diff --git a/.github/actions/cache-mount/action.yml b/.github/actions/cache-mount/action.yml
new file mode 100644
index 00000000000..df0de0b106c
--- /dev/null
+++ b/.github/actions/cache-mount/action.yml
@@ -0,0 +1,36 @@
+name: Cache Mount
+description: Mount a build cache directory using Blacksmith sticky disks, or the GitHub Actions cache when running on GitHub-hosted runners.
+
+inputs:
+  provider:
+    description: Empty or 'blacksmith' selects sticky disks; anything else selects actions/cache.
+    required: false
+    default: ''
+  key:
+    description: Cache key, shared by both backends.
+    required: true
+  path:
+    description: Path to mount.
+    required: true
+
+# Predicates must stay the exact complement of the caller's runs-on — stickydisk
+# only runs on Blacksmith.
+runs:
+  using: composite
+  steps:
+    - name: Mount sticky disk
+      if: inputs.provider == '' || inputs.provider == 'blacksmith'
+      uses: useblacksmith/stickydisk@4c034ba57b706cf0e3b4b0ce098c2a3b1071580c # v1
+      with:
+        key: ${{ inputs.key }}
+        path: ${{ inputs.path }}
+
+    # run_id suffix + prefix restore-key: actions/cache skips save on an exact hit,
+    # which would freeze the cache at the first run's contents.
+    - name: Restore and save cache
+      if: inputs.provider != '' && inputs.provider != 'blacksmith'
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+      with:
+        key: ${{ inputs.key }}-${{ github.run_id }}
+        restore-keys: ${{ inputs.key }}-
+        path: ${{ inputs.path }}
diff --git a/.github/actions/docker-build/action.yml b/.github/actions/docker-build/action.yml
new file mode 100644
index 00000000000..bb241713490
--- /dev/null
+++ b/.github/actions/docker-build/action.yml
@@ -0,0 +1,59 @@
+name: Docker Build and Push
+description: Set up a buildx builder and build/push an image, using Blacksmith's builder or the upstream Docker actions on GitHub-hosted runners.
+
+inputs:
+  provider:
+    description: Empty or 'blacksmith' selects Blacksmith's builder; anything else selects the docker/* actions.
+    required: false
+    default: ''
+  context:
+    description: Build context.
+    required: false
+    default: .
+  file:
+    description: Path to the Dockerfile.
+    required: true
+  platforms:
+    description: Target platforms, e.g. linux/amd64.
+    required: true
+  tags:
+    description: Comma-separated list of tags to push.
+    required: true
+
+# Registry logins must precede this action. provenance/sbom stay off: attestation
+# manifests break `imagetools create` retagging in promote-images.
+runs:
+  using: composite
+  steps:
+    - name: Set up Blacksmith builder
+      if: inputs.provider == '' || inputs.provider == 'blacksmith'
+      uses: useblacksmith/setup-docker-builder@ab5c1da94f53f5cd75c1038092aa276dddfccbba # v1
+
+    - name: Build and push (Blacksmith)
+      if: inputs.provider == '' || inputs.provider == 'blacksmith'
+      uses: useblacksmith/build-push-action@fb9e3e6a9299c78462bfadd0d93352c316adc9b8 # v2
+      with:
+        context: ${{ inputs.context }}
+        file: ${{ inputs.file }}
+        platforms: ${{ inputs.platforms }}
+        push: true
+        tags: ${{ inputs.tags }}
+        provenance: false
+        sbom: false
+
+    - name: Set up Docker Buildx
+      if: inputs.provider != '' && inputs.provider != 'blacksmith'
+      uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+
+    # No cache-to: type=gha — it shares the 10 GB repo quota with the cache mounts.
+    - name: Build and push (GitHub)
+      if: inputs.provider != '' && inputs.provider != 'blacksmith'
+      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+      with:
+        context: ${{ inputs.context }}
+        file: ${{ inputs.file }}
+        platforms: ${{ inputs.platforms }}
+        push: true
+        tags: ${{ inputs.tags }}
+        provenance: false
+        sbom: false
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ca2901c7871..0aa7a40ed9e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,5 +1,20 @@
 name: CI
 
+# Runner provider toggle, read from the CI_PROVIDER repo variable:
+#
+#   gh variable set CI_PROVIDER --body github   # fall back to GitHub-hosted
+#   gh variable delete CI_PROVIDER              # back to Blacksmith (default)
+#
+# A repo variable, not a committed value: during a Blacksmith outage there is no
+# working CI to merge a switchover through. Only unset/'blacksmith' selects
+# Blacksmith; anything unrecognized selects GitHub so a typo can't queue jobs
+# against the provider you're escaping. Every runs-on and both composite actions
+# share this predicate and must change together.
+#
+# GitHub mode is break-glass, not a peer — cold layers, slower runs. The app image
+# is the one job on a paid larger runner: next build needs ~32 GB and OOM-kills
+# (exit 137) on the free 16 GB runners at any heap ceiling.
+
 on:
   push:
     branches: [main, staging, dev]
@@ -28,7 +43,7 @@ jobs:
   # Detect if this is a version release commit (e.g., "v0.5.24: ...")
   detect-version:
     name: Detect Version
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 5
     if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/staging' || github.ref == 'refs/heads/dev')
     outputs:
@@ -81,7 +96,7 @@ jobs:
     name: Build Dev ECR
     needs: [detect-version, migrate-dev]
     if: github.event_name == 'push' && github.ref == 'refs/heads/dev'
-    runs-on: blacksmith-8vcpu-ubuntu-2404
+    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-8vcpu-ubuntu-2404' || matrix.gh_runner }}
     timeout-minutes: 30
     permissions:
       contents: read
@@ -90,14 +105,20 @@ jobs:
       fail-fast: false
       matrix:
         include:
+          # Only the app image needs the paid 8-core/32 GB runner: next build
+          # exhausts the free 16 GB one (exit 137). The others build in <5 min.
           - dockerfile: ./docker/app.Dockerfile
             ecr_repo_secret: ECR_APP
+            gh_runner: linux-x64-8-core
           - dockerfile: ./docker/db.Dockerfile
             ecr_repo_secret: ECR_MIGRATIONS
+            gh_runner: ubuntu-latest
           - dockerfile: ./docker/realtime.Dockerfile
             ecr_repo_secret: ECR_REALTIME
+            gh_runner: ubuntu-latest
           - dockerfile: ./docker/pii.Dockerfile
             ecr_repo_secret: ECR_PII
+            gh_runner: ubuntu-latest
     steps:
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
@@ -118,9 +139,6 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Set up Docker Buildx
-        uses: useblacksmith/setup-docker-builder@ab5c1da94f53f5cd75c1038092aa276dddfccbba # v1
-
       - name: Resolve ECR repo name
         id: ecr-repo
         run: echo "name=$ECR_REPO" >> $GITHUB_OUTPUT
@@ -128,15 +146,12 @@ jobs:
           ECR_REPO: ${{ matrix.ecr_repo_secret == 'ECR_APP' && secrets.ECR_APP || matrix.ecr_repo_secret == 'ECR_MIGRATIONS' && secrets.ECR_MIGRATIONS || matrix.ecr_repo_secret == 'ECR_REALTIME' && secrets.ECR_REALTIME || matrix.ecr_repo_secret == 'ECR_PII' && secrets.ECR_PII || '' }}
 
