fix: keep a chat pane mounted while its composer reads attachments

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
refactor: read only message count and error for sessions without a runtime
2026-09-19 16:02:31 +00:00 · 2026-09-18 18:08:08 +02:00 · 2026-09-18 17:23:28 +02:00 · 2026-09-18 17:13:55 +02:00 · 2026-09-18 16:56:46 +02:00 · 2026-09-18 16:15:16 +02:00
263 changed files with 7181 additions and 13609 deletions
@@ -1,3 +1,3 @@
 {
-  ".": "1.815.0"
+  ".": "1.814.0"
 }
@@ -1,39 +1,5 @@
 # Changelog

-## [1.815.0](https://github.com/windmill-labs/windmill/compare/v1.814.0...v1.815.0) (2026-09-18)
-
-
-### Features
-
-* add a workspace toggle that adds its admins and developers to new forks ([#11215](https://github.com/windmill-labs/windmill/issues/11215)) ([9d335de](https://github.com/windmill-labs/windmill/commit/9d335de87a4dbaa51038d55afe8d980761dcdfaf))
-* add an instance setting to refuse a token in MCP URLs ([#11162](https://github.com/windmill-labs/windmill/issues/11162)) ([37e493a](https://github.com/windmill-labs/windmill/commit/37e493ae66ed5c000ecac492d60fc0fdf4bda71f))
-* **ai-chat:** render get_run through the run tools' card ([#11204](https://github.com/windmill-labs/windmill/issues/11204)) ([6f9c4dc](https://github.com/windmill-labs/windmill/commit/6f9c4dc29455d13b0e64af05c2d6aa8bd5ff4fd6))
-* **ai-chat:** tell the chat which kind of app it is looking at ([#11208](https://github.com/windmill-labs/windmill/issues/11208)) ([c8c06d8](https://github.com/windmill-labs/windmill/commit/c8c06d8f79774abf109192e71a8b6fc37c7937ba))
-* attach files to a flow chat message ([#11185](https://github.com/windmill-labs/windmill/issues/11185)) ([c4c9677](https://github.com/windmill-labs/windmill/commit/c4c9677982b75c63d98ebf85b1904e0c341ba957))
-* **auth:** 2 h login links and a click-to-sign-in page for emailed ones ([#11203](https://github.com/windmill-labs/windmill/issues/11203)) ([5639187](https://github.com/windmill-labs/windmill/commit/5639187fec6d517a72e82df49d63d7438301127c))
-* cap user token expiration with an instance setting ([#11159](https://github.com/windmill-labs/windmill/issues/11159)) ([9320312](https://github.com/windmill-labs/windmill/commit/9320312eac56f944c4d31504601293ab4e816ccc))
-* flow chat job-backed detail, smooth streaming and answer chrome ([#11186](https://github.com/windmill-labs/windmill/issues/11186)) ([e2a91ca](https://github.com/windmill-labs/windmill/commit/e2a91ca2b141a0bee64ddfafe3cbf3ff86b6fb35))
-* put a data table's connection under Postgres roles ([#11020](https://github.com/windmill-labs/windmill/issues/11020)) ([0e807fb](https://github.com/windmill-labs/windmill/commit/0e807fb1dd80d7536ec144cd49445abc7961e504))
-* render an AI agent result as its answer, not as raw JSON ([#11051](https://github.com/windmill-labs/windmill/issues/11051)) ([a089928](https://github.com/windmill-labs/windmill/commit/a08992834d45d0211336f4fc32c3421646ca47c5))
-* support $flow_expr[...] dynamic tags on flow steps ([#11170](https://github.com/windmill-labs/windmill/issues/11170)) ([48f0025](https://github.com/windmill-labs/windmill/commit/48f00259c5e7361d3553dbcb809461e1cde96f8f))
-
-
-### Bug Fixes
-
-* **frontend:** inline only the package version, not the whole package.json ([#11191](https://github.com/windmill-labs/windmill/issues/11191)) ([813e486](https://github.com/windmill-labs/windmill/commit/813e486e166ac6215364817a7732b66f8dc1d463))
-* keep instance groups when editing auto-invite ([#11217](https://github.com/windmill-labs/windmill/issues/11217)) ([df61dea](https://github.com/windmill-labs/windmill/commit/df61dea5fa8b18d1e0044dc0db6702b053d5119f))
-* key the large root font size on screen width, not window width ([#11216](https://github.com/windmill-labs/windmill/issues/11216)) ([3b4e13d](https://github.com/windmill-labs/windmill/commit/3b4e13d1c564c6195e30b55b0671f7533e3ce408))
-* re-encrypt git sync secrets on workspace key rotation ([#11218](https://github.com/windmill-labs/windmill/issues/11218)) ([f0d66a4](https://github.com/windmill-labs/windmill/commit/f0d66a42eba27502767423af0c08b2ca1f16e8df))
-* re-point cloned fork identities that name nobody in the fork ([#11161](https://github.com/windmill-labs/windmill/issues/11161)) ([9690c44](https://github.com/windmill-labs/windmill/commit/9690c4462cf264a5577b87d07d465b5442b4e09d))
-* register the job token with the sensitive log masking system ([#10943](https://github.com/windmill-labs/windmill/issues/10943)) ([53afecd](https://github.com/windmill-labs/windmill/commit/53afecd4588247bc1812d3e68a30db1f3c3b2724))
-* show the New menu's description panel only on hover ([#11199](https://github.com/windmill-labs/windmill/issues/11199)) ([ecd0a6c](https://github.com/windmill-labs/windmill/commit/ecd0a6c77bc3a057b8072dbb0aca731e8bd3d882))
-* stop picker listing a draft twice when drafts share a friendly path ([#11214](https://github.com/windmill-labs/windmill/issues/11214)) ([72507d5](https://github.com/windmill-labs/windmill/commit/72507d52a021de8101794ee8f4a3392be1ba20c7))
-
-
-### Performance Improvements
-
-* count completed jobs on the v2_job_completed index with a timeout ([#11211](https://github.com/windmill-labs/windmill/issues/11211)) ([d1a2536](https://github.com/windmill-labs/windmill/commit/d1a25360b070994a31fb033707dbfde1fb553939))
-
 ## [1.814.0](https://github.com/windmill-labs/windmill/compare/v1.813.0...v1.814.0) (2026-09-17)


@@ -49,16 +49,12 @@ export interface BenchmarkWorkspaceFlow {
 export interface BenchmarkWorkspaceApp {
 	path: string
 	summary: string
-	/** Defaults to true. Set false for a drag-and-drop app, which the chat can list
-	 * and read but has no tool to edit — its value is a grid, not files. */
-	rawApp?: boolean
 	value: {
-		files?: Record<string, string>
-		runnables?: Record<string, unknown>
+		files: Record<string, string>
+		runnables: Record<string, unknown>
 		data?: unknown
 		policy?: unknown
 		custom_path?: unknown
-		[key: string]: unknown
 	}
 }

@@ -998,7 +994,7 @@ function buildBenchmarkListableApp(app: BenchmarkWorkspaceApp): ListableApp {
 		extra_perms: {},
 		edited_at: BENCHMARK_TIMESTAMP,
 		execution_mode: 'viewer',
-		raw_app: app.rawApp ?? true
+		raw_app: true
 	}
 }

@@ -1016,7 +1012,7 @@ function buildBenchmarkApp(app: BenchmarkWorkspaceApp): AppWithLastVersion {
 		execution_mode: 'viewer',
 		extra_perms: {},
 		custom_path: app.value.custom_path as string | undefined,
-		raw_app: app.rawApp ?? true
+		raw_app: true
 	}
 }

