698dbc44a18c0f016aae94a1705f06fd1e48"
-}
@@ -1,15 +1,15 @@
 {
  "db_name": "PostgreSQL",
-  "query": "INSERT INTO global_settings (name, value) VALUES ($1, $2)\n         ON CONFLICT (name) DO UPDATE SET value = $2, updated_at = now()",
+  "query": "UPDATE workspace_settings SET auto_invite = $1 WHERE workspace_id = $2",
  "describe": {
    "columns": [],
    "parameters": {
      "Left": [
-        "Varchar",
-        "Jsonb"
+        "Jsonb",
+        "Text"
      ]
    },
    "nullable": []
  },
-  "hash": "975e404ac3a6258bb8220e122e3de094c7ab23330fdbc74d6e4ad472ddd3c820"
+  "hash": "255ba68caa78d0e814ea817693a319f769907025f9c7d1150d45e8ecb1bff4ab"
 }
@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE cloud_trial_offer SET consumed_at = now() WHERE email = $1 AND consumed_at IS NULL",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "25f27dba5c0ea81d9412bdf1986c2a38b2dcf3976fbd67522c4644ee9bddc330"
-}
@@ -1,73 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "WITH slots AS (\n            SELECT id, slot, min(t) AS first, max(t) AS last, max(v) AS peak,\n                (min(ARRAY[t, v]))[2] AS first_value, (max(ARRAY[t, v]))[2] AS last_value,\n                (max(ARRAY[t, climbing]))[2] = 1 AS last_climbing,\n                COALESCE(bool_and(climbing = 1) AND max(since) - min(since) < $4, false) AS ramp,\n                max(ARRAY[t, since]) FILTER (WHERE climbing = 1) AS last_climb\n            FROM (\n                SELECT id, t,\n                    CASE jsonb_typeof(value)\n                        WHEN 'number' THEN value::double precision\n                        WHEN 'object' THEN t - (value->>'since')::double precision\n                    END AS v,\n                    (value->>'since')::double precision AS since,\n                    (jsonb_typeof(value) = 'object')::int::double precision AS climbing,\n                    greatest(floor((t - $1::double precision) / $2::double precision), -1)::int\n                        AS slot\n                FROM (\n                    SELECT id, value, EXTRACT(EPOCH FROM created_at)::double precision AS t\n                    FROM metrics\n                    WHERE id LIKE 'queue_%'\n                        AND created_at > to_timestamp($1::double precision - $3::double precision)\n                ) m\n            ) s\n            WHERE v IS NOT NULL\n            GROUP BY id, slot\n        )\n        SELECT id AS \"id!\", slot AS \"slot!\", first AS \"first!\", last AS \"last!\",\n            greatest(peak, CASE WHEN last_climb[1] < last THEN (\n                SELECT EXTRACT(EPOCH FROM min(n.created_at))::double precision\n                FROM metrics n\n                WHERE n.id = slots.id AND n.id LIKE 'queue_%'\n                    AND n.created_at > to_timestamp(last_climb[1] + 0.001)\n                    AND n.created_at <= to_timestamp(last + 0.001)\n            ) - last_climb[2] END) AS \"peak!\",\n            first_value AS \"first_value!\", last_value AS \"last_value!\",\n            last_climbing AS \"last_climbing!\", ramp AS \"ramp!\"\n        FROM slots\n        ORDER BY id, slot",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id!",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "slot!",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 2,
-        "name": "first!",
-        "type_info": "Float8"
-      },
-      {
-        "ordinal": 3,
-        "name": "last!",
-        "type_info": "Float8"
-      },
-      {
-        "ordinal": 4,
-        "name": "peak!",
-        "type_info": "Float8"
-      },
-      {
-        "ordinal": 5,
-        "name": "first_value!",
-        "type_info": "Float8"
-      },
-      {
-        "ordinal": 6,
-        "name": "last_value!",
-        "type_info": "Float8"
-      },
-      {
-        "ordinal": 7,
-        "name": "last_climbing!",
-        "type_info": "Bool"
-      },
-      {
-        "ordinal": 8,
-        "name": "ramp!",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Float8",
-        "Float8",
-        "Float8",
-        "Float8"
-      ]
-    },
-    "nullable": [
-      false,
-      null,
-      null,
-      null,
-      null,
-      null,
-      null,
-      null,
-      null
-    ]
-  },
-  "hash": "2742245bc03290120a97b21c441cb56825e9fd552a7aeddfb8a372540c19b863"
-}
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE workspace_settings ws\n           SET datatable = (\n               SELECT jsonb_set(ws.datatable, '{datatables}', jsonb_object_agg(\n                   dt.key,\n                   CASE WHEN dt.value->'reference'->>'workspace_id' = $2\n                       THEN jsonb_set(dt.value, '{reference,workspace_id}', to_jsonb($1::text))\n                       ELSE dt.value END\n               ))\n               FROM jsonb_each(ws.datatable->'datatables') dt\n           )\n           WHERE jsonb_typeof(ws.datatable->'datatables') = 'object'\n             AND ws.datatable::text LIKE '%\"reference\"%'",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "297c7a40dfce729d44aa37bc7c65560517bd25e40c0752a00467829191e2eb98"