       - name: Build and push
-        uses: useblacksmith/build-push-action@fb9e3e6a9299c78462bfadd0d93352c316adc9b8 # v2
+        uses: ./.github/actions/docker-build
         with:
-          context: .
+          provider: ${{ vars.CI_PROVIDER }}
           file: ${{ matrix.dockerfile }}
           platforms: linux/amd64
-          push: true
           tags: ${{ steps.login-ecr.outputs.registry }}/${{ steps.ecr-repo.outputs.name }}:dev
-          provenance: false
-          sbom: false
 
   # Dev: deploy Trigger.dev background tasks to the preview "dev-sim" branch.
   # Gated after migrate-dev for the same reason as build-dev — the new task
@@ -145,7 +160,7 @@ jobs:
     name: Deploy Trigger.dev (Dev)
     needs: [migrate-dev]
     if: github.event_name == 'push' && github.ref == 'refs/heads/dev'
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 15
     steps:
       - name: Checkout code
@@ -192,7 +207,7 @@ jobs:
     if: >-
       github.event_name == 'push' &&
       (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/staging')
-    runs-on: blacksmith-8vcpu-ubuntu-2404
+    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-8vcpu-ubuntu-2404' || matrix.gh_runner }}
     timeout-minutes: 30
     permissions:
       contents: read
@@ -205,15 +220,19 @@ jobs:
           - dockerfile: ./docker/app.Dockerfile
             ghcr_image: ghcr.io/simstudioai/simstudio
             ecr_repo_secret: ECR_APP
+            gh_runner: linux-x64-8-core
           - dockerfile: ./docker/db.Dockerfile
             ghcr_image: ghcr.io/simstudioai/migrations
             ecr_repo_secret: ECR_MIGRATIONS
+            gh_runner: ubuntu-latest
           - dockerfile: ./docker/realtime.Dockerfile
             ghcr_image: ghcr.io/simstudioai/realtime
             ecr_repo_secret: ECR_REALTIME
+            gh_runner: ubuntu-latest
           - dockerfile: ./docker/pii.Dockerfile
             ghcr_image: ghcr.io/simstudioai/pii
             ecr_repo_secret: ECR_PII
+            gh_runner: ubuntu-latest
     steps:
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
@@ -242,9 +261,6 @@ jobs:
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Set up Docker Buildx
-        uses: useblacksmith/setup-docker-builder@ab5c1da94f53f5cd75c1038092aa276dddfccbba # v1
-
       - name: Resolve ECR repo name
         id: ecr-repo
         run: echo "name=$ECR_REPO" >> $GITHUB_OUTPUT
@@ -270,15 +286,12 @@ jobs:
           echo "tags=${TAGS}" >> $GITHUB_OUTPUT
 
       - name: Build and push images
-        uses: useblacksmith/build-push-action@fb9e3e6a9299c78462bfadd0d93352c316adc9b8 # v2
+        uses: ./.github/actions/docker-build
         with:
-          context: .
+          provider: ${{ vars.CI_PROVIDER }}
           file: ${{ matrix.dockerfile }}
           platforms: linux/amd64
-          push: true
           tags: ${{ steps.meta.outputs.tags }}
-          provenance: false
-          sbom: false
 
   # Promote the sha-tagged ECR images to the deploy tags once tests and
   # migrations pass. Pushing the ECR latest/staging tag is what triggers
@@ -292,7 +305,7 @@ jobs:
     if: >-
       github.event_name == 'push' &&
       (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/staging')
-    runs-on: blacksmith-2vcpu-ubuntu-2404
+    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 10
     permissions:
       contents: read
@@ -362,7 +375,7 @@ jobs:
   # never moves a documented tag.
   build-ghcr-arm64:
     name: Build ARM64 (GHCR Only)
-    runs-on: blacksmith-8vcpu-ubuntu-2404-arm
+    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-8vcpu-ubuntu-2404-arm' || matrix.gh_runner }}
     timeout-minutes: 30
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     permissions:
@@ -374,12 +387,16 @@ jobs:
         include:
           - dockerfile: ./docker/app.Dockerfile
             image: ghcr.io/simstudioai/simstudio
+            gh_runner: linux-arm64-8-core
           - dockerfile: ./docker/db.Dockerfile
             image: ghcr.io/simstudioai/migrations
+            gh_runner: ubuntu-24.04-arm
           - dockerfile: ./docker/realtime.Dockerfile
             image: ghcr.io/simstudioai/realtime
+            gh_runner: ubuntu-24.04-arm
           - dockerfile: ./docker/pii.Dockerfile
             image: ghcr.io/simstudioai/pii
+            gh_runner: ubuntu-24.04-arm
 
     steps:
       - name: Checkout code
@@ -392,26 +409,20 @@ jobs:
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Set up Docker Buildx
-        uses: useblacksmith/setup-docker-builder@ab5c1da94f53f5cd75c1038092aa276dddfccbba # v1
-
       - name: Build and push ARM64 to GHCR
-        uses: useblacksmith/build-push-action@fb9e3e6a9299c78462bfadd0d93352c316adc9b8 # v2
+        uses: ./.github/actions/docker-build
         with:
-          context: .
+          provider: ${{ vars.CI_PROVIDER }}
           file: ${{ matrix.dockerfile }}
           platforms: linux/arm64
-          push: true
           tags: ${{ matrix.image }}:${{ github.sha }}-arm64
-          provenance: false
-          sbom: false
 
   # Publish all mutable GHCR tags (latest, latest-amd64/arm64, version tags)
   # and the multi-arch manifests from the immutable sha tags — only on main,
   # after the deploy gate (promote-images) and the ARM64 build both pass.
   create-ghcr-manifests:
     name: Create GHCR Manifests
-    runs-on: blacksmith-2vcpu-ubuntu-2404
+    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 10
     needs: [promote-images, build-ghcr-arm64, detect-version]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
@@ -477,7 +488,7 @@ jobs:
   # Check if docs changed
   check-docs-changes:
     name: Check Docs Changes
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 5
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     outputs:
@@ -506,7 +517,7 @@ jobs:
   # Create GitHub Release (only for version commits on main, after all builds complete)
   create-release:
     name: Create GitHub Release
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 10
     needs: [create-ghcr-manifests, detect-version]
     if: needs.detect-version.outputs.is_release == 'true'
diff --git a/.github/workflows/docs-embeddings.yml b/.github/workflows/docs-embeddings.yml
index 76cf58c584e..b1eb9a28f49 100644
--- a/.github/workflows/docs-embeddings.yml
+++ b/.github/workflows/docs-embeddings.yml
@@ -10,7 +10,7 @@ permissions:
 jobs:
   process-docs-embeddings:
     name: Process Documentation Embeddings
-    runs-on: blacksmith-8vcpu-ubuntu-2404
+    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 30
     if: github.ref == 'refs/heads/main'
 
diff --git a/.github/workflows/migrations.yml b/.github/workflows/migrations.yml
index 593bf854a4e..ab177ed0c5d 100644
--- a/.github/workflows/migrations.yml
+++ b/.github/workflows/migrations.yml
@@ -24,7 +24,7 @@ permissions:
 jobs:
   migrate:
     name: Apply Database Migrations
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 45
 