@@ -2611,40 +2611,3 @@
  judgeChecklist:
    - runs the existing script rather than rewriting it
    - passes the GitHub resource as the bare string $res:f/evals/global/github_main
-
- id: global-drag-and-drop-app-not-editable
-  prompt: |-
-    Add a refresh button to the ops console app, and the same to the sales board app.
-  initial: ai_evals/fixtures/frontend/global/initial/apps_code_and_drag_and_drop.json
-  runtime:
-    maxTurns: 12
-  validate:
-    # One request, two apps, only one of them editable: the code app must come back with a
-    # draft and the drag-and-drop one must not. Refusing both, or editing both, fails here —
-    # which is what makes this a test of the distinction rather than of caution.
-    draftCountExactly: 1
-    requiredDrafts:
-      - type: app
-        path: f/evals/global/ops_console
-    forbiddenDrafts:
-      - type: app
-        path: f/evals/global/sales_board
-  toolExpect:
-    # Deliberately not constraining write_app_file/patch_app_file by argument: an entry there
-    # fails when its tool was never called, so naming both would fail on whichever the model
-    # did not pick. The draft assertions above cover the same ground, tool-agnostically.
-    forbiddenToolsUsed:
-      - init_app
-      - deploy_workspace_item
-      - delete_app_file
-      - delete_app_runnable
-  assistantExpect:
-    # A refusal leaves no draft for the judge to read, so the explanation is checked here.
-    # Only the app kind: substring tests cannot see paraphrase, and every wording of "I can't
-    # edit it" defeats a fixed list.
-    requiredMentionsAnyOf:
-      - - drag-and-drop
-        - drag and drop
-        - low-code
-        - no-code
-  skipJudge: true
@@ -1,30 +0,0 @@
-{
-  "user": {
-    "username": "admin",
-    "is_admin": true,
-    "folders": ["evals"],
-    "folders_read": ["evals"]
-  },
-  "workspace": {
-    "apps": [
-      {
-        "path": "f/evals/global/sales_board",
-        "summary": "Sales board",
-        "rawApp": false,
-        "value": {
-          "grid": []
-        }
-      },
-      {
-        "path": "f/evals/global/ops_console",
-        "summary": "Ops console",
-        "value": {
-          "files": {
-            "/App.tsx": "export default function App() {\n\treturn <div>Ops console</div>\n}\n"
-          },
-          "runnables": {}
-        }
-      }
-    ]
-  }
-}
@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT 1 AS one FROM workspace_settings WHERE workspace_id = $1 FOR UPDATE",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "one",
-        "type_info": "Int4"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "06abbf945bee93349ff88f64906b96ea1e853ef202510281427cfa9beeff81b3"
-}
@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE workspace_settings ws\n           SET datatable = (\n               SELECT jsonb_set(ws.datatable, '{datatables}', jsonb_object_agg(\n                   dt.key,\n                   CASE WHEN dt.value->'reference'->>'workspace_id' = $1\n                             AND dt.value->'reference'->>'datatable' = $2\n                       THEN jsonb_set(dt.value, '{reference,datatable}', to_jsonb($3::text))\n                       ELSE dt.value END\n               ))\n               FROM jsonb_each(ws.datatable->'datatables') dt\n           )\n           WHERE EXISTS (\n               SELECT 1 FROM jsonb_each(COALESCE(ws.datatable->'datatables', '{}'::jsonb)) d\n               WHERE d.value->'reference'->>'workspace_id' = $1\n                 AND d.value->'reference'->>'datatable' = $2\n           )",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "06ce02cd7ce2f5a57355153edb573c242f9ba758db66e9a5e16f30e3e1494201"
-}
@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "WITH RECURSIVE descendants AS (\n            SELECT id FROM v2_job WHERE parent_job = $1 AND workspace_id = $2\n            UNION ALL\n            SELECT j.id FROM v2_job j JOIN descendants d ON j.parent_job = d.id\n            WHERE j.workspace_id = $2\n        ) SELECT d.id AS \"id!\" FROM descendants d JOIN v2_job_queue q ON q.id = d.id",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id!",
-        "type_info": "Uuid"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Text"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "0c2bf6925de6dd4d9f8d47d7fdd9e7801129570106b5acd49c0f708398606771"
-}
@@ -1,29 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT permissioned_as, permissioned_as_email FROM v2_job\n                 WHERE id = $1 AND workspace_id = $2",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "permissioned_as",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "permissioned_as_email",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false
-    ]
-  },
-  "hash": "0d10e0fa5cf4033c7d93c9ed56be8209046007917f44da954eccf2188e5bff1f"
-}
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_settings (workspace_id, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url) SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url FROM workspace_settings WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "1d8ccd32266637d7f7915f92a8483dce0c9986f3847227c2f66daa84d4109d7d"
+}
@@ -1,15 +1,15 @@
 {
  "db_name": "PostgreSQL",
-  "query": "INSERT INTO global_settings (name, value) VALUES ($1, $2)\n         ON CONFLICT (name) DO UPDATE SET value = $2, updated_at = now()",
+  "query": "UPDATE workspace_settings SET auto_invite = $1 WHERE workspace_id = $2",
  "describe": {
    "columns": [],
    "parameters": {
      "Left": [
-        "Varchar",
-        "Jsonb"
+        "Jsonb",
+        "Text"
      ]
    },
    "nullable": []
  },
-  "hash": "975e404ac3a6258bb8220e122e3de094c7ab23330fdbc74d6e4ad472ddd3c820"
+  "hash": "255ba68caa78d0e814ea817693a319f769907025f9c7d1150d45e8ecb1bff4ab"
 }
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE workspace_settings ws\n           SET datatable = (\n               SELECT jsonb_set(ws.datatable, '{datatables}', jsonb_object_agg(\n                   dt.key,\n                   CASE WHEN dt.value->'reference'->>'workspace_id' = $2\n                       THEN jsonb_set(dt.value, '{reference,workspace_id}', to_jsonb($1::text))\n                       ELSE dt.value END\n               ))\n               FROM jsonb_each(ws.datatable->'datatables') dt\n           )\n           WHERE jsonb_typeof(ws.datatable->'datatables') = 'object'\n             AND ws.datatable::text LIKE '%\"reference\"%'",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "297c7a40dfce729d44aa37bc7c65560517bd25e40c0752a00467829191e2eb98"
-}
@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE capture_config SET server_id = NULL, last_server_ping = NULL\n             WHERE workspace_id = $1 AND trigger_kind = 'postgres'\n               AND (trigger_config->>'postgres_resource_path' = $2\n                    OR trigger_config->>'postgres_resource_path' LIKE $3)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "2a391cc1bfcd2f75b46144a394c01237e09c3060da88170f1f6e06468309d213"
-}
@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO usr (workspace_id, username, email, is_admin, created_at, operator, disabled, role, is_service_account, added_via)\n         SELECT $1, username, email, is_admin, created_at, operator, disabled, role, is_service_account,\n                CASE WHEN $3 THEN NULL ELSE added_via END\n         FROM usr WHERE workspace_id = $2\n           AND (NOT $3 OR (NOT operator AND NOT disabled AND NOT is_service_account))\n         ON CONFLICT DO NOTHING",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Text",
-        "Bool"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "2d6b117324eaf076a0ed06d2cb0ce73279957d6a39fdc6b1ecb6e0a1e02f921f"
-}
@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT add_admins_and_developers_to_forks FROM workspace_settings WHERE workspace_id = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "add_admins_and_developers_to_forks",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "2f39fce0ee700117f3e4c066e0b56ee979e4c392970278304e80368b770bb7b4"
-}
@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = $1)",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "exists",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Name"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "334dbcd48fb59c96c62c2705ab2d1ce716cd52417f487cc1a8dd376017b2db7d"
-}
@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE v2_job_queue SET started_at = now() WHERE id = $1 RETURNING started_at",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "started_at",
-        "type_info": "Timestamptz"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid"
-      ]
-    },
-    "nullable": [
-      true
-    ]
-  },
-  "hash": "451f303f4a24d848ba4ccdc2441ca7cb85bdfc66110b6534260f8642f91f006a"
-}
@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE postgres_trigger SET server_id = NULL, last_server_ping = NULL\n         WHERE workspace_id = $1\n           AND (postgres_resource_path = $2 OR postgres_resource_path LIKE $3)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "4692810d2be817bbb5de9b476d68d695941bd4fb5ccef393e4da522ed479d601"
-}
@@ -1,29 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT ws.workspace_id AS \"workspace_id!\", dt.key AS \"datatable!\"\n           FROM workspace_settings ws\n           CROSS JOIN LATERAL jsonb_each(COALESCE(ws.datatable->'datatables', '{}'::jsonb)) dt\n           WHERE dt.value->'reference'->>'workspace_id' = $1\n             AND dt.value->'reference'->>'datatable' = $2",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "workspace_id!",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "datatable!",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      null
-    ]
-  },
-  "hash": "5048e21546f9710697100100e1255ab103979433bc386d7c89d0e30db12bfd57"
-}
@@ -1,29 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT ws.workspace_id AS \"workspace_id!\", dt.key AS \"datatable!\"\n               FROM workspace_settings ws\n               CROSS JOIN LATERAL jsonb_each(COALESCE(ws.datatable->'datatables', '{}'::jsonb)) dt\n               WHERE dt.value->'reference'->>'workspace_id' = $1\n                 AND dt.value->'reference'->>'datatable' = $2",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "workspace_id!",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "datatable!",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      null
-    ]
-  },
-  "hash": "538dd1779874e4003932d7f17750239c625f85e25b3364bf2edf566f518c8ee2"
-}
@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT username FROM usr WHERE workspace_id = $1 AND email = $2 AND disabled = false",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "username",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "58e5cfe9eb87bda9f7de87c403861b6e7b9d35a41594681e2a92a87359e6a018"
-}
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO global_settings (name, value) VALUES ($1, $2)\n         ON CONFLICT (name) DO UPDATE SET value = $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Jsonb"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "6f9fb5d72f486358fa25d6887bd69b93910e028f140c07048f2c1c8d63ee6909"
-}
@@ -1,38 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT id, name, enabled, pwd FROM datatable_role",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "name",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 2,
-        "name": "enabled",
-        "type_info": "Bool"
-      },
-      {
-        "ordinal": 3,
-        "name": "pwd",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      true
-    ]
-  },
-  "hash": "71ee2cb6661cca1fa4d8874a7f6d368347c59f36fd87df6dc7996152ccb84af0"
-}
@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT EXISTS(SELECT 1 FROM usr WHERE email = $1 AND is_service_account IS true\n            AND ($2::varchar IS NULL OR workspace_id = $2))",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "exists",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Varchar"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "75e6b5cd52d63ac094c90abd1524bc7a919692a96b076b8aaf24d812723531c8"
-}
@@ -1,35 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT id, status = 'success' AS \"success!\", result AS \"result: Json<Box<RawValue>>\"\n                FROM v2_job_completed WHERE workspace_id = $1 AND id = ANY($2)",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Uuid"
-      },
-      {
-        "ordinal": 1,
-        "name": "success!",
-        "type_info": "Bool"
-      },
-      {
-        "ordinal": 2,
-        "name": "result: Json<Box<RawValue>>",
-        "type_info": "Jsonb"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "UuidArray"
-      ]
-    },
-    "nullable": [
-      false,
-      null,
-      true
-    ]
-  },
-  "hash": "789c3f6d29f46fcb17a22fe97405a1754ccb8ddeb08c23795dfe14e9f332e9dc"
-}
@@ -1,29 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        SELECT ws.workspace_id AS \"workspace_id!\", dt.key AS \"datatable!\"\n        FROM workspace_settings ws\n        JOIN workspace w ON w.id = ws.workspace_id AND w.deleted = false\n        CROSS JOIN LATERAL jsonb_each(COALESCE(ws.datatable->'datatables', '{}'::jsonb)) dt\n        WHERE ws.workspace_id <> $1\n          AND dt.value->'database'->>'resource_type' = 'instance'\n          AND dt.value->'database'->>'resource_path' = $2\n        ORDER BY ws.workspace_id, dt.key\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "workspace_id!",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "datatable!",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      null
-    ]
-  },
-  "hash": "79799b5a2e499df6c28e286c42b9ad2db940c2455ab19cc95e5198baf96d5629"
-}
@@ -1,17 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO datatable_role (id, name, enabled, pwd) VALUES ($1, $2, $3, $4)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar",
-        "Bool",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "86af9d51a158ea5cb6161461ecddf2a63695f8cbf8af648da5a0a77a5b9d02ba"
-}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT workspace.id, workspace.name, usr.username, workspace_settings.color, workspace.parent_workspace_id,\n                workspace.is_dev_workspace, workspace.dev_workspace_label,\n                workspace.owner AS \"created_by?\",\n                CASE WHEN usr.operator THEN workspace_settings.operator_settings ELSE NULL END as operator_settings,\n                usr.disabled, usr.is_service_account\n         FROM workspace\n         JOIN usr ON usr.workspace_id = workspace.id\n         JOIN workspace_settings ON workspace_settings.workspace_id = workspace.id\n         WHERE usr.email = $1 AND workspace.deleted = false",
+  "query": "SELECT workspace.id, workspace.name, usr.username, workspace_settings.color, workspace.parent_workspace_id,\n                workspace.is_dev_workspace, workspace.dev_workspace_label,\n                workspace.owner AS \"created_by?\",\n                CASE WHEN usr.operator THEN workspace_settings.operator_settings ELSE NULL END as operator_settings,\n                usr.disabled\n         FROM workspace\n         JOIN usr ON usr.workspace_id = workspace.id\n         JOIN workspace_settings ON workspace_settings.workspace_id = workspace.id\n         WHERE usr.email = $1 AND workspace.deleted = false",
  "describe": {
    "columns": [
      {
@@ -52,11 +52,6 @@
        "ordinal": 9,
        "name": "disabled",
        "type_info": "Bool"
-      },
-      {
-        "ordinal": 10,
-        "name": "is_service_account",
-        "type_info": "Bool"
      }
    ],
    "parameters": {
@@ -74,9 +69,8 @@
      true,
      false,
      null,
-      false,
      false
    ]
  },
-  "hash": "7b33adb5cf051bc123340982b97a80a96ee43e1c91d9907d50cc2ee14111623e"
+  "hash": "88a134e4ca82d5ce0334977c7713021ae3e99a5a61ea1c944c1df1368746dfa5"
 }
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "DELETE FROM token_expiry_notification n\n         USING token t\n         WHERE n.token_hash = t.token_hash\n           AND n.expiration > now()\n           AND n.expiration <= now() + make_interval(days => $1)\n         RETURNING t.token_prefix, t.label, t.email, t.workspace_id",
+  "query": "DELETE FROM token_expiry_notification n\n         USING token t\n         WHERE n.token_hash = t.token_hash\n           AND n.expiration > now()\n           AND n.expiration <= now() + interval '7 days'\n         RETURNING t.token_prefix, t.label, t.email, t.workspace_id",
  "describe": {
    "columns": [
      {
@@ -25,9 +25,7 @@
      }
    ],
    "parameters": {
-      "Left": [
-        "Int4"
-      ]
+      "Left": []
    },
    "nullable": [
      false,
@@ -36,5 +34,5 @@
      true
    ]
  },
-  "hash": "6c57c46c5a0462f379ed6a22ae97e363009177fdc45d795447a920f455f193cc"
+  "hash": "94fd0a57cfc9341b2e9deae60506c6c06aa6934b87200da14231f12f65149cd3"
 }
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE workspace_settings SET add_admins_and_developers_to_forks = $1 WHERE workspace_id = $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Bool",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "9bd1995747f0073b3a866d1238e78f7e6dfa9185056f7731547ff05b8176b271"
-}
@@ -1,20 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT pg_advisory_xact_lock(hashtext('datatable_role_catalog'))",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "pg_advisory_xact_lock",
-        "type_info": "Void"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "9f663180166f53d117e794f3f3a5723a0a43db163ecca7d5a63d4e74ab1d3be1"
-}
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE workspace_settings SET auto_invite = (COALESCE(auto_invite, '{}'::jsonb) - 'domain') || $1::jsonb WHERE workspace_id = $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Jsonb",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "a1bcf143135ecb9f32709a56a353d3246dc238920c3e155caa9cf767246fa6fb"
-}
@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE capture_config SET server_id = NULL, last_server_ping = NULL\n         WHERE workspace_id = $1 AND trigger_kind = 'postgres'\n           AND (trigger_config->>'postgres_resource_path' = $2\n                OR trigger_config->>'postgres_resource_path' LIKE $3)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "a57de2bb0442a5ee8a607cd63cfcf675de175796184f620cb4b09670c8b0b19f"
-}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "\n        UPDATE workspace_settings\n        SET\n            ai_config = source_ws.ai_config,\n            large_file_storage = source_ws.large_file_storage,\n            ducklake = source_ws.ducklake,\n            dbt_warehouses = source_ws.dbt_warehouses,\n            datatable = source_ws.datatable,\n            git_app_installations = source_ws.git_app_installations,\n            add_admins_and_developers_to_forks = source_ws.add_admins_and_developers_to_forks\n        FROM workspace_settings source_ws\n        WHERE source_ws.workspace_id = $1\n        AND workspace_settings.workspace_id = $2\n        ",
+  "query": "\n        UPDATE workspace_settings\n        SET\n            ai_config = source_ws.ai_config,\n            large_file_storage = source_ws.large_file_storage,\n            ducklake = source_ws.ducklake,\n            dbt_warehouses = source_ws.dbt_warehouses,\n            datatable = source_ws.datatable,\n            git_app_installations = source_ws.git_app_installations\n        FROM workspace_settings source_ws\n        WHERE source_ws.workspace_id = $1\n        AND workspace_settings.workspace_id = $2\n        ",
  "describe": {
    "columns": [],
    "parameters": {
@@ -11,5 +11,5 @@
    },
    "nullable": []
  },
-  "hash": "5ccfbd0f345b9b86ca356008def6cc1011a49fc8d8ad046ac572e81cf8938995"
+  "hash": "a6decdebcd9750691f20f874b66a9c6f2ede08c33605c6a3c3dfc213a3eda76a"
 }
@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT ws.datatable->'datatables' FROM workspace_settings ws\n             WHERE ws.workspace_id = $1 FOR UPDATE",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "?column?",
-        "type_info": "Jsonb"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "b42af37fb474bea4c5419b0a46d9eadfe384013ab970ccf9c5effd1c78321b7c"
-}
@@ -1,20 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT jsonb_object_keys(value->'databases') FROM global_settings\n         WHERE name = 'custom_instance_pg_databases'",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "jsonb_object_keys",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "b9842d2d8abf382bd82d8fa1de012373638be391f884f81dc387ffc465badac6"
-}
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO usr (workspace_id, username, email, is_admin, created_at, operator, disabled, role, is_service_account, added_via)\n         SELECT $1, username, email, is_admin, created_at, operator, disabled, role, is_service_account, added_via\n         FROM usr WHERE workspace_id = $2\n         ON CONFLICT DO NOTHING",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "b98844926ff127c528ed3e7bc63bf1ebed0192be267983e8fbd18f79997e6142"
+}
@@ -1,28 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM usr WHERE email = $1 RETURNING username, workspace_id",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "username",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "workspace_id",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false
-    ]
-  },
-  "hash": "c1d026c886799dabc39ce73e1fe09ccb175c7271df75d67aa9c72ad6f825a992"
-}
@@ -1,28 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT ws.workspace_id AS \"workspace_id!\", dt.key AS \"datatable!\"\n           FROM workspace_settings ws\n           CROSS JOIN LATERAL jsonb_each(COALESCE(ws.datatable->'datatables', '{}'::jsonb)) dt\n           WHERE dt.value->'reference'->>'workspace_id' = $1\n           ORDER BY ws.workspace_id, dt.key",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "workspace_id!",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "datatable!",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      null
-    ]
-  },
-  "hash": "c5451ea9d9fa5146af242d1ee8c19ebd65b80e7ed9f29b9fb2e03767c2aa94ba"
-}
@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM datatable_role WHERE id = $1",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "c85d362fe2e652d4ac01a35bf470e80b993020a2ff5dcb5849dc570d52798587"
-}
@@ -1,24 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT dt.key AS \"datatable!\"\n           FROM workspace_settings ws\n           CROSS JOIN LATERAL jsonb_each(COALESCE(ws.datatable->'datatables', '{}'::jsonb)) dt\n           WHERE ws.workspace_id = $1\n             AND dt.key <> $2\n             AND NOT dt.value ? 'permissions'\n             AND dt.value->'database'->>'resource_type' = 'instance'\n             AND dt.value->'database'->>'resource_path' = $3\n           ORDER BY dt.key",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "datatable!",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "d48ca62c86b1af7a9dd2450c1c28dc45020a2a553d8874c49f9eafedea5a9d40"
-}
@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT datatable FROM workspace_settings WHERE workspace_id = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "datatable",
-        "type_info": "Jsonb"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      true
-    ]
-  },
-  "hash": "d5fb5dde6300862f978739a3d9249fc2b3e7697c0da7d3195398933d3d81aadf"
-}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "UPDATE token SET label = $1\n           WHERE email = $2 AND token_prefix = $3\n             AND (label IS NULL OR (\n                 label <> 'session'\n                 AND label <> 'guest_session'\n                 AND lower(label) NOT LIKE 'ephemeral%'\n                 AND label <> 'debugger-token'\n                 AND label NOT LIKE 'mcp-oauth-%'\n                 AND NOT starts_with(label, 'embed_app:')\n                 AND NOT starts_with(label, 'sdk_app:')\n                 AND NOT starts_with(label, 'impersonation:')\n                 AND NOT starts_with(label, 'cli-login:')\n             ))\n           RETURNING token_prefix",
+  "query": "UPDATE token SET label = $1\n           WHERE email = $2 AND token_prefix = $3\n             AND (label IS NULL OR (\n                 label <> 'session'\n                 AND label <> 'guest_session'\n                 AND lower(label) NOT LIKE 'ephemeral%'\n                 AND label <> 'debugger-token'\n                 AND label NOT LIKE 'mcp-oauth-%'\n                 AND NOT starts_with(label, 'embed_app:')\n                 AND NOT starts_with(label, 'sdk_app:')\n                 AND NOT starts_with(label, 'impersonation:')\n             ))\n           RETURNING token_prefix",
  "describe": {
    "columns": [
      {
@@ -20,5 +20,5 @@
      false
    ]
  },
-  "hash": "383c80239525d9c4ee90e2f5cb6e46c8a0983c52ad15db083f84a9e344dc4c99"
+  "hash": "d631a26e5531589ff37e677f91a4f1d9f850e3e46c17130dd580426cda7a9f65"
 }
@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE workspace_settings ws\n               SET datatable = (\n                   SELECT jsonb_set(ws.datatable, '{datatables}', jsonb_object_agg(\n                       dt.key,\n                       CASE WHEN dt.value->'reference'->>'workspace_id' = $1\n                                 AND dt.value->'reference'->>'datatable' = $2\n                           THEN jsonb_set(dt.value, '{reference,datatable}', to_jsonb($3::text))\n                           ELSE dt.value END\n                   ))\n                   FROM jsonb_each(ws.datatable->'datatables') dt\n               )\n               WHERE jsonb_typeof(ws.datatable->'datatables') = 'object'\n                 AND ws.datatable::text LIKE '%\"reference\"%'",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "da5057c86607327bafc2942c218025ca9181a0c396405984d87e422e129521c1"
-}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "\n        SELECT\n            workspace_id,\n            slack_team_id,\n            teams_team_id,\n            teams_team_name,\n            teams_team_guid,\n            slack_name,\n            slack_command_script,\n            teams_command_script,\n            slack_email,\n            slack_oauth_client_id,\n            slack_oauth_client_secret,\n            customer_id,\n            plan,\n            webhook,\n            ai_config,\n            dbt_warehouses,\n            large_file_storage,\n            datatable,\n            ducklake,\n            git_sync,\n            deploy_ui,\n            default_app,\n            default_scripts,\n            mute_critical_alerts,\n            color,\n            operator_settings,\n            git_app_installations,\n            auto_invite,\n            error_handler,\n            success_handler,\n            public_app_execution_limit_per_minute,\n            error_handler_fallback_to_instance_alerts,\n            guest_access_enabled,\n            guest_jwt_public_key,\n            guest_jwt_jwks_url,\n            add_admins_and_developers_to_forks\n        FROM\n            workspace_settings\n        WHERE\n            workspace_id = $1\n        ",
+  "query": "\n        SELECT\n            workspace_id,\n            slack_team_id,\n            teams_team_id,\n            teams_team_name,\n            teams_team_guid,\n            slack_name,\n            slack_command_script,\n            teams_command_script,\n            slack_email,\n            slack_oauth_client_id,\n            slack_oauth_client_secret,\n            customer_id,\n            plan,\n            webhook,\n            ai_config,\n            dbt_warehouses,\n            large_file_storage,\n            datatable,\n            ducklake,\n            git_sync,\n            deploy_ui,\n            default_app,\n            default_scripts,\n            mute_critical_alerts,\n            color,\n            operator_settings,\n            git_app_installations,\n            auto_invite,\n            error_handler,\n            success_handler,\n            public_app_execution_limit_per_minute,\n            error_handler_fallback_to_instance_alerts,\n            guest_access_enabled,\n            guest_jwt_public_key,\n            guest_jwt_jwks_url\n        FROM\n            workspace_settings\n        WHERE\n            workspace_id = $1\n        ",
  "describe": {
    "columns": [
      {
@@ -177,11 +177,6 @@
        "ordinal": 34,
        "name": "guest_jwt_jwks_url",
        "type_info": "Text"
-      },
-      {
-        "ordinal": 35,
-        "name": "add_admins_and_developers_to_forks",
-        "type_info": "Bool"
      }
    ],
    "parameters": {
@@ -224,9 +219,8 @@
      false,
      false,
      true,
-      true,
-      false
+      true
    ]
  },
-  "hash": "8ebe054b41793f1a7b85f1f8d29cd21d12fa1207b58bfc46249c250cdcdb5363"
+  "hash": "dc4a57df3becc610f631ef22c116450390addbfae85fecc61c991d94167e6e99"
 }
@@ -1,20 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT value->'roles' FROM global_settings WHERE name = 'custom_instance_pg_databases'",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "?column?",
-        "type_info": "Jsonb"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "dc8dfc37559e9b6713bde48155f48b5a2c7b8199eace1508e102b60d1ff40c04"
-}
@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE postgres_trigger SET server_id = NULL, last_server_ping = NULL\n             WHERE workspace_id = $1\n               AND (postgres_resource_path = $2 OR postgres_resource_path LIKE $3)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "e159b2ff15633f85e839ee4fe1ec2ecd11caf228ea8d0f52ad66def595644250"
-}
@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT datatable FROM workspace_settings WHERE workspace_id = $1 FOR UPDATE",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "datatable",
-        "type_info": "Jsonb"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      true
-    ]
-  },
-  "hash": "e2061df65ffd4a72146c4ca316829265289c8d6f625ac272655c88e1ad0b1745"
-}
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE v2_job_queue SET worker = $1 WHERE id = $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Uuid"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "e459c277c0bc27293d71972d12d26d32b476a43ed391c09d7678215195c4283a"
-}
@@ -1,17 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE workspace_settings\n               SET datatable = jsonb_set(\n                   jsonb_set(\n                       datatable #- ARRAY['datatables', $2, 'reference'],\n                       ARRAY['datatables', $2, 'database'], $3::jsonb),\n                   ARRAY['datatables', $2, 'forked_from'], $4::jsonb\n               )\n               WHERE workspace_id = $1",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Jsonb",
-        "Jsonb"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "ebaf3ed3097621da59dd201b5a4b9d1f440692f183c7c378f59e4b73f1c6e241"
-}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "\n        SELECT\n            workspace_id,\n            slack_team_id,\n            slack_name,\n            teams_team_id,\n            teams_team_name,\n            teams_team_guid,\n            mute_critical_alerts,\n            guest_access_enabled,\n            add_admins_and_developers_to_forks,\n            deploy_ui,\n            large_file_storage,\n            datatable\n        FROM\n            workspace_settings\n        WHERE\n            workspace_id = $1\n        ",
+  "query": "\n        SELECT\n            workspace_id,\n            slack_team_id,\n            slack_name,\n            teams_team_id,\n            teams_team_name,\n            teams_team_guid,\n            mute_critical_alerts,\n            guest_access_enabled,\n            deploy_ui,\n            large_file_storage,\n            datatable\n        FROM\n            workspace_settings\n        WHERE\n            workspace_id = $1\n        ",
  "describe": {
    "columns": [
      {
@@ -45,21 +45,16 @@
      },
      {
        "ordinal": 8,
-        "name": "add_admins_and_developers_to_forks",
-        "type_info": "Bool"
-      },
-      {
-        "ordinal": 9,
        "name": "deploy_ui",
        "type_info": "Jsonb"
      },
      {
-        "ordinal": 10,
+        "ordinal": 9,
        "name": "large_file_storage",
        "type_info": "Jsonb"
      },
      {
-        "ordinal": 11,
+        "ordinal": 10,
        "name": "datatable",
        "type_info": "Jsonb"
      }
@@ -78,11 +73,10 @@
      true,
      true,
      false,
-      false,
      true,
      true,
      true
    ]
  },
-  "hash": "e6e31fdf705896c81f9a0f45d47c1b93db0406aaf278bccba07be00e9f937e2a"
+  "hash": "ede15bff96152f209aff756830cbc76b5afa1af6ed324376989117b1054c3447"
 }
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO workspace_settings (workspace_id, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url, add_admins_and_developers_to_forks) SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url, add_admins_and_developers_to_forks FROM workspace_settings WHERE workspace_id = $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "eefa0588a6a927fd9b3f65e1df652fb2b4cf7983049d2c490940df360c7e2b30"
-}
@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT workspace_id FROM workspace_settings WHERE datatable::text LIKE $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "workspace_id",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "f3ee09fb17955ca8d886f446d397063c4094546a7807343b570b823796372cef"
-}
@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE workspace_settings\n           SET datatable = CASE WHEN $3::jsonb = 'null'::jsonb\n               THEN datatable #- ARRAY['datatables', $2, 'permissions']\n               ELSE jsonb_set(datatable, ARRAY['datatables', $2, 'permissions'], $3::jsonb)\n           END\n           WHERE workspace_id = $1",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Jsonb"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "f4adc9e26ebfebce18a29fb2c21bf06394cacb8a9699a608327b097e0ac1363e"
-}
@@ -1,17 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE datatable_role SET name = $2, enabled = $3, pwd = $4 WHERE id = $1",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Varchar",
-        "Bool",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "fcb34e643b888122766e115a01394ab31ac856252aaa76c75ea27a447009c363"
-}
@@ -2311,9 +2311,9 @@ dependencies = [

 [[package]]
 name = "cc"
-version = "1.4.7"
+version = "1.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54413ede23c2daf518f35156dfde027feb2374004d63bd497f983c8db9c0e313"
+checksum = "a3eb0f42d6c360dc3f8a821f6bf2fdea7f72bfd36b3076eb0e6d1e9e0752fff4"
 dependencies = [
 "find-msvc-tools",
 "jobserver",
@@ -5055,9 +5055,9 @@ dependencies = [

 [[package]]
 name = "find-msvc-tools"
-version = "0.1.13"
+version = "0.1.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef25905e51abafe4dcea6c15fec58c57b601cdbd0ee53d22ea1d3016c587d39b"
+checksum = "3e0f1c7c3a72c66fd80abe965175f7523475c0489a87d3ff9d6e8c87d87a9d2d"

 [[package]]
 name = "fixedbitset"
@@ -5497,9 +5497,9 @@ dependencies = [

 [[package]]
 name = "generator"
-version = "0.8.10"
+version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54ade96dc9003043bce7c035c85a9df5a858bfb2039c5a2e6fdf00f324f6c551"
+checksum = "b3b854b0e584ead1a33f18b2fcad7cf7be18b3875c78816b753639aa501513ae"
 dependencies = [
 "cc",
 "cfg-if",
@@ -14793,7 +14793,7 @@ dependencies = [

 [[package]]
 name = "windmill"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "async-nats",
@@ -14881,7 +14881,7 @@ dependencies = [

 [[package]]
 name = "windmill-ai"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "async-stream",
 "async-trait",
@@ -14915,7 +14915,7 @@ dependencies = [

 [[package]]
 name = "windmill-alerting"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -14928,7 +14928,7 @@ dependencies = [

 [[package]]
 name = "windmill-api"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "argon2",
@@ -15068,7 +15068,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15091,7 +15091,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-assets"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15108,7 +15108,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-auth"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "axum 0.8.9",
@@ -15134,7 +15134,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-client"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "reqwest 0.12.28",
 "serde",
@@ -15144,7 +15144,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-configs"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15161,7 +15161,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-debug"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "axum 0.8.9",
 "base64 0.22.1",
@@ -15183,7 +15183,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-embeddings"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "axum 0.8.9",
@@ -15206,7 +15206,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15222,7 +15222,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-flows"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15244,7 +15244,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-groups"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15266,7 +15266,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-inputs"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15280,7 +15280,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "async-nats",
@@ -15315,7 +15315,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-jobs"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "axum 0.8.9",
@@ -15340,7 +15340,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15368,7 +15368,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-openapi"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "axum 0.8.9",
@@ -15390,7 +15390,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-schedule"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15410,7 +15410,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-scripts"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15448,7 +15448,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-settings"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "axum 0.8.9",
@@ -15470,14 +15470,13 @@ dependencies = [
 "windmill-ai",
 "windmill-alerting",
 "windmill-api-auth",
- "windmill-audit",
 "windmill-common",
 "windmill-object-store",
 ]

 [[package]]
 name = "windmill-api-sse"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "lazy_static",
 "serde",
@@ -15489,7 +15488,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-users"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "argon2",
 "axum 0.8.9",
@@ -15513,7 +15512,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-workers"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15527,7 +15526,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-workspaces"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15562,7 +15561,7 @@ dependencies = [

 [[package]]
 name = "windmill-audit"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "chrono",
 "lazy_static",
@@ -15576,7 +15575,7 @@ dependencies = [

 [[package]]
 name = "windmill-autoscaling"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "axum 0.8.9",
@@ -15595,7 +15594,7 @@ dependencies = [

 [[package]]
 name = "windmill-common"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "aes-gcm",
 "aho-corasick",
@@ -15702,7 +15701,7 @@ dependencies = [

 [[package]]
 name = "windmill-dep-map"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "chrono",
 "futures",
@@ -15722,7 +15721,7 @@ dependencies = [

 [[package]]
 name = "windmill-git-sync"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "regex",
 "serde",
@@ -15739,7 +15738,7 @@ dependencies = [