-}
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE v2_job_completed SET\n                            workflow_as_code_status = jsonb_set(\n                                jsonb_set(\n                                    workflow_as_code_status,\n                                    array[$1],\n                                    COALESCE(workflow_as_code_status->$1, '{}'::jsonb)\n                                ),\n                                array[$1, 'duration_ms'],\n                                to_jsonb($2::bigint)\n                            )\n                        WHERE id = $3 AND workflow_as_code_status IS NOT NULL",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Int8",
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "29935e89475f637d765c516f1aa2be2f0f31fb50d519b42a056d0d73417599a3"
+}
@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE capture_config SET server_id = NULL, last_server_ping = NULL\n             WHERE workspace_id = $1 AND trigger_kind = 'postgres'\n               AND (trigger_config->>'postgres_resource_path' = $2\n                    OR trigger_config->>'postgres_resource_path' LIKE $3)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "2a391cc1bfcd2f75b46144a394c01237e09c3060da88170f1f6e06468309d213"
-}
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO workspace_runnable_dependencies (flow_path, runnable_path, script_hash, runnable_is_flow, runnable_is_agent, workspace_id, app_path)\n         SELECT flow_path, runnable_path, script_hash, runnable_is_flow, runnable_is_agent, $1, app_path\n         FROM workspace_runnable_dependencies\n         WHERE workspace_id = $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "2aa87574b437f0e29991696564c4250441863ab47c345d9685f53c7e224b4887"
-}
@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO usr (workspace_id, username, email, is_admin, created_at, operator, disabled, role, is_service_account, added_via)\n         SELECT $1, username, email, is_admin, created_at, operator, disabled, role, is_service_account,\n                CASE WHEN $3 THEN NULL ELSE added_via END\n         FROM usr WHERE workspace_id = $2\n           AND (NOT $3 OR (NOT operator AND NOT disabled AND NOT is_service_account))\n         ON CONFLICT DO NOTHING",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Text",
-        "Bool"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "2d6b117324eaf076a0ed06d2cb0ce73279957d6a39fdc6b1ecb6e0a1e02f921f"
-}
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO dbt_node (workspace_id, script_path, script_hash, job_id, unique_id,\n            resource_type, name, asset_path, materialized, materialize_strategy, unique_key,\n            tags, description, test_kind, test_column, test_args, severity, attached_node,\n            columns, column_schema, freshness, raw_code, original_file_path, ingested_at)\n         SELECT $2, script_path, script_hash, job_id, unique_id,\n            resource_type, name, asset_path, materialized, materialize_strategy, unique_key,\n            tags, description, test_kind, test_column, test_args, severity, attached_node,\n            columns, column_schema, freshness, raw_code, original_file_path, ingested_at\n         FROM dbt_node\n         WHERE workspace_id = $1 AND job_id = '00000000-0000-0000-0000-000000000000'",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Varchar"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "2e562fb35cfa71702e5fdbc505d2fa6f3114a151b66b0a116b1d98dd84115188"
-}
@@ -1,87 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            UPDATE\n                http_trigger\n            SET\n                route_path = $1,\n                route_path_key = $2,\n                workspaced_route = $3,\n                wrap_body = $4,\n                raw_string = $5,\n                allowed_origins = $6,\n                authentication_resource_path = $7,\n                script_path = $8,\n                path = $9,\n                is_flow = $10,\n                mode = $11,\n                http_method = $12,\n                static_asset_config = $13,\n                edited_by = $14,\n                permissioned_as = $15,\n                request_type = $16,\n                authentication_method = $17,\n                summary = $18,\n                description = $19,\n                edited_at = now(),\n                is_static_website = $20,\n                error_handler_path = $21,\n                error_handler_args = $22,\n                retry = $23\n            WHERE\n                workspace_id = $24 AND\n                path = $25\n            ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar",