     steps:
diff --git a/.github/workflows/publish-cli.yml b/.github/workflows/publish-cli.yml
index da24a3959be..54f8b0b7038 100644
--- a/.github/workflows/publish-cli.yml
+++ b/.github/workflows/publish-cli.yml
@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   publish-npm:
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 15
     steps:
       - name: Checkout repository
diff --git a/.github/workflows/publish-python-sdk.yml b/.github/workflows/publish-python-sdk.yml
index 1890c10b9f5..98e598b11d8 100644
--- a/.github/workflows/publish-python-sdk.yml
+++ b/.github/workflows/publish-python-sdk.yml
@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   publish-pypi:
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 15
     steps:
       - name: Checkout repository
diff --git a/.github/workflows/publish-ts-sdk.yml b/.github/workflows/publish-ts-sdk.yml
index f64f3867a74..e6bb8891b5f 100644
--- a/.github/workflows/publish-ts-sdk.yml
+++ b/.github/workflows/publish-ts-sdk.yml
@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   publish-npm:
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 15
     steps:
       - name: Checkout repository
diff --git a/.github/workflows/test-build.yml b/.github/workflows/test-build.yml
index f20cae5f7d6..ed348a41446 100644
--- a/.github/workflows/test-build.yml
+++ b/.github/workflows/test-build.yml
@@ -10,7 +10,7 @@ permissions:
 jobs:
   test-build:
     name: Lint and Test
-    runs-on: blacksmith-8vcpu-ubuntu-2404
+    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 15
 
     steps:
@@ -27,25 +27,28 @@ jobs:
         with:
           node-version: 22
 
-      # Sticky-disk keys are scoped by event name, and fork PRs get their own
-      # namespace on top: untrusted fork runs must never share a disk with
-      # push runs (whose disks feed production image builds) or with trusted
+      # Cache keys are scoped by event name, and fork PRs get their own
+      # namespace on top: untrusted fork runs must never share a cache with
+      # push runs (whose caches feed production image builds) or with trusted
       # internal-PR runs.
-      - name: Mount Bun cache (Sticky Disk)
-        uses: useblacksmith/stickydisk@4c034ba57b706cf0e3b4b0ce098c2a3b1071580c # v1
+      - name: Mount Bun cache
+        uses: ./.github/actions/cache-mount
         with:
+          provider: ${{ vars.CI_PROVIDER }}
           key: ${{ github.repository }}-bun-cache-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
           path: ~/.bun/install/cache
 
-      - name: Mount node_modules (Sticky Disk)
-        uses: useblacksmith/stickydisk@4c034ba57b706cf0e3b4b0ce098c2a3b1071580c # v1
+      - name: Mount node_modules
+        uses: ./.github/actions/cache-mount
         with:
+          provider: ${{ vars.CI_PROVIDER }}
           key: ${{ github.repository }}-node-modules-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
           path: ./node_modules
 
-      - name: Mount Turbo cache (Sticky Disk)
-        uses: useblacksmith/stickydisk@4c034ba57b706cf0e3b4b0ce098c2a3b1071580c # v1
+      - name: Mount Turbo cache
+        uses: ./.github/actions/cache-mount
         with:
+          provider: ${{ vars.CI_PROVIDER }}
           key: ${{ github.repository }}-turbo-cache-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
           path: ./.turbo
 
@@ -150,6 +153,11 @@ jobs:
       - name: Type-check realtime server
         run: bunx turbo run type-check --filter=@sim/realtime
 
+      # cloud-review-tools.test.ts runs the real helper on the runner, which shells
+      # out to rg. Blacksmith's image ships it, GitHub's doesn't.
+      - name: Install ripgrep
+        run: command -v rg || (sudo apt-get update && sudo apt-get install -y ripgrep)
+
       - name: Run tests with coverage
         env:
           NODE_OPTIONS: '--no-warnings --max-old-space-size=8192'
@@ -186,9 +194,11 @@ jobs:
   # harmless), but the Turbo cache gets its own key: with a shared key, only
   # the last committer's new entries survive each run, so the test and build
   # Turbo entries would evict each other nondeterministically.
+  # Same next build as the app image, so it needs the same larger runner in
+  # GitHub mode: it peaks ~21.9 GB and SIGKILLs on the free 16 GB ones.
   build:
     name: Build App
-    runs-on: blacksmith-8vcpu-ubuntu-2404
+    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-8vcpu-ubuntu-2404' || 'linux-x64-8-core' }}
     timeout-minutes: 15
 
     steps:
@@ -205,21 +215,24 @@ jobs:
         with:
           node-version: 22
 
-      - name: Mount Bun cache (Sticky Disk)
-        uses: useblacksmith/stickydisk@4c034ba57b706cf0e3b4b0ce098c2a3b1071580c # v1
+      - name: Mount Bun cache
+        uses: ./.github/actions/cache-mount
         with:
+          provider: ${{ vars.CI_PROVIDER }}
           key: ${{ github.repository }}-bun-cache-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
           path: ~/.bun/install/cache
 
-      - name: Mount node_modules (Sticky Disk)
-        uses: useblacksmith/stickydisk@4c034ba57b706cf0e3b4b0ce098c2a3b1071580c # v1
+      - name: Mount node_modules
+        uses: ./.github/actions/cache-mount
         with:
+          provider: ${{ vars.CI_PROVIDER }}
           key: ${{ github.repository }}-node-modules-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
           path: ./node_modules
 
-      - name: Mount Turbo cache (Sticky Disk)
-        uses: useblacksmith/stickydisk@4c034ba57b706cf0e3b4b0ce098c2a3b1071580c # v1
+      - name: Mount Turbo cache
+        uses: ./.github/actions/cache-mount
         with:
+          provider: ${{ vars.CI_PROVIDER }}
           key: ${{ github.repository }}-turbo-cache-build-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
           path: ./.turbo
 
diff --git a/apps/docs/content/docs/en/integrations/slack.mdx b/apps/docs/content/docs/en/integrations/slack.mdx
index c90a179c1b9..b02ea9e6cfb 100644
--- a/apps/docs/content/docs/en/integrations/slack.mdx
+++ b/apps/docs/content/docs/en/integrations/slack.mdx
@@ -815,7 +815,7 @@ Set or clear the assistant thread status indicator (the loading shimmer) on a Sl
 | `botToken` | string | No | Bot token for Custom Bot |
 | `channel` | string | Yes | Channel ID containing the assistant thread \(e.g., C1234567890 or D1234567890\) |
 | `threadTs` | string | Yes | Thread timestamp \(thread_ts\) of the assistant thread \(e.g., 1405894322.002768\) |
-| `status` | string | Yes | Status text to display, e.g. 'Working on it…'. Pass an empty string to clear. |
+| `status` | string | No | Status text to display, e.g. 'Working on it…'. Omit or pass an empty string to clear the status. |
 | `loadingMessages` | json | No | Optional list of messages to rotate through as an animated loading indicator \(max 10\). |
 