 [[package]]
 name = "windmill-indexer"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "astral-tokio-tar",
@@ -15766,7 +15765,7 @@ dependencies = [

 [[package]]
 name = "windmill-jseval"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "futures",
@@ -15783,7 +15782,7 @@ dependencies = [

 [[package]]
 name = "windmill-macros"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "itertools 0.14.0",
 "lazy_static",
@@ -15799,7 +15798,7 @@ dependencies = [

 [[package]]
 name = "windmill-mcp"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -15820,7 +15819,7 @@ dependencies = [

 [[package]]
 name = "windmill-native-triggers"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -15851,7 +15850,7 @@ dependencies = [

 [[package]]
 name = "windmill-oauth"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "arc-swap",
@@ -15876,7 +15875,7 @@ dependencies = [

 [[package]]
 name = "windmill-object-store"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "async-stream",
@@ -15911,7 +15910,7 @@ dependencies = [

 [[package]]
 name = "windmill-operator"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "futures",
@@ -15929,7 +15928,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "convert_case 0.6.0",
 "serde",
@@ -15938,7 +15937,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-bash"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -15950,7 +15949,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-csharp"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "serde_json",
@@ -15962,7 +15961,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-go"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "gosyn",
@@ -15974,7 +15973,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-graphql"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -15986,7 +15985,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-java"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "serde_json",
@@ -15998,7 +15997,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-nu"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "nu-parser",
@@ -16009,7 +16008,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-php"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "itertools 0.14.0",
@@ -16020,7 +16019,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-py"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "itertools 0.14.0",
@@ -16032,7 +16031,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "rustpython-ast",
@@ -16043,7 +16042,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "async-recursion",
@@ -16065,7 +16064,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-r"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "serde_json",
@@ -16077,7 +16076,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-ruby"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -16091,7 +16090,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-rust"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "convert_case 0.6.0",
@@ -16108,7 +16107,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-sql"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -16121,7 +16120,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "serde",
@@ -16133,7 +16132,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-ts"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -16151,7 +16150,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "serde-wasm-bindgen",
@@ -16167,7 +16166,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-wac"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "rustpython-ast",
@@ -16183,7 +16182,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-yaml"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -16197,7 +16196,7 @@ dependencies = [

 [[package]]
 name = "windmill-queue"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "async-recursion",
@@ -16236,7 +16235,7 @@ dependencies = [

 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "const_format",
@@ -16276,7 +16275,7 @@ dependencies = [

 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "getrandom 0.3.4",
 "wasm-bindgen",
@@ -16287,7 +16286,7 @@ dependencies = [

 [[package]]
 name = "windmill-store"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "async-recursion",
@@ -16322,7 +16321,7 @@ dependencies = [

 [[package]]
 name = "windmill-test-utils"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16346,7 +16345,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16379,7 +16378,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-amqp"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16406,7 +16405,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-azure"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16439,7 +16438,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-email"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16459,7 +16458,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16493,7 +16492,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-http"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16529,7 +16528,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16552,7 +16551,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16576,7 +16575,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-nats"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "async-nats",
@@ -16600,7 +16599,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16635,7 +16634,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16663,7 +16662,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16688,7 +16687,7 @@ dependencies = [

 [[package]]
 name = "windmill-types"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "bitflags 2.13.2",
@@ -16707,7 +16706,7 @@ dependencies = [

 [[package]]
 name = "windmill-worker"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "async-once-cell",
@@ -16825,7 +16824,7 @@ dependencies = [

 [[package]]
 name = "windmill-worker-volumes"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "bytes",
 "futures",
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.815.0"
+version = "1.814.0"
 authors.workspace = true
 edition.workspace = true

@@ -88,7 +88,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]

 [workspace.package]
-version = "1.815.0"
+version = "1.814.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"

@@ -1 +1 @@
-bc3ef08c8e4233508c023e6ee847a3cd0b8be43b
+d252afcc80e77fcc4f9a2a346b80908c8605a6c0
@@ -1,18 +0,0 @@
-- Refuse while the catalog holds anything. Each row is a live Postgres login with a password
-- only this table carries, so dropping it would leave credentials on the cluster that Windmill can
-- no longer disable, delete or even name — and re-applying could not recreate them, because the
-- role names would already be taken. Cleaning them up here is not an option either: dropping a
-- role means reassigning what it owns in *every* instance database, and a migration runs in one.
--
-- Delete the roles through instance settings first; that path does the cluster work.
-LOCK TABLE datatable_role IN ACCESS EXCLUSIVE MODE;
-
-DO $$
-BEGIN
-    IF EXISTS (SELECT 1 FROM datatable_role) THEN
-        RAISE EXCEPTION 'Cannot roll back: % data table role(s) still exist as Postgres logins. Delete them in instance settings first, which drops them from the cluster.',
-            (SELECT count(*) FROM datatable_role);
-    END IF;
-END $$;
-
-DROP TABLE IF EXISTS datatable_role;
@@ -1,21 +0,0 @@
-- The instance's data table role catalog: one row per Postgres login Windmill created for data
-- table access.
--
-- A table rather than a `global_settings` key, because the value is a set of live cluster
-- credentials and that table has generic read, list, write and CLI round-trip paths that know
-- nothing about what they are carrying. Every one of them is a way to leak the passwords or to
-- overwrite the catalog with a copy that has none, and a row nothing generic touches has none of
-- those. One row per role also makes two concurrent creates two inserts rather than a
-- read-modify-write over one document.
-CREATE TABLE datatable_role (
-    id VARCHAR(50) PRIMARY KEY,
-    -- The Postgres role name, verbatim. Unique because it is the cluster's own key.
-    name VARCHAR(63) NOT NULL UNIQUE,
-    enabled BOOLEAN NOT NULL DEFAULT true,
-    -- Generated by Windmill, never entered by anyone, and never leaves the server.
-    pwd TEXT,
-    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
-);
-
-GRANT ALL ON datatable_role TO windmill_user;
-GRANT ALL ON datatable_role TO windmill_admin;
@@ -1 +0,0 @@
-ALTER TABLE workspace_settings DROP COLUMN add_admins_and_developers_to_forks;
@@ -1 +0,0 @@
-ALTER TABLE workspace_settings ADD COLUMN add_admins_and_developers_to_forks BOOLEAN NOT NULL DEFAULT false;
@@ -6191,7 +6191,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"

 [[package]]
 name = "windmill-common"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "aho-corasick",
 "anyhow",
@@ -6274,7 +6274,7 @@ dependencies = [

 [[package]]
 name = "windmill-macros"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -6286,7 +6286,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "convert_case",
 "serde",
@@ -6295,7 +6295,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-bash"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -6307,7 +6307,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-csharp"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "serde_json",
@@ -6319,7 +6319,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-go"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "gosyn",
@@ -6331,7 +6331,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-graphql"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -6343,7 +6343,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-java"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "serde_json",
@@ -6355,7 +6355,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-nu"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "nu-parser",
@@ -6366,7 +6366,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-php"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "itertools 0.14.0",
@@ -6377,7 +6377,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-py"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "itertools 0.14.0",
@@ -6389,7 +6389,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "rustpython-ast",
@@ -6400,7 +6400,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "async-recursion",
@@ -6422,7 +6422,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-r"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "serde_json",
@@ -6434,7 +6434,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-ruby"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -6448,7 +6448,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-rust"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "convert_case",
@@ -6465,7 +6465,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-sql"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -6478,7 +6478,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "serde",
@@ -6490,7 +6490,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-ts"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -6508,7 +6508,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "serde-wasm-bindgen",
@@ -6524,7 +6524,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-wac"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "rustpython-ast",
@@ -6540,7 +6540,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-wasm"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "getrandom 0.2.17",
@@ -6572,7 +6572,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-yaml"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -6586,7 +6586,7 @@ dependencies = [

 [[package]]
 name = "windmill-types"
-version = "1.815.0"
+version = "1.814.0"
 dependencies = [
 "anyhow",
 "bitflags",
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]

 [workspace.package]
-version = "1.815.0"
+version = "1.814.0"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]

@@ -730,12 +730,7 @@ pub fn parse_asset_syntax(
    s: &str,
    enable_default_syntax: bool,
 ) -> Option<(AssetKind, Cow<'_, str>)> {
-    // `datatable` and `datatable?role=analyst` both name the default data table: the role picks
-    // which Postgres login the connection is made as, not which data table is read.
-    if enable_default_syntax
-        && s.strip_prefix("datatable")
-            .is_some_and(|rest| rest.is_empty() || rest.starts_with('?'))
-    {
+    if enable_default_syntax && s == "datatable" {
        return Some((AssetKind::DataTable, Cow::Borrowed("main")));
    } else if enable_default_syntax && s == "ducklake" {
        return Some((AssetKind::Ducklake, Cow::Borrowed("main")));
@@ -746,14 +741,6 @@ pub fn parse_asset_syntax(
            if *kind == AssetKind::Dbt {
                return Some((*kind, Cow::Owned(canonicalize_table_asset_path(suffix))));
            }
-            // Same reasoning as above, for the explicit form. Specific to data tables: a
-            // `Resource`'s `?table=` is part of what it names, and stripping it would merge two
-            // different assets.
-            if *kind == AssetKind::DataTable {
-                if let Some((path, _role)) = suffix.split_once('?') {
-                    return Some((*kind, Cow::Borrowed(path)));
-                }
-            }
            // The suffix is kept verbatim. For S3 the path encodes the storage:
            // `s3://<storage>/<key>`, with an EMPTY storage segment for the
            // workspace default — so `s3:///key` yields `/key` (leading slash
@@ -1705,25 +1692,6 @@ fn parse_trigger_spec(s: &str) -> Option<TriggerSpec> {
 mod pipeline_annotation_tests {
    use super::*;

-    #[test]
-    fn a_datatable_role_is_not_part_of_the_asset_it_names() {
-        // The role picks which Postgres login the connection is made as, so two references that
-        // differ only by role are the same asset and must land on one graph node.
-        assert_eq!(
-            parse_asset_syntax("datatable://sales?role=analytics", false),
-            Some((AssetKind::DataTable, Cow::Borrowed("sales")))
-        );
-        assert_eq!(
-            parse_asset_syntax("datatable?role=analytics", true),
-            Some((AssetKind::DataTable, Cow::Borrowed("main")))
-        );
-        // A resource's `?table=` is part of what it names, so it is kept.
-        assert_eq!(
-            parse_asset_syntax("$res:f/db/pg?table=users", false),
-            Some((AssetKind::Resource, Cow::Borrowed("f/db/pg?table=users")))
-        );
-    }
-
    #[test]
    fn s3_path_keeps_storage_distinction() {
        // An S3 asset path is `<storage>/<key>` with an empty storage segment
@@ -52,8 +52,7 @@ use windmill_common::{
        INSTANCE_EVENTS_WEBHOOK_SETTING, INSTANCE_PYTHON_VERSION_SETTING,
        JOB_DEFAULT_TIMEOUT_SECS_SETTING, JOB_ISOLATION_SETTING, JWT_SECRET_SETTING,
        KEEP_JOB_DIR_SETTING, LICENSE_KEY_SETTING, MAVEN_REPOS_SETTING, MAVEN_SETTINGS_XML_SETTING,
-        MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING, MONITOR_LOGS_ON_OBJECT_STORE_SETTING,
-        NO_DEFAULT_MAVEN_SETTING,
+        MONITOR_LOGS_ON_OBJECT_STORE_SETTING, NO_DEFAULT_MAVEN_SETTING,
        NPM_CONFIG_REGISTRY_SETTING, NSJAIL_TMPFS_SIZE_MB_SETTING, NSJAIL_TMP_BACKING_SETTING,
        NUGET_CONFIG_SETTING, OAUTH_SETTING, OTEL_SETTING, OTEL_TRACES_RETENTION_SECS_SETTING,
        OTEL_TRACING_PROXY_SETTING, PIP_INDEX_URL_SETTING, POWERSHELL_REPO_PAT_SETTING,
@@ -127,8 +126,7 @@ use windmill_worker::{

 use crate::monitor::{
    initial_load, load_concurrency_key_max_queued, load_disable_password_login,
-    load_fork_workspace_tag_append_fork_suffix, load_keep_job_dir,
-    load_mcp_disable_token_query_param, load_metrics_debug_enabled,
+    load_fork_workspace_tag_append_fork_suffix, load_keep_job_dir, load_metrics_debug_enabled,
    load_preview_tags_override, load_require_preexisting_user, load_retention_period_overrides,
    load_tag_per_workspace_enabled, load_tag_per_workspace_workspaces,
    load_workspace_fairness_duration_secs, load_workspace_fairness_enabled,
@@ -2166,9 +2164,6 @@ async fn process_notify_event(
                DISABLE_PASSWORD_LOGIN_SETTING => {
                    load_disable_password_login(db).await;
                }
-                MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING => {
-                    load_mcp_disable_token_query_param(db).await;
-                }
                EXPOSE_METRICS_SETTING => {
                    tracing::info!("Metrics setting changed, restarting");
                    spawn_graceful_killpill(tx, db, 30, "metrics setting change", server_mode)
@@ -45,10 +45,7 @@ use windmill_common::otel_oss::{
 use windmill_common::{
    agent_workers::DECODED_AGENT_TOKEN,
    apps::APP_WORKSPACED_ROUTE,
-    auth::{
-        create_token_for_owner, ephemeral_script_token_label, job_token_expiry_secs,
-        TOKEN_EXPIRY_WARNING_DAYS,
-    },
+    auth::{create_token_for_owner, ephemeral_script_token_label, job_token_expiry_secs},
    ee_oss::CriticalErrorChannel,
    email_oss::send_email_if_possible,
    error,
@@ -65,7 +62,6 @@ use windmill_common::{
        FORK_WORKSPACE_TAG_APPEND_FORK_SUFFIX_SETTING, HUB_API_SECRET_SETTING,
        HUB_BASE_URL_SETTING, INSTANCE_PYTHON_VERSION_SETTING, JOB_DEFAULT_TIMEOUT_SECS_SETTING,
        JOB_ISOLATION_SETTING, JWT_SECRET_SETTING, KEEP_JOB_DIR_SETTING, LICENSE_KEY_SETTING,
-        MCP_DISABLE_TOKEN_QUERY_PARAM, MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING,
        MONITOR_LOGS_ON_OBJECT_STORE_SETTING, NPMRC_SETTING, NPM_CONFIG_REGISTRY_SETTING,
        NSJAIL_TMPFS_SIZE_MB_SETTING, NSJAIL_TMP_BACKING_SETTING, NUGET_CONFIG_SETTING,
        OTEL_SETTING, OTEL_TRACES_RETENTION_SECS_SETTING, OTEL_TRACING_PROXY_SETTING,
@@ -289,15 +285,6 @@ pub async fn initial_load(
    );

    if let Some(db) = conn.as_sql() {
-        // Outside the `server_mode` block below: a `MODE=mcp` process serves the MCP routes
-        // with `server_mode` false and would otherwise never read this at all. That mode
-        // joins no monitor loop, so there — as for every global setting, `base_url`
-        // included — this pass is the only read, and a change lands on restart.
-        pass.setting(
-            MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING,
-            false,
-            |v| async move { apply_mcp_disable_token_query_param(v) },
-        );
        pass.setting(DEFAULT_TAGS_PER_WORKSPACE_SETTING, false, |v| async move {
            apply_tag_per_workspace_enabled(v)
        });
@@ -1627,23 +1614,6 @@ pub fn apply_disable_password_login(value: Option<serde_json::Value>) {
    };
 }

-pub async fn load_mcp_disable_token_query_param(db: &DB) {
-    match load_value_from_global_settings(db, MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING).await {
-        Ok(v) => apply_mcp_disable_token_query_param(v),
-        Err(e) => tracing::error!("Error loading mcp_disable_token_query_param setting: {e:#}"),
-    };
-}
-
-pub fn apply_mcp_disable_token_query_param(value: Option<serde_json::Value>) {
-    match value {
-        Some(serde_json::Value::Bool(t)) => {
-            MCP_DISABLE_TOKEN_QUERY_PARAM.store(t, Ordering::Relaxed)
-        }
-        None => MCP_DISABLE_TOKEN_QUERY_PARAM.store(false, Ordering::Relaxed),
-        _ => (),
-    };
-}
-
 struct LogFile {
    file_path: String,
    hostname: String,
@@ -2228,7 +2198,7 @@ async fn cleanup_scheduled_job_deletions(db: &Pool<Postgres>) {
 }