-        "Bool",
-        "Bool",
-        "Bool",
-        "TextArray",
-        "Varchar",
-        "Varchar",
-        "Varchar",
-        "Bool",
-        {
-          "Custom": {
-            "name": "trigger_mode",
-            "kind": {
-              "Enum": [
-                "enabled",
-                "disabled",
-                "suspended"
-              ]
-            }
-          }
-        },
-        {
-          "Custom": {
-            "name": "http_method",
-            "kind": {
-              "Enum": [
-                "get",
-                "post",
-                "put",
-                "delete",
-                "patch"
-              ]
-            }
-          }
-        },
-        "Jsonb",
-        "Varchar",
-        "Varchar",
-        {
-          "Custom": {
-            "name": "request_type",
-            "kind": {
-              "Enum": [
-                "sync",
-                "async",
-                "sync_sse"
-              ]
-            }
-          }
-        },
-        {
-          "Custom": {
-            "name": "authentication_method",
-            "kind": {
-              "Enum": [
-                "none",
-                "windmill",
-                "api_key",
-                "basic_http",
-                "custom_script",
-                "signature"
-              ]
-            }
-          }
-        },
-        "Varchar",
-        "Text",
-        "Bool",
-        "Varchar",
-        "Jsonb",
-        "Jsonb",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "2ead4c5e0fec64dfdc24431d2f4871ca8667a657dfdfc2fa65e9ff1a3c0d2908"
-}
@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT add_admins_and_developers_to_forks FROM workspace_settings WHERE workspace_id = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "add_admins_and_developers_to_forks",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "2f39fce0ee700117f3e4c066e0b56ee979e4c392970278304e80368b770bb7b4"
-}
@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE password SET password_hash = $1, login_type = 'password'\n         WHERE email = $2 AND login_type = $3",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "310d91848c7a032846aa8be8c5e5f42477fc5ab17fac70864d1b2f7f91ac7f9d"
-}
@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO dbt_column_edge (workspace_id, script_path, script_hash, job_id,\n                                      parent_unique_id, parent_column, child_unique_id,\n                                      child_column, lineage_kind)\n         VALUES ($1, $2, $3, '00000000-0000-0000-0000-000000000000',\n                 'model.p.stock', 'sku', 'model.p.stock_daily', 'sku', 'copy')",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar",
-        "Int8"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "3162283a5066660e2f31575344083bf1585004f9fddee904ab176ac85ba3c094"
-}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT u.username, u.email FROM workspace w JOIN usr u ON u.workspace_id = w.id AND u.email = w.owner WHERE w.id = $1 AND NOT u.disabled",
+  "query": "SELECT username, email FROM usr WHERE workspace_id = $1 AND is_admin = true AND operator = false AND disabled = false ORDER BY username LIMIT 1",
  "describe": {
    "columns": [
      {
@@ -24,5 +24,5 @@
      false
    ]
  },
-  "hash": "1b5f6620d35dd74b32ce6325891be02fe144a2da1ebf446b0df92944da791fa7"
+  "hash": "3202bed875693ae923f496272cd8ad89b2f17a9d3ef4659c2d2284415177b32c"
 }
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE draft SET value = to_json(jsonb_set(to_jsonb(value), ARRAY['policy', 'on_behalf_of'], to_jsonb($1::text))) WHERE typ IN ('app', 'raw_app') AND value->'policy'->>'on_behalf_of' = $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "32b4d1fe69fd219a5931fdd63cb2b0cb7770950e5c7fa6128bc9d2b2abcc7f2f"
-}
@@ -1,28 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT parent_job, flow_step_id FROM v2_job WHERE id = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "parent_job",
-        "type_info": "Uuid"
-      },
-      {
-        "ordinal": 1,
-        "name": "flow_step_id",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid"
-      ]
-    },
-    "nullable": [
-      true,
-      true
-    ]
-  },
-  "hash": "32ca7941db013dacd2479962fa9ed5c8c64daec45ba820a6c8f7d7ab76cc40c9"
-}