 #### Output
diff --git a/apps/pii/server.py b/apps/pii/server.py
index fdd7c1b2604..05b23e9b0b1 100644
--- a/apps/pii/server.py
+++ b/apps/pii/server.py
@@ -176,23 +176,50 @@ def build_analyzer() -> AnalyzerEngine:
 batch_analyzer = BatchAnalyzerEngine(analyzer_engine=analyzer)
 anonymizer = AnonymizerEngine()
 
-# Every entity the spaCy NER recognizers can produce. A request touching any of
-# these must run spaCy; a request naming only non-NER (regex/checksum) entities can
-# skip it. Derived from the live registry so it stays authoritative if Presidio's
-# default entity set changes (e.g. ORGANIZATION), unioned with a known floor so an
-# unexpectedly empty derivation can never let an NER request skip the NLP pass.
+# Every entity the spaCy NER recognizers can actually produce. A request touching
+# any of these must run spaCy; a request naming only non-NER (regex/checksum)
+# entities can skip it. The registry's SpacyRecognizers CLAIM every entity in
+# Presidio's default NER-model mapping — including PHONE_NUMBER/AGE/ID/EMAIL,
+# which exist for transformer models and which no spaCy model can emit — so the
+# claimed set is intersected with the entities the loaded models' NER labels map
+# onto. Without that filter, selecting PHONE_NUMBER (present in nearly every
+# redaction rule) silently forces the full spaCy pass and the regex-only fast
+# path never fires. The floor guarantees the core NER entities always take the
+# full pass even if label introspection ever derives empty.
 _SPACY_NER_FLOOR = frozenset({"PERSON", "LOCATION", "NRP", "DATE_TIME", "ORGANIZATION"})
-NER_ENTITIES = _SPACY_NER_FLOOR | frozenset(
-    entity
-    for recognizer in analyzer.registry.recognizers
-    if isinstance(recognizer, SpacyRecognizer)
-    for entity in recognizer.supported_entities
+
+
+def _producible_ner_entities() -> frozenset:
+    """Presidio entities some loaded spaCy model's NER labels map onto."""
+    configuration = getattr(analyzer.nlp_engine, "ner_model_configuration", None)
+    mapping = configuration.model_to_presidio_entity_mapping if configuration else {}
+    producible = set()
+    for nlp in getattr(analyzer.nlp_engine, "nlp", {}).values():
+        if "ner" not in nlp.pipe_names:
+            continue
+        for label in nlp.get_pipe("ner").labels:
+            entity = mapping.get(label)
+            if entity:
+                producible.add(entity)
+    return frozenset(producible)
+
+
+NER_ENTITIES = _SPACY_NER_FLOOR | (
+    frozenset(
+        entity
+        for recognizer in analyzer.registry.recognizers
+        if isinstance(recognizer, SpacyRecognizer)
+        for entity in recognizer.supported_entities
+    )
+    & _producible_ner_entities()
 )
 
 # One blank NlpArtifacts per language, built once at startup. Passing these to
 # analyze() skips nlp_engine.process_text (the spaCy tok2vec+ner pass) entirely:
-# the pattern recognizers still match on the raw text, SpacyRecognizer is excluded
-# by the entity filter, and score_threshold is unset so detection is identical.
+# the pattern recognizers still match on the raw text, SpacyRecognizer finds
+# nothing in blank artifacts (and can only be consulted at all for claimed-but-
+# unproducible entities like PHONE_NUMBER), and score_threshold is unset so
+# detection is identical.
 # Only context-based score boosting (which needs real tokens) is unavailable — an
 # accepted trade for skipping NER on the hot block-output path. Read-only, so it
 # is safe to share across requests and workers.
diff --git a/apps/sim/app/(landing)/models/utils.ts b/apps/sim/app/(landing)/models/utils.ts
index 6f54de56b6c..0e75c76e230 100644
--- a/apps/sim/app/(landing)/models/utils.ts
+++ b/apps/sim/app/(landing)/models/utils.ts
@@ -483,7 +483,7 @@ const rawProviders = Object.values(PROVIDER_DEFINITIONS).map((provider) => {
       providerSlug,
       contextWindow: model.contextWindow ?? null,
       releaseDate: model.releaseDate ?? null,
-      deprecated: model.deprecated ?? false,
+      deprecated: !!model.sunset,
       pricing: model.pricing,
       capabilities: mergedCapabilities,
       capabilityTags,
diff --git a/apps/sim/app/api/chat/manage/[id]/route.test.ts b/apps/sim/app/api/chat/manage/[id]/route.test.ts
index 399caeb3b66..bc765862b4c 100644
--- a/apps/sim/app/api/chat/manage/[id]/route.test.ts
+++ b/apps/sim/app/api/chat/manage/[id]/route.test.ts
@@ -20,8 +20,9 @@ import {
 import { NextRequest } from 'next/server'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockCheckChatAccess } = vi.hoisted(() => ({
+const { mockCheckChatAccess, mockValidateChatDeployAuth } = vi.hoisted(() => ({
   mockCheckChatAccess: vi.fn(),
+  mockValidateChatDeployAuth: vi.fn(),
 }))
 
 const mockCreateSuccessResponse = workflowsApiUtilsMockFns.mockCreateSuccessResponse
@@ -50,10 +51,20 @@ vi.mock('@/lib/core/utils/urls', () => ({
 vi.mock('@/app/api/chat/utils', () => ({
   checkChatAccess: mockCheckChatAccess,
 }))
+vi.mock('@/ee/access-control/utils/permission-check', () => {
+  class ChatDeployAuthNotAllowedError extends Error {
+    constructor() {
+      super('This chat authentication mode is not allowed based on your permission group settings')
+      this.name = 'ChatDeployAuthNotAllowedError'
+    }
+  }
+  return { validateChatDeployAuth: mockValidateChatDeployAuth, ChatDeployAuthNotAllowedError }
+})
 vi.mock('@/lib/workflows/persistence/utils', () => workflowsPersistenceUtilsMock)
 vi.mock('@/lib/workflows/orchestration', () => workflowsOrchestrationMock)
 
 import { DELETE, GET, PATCH } from '@/app/api/chat/manage/[id]/route'
+import { ChatDeployAuthNotAllowedError } from '@/ee/access-control/utils/permission-check'
 
 describe('Chat Edit API Route', () => {
   beforeEach(() => {
@@ -213,6 +224,60 @@ describe('Chat Edit API Route', () => {
       expect(data.message).toBe('Chat deployment updated successfully')
     })
 
