Merge remote-tracking branch 'origin/datatable-external-instance-4' into datatable-external-instance-ui

Merge commit '2661dadba63efcc0c5db88a7942d66caf34f20b9' into HEAD
# Conflicts: # backend/ee-repo-ref.txt
2026-09-19 08:02:29 +00:00 · 2026-09-18 01:03:57 +02:00 · 2026-09-18 01:00:23 +02:00 · 2026-09-18 01:00:09 +02:00 · 2026-09-18 01:00:06 +02:00 · 2026-09-18 00:58:35 +02:00
353 changed files with 16541 additions and 14974 deletions
@@ -1,3 +1,3 @@
 {
-  ".": "1.815.0"
+  ".": "1.813.0"
 }
@@ -1,65 +1,5 @@
 # Changelog

-## [1.815.0](https://github.com/windmill-labs/windmill/compare/v1.814.0...v1.815.0) (2026-09-18)
-
-
-### Features
-
-* add a workspace toggle that adds its admins and developers to new forks ([#11215](https://github.com/windmill-labs/windmill/issues/11215)) ([9d335de](https://github.com/windmill-labs/windmill/commit/9d335de87a4dbaa51038d55afe8d980761dcdfaf))
-* add an instance setting to refuse a token in MCP URLs ([#11162](https://github.com/windmill-labs/windmill/issues/11162)) ([37e493a](https://github.com/windmill-labs/windmill/commit/37e493ae66ed5c000ecac492d60fc0fdf4bda71f))
-* **ai-chat:** render get_run through the run tools' card ([#11204](https://github.com/windmill-labs/windmill/issues/11204)) ([6f9c4dc](https://github.com/windmill-labs/windmill/commit/6f9c4dc29455d13b0e64af05c2d6aa8bd5ff4fd6))
-* **ai-chat:** tell the chat which kind of app it is looking at ([#11208](https://github.com/windmill-labs/windmill/issues/11208)) ([c8c06d8](https://github.com/windmill-labs/windmill/commit/c8c06d8f79774abf109192e71a8b6fc37c7937ba))
-* attach files to a flow chat message ([#11185](https://github.com/windmill-labs/windmill/issues/11185)) ([c4c9677](https://github.com/windmill-labs/windmill/commit/c4c9677982b75c63d98ebf85b1904e0c341ba957))
-* **auth:** 2 h login links and a click-to-sign-in page for emailed ones ([#11203](https://github.com/windmill-labs/windmill/issues/11203)) ([5639187](https://github.com/windmill-labs/windmill/commit/5639187fec6d517a72e82df49d63d7438301127c))
-* cap user token expiration with an instance setting ([#11159](https://github.com/windmill-labs/windmill/issues/11159)) ([9320312](https://github.com/windmill-labs/windmill/commit/9320312eac56f944c4d31504601293ab4e816ccc))
-* flow chat job-backed detail, smooth streaming and answer chrome ([#11186](https://github.com/windmill-labs/windmill/issues/11186)) ([e2a91ca](https://github.com/windmill-labs/windmill/commit/e2a91ca2b141a0bee64ddfafe3cbf3ff86b6fb35))
-* put a data table's connection under Postgres roles ([#11020](https://github.com/windmill-labs/windmill/issues/11020)) ([0e807fb](https://github.com/windmill-labs/windmill/commit/0e807fb1dd80d7536ec144cd49445abc7961e504))
-* render an AI agent result as its answer, not as raw JSON ([#11051](https://github.com/windmill-labs/windmill/issues/11051)) ([a089928](https://github.com/windmill-labs/windmill/commit/a08992834d45d0211336f4fc32c3421646ca47c5))
-* support $flow_expr[...] dynamic tags on flow steps ([#11170](https://github.com/windmill-labs/windmill/issues/11170)) ([48f0025](https://github.com/windmill-labs/windmill/commit/48f00259c5e7361d3553dbcb809461e1cde96f8f))
-
-
-### Bug Fixes
-
-* **frontend:** inline only the package version, not the whole package.json ([#11191](https://github.com/windmill-labs/windmill/issues/11191)) ([813e486](https://github.com/windmill-labs/windmill/commit/813e486e166ac6215364817a7732b66f8dc1d463))
-* keep instance groups when editing auto-invite ([#11217](https://github.com/windmill-labs/windmill/issues/11217)) ([df61dea](https://github.com/windmill-labs/windmill/commit/df61dea5fa8b18d1e0044dc0db6702b053d5119f))
-* key the large root font size on screen width, not window width ([#11216](https://github.com/windmill-labs/windmill/issues/11216)) ([3b4e13d](https://github.com/windmill-labs/windmill/commit/3b4e13d1c564c6195e30b55b0671f7533e3ce408))
-* re-encrypt git sync secrets on workspace key rotation ([#11218](https://github.com/windmill-labs/windmill/issues/11218)) ([f0d66a4](https://github.com/windmill-labs/windmill/commit/f0d66a42eba27502767423af0c08b2ca1f16e8df))
-* re-point cloned fork identities that name nobody in the fork ([#11161](https://github.com/windmill-labs/windmill/issues/11161)) ([9690c44](https://github.com/windmill-labs/windmill/commit/9690c4462cf264a5577b87d07d465b5442b4e09d))
-* register the job token with the sensitive log masking system ([#10943](https://github.com/windmill-labs/windmill/issues/10943)) ([53afecd](https://github.com/windmill-labs/windmill/commit/53afecd4588247bc1812d3e68a30db1f3c3b2724))
-* show the New menu's description panel only on hover ([#11199](https://github.com/windmill-labs/windmill/issues/11199)) ([ecd0a6c](https://github.com/windmill-labs/windmill/commit/ecd0a6c77bc3a057b8072dbb0aca731e8bd3d882))
-* stop picker listing a draft twice when drafts share a friendly path ([#11214](https://github.com/windmill-labs/windmill/issues/11214)) ([72507d5](https://github.com/windmill-labs/windmill/commit/72507d52a021de8101794ee8f4a3392be1ba20c7))
-
-
-### Performance Improvements
-
-* count completed jobs on the v2_job_completed index with a timeout ([#11211](https://github.com/windmill-labs/windmill/issues/11211)) ([d1a2536](https://github.com/windmill-labs/windmill/commit/d1a25360b070994a31fb033707dbfde1fb553939))
-
-## [1.814.0](https://github.com/windmill-labs/windmill/compare/v1.813.0...v1.814.0) (2026-09-17)
-
-
-### Features
-
-* **ai-chat:** add list_workers and list_data_metrics global tools ([#11143](https://github.com/windmill-labs/windmill/issues/11143)) ([e954d33](https://github.com/windmill-labs/windmill/commit/e954d33613e4ff5027667eb8f646615d9bbd499d))
-* **ai-chat:** merge get_job_logs and get_flow_run_details into get_run ([#11172](https://github.com/windmill-labs/windmill/issues/11172)) ([5bb37ca](https://github.com/windmill-labs/windmill/commit/5bb37ca3388666fba72c55534e37f37bb3e9299e))
-* allow git sync auto-pull, promotion and PRs on Pro licenses ([#11173](https://github.com/windmill-labs/windmill/issues/11173)) ([02e47de](https://github.com/windmill-labs/windmill/commit/02e47de8b4c4f3f54753aabf8c67bc8e71ffb957))
-* badge chat-input flows on the home list ([#11164](https://github.com/windmill-labs/windmill/issues/11164)) ([3d08197](https://github.com/windmill-labs/windmill/commit/3d0819718221f885b61e73d02b43dcc853c7d02a))
-* collect flow conversations and agent memory once their last message goes ([#11178](https://github.com/windmill-labs/windmill/issues/11178)) ([23c24a9](https://github.com/windmill-labs/windmill/commit/23c24a9688d4c8c462f53221334d538280f16bca))
-* flow chat model picker on a shared model-settings component ([#11187](https://github.com/windmill-labs/windmill/issues/11187)) ([189793c](https://github.com/windmill-labs/windmill/commit/189793c2e4db7f1c853695ebcc895c1ec82ed19f))
-* keep flow inputs and seed the agent when chat mode is enabled ([#11177](https://github.com/windmill-labs/windmill/issues/11177)) ([68f2248](https://github.com/windmill-labs/windmill/commit/68f2248018fc218a090bf939e1eb22ff97d5bc22))
-* let plan mode search and read connected mcp servers ([#11205](https://github.com/windmill-labs/windmill/issues/11205)) ([5371519](https://github.com/windmill-labs/windmill/commit/5371519f0f5ce7750982dcdb374dca72115902e7))
-* let test_run_flow name the conversation of a chat-mode test run ([#11198](https://github.com/windmill-labs/windmill/issues/11198)) ([6e1ef93](https://github.com/windmill-labs/windmill/commit/6e1ef93f329cb396ffc3df3304d592e8fa0e0e71))
-* managed memory with an inherited or custom memory id per step ([#11118](https://github.com/windmill-labs/windmill/issues/11118)) ([c297ed0](https://github.com/windmill-labs/windmill/commit/c297ed0052d998fb8f063faa2a36c6eb03e327be))
-* render the flow chat through the shared session chat components ([#11175](https://github.com/windmill-labs/windmill/issues/11175)) ([a9ec0ae](https://github.com/windmill-labs/windmill/commit/a9ec0aec3ac0c6b0f7919d0eb2168816923826d7))
-* show flow step detail inside the graph tab on narrow detail layouts ([#11168](https://github.com/windmill-labs/windmill/issues/11168)) ([64dffe6](https://github.com/windmill-labs/windmill/commit/64dffe6106ad6a55b61a423c855a4b5b0cef533e))
-* store mcp tool call, result and reasoning on flow conversation rows ([#11176](https://github.com/windmill-labs/windmill/issues/11176)) ([a571117](https://github.com/windmill-labs/windmill/commit/a571117f3fd2cef14c920770645c60ee358fdfdd))
-* tell test flow conversations from deployed ones and rename a chat ([#11179](https://github.com/windmill-labs/windmill/issues/11179)) ([4eab995](https://github.com/windmill-labs/windmill/commit/4eab995cf7cf091a5e4640da4cb77e0921bb7fdf))
-
-
-### Bug Fixes
-
-* disable a schedule whose cron has no run left instead of panicking ([#11195](https://github.com/windmill-labs/windmill/issues/11195)) ([381d447](https://github.com/windmill-labs/windmill/commit/381d4470ef699ea82283742132e56556b95d2bd2))
-* skip expiry notifications for app embed and SDK tokens ([#11169](https://github.com/windmill-labs/windmill/issues/11169)) ([9d348f8](https://github.com/windmill-labs/windmill/commit/9d348f84c7830f36b6153472556fd70e3d84cd24))
-
 ## [1.813.0](https://github.com/windmill-labs/windmill/compare/v1.812.0...v1.813.0) (2026-09-16)


@@ -175,10 +175,6 @@ the decrypted value, exactly as against a real backend. The chat's read path pas
 Seed a recognizable secret (the existing fixture uses `sk_live_do_not_leak_me`) and
 assert it via `valueExcludes` to catch a leak.

-`toolExpect.toolCallArgs` entries support `sharedByAtLeast: <n>`: at least `n` recorded
-calls to that tool must carry the same non-blank string in the field. Use it for calls that
-have to share an identifier, like two test runs of one chat conversation.
-
 `toolExpect.toolCallArgs` entries additionally support `fieldMustBeAbsent: true`: no
 recorded call to that tool may pass the field at all (an explicit `null` counts as
 passing it). Use it for partial-update tools, where supplying a field the model could
@@ -1,5 +1,5 @@
+import { randomUUID } from 'node:crypto'
 import type { BackendValidationSettings } from '../../core/backendValidation'
-import { buildWorkspaceId } from './workspaceId'

 interface CompletedJobResultMaybe {
 	completed: boolean
@@ -24,6 +24,7 @@ export interface CompletedPreviewJob {
 const tokenCache = new Map<string, Promise<string>>()
 const sharedWorkspaceQueue = new Map<string, Promise<void>>()
 const managedSharedWorkspacePrefixes = ['f/evals/']
+const DEFAULT_WORKSPACE_PREFIX = 'ai-evals'

 export class BackendPreviewClient {
 	constructor(private readonly settings: BackendValidationSettings) {}
@@ -440,6 +441,16 @@ async function withSharedWorkspaceLock<T>(workspaceId: string, body: () => Promi
 	}
 }

+function buildWorkspaceId(caseId: string, attempt: number): string {
+	const caseSlug = caseId
+		.toLowerCase()
+		.replace(/[^a-z0-9-]+/g, '-')
+		.replace(/^-+|-+$/g, '')
+		.slice(0, 30)
+	const suffix = randomUUID().slice(0, 8)
+	return `${DEFAULT_WORKSPACE_PREFIX}-${caseSlug || 'case'}-a${attempt}-${suffix}`
+}
+
 function extractFolderName(path: string): string | null {
 	if (!path.startsWith('f/')) {
 		return null
@@ -11,7 +11,6 @@ import type {
 	Script
 } from '../../../frontend/src/lib/gen'
 import type {
-	DataMetric,
 	DataTableTables,
 	DataTableTableSchema,
 	EndpointTool,
@@ -49,16 +48,12 @@ export interface BenchmarkWorkspaceFlow {
 export interface BenchmarkWorkspaceApp {
 	path: string
 	summary: string
-	/** Defaults to true. Set false for a drag-and-drop app, which the chat can list
-	 * and read but has no tool to edit — its value is a grid, not files. */
-	rawApp?: boolean
 	value: {
-		files?: Record<string, string>
-		runnables?: Record<string, unknown>
+		files: Record<string, string>
+		runnables: Record<string, unknown>
 		data?: unknown
 		policy?: unknown
 		custom_path?: unknown
-		[key: string]: unknown
 	}
 }

@@ -117,9 +112,6 @@ export interface BenchmarkWorkspaceRunnables {
 	aiProviders?: BenchmarkWorkspaceAiProvider[]
 	resources?: BenchmarkWorkspaceResource[]
 	datatables?: BenchmarkDatatableSeed[]
-	/** DuckLake catalog names, as `list_ducklakes` reports them. */
-	ducklakes?: string[]
-	dataMetrics?: DataMetric[]
 	jobs?: BenchmarkWorkspaceJob[]
 }

@@ -681,27 +673,6 @@ export function listBenchmarkDatatables(workspace: string): DataTableTables[] |
 	}))
 }

-// ============= DuckLake catalogs and declared metrics =============
-
-/** Seeded DuckLake names, or `null` for a non-benchmark workspace. */
-export function listBenchmarkDucklakes(workspace: string): string[] | null {
-	const runnables = benchmarkWorkspaceRunnables.get(workspace)
-	return runnables ? (runnables.ducklakes ?? []) : null
-}
-
-/**
- * Seeded metric declarations, or `null` for a non-benchmark workspace.
- *
- * The `table` / `path_prefix` filters are ignored: which rows a filter selects is
- * `canonical_table_path`'s business and is pinned by `ducklakeTools.test.ts`.
- * Re-deriving it here would give the eval its own copy of that spec to drift from,
- * and the case this serves measures whether the model reaches for the tool at all.
- */
-export function listBenchmarkDataMetrics(workspace: string): DataMetric[] | null {
-	const runnables = benchmarkWorkspaceRunnables.get(workspace)
-	return runnables ? (runnables.dataMetrics ?? []) : null
-}
-
 export function getBenchmarkDatatableSchema(input: {
 	workspace: string
 	datatableName: string
@@ -869,29 +840,6 @@ export function runBenchmarkFlowByPath(input: {
 	})
 }

-/**
- * Mirror `JobService.runFlowPreview` for benchmark workspaces, including the server's
- * refusal of a chat-enabled flow run that names no conversation (`memory_id`).
- */
-export function runBenchmarkFlowPreview(input: {
-	workspace: string
-	memoryId?: string
-	requestBody?: { path?: string; value?: { chat_input_enabled?: boolean }; args?: unknown }
-}): string {
-	if (input.requestBody?.value?.chat_input_enabled && !input.memoryId) {
-		throw new Error('Bad request: memory_id is required for chat-enabled flows')
-	}
-	const args = (input.requestBody?.args ?? {}) as Record<string, unknown>
-	return createBenchmarkCompletedJob({
-		workspace: input.workspace,
-		jobKind: 'flowpreview',
-		success: true,
-		args,
-		result: { path: input.requestBody?.path, args, mocked: true },
-		logs: 'Mock benchmark flow preview completed successfully.'
-	})
-}
-
 export function previewBenchmarkSchedule(input: {
 	requestBody?: Record<string, unknown>
 }): Record<string, unknown> {
@@ -998,7 +946,7 @@ function buildBenchmarkListableApp(app: BenchmarkWorkspaceApp): ListableApp {
 		extra_perms: {},
 		edited_at: BENCHMARK_TIMESTAMP,
 		execution_mode: 'viewer',
-		raw_app: app.rawApp ?? true
+		raw_app: true
 	}
 }

@@ -1016,7 +964,7 @@ function buildBenchmarkApp(app: BenchmarkWorkspaceApp): AppWithLastVersion {
 		execution_mode: 'viewer',
 		extra_perms: {},
 		custom_path: app.value.custom_path as string | undefined,
-		raw_app: app.rawApp ?? true
+		raw_app: true
 	}
 }

@@ -76,9 +76,7 @@ vi.mock('$lib/gen', async () => {
 		listBenchmarkPlainResources,
 		listBenchmarkApps,
 		listBenchmarkDatatables,
-		listBenchmarkDataMetrics,
 		listBenchmarkDrafts,
-		listBenchmarkDucklakes,
 		listBenchmarkFlows,
 		listBenchmarkJobs,
 		listBenchmarkScripts,
@@ -89,7 +87,6 @@ vi.mock('$lib/gen', async () => {
 		previewBenchmarkSchedule,
 		runBenchmarkDatatableSql,
 		runBenchmarkFlowByPath,
-		runBenchmarkFlowPreview,
 		runBenchmarkScriptByPath,
 		runBenchmarkScriptPreview,
 		updateBenchmarkDraft,
@@ -296,14 +293,6 @@ vi.mock('$lib/gen', async () => {
 							args: data.requestBody
 						})
 					: actual.JobService.runScriptByPath(data),
-			runFlowPreview: async (data: {
-				workspace: string
-				memoryId?: string
-				requestBody?: { path?: string; value?: { chat_input_enabled?: boolean }; args?: unknown }
-			}) =>
-				hasBenchmarkWorkspace(data.workspace)
-					? runBenchmarkFlowPreview(data)
-					: actual.JobService.runFlowPreview(data as any),
 			runFlowByPath: async (data: {
 				workspace: string
 				path: string
@@ -352,10 +341,6 @@ vi.mock('$lib/gen', async () => {
 				hasBenchmarkWorkspace(data.workspace)
 					? (listBenchmarkDatatables(data.workspace) ?? [])
 					: actual.WorkspaceService.listDataTableTables(data),
-			listDucklakes: async (data: { workspace: string }) =>
-				hasBenchmarkWorkspace(data.workspace)
-					? (listBenchmarkDucklakes(data.workspace) ?? [])
-					: actual.WorkspaceService.listDucklakes(data),
 			getDataTableTableSchema: async (data: {
 				workspace: string
 				datatableName: string
@@ -371,12 +356,6 @@ vi.mock('$lib/gen', async () => {
 						})
 					: actual.WorkspaceService.getDataTableTableSchema(data)
 		}),
-		DataMetricService: wrapService(actual.DataMetricService, {
-			listDataMetrics: async (data: { workspace: string }) =>
-				hasBenchmarkWorkspace(data.workspace)
-					? { metrics: listBenchmarkDataMetrics(data.workspace) ?? [] }
-					: actual.DataMetricService.listDataMetrics(data)
-		}),
 		ScheduleService: wrapService(actual.ScheduleService, {
 			existsSchedule: async (data: { workspace: string; path: string }) =>
 				hasBenchmarkWorkspace(data.workspace) ? false : actual.ScheduleService.existsSchedule(data),
@@ -1,8 +1,9 @@
+import { randomUUID } from "node:crypto";
 import type { WindmillBackendSettings } from "../../core/windmillBackendSettings";
-import { buildWorkspaceId } from "./workspaceId";

 const tokenCache = new Map<string, Promise<string>>();
 const sharedWorkspaceQueue = new Map<string, Promise<void>>();
+const DEFAULT_WORKSPACE_PREFIX = "ai-evals";

 export class WindmillBackendClient {
  constructor(private readonly settings: WindmillBackendSettings) {}
@@ -178,6 +179,16 @@ async function withSharedWorkspaceLock<T>(
  }
 }

+function buildWorkspaceId(caseId: string, attempt: number): string {
+  const caseSlug = caseId
+    .toLowerCase()
+    .replace(/[^a-z0-9-]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, 30);
+  const suffix = randomUUID().slice(0, 8);
+  return `${DEFAULT_WORKSPACE_PREFIX}-${caseSlug || "case"}-a${attempt}-${suffix}`;
+}
+
 async function expectOk(response: Response, context: string): Promise<void> {
  if (response.ok) {
    return;
@@ -1,21 +0,0 @@
-import { describe, expect, it } from "bun:test";
-import { buildWorkspaceId } from "./workspaceId";
-
-describe("buildWorkspaceId", () => {
-  // `workspace.proper_id` rejects `--`, which a case id can carry itself and
-  // which truncating a slug on a hyphen produces once the suffix adds its own.
-  // One id per shape: cut landing on a hyphen, cut landing mid-word, no cut, and
-  // a doubled hyphen no cut ever reaches.
-  it("stays within the id length cap and the proper_id format", () => {
-    for (const caseId of [
-      "global-test6-secret-variable-draft",
-      "global-test23-datatable-query-select",
-      "short",
-      "global--test-foo",
-    ]) {
-      const id = buildWorkspaceId(caseId, 1);
-      expect(id.length).toBeLessThanOrEqual(50);
-      expect(id).toMatch(/^\w+(-\w+)*$/);
-    }
-  });
-});
@@ -1,22 +0,0 @@
-import { randomUUID } from "node:crypto";
-
-const DEFAULT_WORKSPACE_PREFIX = "ai-evals";
-
-// A workspace id must be at most 50 characters AND match `^\w+(-\w+)*$`
-// (`workspace.proper_id`), so the case slug yields to the random suffix that
-// makes the id unique, and no hyphen may end up doubled — neither one already in
-// the case id nor one a truncation leaves for the suffix to follow.
-const MAX_WORKSPACE_ID_LENGTH = 50;
-
-export function buildWorkspaceId(caseId: string, attempt: number): string {
-  const caseSlug = caseId
-    .toLowerCase()
-    .replace(/[^a-z0-9-]+/g, "-")
-    .replace(/-{2,}/g, "-")
-    .replace(/^-+|-+$/g, "");
-  const suffix = `-a${attempt}-${randomUUID().slice(0, 8)}`;
-  const head = `${DEFAULT_WORKSPACE_PREFIX}-${caseSlug || "case"}`;
-  return `${head
-    .slice(0, MAX_WORKSPACE_ID_LENGTH - suffix.length)
-    .replace(/-+$/, "")}${suffix}`;
-}
@@ -1919,11 +1919,10 @@
    - when the lookup fails, tells the user instead of inventing table names
    - does not write scripts or resources to answer a read-only question

-# --- Dedicated tools preferred over the API catalog ---
-# The harness serves worker/queue reads itself (benchmark fetch handlers in
-# adapters/frontend), so these cases do not require an mcp-enabled eval backend.
-# The stale `api-catalog` in the id below is kept so results stay comparable
-# across benchmark runs.
+# --- API catalog (search_api_endpoints / call_api_get / call_api_endpoint) ---
+# The harness serves the catalog and the executed calls itself (mock
+# listMcpTools + benchmark fetch handlers in adapters/frontend), so these cases
+# do not require an mcp-enabled eval backend.