 pub async fn check_expiring_tokens(db: &DB) {
-    // Find tokens expiring within the warning window that still have a pending notification row.
+    // Find tokens expiring within 7 days that still have a pending notification row.
    // The notification table stores token_hash (not plaintext) so the join works
    // even after the hash migration makes token.token nullable.
    let expiring_tokens_r = sqlx::query_as!(
@@ -2237,9 +2207,8 @@ pub async fn check_expiring_tokens(db: &DB) {
         USING token t
         WHERE n.token_hash = t.token_hash
           AND n.expiration > now()
-           AND n.expiration <= now() + make_interval(days => $1)
+           AND n.expiration <= now() + interval '7 days'
         RETURNING t.token_prefix, t.label, t.email, t.workspace_id",
-        TOKEN_EXPIRY_WARNING_DAYS,
    )
    .fetch_all(db)
    .await;
@@ -234,7 +234,7 @@ workspace_protection_rule: workspace_id(char), name(char), rules(int), bypass_gr
  FK: (workspace_id) -> workspace(id)
 workspace_runnable_dependencies: flow_path(char), runnable_path(char), script_hash(bigint), runnable_is_flow(bool), workspace_id(char), app_path(char), id(bigint), runnable_is_agent(bool)
  FK: (app_path, workspace_id) -> app(path, workspace_id) | (flow_path, workspace_id) -> flow(path, workspace_id)
-workspace_settings: workspace_id(char), slack_team_id(char), slack_name(char), slack_command_script(char), slack_email(char), customer_id(char), plan(char), webhook(text), ai_config(jsonb), large_file_storage(jsonb), git_sync(jsonb), default_app(char), default_scripts(jsonb), deploy_ui(jsonb), mute_critical_alerts(bool), color(char), operator_settings(jsonb), teams_command_script(text), teams_team_id(text), teams_team_name(text), git_app_installations(jsonb), ducklake(jsonb), slack_oauth_client_id(char), slack_oauth_client_secret(char), datatable(jsonb), teams_team_guid(text), auto_invite(jsonb), error_handler(jsonb), success_handler(jsonb), public_app_execution_limit_per_minute(int), dbt_warehouses(jsonb), guest_access_enabled(bool), guest_jwt_public_key(text), guest_jwt_jwks_url(text), ai_sessions_backup_generation(int), add_admins_and_developers_to_forks(bool)
+workspace_settings: workspace_id(char), slack_team_id(char), slack_name(char), slack_command_script(char), slack_email(char), customer_id(char), plan(char), webhook(text), ai_config(jsonb), large_file_storage(jsonb), git_sync(jsonb), default_app(char), default_scripts(jsonb), deploy_ui(jsonb), mute_critical_alerts(bool), color(char), operator_settings(jsonb), teams_command_script(text), teams_team_id(text), teams_team_name(text), git_app_installations(jsonb), ducklake(jsonb), slack_oauth_client_id(char), slack_oauth_client_secret(char), datatable(jsonb), teams_team_guid(text), auto_invite(jsonb), error_handler(jsonb), success_handler(jsonb), public_app_execution_limit_per_minute(int), dbt_warehouses(jsonb), guest_access_enabled(bool), guest_jwt_public_key(text), guest_jwt_jwks_url(text), ai_sessions_backup_generation(int)
  FK: (workspace_id) -> workspace(id)
 zombie_job_counter: job_id(uuid), counter(int)
  FK: (job_id) -> v2_job(id)
@@ -1,181 +0,0 @@
-use axum::{
-    extract::State,
-    routing::{get, post},
-    Json, Router,
-};
-use serde_json::{json, Value};
-use sqlx::{Pool, Postgres};
-use std::{sync::Arc, time::Duration};
-use tokio::sync::Notify;
-use windmill_common::{flows::FlowValue, jobs::JobPayload};
-use windmill_test_utils::{
-    completed_job, in_test_worker, listen_for_completed_jobs, ApiServer, RunJob, StreamFind,
-};
-
-async fn model(Json(body): Json<Value>) -> ([(&'static str, &'static str); 1], String) {
-    let finished = body["messages"]
-        .as_array()
-        .unwrap()
-        .iter()
-        .any(|m| m["role"] == "tool");
-    let delta = if finished {
-        json!({"role":"assistant", "content":"done"})
-    } else {
-        json!({"role":"assistant", "tool_calls": (0..3).map(|i| json!({
-            "index":i, "id":format!("call_{i}"), "type":"function",
-            "function":{"name":format!("tool_{i}"), "arguments":"{}"}
-        })).collect::<Vec<_>>()})
-    };
-    let event = json!({"choices":[{"index":0, "delta":delta, "finish_reason":null}]});
-    let end = json!({"choices":[{"index":0, "delta":{}, "finish_reason":if finished {"stop"} else {"tool_calls"}}]});
-    (
-        [("content-type", "text/event-stream")],
-        format!("data: {event}\n\ndata: {end}\n\ndata: [DONE]\n\n"),
-    )
-}
-
-async fn run_batch(db: Pool<Postgres>, parallel: bool, limited: bool) -> anyhow::Result<()> {
-    std::env::set_var("ALLOW_PRIVATE_AI_BASE_URLS", "true");
-    let server = ApiServer::start(db.clone()).await?;
-    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await?;
-    let base = format!("http://{}", listener.local_addr()?);
-    let gate = Arc::new(Notify::new());
-    let router = Router::new()
-        .route("/v1/chat/completions", post(model))
-        .route(
-            "/first",
-            get(|State(gate): State<Arc<Notify>>| async move {
-                gate.notified().await;
-                "ok"
-            }),
-        )
-        .route(
-            "/second",
-            get(|State(gate): State<Arc<Notify>>| async move {
-                gate.notify_one();
-                "ok"
-            }),
-        )
-        .with_state(gate);
-    let stub = tokio::spawn(async move {
-        axum::serve(listener, router).await.unwrap();
-    });
-    let tools: Vec<Value> = (0..3).map(|i| {
-        let wait = if parallel && !limited && i < 2 {
-            format!("await fetch('{base}/{}');", if i == 0 {"first"} else {"second"})
-        } else { String::new() };
-        let finish = if i == 2 { "throw new Error('expected tool failure');".to_string() }
-            else { format!("return {i};") };
-        json!({"id":format!("t{i}"),"summary":format!("tool_{i}"),"value":{
-            "type":"rawscript", "language":"bun", "input_transforms":{},
-            "tag": if parallel { "bun" } else { "unserved-tool-tag" },
-            "concurrent_limit": if limited { Some(1) } else { None },
-            "custom_concurrency_key": if limited { Some("agent-tool-test") } else { None },
-            "content":format!("export async function main() {{ {wait} await Bun.sleep({}); {finish} }}", if i == 0 {200} else {0})
-        }})
-    }).collect();
-    let flow: FlowValue = serde_json::from_value(json!({"modules":[{"id":"agent","value":{
-        "type":"aiagent", "tools":tools, "input_transforms":{
-            "provider":{"type":"static","value":{"kind":"customai","model":"queue-test","resource":{"base_url":format!("{base}/v1")}}},
-            "user_message":{"type":"static","value":"run the tools"},
-            "max_iterations":{"type":"static","value":3}
-        }
-    }}]}))?;
-    let id = RunJob::from(JobPayload::RawFlow {
-        value: flow,
-        path: Some("u/test/agent_queue".into()),
-        restarted_from: None,
-    })
-    .push(&db)
-    .await;
-    let notifications = listen_for_completed_jobs(&db).await;
-    let wait = async {
-        if parallel {
-            in_test_worker(&db, notifications.find(&id), server.addr.port()).await;
-        } else {
-            notifications.find(&id).await;
-        }
-    };
-    tokio::time::timeout(
-        Duration::from_secs(45),
-        in_test_worker(&db, wait, server.addr.port()),
-    )
-    .await?;
-    let result = completed_job(id, &db).await;
-    assert!(result.success, "{:?}", result.result);
-    let result = result.json_result().expect("agent result");
-    let messages: Vec<_> = result["messages"]
-        .as_array()
-        .unwrap()
-        .iter()
-        .filter(|m| m["role"] == "tool")
-        .collect();
-    assert_eq!(messages.len(), 3);
-    for (index, message) in messages.iter().enumerate() {
-        assert_eq!(message["tool_call_id"], format!("call_{index}"));
-    }
-    assert_eq!(messages[0]["content"], "0");
-    assert_eq!(messages[1]["content"], "1");
-    assert!(messages[2]["content"]
-        .as_str()
-        .unwrap()
-        .contains("expected tool failure"));
-    let (parent_id, parent_worker): (uuid::Uuid, String) = sqlx::query_as(
-        "SELECT j.id, c.worker FROM v2_job j JOIN v2_job_completed c USING(id) WHERE j.parent_job = $1"
-    ).bind(id).fetch_one(&db).await?;
-    let children: Vec<(String, String, bool)> = sqlx::query_as(
-        "SELECT j.runnable_path, c.worker, c.status = 'success' FROM v2_job j JOIN v2_job_completed c USING(id) WHERE j.parent_job = $1 ORDER BY j.runnable_path"
-    ).bind(parent_id).fetch_all(&db).await?;
-    assert_eq!(children.len(), 3);
-    assert_eq!(
-        children[0].1, parent_worker,
-        "first tool must stay on the parent worker"
-    );
-    assert_eq!(
-        children.iter().map(|c| c.2).collect::<Vec<_>>(),
-        vec![true, true, false]
-    );
-    if limited {
-        let overlapping: i64 = sqlx::query_scalar(
-            "SELECT count(*) FROM v2_job j1 JOIN v2_job_completed c1 ON c1.id = j1.id
-            JOIN v2_job j2 ON j2.parent_job = j1.parent_job AND j2.id > j1.id
-            JOIN v2_job_completed c2 ON c2.id = j2.id
-            WHERE j1.parent_job = $1 AND c1.started_at < c2.completed_at AND c2.started_at < c1.completed_at"
-        ).bind(parent_id).fetch_one(&db).await?;
-        assert_eq!(
-            overlapping, 0,
-            "the reserved first job must count toward the shared limit"
-        );
-    } else if parallel {
-        assert_ne!(
-            children[1].1, parent_worker,
-            "second tool must unblock the first from another worker"
-        );
-    } else {
-        assert!(children.iter().all(|child| child.1 == parent_worker));
-    }
-    stub.abort();
-    server.close().await?;
-    Ok(())
-}
-
-#[sqlx::test(fixtures("base"))]
-#[serial_test::serial]
-async fn parent_drains_tools_without_another_worker(db: Pool<Postgres>) -> anyhow::Result<()> {
-    run_batch(db, false, false).await
-}
-
-#[sqlx::test(fixtures("base"))]
-#[serial_test::serial]
-async fn parent_keeps_first_tool_while_another_worker_runs_siblings(
-    db: Pool<Postgres>,
-) -> anyhow::Result<()> {
-    run_batch(db, true, false).await
-}
-
-#[cfg(all(feature = "enterprise", feature = "private"))]
-#[sqlx::test(fixtures("base"))]
-#[serial_test::serial]
-async fn reserved_tool_obeys_shared_concurrency_limit(db: Pool<Postgres>) -> anyhow::Result<()> {
-    run_batch(db, true, true).await
-}
@@ -3312,60 +3312,3 @@ export function main(i: number) {

    Ok(())
 }
-
-// A `$flow_expr[...]` step tag is resolved from the flow's state before the step is pushed, and
-// one that cannot be resolved fails the step instead of queueing it on a tag no worker serves.
-#[cfg(feature = "deno_core")]
-#[sqlx::test(fixtures("base"))]
-async fn test_flow_expr_step_tag(db: Pool<Postgres>) -> anyhow::Result<()> {
-    initialize_tracing().await;
-    let server = ApiServer::start(db.clone()).await?;
-
-    let step = |id: &str, tag: Option<&str>| {
-        flow_module(
-            id,
-            FlowModuleValue::RawScript {
-                input_transforms: Default::default(),
-                language: ScriptLang::Deno,
-                content: "export function main() { return { lang: 'bun' } }".to_string(),
-                path: None,
-                lock: None,
-                tag: tag.map(str::to_string),
-                concurrency_settings: Default::default(),
-                is_trigger: None,
-                assets: None,
-            },
-        )
-    };
-    let flow = FlowValue {
-        modules: vec![
-            step("a", None),
-            step("b", Some("$flow_expr[results.a.lang]")),
-            step("c", Some("nobody-serves-$flow_expr[a.lang]")),
-        ],
-        same_worker: false,
-        ..Default::default()
-    };
-
-    let job = RunJob::from(JobPayload::RawFlow { value: flow, path: None, restarted_from: None })
-        .run_until_complete(&db, false, server.addr.port())
-        .await;
-
-    let b_tag = sqlx::query_scalar::<_, String>(
-        "SELECT tag FROM v2_job WHERE parent_job = $1 AND flow_step_id = 'b'",
-    )
-    .bind(job.id)
-    .fetch_one(&db)
-    .await?;
-    assert_eq!(b_tag, "bun");
-
-    assert!(!job.success);
-    let result = job.json_result().unwrap();
-    let message = result["error"]["message"].as_str().unwrap_or_default();
-    assert!(
-        message.contains("Could not resolve the step tag `nobody-serves-$flow_expr[a.lang]`"),
-        "got {result:?}"
-    );
-
-    Ok(())
-}
@@ -1530,31 +1530,6 @@ async fn declarative_sync_rejects_an_unusable_instance_banner(db: Pool<Postgres>
    );
 }

-#[sqlx::test(fixtures("base"))]
-async fn declarative_sync_rejects_a_malformed_max_token_expiration(db: Pool<Postgres>) {
-    clear_settings_and_configs(&db).await;
-    let before = count_global_settings(&db).await;
-
-    let mut desired = BTreeMap::new();
-    desired.insert(
-        "max_token_expiration_days".to_string(),
-        serde_json::json!("7.0"),
-    );
-
-    let err = windmill_common::instance_config::sync_global_settings_declarative(
-        &db,
-        &BTreeMap::new(),
-        &desired,
-    )
-    .await
-    .expect_err("a ceiling the token routes cannot read must fail the sync");
-    assert!(
-        err.to_string().contains("max_token_expiration_days"),
-        "the error should name the offending setting, got: {err}"
-    );
-    assert_eq!(count_global_settings(&db).await, before);
-}
-
 #[sqlx::test(fixtures("base"))]
 async fn declarative_sync_rejects_an_unusable_default_allowed_origins(db: Pool<Postgres>) {
    // The declarative writers (the sync-config CLI, the operator's ConfigMap
@@ -1,108 +0,0 @@
-/*
- * The job's own token (`$WM_TOKEN`) stays valid well past the job it was minted
- * for, and job logs are persisted to `job_logs` and optionally to object storage,
- * so a script that echoes the token would otherwise park a live credential in
- * durable storage. `run_worker` registers the token with `sensitive_log_masks`
- * for the job it pulled; this pins that the persisted log carries the masked form.
- */
-
-use sqlx::{Pool, Postgres};
-use windmill_common::{
-    jobs::{JobPayload, RawCode},
-    scripts::ScriptLang,
-};
-use windmill_test_utils::*;
-
-/// Prefix of a serialized job token: `jwt_` plus the base64 of a JWT header.
-/// The masked form keeps only `jwt` + the last three characters, so it never matches.
-const RAW_TOKEN_PREFIX: &str = "jwt_ey";
-
-#[sqlx::test(fixtures("base"))]
-async fn test_job_token_masked_in_persisted_logs(db: Pool<Postgres>) -> anyhow::Result<()> {
-    initialize_tracing().await;
-    let server = ApiServer::start(db.clone()).await?;
-    let port = server.addr.port();
-
-    let job = RunJob::from(JobPayload::Code(RawCode {
-        hash: None,
-        content: "echo \"running with --token $WM_TOKEN\"".to_string(),
-        path: None,
-        lock: None,
-        language: ScriptLang::Bash,
-        cache_ttl: None,
-        cache_ignore_s3_path: None,
-        dedicated_worker: None,
-        concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default()
-            .into(),
-        debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
-        modules: None,
-        tag: None,
-    }))
-    .run_until_complete(&db, false, port)
-    .await;
-    assert!(job.success, "job should have succeeded");
-
-    let logs =
-        sqlx::query_scalar::<_, Option<String>>("SELECT logs FROM job_logs WHERE job_id = $1")
-            .bind(job.id)
-            .fetch_one(&db)
-            .await?
-            .unwrap_or_default();
-
-    assert!(
-        !logs.contains(RAW_TOKEN_PREFIX),
-        "an unmasked job token reached the persisted logs: {logs}"
-    );
-    assert!(
-        logs.contains("secret value was masked"),
-        "expected the masking notice in logs: {logs}"
-    );
-    Ok(())
-}
-
-/// nativets runs V8 in-process and persists `console.log` output through its own
-/// channel, so it is masked by a different mechanism than the bash case above and
-/// needs its own guard.
-#[cfg(feature = "deno_core")]
-#[sqlx::test(fixtures("base"))]
-async fn test_job_token_masked_in_nativets_logs(db: Pool<Postgres>) -> anyhow::Result<()> {
-    initialize_tracing().await;
-    let server = ApiServer::start(db.clone()).await?;
-    let port = server.addr.port();
-
-    let job = RunJob::from(JobPayload::Code(RawCode {
-        hash: None,
-        content: "export async function main() {\n  console.log('running with --token ' + process.env.WM_TOKEN);\n  return 'ok';\n}".to_string(),
-        path: None,
-        lock: None,
-        language: ScriptLang::Nativets,
-        cache_ttl: None,
-        cache_ignore_s3_path: None,
-        dedicated_worker: None,
-        concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default()
-            .into(),
-        debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
-        modules: None,
-        tag: None,
-    }))
-    .run_until_complete(&db, false, port)
-    .await;
-    assert!(job.success, "job should have succeeded");
-
-    let logs =
-        sqlx::query_scalar::<_, Option<String>>("SELECT logs FROM job_logs WHERE job_id = $1")
-            .bind(job.id)
-            .fetch_one(&db)
-            .await?
-            .unwrap_or_default();
-
-    assert!(
-        !logs.contains(RAW_TOKEN_PREFIX),
-        "an unmasked job token reached the persisted logs: {logs}"
-    );
-    assert!(
-        logs.contains("secret value was masked"),
-        "expected the masking notice in logs: {logs}"
-    );
-    Ok(())
-}
@@ -1249,10 +1249,6 @@ pub async fn register_token_expiry_notification(
    if !windmill_common::auth::is_user_token(label) {
        return;
    }
-    let warning_days = windmill_common::auth::TOKEN_EXPIRY_WARNING_DAYS;
-    if expiration <= chrono::Utc::now() + chrono::Duration::days(warning_days.into()) {
-        return;
-    }
    if let Err(e) = sqlx::query!(
        "INSERT INTO token_expiry_notification (token_hash, expiration) VALUES ($1, $2) ON CONFLICT DO NOTHING",
        token_hash,
@@ -800,14 +800,6 @@ async fn delete_folder(

    not_found_if_none(get_folderopt(&mut tx, &w_id, &name).await?, "Folder", &name)?;

-    // See the same call in `delete_group`: a freed name must not stay in a tenant list.
-    windmill_common::workspaces::remove_datatable_tenant_in_workspace(
-        &mut tx,
-        &w_id,
-        &format!("f/{name}"),
-    )
-    .await?;
-
    let del = sqlx::query_scalar!(
        "DELETE FROM folder WHERE name = $1 AND workspace_id = $2 RETURNING 1",
        name,
@@ -797,15 +797,6 @@ async fn delete_group(
    }
    not_found_if_none(get_group_opt(&mut tx, &w_id, &name).await?, "Group", &name)?;

-    // A tenant list names a principal, so a freed name must not linger in one: a later group
-    // reusing it would silently inherit the data table access this one had.
-    windmill_common::workspaces::remove_datatable_tenant_in_workspace(
-        &mut tx,
-        &w_id,
-        &format!("g/{name}"),
-    )
-    .await?;
-
    sqlx::query!(
        "DELETE FROM usr_to_group WHERE group_ = $1 AND workspace_id = $2",
        name,
@@ -1,45 +0,0 @@
-- A data table under roles in `test-workspace`, and a fork whose entry points at it rather than
-- carrying a copy. `test-user-2` is a non-admin of the parent and an admin of the fork: the shape
-- the pointer exists for.
-
-- Empty registry: role provisioning grants CONNECT on every database named here, and the data
-- table's `dt_main` is a name in workspace settings, not a database that exists.
-INSERT INTO global_settings (name, value) VALUES
-    ('custom_instance_pg_databases', '{"user_pwd": "pw", "databases": {}}'::jsonb)
-    ON CONFLICT (name) DO UPDATE SET value = EXCLUDED.value;
-
-INSERT INTO datatable_role (id, name, enabled, pwd) VALUES ('role1', 'analytics', true, 'pw');
-
-UPDATE workspace_settings SET datatable = '{
-    "datatables": {
-        "main": {
-            "database": {"resource_type": "instance", "resource_path": "dt_main"},
-            "permissions": {
-                "default_role": "role1",
-                "roles": {
-                    "admin": {"tenants": []},
-                    "role1": {"tenants": ["u/test-user-2", "g/analysts", "f/finance"]}
-                }
-            }
-        }
-    }
-}'::jsonb WHERE workspace_id = 'test-workspace';
-
-INSERT INTO group_ (workspace_id, name, summary, extra_perms) VALUES
-	('test-workspace', 'analysts', 'Analysts', '{}');
-INSERT INTO folder (workspace_id, name, display_name, owners, extra_perms) VALUES
-	('test-workspace', 'finance', 'finance', '{}', '{}');
-
-INSERT INTO workspace (id, name, owner, parent_workspace_id) VALUES
-	('wm-fork-dt', 'fork of test-workspace', 'test2@windmill.dev', 'test-workspace');
-INSERT INTO workspace_key (workspace_id, kind, key) VALUES ('wm-fork-dt', 'cloud', 'test-key');
-INSERT INTO group_ (workspace_id, name, summary, extra_perms) VALUES
-	('wm-fork-dt', 'all', 'All users', '{}');
-INSERT INTO usr (workspace_id, email, username, is_admin, role) VALUES
-	('wm-fork-dt', 'test2@windmill.dev', 'test-user-2', true, 'Admin');
-
-INSERT INTO workspace_settings (workspace_id, datatable) VALUES ('wm-fork-dt', '{
-    "datatables": {
-        "main": {"reference": {"workspace_id": "test-workspace", "datatable": "main"}}
-    }
-}'::jsonb);
@@ -311,121 +311,3 @@ async fn test_fork_keeps_only_resolvable_on_behalf_of(db: Pool<Postgres>) -> any