+    it('returns 403 when the updated auth type changes to a blocked mode', async () => {
+      authMockFns.mockGetSession.mockResolvedValue({
+        user: { id: 'user-id' },
+      })
+
+      mockCheckChatAccess.mockResolvedValue({
+        hasAccess: true,
+        chat: {
+          id: 'chat-123',
+          identifier: 'test-chat',
+          authType: 'password',
+          workflowId: 'workflow-123',
+        },
+        workspaceId: 'workspace-123',
+      })
+      mockValidateChatDeployAuth.mockRejectedValueOnce(new ChatDeployAuthNotAllowedError())
+
+      const req = new NextRequest('http://localhost:3000/api/chat/manage/chat-123', {
+        method: 'PATCH',
+        body: JSON.stringify({ authType: 'public' }),
+      })
+      const response = await PATCH(req, { params: Promise.resolve({ id: 'chat-123' }) })
+
+      expect(response.status).toBe(403)
+      expect(mockValidateChatDeployAuth).toHaveBeenCalledWith('user-id', 'workspace-123', 'public')
+      expect(dbChainMockFns.update).not.toHaveBeenCalled()
+    })
+
+    it('does not re-check the auth mode when it is unchanged (grandfathered)', async () => {
+      authMockFns.mockGetSession.mockResolvedValue({
+        user: { id: 'user-id' },
+      })
+
+      mockCheckChatAccess.mockResolvedValue({
+        hasAccess: true,
+        chat: {
+          id: 'chat-123',
+          identifier: 'test-chat',
+          authType: 'public',
+          workflowId: 'workflow-123',
+        },
+        workspaceId: 'workspace-123',
+      })
+
+      const req = new NextRequest('http://localhost:3000/api/chat/manage/chat-123', {
+        method: 'PATCH',
+        body: JSON.stringify({ authType: 'public', title: 'Renamed' }),
+      })
+      const response = await PATCH(req, { params: Promise.resolve({ id: 'chat-123' }) })
+
+      expect(response.status).toBe(200)
+      expect(mockValidateChatDeployAuth).not.toHaveBeenCalled()
+    })
+
     it('rejects the update without admitting a new deploy while an attempt is in flight', async () => {
       authMockFns.mockGetSession.mockResolvedValue({ user: { id: 'user-id' } })
       mockCheckChatAccess.mockResolvedValue({
diff --git a/apps/sim/app/api/chat/manage/[id]/route.ts b/apps/sim/app/api/chat/manage/[id]/route.ts
index 0afb00b152a..08acae6daa0 100644
--- a/apps/sim/app/api/chat/manage/[id]/route.ts
+++ b/apps/sim/app/api/chat/manage/[id]/route.ts
@@ -23,6 +23,10 @@ import {
   createErrorResponse,
   createSuccessResponse,
 } from '@/app/api/workflows/utils'
+import {
+  ChatDeployAuthNotAllowedError,
+  validateChatDeployAuth,
+} from '@/ee/access-control/utils/permission-check'
 
 export const dynamic = 'force-dynamic'
 export const maxDuration = 120
@@ -119,6 +123,20 @@ export const PATCH = withRouteHandler(
         return createErrorResponse('Changing the workflow of a chat deployment is not allowed', 400)
       }
 
+      // Enforce the permission group's chat auth-mode allow-list only when the
+      // mode actually changes, so a grandfathered mode already saved on this chat
+      // can still be re-saved (e.g. a title-only edit) without a 403.
+      if (authType && authType !== existingChatRecord.authType && chatWorkspaceId) {
+        try {
+          await validateChatDeployAuth(session.user.id, chatWorkspaceId, authType)
+        } catch (error) {
+          if (error instanceof ChatDeployAuthNotAllowedError) {
+            return createErrorResponse(error.message, 403)
+          }
+          throw error
+        }
+      }
+
       if (identifier && identifier !== existingChat[0].identifier) {
         const existingIdentifier = await db
           .select()
diff --git a/apps/sim/app/api/chat/route.test.ts b/apps/sim/app/api/chat/route.test.ts
index 59d6a72b0e4..d85f62bd2b4 100644
--- a/apps/sim/app/api/chat/route.test.ts
+++ b/apps/sim/app/api/chat/route.test.ts
@@ -16,8 +16,9 @@ import {
 import { NextRequest } from 'next/server'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockCheckWorkflowAccessForChatCreation } = vi.hoisted(() => ({
+const { mockCheckWorkflowAccessForChatCreation, mockValidateChatDeployAuth } = vi.hoisted(() => ({
   mockCheckWorkflowAccessForChatCreation: vi.fn(),
+  mockValidateChatDeployAuth: vi.fn(),
 }))
 
 const mockCreateSuccessResponse = workflowsApiUtilsMockFns.mockCreateSuccessResponse
@@ -32,6 +33,16 @@ vi.mock('@/app/api/chat/utils', () => ({
   checkWorkflowAccessForChatCreation: mockCheckWorkflowAccessForChatCreation,
 }))
 
+vi.mock('@/ee/access-control/utils/permission-check', () => {
+  class ChatDeployAuthNotAllowedError extends Error {
+    constructor() {
+      super('This chat authentication mode is not allowed based on your permission group settings')
+      this.name = 'ChatDeployAuthNotAllowedError'
+    }
+  }
+  return { validateChatDeployAuth: mockValidateChatDeployAuth, ChatDeployAuthNotAllowedError }
+})
+
 vi.mock('@/lib/workflows/orchestration', () => workflowsOrchestrationMock)
 
 vi.mock('@/lib/core/config/env', () =>
@@ -42,6 +53,7 @@ vi.mock('@/lib/core/config/env', () =>
 )
 
 import { GET, POST } from '@/app/api/chat/route'
+import { ChatDeployAuthNotAllowedError } from '@/ee/access-control/utils/permission-check'
 
 describe('Chat API Route', () => {
   beforeEach(() => {
@@ -237,6 +249,40 @@ describe('Chat API Route', () => {
       )
     })
 
+    it('returns 403 when the chat auth type is blocked by the permission group', async () => {
+      authMockFns.mockGetSession.mockResolvedValue({
+        user: { id: 'user-id', email: 'user@example.com' },
+      })
+
+      const validData = {
+        workflowId: 'workflow-123',
+        identifier: 'test-chat',
+        title: 'Test Chat',
+        authType: 'public',
+        customizations: {
+          primaryColor: '#000000',
+          welcomeMessage: 'Hello',
+        },
+      }
+
+      dbChainMockFns.limit.mockResolvedValueOnce([])
+      mockCheckWorkflowAccessForChatCreation.mockResolvedValue({
+        hasAccess: true,
+        workflow: { userId: 'user-id', workspaceId: 'workspace-1', isDeployed: true },
+      })
+      mockValidateChatDeployAuth.mockRejectedValueOnce(new ChatDeployAuthNotAllowedError())
+
+      const req = new NextRequest('http://localhost:3000/api/chat', {
+        method: 'POST',
+        body: JSON.stringify(validData),
+      })
+      const response = await POST(req)
+
+      expect(response.status).toBe(403)
+      expect(mockValidateChatDeployAuth).toHaveBeenCalledWith('user-id', 'workspace-1', 'public')
+      expect(mockPerformChatDeploy).not.toHaveBeenCalled()
+    })
+
     it('passes chat customizations and outputConfigs through in the API request shape', async () => {
       authMockFns.mockGetSession.mockResolvedValue({
         user: { id: 'user-id', email: 'user@example.com' },
diff --git a/apps/sim/app/api/chat/route.ts b/apps/sim/app/api/chat/route.ts
index ca1f8019fe7..03f4e5377af 100644
--- a/apps/sim/app/api/chat/route.ts
+++ b/apps/sim/app/api/chat/route.ts
@@ -11,6 +11,10 @@ import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { performChatDeploy } from '@/lib/workflows/orchestration'
 import { checkWorkflowAccessForChatCreation } from '@/app/api/chat/utils'
 import { createErrorResponse, createSuccessResponse } from '@/app/api/workflows/utils'
+import {
+  ChatDeployAuthNotAllowedError,
+  validateChatDeployAuth,
+} from '@/ee/access-control/utils/permission-check'
 
 const logger = createLogger('ChatAPI')
 