 - id: global-test30-api-catalog-workers
  prompt: |-
@@ -1935,42 +1934,23 @@
    draftCountExactly: 0
  toolExpect:
    requiredToolsUsed:
-      - list_workers
-    forbiddenToolsUsed:
+      - search_api_endpoints
      - call_api_get
+    forbiddenToolsUsed:
      - call_api_endpoint
      - write_script
      - deploy_workspace_item
+    toolCallArgs:
+      - tool: call_api_get
+        field: name
+        stringIncludesAnyOf:
+          - listWorkers
  # Read-only workspace inspection produces no draft; validate via tool use.
  skipJudge: true
  judgeChecklist:
-    - reads worker state through list_workers instead of guessing or fabricating
+    - discovers the workers endpoint through the API catalog instead of guessing or fabricating
    - reports worker status from the returned data

- id: global-test37-ducklake-declared-measure
-  prompt: |-
-    We track orders in the main ducklake. Write me a duckdb script that reports total
-    revenue by month. Keep it as a draft, don't deploy it.
-  initial: ai_evals/fixtures/frontend/global/initial/ducklake_orders_metrics.json
-  runtime:
-    maxTurns: 8
-  validate:
-    draftCountExactly: 1
-  toolExpect:
-    requiredToolsUsed:
-      - list_data_metrics
-    forbiddenToolsUsed:
-      - deploy_workspace_item
-      - delete_workspace_item
-  # The judge runs: the point is not that the tool was called but that the number it
-  # describes is the declared one. `revenue` excludes test rows, so an aggregate that
-  # reproduces it without the filter is plausible, runnable and wrong.
-  judgeChecklist:
-    - totals revenue with the declared sum over the amount column rather than an invented aggregate over a guessed column
-    - excludes test orders from the total, as the declared revenue measure does
-    - groups by month using the declared order_month expression over order_date
-    - does not introduce column names absent from the declarations
-
 - id: global-test31-draft-test-run-not-deployed
  prompt: |-
    Update `f/evals/global/format_greeting` so the provided name is uppercased in the greeting, then run it with name "ada" to check it works.
@@ -2160,32 +2140,6 @@
    - creates an AI draft of f/evals/global/process_invoice applying 8% tax
    - does not deploy or save the draft

- id: global-test38-chat-flow-follow-up-same-conversation
-  prompt: |-
-    I want to check that my support chat flow `f/evals/global/support_chat` remembers what was said.
-    Test it: first send "My name is Ada", then send "What is my name?" as a follow-up in the same chat.
-  initial: ai_evals/fixtures/frontend/global/initial/support_chat_flow.json
-  runtime:
-    maxTurns: 8
-  validate:
-    draftCountExactly: 0
-  toolExpect:
-    requiredToolsUsed:
-      - test_run_flow
-    # A chat flow's memory lives in its conversation, so a follow-up only reaches the first
-    # turn's history when both test runs name the same conversation.
-    toolCallArgs:
-      - tool: test_run_flow
-        field: memory_id
-        sharedByAtLeast: 2
-    forbiddenToolsUsed:
-      - run_flow
-      - deploy_workspace_item
-  # The judge cannot observe runs; what this case guards is the conversation the runs share.
-  skipJudge: true
-  judgeChecklist:
-    - test-runs the chat flow twice, the second message as a follow-up in the first run's conversation
-
 - id: global-undo-created-draft
  prompt: |-
    Create a draft Postgres resource at `u/admin/scratch_db` for host db.example.com port 5432, database `orders`, user `app`, and tell me what fields it ended up with.
@@ -2611,40 +2565,3 @@
  judgeChecklist:
    - runs the existing script rather than rewriting it
    - passes the GitHub resource as the bare string $res:f/evals/global/github_main
-
- id: global-drag-and-drop-app-not-editable
-  prompt: |-
-    Add a refresh button to the ops console app, and the same to the sales board app.
-  initial: ai_evals/fixtures/frontend/global/initial/apps_code_and_drag_and_drop.json
-  runtime:
-    maxTurns: 12
-  validate:
-    # One request, two apps, only one of them editable: the code app must come back with a
-    # draft and the drag-and-drop one must not. Refusing both, or editing both, fails here —
-    # which is what makes this a test of the distinction rather than of caution.
-    draftCountExactly: 1
-    requiredDrafts:
-      - type: app
-        path: f/evals/global/ops_console
-    forbiddenDrafts:
-      - type: app
-        path: f/evals/global/sales_board
-  toolExpect:
-    # Deliberately not constraining write_app_file/patch_app_file by argument: an entry there
-    # fails when its tool was never called, so naming both would fail on whichever the model
-    # did not pick. The draft assertions above cover the same ground, tool-agnostically.
-    forbiddenToolsUsed:
-      - init_app
-      - deploy_workspace_item
-      - delete_app_file
-      - delete_app_runnable
-  assistantExpect:
-    # A refusal leaves no draft for the judge to read, so the explanation is checked here.
-    # Only the app kind: substring tests cannot see paraphrase, and every wording of "I can't
-    # edit it" defeats a fixed list.
-    requiredMentionsAnyOf:
-      - - drag-and-drop
-        - drag and drop
-        - low-code
-        - no-code
-  skipJudge: true
@@ -182,13 +182,6 @@ export interface ToolCallArgumentRule {
   * the point is that the model filled it in at all rather than what it said.
   */
  nonEmpty?: boolean;
-  /**
-   * Existential over calls: at least this many recorded calls to `tool` carry the
-   * same non-blank string in `field`. Use when calls have to share an identifier —
-   * e.g. test runs that continue one conversation — while a retry with a rejected
-   * value in between is still acceptable.
-   */
-  sharedByAtLeast?: number;
  /**
   * Universal over calls: no recorded call to `tool` may pass `field` at all.
   * For partial-update tools, where supplying a field the model could not have
@@ -396,32 +396,6 @@ describe("validateToolExpectations", () => {
    expect(nonEmptyCheck?.details).toContain("blank on 1 of 2");
  });

-  it("requires sharedByAtLeast calls to carry one value, not merely a value each", () => {
-    const run = (ids: (string | undefined)[]) =>
-      validateToolExpectations({
-        run: {
-          success: true,
-          actual: {},
-          assistantMessageCount: 1,
-          toolCallCount: ids.length,
-          toolsUsed: ["test_run_flow"],
-          toolCallDetails: ids.map((memory_id) => ({
-            name: "test_run_flow",
-            arguments: { path: "f/chat", memory_id },
-          })),
-          skillsInvoked: [],
-        },
-        toolExpect: {
-          toolCallArgs: [{ tool: "test_run_flow", field: "memory_id", sharedByAtLeast: 2 }],
-        },
-      }).find((c) => c.name.includes("is shared by at least 2 calls"))?.passed;
-
-    expect(run(["a", "b"])).toBe(false);
-    expect(run(["a"])).toBe(false);
-    expect(run([undefined, undefined])).toBe(false);
-    expect(run(["rejected", "a", "a"])).toBe(true);
-  });
-
  it("passes nonEmpty when every call filled the field", () => {
    const checks = validateToolExpectations({
      run: {
@@ -320,23 +320,6 @@ export function validateToolExpectations(input: {
      );
    }

-    if (rule.sharedByAtLeast !== undefined) {
-      const counts = new Map<string, number>();
-      for (const value of values) {
-        if (typeof value === "string" && value.trim().length > 0) {
-          counts.set(value, (counts.get(value) ?? 0) + 1);
-        }
-      }
-      const mostShared = Math.max(0, ...counts.values());
-      checks.push(
-        check(
-          `${rule.tool}.${rule.field} is shared by at least ${rule.sharedByAtLeast} calls`,
-          mostShared >= rule.sharedByAtLeast,
-          `most calls sharing one value: ${mostShared}; values: ${summarizeToolValues(values)}`
-        )
-      );
-    }
-
    if (rule.fieldMustBeAbsent) {
      // Anything other than `undefined` was supplied — an explicit `null` is the
      // model passing the field, not omitting it.
@@ -1,30 +0,0 @@
-{
-  "user": {
-    "username": "admin",
-    "is_admin": true,
-    "folders": ["evals"],
-    "folders_read": ["evals"]
-  },
-  "workspace": {
-    "apps": [
-      {
-        "path": "f/evals/global/sales_board",
-        "summary": "Sales board",
-        "rawApp": false,
-        "value": {
-          "grid": []
-        }
-      },
-      {
-        "path": "f/evals/global/ops_console",
-        "summary": "Ops console",
-        "value": {
-          "files": {
-            "/App.tsx": "export default function App() {\n\treturn <div>Ops console</div>\n}\n"
-          },
-          "runnables": {}
-        }
-      }
-    ]
-  }
-}
@@ -1,36 +0,0 @@
-{
-  "workspace": {
-    "ducklakes": ["main"],
-    "dataMetrics": [
-      {
-        "script_path": "f/analytics/orders_pipeline",
-        "table_path": "main/main.orders",
-        "kind": "measure",
-        "name": "revenue",
-        "expr": "sum(amount)",
-        "filter": "not is_test"
-      },
-      {
-        "script_path": "f/analytics/orders_pipeline",
-        "table_path": "main/main.orders",
-        "kind": "measure",
-        "name": "order_count",
-        "expr": "count(*)"
-      },
-      {
-        "script_path": "f/analytics/orders_pipeline",
-        "table_path": "main/main.orders",
-        "kind": "dimension",
-        "name": "order_month",
-        "expr": "date_trunc('month', order_date)"
-      },
-      {
-        "script_path": "f/analytics/orders_pipeline",
-        "table_path": "main/main.orders",
-        "kind": "dimension",
-        "name": "region",
-        "expr": "region"
-      }
-    ]
-  }
-}
@@ -1,59 +0,0 @@
-{
-  "workspace": {
-    "flows": [
-      {
-        "path": "f/evals/global/support_chat",
-        "summary": "Support chat",
-        "description": "Answers customer questions in a chat, remembering earlier messages.",
-        "schema": {
-          "$schema": "https://json-schema.org/draft/2020-12/schema",
-          "type": "object",
-          "properties": {
-            "user_message": {
-              "type": "string",
-              "description": "Message from user"
-            }
-          },
-          "required": ["user_message"]
-        },
-        "value": {
-          "chat_input_enabled": true,
-          "modules": [
-            {
-              "id": "assistant",
-              "summary": "Support assistant",
-              "value": {
-                "type": "aiagent",
-                "tools": [],
-                "input_transforms": {
-                  "provider": {
-                    "type": "static",
-                    "value": {
-                      "kind": "anthropic",
-                      "model": "claude-haiku-4-5-20251001",
-                      "resource": "$res:f/evals/ai/anthropic"
-                    }
-                  },
-                  "user_message": {
-                    "type": "javascript",
-                    "expr": "flow_input.user_message"
-                  },
-                  "system_prompt": {
-                    "type": "static",
-                    "value": "You are a friendly support assistant. Keep answers short."
-                  },
-                  "memory": {
-                    "type": "static",
-                    "value": { "kind": "auto", "context_length": 10 }
-                  },
-                  "streaming": { "type": "static", "value": true },
-                  "output_type": { "type": "static", "value": "text" }
-                }
-              }
-            }
-          ]
-        }
-      }
-    ]
-  }
-}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT id, conversation_id, message_type as \"message_type: MessageType\", content, job_id, created_at, created_seq, step_name, success, tool_arguments, tool_result, reasoning, attachments\n             FROM flow_conversation_message\n             WHERE conversation_id = $1\n               AND created_seq > $2\n             ORDER BY created_seq ASC\n             LIMIT $3\n             ",
+  "query": "SELECT id, conversation_id, message_type as \"message_type: MessageType\", content, job_id, created_at, created_seq, step_name, success\n             FROM (\n                SELECT id, conversation_id, message_type, content, job_id, created_at, created_seq, step_name, success\n                FROM flow_conversation_message\n                WHERE conversation_id = $1\n                ORDER BY created_seq DESC\n                LIMIT $2 OFFSET $3\n             ) AS messages\n             ORDER BY created_seq ASC\n             ",
  "describe": {
    "columns": [
      {
@@ -58,26 +58,6 @@
        "ordinal": 8,
        "name": "success",
        "type_info": "Bool"
-      },
-      {
-        "ordinal": 9,
-        "name": "tool_arguments",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 10,
-        "name": "tool_result",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 11,
-        "name": "reasoning",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 12,
-        "name": "attachments",
-        "type_info": "Jsonb"
      }
    ],
    "parameters": {
@@ -96,12 +76,8 @@
      false,
      false,
      true,
-      false,
-      true,
-      true,
-      true,
-      true
+      false
    ]
  },
-  "hash": "d6fa78c43b6c5f8040d7bccb29ad8627be1dac6fbe0097735a52f47c173f51c9"
+  "hash": "1c3473a0f9f6b6148b2c975f9f05bdefedf8a51c4e6ddf0eca367b9cc778d051"
 }
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_settings (workspace_id, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url) SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url FROM workspace_settings WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "1d8ccd32266637d7f7915f92a8483dce0c9986f3847227c2f66daa84d4109d7d"
+}
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE workspace_settings SET auto_invite = $1 WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Jsonb",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "255ba68caa78d0e814ea817693a319f769907025f9c7d1150d45e8ecb1bff4ab"
+}
@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO usr (workspace_id, username, email, is_admin, created_at, operator, disabled, role, is_service_account, added_via)\n         SELECT $1, username, email, is_admin, created_at, operator, disabled, role, is_service_account,\n                CASE WHEN $3 THEN NULL ELSE added_via END\n         FROM usr WHERE workspace_id = $2\n           AND (NOT $3 OR (NOT operator AND NOT disabled AND NOT is_service_account))\n         ON CONFLICT DO NOTHING",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Text",
-        "Bool"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "2d6b117324eaf076a0ed06d2cb0ce73279957d6a39fdc6b1ecb6e0a1e02f921f"
-}
@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT add_admins_and_developers_to_forks FROM workspace_settings WHERE workspace_id = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "add_admins_and_developers_to_forks",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "2f39fce0ee700117f3e4c066e0b56ee979e4c392970278304e80368b770bb7b4"
-}
@@ -1,24 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE flow_conversation SET title = $1, updated_at = updated_at\n         WHERE id = $2 AND workspace_id = $3\n         RETURNING id",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Uuid"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Uuid",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "5b9c9eb64051f291fed4be9bc0b0cc0aef2e7bde732899976eddac36a2da7658"
-}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT id, workspace_id, flow_path, title, created_at, updated_at, created_by, is_test\n         FROM flow_conversation\n         WHERE id = $1 AND workspace_id = $2",
+  "query": "SELECT id, workspace_id, flow_path, title, created_at, updated_at, created_by\n         FROM flow_conversation\n         WHERE id = $1 AND workspace_id = $2\n         FOR UPDATE",
  "describe": {
    "columns": [
      {
@@ -37,11 +37,6 @@
        "ordinal": 6,
        "name": "created_by",
        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 7,
-        "name": "is_test",
-        "type_info": "Bool"
      }
    ],
    "parameters": {
@@ -57,9 +52,8 @@
      true,
      false,
      false,
-      false,
      false
    ]
  },
-  "hash": "48c8522a4fed219c5011f4ba63c81cfe028a8b2a32bd790840cef65c452a8c31"
+  "hash": "6f32c1feed096ff706ae359ad6a3ca33b3f82ca38289dfa4a69aa95041027d57"
 }
@@ -1,38 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT id, name, enabled, pwd FROM datatable_role",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "name",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 2,
-        "name": "enabled",
-        "type_info": "Bool"
-      },
-      {
-        "ordinal": 3,
-        "name": "pwd",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      true
-    ]
-  },
-  "hash": "71ee2cb6661cca1fa4d8874a7f6d368347c59f36fd87df6dc7996152ccb84af0"
-}
@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT EXISTS(SELECT 1 FROM usr WHERE email = $1 AND is_service_account IS true\n            AND ($2::varchar IS NULL OR workspace_id = $2))",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "exists",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Varchar"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "75e6b5cd52d63ac094c90abd1524bc7a919692a96b076b8aaf24d812723531c8"
-}
@@ -1,29 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        SELECT ws.workspace_id AS \"workspace_id!\", dt.key AS \"datatable!\"\n        FROM workspace_settings ws\n        JOIN workspace w ON w.id = ws.workspace_id AND w.deleted = false\n        CROSS JOIN LATERAL jsonb_each(COALESCE(ws.datatable->'datatables', '{}'::jsonb)) dt\n        WHERE ws.workspace_id <> $1\n          AND dt.value->'database'->>'resource_type' = 'instance'\n          AND dt.value->'database'->>'resource_path' = $2\n        ORDER BY ws.workspace_id, dt.key\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "workspace_id!",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "datatable!",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      null
-    ]
-  },
-  "hash": "79799b5a2e499df6c28e286c42b9ad2db940c2455ab19cc95e5198baf96d5629"
-}
@@ -1,17 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO datatable_role (id, name, enabled, pwd) VALUES ($1, $2, $3, $4)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar",
-        "Bool",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "86af9d51a158ea5cb6161461ecddf2a63695f8cbf8af648da5a0a77a5b9d02ba"
-}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT workspace.id, workspace.name, usr.username, workspace_settings.color, workspace.parent_workspace_id,\n                workspace.is_dev_workspace, workspace.dev_workspace_label,\n                workspace.owner AS \"created_by?\",\n                CASE WHEN usr.operator THEN workspace_settings.operator_settings ELSE NULL END as operator_settings,\n                usr.disabled, usr.is_service_account\n         FROM workspace\n         JOIN usr ON usr.workspace_id = workspace.id\n         JOIN workspace_settings ON workspace_settings.workspace_id = workspace.id\n         WHERE usr.email = $1 AND workspace.deleted = false",
+  "query": "SELECT workspace.id, workspace.name, usr.username, workspace_settings.color, workspace.parent_workspace_id,\n                workspace.is_dev_workspace, workspace.dev_workspace_label,\n                workspace.owner AS \"created_by?\",\n                CASE WHEN usr.operator THEN workspace_settings.operator_settings ELSE NULL END as operator_settings,\n                usr.disabled\n         FROM workspace\n         JOIN usr ON usr.workspace_id = workspace.id\n         JOIN workspace_settings ON workspace_settings.workspace_id = workspace.id\n         WHERE usr.email = $1 AND workspace.deleted = false",
  "describe": {
    "columns": [
      {
@@ -52,11 +52,6 @@
        "ordinal": 9,
        "name": "disabled",
        "type_info": "Bool"
-      },
-      {
-        "ordinal": 10,
-        "name": "is_service_account",
-        "type_info": "Bool"
      }
    ],
    "parameters": {
@@ -74,9 +69,8 @@
      true,
      false,
      null,
-      false,
      false
    ]
  },
-  "hash": "7b33adb5cf051bc123340982b97a80a96ee43e1c91d9907d50cc2ee14111623e"
+  "hash": "88a134e4ca82d5ce0334977c7713021ae3e99a5a61ea1c944c1df1368746dfa5"
 }
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "DELETE FROM token_expiry_notification n\n         USING token t\n         WHERE n.token_hash = t.token_hash\n           AND n.expiration > now()\n           AND n.expiration <= now() + make_interval(days => $1)\n         RETURNING t.token_prefix, t.label, t.email, t.workspace_id",
+  "query": "DELETE FROM token_expiry_notification n\n         USING token t\n         WHERE n.token_hash = t.token_hash\n           AND n.expiration > now()\n           AND n.expiration <= now() + interval '7 days'\n         RETURNING t.token_prefix, t.label, t.email, t.workspace_id",
  "describe": {
    "columns": [
      {
@@ -25,9 +25,7 @@
      }
    ],
    "parameters": {
-      "Left": [
-        "Int4"
-      ]
+      "Left": []
    },
    "nullable": [
      false,
@@ -36,5 +34,5 @@
      true
    ]
  },
-  "hash": "6c57c46c5a0462f379ed6a22ae97e363009177fdc45d795447a920f455f193cc"
+  "hash": "94fd0a57cfc9341b2e9deae60506c6c06aa6934b87200da14231f12f65149cd3"
 }
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE workspace_settings SET add_admins_and_developers_to_forks = $1 WHERE workspace_id = $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Bool",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "9bd1995747f0073b3a866d1238e78f7e6dfa9185056f7731547ff05b8176b271"
-}
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE workspace_settings SET auto_invite = (COALESCE(auto_invite, '{}'::jsonb) - 'domain') || $1::jsonb WHERE workspace_id = $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Jsonb",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "a1bcf143135ecb9f32709a56a353d3246dc238920c3e155caa9cf767246fa6fb"
-}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "\n        UPDATE workspace_settings\n        SET\n            ai_config = source_ws.ai_config,\n            large_file_storage = source_ws.large_file_storage,\n            ducklake = source_ws.ducklake,\n            dbt_warehouses = source_ws.dbt_warehouses,\n            datatable = source_ws.datatable,\n            git_app_installations = source_ws.git_app_installations,\n            add_admins_and_developers_to_forks = source_ws.add_admins_and_developers_to_forks\n        FROM workspace_settings source_ws\n        WHERE source_ws.workspace_id = $1\n        AND workspace_settings.workspace_id = $2\n        ",
+  "query": "\n        UPDATE workspace_settings\n        SET\n            ai_config = source_ws.ai_config,\n            large_file_storage = source_ws.large_file_storage,\n            ducklake = source_ws.ducklake,\n            dbt_warehouses = source_ws.dbt_warehouses,\n            datatable = source_ws.datatable,\n            git_app_installations = source_ws.git_app_installations\n        FROM workspace_settings source_ws\n        WHERE source_ws.workspace_id = $1\n        AND workspace_settings.workspace_id = $2\n        ",
  "describe": {
    "columns": [],
    "parameters": {
@@ -11,5 +11,5 @@
    },
    "nullable": []
  },
-  "hash": "5ccfbd0f345b9b86ca356008def6cc1011a49fc8d8ad046ac572e81cf8938995"
+  "hash": "a6decdebcd9750691f20f874b66a9c6f2ede08c33605c6a3c3dfc213a3eda76a"
 }
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "INSERT INTO flow_conversation_message (conversation_id, message_type, content, job_id, step_name, success, tool_arguments, tool_result, reasoning, attachments)\n         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)",
+  "query": "INSERT INTO flow_conversation_message (conversation_id, message_type, content, job_id, step_name, success)\n         VALUES ($1, $2, $3, $4, $5, $6)",
  "describe": {
    "columns": [],
    "parameters": {
@@ -21,14 +21,10 @@
        "Text",
        "Uuid",
        "Varchar",
-        "Bool",
-        "Text",
-        "Text",
-        "Text",
-        "Jsonb"
+        "Bool"
      ]
    },
    "nullable": []
  },
-  "hash": "12329c3359a7944ab5fa3aa27ddca1b26f340ccf574b9fa07641fe88b2d2987c"
+  "hash": "b1a9a433e577133869c067b2ce383fc6ce4e9df307feb5fd3edc0d1276d61ff1"
 }
@@ -1,20 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT jsonb_object_keys(value->'databases') FROM global_settings\n         WHERE name = 'custom_instance_pg_databases'",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "jsonb_object_keys",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "b9842d2d8abf382bd82d8fa1de012373638be391f884f81dc387ffc465badac6"
-}
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO usr (workspace_id, username, email, is_admin, created_at, operator, disabled, role, is_service_account, added_via)\n         SELECT $1, username, email, is_admin, created_at, operator, disabled, role, is_service_account, added_via\n         FROM usr WHERE workspace_id = $2\n         ON CONFLICT DO NOTHING",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "b98844926ff127c528ed3e7bc63bf1ebed0192be267983e8fbd18f79997e6142"
+}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "INSERT INTO flow_conversation (id, workspace_id, flow_path, created_by, title, is_test)\n         VALUES ($1, $2, $3, $4, $5, $6)\n         ON CONFLICT (id) DO NOTHING\n         RETURNING id, workspace_id, flow_path, title, created_at, updated_at, created_by, is_test",
+  "query": "INSERT INTO flow_conversation (id, workspace_id, flow_path, created_by, title)\n         VALUES ($1, $2, $3, $4, $5)\n         ON CONFLICT (id) DO NOTHING\n         RETURNING id, workspace_id, flow_path, title, created_at, updated_at, created_by",
  "describe": {
    "columns": [
      {
@@ -37,11 +37,6 @@
        "ordinal": 6,
        "name": "created_by",
        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 7,
-        "name": "is_test",
-        "type_info": "Bool"
      }
    ],
    "parameters": {
@@ -50,8 +45,7 @@
        "Varchar",
        "Varchar",
        "Varchar",
-        "Varchar",
-        "Bool"
+        "Varchar"
      ]
    },
    "nullable": [
@@ -61,9 +55,8 @@
      true,
      false,
      false,
-      false,
      false
    ]
  },
-  "hash": "6d259b8cce5da5fecefe4ce322789b6b2cc43b51f2056c677d58f39c31fb26cb"
+  "hash": "c1e3ed3ecc3bcb98f60ba8196d33fee4a74f61b061e5025ecb75882208b3ba8f"
 }
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT id, workspace_id, flow_path, title, created_at, updated_at, created_by, is_test\n         FROM flow_conversation\n         WHERE id = $1 AND workspace_id = $2\n         FOR UPDATE",
+  "query": "SELECT id, workspace_id, flow_path, title, created_at, updated_at, created_by\n         FROM flow_conversation\n         WHERE id = $1 AND workspace_id = $2",
  "describe": {
    "columns": [
      {
@@ -37,11 +37,6 @@
        "ordinal": 6,
        "name": "created_by",
        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 7,
-        "name": "is_test",
-        "type_info": "Bool"
      }
    ],
    "parameters": {
@@ -57,9 +52,8 @@
      true,
      false,
      false,
-      false,
      false
    ]
  },
-  "hash": "dd84f9dfb238d18cb74f9e43228345427131bf8008eba6920021d6a449791534"
+  "hash": "c383cc023714b361d10c10e8fef1fc148ab1da942951ee9ffdddaecee76a6be9"
 }
@@ -1,24 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT dt.key AS \"datatable!\"\n           FROM workspace_settings ws\n           CROSS JOIN LATERAL jsonb_each(COALESCE(ws.datatable->'datatables', '{}'::jsonb)) dt\n           WHERE ws.workspace_id = $1\n             AND dt.key <> $2\n             AND NOT dt.value ? 'permissions'\n             AND dt.value->'database'->>'resource_type' = 'instance'\n             AND dt.value->'database'->>'resource_path' = $3\n           ORDER BY dt.key",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "datatable!",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "d48ca62c86b1af7a9dd2450c1c28dc45020a2a553d8874c49f9eafedea5a9d40"
-}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "UPDATE token SET label = $1\n           WHERE email = $2 AND token_prefix = $3\n             AND (label IS NULL OR (\n                 label <> 'session'\n                 AND label <> 'guest_session'\n                 AND lower(label) NOT LIKE 'ephemeral%'\n                 AND label <> 'debugger-token'\n                 AND label NOT LIKE 'mcp-oauth-%'\n                 AND NOT starts_with(label, 'embed_app:')\n                 AND NOT starts_with(label, 'sdk_app:')\n                 AND NOT starts_with(label, 'impersonation:')\n                 AND NOT starts_with(label, 'cli-login:')\n             ))\n           RETURNING token_prefix",
+  "query": "UPDATE token SET label = $1\n           WHERE email = $2 AND token_prefix = $3\n             AND (label IS NULL OR (\n                 label <> 'session'\n                 AND label <> 'guest_session'\n                 AND lower(label) NOT LIKE 'ephemeral%'\n                 AND label <> 'debugger-token'\n                 AND label NOT LIKE 'mcp-oauth-%'\n                 AND NOT starts_with(label, 'embed_app:')\n                 AND NOT starts_with(label, 'sdk_app:')\n                 AND NOT starts_with(label, 'impersonation:')\n             ))\n           RETURNING token_prefix",
  "describe": {
    "columns": [
      {
@@ -20,5 +20,5 @@
      false
    ]
  },
-  "hash": "383c80239525d9c4ee90e2f5cb6e46c8a0983c52ad15db083f84a9e344dc4c99"
+  "hash": "d631a26e5531589ff37e677f91a4f1d9f850e3e46c17130dd580426cda7a9f65"
 }
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "\n        SELECT\n            workspace_id,\n            slack_team_id,\n            teams_team_id,\n            teams_team_name,\n            teams_team_guid,\n            slack_name,\n            slack_command_script,\n            teams_command_script,\n            slack_email,\n            slack_oauth_client_id,\n            slack_oauth_client_secret,\n            customer_id,\n            plan,\n            webhook,\n            ai_config,\n            dbt_warehouses,\n            large_file_storage,\n            datatable,\n            ducklake,\n            git_sync,\n            deploy_ui,\n            default_app,\n            default_scripts,\n            mute_critical_alerts,\n            color,\n            operator_settings,\n            git_app_installations,\n            auto_invite,\n            error_handler,\n            success_handler,\n            public_app_execution_limit_per_minute,\n            error_handler_fallback_to_instance_alerts,\n            guest_access_enabled,\n            guest_jwt_public_key,\n            guest_jwt_jwks_url,\n            add_admins_and_developers_to_forks\n        FROM\n            workspace_settings\n        WHERE\n            workspace_id = $1\n        ",
+  "query": "\n        SELECT\n            workspace_id,\n            slack_team_id,\n            teams_team_id,\n            teams_team_name,\n            teams_team_guid,\n            slack_name,\n            slack_command_script,\n            teams_command_script,\n            slack_email,\n            slack_oauth_client_id,\n            slack_oauth_client_secret,\n            customer_id,\n            plan,\n            webhook,\n            ai_config,\n            dbt_warehouses,\n            large_file_storage,\n            datatable,\n            ducklake,\n            git_sync,\n            deploy_ui,\n            default_app,\n            default_scripts,\n            mute_critical_alerts,\n            color,\n            operator_settings,\n            git_app_installations,\n            auto_invite,\n            error_handler,\n            success_handler,\n            public_app_execution_limit_per_minute,\n            error_handler_fallback_to_instance_alerts,\n            guest_access_enabled,\n            guest_jwt_public_key,\n            guest_jwt_jwks_url\n        FROM\n            workspace_settings\n        WHERE\n            workspace_id = $1\n        ",
  "describe": {
    "columns": [
      {
@@ -177,11 +177,6 @@
        "ordinal": 34,
        "name": "guest_jwt_jwks_url",
        "type_info": "Text"
-      },
-      {
-        "ordinal": 35,
-        "name": "add_admins_and_developers_to_forks",
-        "type_info": "Bool"
      }
    ],
    "parameters": {
@@ -224,9 +219,8 @@
      false,
      false,
      true,
-      true,
-      false
+      true
    ]
  },
-  "hash": "8ebe054b41793f1a7b85f1f8d29cd21d12fa1207b58bfc46249c250cdcdb5363"
+  "hash": "dc4a57df3becc610f631ef22c116450390addbfae85fecc61c991d94167e6e99"
 }
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "\n        SELECT\n            j.args as \"args: Json<HashMap<String, Box<RawValue>>>\",\n            js.flow_status as \"flow_status: Json<windmill_common::flow_status::FlowStatus>\",\n            j.runnable_path\n        FROM v2_job_status js\n        INNER JOIN v2_job j ON j.id = js.id\n        WHERE js.id = $1\n        ",
+  "query": "\n        SELECT\n            j.args as \"args: Json<HashMap<String, Box<RawValue>>>\",\n            js.flow_status as \"flow_status: Json<windmill_common::flow_status::FlowStatus>\"\n        FROM v2_job_status js\n        INNER JOIN v2_job j ON j.id = js.id\n        WHERE js.id = $1\n        ",
  "describe": {
    "columns": [
      {
@@ -12,11 +12,6 @@
        "ordinal": 1,
        "name": "flow_status: Json<windmill_common::flow_status::FlowStatus>",
        "type_info": "Jsonb"
-      },
-      {
-        "ordinal": 2,
-        "name": "runnable_path",
-        "type_info": "Varchar"
      }
    ],
    "parameters": {
@@ -25,10 +20,9 @@
      ]
    },
    "nullable": [
-      true,
      true,
      true
    ]
  },
-  "hash": "9008f9abb70a9a07e38acb20bea6a710d0efd77dac4aedeb88d72240e816530b"
+  "hash": "dd89d652154748d6d7e625e31778f6885d0ee62d29a4b8894a4b459dd215a103"
 }
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT id, conversation_id, message_type as \"message_type: MessageType\", content, job_id, created_at, created_seq, step_name, success, tool_arguments, tool_result, reasoning, attachments\n             FROM (\n                SELECT id, conversation_id, message_type, content, job_id, created_at, created_seq, step_name, success, tool_arguments, tool_result, reasoning, attachments\n                FROM flow_conversation_message\n                WHERE conversation_id = $1\n                ORDER BY created_seq DESC\n                LIMIT $2 OFFSET $3\n             ) AS messages\n             ORDER BY created_seq ASC\n             ",
+  "query": "SELECT id, conversation_id, message_type as \"message_type: MessageType\", content, job_id, created_at, created_seq, step_name, success\n             FROM flow_conversation_message\n             WHERE conversation_id = $1\n               AND created_seq > $2\n             ORDER BY created_seq ASC\n             LIMIT $3\n             ",
  "describe": {
    "columns": [
      {
@@ -58,26 +58,6 @@
        "ordinal": 8,
        "name": "success",
        "type_info": "Bool"
-      },
-      {
-        "ordinal": 9,
-        "name": "tool_arguments",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 10,
-        "name": "tool_result",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 11,
-        "name": "reasoning",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 12,
-        "name": "attachments",
-        "type_info": "Jsonb"
      }
    ],
    "parameters": {
@@ -96,12 +76,8 @@
      false,
      false,
      true,
-      false,
-      true,
-      true,
-      true,
-      true
+      false
    ]
  },
-  "hash": "a4a823f70b3dbe6aaf4a61c98345e94c5042fd5e6351fea139a66ecb1fb812ab"
+  "hash": "e8802be9203c1e88a06e337260ccca029380139f89a01a89033e36a6ed9ac082"
 }
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "\n        SELECT\n            workspace_id,\n            slack_team_id,\n            slack_name,\n            teams_team_id,\n            teams_team_name,\n            teams_team_guid,\n            mute_critical_alerts,\n            guest_access_enabled,\n            add_admins_and_developers_to_forks,\n            deploy_ui,\n            large_file_storage,\n            datatable\n        FROM\n            workspace_settings\n        WHERE\n            workspace_id = $1\n        ",
+  "query": "\n        SELECT\n            workspace_id,\n            slack_team_id,\n            slack_name,\n            teams_team_id,\n            teams_team_name,\n            teams_team_guid,\n            mute_critical_alerts,\n            guest_access_enabled,\n            deploy_ui,\n            large_file_storage,\n            datatable\n        FROM\n            workspace_settings\n        WHERE\n            workspace_id = $1\n        ",
  "describe": {
    "columns": [
      {
@@ -45,21 +45,16 @@
      },
      {
        "ordinal": 8,
-        "name": "add_admins_and_developers_to_forks",
-        "type_info": "Bool"
-      },
-      {
-        "ordinal": 9,
        "name": "deploy_ui",
        "type_info": "Jsonb"
      },
      {
-        "ordinal": 10,
+        "ordinal": 9,
        "name": "large_file_storage",
        "type_info": "Jsonb"
      },
      {
-        "ordinal": 11,
+        "ordinal": 10,
        "name": "datatable",
        "type_info": "Jsonb"
      }
@@ -78,11 +73,10 @@
      true,
      true,
      false,
-      false,
      true,
      true,
      true
    ]
  },
-  "hash": "e6e31fdf705896c81f9a0f45d47c1b93db0406aaf278bccba07be00e9f937e2a"
+  "hash": "ede15bff96152f209aff756830cbc76b5afa1af6ed324376989117b1054c3447"
 }
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO workspace_settings (workspace_id, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url, add_admins_and_developers_to_forks) SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url, add_admins_and_developers_to_forks FROM workspace_settings WHERE workspace_id = $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "eefa0588a6a927fd9b3f65e1df652fb2b4cf7983049d2c490940df360c7e2b30"
-}
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.815.0"
+version = "1.813.0"
 authors.workspace = true
 edition.workspace = true