    Ok(())
 }
-
-/// Apps, schedules, triggers and their drafts cannot drop an identity the way scripts and flows
-/// do, so one naming nobody in the fork goes to its creator while one that still resolves stays.
-/// Forked as an admin, whose app policies the clone otherwise keeps.
-#[sqlx::test(migrations = "../migrations", fixtures("base"))]
-async fn test_fork_repoints_unresolvable_identities(db: Pool<Postgres>) -> anyhow::Result<()> {
-    initialize_tracing().await;
-
-    let server = ApiServer::start(db.clone()).await?;
-    let base_url = format!("http://localhost:{}/api", server.addr.port());
-
-    let stranger = json!({
-        "on_behalf_of": "u/test-user-2",
-        "on_behalf_of_email": "test2@windmill.dev",
-        "execution_mode": "publisher",
-    });
-    sqlx::query(
-        "INSERT INTO app (workspace_id, path, summary, policy, versions)
-         VALUES ('test-workspace', 'u/test-user/stranger', '', $1, '{}'),
-                ('test-workspace', 'u/test-user/group', '', $2, '{}')",
-    )
-    .bind(&stranger)
-    .bind(json!({
-        "on_behalf_of": "g/all",
-        "on_behalf_of_email": "group-all@windmill.dev",
-        "execution_mode": "publisher",
-    }))
-    .execute(&db)
-    .await?;
-    // The clone re-aggregates `versions` from `app_version`, and the column is NOT NULL.
-    sqlx::query(
-        "WITH v AS (
-            INSERT INTO app_version (app_id, value, created_by)
-            SELECT id, '{}'::json, 'test-user' FROM app WHERE workspace_id = 'test-workspace'
-            RETURNING id, app_id
-         )
-         UPDATE app SET versions = ARRAY[v.id] FROM v WHERE app.id = v.app_id",
-    )
-    .execute(&db)
-    .await?;
-    sqlx::query(
-        "INSERT INTO draft (workspace_id, path, typ, value, created_at, email)
-         VALUES ('test-workspace', 'u/test-user/stranger', 'raw_app', $1::json, NOW(), 'test@windmill.dev'),
-                ('test-workspace', 'u/test-user/stranger', 'trigger_websocket', $2::json, NOW(), 'test@windmill.dev'),
-                ('test-workspace', 'u/test-user/nul', 'raw_app', $3::json, NOW(), 'test@windmill.dev')",
-    )
-    .bind(json!({ "policy": stranger }))
-    .bind(json!({ "permissioned_as": "u/test-user-2" }))
-    // Saved before drafts were stripped of NULs: any jsonb parse of it raises, so it must be
-    // skipped rather than abort the fork. Built from parts because a NUL escape can't sit in source.
-    .bind(format!(
-        r#"{{"policy":{{"on_behalf_of":"u/test-user-2"}},"files":{{"f":"a{}u0000"}}}}"#,
-        "\\"
-    ))
-    .execute(&db)
-    .await?;
-    sqlx::query(
-        "INSERT INTO schedule (workspace_id, path, edited_by, schedule, script_path, email, permissioned_as, enabled)
-         VALUES ('test-workspace', 'u/test-user/stranger', 'test-user', '0 0 * * * *', 'u/test-user/s', 'test2@windmill.dev', 'u/test-user-2', false)",
-    )
-    .execute(&db)
-    .await?;
-    sqlx::query(
-        "INSERT INTO websocket_trigger (workspace_id, path, url, script_path, is_flow, edited_by, permissioned_as, mode)
-         VALUES ('test-workspace', 'u/test-user/stranger', 'ws://localhost', 'u/test-user/s', false, 'test-user', 'u/test-user-2', 'disabled')",
-    )
-    .execute(&db)
-    .await?;
-
-    let resp = reqwest::Client::new()
-        .post(format!(
-            "{base_url}/w/test-workspace/workspaces/create_fork"
-        ))
-        .header("Authorization", "Bearer SECRET_TOKEN")
-        .json(&json!({ "id": "wm-fork-repoint", "name": "Fork", "color": "#0000ff" }))
-        .send()
-        .await?;
-    assert!(
-        resp.status().is_success(),
-        "creating the fork: {}",
-        resp.text().await?
-    );
-
-    let text = |sql: &'static str| sqlx::query_scalar::<_, String>(sql).fetch_one(&db);
-    assert_eq!(
-        text("SELECT (policy->>'on_behalf_of') || ' ' || (policy->>'on_behalf_of_email') FROM app WHERE workspace_id = 'wm-fork-repoint' AND path = 'u/test-user/stranger'").await?,
-        "u/test-user test@windmill.dev"
-    );
-    assert_eq!(
-        text("SELECT policy->>'on_behalf_of' FROM app WHERE workspace_id = 'wm-fork-repoint' AND path = 'u/test-user/group'").await?,
-        "g/all"
-    );
-    assert_eq!(
-        text("SELECT value->'policy'->>'on_behalf_of' FROM draft WHERE workspace_id = 'wm-fork-repoint' AND path = 'u/test-user/stranger' AND typ = 'raw_app'").await?,
-        "u/test-user"
-    );
-    assert_eq!(
-        text("SELECT CASE WHEN strpos(value::text, 'u/test-user-2') > 0 THEN 'kept' ELSE 'rewritten' END FROM draft WHERE workspace_id = 'wm-fork-repoint' AND path = 'u/test-user/nul'").await?,
-        "kept"
-    );
-    assert_eq!(
-        text("SELECT value->>'permissioned_as' FROM draft WHERE workspace_id = 'wm-fork-repoint' AND typ = 'trigger_websocket'").await?,
-        "u/test-user"
-    );
-    assert_eq!(
-        text("SELECT permissioned_as || ' ' || email FROM schedule WHERE workspace_id = 'wm-fork-repoint'").await?,
-        "u/test-user test@windmill.dev"
-    );
-    assert_eq!(
-        text(
-            "SELECT permissioned_as FROM websocket_trigger WHERE workspace_id = 'wm-fork-repoint'"
-        )
-        .await?,
-        "u/test-user"
-    );
-
-    Ok(())
-}
@@ -1,75 +0,0 @@
-use serde_json::json;
-use sqlx::{Pool, Postgres};
-
-use windmill_test_utils::*;
-
-/// With `add_admins_and_developers_to_forks` on, a fork starts with the parent's admins and
-/// developers at their parent role, even when a developer forks it; operators are left out. The
-/// copies are manual members: a parent membership that came from an instance group must not carry
-/// that provenance into a fork that does not configure the group.
-#[sqlx::test(migrations = "../migrations", fixtures("base"))]
-async fn test_fork_adds_parent_admins_and_developers(db: Pool<Postgres>) -> anyhow::Result<()> {
-    initialize_tracing().await;
-    let server = ApiServer::start(db.clone()).await?;
-    let base_url = format!(
-        "http://localhost:{}/api/w/test-workspace/workspaces",
-        server.addr.port()
-    );
-    let client = reqwest::Client::new();
-
-    sqlx::query(
-        "UPDATE usr SET operator = true WHERE workspace_id = 'test-workspace' AND username = 'test-user-3'",
-    )
-    .execute(&db)
-    .await?;
-    sqlx::query(
-        "INSERT INTO usr (workspace_id, email, username, is_admin, added_via)
-         VALUES ('test-workspace', 'test4@windmill.dev', 'test-user-4', false,
-                 '{\"source\": \"instance_group\", \"group\": \"devs\"}')",
-    )
-    .execute(&db)
-    .await?;
-
-    let resp = client
-        .post(format!(
-            "{base_url}/edit_add_admins_and_developers_to_forks"
-        ))
-        .header("Authorization", "Bearer SECRET_TOKEN")
-        .json(&json!({ "add_admins_and_developers_to_forks": true }))
-        .send()
-        .await?;
-    assert!(
-        resp.status().is_success(),
-        "enabling the setting: {}",
-        resp.text().await?
-    );
-
-    let resp = client
-        .post(format!("{base_url}/create_fork"))
-        .header("Authorization", "Bearer SECRET_TOKEN_2")
-        .json(&json!({ "id": "wm-fork-team", "name": "Team fork" }))
-        .send()
-        .await?;
-    assert!(
-        resp.status().is_success(),
-        "creating the fork: {}",
-        resp.text().await?
-    );
-
-    let members: Vec<(String, bool, bool)> = sqlx::query_as(
-        "SELECT username, is_admin, added_via IS NULL FROM usr
-         WHERE workspace_id = 'wm-fork-team' ORDER BY username",
-    )
-    .fetch_all(&db)
-    .await?;
-    assert_eq!(
-        members,
-        vec![
-            ("test-user".to_string(), true, true),
-            ("test-user-2".to_string(), false, true),
-            ("test-user-4".to_string(), false, true),
-        ]
-    );
-
-    Ok(())
-}
@@ -115,60 +115,6 @@ async fn login_link_is_single_use_and_same_origin(db: Pool<Postgres>) -> anyhow:
    Ok(())
 }

-#[sqlx::test(migrations = "../migrations", fixtures("base"))]
-async fn confirmed_login_link_is_spent_by_the_click_not_the_page(
-    db: Pool<Postgres>,
-) -> anyhow::Result<()> {
-    initialize_tracing().await;
-    let server = ApiServer::start(db.clone()).await?;
-    let port = server.addr.port();
-    let base = format!("http://localhost:{port}/api");
-
-    let resp = client()
-        .post(format!("{base}/users/login_links"))
-        .header("Authorization", "Bearer SECRET_TOKEN")
-        .json(&json!({"email": "test2@windmill.dev", "confirm": true}))
-        .send()
-        .await?;
-    assert_eq!(resp.status(), 201);
-    let link = resp.json::<serde_json::Value>().await?;
-    // The URL handed out is the frontend page, not the API path that signs in on a GET.
-    let token = link["url"]
-        .as_str()
-        .unwrap()
-        .split_once("/user/login_link?token=")
-        .expect("confirmation page url")
-        .1
-        .to_string();
-
-    let confirm = || {
-        client()
-            .post(format!("{base}/auth/login_link/{token}"))
-            .send()
-    };
-    let resp = confirm().await?;
-    assert_eq!(resp.status(), 200);
-    assert!(resp
-        .headers()
-        .get_all("set-cookie")
-        .iter()
-        .any(|c| c.to_str().unwrap().starts_with("token=")));
-    assert_eq!(
-        resp.json::<serde_json::Value>().await?["location"],
-        "/user/workspaces"
-    );
-
-    let resp = confirm().await?;
-    assert_eq!(resp.status(), 200);
-    assert!(resp.headers().get("set-cookie").is_none());
-    assert_eq!(
-        resp.json::<serde_json::Value>().await?["location"],
-        "/user/login_link_expired?reason=used"
-    );
-
-    Ok(())
-}
-
 #[sqlx::test(migrations = "../migrations", fixtures("base"))]
 async fn login_link_mint_can_require_a_login_type(db: Pool<Postgres>) -> anyhow::Result<()> {
    initialize_tracing().await;
@@ -1,239 +0,0 @@
-//! `max_token_expiration_days`: the instance-wide ceiling on how far ahead a token a caller
-//! picks the lifetime of may expire, and the service-account exemption.
-
-use serde_json::json;
-use sqlx::types::chrono::{DateTime, Utc};
-use sqlx::{Pool, Postgres};
-use windmill_test_utils::*;
-
-const DAY: u64 = 24 * 60 * 60;
-
-fn client() -> reqwest::Client {
-    reqwest::Client::new()
-}
-
-fn from_now(secs: u64) -> DateTime<Utc> {
-    Utc::now() + std::time::Duration::from_secs(secs)
-}
-
-async fn set_max(db: &Pool<Postgres>, value: serde_json::Value) {
-    sqlx::query(
-        "INSERT INTO global_settings (name, value) VALUES ('max_token_expiration_days', $1)
-         ON CONFLICT (name) DO UPDATE SET value = EXCLUDED.value",
-    )
-    .bind(value)
-    .execute(db)
-    .await
-    .unwrap();
-}
-
-/// Mints as `test2@windmill.dev`, a plain member of `test-workspace`.
-async fn create_token(port: u16, body: serde_json::Value) -> reqwest::Response {
-    client()
-        .post(format!("http://localhost:{port}/api/users/tokens/create"))
-        .header("Authorization", "Bearer SECRET_TOKEN_2")
-        .json(&body)
-        .send()
-        .await
-        .unwrap()
-}
-
-async fn stored_expiration(db: &Pool<Postgres>, label: &str) -> Option<DateTime<Utc>> {
-    sqlx::query_scalar::<_, Option<DateTime<Utc>>>("SELECT expiration FROM token WHERE label = $1")
-        .bind(label)
-        .fetch_one(db)
-        .await
-        .unwrap()
-}
-
-#[sqlx::test(migrations = "../migrations", fixtures("base"))]
-async fn test_max_token_expiration_days_shortens_user_tokens(
-    db: Pool<Postgres>,
-) -> anyhow::Result<()> {
-    initialize_tracing().await;
-    let server = ApiServer::start(db.clone()).await?;
-    let port = server.addr.port();
-
-    let resp = create_token(port, json!({ "label": "unset" })).await;
-    assert_eq!(resp.status(), 201);
-    assert_eq!(
-        stored_expiration(&db, "unset").await,
-        None,
-        "with no setting a token may still have no expiration"
-    );
-
-    // Refused at write time: the token routes can only read a value they cannot parse as no
-    // ceiling at all.
-    let resp = client()
-        .post(format!(
-            "http://localhost:{port}/api/settings/global/max_token_expiration_days"
-        ))
-        .header("Authorization", "Bearer SECRET_TOKEN")
-        .json(&json!({ "value": 7.5 }))
-        .send()
-        .await?;
-    assert_eq!(resp.status(), 400);
-
-    set_max(&db, json!(7)).await;
-
-    // The token form reads the ceiling as whoever is creating the token, usually not a
-    // superadmin, so it can offer only expirations the server would keep.
-    let resp = client()
-        .get(format!(
-            "http://localhost:{port}/api/settings/global/max_token_expiration_days"
-        ))
-        .header("Authorization", "Bearer SECRET_TOKEN_2")
-        .send()
-        .await?;
-    assert_eq!(resp.status(), 200);
-    assert_eq!(resp.text().await?, "7");
-
-    let resp = create_token(port, json!({ "label": "none asked" })).await;
-    assert_eq!(resp.status(), 201);
-    let expiration = stored_expiration(&db, "none asked")
-        .await
-        .expect("a token asking for no expiration gets the ceiling");
-    assert!(
-        expiration > from_now(6 * DAY) && expiration <= from_now(7 * DAY),
-        "expected the 7 day ceiling, got {expiration}"
-    );
-
-    let resp = create_token(
-        port,
-        json!({ "label": "past the ceiling", "expiration": from_now(30 * DAY) }),
-    )
-    .await;
-    assert_eq!(resp.status(), 201);
-    let expiration = stored_expiration(&db, "past the ceiling").await.unwrap();
-    assert!(
-        expiration > from_now(6 * DAY) && expiration <= from_now(7 * DAY),
-        "expected an expiration past the ceiling to be shortened to it, got {expiration}"
-    );
-
-    let resp = create_token(
-        port,
-        json!({ "label": "within", "expiration": from_now(3 * DAY) }),
-    )
-    .await;
-    assert_eq!(resp.status(), 201);
-    let expiration = stored_expiration(&db, "within").await.unwrap();
-    assert!(
-        expiration <= from_now(3 * DAY),
-        "an expiration within the ceiling must be kept, got {expiration}"
-    );
-
-    // The settings UI stores an integer, but the YAML instance config and config sync can write
-    // the same whole number as a string or as `5.0`. Reading either as "unset" would silently
-    // drop the ceiling, while the token form (`parseMaxTokenExpirationDays`) still showed it.
-    for (stored, label) in [
-        (json!("5"), "string setting"),
-        (json!(5.0), "float setting"),
-    ] {
-        set_max(&db, stored).await;
-        let resp = create_token(port, json!({ "label": label })).await;
-        assert_eq!(resp.status(), 201);
-        let expiration = stored_expiration(&db, label).await;
-        assert!(
-            expiration.is_some_and(|e| e > from_now(4 * DAY) && e <= from_now(5 * DAY)),
-            "{label}: expected the 5 day ceiling, got {expiration:?}"
-        );
-    }
-
-    // A superadmin impersonating a user picks the lifetime too, so the ceiling applies there;
-    // left out, it would be the one way to mint a token that never expires.
-    let resp = client()
-        .post(format!(
-            "http://localhost:{port}/api/users/tokens/impersonate"
-        ))
-        .header("Authorization", "Bearer SECRET_TOKEN")
-        .json(&json!({ "label": "impersonated", "impersonate_email": "test3@windmill.dev" }))
-        .send()
-        .await?;
-    assert_eq!(resp.status(), 201);
-    assert!(
-        stored_expiration(&db, "impersonated").await.is_some(),
-        "an impersonation token asking for no expiration gets the ceiling"
-    );
-
-    Ok(())
-}
-
-#[sqlx::test(migrations = "../migrations", fixtures("base"))]
-async fn test_service_accounts_are_exempt(db: Pool<Postgres>) -> anyhow::Result<()> {
-    initialize_tracing().await;
-    let server = ApiServer::start(db.clone()).await?;
-    let port = server.addr.port();
-
-    set_max(&db, json!(7)).await;
-    // The same email is a service account in one workspace and an ordinary user in another.
-    sqlx::query(
-        "UPDATE usr SET is_service_account = true
-         WHERE email = 'test2@windmill.dev' AND workspace_id = 'test-workspace'",
-    )
-    .execute(&db)
-    .await?;
-    sqlx::query("INSERT INTO workspace (id, name, owner) VALUES ('other', 'other', 'test-user')")
-        .execute(&db)
-        .await?;
-    sqlx::query("INSERT INTO workspace_settings (workspace_id) VALUES ('other')")
-        .execute(&db)
-        .await?;
-    sqlx::query(
-        "INSERT INTO usr (workspace_id, email, username, is_admin, role)
-         VALUES ('other', 'test2@windmill.dev', 'test-user-2', false, 'User')",
-    )
-    .execute(&db)
-    .await?;
-
-    // The token form decides the exemption from this list, so it must carry each membership's flag.
-    let memberships: serde_json::Value = client()
-        .get(format!("http://localhost:{port}/api/workspaces/users"))
-        .header("Authorization", "Bearer SECRET_TOKEN_2")
-        .send()
-        .await?
-        .json()
-        .await?;
-    for (workspace, is_service_account) in [("test-workspace", true), ("other", false)] {
-        let membership = memberships["workspaces"]
-            .as_array()
-            .and_then(|ws| ws.iter().find(|w| w["id"] == workspace))
-            .unwrap_or_else(|| panic!("{workspace} missing from {memberships}"));
-        assert_eq!(membership["is_service_account"], json!(is_service_account));
-    }
-
-    for (label, workspace_id, exempt) in [
-        ("own workspace", Some("test-workspace"), true),
-        ("other workspace", Some("other"), false),
-        // A workspace-less token has no workspace to match, so a service account anywhere counts.
-        ("global", None, true),
-    ] {
-        let resp = create_token(
-            port,
-            json!({ "label": label, "workspace_id": workspace_id }),
-        )
-        .await;
-        assert_eq!(resp.status(), 201);
-        assert_eq!(
-            stored_expiration(&db, label).await.is_none(),
-            exempt,
-            "{label}: expected exempt = {exempt}"
-        );
-    }
-
-    // Impersonation checks the impersonated account, not the superadmin minting the token.
-    let resp = client()
-        .post(format!(
-            "http://localhost:{port}/api/users/tokens/impersonate"
-        ))
-        .header("Authorization", "Bearer SECRET_TOKEN")
-        .json(&json!({ "label": "impersonated service account", "impersonate_email": "test2@windmill.dev" }))
-        .send()
-        .await?;
-    assert_eq!(resp.status(), 201);
-    assert_eq!(
-        stored_expiration(&db, "impersonated service account").await,
-        None
-    );
-
-    Ok(())
-}
@@ -1,102 +0,0 @@
-//! The `mcp_disable_token_query_param` switch closes the URL-borne credential path.
-//!
-//! The rejection is a middleware layered between the `WWW-Authenticate` decorator and
-//! everything that reads a token, on both the workspaced and the gateway mount. Each half of
-//! that sandwich is pinned: the `WWW-Authenticate` header on the refusal catches the layer
-//! being moved outward (a client would lose the pointer that starts OAuth discovery), and
-//! refusing a token that was never valid catches it being moved inward past authentication
-//! (the URL-borne token would be hashed and looked up before anything refused it).
-#![cfg(feature = "mcp")]
-
-use std::sync::atomic::Ordering;
-
-use serde_json::json;
-use sqlx::{Pool, Postgres};
-
-use windmill_common::global_settings::MCP_DISABLE_TOKEN_QUERY_PARAM;
-use windmill_test_utils::*;
-
-/// Workspace-less with an `mcp:` scope, which is what the gateway mount requires; the
-/// workspaced mount takes its workspace from the path, so one token reaches both.
-async fn insert_mcp_token(db: &Pool<Postgres>) -> anyhow::Result<()> {
-    sqlx::query(
-        "INSERT INTO token (token_hash, token_prefix, token, email, label, super_admin, scopes)
-         VALUES (encode(sha256('MCP_TOKEN'::bytea), 'hex'), 'MCP_TOK', 'MCP_TOKEN', 'test@windmill.dev', 'mcp token', true, ARRAY['mcp:all'])",
-    )
-    .execute(db)
-    .await?;
-    Ok(())
-}
-
-/// A token that is not in `token` at all. Authentication would refuse it on its own, so a
-/// refusal carrying the middleware's own wording is evidence nothing looked it up first.
-const BOGUS_TOKEN: &str = "NOT_A_REAL_TOKEN";
-
-async fn tools_list(url: &str) -> anyhow::Result<reqwest::Response> {
-    Ok(reqwest::Client::new()
-        .post(url)
-        .header("Accept", "application/json, text/event-stream")
-        .json(&json!({ "jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": {} }))
-        .send()
-        .await?)
-}
-
-#[sqlx::test(migrations = "../migrations", fixtures("base"))]
-async fn test_mcp_token_query_param_switch(db: Pool<Postgres>) -> anyhow::Result<()> {
-    initialize_tracing().await;
-    set_jwt_secret().await;
-    insert_mcp_token(&db).await?;
-    let server = ApiServer::start_mcp(db.clone()).await?;
-    let port = server.addr.port();
-    let workspaced =
-        format!("http://localhost:{port}/api/mcp/w/test-workspace/mcp?token=MCP_TOKEN");
-    let gateway = format!("http://localhost:{port}/api/mcp/gateway?token=MCP_TOKEN");
-
-    assert_eq!(
-        tools_list(&workspaced).await?.status(),
-        200,
-        "a URL-borne token is the documented default and must keep working while the switch is off"
-    );
-    assert_eq!(tools_list(&gateway).await?.status(), 200);
-
-    MCP_DISABLE_TOKEN_QUERY_PARAM.store(true, Ordering::Relaxed);
-
-    for url in [&workspaced, &gateway] {
-        let resp = tools_list(url).await?;
-        assert_eq!(
-            resp.status(),
-            401,
-            "{url} still admitted a token in the URL"
-        );
-        // What sends the client into the OAuth flow rather than leaving it stuck on a 401.
-        assert!(
-            resp.headers().contains_key("www-authenticate"),
-            "{url} rejected without pointing at the authorization server"
-        );
-    }
-
-    // Refused before authentication, not after: an invalid token gets the middleware's own
-    // message rather than the generic 401 that looking it up would produce.
-    let resp = tools_list(&format!(
-        "http://localhost:{port}/api/mcp/w/test-workspace/mcp?token={BOGUS_TOKEN}"
-    ))
-    .await?;
-    assert_eq!(resp.status(), 401);
-    assert!(
-        resp.text().await?.contains("does not accept a token in the MCP URL"),
-        "an invalid URL token was answered by authentication, so the token was read before \
-         the switch refused it"
-    );
-
-    // The header stays open: it is the channel the OAuth flow itself hands tokens over on.
-    let resp = reqwest::Client::new()
-        .post(format!("http://localhost:{port}/api/mcp/gateway"))
-        .header("Accept", "application/json, text/event-stream")
-        .header("Authorization", "Bearer MCP_TOKEN")
-        .json(&json!({ "jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": {} }))
-        .send()
-        .await?;
-    assert_eq!(resp.status(), 200);
-
-    Ok(())
-}
@@ -1,49 +0,0 @@
-//! Which user tokens get an "expiring soon" warning queued when they are created.
-
-use serde_json::json;
-use sqlx::types::chrono::Utc;
-use sqlx::{Pool, Postgres};
-use windmill_test_utils::*;
-
-const DAY: u64 = 24 * 60 * 60;
-
-async fn warning_queued(db: &Pool<Postgres>, label: &str) -> bool {
-    sqlx::query_scalar::<_, bool>(
-        "SELECT EXISTS(SELECT 1 FROM token_expiry_notification n
-            JOIN token t ON t.token_hash = n.token_hash WHERE t.label = $1)",
-    )
-    .bind(label)
-    .fetch_one(db)
-    .await
-    .unwrap()
-}
-
-#[sqlx::test(migrations = "../migrations", fixtures("base"))]
-async fn test_short_lived_tokens_get_no_expiry_warning(db: Pool<Postgres>) -> anyhow::Result<()> {
-    initialize_tracing().await;
-    let server = ApiServer::start(db.clone()).await?;
-    let port = server.addr.port();
-
-    for (label, lifetime) in [("short", DAY), ("long", 30 * DAY)] {
-        let resp = reqwest::Client::new()
-            .post(format!("http://localhost:{port}/api/users/tokens/create"))
-            .header("Authorization", "Bearer SECRET_TOKEN_2")
-            .json(&json!({
-                "label": label,
-                "expiration": Utc::now() + std::time::Duration::from_secs(lifetime),
-            }))
-            .send()
-            .await?;
-        assert_eq!(resp.status(), 201);
-    }
-
-    assert!(
-        !warning_queued(&db, "short").await,
-        "a token whose whole lifetime fits in the warning window must not be warned about"
-    );
-    assert!(
-        warning_queued(&db, "long").await,
-        "a longer-lived token still gets its warning"
-    );
-    Ok(())
-}
@@ -275,67 +275,6 @@ async fn test_encryption_key_rotation_dispatches_batched_git_sync(
    Ok(())
 }