@@ -101,6 +105,17 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       return createErrorResponse('Workflow not found or access denied', 404)
     }
 
+    if (workflowRecord.workspaceId) {
+      try {
+        await validateChatDeployAuth(session.user.id, workflowRecord.workspaceId, authType)
+      } catch (error) {
+        if (error instanceof ChatDeployAuthNotAllowedError) {
+          return createErrorResponse(error.message, 403)
+        }
+        throw error
+      }
+    }
+
     const result = await performChatDeploy({
       workflowId,
       userId: session.user.id,
diff --git a/apps/sim/app/api/copilot/chat/delete/route.ts b/apps/sim/app/api/copilot/chat/delete/route.ts
index ccd3ba7334a..a0666d2c6eb 100644
--- a/apps/sim/app/api/copilot/chat/delete/route.ts
+++ b/apps/sim/app/api/copilot/chat/delete/route.ts
@@ -35,6 +35,16 @@ export const DELETE = withRouteHandler(async (request: NextRequest) => {
       return NextResponse.json({ success: true })
     }
 
+    // Mothership (sidebar) chats are soft-deleted through their own route so
+    // they land in Recently Deleted — this legacy hard-delete must not bypass
+    // that.
+    if (chat.type === 'mothership') {
+      return NextResponse.json(
+        { success: false, error: 'Use the mothership chat delete endpoint' },
+        { status: 400 }
+      )
+    }
+
     const [deleted] = await db
       .delete(copilotChats)
       .where(and(eq(copilotChats.id, parsed.chatId), eq(copilotChats.userId, session.user.id)))
diff --git a/apps/sim/app/api/copilot/chat/queries.ts b/apps/sim/app/api/copilot/chat/queries.ts
index c7fa4d58b3f..0047b7e6f11 100644
--- a/apps/sim/app/api/copilot/chat/queries.ts
+++ b/apps/sim/app/api/copilot/chat/queries.ts
@@ -3,7 +3,7 @@ import { copilotChats } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { authorizeWorkflowByWorkspacePermission } from '@sim/platform-authz/workflow'
 import { toError } from '@sim/utils/errors'
-import { and, desc, eq } from 'drizzle-orm'
+import { and, desc, eq, isNull } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { getLatestRunForStream } from '@/lib/copilot/async-runs/repository'
 import { buildEffectiveChatTranscript } from '@/lib/copilot/chat/effective-transcript'
@@ -189,7 +189,13 @@ export async function GET(req: NextRequest) {
         updatedAt: copilotChats.updatedAt,
       })
       .from(copilotChats)
-      .where(and(eq(copilotChats.userId, authenticatedUserId), scopeFilter))
+      .where(
+        and(
+          eq(copilotChats.userId, authenticatedUserId),
+          isNull(copilotChats.deletedAt),
+          scopeFilter
+        )
+      )
       .orderBy(desc(copilotChats.updatedAt))
 
     const scope = workflowId ? `workflow ${workflowId}` : `workspace ${workspaceId}`
diff --git a/apps/sim/app/api/copilot/chat/resources/route.ts b/apps/sim/app/api/copilot/chat/resources/route.ts
index 823b9a94aba..c4e3c0f350b 100644
--- a/apps/sim/app/api/copilot/chat/resources/route.ts
+++ b/apps/sim/app/api/copilot/chat/resources/route.ts
@@ -1,7 +1,7 @@
 import { db } from '@sim/db'
 import { copilotChats } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { and, eq, sql } from 'drizzle-orm'
+import { and, eq, isNull, sql } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import {
   addCopilotChatResourceContract,
@@ -64,7 +64,13 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
     const [chat] = await db
       .select({ resources: copilotChats.resources })
       .from(copilotChats)
-      .where(and(eq(copilotChats.id, chatId), eq(copilotChats.userId, userId)))
+      .where(
+        and(
+          eq(copilotChats.id, chatId),
+          eq(copilotChats.userId, userId),
+          isNull(copilotChats.deletedAt)
+        )
+      )
       .limit(1)
 
     if (!chat) {
@@ -91,7 +97,13 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
     await db
       .update(copilotChats)
       .set({ resources: sql`${JSON.stringify(merged)}::jsonb`, updatedAt: new Date() })
-      .where(and(eq(copilotChats.id, chatId), eq(copilotChats.userId, userId)))
+      .where(
+        and(
+          eq(copilotChats.id, chatId),
+          eq(copilotChats.userId, userId),
+          isNull(copilotChats.deletedAt)
+        )
+      )
 
     logger.info('Added resource to chat', { chatId, resource })
 
@@ -124,7 +136,13 @@ export const PATCH = withRouteHandler(async (req: NextRequest) => {
     const [chat] = await db
       .select({ resources: copilotChats.resources })
       .from(copilotChats)
-      .where(and(eq(copilotChats.id, chatId), eq(copilotChats.userId, userId)))
+      .where(
+        and(
+          eq(copilotChats.id, chatId),
+          eq(copilotChats.userId, userId),
+          isNull(copilotChats.deletedAt)
+        )
+      )
       .limit(1)
 
     if (!chat) {
@@ -142,7 +160,13 @@ export const PATCH = withRouteHandler(async (req: NextRequest) => {
     await db
       .update(copilotChats)
       .set({ resources: sql`${JSON.stringify(newOrder)}::jsonb`, updatedAt: new Date() })
-      .where(and(eq(copilotChats.id, chatId), eq(copilotChats.userId, userId)))
+      .where(
+        and(
+          eq(copilotChats.id, chatId),
+          eq(copilotChats.userId, userId),
+          isNull(copilotChats.deletedAt)
+        )
+      )
 
     logger.info('Reordered resources for chat', { chatId, count: newOrder.length })
 
@@ -182,7 +206,13 @@ export const DELETE = withRouteHandler(async (req: NextRequest) => {
         ), '[]'::jsonb)`,
         updatedAt: new Date(),
       })
-      .where(and(eq(copilotChats.id, chatId), eq(copilotChats.userId, userId)))
+      .where(
+        and(
+          eq(copilotChats.id, chatId),
+          eq(copilotChats.userId, userId),
+          isNull(copilotChats.deletedAt)
+        )
+      )
       .returning({ resources: copilotChats.resources })
 
     if (!updated) {
diff --git a/apps/sim/app/api/copilot/chat/update-messages/route.test.ts b/apps/sim/app/api/copilot/chat/update-messages/route.test.ts
index 2e7dfa134c8..b6ec71a7a9a 100644
--- a/apps/sim/app/api/copilot/chat/update-messages/route.test.ts
+++ b/apps/sim/app/api/copilot/chat/update-messages/route.test.ts
@@ -46,6 +46,7 @@ vi.mock('@/lib/copilot/chat/messages-store', () => ({
 vi.mock('drizzle-orm', () => ({
   and: vi.fn((...conditions: unknown[]) => ({ conditions, type: 'and' })),
   eq: vi.fn((field: unknown, value: unknown) => ({ field, value, type: 'eq' })),
+  isNull: vi.fn((field: unknown) => ({ field, type: 'isNull' })),
 }))
 