@@ -88,7 +88,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]

 [workspace.package]
-version = "1.815.0"
+version = "1.813.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"

@@ -624,6 +624,7 @@ wasm-bindgen-test = "^0"
 convert_case = "0.6.0"
 getrandom = "0.2"
 tokio-postgres = {version = "^0.7", features = ["array-impls", "with-serde_json-1", "with-chrono-0_4", "with-uuid-1", "with-bit-vec-0_6"]}
+postgres-protocol = "0.6"
 rust-postgres = { package = "tokio-postgres", git = "https://github.com/MaterializeInc/rust-postgres", rev = "78c1222577bb091d69bc22b1bc7ad01c14675abe"}
 rust-postgres-native-tls = { package = "postgres-native-tls", git = "https://github.com/MaterializeInc/rust-postgres", features = ["runtime"], rev = "78c1222577bb091d69bc22b1bc7ad01c14675abe" }
 bit-vec = "=0.6.3"
@@ -1 +1 @@
-bc3ef08c8e4233508c023e6ee847a3cd0b8be43b
+151be033ea2bf2f768f381a8cd3b888bdd366cf9
@@ -1,3 +0,0 @@
-ALTER TABLE flow_conversation_message DROP COLUMN tool_arguments;
-ALTER TABLE flow_conversation_message DROP COLUMN tool_result;
-ALTER TABLE flow_conversation_message DROP COLUMN reasoning;
@@ -1,12 +0,0 @@
-- A chat is rebuilt from its rows without reading jobs, so every tool row carries its call:
-- the arguments the model wrote and the text the model got back, or what the call failed
-- with. A script or flow tool's job holds the args its input transforms produced, not the
-- model's; an MCP tool runs inside the agent's job, whose result lists every call of the
-- turn with nothing tying one to a row. A provider-native web search carries only its
-- citations, the provider never returning the query.
-ALTER TABLE flow_conversation_message ADD COLUMN tool_arguments TEXT;
-ALTER TABLE flow_conversation_message ADD COLUMN tool_result TEXT;
-
-- The thinking behind this row. The agent job keeps the turn's thinking as one string;
-- the rows keep it per iteration, next to the answer or tool call it led to.
-ALTER TABLE flow_conversation_message ADD COLUMN reasoning TEXT;
@@ -1 +0,0 @@
-ALTER TABLE flow_conversation DROP COLUMN is_test;
@@ -1,26 +0,0 @@
-- A chat run from the flow editor's test panel is stored exactly like one from the
-- deployed flow, so the two were indistinguishable once written. Marking them lets the
-- lists tell a trial apart from a real conversation.
-ALTER TABLE flow_conversation ADD COLUMN is_test BOOLEAN NOT NULL DEFAULT false;
-
-- Existing rows: a conversation whose messages came from a flowpreview run was a test.
-- Derived once here because the job is purged on retention, after which the origin of an
-- old conversation is unknowable.
--
-- Walked to the root job rather than matched directly: an existing message row never holds
-- the flow job itself. The rows point at the step that produced them — the AI agent's job
-- for an answer, the tool's own job for a tool call — whose kind is never 'flowpreview'.
--
-- `root_job` first, matching `get_root_job_id` (windmill-worker/src/common.rs): only it
-- reaches the top of the run. `flow_innermost_root_job` stops at the closest flow scope by
-- design, so an agent inside a subflow would land on that subflow's 'flow' row and the
-- conversation would read as deployed.
-UPDATE flow_conversation c
-SET is_test = true
-WHERE EXISTS (
-    SELECT 1 FROM flow_conversation_message m
-    JOIN v2_job j ON j.id = m.job_id
-    JOIN v2_job root
-      ON root.id = coalesce(j.root_job, j.flow_innermost_root_job, j.parent_job, j.id)
-    WHERE m.conversation_id = c.id AND root.kind = 'flowpreview'
-);
@@ -1 +0,0 @@
-ALTER TABLE flow_conversation_message DROP COLUMN attachments;
@@ -1,4 +0,0 @@
-- The files a user message carried, as object-storage references: `[{input, s3, storage?,
-- filename?}]`. Only references, never file bytes and never a presigned URL, so a
-- transcript can show a message's files without reading its run's args.
-ALTER TABLE flow_conversation_message ADD COLUMN attachments JSONB;
@@ -0,0 +1,22 @@
+-- Roles on the external cluster are live logins there; dropping the column would forget them.
+LOCK TABLE datatable_role;
+DO $$
+BEGIN
+    IF EXISTS (SELECT 1 FROM datatable_role WHERE cluster <> 'instance') THEN
+        RAISE EXCEPTION 'datatable_role holds roles on the external instance cluster. Delete them in instance settings first.';
+    END IF;
+    -- Before this, only data tables on Windmill's own cluster could be under roles, and a role
+    -- block left with just `admin` survives deleting every external role.
+    IF EXISTS (
+        SELECT 1 FROM workspace_settings ws,
+            jsonb_each(CASE WHEN jsonb_typeof(ws.datatable->'datatables') = 'object'
+                THEN ws.datatable->'datatables' ELSE '{}'::jsonb END) dt
+        WHERE dt.value->'database'->>'resource_type' = 'external_instance'
+          AND dt.value ? 'permissions'
+    ) THEN
+        RAISE EXCEPTION 'external instance data tables are still under roles. Turn their roles off first.';
+    END IF;
+END $$;
+ALTER TABLE datatable_role DROP CONSTRAINT datatable_role_cluster_name_key;
+ALTER TABLE datatable_role ADD CONSTRAINT datatable_role_name_key UNIQUE (name);
+ALTER TABLE datatable_role DROP COLUMN cluster;
@@ -0,0 +1,8 @@
+-- A data table role is a Postgres login on one cluster: Windmill's own ('instance'), or the external
+-- instance cluster ('external_instance'). Role names are the cluster's own key, so they are unique
+-- per cluster rather than across the instance.
+ALTER TABLE datatable_role
+    ADD COLUMN cluster VARCHAR(20) NOT NULL DEFAULT 'instance'
+        CHECK (cluster IN ('instance', 'external_instance'));
+ALTER TABLE datatable_role DROP CONSTRAINT datatable_role_name_key;
+ALTER TABLE datatable_role ADD CONSTRAINT datatable_role_cluster_name_key UNIQUE (cluster, name);
@@ -1 +0,0 @@
-ALTER TABLE workspace_settings DROP COLUMN add_admins_and_developers_to_forks;
@@ -1 +0,0 @@
-ALTER TABLE workspace_settings ADD COLUMN add_admins_and_developers_to_forks BOOLEAN NOT NULL DEFAULT false;
@@ -6191,7 +6191,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"

 [[package]]
 name = "windmill-common"
-version = "1.815.0"
+version = "1.813.0"
 dependencies = [
 "aho-corasick",
 "anyhow",
@@ -6274,7 +6274,7 @@ dependencies = [

 [[package]]
 name = "windmill-macros"
-version = "1.815.0"
+version = "1.813.0"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -6286,7 +6286,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser"
-version = "1.815.0"
+version = "1.813.0"
 dependencies = [
 "convert_case",
 "serde",
@@ -6295,7 +6295,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-bash"
-version = "1.815.0"
+version = "1.813.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -6307,7 +6307,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-csharp"
-version = "1.815.0"
+version = "1.813.0"
 dependencies = [
 "anyhow",
 "serde_json",
@@ -6319,7 +6319,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-go"
-version = "1.815.0"
+version = "1.813.0"
 dependencies = [
 "anyhow",
 "gosyn",
@@ -6331,7 +6331,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-graphql"
-version = "1.815.0"
+version = "1.813.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -6343,7 +6343,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-java"
-version = "1.815.0"
+version = "1.813.0"
 dependencies = [
 "anyhow",
 "serde_json",
@@ -6355,7 +6355,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-nu"
-version = "1.815.0"
+version = "1.813.0"
 dependencies = [
 "anyhow",
 "nu-parser",
@@ -6366,7 +6366,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-php"
-version = "1.815.0"
+version = "1.813.0"
 dependencies = [
 "anyhow",
 "itertools 0.14.0",
@@ -6377,7 +6377,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-py"
-version = "1.815.0"
+version = "1.813.0"
 dependencies = [
 "anyhow",
 "itertools 0.14.0",
@@ -6389,7 +6389,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.815.0"
+version = "1.813.0"
 dependencies = [
 "anyhow",
 "rustpython-ast",
@@ -6400,7 +6400,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.815.0"
+version = "1.813.0"
 dependencies = [
 "anyhow",
 "async-recursion",
@@ -6422,7 +6422,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-r"
-version = "1.815.0"
+version = "1.813.0"
 dependencies = [
 "anyhow",
 "serde_json",
@@ -6434,7 +6434,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-ruby"
-version = "1.815.0"
+version = "1.813.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -6448,7 +6448,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-rust"
-version = "1.815.0"
+version = "1.813.0"
 dependencies = [
 "anyhow",
 "convert_case",
@@ -6465,7 +6465,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-sql"
-version = "1.815.0"
+version = "1.813.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -6478,7 +6478,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.815.0"
+version = "1.813.0"
 dependencies = [
 "anyhow",
 "serde",
@@ -6490,7 +6490,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-ts"
-version = "1.815.0"
+version = "1.813.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -6508,7 +6508,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.815.0"
+version = "1.813.0"
 dependencies = [
 "anyhow",
 "serde-wasm-bindgen",
@@ -6524,7 +6524,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-wac"
-version = "1.815.0"
+version = "1.813.0"
 dependencies = [
 "anyhow",
 "rustpython-ast",
@@ -6540,7 +6540,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-wasm"
-version = "1.815.0"
+version = "1.813.0"
 dependencies = [
 "anyhow",
 "getrandom 0.2.17",
@@ -6572,7 +6572,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-yaml"
-version = "1.815.0"
+version = "1.813.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -6586,7 +6586,7 @@ dependencies = [

 [[package]]
 name = "windmill-types"
-version = "1.815.0"
+version = "1.813.0"
 dependencies = [
 "anyhow",
 "bitflags",
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]

 [workspace.package]
-version = "1.815.0"
+version = "1.813.0"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]

@@ -52,8 +52,7 @@ use windmill_common::{
        INSTANCE_EVENTS_WEBHOOK_SETTING, INSTANCE_PYTHON_VERSION_SETTING,
        JOB_DEFAULT_TIMEOUT_SECS_SETTING, JOB_ISOLATION_SETTING, JWT_SECRET_SETTING,
        KEEP_JOB_DIR_SETTING, LICENSE_KEY_SETTING, MAVEN_REPOS_SETTING, MAVEN_SETTINGS_XML_SETTING,
-        MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING, MONITOR_LOGS_ON_OBJECT_STORE_SETTING,
-        NO_DEFAULT_MAVEN_SETTING,
+        MONITOR_LOGS_ON_OBJECT_STORE_SETTING, NO_DEFAULT_MAVEN_SETTING,
        NPM_CONFIG_REGISTRY_SETTING, NSJAIL_TMPFS_SIZE_MB_SETTING, NSJAIL_TMP_BACKING_SETTING,
        NUGET_CONFIG_SETTING, OAUTH_SETTING, OTEL_SETTING, OTEL_TRACES_RETENTION_SECS_SETTING,
        OTEL_TRACING_PROXY_SETTING, PIP_INDEX_URL_SETTING, POWERSHELL_REPO_PAT_SETTING,
@@ -127,8 +126,7 @@ use windmill_worker::{

 use crate::monitor::{
    initial_load, load_concurrency_key_max_queued, load_disable_password_login,
-    load_fork_workspace_tag_append_fork_suffix, load_keep_job_dir,
-    load_mcp_disable_token_query_param, load_metrics_debug_enabled,
+    load_fork_workspace_tag_append_fork_suffix, load_keep_job_dir, load_metrics_debug_enabled,
    load_preview_tags_override, load_require_preexisting_user, load_retention_period_overrides,
    load_tag_per_workspace_enabled, load_tag_per_workspace_workspaces,
    load_workspace_fairness_duration_secs, load_workspace_fairness_enabled,
@@ -2166,9 +2164,6 @@ async fn process_notify_event(
                DISABLE_PASSWORD_LOGIN_SETTING => {
                    load_disable_password_login(db).await;
                }
-                MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING => {
-                    load_mcp_disable_token_query_param(db).await;
-                }
                EXPOSE_METRICS_SETTING => {
                    tracing::info!("Metrics setting changed, restarting");
                    spawn_graceful_killpill(tx, db, 30, "metrics setting change", server_mode)
@@ -45,10 +45,7 @@ use windmill_common::otel_oss::{
 use windmill_common::{
    agent_workers::DECODED_AGENT_TOKEN,
    apps::APP_WORKSPACED_ROUTE,
-    auth::{
-        create_token_for_owner, ephemeral_script_token_label, job_token_expiry_secs,
-        TOKEN_EXPIRY_WARNING_DAYS,
-    },
+    auth::{create_token_for_owner, ephemeral_script_token_label, job_token_expiry_secs},
    ee_oss::CriticalErrorChannel,
    email_oss::send_email_if_possible,
    error,
@@ -65,7 +62,6 @@ use windmill_common::{
        FORK_WORKSPACE_TAG_APPEND_FORK_SUFFIX_SETTING, HUB_API_SECRET_SETTING,
        HUB_BASE_URL_SETTING, INSTANCE_PYTHON_VERSION_SETTING, JOB_DEFAULT_TIMEOUT_SECS_SETTING,
        JOB_ISOLATION_SETTING, JWT_SECRET_SETTING, KEEP_JOB_DIR_SETTING, LICENSE_KEY_SETTING,
-        MCP_DISABLE_TOKEN_QUERY_PARAM, MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING,
        MONITOR_LOGS_ON_OBJECT_STORE_SETTING, NPMRC_SETTING, NPM_CONFIG_REGISTRY_SETTING,
        NSJAIL_TMPFS_SIZE_MB_SETTING, NSJAIL_TMP_BACKING_SETTING, NUGET_CONFIG_SETTING,
        OTEL_SETTING, OTEL_TRACES_RETENTION_SECS_SETTING, OTEL_TRACING_PROXY_SETTING,
@@ -289,15 +285,6 @@ pub async fn initial_load(
    );

    if let Some(db) = conn.as_sql() {
-        // Outside the `server_mode` block below: a `MODE=mcp` process serves the MCP routes
-        // with `server_mode` false and would otherwise never read this at all. That mode
-        // joins no monitor loop, so there — as for every global setting, `base_url`
-        // included — this pass is the only read, and a change lands on restart.
-        pass.setting(
-            MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING,
-            false,
-            |v| async move { apply_mcp_disable_token_query_param(v) },
-        );
        pass.setting(DEFAULT_TAGS_PER_WORKSPACE_SETTING, false, |v| async move {
            apply_tag_per_workspace_enabled(v)
        });
@@ -1627,23 +1614,6 @@ pub fn apply_disable_password_login(value: Option<serde_json::Value>) {
    };
 }