-/// Stored repository tokens and webhook secrets are encrypted under the
-/// workspace key but never synced, so a rotation has to carry them over even
-/// when the caller skips re-encrypting variables.
-#[sqlx::test(migrations = "../migrations", fixtures("base"))]
-async fn test_encryption_key_rotation_reencrypts_git_sync_secrets(
-    db: Pool<Postgres>,
-) -> anyhow::Result<()> {
-    use windmill_common::variables::{build_crypt, crypt_from_key_with_suffix, decrypt, encrypt};
-    initialize_tracing().await;
-
-    create_folder(&db, "28103").await?;
-    create_git_repo_resource(&db).await?;
-    let sync_script_path = "f/28103/test_sync_script_git_secrets";
-    create_sync_script(&db, sync_script_path).await?;
-    setup_git_sync_config(&db, sync_script_path).await?;
-
-    let mc = build_crypt(&db, "test-workspace").await?;
-    sqlx::query(
-        r#"
-        UPDATE workspace_settings SET
-            git_credentials = jsonb_build_array(jsonb_build_object(
-                'token', $1::text, 'repo_identity', 'https://gitlab.example.com/grp/proj')),
-            git_sync = jsonb_set(git_sync, '{repositories,0,auto_pull}', jsonb_build_object(
-                'enabled', true, 'mode', 'webhook', 'webhook_id', 1, 'webhook_secret', $2::text))
-        WHERE workspace_id = 'test-workspace'
-        "#,
-    )
-    .bind(encrypt(&mc, "stored-token"))
-    .bind(encrypt(&mc, "hook-secret"))
-    .execute(&db)
-    .await?;
-
-    let server = ApiServer::start(db.clone()).await?;
-    let port = server.addr.port();
-    let base = format!("http://localhost:{port}/api/w/test-workspace/workspaces");
-
-    let new_key = "c".repeat(64);
-    let resp = authed(client().post(format!("{base}/encryption_key")))
-        .json(&json!({"new_key": new_key, "skip_reencrypt": true}))
-        .send()
-        .await?;
-    assert_eq!(
-        resp.status(),
-        200,
-        "set_encryption_key failed: {}",
-        resp.text().await?
-    );
-
-    let (token, secret): (String, String) = sqlx::query_as(
-        "SELECT git_credentials->0->>'token', git_sync#>>'{repositories,0,auto_pull,webhook_secret}'
-         FROM workspace_settings WHERE workspace_id = 'test-workspace'",
-    )
-    .fetch_one(&db)
-    .await?;
-    let new_mc = crypt_from_key_with_suffix(&new_key, "");
-    assert_eq!(decrypt(&new_mc, token)?, "stored-token");
-    assert_eq!(decrypt(&new_mc, secret)?, "hook-secret");
-
-    Ok(())
-}
-
 /// Regression test for the non-debouncing fallback: a workspace whose sync
 /// script predates hub version 28103 must still receive git-sync jobs for the
 /// encryption_key entry and every re-encrypted secret. Before the fallback was
@@ -1166,47 +1166,3 @@ async fn test_create_service_account_drops_orphaned_group_memberships(

    Ok(())
 }
-
-#[cfg(feature = "private")]
-#[sqlx::test(migrations = "../migrations", fixtures("base"))]
-async fn test_edit_auto_invite_preserves_instance_groups(db: Pool<Postgres>) -> anyhow::Result<()> {
-    initialize_tracing().await;
-
-    sqlx::query(
-        r#"UPDATE workspace_settings
-           SET auto_invite = '{"instance_groups": ["eng"], "instance_groups_roles": {"eng": "developer"}}'
-           WHERE workspace_id = 'test-workspace'"#,
-    )
-    .execute(&db)
-    .await?;
-
-    let server = ApiServer::start(db.clone()).await?;
-    let port = server.addr.port();
-    let base = format!("http://localhost:{port}/api/w/test-workspace/workspaces");
-
-    // enable, then disable
-    for body in [
-        json!({"operator": false, "invite_all": true, "auto_add": false}),
-        json!({}),
-    ] {
-        let resp = authed(client().post(format!("{base}/edit_auto_invite")))
-            .json(&body)
-            .send()
-            .await?;
-        assert_eq!(resp.status(), 200, "{body}: {}", resp.text().await?);
-
-        let auto_invite: serde_json::Value = sqlx::query_scalar(
-            "SELECT auto_invite FROM workspace_settings WHERE workspace_id = 'test-workspace'",
-        )
-        .fetch_one(&db)
-        .await?;
-        assert_eq!(auto_invite["instance_groups"], json!(["eng"]), "{body}");
-        assert_eq!(
-            auto_invite["instance_groups_roles"],
-            json!({"eng": "developer"}),
-            "{body}"
-        );
-    }
-
-    Ok(())
-}
@@ -11,7 +11,7 @@ path = "src/lib.rs"
 [features]
 default = []
 enterprise = ["license"]
-private = ["windmill-common/private", "windmill-audit/private"]
+private = ["windmill-common/private"]
 parquet = ["windmill-common/parquet", "windmill-object-store/parquet"]
 license = ["dep:rsa"]

@@ -19,7 +19,6 @@ license = ["dep:rsa"]
 windmill-ai = { workspace = true, default-features = false }
 windmill-alerting.workspace = true
 windmill-api-auth.workspace = true
-windmill-audit.workspace = true
 windmill-common = { workspace = true, default-features = false }
 axum.workspace = true
 anyhow.workspace = true
@@ -1,44 +0,0 @@
-/*
- * Author: Ruben Fiszel
- * Copyright: Windmill Labs, Inc 2022
- * This file and its contents are licensed under the AGPLv3 License.
- * Please see the included NOTICE for copyright information and
- * LICENSE-AGPL for a copy of the license.
- */
-
-//! Where the data table role catalog endpoints come from: the enterprise implementation, or a
-//! refusal. Roles are an Enterprise Edition feature; see `windmill_common::datatable_roles_oss`.
-
-#[cfg(all(feature = "private", feature = "enterprise"))]
-pub(crate) use crate::datatable_roles_ee::{
-    create_datatable_role, delete_datatable_role, list_datatable_roles, update_datatable_role,
-};
-
-#[cfg(not(all(feature = "private", feature = "enterprise")))]
-pub(crate) use ce::*;
-
-// The routes stay registered so the API has one shape; each answers after authentication, before
-// anything is read.
-#[cfg(not(all(feature = "private", feature = "enterprise")))]
-mod ce {
-    use windmill_api_auth::ApiAuthed;
-    use windmill_common::{
-        datatable_roles_oss::datatable_roles_unavailable as unavailable, error::Result,
-    };
-
-    pub(crate) async fn list_datatable_roles(_authed: ApiAuthed) -> Result<String> {
-        Err(unavailable())
-    }
-
-    pub(crate) async fn create_datatable_role(_authed: ApiAuthed) -> Result<String> {
-        Err(unavailable())
-    }
-
-    pub(crate) async fn update_datatable_role(_authed: ApiAuthed) -> Result<String> {
-        Err(unavailable())
-    }
-
-    pub(crate) async fn delete_datatable_role(_authed: ApiAuthed) -> Result<String> {
-        Err(unavailable())
-    }
-}
@@ -17,9 +17,6 @@ mod audit_logs_s3;
 mod audit_logs_s3_backfill;
 #[cfg(feature = "parquet")]
 mod background_task;
-#[cfg(all(feature = "private", feature = "enterprise"))]
-mod datatable_roles_ee;
-mod datatable_roles_oss;
 #[cfg(feature = "private")]
 mod ee;
 pub mod ee_oss;
@@ -64,7 +61,6 @@ use windmill_common::{
        GITHUB_APP_WEBHOOK_BASE_URL_SETTING, HTTP_ROUTE_DEFAULT_ALLOWED_ORIGINS_SETTING,
        HTTP_ROUTE_WORKSPACED_ROUTE_SETTING, HUB_ACCESSIBLE_URL_SETTING, HUB_BASE_URL_SETTING,
        INSTANCE_BANNER_SETTING, MAX_RETENTION_OVERRIDE_WORKSPACES,
-        MAX_TOKEN_EXPIRATION_DAYS_SETTING, MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING,
        RETENTION_PERIOD_SECS_OVERRIDES_SETTING, RUFF_CONFIG_SETTING, UNIQUE_ID_SETTING,
        WORKSPACE_FAIRNESS_DURATION_SECS_SETTING, WORKSPACE_FAIRNESS_ENABLED_SETTING,
        WORKSPACE_FAIRNESS_MAX_PERCENT_SETTING, WORKSPACE_FAIRNESS_MIN_TOTAL_SETTING,
@@ -155,16 +151,6 @@ pub fn global_service() -> Router {
            "/list_custom_instance_pg_databases",
            post(list_custom_instance_pg_databases),
        )
-        .route(
-            "/datatable_roles",
-            get(datatable_roles_oss::list_datatable_roles)
-                .post(datatable_roles_oss::create_datatable_role),
-        )
-        .route(
-            "/datatable_roles/{id}",
-            post(datatable_roles_oss::update_datatable_role)
-                .delete(datatable_roles_oss::delete_datatable_role),
-        )
        .route(
            "/refresh_custom_instance_user_pwd",
            post(refresh_custom_instance_user_pwd),
@@ -1196,12 +1182,6 @@ async fn run_setting_pre_write_hook(
                }
            }
        }
-        MAX_TOKEN_EXPIRATION_DAYS_SETTING => {
-            windmill_common::global_settings::parse_max_token_expiration_days(Some(value))
-                .map_err(|e| {
-                    error::Error::BadRequest(format!("{MAX_TOKEN_EXPIRATION_DAYS_SETTING}: {e}"))
-                })?;
-        }
        INSTANCE_BANNER_SETTING => {
            match value {
                // Clearing (delete row) is handled by the caller; allow it through.
@@ -1363,12 +1343,6 @@ pub async fn get_global_setting(
        && key != HTTP_ROUTE_DEFAULT_ALLOWED_ORIGINS_SETTING
        && key != WS_BASE_URL_SETTING
        && key != INSTANCE_BANNER_SETTING
-        // The token form reads it to stop offering expirations the server would shorten.
-        && key != MAX_TOKEN_EXPIRATION_DAYS_SETTING
-        // Whoever is wiring up an MCP client reads it to know whether a URL-borne token
-        // would be refused, and they are usually not a superadmin. Not a secret: pointing
-        // any MCP client at the instance discovers the same answer.
-        && key != MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING
    {
        require_super_admin(&db, &authed).await?;
    }
@@ -47,10 +47,7 @@ use windmill_audit::audit_oss::audit_log;
 use windmill_audit::ActionKind;
 use windmill_common::audit::AuditAuthor;
 use windmill_common::auth::{hash_token, safe_token_prefix, TOKEN_PREFIX_LEN};
-use windmill_common::global_settings::{
-    load_value_from_global_settings, parse_max_token_expiration_days,
-    AUTOMATE_USERNAME_CREATION_SETTING, MAX_TOKEN_EXPIRATION_DAYS_SETTING,
-};
+use windmill_common::global_settings::AUTOMATE_USERNAME_CREATION_SETTING;
 use windmill_common::oauth2::InstanceEvent;
 use windmill_common::per_minute_counter::PerMinuteCounter;
 use windmill_common::users::truncate_token;
@@ -171,10 +168,7 @@ pub fn make_unauthed_service() -> Router {
        .route("/logout", post(logout).get(logout))
        .route("/is_first_time_setup", get(is_first_time_setup))
        .route("/request_password_reset", post(request_password_reset))
-        .route(
-            "/login_link/{token}",
-            get(consume_login_link).post(confirm_login_link),
-        )
+        .route("/login_link/{token}", get(consume_login_link))
        .route("/is_smtp_configured", get(is_smtp_configured))
        .route(
            "/is_password_login_disabled",
@@ -1709,25 +1703,14 @@ async fn delete_user(
        .await?;
    windmill_common::user_drafts::delete_drafts_of_email(&mut *tx, &email_to_delete).await?;

-    let memberships = sqlx::query!(
-        "DELETE FROM usr WHERE email = $1 RETURNING username, workspace_id",
+    let usernames = sqlx::query_scalar!(
+        "DELETE FROM usr WHERE email = $1 RETURNING username",
        &email_to_delete
    )
    .fetch_all(&mut *tx)
    .await?;

-    for row in memberships {
-        let username = row.username;
-        // A tenant list names a principal of its workspace, so the name has to be freed in every
-        // workspace this account belonged to: a later account taking the username would otherwise
-        // inherit the data table access it had.
-        windmill_common::workspaces::remove_datatable_tenant_in_workspace(
-            &mut tx,
-            &row.workspace_id,
-            &format!("u/{username}"),
-        )
-        .await?;
-
+    for username in usernames {
        sqlx::query!("DELETE FROM password WHERE email = $1", &email_to_delete)
            .execute(&mut *tx)
            .await?;
@@ -2473,15 +2456,6 @@ pub async fn delete_workspace_user_internal(
    tx: &mut Transaction<'_, Postgres>,
    authed: Option<&ApiAuthed>, // None for system operations
 ) -> Result<()> {
-    // Same reasoning as the `extra_perms` sweep below: a freed username must not stay named
-    // anywhere that grants access, tenant lists included.
-    windmill_common::workspaces::remove_datatable_tenant_in_workspace(
-        tx,
-        w_id,
-        &format!("u/{username_to_delete}"),
-    )
-    .await?;
-
    // ---- Clean up extra_perms referencing this user ----
    let extra_perms_tables = [
        "script",
@@ -3098,68 +3072,11 @@ pub async fn create_guest_session_token<'c>(

 // create_token_internal is re-exported from windmill-api-auth above

-/// Applies the instance-wide ceiling on how long a token a caller picks the lifetime of may
-/// live (`create_token`, and `impersonate` for superadmins), returning the expiration to store:
-/// the requested one while it fits, the ceiling otherwise, and the ceiling as well when none was
-/// requested. Only the stored expiration is capped: tokens already stored when the setting is
-/// turned on or lowered keep theirs, since the auth lookup never reads the setting.
-///
-/// It shortens rather than refuses because most callers do not comply on their own. The CLI
-/// authorization page, `wmill user create-token` and the editor's language-server token each
-/// pick a lifetime, often none at all, without reading the setting (and CLIs already installed
-/// never will), so refusing would break logging in and the editor instead of the long-lived
-/// tokens the setting is aimed at.
-///
-/// Read from `global_settings` on each call rather than cached: token creation is rare
-/// enough that the round trip costs nothing, and the ceiling is then never served stale.
-///
-/// A token owned by a service account is exempt: in the workspace the token names, or in any
-/// workspace for a workspace-less token, which has none to match. Service accounts are the
-/// identity automation that needs a long-lived credential runs as. The cost is that any
-/// workspace admin can create and impersonate one to hold an uncapped token, so the ceiling
-/// bounds personal tokens rather than what an admin can obtain.
-async fn cap_token_expiration(
-    db: &DB,
-    owner_email: &str,
-    workspace_id: Option<&str>,
-    requested: Option<chrono::DateTime<chrono::Utc>>,
-) -> Result<Option<chrono::DateTime<chrono::Utc>>> {
-    let value = load_value_from_global_settings(db, MAX_TOKEN_EXPIRATION_DAYS_SETTING).await?;
-    let max_days = match parse_max_token_expiration_days(value.as_ref()) {
-        Ok(Some(max_days)) => max_days,
-        Ok(None) => return Ok(requested),
-        // Both write paths reject this, so only a row written around them gets here.
-        Err(e) => {
-            tracing::warn!("ignoring {MAX_TOKEN_EXPIRATION_DAYS_SETTING}: {e}");
-            return Ok(requested);
-        }
-    };
-    let max = chrono::Utc::now() + chrono::Duration::days(max_days);
-
-    let is_service_account = sqlx::query_scalar!(
-        "SELECT EXISTS(SELECT 1 FROM usr WHERE email = $1 AND is_service_account IS true
-            AND ($2::varchar IS NULL OR workspace_id = $2))",
-        owner_email,
-        workspace_id,
-    )
-    .fetch_one(db)
-    .await?
-    .unwrap_or(false);
-    if is_service_account {
-        return Ok(requested);
-    }
-
-    Ok(Some(match requested {
-        Some(expiration) if expiration < max => expiration,
-        _ => max,
-    }))
-}
-
 async fn create_token(
    Extension(db): Extension<DB>,
    authed: ApiAuthed,
    OptJobAuthed { job_id, .. }: OptJobAuthed,
-    Json(mut token_config): Json<NewToken>,
+    Json(token_config): Json<NewToken>,
 ) -> Result<(StatusCode, String)> {
    forbid_elevated_job_token(&db, &authed.email, job_id).await?;
    check_token_create_rate_limit(&authed.username)?;
@@ -3181,14 +3098,6 @@ async fn create_token(

    windmill_api_auth::ensure_scopes_within_caller(&authed, token_config.scopes.as_deref())?;

-    token_config.expiration = cap_token_expiration(
-        &db,
-        &authed.email,
-        token_config.workspace_id.as_deref(),
-        token_config.expiration,
-    )
-    .await?;
-
    let mut tx = db.begin().await?;

    let token = create_token_internal(&mut *tx, &db, &authed, token_config).await?;
@@ -3245,7 +3154,6 @@ async fn impersonate(
    .fetch_optional(&db)
    .await?
    .unwrap_or(false);
-    let expiration = cap_token_expiration(&db, &impersonated, None, new_token.expiration).await?;
    let mut tx = db.begin().await?;

    sqlx::query!(
@@ -3257,7 +3165,7 @@ async fn impersonate(
        plaintext as Option<&str>,
        impersonated,
        new_token.label,
-        expiration,
+        new_token.expiration,
        is_super_admin
    )
    .execute(&mut *tx)
@@ -3267,7 +3175,7 @@ async fn impersonate(
        &mut *tx,
        &t_hash,
        new_token.label.as_deref(),
-        expiration,
+        new_token.expiration,
    )
    .await;

@@ -3287,12 +3195,9 @@ async fn impersonate(
 }

 const LOGIN_LINK_DEFAULT_TTL_S: u32 = 600;
-// Long enough for a link sent by email to still work when it is read. `require_login_type` is
-// only checked at mint, so a much longer cap would need re-checking it when the link is opened.
-const LOGIN_LINK_MAX_TTL_S: u32 = 7200;
+const LOGIN_LINK_MAX_TTL_S: u32 = 900;
 const LOGIN_LINK_DEFAULT_RD: &str = "/user/workspaces";
 const LOGIN_LINK_EXPIRED_PAGE: &str = "/user/login_link_expired";
-const LOGIN_LINK_CONFIRM_PAGE: &str = "/user/login_link";

 #[derive(Deserialize)]
 pub struct NewLoginLink {
@@ -3303,9 +3208,6 @@ pub struct NewLoginLink {
    /// account it created can require `pending_oauth`, so the link stops working once the
    /// owner has set a password or signed in with a provider.
    pub require_login_type: Option<String>,
-    /// Hand out a page that signs in only when its button is clicked. Mail scanners open links
-    /// on delivery, and opening the plain link spends it, so a link sent by email sets this.
-    pub confirm: Option<bool>,
 }

 #[derive(Serialize)]
@@ -3456,12 +3358,11 @@ async fn create_login_link(
    .await?;
    tx.commit().await?;