 import { POST } from '@/app/api/copilot/chat/update-messages/route'
diff --git a/apps/sim/app/api/copilot/chats/route.ts b/apps/sim/app/api/copilot/chats/route.ts
index 5f72001816b..f5c01ad73db 100644
--- a/apps/sim/app/api/copilot/chats/route.ts
+++ b/apps/sim/app/api/copilot/chats/route.ts
@@ -62,6 +62,7 @@ export const GET = withRouteHandler(async (_request: NextRequest) => {
       .where(
         and(
           eq(copilotChats.userId, userId),
+          isNull(copilotChats.deletedAt),
           or(
             and(isNull(copilotChats.workflowId), isNull(copilotChats.workspaceId)),
             inAccessibleWorkspace
diff --git a/apps/sim/app/api/cron/cleanup-stale-executions/route.ts b/apps/sim/app/api/cron/cleanup-stale-executions/route.ts
index 47505d2a94c..e58d9a037d4 100644
--- a/apps/sim/app/api/cron/cleanup-stale-executions/route.ts
+++ b/apps/sim/app/api/cron/cleanup-stale-executions/route.ts
@@ -1,8 +1,9 @@
 import { asyncJobs, db } from '@sim/db'
-import { tableJobs, workflowExecutionLogs } from '@sim/db/schema'
+import { tableJobs, workflowDeploymentOperation, workflowExecutionLogs } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { toError } from '@sim/utils/errors'
-import { and, eq, inArray, lt, sql } from 'drizzle-orm'
+import { and, eq, exists, gt, inArray, lt, sql } from 'drizzle-orm'
+import { alias } from 'drizzle-orm/pg-core'
 import { type NextRequest, NextResponse } from 'next/server'
 import { verifyCronAuth } from '@/lib/auth/internal'
 import { JOB_RETENTION_HOURS, JOB_STATUS } from '@/lib/core/async-jobs'
@@ -17,6 +18,14 @@ const STALE_THRESHOLD_MINUTES = Math.ceil(STALE_THRESHOLD_MS / 60000)
 const MAX_INT32 = 2_147_483_647
 /** Terminal table-jobs older than this are pruned; only the latest job per table is ever read. */
 const TABLE_JOB_RETENTION_HOURS = 24
+/**
+ * Terminal deployment operations older than this are pruned. Every reader of
+ * this table is latest-generation-only, and idempotency keys only need to
+ * survive a client retry window, so 30 days is generous.
+ */
+const DEPLOYMENT_OPERATION_RETENTION_DAYS = 30
+const DEPLOYMENT_OPERATION_PRUNE_BATCH_SIZE = 2000
+const DEPLOYMENT_OPERATION_PRUNE_MAX_BATCHES = 10
 
 export const GET = withRouteHandler(async (request: NextRequest) => {
   try {
@@ -221,6 +230,64 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
       })
     }
 
+    /**
+     * Prune terminal deployment operations past retention. HARD INVARIANT:
+     * the newest-generation row per workflow must always survive — the next
+     * deploy computes `generation = MAX(generation) + 1`, and the webhook
+     * registration store fences rows with lt/gt comparisons against stored
+     * generations, so generation reuse after a full wipe would permanently
+     * wedge that workflow's deployments. The `exists(newer)` predicate
+     * guarantees the max-generation row is never eligible; the status filter
+     * keeps in-flight rows (an outbox worker may still hold their fence).
+     */
+    let deploymentOperationsPruned = 0
+    try {
+      const deploymentOpRetention = new Date(
+        Date.now() - DEPLOYMENT_OPERATION_RETENTION_DAYS * 24 * 60 * 60 * 1000
+      )
+      const newerOperation = alias(workflowDeploymentOperation, 'newer_operation')
+      for (let batch = 0; batch < DEPLOYMENT_OPERATION_PRUNE_MAX_BATCHES; batch++) {
+        const prunable = db
+          .select({ id: workflowDeploymentOperation.id })
+          .from(workflowDeploymentOperation)
+          .where(
+            and(
+              inArray(workflowDeploymentOperation.status, ['active', 'failed', 'superseded']),
+              lt(workflowDeploymentOperation.completedAt, deploymentOpRetention),
+              exists(
+                db
+                  .select({ id: newerOperation.id })
+                  .from(newerOperation)
+                  .where(
+                    and(
+                      eq(newerOperation.workflowId, workflowDeploymentOperation.workflowId),
+                      gt(newerOperation.generation, workflowDeploymentOperation.generation)
+                    )
+                  )
+              )
+            )
+          )
+          .limit(DEPLOYMENT_OPERATION_PRUNE_BATCH_SIZE)
+
+        const deleted = await db
+          .delete(workflowDeploymentOperation)
+          .where(inArray(workflowDeploymentOperation.id, prunable))
+          .returning({ id: workflowDeploymentOperation.id })
+
+        deploymentOperationsPruned += deleted.length
+        if (deleted.length < DEPLOYMENT_OPERATION_PRUNE_BATCH_SIZE) break
+      }
+      if (deploymentOperationsPruned > 0) {
+        logger.info(
+          `Pruned ${deploymentOperationsPruned} old deployment operations (retention: ${DEPLOYMENT_OPERATION_RETENTION_DAYS}d)`
+        )
+      }
+    } catch (error) {
+      logger.error('Failed to prune old deployment operations:', {
+        error: toError(error).message,
+      })
+    }
+
     return NextResponse.json({
       success: true,
       executions: {
@@ -239,6 +306,10 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
       tableJobs: {
         staleMarkedFailed: staleTableJobsMarkedFailed,
       },
+      deploymentOperations: {
+        pruned: deploymentOperationsPruned,
+        retentionDays: DEPLOYMENT_OPERATION_RETENTION_DAYS,
+      },
     })
   } catch (error) {
     logger.error('Error in stale execution cleanup job:', error)
diff --git a/apps/sim/app/api/mcp/oauth/callback/route.ts b/apps/sim/app/api/mcp/oauth/callback/route.ts
index e6d5b73186c..7694f23b010 100644
--- a/apps/sim/app/api/mcp/oauth/callback/route.ts
+++ b/apps/sim/app/api/mcp/oauth/callback/route.ts
@@ -25,6 +25,46 @@ const logger = createLogger('McpOauthCallbackAPI')
 
 export const dynamic = 'force-dynamic'
 