-pub async fn load_mcp_disable_token_query_param(db: &DB) {
-    match load_value_from_global_settings(db, MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING).await {
-        Ok(v) => apply_mcp_disable_token_query_param(v),
-        Err(e) => tracing::error!("Error loading mcp_disable_token_query_param setting: {e:#}"),
-    };
-}
-
-pub fn apply_mcp_disable_token_query_param(value: Option<serde_json::Value>) {
-    match value {
-        Some(serde_json::Value::Bool(t)) => {
-            MCP_DISABLE_TOKEN_QUERY_PARAM.store(t, Ordering::Relaxed)
-        }
-        None => MCP_DISABLE_TOKEN_QUERY_PARAM.store(false, Ordering::Relaxed),
-        _ => (),
-    };
-}
-
 struct LogFile {
    file_path: String,
    hostname: String,
@@ -2228,7 +2198,7 @@ async fn cleanup_scheduled_job_deletions(db: &Pool<Postgres>) {
 }

 pub async fn check_expiring_tokens(db: &DB) {
-    // Find tokens expiring within the warning window that still have a pending notification row.
+    // Find tokens expiring within 7 days that still have a pending notification row.
    // The notification table stores token_hash (not plaintext) so the join works
    // even after the hash migration makes token.token nullable.
    let expiring_tokens_r = sqlx::query_as!(
@@ -2237,9 +2207,8 @@ pub async fn check_expiring_tokens(db: &DB) {
         USING token t
         WHERE n.token_hash = t.token_hash
           AND n.expiration > now()
-           AND n.expiration <= now() + make_interval(days => $1)
+           AND n.expiration <= now() + interval '7 days'
         RETURNING t.token_prefix, t.label, t.email, t.workspace_id",
-        TOKEN_EXPIRY_WARNING_DAYS,
    )
    .fetch_all(db)
    .await;
@@ -99,9 +99,9 @@ email_trigger: path(char), local_part(char), workspaced_local_part(bool), script
 favorite: usr(char), workspace_id(char), path(char), favorite_kind(favorite_kind)
 flow: workspace_id(char), path(char), summary(text), description(text), value(jsonb), edited_by(char), edited_at(ts), archived(bool), schema(json), extra_perms(jsonb), dependency_job(uuid), draft_only(bool), tag(char), ws_error_handler_muted(bool), dedicated_worker(bool), timeout(int), visible_to_runner_only(bool), concurrency_key(char), versions(bigint[]), on_behalf_of(varchar), on_behalf_of_email(text), lock_error_logs(text), labels(text[])
  FK: (workspace_id) -> workspace(id)
-flow_conversation: id(uuid), workspace_id(char), flow_path(char), title(char), created_at(ts), updated_at(ts), created_by(char), is_test(bool)
+flow_conversation: id(uuid), workspace_id(char), flow_path(char), title(char), created_at(ts), updated_at(ts), created_by(char)
  FK: (workspace_id) -> workspace(id)
-flow_conversation_message: id(uuid), conversation_id(uuid), message_type(message_type), content(text), job_id(uuid), created_at(ts), created_seq(int8), step_name(char), success(bool), tool_arguments(text), tool_result(text), reasoning(text), attachments(jsonb)
+flow_conversation_message: id(uuid), conversation_id(uuid), message_type(message_type), content(text), job_id(uuid), created_at(ts), created_seq(int8), step_name(char), success(bool)
  FK: (conversation_id) -> flow_conversation(id) | (job_id) -> v2_job(id)
 flow_iterator_data: job_id(uuid), itered(jsonb)
 flow_node: id(bigint), workspace_id(char), hash(bigint), path(char), lock(text), code(text), flow(jsonb), hash_v2(char(64))
@@ -234,7 +234,7 @@ workspace_protection_rule: workspace_id(char), name(char), rules(int), bypass_gr
  FK: (workspace_id) -> workspace(id)
 workspace_runnable_dependencies: flow_path(char), runnable_path(char), script_hash(bigint), runnable_is_flow(bool), workspace_id(char), app_path(char), id(bigint), runnable_is_agent(bool)
  FK: (app_path, workspace_id) -> app(path, workspace_id) | (flow_path, workspace_id) -> flow(path, workspace_id)
-workspace_settings: workspace_id(char), slack_team_id(char), slack_name(char), slack_command_script(char), slack_email(char), customer_id(char), plan(char), webhook(text), ai_config(jsonb), large_file_storage(jsonb), git_sync(jsonb), default_app(char), default_scripts(jsonb), deploy_ui(jsonb), mute_critical_alerts(bool), color(char), operator_settings(jsonb), teams_command_script(text), teams_team_id(text), teams_team_name(text), git_app_installations(jsonb), ducklake(jsonb), slack_oauth_client_id(char), slack_oauth_client_secret(char), datatable(jsonb), teams_team_guid(text), auto_invite(jsonb), error_handler(jsonb), success_handler(jsonb), public_app_execution_limit_per_minute(int), dbt_warehouses(jsonb), guest_access_enabled(bool), guest_jwt_public_key(text), guest_jwt_jwks_url(text), ai_sessions_backup_generation(int), add_admins_and_developers_to_forks(bool)
+workspace_settings: workspace_id(char), slack_team_id(char), slack_name(char), slack_command_script(char), slack_email(char), customer_id(char), plan(char), webhook(text), ai_config(jsonb), large_file_storage(jsonb), git_sync(jsonb), default_app(char), default_scripts(jsonb), deploy_ui(jsonb), mute_critical_alerts(bool), color(char), operator_settings(jsonb), teams_command_script(text), teams_team_id(text), teams_team_name(text), git_app_installations(jsonb), ducklake(jsonb), slack_oauth_client_id(char), slack_oauth_client_secret(char), datatable(jsonb), teams_team_guid(text), auto_invite(jsonb), error_handler(jsonb), success_handler(jsonb), public_app_execution_limit_per_minute(int), dbt_warehouses(jsonb), guest_access_enabled(bool), guest_jwt_public_key(text), guest_jwt_jwks_url(text), ai_sessions_backup_generation(int)
  FK: (workspace_id) -> workspace(id)
 zombie_job_counter: job_id(uuid), counter(int)
  FK: (job_id) -> v2_job(id)
@@ -3312,60 +3312,3 @@ export function main(i: number) {

    Ok(())
 }
-
-// A `$flow_expr[...]` step tag is resolved from the flow's state before the step is pushed, and
-// one that cannot be resolved fails the step instead of queueing it on a tag no worker serves.
-#[cfg(feature = "deno_core")]
-#[sqlx::test(fixtures("base"))]
-async fn test_flow_expr_step_tag(db: Pool<Postgres>) -> anyhow::Result<()> {
-    initialize_tracing().await;
-    let server = ApiServer::start(db.clone()).await?;
-
-    let step = |id: &str, tag: Option<&str>| {
-        flow_module(
-            id,
-            FlowModuleValue::RawScript {
-                input_transforms: Default::default(),
-                language: ScriptLang::Deno,
-                content: "export function main() { return { lang: 'bun' } }".to_string(),
-                path: None,
-                lock: None,
-                tag: tag.map(str::to_string),
-                concurrency_settings: Default::default(),
-                is_trigger: None,
-                assets: None,
-            },
-        )
-    };
-    let flow = FlowValue {
-        modules: vec![
-            step("a", None),
-            step("b", Some("$flow_expr[results.a.lang]")),
-            step("c", Some("nobody-serves-$flow_expr[a.lang]")),
-        ],
-        same_worker: false,
-        ..Default::default()
-    };
-
-    let job = RunJob::from(JobPayload::RawFlow { value: flow, path: None, restarted_from: None })
-        .run_until_complete(&db, false, server.addr.port())
-        .await;
-
-    let b_tag = sqlx::query_scalar::<_, String>(
-        "SELECT tag FROM v2_job WHERE parent_job = $1 AND flow_step_id = 'b'",
-    )
-    .bind(job.id)
-    .fetch_one(&db)
-    .await?;
-    assert_eq!(b_tag, "bun");
-
-    assert!(!job.success);
-    let result = job.json_result().unwrap();
-    let message = result["error"]["message"].as_str().unwrap_or_default();
-    assert!(
-        message.contains("Could not resolve the step tag `nobody-serves-$flow_expr[a.lang]`"),
-        "got {result:?}"
-    );
-
-    Ok(())
-}
@@ -1530,31 +1530,6 @@ async fn declarative_sync_rejects_an_unusable_instance_banner(db: Pool<Postgres>
    );
 }

-#[sqlx::test(fixtures("base"))]
-async fn declarative_sync_rejects_a_malformed_max_token_expiration(db: Pool<Postgres>) {
-    clear_settings_and_configs(&db).await;
-    let before = count_global_settings(&db).await;
-
-    let mut desired = BTreeMap::new();
-    desired.insert(
-        "max_token_expiration_days".to_string(),
-        serde_json::json!("7.0"),
-    );
-
-    let err = windmill_common::instance_config::sync_global_settings_declarative(
-        &db,
-        &BTreeMap::new(),
-        &desired,
-    )
-    .await
-    .expect_err("a ceiling the token routes cannot read must fail the sync");
-    assert!(
-        err.to_string().contains("max_token_expiration_days"),
-        "the error should name the offending setting, got: {err}"
-    );
-    assert_eq!(count_global_settings(&db).await, before);
-}
-
 #[sqlx::test(fixtures("base"))]
 async fn declarative_sync_rejects_an_unusable_default_allowed_origins(db: Pool<Postgres>) {
    // The declarative writers (the sync-config CLI, the operator's ConfigMap
@@ -1,108 +0,0 @@
-/*
- * The job's own token (`$WM_TOKEN`) stays valid well past the job it was minted
- * for, and job logs are persisted to `job_logs` and optionally to object storage,
- * so a script that echoes the token would otherwise park a live credential in
- * durable storage. `run_worker` registers the token with `sensitive_log_masks`
- * for the job it pulled; this pins that the persisted log carries the masked form.
- */
-
-use sqlx::{Pool, Postgres};
-use windmill_common::{
-    jobs::{JobPayload, RawCode},
-    scripts::ScriptLang,
-};
-use windmill_test_utils::*;
-
-/// Prefix of a serialized job token: `jwt_` plus the base64 of a JWT header.
-/// The masked form keeps only `jwt` + the last three characters, so it never matches.
-const RAW_TOKEN_PREFIX: &str = "jwt_ey";
-
-#[sqlx::test(fixtures("base"))]
-async fn test_job_token_masked_in_persisted_logs(db: Pool<Postgres>) -> anyhow::Result<()> {
-    initialize_tracing().await;
-    let server = ApiServer::start(db.clone()).await?;
-    let port = server.addr.port();
-
-    let job = RunJob::from(JobPayload::Code(RawCode {
-        hash: None,
-        content: "echo \"running with --token $WM_TOKEN\"".to_string(),
-        path: None,
-        lock: None,
-        language: ScriptLang::Bash,
-        cache_ttl: None,
-        cache_ignore_s3_path: None,
-        dedicated_worker: None,
-        concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default()
-            .into(),
-        debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
-        modules: None,
-        tag: None,
-    }))
-    .run_until_complete(&db, false, port)
-    .await;
-    assert!(job.success, "job should have succeeded");
-
-    let logs =
-        sqlx::query_scalar::<_, Option<String>>("SELECT logs FROM job_logs WHERE job_id = $1")
-            .bind(job.id)
-            .fetch_one(&db)
-            .await?
-            .unwrap_or_default();
-
-    assert!(
-        !logs.contains(RAW_TOKEN_PREFIX),
-        "an unmasked job token reached the persisted logs: {logs}"
-    );
-    assert!(
-        logs.contains("secret value was masked"),
-        "expected the masking notice in logs: {logs}"
-    );
-    Ok(())
-}
-
-/// nativets runs V8 in-process and persists `console.log` output through its own
-/// channel, so it is masked by a different mechanism than the bash case above and
-/// needs its own guard.
-#[cfg(feature = "deno_core")]
-#[sqlx::test(fixtures("base"))]
-async fn test_job_token_masked_in_nativets_logs(db: Pool<Postgres>) -> anyhow::Result<()> {
-    initialize_tracing().await;
-    let server = ApiServer::start(db.clone()).await?;
-    let port = server.addr.port();
-
-    let job = RunJob::from(JobPayload::Code(RawCode {
-        hash: None,
-        content: "export async function main() {\n  console.log('running with --token ' + process.env.WM_TOKEN);\n  return 'ok';\n}".to_string(),
-        path: None,
-        lock: None,
-        language: ScriptLang::Nativets,
-        cache_ttl: None,
-        cache_ignore_s3_path: None,
-        dedicated_worker: None,
-        concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default()
-            .into(),
-        debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
-        modules: None,
-        tag: None,
-    }))
-    .run_until_complete(&db, false, port)
-    .await;
-    assert!(job.success, "job should have succeeded");
-
-    let logs =
-        sqlx::query_scalar::<_, Option<String>>("SELECT logs FROM job_logs WHERE job_id = $1")
-            .bind(job.id)
-            .fetch_one(&db)
-            .await?
-            .unwrap_or_default();
-
-    assert!(
-        !logs.contains(RAW_TOKEN_PREFIX),
-        "an unmasked job token reached the persisted logs: {logs}"
-    );
-    assert!(
-        logs.contains("secret value was masked"),
-        "expected the masking notice in logs: {logs}"
-    );
-    Ok(())
-}
@@ -1199,63 +1199,3 @@ async fn test_wm_labels_from_result_merged_with_static_labels(

    Ok(())
 }
-
-/// `tag` lives only on `v2_job`, which count_jobs joins only when `tags` is set.
-#[sqlx::test(fixtures("base"))]
-async fn test_count_completed_jobs_tags_filter(db: Pool<Postgres>) -> anyhow::Result<()> {
-    initialize_tracing().await;
-
-    let server = ApiServer::start(db.clone()).await?;
-    let port = server.addr.port();
-    let client = windmill_api_client::create_client(
-        &format!("http://localhost:{port}"),
-        "SECRET_TOKEN".to_string(),
-    );
-
-    for (ws, tag, status) in [
-        ("test-workspace", "deno", "success"),
-        ("test-workspace", "deno", "failure"),
-        ("test-workspace", "python3", "success"),
-        ("other-workspace", "deno", "success"),
-    ] {
-        let id = uuid::Uuid::new_v4();
-        sqlx::query("INSERT INTO v2_job (id, workspace_id, tag) VALUES ($1, $2, $3)")
-            .bind(id)
-            .bind(ws)
-            .bind(tag)
-            .execute(&db)
-            .await?;
-        sqlx::query(
-            "INSERT INTO v2_job_completed (id, workspace_id, status, duration_ms) VALUES ($1, $2, $3::job_status, 0)",
-        )
-        .bind(id)
-        .bind(ws)
-        .bind(status)
-        .execute(&db)
-        .await?;
-    }
-
-    for (query, expected) in [
-        ("", 3),
-        ("tags=deno", 2),
-        ("tags=deno&success=true", 1),
-        ("tags=deno,python3&completed_after_s_ago=3600", 3),
-    ] {
-        let response = client
-            .client()
-            .get(format!(
-                "{}/w/test-workspace/jobs/completed/count_jobs?{query}",
-                client.baseurl()
-            ))
-            .send()
-            .await?;
-        assert!(
-            response.status().is_success(),
-            "{query}: {}",
-            response.text().await?
-        );
-        assert_eq!(response.json::<i64>().await?, expected, "{query}");
-    }
-
-    Ok(())
-}
@@ -258,7 +258,6 @@ async fn test_new_turns_wait_for_conversation_cleanup_and_recreate(
                    "test-user",
                    "hi again",
                    conv_id,
-                    false,
                )
                .await?;
                windmill_common::flow_conversations::add_message_to_conversation_tx(
@@ -269,7 +268,6 @@ async fn test_new_turns_wait_for_conversation_cleanup_and_recreate(
                    windmill_common::flow_conversations::MessageType::User,
                    None,
                    true,
-                    None,
                )
                .await?;
                tx.commit().await?;
@@ -23,7 +23,6 @@ async-trait.workspace = true
 async-stream.workspace = true
 base64.workspace = true
 bytes.workspace = true
-indexmap.workspace = true
 eventsource-stream.workspace = true
 futures.workspace = true
 http.workspace = true
@@ -1074,8 +1074,7 @@ impl BedrockQueryBuilder {

        let mut accumulated_text = String::new();
        let mut events_str = String::new();
-        let mut accumulated_tool_calls: indexmap::IndexMap<String, StreamingToolCall> =
-            indexmap::IndexMap::new();
+        let mut accumulated_tool_calls: HashMap<String, StreamingToolCall> = HashMap::new();
        let mut current_tool_use_id: Option<String> = None;
        let mut usage: Option<TokenUsage> = None;
        // Claude reasoning block for the turn (only populated when thinking is on),
@@ -1264,10 +1263,7 @@ mod tests {
        // recovers the uncached share by subtracting the details back out.
        assert_eq!(usage["usage"]["prompt_tokens"], 1010);
        assert_eq!(usage["usage"]["completion_tokens"], 7);
-        assert_eq!(
-            usage["usage"]["prompt_tokens_details"]["cached_tokens"],
-            900
-        );
+        assert_eq!(usage["usage"]["prompt_tokens_details"]["cached_tokens"], 900);
        assert_eq!(
            usage["usage"]["prompt_tokens_details"]["cache_write_tokens"],
            100
@@ -1,7 +1,6 @@
 use std::collections::HashMap;

 use eventsource_stream::Eventsource;
-use indexmap::IndexMap;
 use reqwest::Response;
 use serde::Deserialize;
 use tokio_stream::StreamExt;
@@ -138,9 +137,7 @@ pub struct OpenAISSEParser {
    pub accumulated_content: String,
    /// The thinking streamed before the answer, kept so it can be stored with it.
    pub accumulated_reasoning: String,
-    // Insertion-ordered in every parser: tool calls run and are persisted in the order the
-    // stream showed them, and a chat attaches a round's thinking to its first call.
-    pub accumulated_tool_calls: IndexMap<i64, OpenAIToolCall>,
+    pub accumulated_tool_calls: HashMap<i64, OpenAIToolCall>,
    pub events_str: String,
    pub stream_event_processor: Box<dyn StreamEventSink>,
    /// Token usage from final chunk (when stream_options.include_usage is true)
@@ -152,7 +149,7 @@ impl OpenAISSEParser {
        Self {
            accumulated_content: String::new(),
            accumulated_reasoning: String::new(),
-            accumulated_tool_calls: IndexMap::new(),
+            accumulated_tool_calls: HashMap::new(),
            events_str: String::new(),
            stream_event_processor,
            usage: None,
@@ -362,7 +359,7 @@ pub struct AnthropicSSEParser {
    pub accumulated_content: String,
    /// The thinking streamed before the answer, kept so it can be stored with it.
    pub accumulated_reasoning: String,
-    pub accumulated_tool_calls: IndexMap<i64, OpenAIToolCall>,
+    pub accumulated_tool_calls: HashMap<i64, OpenAIToolCall>,
    pub events_str: String,
    pub stream_event_processor: Box<dyn StreamEventSink>,
    /// Track content block types by index
@@ -385,7 +382,7 @@ impl AnthropicSSEParser {
        Self {
            accumulated_content: String::new(),
            accumulated_reasoning: String::new(),
-            accumulated_tool_calls: IndexMap::new(),
+            accumulated_tool_calls: HashMap::new(),
            events_str: String::new(),
            stream_event_processor,
            content_blocks: HashMap::new(),
@@ -604,7 +601,7 @@ pub struct GeminiSSEParser {
    pub accumulated_content: String,
    /// The thinking streamed before the answer, kept so it can be stored with it.
    pub accumulated_reasoning: String,
-    pub accumulated_tool_calls: IndexMap<i64, OpenAIToolCall>,
+    pub accumulated_tool_calls: HashMap<i64, OpenAIToolCall>,
    pub events_str: String,
    pub stream_event_processor: Box<dyn StreamEventSink>,
    tool_call_index: i64,
@@ -618,7 +615,7 @@ impl GeminiSSEParser {
        Self {
            accumulated_content: String::new(),
            accumulated_reasoning: String::new(),
-            accumulated_tool_calls: IndexMap::new(),
+            accumulated_tool_calls: HashMap::new(),
            events_str: String::new(),
            stream_event_processor,
            tool_call_index: 0,
@@ -836,7 +833,7 @@ pub struct OpenAIResponsesSSEParser {
    pub accumulated_content: String,
    /// The reasoning summary streamed before the answer, kept so it can be stored with it.
    pub accumulated_reasoning: String,
-    pub accumulated_tool_calls: IndexMap<String, OpenAIToolCall>,
+    pub accumulated_tool_calls: HashMap<String, OpenAIToolCall>,
    /// Maps item_id -> (name, call_id) for function calls
    tool_call_metadata: HashMap<String, (String, String)>,
    /// Maps item_id -> accumulated arguments
@@ -858,7 +855,7 @@ impl OpenAIResponsesSSEParser {
        Self {
            accumulated_content: String::new(),
            accumulated_reasoning: String::new(),
-            accumulated_tool_calls: IndexMap::new(),
+            accumulated_tool_calls: HashMap::new(),
            tool_call_metadata: HashMap::new(),
            tool_call_arguments: HashMap::new(),
            events_str: String::new(),
@@ -78,50 +78,17 @@ impl Default for OutputType {
 #[serde(tag = "kind", rename_all = "lowercase")]
 pub enum Memory {
    Off,
-    Window {
-        #[serde(default, deserialize_with = "deserialize_null_as_zero")]
-        context_length: usize,
-    },
-    /// Written before `window`. Its `memory_id` stays a fallback behind the run's memory id.
    Auto {
-        #[serde(default, deserialize_with = "deserialize_null_as_zero")]
+        #[serde(default)]
        context_length: usize,
-        #[serde(default, deserialize_with = "deserialize_blank_as_none")]
+        #[serde(default)]
        memory_id: Option<Uuid>,
    },
-    /// Written before a step had history inputs of its own, and read on its own where it remains.
    Manual {
        messages: Vec<OpenAIMessage>,
    },
 }