-    let base_url = (**BASE_URL.load()).clone();
-    let url = if nl.confirm.unwrap_or(false) {
-        format!("{base_url}{LOGIN_LINK_CONFIRM_PAGE}?token={token}")
-    } else {
-        format!("{base_url}/api/auth/login_link/{token}")
-    };
+    let url = format!(
+        "{}/api/auth/login_link/{}",
+        (**BASE_URL.load()).clone(),
+        token
+    );
    Ok((StatusCode::CREATED, Json(LoginLink { url, expires_at })))
 }

@@ -3707,45 +3608,19 @@ async fn consume_login_link(
    Path(token): Path<String>,
    Query(query): Query<LoginLinkQuery>,
 ) -> Result<Response> {
-    let location = redeem_login_link(&headers, cookies, &db, &token, query.rd).await?;
-    Ok(login_link_redirect(location))
-}
-
-#[derive(Serialize)]
-struct LoginLinkLocation {
-    location: String,
-}
-
-/// The confirmation page's click. It answers with where to go rather than redirecting, and the
-/// page navigates there itself.
-async fn confirm_login_link(
-    headers: axum::http::HeaderMap,
-    cookies: Cookies,
-    Extension(db): Extension<DB>,
-    Path(token): Path<String>,
-) -> JsonResult<LoginLinkLocation> {
-    let location = redeem_login_link(&headers, cookies, &db, &token, None).await?;
-    Ok(Json(LoginLinkLocation { location }))
-}
-
-/// Spends the link and sets the session cookie, returning the post-login destination; or
-/// returns the explanation page, with no session, when the link cannot be used.
-async fn redeem_login_link(
-    headers: &axum::http::HeaderMap,
-    cookies: Cookies,
-    db: &DB,
-    token: &str,
-    requested_rd: Option<String>,
-) -> Result<String> {
-    let bounce = |reason: &str| Ok(format!("{LOGIN_LINK_EXPIRED_PAGE}?reason={reason}"));
+    let bounce = |reason: &str| {
+        Ok(login_link_redirect(format!(
+            "{LOGIN_LINK_EXPIRED_PAGE}?reason={reason}"
+        )))
+    };
    if token.len() != 32 {
        return bounce("invalid");
    }
-    let t_hash = hash_token(token);
+    let t_hash = hash_token(&token);
    // The account is unknown until the row is read, so only the global and per-IP tiers
    // apply here; a 32-char random token leaves nothing for the per-account tier to guard.
    windmill_common::login_rate_limit::check_and_increment_login_attempt(
-        headers,
+        &headers,
        &t_hash[..TOKEN_PREFIX_LEN],
    )?;

@@ -3812,10 +3687,11 @@ async fn redeem_login_link(
    .await?;
    tx.commit().await?;

-    Ok(link
+    let rd = link
        .rd
-        .or_else(|| same_origin_rd(requested_rd))
-        .unwrap_or_else(|| LOGIN_LINK_DEFAULT_RD.to_string()))
+        .or_else(|| same_origin_rd(query.rd))
+        .unwrap_or_else(|| LOGIN_LINK_DEFAULT_RD.to_string());
+    Ok(login_link_redirect(rd))
 }

 #[derive(Deserialize)]
@@ -4049,7 +3925,6 @@ async fn update_token_label(
                 AND NOT starts_with(label, 'embed_app:')
                 AND NOT starts_with(label, 'sdk_app:')
                 AND NOT starts_with(label, 'impersonation:')
-                 AND NOT starts_with(label, 'cli-login:')
             ))
           RETURNING token_prefix",
        req.label.as_deref(),
@@ -4090,12 +3965,6 @@ async fn leave_workspace(
 ) -> Result<String> {
    forbid_job_token_account_destruction(&authed)?;
    let mut tx = db.begin().await?;
-    windmill_common::workspaces::remove_datatable_tenant_in_workspace(
-        &mut tx,
-        &w_id,
-        &format!("u/{}", authed.username),
-    )
-    .await?;
    sqlx::query!(
        "DELETE FROM usr WHERE workspace_id = $1 AND username = $2",
        &w_id,
@@ -30,7 +30,6 @@ use windmill_api_auth::{require_super_admin, ApiAuthed};
 use windmill_api_jobs::run_wait_result_internal;
 use windmill_audit::audit_oss::audit_log;
 use windmill_audit::ActionKind;
-use windmill_common::datatable_roles::ADMIN_DATATABLE_ROLE;
 use windmill_common::db::UserDB;
 use windmill_common::error::{pg_error_message, Error, JsonResult, Result};
 use windmill_common::jobs::{JobPayload, RawCode};
@@ -39,11 +38,7 @@ use windmill_common::runnable_settings::{ConcurrencySettingsWithCustom, Debounci
 use windmill_common::scripts::ScriptLang;
 use windmill_common::users::username_to_permissioned_as;
 use windmill_common::worker::to_raw_value;
-use windmill_common::worker::SqlAnnotations;
-use windmill_common::workspaces::{
-    ensure_can_use_datatable_role, ensure_datatable_admin_access,
-    get_datatable_resource_from_db_unchecked, resolve_governing_datatable, DatatableAccess,
-};
+use windmill_common::workspaces::get_datatable_resource_from_db_unchecked;
 use windmill_common::{PgDatabase, DB};
 use windmill_git_sync::{
    handle_deployment_metadata, handle_deployment_metadata_batch, DeployedObject,
@@ -91,42 +86,6 @@ pub(crate) fn routes() -> Router {
        )
 }

-/// Refuse a migration whose role this caller may not use, before a job is pushed or a version
-/// recorded.
-///
-/// A migration that declares `-- role <name>` runs as that role, so the caller has to be one of its
-/// tenants. One that declares none runs as `admin` and reaches every object in the database
-/// whatever the roles grant, so it is for the admins of the workspace that governs the data table
-/// — a fork can run a migration under a role it holds, never a migration under `admin`.
-///
-/// The executor re-checks the role when it resolves the connection, so this is not the boundary. It
-/// is what makes the refusal legible: which migration, and which role.
-async fn ensure_migration_role_allowed(
-    db: &DB,
-    w_id: &str,
-    datatable_name: &str,
-    authed: &ApiAuthed,
-    sql: &str,
-    timestamp: i64,
-    name: &str,
-) -> Result<()> {
-    let context = format!("Migration {timestamp} ({name})");
-    let access = DatatableAccess::Authed(authed.to_authed_ref());
-    match SqlAnnotations::datatable_role(sql)? {
-        Some(role) => {
-            ensure_can_use_datatable_role(db, w_id, datatable_name, Some(&role), &access, &context)
-                .await
-        }
-        None => ensure_datatable_admin_access(db, w_id, datatable_name, &access)
-            .await
-            .map_err(|e| {
-                Error::NotAuthorized(format!(
-                    "{context} declares no role, so it would run as admin. {e}"
-                ))
-            }),
-    }
-}
-
 #[derive(Serialize)]
 struct AppliedMigration {
    version: i64,
@@ -169,18 +128,7 @@ async fn datatable_database_arg(
    .await?
    .ok_or_else(|| Error::internal_err(format!("datatable {datatable_name} not found")))?;

-    // `?role=admin` rather than a bare reference, so a migration that declares no `-- role` runs
-    // as the connection that owns the schema instead of falling through to the data table's
-    // default role — which is what `ensure_migration_role_allowed` gated it as, and which is the
-    // only role a DDL statement can be expected to succeed under. A migration that does declare a
-    // role overrides this: the annotation wins over the reference.
-    //
-    // A legacy name containing `?` cannot be migrated through this reference: the appended query
-    // makes it neither an exact name nor a parseable one. Accepted on purpose, since such names can
-    // no longer be created and none are expected to carry migrations.
-    Ok(to_raw_value(&format!(
-        "datatable://{datatable_name}?role={ADMIN_DATATABLE_ROLE}"
-    )))
+    Ok(to_raw_value(&format!("datatable://{datatable_name}")))
 }

 /// Run a migration's SQL as a normal Windmill `postgresql` job, permissioned as
@@ -436,11 +384,6 @@ async fn run_datatable_migrations(
    Path((w_id, datatable_name)): Path<(String, String)>,
    Query(query): Query<RunDatatableMigrationsQuery>,
 ) -> JsonResult<RunDatatableMigrationsResult> {
-    // Before the admin connection is opened at all: the bookkeeping below is created and read
-    // through it, so a caller no role covers must be refused here rather than after the fact.
-    crate::datatable_permissions::ensure_reaches_datatable(&db, &w_id, &datatable_name, &authed)
-        .await?;
-
    audit_log(
        &db,
        &authed,
@@ -497,16 +440,6 @@ async fn run_datatable_migrations(
        if applied_versions.contains(&m.timestamp) {
            continue;
        }
-        ensure_migration_role_allowed(
-            &db,
-            &w_id,
-            &datatable_name,
-            &authed,
-            &m.code_up,
-            m.timestamp,
-            &m.name,
-        )
-        .await?;
        run_datatable_migration_job(&db, &user_db, &authed, &w_id, &database_arg, &m.code_up)
            .await
            .map_err(|e| {
@@ -573,11 +506,6 @@ async fn rollback_datatable_migrations(
    Path((w_id, datatable_name)): Path<(String, String)>,
    Query(query): Query<RollbackDatatableMigrationsQuery>,
 ) -> JsonResult<RollbackDatatableMigrationsResult> {
-    // Before the admin connection is opened at all: the bookkeeping below is created and read
-    // through it, so a caller no role covers must be refused here rather than after the fact.
-    crate::datatable_permissions::ensure_reaches_datatable(&db, &w_id, &datatable_name, &authed)
-        .await?;
-
    audit_log(
        &db,
        &authed,
@@ -660,17 +588,6 @@ async fn rollback_datatable_migrations(
        ))
    })?;

-    ensure_migration_role_allowed(
-        &db,
-        &w_id,
-        &datatable_name,
-        &authed,
-        &code_down,
-        version,
-        &definition.name,
-    )
-    .await?;
-
    let database_arg = datatable_database_arg(&db, &w_id, &datatable_name).await?;
    run_datatable_migration_job(&db, &user_db, &authed, &w_id, &database_arg, &code_down)
        .await
@@ -831,15 +748,10 @@ async fn read_applied_datatable_versions(

 /// List a data table's migrations annotated with whether each has been applied.
 async fn datatable_migrations_status(
-    authed: ApiAuthed,
+    _authed: ApiAuthed,
    Extension(db): Extension<DB>,
    Path((w_id, datatable_name)): Path<(String, String)>,
 ) -> JsonResult<DatatableMigrationsStatusResult> {
-    // Reads `_wm_migrations` through the data table's admin connection, so it answers to the same
-    // question as running one: may you reach this data table at all.
-    crate::datatable_permissions::ensure_reaches_datatable(&db, &w_id, &datatable_name, &authed)
-        .await?;
-
    let enabled = datatable_migrations_enabled(&db, &w_id, &datatable_name).await?;
    if !enabled {
        return Ok(Json(DatatableMigrationsStatusResult {
@@ -1519,15 +1431,6 @@ async fn generate_initial_datatable_migration(
    Extension(db): Extension<DB>,
    Path((w_id, datatable_name)): Path<(String, String)>,
 ) -> JsonResult<DatatableMigration> {
-    // Returns a `pg_dump` of the whole schema and writes into the data table's own bookkeeping, so
-    // it answers to the workspace that governs it rather than to whoever is asking.
-    ensure_datatable_admin_access(
-        &db,
-        &w_id,
-        &datatable_name,
-        &DatatableAccess::Authed(authed.to_authed_ref()),
-    )
-    .await?;
    validate_datatable_path_segment(&datatable_name)?;
    ensure_datatable_migrations_enabled(&db, &w_id, &datatable_name).await?;

@@ -1698,21 +1601,9 @@ pub(crate) struct DatatableRename {
    pub(crate) to: String,
 }

-/// The database whose `_wm_migrations` a rename or delete of `datatable` in `w_id` should touch —
-/// `None` when that is somebody else's.
-///
-/// A fork's entry points at the workspace that governs the data table, so renaming or removing it
-/// changes what the fork calls the data table and nothing more. Following the pointer here would
-/// let a fork admin relabel or wipe the *governing* workspace's migration bookkeeping through
-/// their own settings form, and the parent would then re-run every migration from zero.
-async fn resolve_datatable_pg(db: &DB, w_id: &str, datatable: &str) -> Result<Option<PgDatabase>> {
-    let governing = resolve_governing_datatable(db, w_id, datatable).await?;
-    if governing.workspace_id != w_id {
-        return Ok(None);
-    }
+async fn resolve_datatable_pg(db: &DB, w_id: &str, datatable: &str) -> Result<PgDatabase> {
    let db_resource = get_datatable_resource_from_db_unchecked(db, w_id, datatable).await?;
    serde_json::from_value(db_resource)
-        .map(Some)
        .map_err(|e| Error::internal_err(format!("Failed to parse database credentials: {}", e)))
 }

@@ -1730,9 +1621,7 @@ fn ignore_missing_wm_migrations(e: tokio_postgres::Error) -> Result<()> {

 /// Drop a data table's rows from its own database's `_wm_migrations`.
 async fn remote_forget_datatable_migrations(db: &DB, w_id: &str, datatable: &str) -> Result<()> {
-    let Some(pg_db) = resolve_datatable_pg(db, w_id, datatable).await? else {
-        return Ok(());
-    };
+    let pg_db = resolve_datatable_pg(db, w_id, datatable).await?;
    let (client, connection) = pg_db.connect(Some(db)).await?;
    tokio::spawn(async move {
        let _ = connection.await;
@@ -1757,9 +1646,7 @@ async fn remote_rename_datatable_migrations(
    from: &str,
    to: &str,
 ) -> Result<()> {
-    let Some(pg_db) = resolve_datatable_pg(db, w_id, resolve_by).await? else {
-        return Ok(());
-    };
+    let pg_db = resolve_datatable_pg(db, w_id, resolve_by).await?;
    let (client, connection) = pg_db.connect(Some(db)).await?;
    tokio::spawn(async move {
        let _ = connection.await;
@@ -1,67 +0,0 @@
-/*
- * Author: Ruben Fiszel
- * Copyright: Windmill Labs, Inc 2022
- * This file and its contents are licensed under the AGPLv3 License.
- * Please see the included NOTICE for copyright information and
- * LICENSE-AGPL for a copy of the license.
- */
-
-//! Who may connect to a data table as which role.
-//!
-//! The decision lives on the data table entry of the workspace that governs it, which is not
-//! necessarily the workspace asking: a fork's entry points at its parent's, and everything here
-//! resolves through that pointer first. Nothing in this module runs SQL against the data table —
-//! a save is tenant lists and a default, and the Postgres roles themselves are the instance
-//! catalog's business.
-
-use axum::{routing::get, Router};
-
-use windmill_api_auth::ApiAuthed;
-use windmill_common::error::Result;
-use windmill_common::workspaces::GoverningDatatable;
-use windmill_common::DB;
-
-use crate::datatable_permissions_oss as roles;
-
-pub(crate) fn routes() -> Router {
-    Router::new()
-        .route(
-            "/datatable_permissions/{datatable_name}",
-            get(roles::get_datatable_permissions).post(roles::set_datatable_permissions),
-        )
-        .route(
-            "/datatable_usable_roles/{datatable_name}",
-            get(roles::list_usable_datatable_roles),
-        )
-}
-
-/// Administering a data table — its permissions, its migrations that declare no role, its exports
-/// — is for the admins of the workspace that governs it. A fork can use the data table; it never
-/// administers it.
-// The gate for whatever administers a data table under roles, which the routes of this module alone
-// do not always reach.
-#[allow(dead_code)]
-pub(crate) async fn ensure_governs_datatable(
-    db: &DB,
-    authed: &ApiAuthed,
-    w_id: &str,
-    governing: &GoverningDatatable,
-) -> Result<()> {
-    roles::ensure_governs_datatable(db, authed, w_id, governing).await
-}
-
-/// Refuse a caller that no tenant of this data table covers.
-///
-/// The bookkeeping endpoints below open the data table's `admin` connection to read or create
-/// `_wm_migrations` before they know which migration will run — so without this, someone covered
-/// by no role at all can still force admin-backed reads and writes on a database they may not
-/// touch. It asks only "may you reach this data table as anything"; which role a given migration
-/// runs as is still decided per migration, and by the executor after that.
-pub(crate) async fn ensure_reaches_datatable(
-    db: &DB,
-    w_id: &str,
-    datatable_name: &str,
-    authed: &ApiAuthed,
-) -> Result<()> {
-    roles::ensure_reaches_datatable(db, w_id, datatable_name, authed).await
-}
@@ -1,73 +0,0 @@
-/*
- * Author: Ruben Fiszel
- * Copyright: Windmill Labs, Inc 2022
- * This file and its contents are licensed under the AGPLv3 License.
- * Please see the included NOTICE for copyright information and
- * LICENSE-AGPL for a copy of the license.
- */
-
-//! Where the data table permissions endpoints and their gates come from: the enterprise
-//! implementation, or a refusal. Roles are an Enterprise Edition feature; see
-//! `windmill_common::datatable_roles_oss`.
-
-#[cfg(all(feature = "private", feature = "enterprise"))]
-pub(crate) use crate::datatable_permissions_ee::{
-    ensure_governs_datatable, ensure_reaches_datatable, get_datatable_permissions,
-    list_usable_datatable_roles, set_datatable_permissions,
-};
-
-#[cfg(not(all(feature = "private", feature = "enterprise")))]
-pub(crate) use ce::*;
-
-#[cfg(not(all(feature = "private", feature = "enterprise")))]
-mod ce {
-    use windmill_api_auth::ApiAuthed;
-    use windmill_common::{
-        datatable_roles_oss::datatable_roles_unavailable as unavailable,
-        error::Result,
-        workspaces::{resolve_governing_datatable, GoverningDatatable},
-        DB,
-    };
-
-    /// Nobody administers a data table's roles without them.
-    #[allow(dead_code)]
-    pub(crate) async fn ensure_governs_datatable(
-        _db: &DB,
-        _authed: &ApiAuthed,
-        _w_id: &str,
-        _governing: &GoverningDatatable,
-    ) -> Result<()> {
-        Err(unavailable())
-    }
-
-    /// A data table not under roles is reached as it was before roles existed. One under roles is
-    /// refused: no role of it can be connected as.
-    pub(crate) async fn ensure_reaches_datatable(
-        db: &DB,
-        w_id: &str,
-        datatable_name: &str,
-        _authed: &ApiAuthed,
-    ) -> Result<()> {
-        let governing = resolve_governing_datatable(db, w_id, datatable_name).await?;
-        if governing.datatable.permissions.is_none() {
-            Ok(())
-        } else {
-            Err(unavailable())
-        }
-    }
-
-    // The routes stay registered so the API has one shape; each answers after authentication,
-    // before anything is read.
-
-    pub(crate) async fn get_datatable_permissions(_authed: ApiAuthed) -> Result<String> {
-        Err(unavailable())
-    }
-
-    pub(crate) async fn set_datatable_permissions(_authed: ApiAuthed) -> Result<String> {
-        Err(unavailable())
-    }
-
-    pub(crate) async fn list_usable_datatable_roles(_authed: ApiAuthed) -> Result<String> {
-        Err(unavailable())
-    }
-}
@@ -2,8 +2,6 @@
 pub mod ai_session_backups;
 pub mod data_metrics;
 pub mod datatable_migrations;
-pub mod datatable_permissions;
-pub mod datatable_permissions_oss;
 pub mod deployment_requests;
 pub mod workspaces;
 pub mod workspaces_extra;
@@ -11,6 +9,3 @@ pub mod workspaces_oss;

 #[cfg(feature = "private")]
 pub mod workspaces_ee;
-
-#[cfg(all(feature = "private", feature = "enterprise"))]
-pub mod datatable_permissions_ee;
@@ -113,7 +113,7 @@ pub(crate) async fn change_workspace_id(
    // Duplicate workspace settings (keep copy in old workspace for reference)
    info!("Duplicating workspace_settings table");
    sqlx::query!(
-        "INSERT INTO workspace_settings (workspace_id, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url, add_admins_and_developers_to_forks) SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url, add_admins_and_developers_to_forks FROM workspace_settings WHERE workspace_id = $2",
+        "INSERT INTO workspace_settings (workspace_id, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url) SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url FROM workspace_settings WHERE workspace_id = $2",
        &rw.new_id,
        &old_id
    )
@@ -492,30 +492,6 @@ pub(crate) async fn change_workspace_id(
    .fetch_all(&mut *tx)
    .await?;