@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = $1)",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "exists",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Name"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "334dbcd48fb59c96c62c2705ab2d1ce716cd52417f487cc1a8dd376017b2db7d"
-}
@@ -1,20 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT path FROM asset WHERE workspace_id = 'test-workspace' AND kind = 'dbt' AND usage_path = 'u/test-user/ingest' AND usage_access_type = 'w'",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "path",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "33aa15957f56281947963cd696f7f518433741305d891d99059184eaf39fa2db"
-}
@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT r->>'script_path' as \"script_path\"\n           FROM workspace_settings ws,\n                jsonb_array_elements(\n                    CASE WHEN jsonb_typeof(ws.git_sync->'repositories') = 'array'\n                         THEN ws.git_sync->'repositories' END\n                ) r\n           WHERE ws.workspace_id = $1\n             AND r->>'git_repo_resource_path' IN ($2, '$res:' || $2)\n           LIMIT 1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "script_path",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "35783f52031d7ba14142108480b3599f083dee7415acdbe4410412309dfa2ca1"
-}
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE draft SET value = to_json(jsonb_set(to_jsonb(value), ARRAY['policy', 'on_behalf_of_email'], to_jsonb($1::text))) WHERE typ IN ('app', 'raw_app') AND value->'policy'->>'on_behalf_of_email' = $2 AND (value->'policy'->>'on_behalf_of' IS NULL OR value->'policy'->>'on_behalf_of' NOT LIKE 'g/%')",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "3721bd6524ea48a1068ee8013bcc1aeca1b9fe784336fabb71ce13bdb58839da"
-}
@@ -1,24 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE token SET label = $1\n           WHERE email = $2 AND token_prefix = $3\n             AND (label IS NULL OR (\n                 label <> 'session'\n                 AND label <> 'guest_session'\n                 AND lower(label) NOT LIKE 'ephemeral%'\n                 AND label <> 'debugger-token'\n                 AND label NOT LIKE 'mcp-oauth-%'\n                 AND NOT starts_with(label, 'embed_app:')\n                 AND NOT starts_with(label, 'sdk_app:')\n                 AND NOT starts_with(label, 'impersonation:')\n                 AND NOT starts_with(label, 'cli-login:')\n             ))\n           RETURNING token_prefix",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "token_prefix",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "383c80239525d9c4ee90e2f5cb6e46c8a0983c52ad15db083f84a9e344dc4c99"
-}
@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT path FROM app WHERE id = $1 AND workspace_id = $2",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "path",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Int8",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "391139a04bd48319a5512e7859b63e81438c7483ac892b971fe8a20709555cc1"
-}
@@ -1,18 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO draft_move (workspace_id, typ, old_path, new_path, email)\n         SELECT $1, t::draft_kind, $3, $4, $5 FROM unnest($2::text[]) t",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "TextArray",
-        "Varchar",
-        "Varchar",
-        "Varchar"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "3a015ab279785a15f89c89d8c4d155e85370d4c2b7ed14fbb510919e7624ca1c"
-}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Ruben FiszelandClaude Opus 5	1b95662f49	fix(frontend): keep a draft-only rename consistent with its storage key Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Wy24UHSVRZdDaPWiBay9MG	2026-09-04 02:01:43 +02:00
Ruben FiszelandClaude Opus 5	eb6e12f0d2	fix(frontend): keep autosaving a reopened draft-only item Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Wy24UHSVRZdDaPWiBay9MG	2026-09-04 01:45:06 +02:00
Ruben FiszelandClaude Opus 5	7512783fde	refactor(frontend): let the draft helper own draft-only items too Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Wy24UHSVRZdDaPWiBay9MG	2026-09-04 01:25:21 +02:00
Ruben FiszelandClaude Opus 5	33063fbf25	fix(frontend): validate and settle draft keys around close and save Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Wy24UHSVRZdDaPWiBay9MG	2026-09-04 00:59:21 +02:00
Ruben FiszelandClaude Opus 5	ed1ccc05b9	fix(frontend): settle new-item drafts before the drawer closes Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Wy24UHSVRZdDaPWiBay9MG	2026-09-04 00:53:52 +02:00
Ruben FiszelandClaude Fable 5.1	81a0773edf	feat(frontend): autosave drafts for new resources and variables Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Wy24UHSVRZdDaPWiBay9MG	2026-09-04 00:53:52 +02:00