-// An editor form can leave `""` in a legacy baked id it never filled; it means no id rather than
-// failing every run of the step.
-fn deserialize_blank_as_none<'de, D: serde::Deserializer<'de>>(
-    deserializer: D,
-) -> Result<Option<Uuid>, D::Error> {
-    match <Option<String> as serde::Deserialize>::deserialize(deserializer)? {
-        Some(id) if !id.trim().is_empty() => Uuid::parse_str(id.trim())
-            .map(Some)
-            .map_err(serde::de::Error::custom),
-        _ => Ok(None),
-    }
-}
-
-// A count the editor's number field was cleared of is stored as `null`, which `default` does not
-// cover; it reads as 0, memory off, rather than failing every run of the step.
-fn deserialize_null_as_zero<'de, D: serde::Deserializer<'de>>(
-    deserializer: D,
-) -> Result<usize, D::Error> {
-    <Option<usize> as serde::Deserialize>::deserialize(deserializer).map(Option::unwrap_or_default)
-}
-
-fn deserialize_present<'de, D: serde::Deserializer<'de>>(
-    deserializer: D,
-) -> Result<Option<serde_json::Value>, D::Error> {
-    <serde_json::Value as serde::Deserialize>::deserialize(deserializer).map(Some)
-}
-
 #[derive(Deserialize)]
 struct AIAgentArgsRaw {
    provider: ProviderWithResource,
@@ -136,12 +103,6 @@ struct AIAgentArgsRaw {
    streaming: Option<bool>,
    max_iterations: Option<usize>,
    memory: Option<Memory>,
-    // A null must stay distinguishable from an absent key: a step whose own memory id evaluates to
-    // nothing runs stateless instead of falling back to the run's memory id.
-    #[serde(default, deserialize_with = "deserialize_present")]
-    memory_id: Option<serde_json::Value>,
-    #[serde(default)]
-    previous_messages: Option<Vec<OpenAIMessage>>,
    enabled_tools: Option<Vec<String>>,
    // Legacy field for backward compatibility
    messages_context_length: Option<usize>,
@@ -163,10 +124,6 @@ pub struct AIAgentArgs {
    pub streaming: Option<bool>,
    pub max_iterations: Option<usize>,
    pub memory: Option<Memory>,
-    /// Memory id set on the step, overriding the run's. Empty when its expression produced none.
-    pub memory_id: Option<String>,
-    /// History supplied by the flow, replayed without reading or writing memory.
-    pub previous_messages: Option<Vec<OpenAIMessage>>,
    /// Which of the agent's tools this run may call; `narrow_roster` holds what the names are and
    /// what `None` means.
    pub enabled_tools: Option<Vec<String>>,
@@ -182,17 +139,12 @@ impl From<AIAgentArgsRaw> for AIAgentArgs {
        });

        // Backward compatibility: if context_length is 0, use off mode
-        let memory = memory.map(|memory| match memory {
-            Memory::Auto { context_length: 0, .. } | Memory::Window { context_length: 0 } => {
+        let memory = memory.map(|memory| {
+            if let Memory::Auto { context_length: 0, .. } = memory {
                Memory::Off
+            } else {
+                memory
            }
-            memory => memory,
-        });
-
-        let memory_id = raw.memory_id.map(|value| match value {
-            serde_json::Value::Null => String::new(),
-            serde_json::Value::String(s) => s.trim().to_string(),
-            value => value.to_string(),
        });

        AIAgentArgs {
@@ -207,8 +159,6 @@ impl From<AIAgentArgsRaw> for AIAgentArgs {
            streaming: raw.streaming,
            max_iterations: raw.max_iterations,
            memory,
-            memory_id,
-            previous_messages: raw.previous_messages,
            enabled_tools: raw.enabled_tools,
            credentials_check: raw.credentials_check.unwrap_or(false),
        }
@@ -1249,10 +1249,6 @@ pub async fn register_token_expiry_notification(
    if !windmill_common::auth::is_user_token(label) {
        return;
    }
-    let warning_days = windmill_common::auth::TOKEN_EXPIRY_WARNING_DAYS;
-    if expiration <= chrono::Utc::now() + chrono::Duration::days(warning_days.into()) {
-        return;
-    }
    if let Err(e) = sqlx::query!(
        "INSERT INTO token_expiry_notification (token_hash, expiration) VALUES ($1, $2) ON CONFLICT DO NOTHING",
        token_hash,
@@ -1,6 +1,6 @@
 use axum::{
    extract::{Path, Query},
-    routing::{delete, get, post},
+    routing::{delete, get},
    Extension, Json, Router,
 };
 use chrono::{DateTime, Utc};
@@ -15,14 +15,13 @@ use windmill_common::{
    db::{UserDB, DB},
    error::{JsonResult, Result},
    flow_conversations::MessageType,
-    utils::{not_found_if_none, paginate, truncate_with_ellipsis, Pagination},
+    utils::{not_found_if_none, paginate, Pagination},
 };

 pub fn workspaced_service() -> Router {
    Router::new()
        .route("/list", get(list_conversations))
        .route("/delete/{conversation_id}", delete(delete_conversation))
-        .route("/update/{conversation_id}", post(update_conversation))
        .route("/{conversation_id}/messages", get(list_messages))
 }

@@ -37,37 +36,11 @@ pub struct FlowConversationMessage {
    pub created_seq: i64,
    pub step_name: Option<String>,
    pub success: bool,
-    /// On a tool row, the arguments the model wrote. For a Windmill tool these exclude the
-    /// inputs its step wires in. Null for a web search, whose query the provider does not
-    /// return.
-    pub tool_arguments: Option<String>,
-    /// On a tool row, the text the model got back, or what the call failed with; a web
-    /// search's citations.
-    pub tool_result: Option<String>,
-    /// On an answer, the thinking that produced it; on a tool row, the thinking that led to
-    /// the call. The agent job keeps the turn's thinking as one string.
-    pub reasoning: Option<String>,
-    /// The files a user message carried, as object-storage references
-    /// (`[{input, s3, storage?, filename?}]`).
-    pub attachments: Option<sqlx::types::JsonValue>,
-}
-
-/// Which conversations a listing holds. A test chat was started from the editor's test
-/// panel; a deployed one from the flow itself.
-#[derive(Deserialize, Default, Clone, Copy)]
-#[serde(rename_all = "lowercase")]
-pub enum ConversationKind {
-    Test,
-    /// The default: a deployed flow's chat should not surface someone's trial runs.
-    #[default]
-    Deployed,
-    All,
 }

 #[derive(Deserialize)]
 pub struct ListConversationsQuery {
    pub flow_path: Option<String>,
-    pub kind: Option<ConversationKind>,
 }

 #[derive(Deserialize)]
@@ -94,7 +67,6 @@ async fn list_conversations(
        "created_at",
        "updated_at",
        "created_by",
-        "is_test",
    ])
    .and_where_eq("workspace_id", "?".bind(&w_id));

@@ -102,16 +74,6 @@ async fn list_conversations(
        sqlb.and_where_eq("flow_path", "?".bind(flow_path));
    }

-    match query.kind.unwrap_or_default() {
-        ConversationKind::Test => {
-            sqlb.and_where_eq("is_test", "true");
-        }
-        ConversationKind::Deployed => {
-            sqlb.and_where_eq("is_test", "false");
-        }
-        ConversationKind::All => {}
-    }
-
    sqlb.order_by("updated_at", true)
        .limit(per_page as i64)
        .offset(offset as i64);
@@ -139,7 +101,7 @@ async fn delete_conversation(
    // Verify the conversation exists and belongs to the user
    let conversation = sqlx::query_as!(
        FlowConversation,
-        "SELECT id, workspace_id, flow_path, title, created_at, updated_at, created_by, is_test
+        "SELECT id, workspace_id, flow_path, title, created_at, updated_at, created_by
         FROM flow_conversation
         WHERE id = $1 AND workspace_id = $2",
        conversation_id,
@@ -186,50 +148,6 @@ async fn delete_conversation(
    Ok(format!("Conversation {} deleted", conversation_id))
 }

-#[derive(Deserialize)]
-pub struct UpdateConversation {
-    pub title: String,
-}
-
-async fn update_conversation(
-    authed: ApiAuthed,
-    Extension(user_db): Extension<UserDB>,
-    Path((w_id, conversation_id)): Path<(String, Uuid)>,
-    Json(update): Json<UpdateConversation>,
-) -> Result<String> {
-    // Postgres refuses a NUL in a text column, so it must not reach the query as a 500.
-    if update.title.contains('\0') {
-        return Err(windmill_common::error::Error::BadRequest(
-            "title cannot contain a NUL character".to_string(),
-        ));
-    }
-    // The column is VARCHAR(255) and the helper appends an ellipsis to what it cuts, so the
-    // bound it takes is three short of the column's. A longer title would otherwise reach
-    // Postgres as a 22001 and come back a 500.
-    let title = truncate_with_ellipsis(update.title.trim(), 252);
-
-    let mut tx = user_db.clone().begin(&authed).await?;
-
-    // `updated_at` is kept: the list is ordered by it, and a rename must not move the
-    // chat to the top the way a new turn does.
-    let updated = sqlx::query_scalar!(
-        "UPDATE flow_conversation SET title = $1, updated_at = updated_at
-         WHERE id = $2 AND workspace_id = $3
-         RETURNING id",
-        title,
-        conversation_id,
-        &w_id
-    )
-    .fetch_optional(&mut *tx)
-    .await?;
-
-    not_found_if_none(updated, "Conversation", conversation_id.to_string())?;
-
-    tx.commit().await?;
-
-    Ok(format!("Conversation {} updated", conversation_id))
-}
-
 async fn list_messages(
    authed: ApiAuthed,
    Extension(user_db): Extension<UserDB>,
@@ -260,7 +178,7 @@ async fn list_messages(
    let messages = if let Some(after_seq) = query.after_seq {
        sqlx::query_as!(
            FlowConversationMessage,
-            r#"SELECT id, conversation_id, message_type as "message_type: MessageType", content, job_id, created_at, created_seq, step_name, success, tool_arguments, tool_result, reasoning, attachments
+            r#"SELECT id, conversation_id, message_type as "message_type: MessageType", content, job_id, created_at, created_seq, step_name, success
             FROM flow_conversation_message
             WHERE conversation_id = $1
               AND created_seq > $2
@@ -277,9 +195,9 @@ async fn list_messages(
        // Fetch messages for this conversation, oldest first, but reverse the order of the messages for easy rendering on the frontend
        sqlx::query_as!(
            FlowConversationMessage,
-            r#"SELECT id, conversation_id, message_type as "message_type: MessageType", content, job_id, created_at, created_seq, step_name, success, tool_arguments, tool_result, reasoning, attachments
+            r#"SELECT id, conversation_id, message_type as "message_type: MessageType", content, job_id, created_at, created_seq, step_name, success
             FROM (
-                SELECT id, conversation_id, message_type, content, job_id, created_at, created_seq, step_name, success, tool_arguments, tool_result, reasoning, attachments
+                SELECT id, conversation_id, message_type, content, job_id, created_at, created_seq, step_name, success
                FROM flow_conversation_message
                WHERE conversation_id = $1
                ORDER BY created_seq DESC
@@ -0,0 +1,108 @@
+//! Who may read and change a data table's grants and owners. On the Enterprise Edition: its
+//! administrators, from the workspace that governs it. Without it: nobody. Each refusal is decided
+//! before anything connects to the data table, so the fixture's database never has to exist.
+
+use serde_json::{json, Value};
+use sqlx::{Pool, Postgres};
+
+use windmill_test_utils::*;
+
+fn grant_select_on_public() -> Value {
+    json!({
+        "target": {"kind": "schema", "schema": "public"},
+        "change": {"type": "grant", "role": "analytics", "privileges": ["SELECT"],
+                   "scope": "all_tables"},
+        "statements": [r#"GRANT SELECT ON ALL TABLES IN SCHEMA "public" TO "analytics""#]
+    })
+}
+
+async fn post_acl(
+    port: u16,
+    w_id: &str,
+    action: &str,
+    token: &str,
+) -> anyhow::Result<reqwest::Response> {
+    Ok(reqwest::Client::new()
+        .post(format!(
+            "http://localhost:{port}/api/w/{w_id}/workspaces/datatable_acl/main/{action}"
+        ))
+        .header("Authorization", format!("Bearer {token}"))
+        .json(&grant_select_on_public())
+        .send()
+        .await?)
+}
+
+/// A fork reaches the data table through a pointer: it may use it, never change what each role may
+/// touch on it — not even as an admin of the fork.
+#[cfg(all(feature = "private", feature = "enterprise"))]
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn a_fork_cannot_change_access_on_the_data_table_it_points_at(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    for action in ["plan", "apply"] {
+        let resp = post_acl(port, "wm-fork-dt", action, "SECRET_TOKEN_2").await?;
+        assert_eq!(resp.status(), 401, "{action}: {}", resp.text().await?);
+    }
+    Ok(())
+}
+
+#[cfg(all(feature = "private", feature = "enterprise"))]
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn a_member_who_is_not_an_admin_cannot_change_access(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    for action in ["plan", "apply"] {
+        let resp = post_acl(port, "test-workspace", action, "SECRET_TOKEN_2").await?;
+        assert_eq!(resp.status(), 401, "{action}: {}", resp.text().await?);
+    }
+    Ok(())
+}
+
+/// Not even reading, and not even on a data table that is not under roles — which any member
+/// reaches, so only the edition stands between them and the instance's credentials.
+#[cfg(not(all(feature = "private", feature = "enterprise")))]
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn only_the_enterprise_edition_has_the_access_editor(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    sqlx::query(
+        "UPDATE workspace_settings
+         SET datatable = datatable #- '{datatables,main,permissions}'
+         WHERE workspace_id = 'test-workspace'",
+    )
+    .execute(&db)
+    .await?;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let read = reqwest::Client::new()
+        .get(format!(
+            "http://localhost:{port}/api/w/test-workspace/workspaces/datatable_acl/main?kind=database"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .send()
+        .await?;
+    let mut responses = vec![("read", read)];
+    for action in ["plan", "apply"] {
+        responses.push((
+            action,
+            post_acl(port, "test-workspace", action, "SECRET_TOKEN").await?,
+        ));
+    }
+    for (action, resp) in responses {
+        assert_eq!(resp.status(), 400, "{action}");
+        let body = resp.text().await?;
+        assert!(
+            body.contains("Data table roles are a Windmill Enterprise Edition feature"),
+            "{action}: {body}"
+        );
+    }
+    Ok(())
+}
@@ -391,7 +391,11 @@ async fn concurrent_role_creations_both_survive(db: Pool<Postgres>) -> anyhow::R
        assert_eq!(a.0, 200, "{}", a.1);
        assert_eq!(b.0, 200, "{}", b.1);

-        let catalog = windmill_common::datatable_roles::read_role_catalog(&db).await?;
+        let catalog = windmill_common::datatable_roles::read_role_catalog(
+            &db,
+            windmill_common::datatable_roles::DatatableRoleCluster::Instance,
+        )
+        .await?;
        let recorded: Vec<&str> = catalog.values().map(|r| r.name.as_str()).collect();
        for name in &names {
            assert!(
@@ -460,7 +464,11 @@ async fn a_role_delete_that_fails_part_way_leaves_the_role_disabled(
        let body = resp.text().await?;
        assert_eq!(status, 400, "{body}");

-        let catalog = windmill_common::datatable_roles::read_role_catalog(&db).await?;
+        let catalog = windmill_common::datatable_roles::read_role_catalog(
+            &db,
+            windmill_common::datatable_roles::DatatableRoleCluster::Instance,
+        )
+        .await?;
        let role = catalog
            .get(&id)
            .expect("a failed delete keeps the entry to retry");
@@ -912,6 +920,18 @@ async fn a_stored_name_containing_a_question_mark_resolves_as_itself(
        resolve("main?dt").await.is_err(),
        "an unknown parameter was ignored"
    );
+
+    sqlx::query(
+        "UPDATE workspace_settings
+         SET datatable = jsonb_set(datatable, '{datatables,main?role=analytics}', datatable->'datatables'->'main')
+         WHERE workspace_id = 'test-workspace'",
+    )
+    .execute(&db)
+    .await?;
+    assert!(
+        resolve("main?role=analytics").await.is_err(),
+        "a reference naming both a stored data table and a role on another resolved to one of them"
+    );
    Ok(())
 }

@@ -1009,6 +1029,70 @@ async fn an_entry_without_roles_cannot_newly_reach_a_database_under_roles(
    Ok(())
 }

+/// Browsing names the role it connects as, and a role the caller may not use is refused rather
+/// than quietly listed as the default. The refusal is decided before connecting, so the fixture's
+/// database never has to exist.
+#[cfg(all(feature = "private", feature = "enterprise"))]
+#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
+async fn browsing_as_a_role_the_caller_may_not_use_is_refused(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/test-workspace/workspaces");
+
+    // `test-user-2` is a tenant of `analytics` only.
+    let resp = authed(
+        client().get(format!(
+            "{base}/list_datatable_tables?role_for=main&role=admin"
+        )),
+        "SECRET_TOKEN_2",
+    )
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 200);
+    let body: Value = resp.json().await?;
+    let entry = body
+        .as_array()
+        .and_then(|a| a.iter().find(|e| e["datatable_name"] == "main"))
+        .expect("main is listed");
+    assert_eq!(entry["usable_roles"], json!(["analytics"]), "{entry}");
+    assert_eq!(entry["default_role"], "analytics", "{entry}");
+    assert_eq!(entry["permissioned"], true, "{entry}");
+    assert_eq!(entry["instance"], true, "{entry}");
+    let error = entry["error"].as_str().unwrap_or_default();
+    assert!(
+        error.contains("Not allowed to use role 'admin'"),
+        "listed as another role than the one asked for: {entry}"
+    );
+
+    let resp = authed(
+        client().get(format!(
+            "{base}/get_datatable_table_schema?datatable_name=main&schema_name=public&table_name=t&role=admin"
+        )),
+        "SECRET_TOKEN_2",
+    )
+    .send()
+    .await?;
+    let status = resp.status();
+    let text = resp.text().await?;
+    assert!(
+        text.contains("Not allowed to use role 'admin'"),
+        "{status}: {text}"
+    );
+
+    // A role means nothing without the data table it belongs to.
+    let resp = authed(
+        client().get(format!("{base}/list_datatable_tables?role=analytics")),
+        "SECRET_TOKEN_2",
+    )
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 400, "{}", resp.text().await?);
+    Ok(())
+}
+
 #[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
 async fn an_alias_saved_elsewhere_waits_for_roles_going_on_for_its_database(
    db: Pool<Postgres>,
@@ -311,121 +311,3 @@ async fn test_fork_keeps_only_resolvable_on_behalf_of(db: Pool<Postgres>) -> any

    Ok(())
 }
-
-/// Apps, schedules, triggers and their drafts cannot drop an identity the way scripts and flows
-/// do, so one naming nobody in the fork goes to its creator while one that still resolves stays.
-/// Forked as an admin, whose app policies the clone otherwise keeps.
-#[sqlx::test(migrations = "../migrations", fixtures("base"))]
-async fn test_fork_repoints_unresolvable_identities(db: Pool<Postgres>) -> anyhow::Result<()> {
-    initialize_tracing().await;
-
-    let server = ApiServer::start(db.clone()).await?;
-    let base_url = format!("http://localhost:{}/api", server.addr.port());
-
-    let stranger = json!({
-        "on_behalf_of": "u/test-user-2",
-        "on_behalf_of_email": "test2@windmill.dev",
-        "execution_mode": "publisher",
-    });
-    sqlx::query(
-        "INSERT INTO app (workspace_id, path, summary, policy, versions)
-         VALUES ('test-workspace', 'u/test-user/stranger', '', $1, '{}'),
-                ('test-workspace', 'u/test-user/group', '', $2, '{}')",
-    )
-    .bind(&stranger)
-    .bind(json!({
-        "on_behalf_of": "g/all",
-        "on_behalf_of_email": "group-all@windmill.dev",
-        "execution_mode": "publisher",
-    }))
-    .execute(&db)
-    .await?;
-    // The clone re-aggregates `versions` from `app_version`, and the column is NOT NULL.
-    sqlx::query(
-        "WITH v AS (
-            INSERT INTO app_version (app_id, value, created_by)
-            SELECT id, '{}'::json, 'test-user' FROM app WHERE workspace_id = 'test-workspace'
-            RETURNING id, app_id
-         )
-         UPDATE app SET versions = ARRAY[v.id] FROM v WHERE app.id = v.app_id",
-    )
-    .execute(&db)
-    .await?;
-    sqlx::query(
-        "INSERT INTO draft (workspace_id, path, typ, value, created_at, email)
-         VALUES ('test-workspace', 'u/test-user/stranger', 'raw_app', $1::json, NOW(), 'test@windmill.dev'),
-                ('test-workspace', 'u/test-user/stranger', 'trigger_websocket', $2::json, NOW(), 'test@windmill.dev'),
-                ('test-workspace', 'u/test-user/nul', 'raw_app', $3::json, NOW(), 'test@windmill.dev')",
-    )
-    .bind(json!({ "policy": stranger }))
-    .bind(json!({ "permissioned_as": "u/test-user-2" }))
-    // Saved before drafts were stripped of NULs: any jsonb parse of it raises, so it must be
-    // skipped rather than abort the fork. Built from parts because a NUL escape can't sit in source.
-    .bind(format!(
-        r#"{{"policy":{{"on_behalf_of":"u/test-user-2"}},"files":{{"f":"a{}u0000"}}}}"#,
-        "\\"
-    ))
-    .execute(&db)
-    .await?;
-    sqlx::query(
-        "INSERT INTO schedule (workspace_id, path, edited_by, schedule, script_path, email, permissioned_as, enabled)
-         VALUES ('test-workspace', 'u/test-user/stranger', 'test-user', '0 0 * * * *', 'u/test-user/s', 'test2@windmill.dev', 'u/test-user-2', false)",
-    )
-    .execute(&db)
-    .await?;
-    sqlx::query(
-        "INSERT INTO websocket_trigger (workspace_id, path, url, script_path, is_flow, edited_by, permissioned_as, mode)
-         VALUES ('test-workspace', 'u/test-user/stranger', 'ws://localhost', 'u/test-user/s', false, 'test-user', 'u/test-user-2', 'disabled')",
-    )
-    .execute(&db)
-    .await?;
-
-    let resp = reqwest::Client::new()
-        .post(format!(
-            "{base_url}/w/test-workspace/workspaces/create_fork"
-        ))
-        .header("Authorization", "Bearer SECRET_TOKEN")
-        .json(&json!({ "id": "wm-fork-repoint", "name": "Fork", "color": "#0000ff" }))
-        .send()
-        .await?;
-    assert!(
-        resp.status().is_success(),
-        "creating the fork: {}",
-        resp.text().await?
-    );
-
-    let text = |sql: &'static str| sqlx::query_scalar::<_, String>(sql).fetch_one(&db);
-    assert_eq!(
-        text("SELECT (policy->>'on_behalf_of') || ' ' || (policy->>'on_behalf_of_email') FROM app WHERE workspace_id = 'wm-fork-repoint' AND path = 'u/test-user/stranger'").await?,
-        "u/test-user test@windmill.dev"
-    );
-    assert_eq!(
-        text("SELECT policy->>'on_behalf_of' FROM app WHERE workspace_id = 'wm-fork-repoint' AND path = 'u/test-user/group'").await?,
-        "g/all"
-    );
-    assert_eq!(
-        text("SELECT value->'policy'->>'on_behalf_of' FROM draft WHERE workspace_id = 'wm-fork-repoint' AND path = 'u/test-user/stranger' AND typ = 'raw_app'").await?,
-        "u/test-user"
-    );
-    assert_eq!(
-        text("SELECT CASE WHEN strpos(value::text, 'u/test-user-2') > 0 THEN 'kept' ELSE 'rewritten' END FROM draft WHERE workspace_id = 'wm-fork-repoint' AND path = 'u/test-user/nul'").await?,
-        "kept"
-    );
-    assert_eq!(
-        text("SELECT value->>'permissioned_as' FROM draft WHERE workspace_id = 'wm-fork-repoint' AND typ = 'trigger_websocket'").await?,
-        "u/test-user"
-    );
-    assert_eq!(
-        text("SELECT permissioned_as || ' ' || email FROM schedule WHERE workspace_id = 'wm-fork-repoint'").await?,
-        "u/test-user test@windmill.dev"
-    );
-    assert_eq!(
-        text(
-            "SELECT permissioned_as FROM websocket_trigger WHERE workspace_id = 'wm-fork-repoint'"
-        )
-        .await?,
-        "u/test-user"
-    );
-
-    Ok(())
-}
@@ -1,75 +0,0 @@
-use serde_json::json;
-use sqlx::{Pool, Postgres};
-
-use windmill_test_utils::*;
-
-/// With `add_admins_and_developers_to_forks` on, a fork starts with the parent's admins and
-/// developers at their parent role, even when a developer forks it; operators are left out. The
-/// copies are manual members: a parent membership that came from an instance group must not carry
-/// that provenance into a fork that does not configure the group.
-#[sqlx::test(migrations = "../migrations", fixtures("base"))]
-async fn test_fork_adds_parent_admins_and_developers(db: Pool<Postgres>) -> anyhow::Result<()> {
-    initialize_tracing().await;
-    let server = ApiServer::start(db.clone()).await?;
-    let base_url = format!(
-        "http://localhost:{}/api/w/test-workspace/workspaces",
-        server.addr.port()
-    );
-    let client = reqwest::Client::new();
-
-    sqlx::query(
-        "UPDATE usr SET operator = true WHERE workspace_id = 'test-workspace' AND username = 'test-user-3'",
-    )
-    .execute(&db)
-    .await?;
-    sqlx::query(
-        "INSERT INTO usr (workspace_id, email, username, is_admin, added_via)
-         VALUES ('test-workspace', 'test4@windmill.dev', 'test-user-4', false,
-                 '{\"source\": \"instance_group\", \"group\": \"devs\"}')",
-    )
-    .execute(&db)
-    .await?;
-
-    let resp = client
-        .post(format!(
-            "{base_url}/edit_add_admins_and_developers_to_forks"
-        ))
-        .header("Authorization", "Bearer SECRET_TOKEN")
-        .json(&json!({ "add_admins_and_developers_to_forks": true }))
-        .send()
-        .await?;
-    assert!(
-        resp.status().is_success(),
-        "enabling the setting: {}",
-        resp.text().await?
-    );
-
-    let resp = client
-        .post(format!("{base_url}/create_fork"))
-        .header("Authorization", "Bearer SECRET_TOKEN_2")
-        .json(&json!({ "id": "wm-fork-team", "name": "Team fork" }))
-        .send()
-        .await?;
-    assert!(
-        resp.status().is_success(),
-        "creating the fork: {}",
-        resp.text().await?
-    );
-
-    let members: Vec<(String, bool, bool)> = sqlx::query_as(
-        "SELECT username, is_admin, added_via IS NULL FROM usr
-         WHERE workspace_id = 'wm-fork-team' ORDER BY username",
-    )
-    .fetch_all(&db)
-    .await?;
-    assert_eq!(
-        members,
-        vec![
-            ("test-user".to_string(), true, true),
-            ("test-user-2".to_string(), false, true),
-            ("test-user-4".to_string(), false, true),
-        ]
-    );
-
-    Ok(())
-}
@@ -115,60 +115,6 @@ async fn login_link_is_single_use_and_same_origin(db: Pool<Postgres>) -> anyhow:
    Ok(())
 }