-    // A fork's data table entry names the workspace that governs it by id, so the rename has to
-    // follow there too — anywhere, not just in the reparented children: a detached workspace can
-    // point at this one without being its fork. Left behind, the pointer resolves to the archived
-    // shell and every job through it stops.
-    info!("Re-pointing data table references to the new workspace id");
-    sqlx::query!(
-        r#"UPDATE workspace_settings ws
-           SET datatable = (
-               SELECT jsonb_set(ws.datatable, '{datatables}', jsonb_object_agg(
-                   dt.key,
-                   CASE WHEN dt.value->'reference'->>'workspace_id' = $2
-                       THEN jsonb_set(dt.value, '{reference,workspace_id}', to_jsonb($1::text))
-                       ELSE dt.value END
-               ))
-               FROM jsonb_each(ws.datatable->'datatables') dt
-           )
-           WHERE jsonb_typeof(ws.datatable->'datatables') = 'object'
-             AND ws.datatable::text LIKE '%"reference"%'"#,
-        &rw.new_id,
-        &old_id,
-    )
-    .execute(&mut *tx)
-    .await?;
-
    info!("Updating workspace_protection_rule table");
    sqlx::query!(
        "UPDATE workspace_protection_rule SET workspace_id = $1 WHERE workspace_id = $2",
@@ -995,22 +971,6 @@ pub(crate) async fn delete_workspace(
    // but the destructive cleanup itself runs only after the commit below: a delete that
    // fails mid-way must never leave a live workspace with its fork data destroyed and no
    // registry row to retry from. Read-only: nothing is dropped here.
-    // Read before the delete: another workspace's data table entry can point at one of this
-    // workspace's, and deleting the workspace it names leaves that pointer resolving to nothing.
-    // Nothing sweeps them — turning them back into copies would hand each fork the database
-    // outright — so the deleter is told which data tables they just stranded.
-    let stranded_pointers = sqlx::query!(
-        r#"SELECT ws.workspace_id AS "workspace_id!", dt.key AS "datatable!"
-           FROM workspace_settings ws
-           CROSS JOIN LATERAL jsonb_each(COALESCE(ws.datatable->'datatables', '{}'::jsonb)) dt
-           WHERE dt.value->'reference'->>'workspace_id' = $1
-           ORDER BY ws.workspace_id, dt.key"#,
-        &w_id,
-    )
-    .fetch_all(&db)
-    .await
-    .unwrap_or_default();
-
    let fork_ducklake_cleanups = prepare_fork_ducklake_cleanups(&db, &w_id, None)
        .await
        .unwrap_or_else(|e| {
@@ -1329,23 +1289,7 @@ pub(crate) async fn delete_workspace(
        tracing::warn!("failed to broadcast fork lineage change: {e:#}");
    }

-    if stranded_pointers.is_empty() {
-        Ok(format!("Deleted workspace {}", &w_id))
-    } else {
-        let stranded = stranded_pointers
-            .iter()
-            .map(|r| format!("{}/{}", r.workspace_id, r.datatable))
-            .collect::<Vec<_>>()
-            .join(", ");
-        Ok(format!(
-            concat!(
-                "Deleted workspace {}. These data tables were governed by it and no longer ",
-                "resolve: {}. Their databases still exist; a superadmin can point them at ",
-                "another workspace's data table."
-            ),
-            &w_id, stranded
-        ))
-    }
+    Ok(format!("Deleted workspace {}", &w_id))
 }

 #[derive(Deserialize)]
@@ -1399,20 +1343,15 @@ pub async fn drop_forked_datatable_databases(
    let mut errors: Vec<String> = Vec::new();

    for dt_name in &req.datatable_names {
-        // Only a clone is droppable, and a clone is terminal by construction: a kept data table is
-        // a pointer at the parent's database, which this fork does not own.
-        let database = match datatables.get(dt_name) {
-            Some(dt) if dt.forked_from.is_some() => match dt.database.as_ref() {
-                Some(database) => database,
-                None => continue,
-            },
+        let dt = match datatables.get(dt_name) {
+            Some(dt) if dt.forked_from.is_some() => dt,
            _ => continue,
        };

-        if database.resource_type
+        if dt.database.resource_type
            == windmill_common::workspaces::DataTableCatalogResourceType::Instance
        {
-            let db_to_drop = &database.resource_path;
+            let db_to_drop = &dt.database.resource_path;
            if !db_to_drop.starts_with("wm_fork_") {
                errors.push(format!(
                    "Refusing to drop instance database '{}' for datatable://{}:  name does not start with 'wm_fork_'",
@@ -1,7 +1,7 @@
 openapi: "3.0.3"

 info:
-  version: 1.815.0
+  version: 1.814.0
  title: Windmill API

  contact:
@@ -529,30 +529,6 @@ paths:
      responses:
        "302":
          description: redirected to the post-login destination, or to /user/login_link_expired when the link is used, expired or unknown
-    post:
-      security: []
-      summary: consume a single-use login link from its confirmation page, set the session cookie and answer where to go
-      operationId: confirmLoginLink
-      tags:
-        - user
-      parameters:
-        - name: token
-          in: path
-          required: true
-          schema:
-            type: string
-      responses:
-        "200":
-          description: the post-login destination, or /user/login_link_expired when the link is used, expired or unknown
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - location
-                properties:
-                  location:
-                    type: string

  /auth/reset_password:
    post:
@@ -1612,89 +1588,6 @@ paths:
                additionalProperties:
                  $ref: "#/components/schemas/CustomInstanceDb"

-  /settings/datatable_roles:
-    get:
-      summary: list the instance's data table roles
-      operationId: listInstanceDatatableRoles
-      tags:
-        - setting
-      responses:
-        "200":
-          description: the instance role catalog
-          content:
-            application/json:
-              schema:
-                type: array
-                items:
-                  $ref: "#/components/schemas/InstanceDatatableRole"
-    post:
-      summary: create a data table role on the instance's Postgres cluster
-      operationId: createInstanceDatatableRole
-      tags:
-        - setting
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              type: object
-              required: [name]
-              properties:
-                name:
-                  type: string
-      responses:
-        "200":
-          description: the created role
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/InstanceDatatableRole"
-
-  /settings/datatable_roles/{id}:
-    post:
-      summary: rename a data table role or turn its login on and off
-      operationId: updateInstanceDatatableRole
-      tags:
-        - setting
-      parameters:
-        - in: path
-          name: id
-          required: true
-          schema:
-            type: string
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                name:
-                  type: string
-                enabled:
-                  type: boolean
-      responses:
-        "200":
-          description: the updated role
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/InstanceDatatableRole"
-    delete:
-      summary: drop a data table role from the cluster and from every workspace that named it
-      operationId: deleteInstanceDatatableRole
-      tags:
-        - setting
-      parameters:
-        - in: path
-          name: id
-          required: true
-          schema:
-            type: string
-      responses:
-        "200":
-          description: deleted
-
  /settings/setup_custom_instance_pg_database/{name}:
    post:
      summary: Runs CREATE DATABASE on the Windmill Postgres and grants access to the custom_instance_user
@@ -4090,13 +3983,9 @@ paths:
                  guest_access_enabled:
                    type: boolean
                    description: Whether this workspace admits guest sessions. An app's own `guest` execution mode is inert while this is false.
-                  add_admins_and_developers_to_forks:
-                    type: boolean
-                    description: Whether every new fork of this workspace starts with its admins and developers as members, keeping their role.
                required:
                  - workspace_id
                  - guest_access_enabled
-                  - add_admins_and_developers_to_forks

  /w/{workspace}/workspaces/get_settings:
    get:
@@ -4187,9 +4076,6 @@ paths:
                  guest_jwt_jwks_url:
                    type: string
                    description: JWKS URL a guest JWT (`jwt_guest_`) is verified against for this workspace. Mutually exclusive with `guest_jwt_public_key`.
-                  add_admins_and_developers_to_forks:
-                    type: boolean
-                    description: Whether every new fork of this workspace starts with its admins and developers as members, keeping their role.

  /w/{workspace}/workspaces/get_deploy_to:
    get:
@@ -5255,7 +5141,7 @@ paths:
                type: array
                items:
                  type: object
-                  required: [name, resource_type, resource_path, permissioned]
+                  required: [name, resource_type, resource_path]
                  properties:
                    name:
                      type: string
@@ -5264,97 +5150,6 @@ paths:
                      enum: [postgres, instance]
                    resource_path:
                      type: string
-                    governing_workspace_id:
-                      type: string
-                    permissioned:
-                      type: boolean
-
-  /w/{workspace}/workspaces/datatable_permissions/{datatable_name}:
-    get:
-      summary: get who may connect to a data table as which role
-      operationId: getDatatablePermissions
-      tags:
-        - workspace
-      parameters:
-        - $ref: "#/components/parameters/WorkspaceId"
-        - name: datatable_name
-          in: path
-          required: true
-          schema:
-            type: string
-      responses:
-        "200":
-          description: the data table's roles and their tenants
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/DatatablePermissions"
-    post:
-      summary: set who may connect to a data table as which role
-      operationId: setDatatablePermissions
-      tags:
-        - workspace
-      parameters:
-        - $ref: "#/components/parameters/WorkspaceId"
-        - name: datatable_name
-          in: path
-          required: true
-          schema:
-            type: string
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              type: object
-              required: [permissioned]
-              properties:
-                permissioned:
-                  type: boolean
-                default_role:
-                  type: string
-                roles:
-                  type: array
-                  items:
-                    $ref: "#/components/schemas/DatatableRoleTenants"
-      responses:
-        "200":
-          description: status
-          content:
-            text/plain:
-              schema:
-                type: string
-
-  /w/{workspace}/workspaces/datatable_usable_roles/{datatable_name}:
-    get:
-      summary: list the data table roles the caller may connect as
-      operationId: listUsableDatatableRoles
-      tags:
-        - workspace
-      parameters:
-        - $ref: "#/components/parameters/WorkspaceId"
-        - name: datatable_name
-          in: path
-          required: true
-          schema:
-            type: string
-      responses:
-        "200":
-          description: usable roles
-          content:
-            application/json:
-              schema:
-                type: object
-                required: [permissioned, roles, default_role]
-                properties:
-                  permissioned:
-                    type: boolean
-                  roles:
-                    type: array
-                    items:
-                      type: string
-                  default_role:
-                    type: string

  /w/{workspace}/workspaces/list_datatable_schemas:
    get:
@@ -5536,22 +5331,7 @@ paths:
          description: status
          content:
            application/json:
-              schema:
-                type: object
-                properties:
-                  stranded_references:
-                    description: >-
-                      Data tables in other workspaces that were governed by one this save deleted
-                      and no longer resolve.
-                    type: array
-                    items:
-                      type: object
-                      required: [workspace_id, datatable]
-                      properties:
-                        workspace_id:
-                          type: string
-                        datatable:
-                          type: string
+              schema: {}

  /w/{workspace}/workspaces/run_datatable_migrations/{datatable_name}:
    post:
@@ -6320,39 +6100,6 @@ paths:
              schema:
                type: string

-  /w/{workspace}/workspaces/edit_add_admins_and_developers_to_forks:
-    post:
-      summary: choose whether new forks of this workspace start with its admins and developers
-      description: >-
-        When on, every fork created from this workspace gets the workspace's admins and
-        developers as members, with the role they hold here; operators, disabled users and
-        service accounts are left out. The setting is copied into each fork, so forks of a
-        fork follow it too. Off by default. Workspace-admin gated.
-      operationId: editAddAdminsAndDevelopersToForks
-      tags:
-        - workspace
-      parameters:
-        - $ref: "#/components/parameters/WorkspaceId"
-      requestBody:
-        description: Whether new forks start with this workspace's admins and developers
-        required: true
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                add_admins_and_developers_to_forks:
-                  type: boolean
-              required:
-                - add_admins_and_developers_to_forks
-      responses:
-        "200":
-          description: status
-          content:
-            text/plain:
-              schema:
-                type: string
-
  /w/{workspace}/workspaces/edit_guest_jwt_key:
    post:
      summary: set the key guest JWTs are verified against for this workspace
@@ -6817,7 +6564,7 @@ paths:
                  type: string
                expires_in_s:
                  type: integer
-                  description: link lifetime in seconds, at most 7200 (default 600)
+                  description: link lifetime in seconds, at most 900 (default 600)
                rd:
                  type: string
                  description: same-origin path the browser lands on after login (default /user/workspaces)
@@ -6827,12 +6574,6 @@ paths:
                    mint only while the account still has this login type (for example
                    pending_oauth), so a link stops working once the owner has set a password
                    or signed in with a provider
-                confirm:
-                  type: boolean
-                  description: >-
-                    return a /user/login_link page that signs in only when its button is
-                    clicked, instead of a link spent by opening it; set it for links sent by
-                    email, which mail scanners open on delivery (default false)
      responses:
        "201":
          description: login link minted
@@ -33659,66 +33400,6 @@ components:
        - ducklake
        - datatable

-    InstanceDatatableRole:
-      type: object
-      required: [id, name, enabled]
-      properties:
-        id:
-          type: string
-        name:
-          type: string
-        enabled:
-          type: boolean
-
-    DatatableRoleTenants:
-      type: object
-      required: [id, tenants]
-      properties:
-        id:
-          type: string
-        name:
-          type: string
-        tenants:
-          type: array
-          items:
-            type: string
-
-    DatatablePermissions:
-      type: object
-      required: [supported, permissioned, default_role, roles, editable, available_roles]
-      properties:
-        supported:
-          type: boolean
-          description: >-
-            Whether this data table can be put under roles at all. Only one backed by the
-            instance database can: a role is a login on that cluster.
-        permissioned:
-          type: boolean
-        default_role:
-          type: string
-        roles:
-          type: array
-          items:
-            $ref: "#/components/schemas/DatatableRoleTenants"
-        governing_workspace_id:
-          type: string
-        editable:
-          type: boolean
-        available_roles:
-          type: array
-          items:
-            $ref: "#/components/schemas/InstanceDatatableRole"
-        ungoverned_reachers:
-          type: array
-          items:
-            type: object
-            required: [workspace_id, datatable]
-            properties:
-              workspace_id:
-                type: string
-              datatable:
-                type: string
-
    CustomInstanceDb:
      type: object
      required:
@@ -34801,9 +34482,6 @@ components:
                nullable: true
              disabled:
                type: boolean
-              is_service_account:
-                type: boolean
-                description: Whether this membership is a service account.
            required:
              - id
              - name
@@ -35770,11 +35448,9 @@ components:
          type: object
          additionalProperties:
            type: object
+            required: [database]
            properties:
              database:
-                description: >-
-                  Set on an entry that owns its database. Absent on a fork's entry, which points at
-                  another workspace's data table instead.
                type: object
                properties:
                  resource_type:
@@ -35786,17 +35462,6 @@ components:
                    type: string
                required:
                  - resource_type
-              reference:
-                description: >-
-                  The workspace and data table that govern this one. Server-owned: written by fork
-                  creation, and carried across a settings save whatever the request says.
-                type: object
-                required: [workspace_id, datatable]
-                properties:
-                  workspace_id:
-                    type: string
-                  datatable:
-                    type: string
              migrations_enabled:
                type: boolean
                description: Whether the SQL migrations feature is opted in for this data table
@@ -567,9 +567,6 @@ async fn set_config(
    };

    let mut tx = user_db.begin(&authed).await?;
-    if matches!(nc.trigger_kind, TriggerKind::Postgres) {
-        windmill_common::datatable_roles::lock_datatable_streams(&mut *tx, false).await?;
-    }

    sqlx::query!(
        r#"
@@ -617,9 +614,6 @@ async fn ping_config(
    )>,
 ) -> Result<()> {
    let mut tx = user_db.begin(&authed).await?;
-    if matches!(trigger_kind, TriggerKind::Postgres) {
-        windmill_common::datatable_roles::lock_datatable_streams(&mut *tx, false).await?;
-    }

    sqlx::query!(
        r#"
@@ -8365,9 +8365,8 @@ pub async fn run_wait_result_flow_by_version(
 /// job lives, in particular DuckDB, which runs in-process in the worker.
 ///
 /// What it does permit is any statement against the workspace's data tables, writes and DDL
-/// included: the helper's body is an unrestricted SQL template. What that reaches is the
-/// operator's own data table role — the preview job is permissioned as them, so the executor
-/// resolves it under their tenancy like any other job.
+/// included: the helper's body is an unrestricted SQL template and data tables carry no
+/// per-user ACL. Narrowing that is a separate decision from this exemption.
 ///
 /// The database argument is only half the target: the executor honors a `-- database`
 /// directive in the SQL over it, and `-- s3` redirects the result set, so both are refused.
@@ -8599,7 +8598,7 @@ async fn run_inline_preview_script(
 #[cfg(not(feature = "run_inline"))]
 async fn run_inline_preview_script() -> error::Result<Response> {
    Err(error::Error::InternalErr(
-        "inline preview requires the run_inline feature on the worker".to_string(),
+        "inline preview requires the worker feature".to_string(),
    ))
 }

@@ -560,7 +560,7 @@ pub async fn run_server(
        if server_mode || mcp_mode {
            use mcp::{
                add_www_authenticate_header, add_www_authenticate_header_gateway,
-                extract_workspace_from_token, reject_token_query_param,
+                extract_workspace_from_token,
            };
            let (mcp_router, mcp_cancellation_token) = setup_mcp_server(
                db.clone(),
@@ -573,17 +573,15 @@ pub async fn run_server(
            let workspaced_mcp_router = mcp_router
                .clone()
                .route_layer(from_extractor::<ApiAuthed>())
-                .layer(axum::middleware::from_fn(reject_token_query_param))
                .layer(axum::middleware::from_fn(add_www_authenticate_header))
                .layer(axum::middleware::from_fn(extract_and_store_workspace_id));
            // Gateway MCP router — resolves workspace from token
            let gateway_mcp_router = mcp_router
                .route_layer(from_extractor::<ApiAuthed>())
-                .layer(axum::middleware::from_fn(extract_workspace_from_token))
-                .layer(axum::middleware::from_fn(reject_token_query_param))
                .layer(axum::middleware::from_fn(
                    add_www_authenticate_header_gateway,
-                ));
+                ))
+                .layer(axum::middleware::from_fn(extract_workspace_from_token));
            (
                workspaced_mcp_router,
                gateway_mcp_router,
@@ -43,14 +43,11 @@ use axum::{
    extract::{Extension, Path},
    http::Request,
    middleware::Next,
-    response::{IntoResponse, Response},
+    response::Response,
    routing::get,
    Json, Router,
 };
-use windmill_common::{
-    auth::hash_token, db::GatewayWorkspaceId, error::JsonResult,
-    global_settings::MCP_DISABLE_TOKEN_QUERY_PARAM,
-};
+use windmill_common::{auth::hash_token, db::GatewayWorkspaceId, error::JsonResult};

 // McpAuth impl for ApiAuthed is in windmill-api-auth (same crate as the type)

@@ -449,29 +446,6 @@ pub async fn add_www_authenticate_header(
    }
 }

-/// Middleware refusing a credential carried in the MCP URL once the instance sets
-/// `mcp_disable_token_query_param`. Sits outside everything that reads the token, so neither
-/// the gateway lookup nor `ApiAuthed` ever sees it, and inside the `WWW-Authenticate` layer,
-/// whose header is what sends the client into the OAuth flow instead. Refused rather than
-/// ignored: the URL leaked the token whether or not the request used it.
-pub async fn reject_token_query_param(request: Request<axum::body::Body>, next: Next) -> Response {
-    let carries_token = MCP_DISABLE_TOKEN_QUERY_PARAM.load(std::sync::atomic::Ordering::Relaxed)
-        && request
-            .uri()
-            .query()
-            .is_some_and(|q| url::form_urlencoded::parse(q.as_bytes()).any(|(k, _)| k == "token"));
-    if carries_token {
-        return (
-            axum::http::StatusCode::UNAUTHORIZED,
-            "This instance does not accept a token in the MCP URL. Remove the token query \
-             parameter and let your client sign in through OAuth, or send the token in an \
-             Authorization header.",
-        )
-            .into_response();
-    }
-    next.run(request).await
-}
-
 /// Extract the bearer token from either the `Authorization` header or the
 /// `?token=` query parameter (MCP clients commonly pass it in the URL).
 fn extract_gateway_token(request: &Request<axum::body::Body>) -> Option<String> {
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Guilhem LemouelandClaude Opus 5	4b7771e703	fix: keep a chat pane mounted while its composer reads attachments Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-18 18:08:08 +02:00
Guilhem LemouelandClaude Opus 5	05e0534caf	refactor: read only message count and error for sessions without a runtime Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-18 17:23:28 +02:00
Guilhem LemouelandClaude Opus 5	4a931f0193	refactor: cap mounted chat panes instead of evicting session runtimes Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-18 17:13:55 +02:00
Guilhem LemouelandClaude Opus 5	3e70d0c8ef	fix: keep unsent input, init and chat rotation safe from runtime eviction Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-18 16:56:46 +02:00
Guilhem LemouelandClaude Opus 5	62e9cac57b	perf: stop mounting a chat per listed session on the sessions page Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-18 16:15:16 +02:00
Guilhem LemouelandClaude Opus 5	244b6bd1ce	perf: load only a session's own chats in its chat history Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-18 16:15:16 +02:00
Guilhem LemouelandClaude Opus 5	9ad4028553	perf: skip whole-document menu lookup on pointerdown when closed Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-18 16:15:08 +02:00
				`@@ -1 +0,0 @@`
				`ALTER TABLE workspace_settings DROP COLUMN add_admins_and_developers_to_forks;`
				`@@ -1 +0,0 @@`
				`ALTER TABLE workspace_settings ADD COLUMN add_admins_and_developers_to_forks BOOLEAN NOT NULL DEFAULT false;`