-#[sqlx::test(migrations = "../migrations", fixtures("base"))]
-async fn confirmed_login_link_is_spent_by_the_click_not_the_page(
-    db: Pool<Postgres>,
-) -> anyhow::Result<()> {
-    initialize_tracing().await;
-    let server = ApiServer::start(db.clone()).await?;
-    let port = server.addr.port();
-    let base = format!("http://localhost:{port}/api");
-
-    let resp = client()
-        .post(format!("{base}/users/login_links"))
-        .header("Authorization", "Bearer SECRET_TOKEN")
-        .json(&json!({"email": "test2@windmill.dev", "confirm": true}))
-        .send()
-        .await?;
-    assert_eq!(resp.status(), 201);
-    let link = resp.json::<serde_json::Value>().await?;
-    // The URL handed out is the frontend page, not the API path that signs in on a GET.
-    let token = link["url"]
-        .as_str()
-        .unwrap()
-        .split_once("/user/login_link?token=")
-        .expect("confirmation page url")
-        .1
-        .to_string();
-
-    let confirm = || {
-        client()
-            .post(format!("{base}/auth/login_link/{token}"))
-            .send()
-    };
-    let resp = confirm().await?;
-    assert_eq!(resp.status(), 200);
-    assert!(resp
-        .headers()
-        .get_all("set-cookie")
-        .iter()
-        .any(|c| c.to_str().unwrap().starts_with("token=")));
-    assert_eq!(
-        resp.json::<serde_json::Value>().await?["location"],
-        "/user/workspaces"
-    );
-
-    let resp = confirm().await?;
-    assert_eq!(resp.status(), 200);
-    assert!(resp.headers().get("set-cookie").is_none());
-    assert_eq!(
-        resp.json::<serde_json::Value>().await?["location"],
-        "/user/login_link_expired?reason=used"
-    );
-
-    Ok(())
-}
-
 #[sqlx::test(migrations = "../migrations", fixtures("base"))]
 async fn login_link_mint_can_require_a_login_type(db: Pool<Postgres>) -> anyhow::Result<()> {
    initialize_tracing().await;
@@ -1,239 +0,0 @@
-//! `max_token_expiration_days`: the instance-wide ceiling on how far ahead a token a caller
-//! picks the lifetime of may expire, and the service-account exemption.
-
-use serde_json::json;
-use sqlx::types::chrono::{DateTime, Utc};
-use sqlx::{Pool, Postgres};
-use windmill_test_utils::*;
-
-const DAY: u64 = 24 * 60 * 60;
-
-fn client() -> reqwest::Client {
-    reqwest::Client::new()
-}
-
-fn from_now(secs: u64) -> DateTime<Utc> {
-    Utc::now() + std::time::Duration::from_secs(secs)
-}
-
-async fn set_max(db: &Pool<Postgres>, value: serde_json::Value) {
-    sqlx::query(
-        "INSERT INTO global_settings (name, value) VALUES ('max_token_expiration_days', $1)
-         ON CONFLICT (name) DO UPDATE SET value = EXCLUDED.value",
-    )
-    .bind(value)
-    .execute(db)
-    .await
-    .unwrap();
-}
-
-/// Mints as `test2@windmill.dev`, a plain member of `test-workspace`.
-async fn create_token(port: u16, body: serde_json::Value) -> reqwest::Response {
-    client()
-        .post(format!("http://localhost:{port}/api/users/tokens/create"))
-        .header("Authorization", "Bearer SECRET_TOKEN_2")
-        .json(&body)
-        .send()
-        .await
-        .unwrap()
-}
-
-async fn stored_expiration(db: &Pool<Postgres>, label: &str) -> Option<DateTime<Utc>> {
-    sqlx::query_scalar::<_, Option<DateTime<Utc>>>("SELECT expiration FROM token WHERE label = $1")
-        .bind(label)
-        .fetch_one(db)
-        .await
-        .unwrap()
-}
-
-#[sqlx::test(migrations = "../migrations", fixtures("base"))]
-async fn test_max_token_expiration_days_shortens_user_tokens(
-    db: Pool<Postgres>,
-) -> anyhow::Result<()> {
-    initialize_tracing().await;
-    let server = ApiServer::start(db.clone()).await?;
-    let port = server.addr.port();
-
-    let resp = create_token(port, json!({ "label": "unset" })).await;
-    assert_eq!(resp.status(), 201);
-    assert_eq!(
-        stored_expiration(&db, "unset").await,
-        None,
-        "with no setting a token may still have no expiration"
-    );
-
-    // Refused at write time: the token routes can only read a value they cannot parse as no
-    // ceiling at all.
-    let resp = client()
-        .post(format!(
-            "http://localhost:{port}/api/settings/global/max_token_expiration_days"
-        ))
-        .header("Authorization", "Bearer SECRET_TOKEN")
-        .json(&json!({ "value": 7.5 }))
-        .send()
-        .await?;
-    assert_eq!(resp.status(), 400);
-
-    set_max(&db, json!(7)).await;
-
-    // The token form reads the ceiling as whoever is creating the token, usually not a
-    // superadmin, so it can offer only expirations the server would keep.
-    let resp = client()
-        .get(format!(
-            "http://localhost:{port}/api/settings/global/max_token_expiration_days"
-        ))
-        .header("Authorization", "Bearer SECRET_TOKEN_2")
-        .send()
-        .await?;
-    assert_eq!(resp.status(), 200);
-    assert_eq!(resp.text().await?, "7");
-
-    let resp = create_token(port, json!({ "label": "none asked" })).await;
-    assert_eq!(resp.status(), 201);
-    let expiration = stored_expiration(&db, "none asked")
-        .await
-        .expect("a token asking for no expiration gets the ceiling");
-    assert!(
-        expiration > from_now(6 * DAY) && expiration <= from_now(7 * DAY),
-        "expected the 7 day ceiling, got {expiration}"
-    );
-
-    let resp = create_token(
-        port,
-        json!({ "label": "past the ceiling", "expiration": from_now(30 * DAY) }),
-    )
-    .await;
-    assert_eq!(resp.status(), 201);
-    let expiration = stored_expiration(&db, "past the ceiling").await.unwrap();
-    assert!(
-        expiration > from_now(6 * DAY) && expiration <= from_now(7 * DAY),
-        "expected an expiration past the ceiling to be shortened to it, got {expiration}"
-    );
-
-    let resp = create_token(
-        port,
-        json!({ "label": "within", "expiration": from_now(3 * DAY) }),
-    )
-    .await;
-    assert_eq!(resp.status(), 201);
-    let expiration = stored_expiration(&db, "within").await.unwrap();
-    assert!(
-        expiration <= from_now(3 * DAY),
-        "an expiration within the ceiling must be kept, got {expiration}"
-    );
-
-    // The settings UI stores an integer, but the YAML instance config and config sync can write
-    // the same whole number as a string or as `5.0`. Reading either as "unset" would silently
-    // drop the ceiling, while the token form (`parseMaxTokenExpirationDays`) still showed it.
-    for (stored, label) in [
-        (json!("5"), "string setting"),
-        (json!(5.0), "float setting"),
-    ] {
-        set_max(&db, stored).await;
-        let resp = create_token(port, json!({ "label": label })).await;
-        assert_eq!(resp.status(), 201);
-        let expiration = stored_expiration(&db, label).await;
-        assert!(
-            expiration.is_some_and(|e| e > from_now(4 * DAY) && e <= from_now(5 * DAY)),
-            "{label}: expected the 5 day ceiling, got {expiration:?}"
-        );
-    }
-
-    // A superadmin impersonating a user picks the lifetime too, so the ceiling applies there;
-    // left out, it would be the one way to mint a token that never expires.
-    let resp = client()
-        .post(format!(
-            "http://localhost:{port}/api/users/tokens/impersonate"
-        ))
-        .header("Authorization", "Bearer SECRET_TOKEN")
-        .json(&json!({ "label": "impersonated", "impersonate_email": "test3@windmill.dev" }))
-        .send()
-        .await?;
-    assert_eq!(resp.status(), 201);
-    assert!(
-        stored_expiration(&db, "impersonated").await.is_some(),
-        "an impersonation token asking for no expiration gets the ceiling"
-    );
-
-    Ok(())
-}
-
-#[sqlx::test(migrations = "../migrations", fixtures("base"))]
-async fn test_service_accounts_are_exempt(db: Pool<Postgres>) -> anyhow::Result<()> {
-    initialize_tracing().await;
-    let server = ApiServer::start(db.clone()).await?;
-    let port = server.addr.port();
-
-    set_max(&db, json!(7)).await;
-    // The same email is a service account in one workspace and an ordinary user in another.
-    sqlx::query(
-        "UPDATE usr SET is_service_account = true
-         WHERE email = 'test2@windmill.dev' AND workspace_id = 'test-workspace'",
-    )
-    .execute(&db)
-    .await?;
-    sqlx::query("INSERT INTO workspace (id, name, owner) VALUES ('other', 'other', 'test-user')")
-        .execute(&db)
-        .await?;
-    sqlx::query("INSERT INTO workspace_settings (workspace_id) VALUES ('other')")
-        .execute(&db)
-        .await?;
-    sqlx::query(
-        "INSERT INTO usr (workspace_id, email, username, is_admin, role)
-         VALUES ('other', 'test2@windmill.dev', 'test-user-2', false, 'User')",
-    )
-    .execute(&db)
-    .await?;
-
-    // The token form decides the exemption from this list, so it must carry each membership's flag.
-    let memberships: serde_json::Value = client()
-        .get(format!("http://localhost:{port}/api/workspaces/users"))
-        .header("Authorization", "Bearer SECRET_TOKEN_2")
-        .send()
-        .await?
-        .json()
-        .await?;
-    for (workspace, is_service_account) in [("test-workspace", true), ("other", false)] {
-        let membership = memberships["workspaces"]
-            .as_array()
-            .and_then(|ws| ws.iter().find(|w| w["id"] == workspace))
-            .unwrap_or_else(|| panic!("{workspace} missing from {memberships}"));
-        assert_eq!(membership["is_service_account"], json!(is_service_account));
-    }
-
-    for (label, workspace_id, exempt) in [
-        ("own workspace", Some("test-workspace"), true),
-        ("other workspace", Some("other"), false),
-        // A workspace-less token has no workspace to match, so a service account anywhere counts.
-        ("global", None, true),
-    ] {
-        let resp = create_token(
-            port,
-            json!({ "label": label, "workspace_id": workspace_id }),
-        )
-        .await;
-        assert_eq!(resp.status(), 201);
-        assert_eq!(
-            stored_expiration(&db, label).await.is_none(),
-            exempt,
-            "{label}: expected exempt = {exempt}"
-        );
-    }
-
-    // Impersonation checks the impersonated account, not the superadmin minting the token.
-    let resp = client()
-        .post(format!(
-            "http://localhost:{port}/api/users/tokens/impersonate"
-        ))
-        .header("Authorization", "Bearer SECRET_TOKEN")
-        .json(&json!({ "label": "impersonated service account", "impersonate_email": "test2@windmill.dev" }))
-        .send()
-        .await?;
-    assert_eq!(resp.status(), 201);
-    assert_eq!(
-        stored_expiration(&db, "impersonated service account").await,
-        None
-    );
-
-    Ok(())
-}
@@ -1,102 +0,0 @@
-//! The `mcp_disable_token_query_param` switch closes the URL-borne credential path.
-//!
-//! The rejection is a middleware layered between the `WWW-Authenticate` decorator and
-//! everything that reads a token, on both the workspaced and the gateway mount. Each half of
-//! that sandwich is pinned: the `WWW-Authenticate` header on the refusal catches the layer
-//! being moved outward (a client would lose the pointer that starts OAuth discovery), and
-//! refusing a token that was never valid catches it being moved inward past authentication
-//! (the URL-borne token would be hashed and looked up before anything refused it).
-#![cfg(feature = "mcp")]
-
-use std::sync::atomic::Ordering;
-
-use serde_json::json;
-use sqlx::{Pool, Postgres};
-
-use windmill_common::global_settings::MCP_DISABLE_TOKEN_QUERY_PARAM;
-use windmill_test_utils::*;
-
-/// Workspace-less with an `mcp:` scope, which is what the gateway mount requires; the
-/// workspaced mount takes its workspace from the path, so one token reaches both.
-async fn insert_mcp_token(db: &Pool<Postgres>) -> anyhow::Result<()> {
-    sqlx::query(
-        "INSERT INTO token (token_hash, token_prefix, token, email, label, super_admin, scopes)
-         VALUES (encode(sha256('MCP_TOKEN'::bytea), 'hex'), 'MCP_TOK', 'MCP_TOKEN', 'test@windmill.dev', 'mcp token', true, ARRAY['mcp:all'])",
-    )
-    .execute(db)
-    .await?;
-    Ok(())
-}
-
-/// A token that is not in `token` at all. Authentication would refuse it on its own, so a
-/// refusal carrying the middleware's own wording is evidence nothing looked it up first.
-const BOGUS_TOKEN: &str = "NOT_A_REAL_TOKEN";
-
-async fn tools_list(url: &str) -> anyhow::Result<reqwest::Response> {
-    Ok(reqwest::Client::new()
-        .post(url)
-        .header("Accept", "application/json, text/event-stream")
-        .json(&json!({ "jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": {} }))
-        .send()
-        .await?)
-}
-
-#[sqlx::test(migrations = "../migrations", fixtures("base"))]
-async fn test_mcp_token_query_param_switch(db: Pool<Postgres>) -> anyhow::Result<()> {
-    initialize_tracing().await;
-    set_jwt_secret().await;
-    insert_mcp_token(&db).await?;
-    let server = ApiServer::start_mcp(db.clone()).await?;
-    let port = server.addr.port();
-    let workspaced =
-        format!("http://localhost:{port}/api/mcp/w/test-workspace/mcp?token=MCP_TOKEN");
-    let gateway = format!("http://localhost:{port}/api/mcp/gateway?token=MCP_TOKEN");
-
-    assert_eq!(
-        tools_list(&workspaced).await?.status(),
-        200,
-        "a URL-borne token is the documented default and must keep working while the switch is off"
-    );
-    assert_eq!(tools_list(&gateway).await?.status(), 200);
-
-    MCP_DISABLE_TOKEN_QUERY_PARAM.store(true, Ordering::Relaxed);
-
-    for url in [&workspaced, &gateway] {
-        let resp = tools_list(url).await?;
-        assert_eq!(
-            resp.status(),
-            401,
-            "{url} still admitted a token in the URL"
-        );
-        // What sends the client into the OAuth flow rather than leaving it stuck on a 401.
-        assert!(
-            resp.headers().contains_key("www-authenticate"),
-            "{url} rejected without pointing at the authorization server"
-        );
-    }
-
-    // Refused before authentication, not after: an invalid token gets the middleware's own
-    // message rather than the generic 401 that looking it up would produce.
-    let resp = tools_list(&format!(
-        "http://localhost:{port}/api/mcp/w/test-workspace/mcp?token={BOGUS_TOKEN}"
-    ))
-    .await?;
-    assert_eq!(resp.status(), 401);
-    assert!(
-        resp.text().await?.contains("does not accept a token in the MCP URL"),
-        "an invalid URL token was answered by authentication, so the token was read before \
-         the switch refused it"
-    );
-
-    // The header stays open: it is the channel the OAuth flow itself hands tokens over on.
-    let resp = reqwest::Client::new()
-        .post(format!("http://localhost:{port}/api/mcp/gateway"))
-        .header("Accept", "application/json, text/event-stream")
-        .header("Authorization", "Bearer MCP_TOKEN")
-        .json(&json!({ "jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": {} }))
-        .send()
-        .await?;
-    assert_eq!(resp.status(), 200);
-
-    Ok(())
-}
@@ -1,49 +0,0 @@
-//! Which user tokens get an "expiring soon" warning queued when they are created.
-
-use serde_json::json;
-use sqlx::types::chrono::Utc;
-use sqlx::{Pool, Postgres};
-use windmill_test_utils::*;
-
-const DAY: u64 = 24 * 60 * 60;
-
-async fn warning_queued(db: &Pool<Postgres>, label: &str) -> bool {
-    sqlx::query_scalar::<_, bool>(
-        "SELECT EXISTS(SELECT 1 FROM token_expiry_notification n
-            JOIN token t ON t.token_hash = n.token_hash WHERE t.label = $1)",
-    )
-    .bind(label)
-    .fetch_one(db)
-    .await
-    .unwrap()
-}
-
-#[sqlx::test(migrations = "../migrations", fixtures("base"))]
-async fn test_short_lived_tokens_get_no_expiry_warning(db: Pool<Postgres>) -> anyhow::Result<()> {
-    initialize_tracing().await;
-    let server = ApiServer::start(db.clone()).await?;
-    let port = server.addr.port();
-
-    for (label, lifetime) in [("short", DAY), ("long", 30 * DAY)] {
-        let resp = reqwest::Client::new()
-            .post(format!("http://localhost:{port}/api/users/tokens/create"))
-            .header("Authorization", "Bearer SECRET_TOKEN_2")
-            .json(&json!({
-                "label": label,
-                "expiration": Utc::now() + std::time::Duration::from_secs(lifetime),
-            }))
-            .send()
-            .await?;
-        assert_eq!(resp.status(), 201);
-    }
-
-    assert!(
-        !warning_queued(&db, "short").await,
-        "a token whose whole lifetime fits in the warning window must not be warned about"
-    );
-    assert!(
-        warning_queued(&db, "long").await,
-        "a longer-lived token still gets its warning"
-    );
-    Ok(())
-}
@@ -275,67 +275,6 @@ async fn test_encryption_key_rotation_dispatches_batched_git_sync(
    Ok(())
 }

-/// Stored repository tokens and webhook secrets are encrypted under the
-/// workspace key but never synced, so a rotation has to carry them over even
-/// when the caller skips re-encrypting variables.
-#[sqlx::test(migrations = "../migrations", fixtures("base"))]
-async fn test_encryption_key_rotation_reencrypts_git_sync_secrets(
-    db: Pool<Postgres>,
-) -> anyhow::Result<()> {
-    use windmill_common::variables::{build_crypt, crypt_from_key_with_suffix, decrypt, encrypt};
-    initialize_tracing().await;
-
-    create_folder(&db, "28103").await?;
-    create_git_repo_resource(&db).await?;
-    let sync_script_path = "f/28103/test_sync_script_git_secrets";
-    create_sync_script(&db, sync_script_path).await?;
-    setup_git_sync_config(&db, sync_script_path).await?;
-
-    let mc = build_crypt(&db, "test-workspace").await?;
-    sqlx::query(
-        r#"
-        UPDATE workspace_settings SET
-            git_credentials = jsonb_build_array(jsonb_build_object(
-                'token', $1::text, 'repo_identity', 'https://gitlab.example.com/grp/proj')),
-            git_sync = jsonb_set(git_sync, '{repositories,0,auto_pull}', jsonb_build_object(
-                'enabled', true, 'mode', 'webhook', 'webhook_id', 1, 'webhook_secret', $2::text))
-        WHERE workspace_id = 'test-workspace'
-        "#,
-    )
-    .bind(encrypt(&mc, "stored-token"))
-    .bind(encrypt(&mc, "hook-secret"))
-    .execute(&db)
-    .await?;
-
-    let server = ApiServer::start(db.clone()).await?;
-    let port = server.addr.port();
-    let base = format!("http://localhost:{port}/api/w/test-workspace/workspaces");
-
-    let new_key = "c".repeat(64);
-    let resp = authed(client().post(format!("{base}/encryption_key")))
-        .json(&json!({"new_key": new_key, "skip_reencrypt": true}))
-        .send()
-        .await?;
-    assert_eq!(
-        resp.status(),
-        200,
-        "set_encryption_key failed: {}",
-        resp.text().await?
-    );
-
-    let (token, secret): (String, String) = sqlx::query_as(
-        "SELECT git_credentials->0->>'token', git_sync#>>'{repositories,0,auto_pull,webhook_secret}'
-         FROM workspace_settings WHERE workspace_id = 'test-workspace'",
-    )
-    .fetch_one(&db)
-    .await?;
-    let new_mc = crypt_from_key_with_suffix(&new_key, "");
-    assert_eq!(decrypt(&new_mc, token)?, "stored-token");
-    assert_eq!(decrypt(&new_mc, secret)?, "hook-secret");
-
-    Ok(())
-}
-
 /// Regression test for the non-debouncing fallback: a workspace whose sync
 /// script predates hub version 28103 must still receive git-sync jobs for the
 /// encryption_key entry and every re-encrypted secret. Before the fallback was
@@ -1166,47 +1166,3 @@ async fn test_create_service_account_drops_orphaned_group_memberships(

    Ok(())
 }
-
-#[cfg(feature = "private")]
-#[sqlx::test(migrations = "../migrations", fixtures("base"))]
-async fn test_edit_auto_invite_preserves_instance_groups(db: Pool<Postgres>) -> anyhow::Result<()> {
-    initialize_tracing().await;
-
-    sqlx::query(
-        r#"UPDATE workspace_settings
-           SET auto_invite = '{"instance_groups": ["eng"], "instance_groups_roles": {"eng": "developer"}}'
-           WHERE workspace_id = 'test-workspace'"#,
-    )
-    .execute(&db)
-    .await?;
-
-    let server = ApiServer::start(db.clone()).await?;
-    let port = server.addr.port();
-    let base = format!("http://localhost:{port}/api/w/test-workspace/workspaces");
-
-    // enable, then disable
-    for body in [
-        json!({"operator": false, "invite_all": true, "auto_add": false}),
-        json!({}),
-    ] {
-        let resp = authed(client().post(format!("{base}/edit_auto_invite")))
-            .json(&body)
-            .send()
-            .await?;
-        assert_eq!(resp.status(), 200, "{body}: {}", resp.text().await?);
-
-        let auto_invite: serde_json::Value = sqlx::query_scalar(
-            "SELECT auto_invite FROM workspace_settings WHERE workspace_id = 'test-workspace'",
-        )
-        .fetch_one(&db)
-        .await?;
-        assert_eq!(auto_invite["instance_groups"], json!(["eng"]), "{body}");
-        assert_eq!(
-            auto_invite["instance_groups_roles"],
-            json!({"eng": "developer"}),
-            "{body}"
-        );
-    }
-
-    Ok(())
-}
@@ -26,9 +26,7 @@ use windmill_api_auth::{check_scopes, get_scope_tags, ApiAuthed};
 use windmill_common::{
    db::{UserDB, UserDbWithAuthed},
    error::{self, Error},
-    flow_conversations::{
-        add_message_to_conversation_tx, message_attachments, MessageExtras, MessageType,
-    },
+    flow_conversations::{add_message_to_conversation_tx, MessageType},
    get_latest_flow_version_info_for_path,
    jobs::{
        check_tag_available_for_workspace_internal, format_result, script_path_to_payload,
@@ -655,11 +653,9 @@ pub async fn set_flow_memory_id(
 pub async fn process_flow_run_query_params(
    tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
    job_id: Uuid,
-    w_id: &str,
-    flow_path: &str,
    run_query: &RunJobQuery,
 ) -> error::Result<()> {
-    if let Some(memory_id) = run_query.memory_key(w_id, flow_path) {
+    if let Some(memory_id) = run_query.memory_id {
        set_flow_memory_id(tx, job_id, memory_id).await?;
    }
    Ok(())
@@ -673,13 +669,10 @@ pub async fn handle_chat_conversation_messages(
    run_query: &RunJobQuery,
    user_message_raw: Option<&Box<serde_json::value::RawValue>>,
    job_id: Uuid,
-    is_test: bool,
-    // The run's args, for the files the message carried.
-    args: &HashMap<String, Box<serde_json::value::RawValue>>,
 ) -> error::Result<()> {
    // Names the query parameter rather than the field: it is not a flow argument, and
    // supplying it as one is the first thing tried on reading `memory_id is required`.
-    let memory_id = run_query.memory_key(w_id, flow_path).ok_or_else(|| {
+    let memory_id = run_query.memory_id.ok_or_else(|| {
        windmill_common::error::Error::BadRequest(
            "memory_id is required for chat-enabled flows. Pass it as the `memory_id` query \
             parameter, not as a flow argument: it names the conversation the turn belongs to, \
@@ -708,12 +701,11 @@ pub async fn handle_chat_conversation_messages(
        &authed.username,
        &user_message,
        memory_id,
-        is_test,
    )
    .await?;

-    // The run this message started. The row keeps the files the message carried as
-    // references; its args are the only record of every other flow input, and nothing
+    // The run this message started. Its args are the only record of what the message
+    // carried besides its text — attachments and every other flow input — and nothing
    // written later points at them: an assistant row holds the AI agent step's job.
    add_message_to_conversation_tx(
        tx,
@@ -723,7 +715,6 @@ pub async fn handle_chat_conversation_messages(
        MessageType::User,
        None,
        true,
-        Some(&MessageExtras { attachments: message_attachments(args), ..Default::default() }),
    )
    .await?;

@@ -831,7 +822,7 @@ pub async fn run_flow<'c>(
    .await?;

    // Set memory_id if provided (for agent memory)
-    if let Some(memory_id) = run_query.memory_key(w_id, flow_path) {
+    if let Some(memory_id) = run_query.memory_id {
        set_flow_memory_id(&mut tx, uuid, memory_id).await?;
    }

@@ -845,8 +836,6 @@ pub async fn run_flow<'c>(
            &run_query,
            args.args.get("user_message"),
            uuid,
-            false,
-            &args.args,
        )
        .await?;
    }
@@ -47,25 +47,13 @@ pub struct RunJobQuery {
    pub cache_ignore_s3_path: Option<bool>,
    pub skip_preprocessor: Option<bool>,
    pub poll_delay_ms: Option<u64>,
-    /// Any string; see [`RunJobQuery::memory_key`].
-    pub memory_id: Option<String>,
+    pub memory_id: Option<Uuid>,
    pub trigger_external_id: Option<String>,
    pub service_name: Option<String>,
    pub suspended_mode: Option<bool>,
 }

 impl RunJobQuery {
-    /// The memory id as stored in `flow_status.memory_id`: a uuid is kept, any other string hashed
-    /// within the workspace and the flow being run.
-    pub fn memory_key(&self, workspace_id: &str, flow_path: &str) -> Option<Uuid> {
-        self.memory_id
-            .as_deref()
-            .filter(|memory_id| !memory_id.trim().is_empty())
-            .map(|memory_id| {
-                windmill_common::flow_conversations::memory_key(workspace_id, flow_path, memory_id)
-            })
-    }
-
    pub async fn get_scheduled_for(
        &self,
        db: &DB,
@@ -60,11 +60,10 @@ use windmill_common::{
    global_settings::{
        AI_CONFIG_SETTING, APP_WORKSPACED_ROUTE_SETTING, AUTOMATE_USERNAME_CREATION_SETTING,
        CRITICAL_ALERT_MUTE_UI_SETTING, CUSTOM_TAGS_SETTING, DEFAULT_TAGS_WORKSPACES_SETTING,
-        DISABLE_HUB_SETTING, EMAIL_DOMAIN_SETTING, ENV_SETTINGS,
+        DISABLE_HUB_SETTING, EMAIL_DOMAIN_SETTING, ENV_SETTINGS, EXTERNAL_INSTANCE_PG_SETTING,
        GITHUB_APP_WEBHOOK_BASE_URL_SETTING, HTTP_ROUTE_DEFAULT_ALLOWED_ORIGINS_SETTING,
        HTTP_ROUTE_WORKSPACED_ROUTE_SETTING, HUB_ACCESSIBLE_URL_SETTING, HUB_BASE_URL_SETTING,
        INSTANCE_BANNER_SETTING, MAX_RETENTION_OVERRIDE_WORKSPACES,
-        MAX_TOKEN_EXPIRATION_DAYS_SETTING, MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING,
        RETENTION_PERIOD_SECS_OVERRIDES_SETTING, RUFF_CONFIG_SETTING, UNIQUE_ID_SETTING,
        WORKSPACE_FAIRNESS_DURATION_SECS_SETTING, WORKSPACE_FAIRNESS_ENABLED_SETTING,
        WORKSPACE_FAIRNESS_MAX_PERCENT_SETTING, WORKSPACE_FAIRNESS_MIN_TOTAL_SETTING,
@@ -169,6 +168,22 @@ pub fn global_service() -> Router {
            "/refresh_custom_instance_user_pwd",
            post(refresh_custom_instance_user_pwd),
        )
+        .route(
+            "/external_instance_pg/status",
+            get(get_external_instance_pg_status),
+        )
+        .route(
+            "/external_instance_pg/setup",
+            post(setup_external_instance_pg),
+        )
+        .route(
+            "/external_instance_pg/databases",
+            get(list_external_instance_pg_databases),
+        )
+        .route(
+            "/external_instance_pg/databases/{name}",
+            post(create_external_instance_pg_database).delete(drop_external_instance_pg_database),
+        )
        .route(
            "/setup_custom_instance_pg_database/{name}",
            post(setup_custom_instance_pg_database),
@@ -878,6 +893,14 @@ pub async fn set_global_setting_internal(
        )));
    }

+    if key == EXTERNAL_INSTANCE_PG_SETTING {
+        return windmill_common::external_instance_pg::write_external_instance_pg_setting(
+            db,
+            Some(&value),
+        )
+        .await;
+    }
+
    run_setting_pre_write_hook(db, &key, &value).await?;

    match value {
@@ -1196,12 +1219,6 @@ async fn run_setting_pre_write_hook(
                }
            }
        }
-        MAX_TOKEN_EXPIRATION_DAYS_SETTING => {
-            windmill_common::global_settings::parse_max_token_expiration_days(Some(value))
-                .map_err(|e| {
-                    error::Error::BadRequest(format!("{MAX_TOKEN_EXPIRATION_DAYS_SETTING}: {e}"))
-                })?;
-        }
        INSTANCE_BANNER_SETTING => {
            match value {
                // Clearing (delete row) is handled by the caller; allow it through.
@@ -1265,7 +1282,7 @@ async fn set_instance_config(
    let desired_map = desired.global_settings.to_settings_map();
    if !desired_map.is_empty() {
        let current_map = current.global_settings.to_settings_map();
-        let settings_diff =
+        let mut settings_diff =
            instance_config::diff_global_settings(&current_map, &desired_map, ApplyMode::Merge);
        let ai_config_changed = settings_diff
            .upserts
@@ -1294,8 +1311,15 @@ async fn set_instance_config(
        }

        for (key, value) in &settings_diff.upserts {
-            run_setting_pre_write_hook(&db, key, value).await?;
+            if key != EXTERNAL_INSTANCE_PG_SETTING {
+                run_setting_pre_write_hook(&db, key, value).await?;
+            }
        }
+        windmill_common::external_instance_pg::write_external_instance_pg_from_diff(
+            &db,
+            &mut settings_diff,
+        )
+        .await?;

        instance_config::apply_settings_diff(&db, &settings_diff)
            .await
@@ -1363,12 +1387,6 @@ pub async fn get_global_setting(
        && key != HTTP_ROUTE_DEFAULT_ALLOWED_ORIGINS_SETTING
        && key != WS_BASE_URL_SETTING
        && key != INSTANCE_BANNER_SETTING
-        // The token form reads it to stop offering expirations the server would shorten.
-        && key != MAX_TOKEN_EXPIRATION_DAYS_SETTING
-        // Whoever is wiring up an MCP client reads it to know whether a URL-borne token
-        // would be refused, and they are usually not a superadmin. Not a secret: pointing
-        // any MCP client at the instance discovers the same answer.
-        && key != MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING
    {
        require_super_admin(&db, &authed).await?;
    }
@@ -1660,6 +1678,8 @@ struct CustomInstanceDb {
    tag: Option<String>,
    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    used_by_workspaces: Vec<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    workspace_id: Option<String>,
 }

 #[derive(Deserialize, Debug, Serialize, Default)]
@@ -1756,6 +1776,135 @@ async fn refresh_custom_instance_user_pwd(
    Ok(Json(()))
 }

+async fn get_external_instance_pg_status(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+) -> JsonResult<windmill_common::external_instance_pg::ExternalInstancePgStatus> {
+    require_super_admin(&db, &authed).await?;
+    Ok(Json(
+        windmill_common::external_instance_pg::external_instance_pg_status(&db).await?,
+    ))
+}
+
+#[derive(Deserialize)]
+struct SetupExternalInstancePgBody {
+    #[serde(default)]
+    rotate_passwords: bool,
+}
+
+async fn setup_external_instance_pg(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+    Json(body): Json<SetupExternalInstancePgBody>,
+) -> JsonResult<windmill_common::external_instance_pg::ExternalInstancePgSetupReport> {
+    require_super_admin(&db, &authed).await?;
+    let report = windmill_common::external_instance_pg::setup_external_instance_pg_unchecked(
+        &db,
+        body.rotate_passwords,
+    )
+    .await?;
+    let rotated = body.rotate_passwords.to_string();
+    let success = report.success.to_string();
+    windmill_audit::audit_oss::audit_log(
+        &db,
+        &authed,
+        "settings.setup_external_instance_pg",
+        windmill_audit::ActionKind::Update,
+        "global",
+        Some(&authed.email),
+        Some(
+            [
+                ("rotate_passwords", rotated.as_str()),
+                ("success", success.as_str()),
+            ]
+            .into(),
+        ),
+    )
+    .await?;
+    Ok(Json(report))
+}
+
+#[derive(Serialize)]
+struct ExternalInstancePgDatabase {
+    #[serde(flatten)]
+    status: windmill_common::instance_config::CustomInstanceDb,
+    used_by_workspaces: Vec<String>,
+}
+
+async fn list_external_instance_pg_databases(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+) -> JsonResult<std::collections::BTreeMap<String, ExternalInstancePgDatabase>> {
+    require_super_admin(&db, &authed).await?;
+    let databases = windmill_common::external_instance_pg::external_instance_databases(&db).await?;
+    let mut usages =
+        windmill_common::external_instance_pg::external_instance_database_usages(&db).await?;
+    Ok(Json(
+        databases
+            .into_iter()
+            .map(|(name, status)| {
+                let used_by_workspaces = usages.remove(&name).unwrap_or_default();
+                (
+                    name,
+                    ExternalInstancePgDatabase {
+                        status,
+                        used_by_workspaces: used_by_workspaces.into_iter().collect(),
+                    },
+                )
+            })
+            .collect(),
+    ))
+}
+
+async fn create_external_instance_pg_database(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+    Path(dbname): Path<String>,
+    Json(body): Json<SetupCustomInstanceDbBody>,
+) -> JsonResult<()> {
+    require_super_admin(&db, &authed).await?;
+    let tag = body.tag.as_deref().unwrap_or("datatable");
+    windmill_common::external_instance_pg::create_external_instance_database_unchecked(
+        &db, &dbname, tag, None,
+    )
+    .await?;
+    windmill_audit::audit_oss::audit_log(
+        &db,
+        &authed,
+        "settings.create_external_instance_pg_database",
+        windmill_audit::ActionKind::Create,
+        "global",
+        Some(&authed.email),
+        Some([("dbname", dbname.as_str()), ("tag", tag)].into()),
+    )
+    .await?;
+    Ok(Json(()))
+}
+
+async fn drop_external_instance_pg_database(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+    Path(dbname): Path<String>,
+) -> JsonResult<()> {
+    require_super_admin(&db, &authed).await?;
+    // A data table naming a dropped database fails on every job, far from the drop that caused it.
+    windmill_common::external_instance_pg::drop_external_instance_database_unchecked(
+        &db, &dbname, None,
+    )
+    .await?;
+    windmill_audit::audit_oss::audit_log(
+        &db,
+        &authed,
+        "settings.drop_external_instance_pg_database",
+        windmill_audit::ActionKind::Delete,
+        "global",
+        Some(&authed.email),
+        Some([("dbname", dbname.as_str())].into()),
+    )
+    .await?;
+    Ok(Json(()))
+}
+
 #[derive(Deserialize)]
 struct SetupCustomInstanceDbBody {
    tag: Option<String>,
@@ -1767,12 +1916,31 @@ async fn setup_custom_instance_pg_database(
    Path(dbname): Path<String>,
    Json(body): Json<SetupCustomInstanceDbBody>,
 ) -> JsonResult<CustomInstanceDb> {
+    // Before anything is recorded: the status written below replaces the registry entry, and with it
+    // the workspace a fork copy is reserved for.
+    require_super_admin(&db, &authed).await?;
+    // A re-run keeps the fork reservation: without it, the workspace the copy was made for could no
+    // longer import into it or finish its fork.
+    let workspace_id = sqlx::query_scalar::<_, Option<String>>(
+        "SELECT value->'databases'->$1->>'workspace_id' FROM global_settings
+         WHERE name = 'custom_instance_pg_databases'",
+    )
+    .bind(&dbname)
+    .fetch_optional(&db)
+    .await?
+    .flatten();
    let mut logs = CustomInstanceDbLogs::default();
    let result = setup_custom_instance_pg_database_inner(authed, &db, &dbname, &mut logs).await;
    let success = result.is_ok();
    let error = result.err().map(|e| e.to_string());
-    let status =
-        CustomInstanceDb { logs, success, error, tag: body.tag, used_by_workspaces: vec![] };
+    let status = CustomInstanceDb {
+        logs,
+        success,
+        error,
+        tag: body.tag,
+        used_by_workspaces: vec![],
+        workspace_id,
+    };
    let status_json = serde_json::to_value(&status).map_err(to_anyhow)?;
    // Save that the database was setup successfully
    sqlx::query!(
@@ -47,10 +47,7 @@ use windmill_audit::audit_oss::audit_log;
 use windmill_audit::ActionKind;
 use windmill_common::audit::AuditAuthor;
 use windmill_common::auth::{hash_token, safe_token_prefix, TOKEN_PREFIX_LEN};
-use windmill_common::global_settings::{
-    load_value_from_global_settings, parse_max_token_expiration_days,
-    AUTOMATE_USERNAME_CREATION_SETTING, MAX_TOKEN_EXPIRATION_DAYS_SETTING,
-};
+use windmill_common::global_settings::AUTOMATE_USERNAME_CREATION_SETTING;
 use windmill_common::oauth2::InstanceEvent;
 use windmill_common::per_minute_counter::PerMinuteCounter;
 use windmill_common::users::truncate_token;
@@ -171,10 +168,7 @@ pub fn make_unauthed_service() -> Router {
        .route("/logout", post(logout).get(logout))
        .route("/is_first_time_setup", get(is_first_time_setup))
        .route("/request_password_reset", post(request_password_reset))
-        .route(
-            "/login_link/{token}",
-            get(consume_login_link).post(confirm_login_link),
-        )
+        .route("/login_link/{token}", get(consume_login_link))
        .route("/is_smtp_configured", get(is_smtp_configured))
        .route(
            "/is_password_login_disabled",
@@ -3098,68 +3092,11 @@ pub async fn create_guest_session_token<'c>(

 // create_token_internal is re-exported from windmill-api-auth above

-/// Applies the instance-wide ceiling on how long a token a caller picks the lifetime of may
-/// live (`create_token`, and `impersonate` for superadmins), returning the expiration to store:
-/// the requested one while it fits, the ceiling otherwise, and the ceiling as well when none was
-/// requested. Only the stored expiration is capped: tokens already stored when the setting is
-/// turned on or lowered keep theirs, since the auth lookup never reads the setting.
-///
-/// It shortens rather than refuses because most callers do not comply on their own. The CLI
-/// authorization page, `wmill user create-token` and the editor's language-server token each
-/// pick a lifetime, often none at all, without reading the setting (and CLIs already installed
-/// never will), so refusing would break logging in and the editor instead of the long-lived
-/// tokens the setting is aimed at.
-///
-/// Read from `global_settings` on each call rather than cached: token creation is rare
-/// enough that the round trip costs nothing, and the ceiling is then never served stale.
-///
-/// A token owned by a service account is exempt: in the workspace the token names, or in any
-/// workspace for a workspace-less token, which has none to match. Service accounts are the
-/// identity automation that needs a long-lived credential runs as. The cost is that any
-/// workspace admin can create and impersonate one to hold an uncapped token, so the ceiling
-/// bounds personal tokens rather than what an admin can obtain.
-async fn cap_token_expiration(
-    db: &DB,
-    owner_email: &str,
-    workspace_id: Option<&str>,
-    requested: Option<chrono::DateTime<chrono::Utc>>,
-) -> Result<Option<chrono::DateTime<chrono::Utc>>> {
-    let value = load_value_from_global_settings(db, MAX_TOKEN_EXPIRATION_DAYS_SETTING).await?;
-    let max_days = match parse_max_token_expiration_days(value.as_ref()) {
-        Ok(Some(max_days)) => max_days,
-        Ok(None) => return Ok(requested),
-        // Both write paths reject this, so only a row written around them gets here.
-        Err(e) => {
-            tracing::warn!("ignoring {MAX_TOKEN_EXPIRATION_DAYS_SETTING}: {e}");
-            return Ok(requested);
-        }
-    };
-    let max = chrono::Utc::now() + chrono::Duration::days(max_days);
-
-    let is_service_account = sqlx::query_scalar!(
-        "SELECT EXISTS(SELECT 1 FROM usr WHERE email = $1 AND is_service_account IS true
-            AND ($2::varchar IS NULL OR workspace_id = $2))",
-        owner_email,
-        workspace_id,
-    )
-    .fetch_one(db)
-    .await?
-    .unwrap_or(false);
-    if is_service_account {
-        return Ok(requested);
-    }
-
-    Ok(Some(match requested {
-        Some(expiration) if expiration < max => expiration,
-        _ => max,
-    }))
-}
-
 async fn create_token(
    Extension(db): Extension<DB>,
    authed: ApiAuthed,
    OptJobAuthed { job_id, .. }: OptJobAuthed,
-    Json(mut token_config): Json<NewToken>,
+    Json(token_config): Json<NewToken>,
 ) -> Result<(StatusCode, String)> {
    forbid_elevated_job_token(&db, &authed.email, job_id).await?;
    check_token_create_rate_limit(&authed.username)?;
@@ -3181,14 +3118,6 @@ async fn create_token(

    windmill_api_auth::ensure_scopes_within_caller(&authed, token_config.scopes.as_deref())?;

-    token_config.expiration = cap_token_expiration(
-        &db,
-        &authed.email,
-        token_config.workspace_id.as_deref(),
-        token_config.expiration,
-    )
-    .await?;
-
    let mut tx = db.begin().await?;

    let token = create_token_internal(&mut *tx, &db, &authed, token_config).await?;
@@ -3245,7 +3174,6 @@ async fn impersonate(
    .fetch_optional(&db)
    .await?
    .unwrap_or(false);
-    let expiration = cap_token_expiration(&db, &impersonated, None, new_token.expiration).await?;
    let mut tx = db.begin().await?;

    sqlx::query!(
@@ -3257,7 +3185,7 @@ async fn impersonate(
        plaintext as Option<&str>,
        impersonated,
        new_token.label,
-        expiration,
+        new_token.expiration,
        is_super_admin
    )
    .execute(&mut *tx)
@@ -3267,7 +3195,7 @@ async fn impersonate(
        &mut *tx,
        &t_hash,
        new_token.label.as_deref(),
-        expiration,
+        new_token.expiration,
    )
    .await;

@@ -3287,12 +3215,9 @@ async fn impersonate(
 }

 const LOGIN_LINK_DEFAULT_TTL_S: u32 = 600;
-// Long enough for a link sent by email to still work when it is read. `require_login_type` is
-// only checked at mint, so a much longer cap would need re-checking it when the link is opened.
-const LOGIN_LINK_MAX_TTL_S: u32 = 7200;
+const LOGIN_LINK_MAX_TTL_S: u32 = 900;
 const LOGIN_LINK_DEFAULT_RD: &str = "/user/workspaces";
 const LOGIN_LINK_EXPIRED_PAGE: &str = "/user/login_link_expired";
-const LOGIN_LINK_CONFIRM_PAGE: &str = "/user/login_link";

 #[derive(Deserialize)]
 pub struct NewLoginLink {
@@ -3303,9 +3228,6 @@ pub struct NewLoginLink {
    /// account it created can require `pending_oauth`, so the link stops working once the
    /// owner has set a password or signed in with a provider.
    pub require_login_type: Option<String>,
-    /// Hand out a page that signs in only when its button is clicked. Mail scanners open links
-    /// on delivery, and opening the plain link spends it, so a link sent by email sets this.
-    pub confirm: Option<bool>,
 }

 #[derive(Serialize)]
@@ -3456,12 +3378,11 @@ async fn create_login_link(
    .await?;
    tx.commit().await?;

-    let base_url = (**BASE_URL.load()).clone();
-    let url = if nl.confirm.unwrap_or(false) {
-        format!("{base_url}{LOGIN_LINK_CONFIRM_PAGE}?token={token}")
-    } else {
-        format!("{base_url}/api/auth/login_link/{token}")
-    };
+    let url = format!(
+        "{}/api/auth/login_link/{}",
+        (**BASE_URL.load()).clone(),
+        token
+    );
    Ok((StatusCode::CREATED, Json(LoginLink { url, expires_at })))
 }

@@ -3707,45 +3628,19 @@ async fn consume_login_link(
    Path(token): Path<String>,
    Query(query): Query<LoginLinkQuery>,
 ) -> Result<Response> {
-    let location = redeem_login_link(&headers, cookies, &db, &token, query.rd).await?;
-    Ok(login_link_redirect(location))
-}
-
-#[derive(Serialize)]
-struct LoginLinkLocation {
-    location: String,
-}
-
-/// The confirmation page's click. It answers with where to go rather than redirecting, and the
-/// page navigates there itself.
-async fn confirm_login_link(
-    headers: axum::http::HeaderMap,
-    cookies: Cookies,
-    Extension(db): Extension<DB>,
-    Path(token): Path<String>,
-) -> JsonResult<LoginLinkLocation> {
-    let location = redeem_login_link(&headers, cookies, &db, &token, None).await?;
-    Ok(Json(LoginLinkLocation { location }))
-}
-
-/// Spends the link and sets the session cookie, returning the post-login destination; or
-/// returns the explanation page, with no session, when the link cannot be used.
-async fn redeem_login_link(
-    headers: &axum::http::HeaderMap,
-    cookies: Cookies,
-    db: &DB,
-    token: &str,
-    requested_rd: Option<String>,
-) -> Result<String> {
-    let bounce = |reason: &str| Ok(format!("{LOGIN_LINK_EXPIRED_PAGE}?reason={reason}"));
+    let bounce = |reason: &str| {
+        Ok(login_link_redirect(format!(
+            "{LOGIN_LINK_EXPIRED_PAGE}?reason={reason}"
+        )))
+    };
    if token.len() != 32 {
        return bounce("invalid");
    }
-    let t_hash = hash_token(token);
+    let t_hash = hash_token(&token);
    // The account is unknown until the row is read, so only the global and per-IP tiers
    // apply here; a 32-char random token leaves nothing for the per-account tier to guard.
    windmill_common::login_rate_limit::check_and_increment_login_attempt(
-        headers,
+        &headers,
        &t_hash[..TOKEN_PREFIX_LEN],
    )?;

@@ -3812,10 +3707,11 @@ async fn redeem_login_link(
    .await?;
    tx.commit().await?;

-    Ok(link
+    let rd = link
        .rd
-        .or_else(|| same_origin_rd(requested_rd))
-        .unwrap_or_else(|| LOGIN_LINK_DEFAULT_RD.to_string()))
+        .or_else(|| same_origin_rd(query.rd))
+        .unwrap_or_else(|| LOGIN_LINK_DEFAULT_RD.to_string());
+    Ok(login_link_redirect(rd))
 }

 #[derive(Deserialize)]
@@ -4049,7 +3945,6 @@ async fn update_token_label(
                 AND NOT starts_with(label, 'embed_app:')
                 AND NOT starts_with(label, 'sdk_app:')
                 AND NOT starts_with(label, 'impersonation:')
-                 AND NOT starts_with(label, 'cli-login:')
             ))
           RETURNING token_prefix",
        req.label.as_deref(),
@@ -0,0 +1,44 @@
+/*
+ * Author: Ruben Fiszel
+ * Copyright: Windmill Labs, Inc 2022
+ * This file and its contents are licensed under the AGPLv3 License.
+ * Please see the included NOTICE for copyright information and
+ * LICENSE-AGPL for a copy of the license.
+ */
+
+//! Where the ACL planner comes from: the enterprise one, or a refusal.
+//!
+//! Data table roles are an Enterprise Edition feature, and so is everything here — reading who
+//! owns what included. `private` alone is not that edition — community builds carry it — so the
+//! planner is behind `enterprise` as well.
+
+#[cfg(all(feature = "private", feature = "enterprise"))]
+pub(crate) use crate::datatable_acl_ee::plan_statements;
+
+#[cfg(all(feature = "private", feature = "enterprise"))]
+pub(crate) fn ensure_datatable_acl_available() -> windmill_common::error::Result<()> {
+    Ok(())
+}
+
+#[cfg(not(all(feature = "private", feature = "enterprise")))]
+use {
+    crate::datatable_acl::{AclChange, AclPlan, AclTarget, CatalogFacts},
+    windmill_common::{datatable_roles_oss::datatable_roles_unavailable, error::Result},
+};
+
+/// Checked first by every ACL route, before anything is read or connected to.
+#[cfg(not(all(feature = "private", feature = "enterprise")))]
+pub(crate) fn ensure_datatable_acl_available() -> Result<()> {
+    Err(datatable_roles_unavailable())
+}
+
+#[cfg(not(all(feature = "private", feature = "enterprise")))]
+pub(crate) fn plan_statements(
+    _target: &AclTarget,
+    _change: &AclChange,
+    _dbname: &str,
+    _pg_role: &str,
+    _facts: &CatalogFacts,
+) -> Result<AclPlan> {
+    Err(datatable_roles_unavailable())
+}
@@ -11,7 +11,7 @@
 //! to keep that file focused on core workspace configuration.

 use crate::workspaces::{
-    is_instance_datatable, pg_dump_database, strip_unreplayable_dump_lines, ItemComparison,
+    managed_datatable_kind, pg_dump_database, strip_unreplayable_dump_lines, ItemComparison,
    PgDumpOptions,
 };

@@ -1556,7 +1556,9 @@ async fn generate_initial_datatable_migration(
    // without what a replay elsewhere cannot run: the replaying user owns none of this
    // database's objects, and the grants Windmill plants in an instance database (`ALTER
    // DEFAULT PRIVILEGES FOR ROLE ...`) fail even replaying onto the same server.
-    let no_acl = is_instance_datatable(&db, &w_id, &datatable_name).await?;
+    let no_acl = managed_datatable_kind(&db, &w_id, &datatable_name)
+        .await?
+        .is_some();
    let dump_file = pg_dump_database(
        &pg_db,
        PgDumpOptions {
@@ -65,3 +65,15 @@ pub(crate) async fn ensure_reaches_datatable(
 ) -> Result<()> {
    roles::ensure_reaches_datatable(db, w_id, datatable_name, authed).await
 }
+
+/// [`ensure_reaches_datatable`] against an entry already resolved, for a caller that goes on to
+/// connect from that same entry.
+pub(crate) async fn ensure_reaches_governing_datatable(
+    db: &DB,
+    w_id: &str,
+    datatable_name: &str,
+    governing: &GoverningDatatable,
+    authed: &ApiAuthed,
+) -> Result<()> {
+    roles::ensure_reaches_governing_datatable(db, w_id, datatable_name, governing, authed).await
+}
@@ -12,8 +12,9 @@

 #[cfg(all(feature = "private", feature = "enterprise"))]
 pub(crate) use crate::datatable_permissions_ee::{
-    ensure_governs_datatable, ensure_reaches_datatable, get_datatable_permissions,
-    list_usable_datatable_roles, set_datatable_permissions,
+    ensure_governs_datatable, ensure_reaches_datatable, ensure_reaches_governing_datatable,
+    get_datatable_permissions, list_usable_datatable_roles, set_datatable_permissions,
+    usable_datatable_roles,
 };

 #[cfg(not(all(feature = "private", feature = "enterprise")))]
@@ -56,6 +57,20 @@ mod ce {
        }
    }

+    pub(crate) async fn ensure_reaches_governing_datatable(
+        _db: &DB,
+        _w_id: &str,
+        _datatable_name: &str,
+        governing: &GoverningDatatable,
+        _authed: &ApiAuthed,
+    ) -> Result<()> {
+        if governing.datatable.permissions.is_none() {
+            Ok(())
+        } else {
+            Err(unavailable())
+        }
+    }
+
    // The routes stay registered so the API has one shape; each answers after authentication,
    // before anything is read.

@@ -70,4 +85,28 @@ mod ce {
    pub(crate) async fn list_usable_datatable_roles(_authed: ApiAuthed) -> Result<String> {
        Err(unavailable())
    }
+
+    pub(crate) struct UsableDatatableRoles {
+        pub(crate) permissioned: bool,
+        pub(crate) roles: Vec<String>,
+        pub(crate) default_role: String,
+    }
+
+    /// A data table not under roles is used as `admin`, as before roles existed. One under roles
+    /// is refused: no role of it can be connected as.
+    pub(crate) async fn usable_datatable_roles(
+        _db: &DB,
+        _authed: &ApiAuthed,
+        _w_id: &str,
+        governing: &GoverningDatatable,
+    ) -> Result<UsableDatatableRoles> {
+        if governing.datatable.permissions.is_some() {
+            return Err(unavailable());
+        }
+        Ok(UsableDatatableRoles {
+            permissioned: false,
+            roles: vec![],
+            default_role: windmill_common::datatable_roles::ADMIN_DATATABLE_ROLE.to_string(),
+        })
+    }
 }
@@ -1,6 +1,8 @@
 #[cfg(feature = "parquet")]
 pub mod ai_session_backups;
 pub mod data_metrics;
+pub mod datatable_acl;
+pub mod datatable_acl_oss;
 pub mod datatable_migrations;
 pub mod datatable_permissions;
 pub mod datatable_permissions_oss;
@@ -12,5 +14,8 @@ pub mod workspaces_oss;
 #[cfg(feature = "private")]
 pub mod workspaces_ee;

+#[cfg(all(feature = "private", feature = "enterprise"))]
+pub mod datatable_acl_ee;
+
 #[cfg(all(feature = "private", feature = "enterprise"))]
 pub mod datatable_permissions_ee;
@@ -110,10 +110,25 @@ pub(crate) async fn change_workspace_id(
    .execute(&mut *tx)
    .await?;

+    // A fork copy reserved for the old id would otherwise be unreachable: its creator cannot
+    // import into it or finish its fork under the new id, and nothing else would ever drop it.
+    sqlx::query(
+        r#"UPDATE global_settings SET value = jsonb_set(value, '{databases}', (
+               SELECT COALESCE(jsonb_object_agg(k, CASE WHEN v->>'workspace_id' = $1
+                   THEN jsonb_set(v, '{workspace_id}', to_jsonb($2::text)) ELSE v END), '{}'::jsonb)
+               FROM jsonb_each(COALESCE(value->'databases', '{}'::jsonb)) AS e(k, v)
+           ))
+           WHERE name = 'custom_instance_pg_databases'"#,
+    )
+    .bind(&old_id)
+    .bind(&rw.new_id)
+    .execute(&mut *tx)
+    .await?;
+
    // Duplicate workspace settings (keep copy in old workspace for reference)
    info!("Duplicating workspace_settings table");
    sqlx::query!(
-        "INSERT INTO workspace_settings (workspace_id, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url, add_admins_and_developers_to_forks) SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url, add_admins_and_developers_to_forks FROM workspace_settings WHERE workspace_id = $2",
+        "INSERT INTO workspace_settings (workspace_id, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url) SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url FROM workspace_settings WHERE workspace_id = $2",
        &rw.new_id,
        &old_id
    )
@@ -1409,9 +1424,7 @@ pub async fn drop_forked_datatable_databases(
            _ => continue,
        };

-        if database.resource_type
-            == windmill_common::workspaces::DataTableCatalogResourceType::Instance
-        {
+        if database.resource_type.is_windmill_managed() {
            let db_to_drop = &database.resource_path;
            if !db_to_drop.starts_with("wm_fork_") {
                errors.push(format!(
@@ -1420,7 +1433,42 @@ pub async fn drop_forked_datatable_databases(
                ));
                continue;
            }
-            if let Err(e) = windmill_common::drop_custom_instance_database(&db, db_to_drop).await {
+            // The fork's own entry is what is going away; anything else still reaching the copy,
+            // a child fork's pointer at this entry included, keeps it. The lock keeps a child fork
+            // from gaining such a pointer before the drop.
+            let dropped = async {
+                let mut tx = db.begin().await?;
+                windmill_common::workspaces::lock_fork_datatables(&mut tx, &w_id).await?;
+                if database.resource_type
+                    == windmill_common::workspaces::DataTableCatalogResourceType::ExternalInstance
+                {
+                    windmill_common::external_instance_pg::drop_external_instance_database_unchecked(
+                        &db,
+                        db_to_drop,
+                        Some((&w_id, dt_name)),
+                    )
+                    .await?;
+                } else {
+                    let uses = windmill_common::workspaces::managed_database_uses(
+                        &mut tx,
+                        windmill_common::workspaces::DataTableCatalogResourceType::Instance,
+                        db_to_drop,
+                        Some((&w_id, dt_name)),
+                    )
+                    .await?;
+                    if !uses.is_empty() {
+                        return Err(Error::BadRequest(format!(
+                            "it is still used by {}",
+                            uses.join(", ")
+                        )));
+                    }
+                    windmill_common::drop_custom_instance_database(&db, db_to_drop).await?;
+                }
+                tx.commit().await?;
+                Ok::<_, Error>(())
+            }
+            .await;
+            if let Err(e) = dropped {
                errors.push(format!(
                    "Could not drop instance database '{}' for datatable://{}: {}",
                    db_to_drop, dt_name, e
@@ -1787,7 +1835,17 @@ async fn resolve_fork_catalog_pg(
            "ducklake://{ducklake_name}: malformed registry catalog identity `{catalog}`"
        ))
    })?;
-    let catalog_resource = if resource_type == "instance" {
+    let catalog_resource = if resource_type == "external_instance" {
+        serde_json::to_value(
+            windmill_common::external_instance_pg::external_instance_connection_unchecked(
+                db,
+                resource_path,
+                false,
+            )
+            .await?,
+        )
+        .map_err(|e| Error::internal_err(format!("serializing pg creds: {e}")))?
+    } else if resource_type == "instance" {
        let mut pg_creds = windmill_common::PgDatabase::parse_uri(
            &windmill_common::get_database_url().await?.as_str().await,
        )?;
@@ -4310,11 +4310,11 @@ async fn execute_component(
        }
    }

-    let flow_path = payload
+    let is_flow = payload
        .path
-        .as_deref()
-        .and_then(|path| path.strip_prefix("flow/"))
-        .map(str::to_string);
+        .as_ref()
+        .map(|p| p.starts_with("flow/"))
+        .unwrap_or(false);

    // Tag for inline-script jobs is read from the deployed policy in run mode;
    // only preview mode (editor) honors the client-supplied tag. This applies to
@@ -4444,9 +4444,8 @@ async fn execute_component(

    // Apply runnable query parameters if provided
    if let Some(ref run_query) = payload.run_query_params {
-        if let Some(flow_path) = flow_path.as_deref() {
-            crate::jobs::process_flow_run_query_params(&mut tx, uuid, &w_id, flow_path, run_query)
-                .await?;
+        if is_flow {
+            crate::jobs::process_flow_run_query_params(&mut tx, uuid, run_query).await?;
        }
    }

@@ -4369,12 +4369,12 @@ async fn count_completed_jobs_detail(
    Query(query): Query<CountCompletedJobsQuery>,
 ) -> error::JsonResult<i64> {
    let mut sqlb = SqlBuilder::select_from("v2_job_completed");
+    //FOR RLS
+    sqlb.join("v2_job USING (id)");
    sqlb.field("COUNT(*) as count");

-    // Filtering on v2_job.workspace_id instead would keep the planner off
-    // ix_job_workspace_id_completed_at_all and scan the whole retention window.
    if !(w_id == "admins" && query.all_workspaces.unwrap_or(false)) {
-        sqlb.and_where_eq("v2_job_completed.workspace_id", "?".bind(&w_id));
+        sqlb.and_where_eq("v2_job.workspace_id", "?".bind(&w_id));
    }

    if let Some(after_s_ago) = query.completed_after_s_ago {
@@ -4393,7 +4393,6 @@ async fn count_completed_jobs_detail(
    }

    if let Some(tags) = query.tags {
-        sqlb.join("v2_job USING (id)");
        sqlb.and_where_in(
            "v2_job.tag",
            &tags.split(",").map(|t| quote(t)).collect::<Vec<_>>(),
@@ -4401,19 +4400,7 @@ async fn count_completed_jobs_detail(
    }

    let sql = sqlb.sql()?;
-    let mut tx = db.begin().await?;
-    set_list_jobs_statement_timeout(&mut tx).await?;
-    let stats = sqlx::query_scalar::<_, i64>(&sql)
-        .fetch_one(&mut *tx)
-        .await
-        .map_err(|e| {
-            list_jobs_timeout_error(
-                e,
-                "Counting completed jobs",
-                "Lower completed_after_s_ago or narrow the filters.",
-            )
-        })?;
-    tx.commit().await?;
+    let stats = sqlx::query_scalar::<_, i64>(&sql).fetch_one(&db).await?;

    Ok(Json(stats))
 }
@@ -4442,33 +4429,6 @@ lazy_static::lazy_static! {
            .unwrap_or(30);
 }

-/// A client that gives up does not cancel its query, so without this bound every retry of a
-/// slow filter stacks another scan running until the connection-wide 5min timeout.
-async fn set_list_jobs_statement_timeout(tx: &mut Transaction<'_, Postgres>) -> error::Result<()> {
-    let timeout_secs = *LIST_JOBS_STATEMENT_TIMEOUT_SECS;
-    if timeout_secs > 0 {
-        sqlx::query(&format!("SET LOCAL statement_timeout = '{timeout_secs}s'"))
-            .execute(&mut **tx)
-            .await?;
-    }
-    Ok(())
-}
-
-fn list_jobs_timeout_error(e: sqlx::Error, action: &str, hint: &str) -> Error {
-    let timeout_secs = *LIST_JOBS_STATEMENT_TIMEOUT_SECS;
-    match e {
-        sqlx::Error::Database(ref db_err)
-            if timeout_secs > 0 && db_err.code().as_deref() == Some("57014") =>
-        {
-            Error::Generic(
-                StatusCode::BAD_REQUEST,
-                format!("{action} took more than {timeout_secs}s and was stopped. {hint}"),
-            )
-        }
-        e => e.into(),
-    }
-}
-
 async fn list_jobs(
    authed: ApiAuthed,
    Extension(user_db): Extension<UserDB>,
@@ -4585,14 +4545,32 @@ async fn list_jobs(
    };
    // tracing::info!("sql: {}", &sql);
    let mut tx: Transaction<'_, Postgres> = user_db.begin(&authed).await?;
-    set_list_jobs_statement_timeout(&mut tx).await?;
+
+    // A client that gives up does not cancel its query, so without this bound every retry of a
+    // slow filter stacks another scan running until the connection-wide 5min timeout.
+    let timeout_secs = *LIST_JOBS_STATEMENT_TIMEOUT_SECS;
+    if timeout_secs > 0 {
+        sqlx::query(&format!("SET LOCAL statement_timeout = '{timeout_secs}s'"))
+            .execute(&mut *tx)
+            .await?;
+    }

    let jobs: Vec<UnifiedJob> = sqlx::query_as(&sql)
        .fetch_all(&mut *tx)
        .warn_after_seconds_with_sql(5, format!("list_jobs: {}", sql))
        .await
-        .map_err(|e| {
-            list_jobs_timeout_error(e, "Listing jobs", "Set a start date or narrow the filters.")
+        .map_err(|e| match e {
+            sqlx::Error::Database(ref db_err)
+                if timeout_secs > 0 && db_err.code().as_deref() == Some("57014") =>
+            {
+                Error::Generic(
+                    StatusCode::BAD_REQUEST,
+                    format!(
+                        "Listing jobs took more than {timeout_secs}s and was stopped. Set a start date or narrow the filters."
+                    ),
+                )
+            }
+            e => e.into(),
        })?;
    tx.commit().await?;

@@ -8723,7 +8701,12 @@ fn register_potential_assets_on_inline_execution(
            .as_ref()
            .and_then(|args| args.get("database"))
            .map(|v| v.get().trim_matches('"'))
-            .and_then(|dt| dt.strip_prefix("datatable://"));
+            .and_then(|dt| dt.strip_prefix("datatable://"))
+            // `?role=` picks the connection, not the data table. Anything else after a `?` may be
+            // part of a name stored before names were restricted, so it stays.
+            .map(|dt| {
+                windmill_common::workspaces::parse_datatable_ref(dt).map_or(dt, |(name, _)| name)
+            });
        if let Some(datatable) = datatable {
            let re = regex::Regex::new(r#"SET search_path TO "([^"]+)";"#).unwrap();
            let (schema, content) = if let Some(captures) = re.captures(&preview.content) {
@@ -9563,7 +9546,7 @@ async fn run_preview_flow_job(
    .await?;

    // Set memory_id if provided (for agent memory)
-    if let Some(memory_id) = run_query.memory_key(&w_id, &flow_path) {
+    if let Some(memory_id) = run_query.memory_id {
        set_flow_memory_id(&mut tx, uuid, memory_id).await?;
    }

@@ -9577,9 +9560,6 @@ async fn run_preview_flow_job(
            &run_query,
            user_message.as_ref(),
            uuid,
-            // Run from the editor's test panel: a trial, not a real conversation.
-            true,
-            &flow_args,
        )
        .await?;
    }
@@ -560,7 +560,7 @@ pub async fn run_server(
        if server_mode || mcp_mode {
            use mcp::{
                add_www_authenticate_header, add_www_authenticate_header_gateway,
-                extract_workspace_from_token, reject_token_query_param,
+                extract_workspace_from_token,
            };
            let (mcp_router, mcp_cancellation_token) = setup_mcp_server(
                db.clone(),
@@ -573,17 +573,15 @@ pub async fn run_server(
            let workspaced_mcp_router = mcp_router
                .clone()
                .route_layer(from_extractor::<ApiAuthed>())
-                .layer(axum::middleware::from_fn(reject_token_query_param))
                .layer(axum::middleware::from_fn(add_www_authenticate_header))
                .layer(axum::middleware::from_fn(extract_and_store_workspace_id));
            // Gateway MCP router — resolves workspace from token
            let gateway_mcp_router = mcp_router
                .route_layer(from_extractor::<ApiAuthed>())
-                .layer(axum::middleware::from_fn(extract_workspace_from_token))
-                .layer(axum::middleware::from_fn(reject_token_query_param))
                .layer(axum::middleware::from_fn(
                    add_www_authenticate_header_gateway,
-                ));
+                ))
+                .layer(axum::middleware::from_fn(extract_workspace_from_token));
            (
                workspaced_mcp_router,
                gateway_mcp_router,
@@ -43,14 +43,11 @@ use axum::{
    extract::{Extension, Path},
    http::Request,
    middleware::Next,
-    response::{IntoResponse, Response},
+    response::Response,
    routing::get,
    Json, Router,
 };
-use windmill_common::{
-    auth::hash_token, db::GatewayWorkspaceId, error::JsonResult,
-    global_settings::MCP_DISABLE_TOKEN_QUERY_PARAM,
-};
+use windmill_common::{auth::hash_token, db::GatewayWorkspaceId, error::JsonResult};

 // McpAuth impl for ApiAuthed is in windmill-api-auth (same crate as the type)

@@ -449,29 +446,6 @@ pub async fn add_www_authenticate_header(
    }
 }

-/// Middleware refusing a credential carried in the MCP URL once the instance sets
-/// `mcp_disable_token_query_param`. Sits outside everything that reads the token, so neither
-/// the gateway lookup nor `ApiAuthed` ever sees it, and inside the `WWW-Authenticate` layer,
-/// whose header is what sends the client into the OAuth flow instead. Refused rather than
-/// ignored: the URL leaked the token whether or not the request used it.
-pub async fn reject_token_query_param(request: Request<axum::body::Body>, next: Next) -> Response {
-    let carries_token = MCP_DISABLE_TOKEN_QUERY_PARAM.load(std::sync::atomic::Ordering::Relaxed)
-        && request
-            .uri()
-            .query()
-            .is_some_and(|q| url::form_urlencoded::parse(q.as_bytes()).any(|(k, _)| k == "token"));
-    if carries_token {
-        return (
-            axum::http::StatusCode::UNAUTHORIZED,
-            "This instance does not accept a token in the MCP URL. Remove the token query \
-             parameter and let your client sign in through OAuth, or send the token in an \
-             Authorization header.",
-        )
-            .into_response();
-    }
-    next.run(request).await
-}
-
 /// Extract the bearer token from either the `Authorization` header or the
 /// `?token=` query parameter (MCP clients commonly pass it in the URL).
 fn extract_gateway_token(request: &Request<axum::body::Body>) -> Option<String> {
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`ALTER TABLE flow_conversation DROP COLUMN is_test;`
				`@@ -1 +0,0 @@`
				`ALTER TABLE flow_conversation_message DROP COLUMN attachments;`
				`@@ -1 +0,0 @@`
				`ALTER TABLE workspace_settings DROP COLUMN add_admins_and_developers_to_forks;`
				`@@ -1 +0,0 @@`
				`ALTER TABLE workspace_settings ADD COLUMN add_admins_and_developers_to_forks BOOLEAN NOT NULL DEFAULT false;`