+class OauthCallbackStepTimeout extends Error {
+  constructor(step: string, ms: number) {
+    super(`MCP OAuth callback step "${step}" did not settle within ${ms}ms`)
+    this.name = 'OauthCallbackStepTimeout'
+  }
+}
+
+/**
+ * Times and bounds one awaited step of the callback so a stalled operation
+ * surfaces as a labeled, logged error instead of hanging the request forever.
+ * The losing promise is not cancelled (a wedged DB/socket op can't be), so it
+ * settles in the background with its rejection swallowed; the point is that the
+ * request stops waiting on it and the logs name the exact step that stalled.
+ */
+async function timedStep<T>(step: string, ms: number, fn: () => Promise<T>): Promise<T> {
+  const start = Date.now()
+  logger.info(`OAuth callback step start: ${step}`)
+  const work = Promise.resolve(fn())
+  work.catch(() => {})
+  let timer: ReturnType<typeof setTimeout> | undefined
+  try {
+    const value = await Promise.race([
+      work,
+      new Promise<never>((_, reject) => {
+        timer = setTimeout(() => reject(new OauthCallbackStepTimeout(step, ms)), ms)
+        timer.unref?.()
+      }),
+    ])
+    logger.info(`OAuth callback step done: ${step} (${Date.now() - start}ms)`)
+    return value
+  } catch (error) {
+    logger.error(`OAuth callback step failed: ${step} (${Date.now() - start}ms)`, {
+      error: toError(error).message,
+    })
+    throw error
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
 function escapeHtml(value: string): string {
   return value
     .replace(/&/g, '&amp;')
@@ -145,8 +185,9 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
         serverId
       )
     }
+    const serverUrl = server.url
     try {
-      assertSafeOauthServerUrl(server.url)
+      assertSafeOauthServerUrl(serverUrl)
     } catch {
       return respond(
         'MCP OAuth requires https (or http://localhost for development).',
@@ -157,16 +198,22 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
     }
 
     // Burn state before token exchange so a replayed callback cannot reuse it.
-    await clearState(row.id, 'callback:burn-before-exchange')
+    await timedStep('clearState(burn)', 10_000, () =>
+      clearState(row.id, 'callback:burn-before-exchange')
+    )
 
-    const preregistered = await loadPreregisteredClient(server.id)
+    const preregistered = await timedStep('loadPreregisteredClient', 15_000, () =>
+      loadPreregisteredClient(server.id)
+    )
     const provider = new SimMcpOauthProvider({ row, preregistered })
     let result: Awaited<ReturnType<typeof mcpAuthGuarded>>
     try {
-      result = await mcpAuthGuarded(provider, {
-        serverUrl: server.url,
-        authorizationCode: code,
-      })
+      result = await timedStep('mcpAuthGuarded', 120_000, () =>
+        mcpAuthGuarded(provider, {
+          serverUrl,
+          authorizationCode: code,
+        })
+      )
     } catch (e) {
       logger.error('Token exchange failed during MCP OAuth callback', e)
       return respond(
@@ -176,7 +223,11 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
         server.id
       )
     } finally {
-      await clearVerifier(row.id)
+      await timedStep('clearVerifier', 10_000, () => clearVerifier(row.id)).catch((e) =>
+        logger.error('Failed to clear PKCE verifier after MCP OAuth callback', {
+          error: toError(e).message,
+        })
+      )
     }
 
     if (result !== 'AUTHORIZED') {
@@ -185,7 +236,9 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
 
     try {
       // forceRefresh: skip any stale cache from before re-auth.
-      await mcpService.discoverServerTools(session.user.id, server.id, server.workspaceId, true)
+      await timedStep('discoverServerTools', 60_000, () =>
+        mcpService.discoverServerTools(session.user.id, server.id, server.workspaceId, true)
+      )
     } catch (e) {
       logger.warn('Post-auth tools refresh failed', toError(e).message)
     }
diff --git a/apps/sim/app/api/mothership/chats/[chatId]/fork/route.test.ts b/apps/sim/app/api/mothership/chats/[chatId]/fork/route.test.ts
index 15860b3e6e0..a3c42f0f07e 100644
--- a/apps/sim/app/api/mothership/chats/[chatId]/fork/route.test.ts
+++ b/apps/sim/app/api/mothership/chats/[chatId]/fork/route.test.ts
@@ -70,6 +70,7 @@ vi.mock('@sim/db/schema', () => ({
     previewYaml: 'copilotChats.previewYaml',
     planArtifact: 'copilotChats.planArtifact',
     config: 'copilotChats.config',
+    deletedAt: 'copilotChats.deletedAt',
   },
   workspaceFiles: {
     id: 'workspaceFiles.id',
@@ -77,8 +78,10 @@ vi.mock('@sim/db/schema', () => ({
 }))
 
 vi.mock('drizzle-orm', () => ({
+  and: vi.fn((...conditions: unknown[]) => ({ type: 'and', conditions })),
   eq: vi.fn((field: unknown, value: unknown) => ({ type: 'eq', field, value })),
   inArray: vi.fn((field: unknown, values: unknown) => ({ type: 'inArray', field, values })),
+  isNull: vi.fn((field: unknown) => ({ type: 'isNull', field })),
 }))
 
 vi.mock('@/lib/copilot/resources/persistence', () => ({
diff --git a/apps/sim/app/api/mothership/chats/[chatId]/fork/route.ts b/apps/sim/app/api/mothership/chats/[chatId]/fork/route.ts
index 9f8011bd264..ed88eed525e 100644
--- a/apps/sim/app/api/mothership/chats/[chatId]/fork/route.ts
+++ b/apps/sim/app/api/mothership/chats/[chatId]/fork/route.ts
@@ -2,7 +2,7 @@ import { db } from '@sim/db'
 import { copilotChats, workspaceFiles } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { generateId } from '@sim/utils/id'
-import { eq, inArray } from 'drizzle-orm'
+import { and, eq, inArray, isNull } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { forkMothershipChatContract } from '@/lib/api/contracts/mothership-chats'
 import { parseRequest } from '@/lib/api/server'
@@ -84,7 +84,7 @@ export const POST = withRouteHandler(
           config: copilotChats.config,
         })
         .from(copilotChats)
-        .where(eq(copilotChats.id, chatId))
+        .where(and(eq(copilotChats.id, chatId), isNull(copilotChats.deletedAt)))
         .limit(1)
 
       if (!parent || parent.userId !== userId || parent.type !== 'mothership') {
diff --git a/apps/sim/app/api/mothership/chats/[chatId]/restore/route.test.ts b/apps/sim/app/api/mothership/chats/[chatId]/restore/route.test.ts
new file mode 100644
index 00000000000..31d49d8a653
--- /dev/null
+++ b/apps/sim/app/api/mothership/chats/[chatId]/restore/route.test.ts
@@ -0,0 +1,163 @@
+/**
+ * @vitest-environment node
+ */
+import { copilotHttpMock, copilotHttpMockFns } from '@sim/testing'
+import { NextRequest } from 'next/server'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const {
+  mockDbSelect,
+  mockSelectFrom,
+  mockSelectWhere,
+  mockSelectLimit,
+  mockDbUpdate,
+  mockDbSet,
+  mockUpdateWhere,
+  mockDbReturning,
+  mockAssertActiveWorkspaceAccess,
+  mockPublishStatusChanged,
+} = vi.hoisted(() => ({
+  mockDbSelect: vi.fn(),
+  mockSelectFrom: vi.fn(),
+  mockSelectWhere: vi.fn(),
+  mockSelectLimit: vi.fn(),
+  mockDbUpdate: vi.fn(),
+  mockDbSet: vi.fn(),
+  mockUpdateWhere: vi.fn(),
+  mockDbReturning: vi.fn(),
+  mockAssertActiveWorkspaceAccess: vi.fn(),
+  mockPublishStatusChanged: vi.fn(),
+}))
+
+vi.mock('@sim/db', () => ({
+  db: {
+    select: mockDbSelect,
+    update: mockDbUpdate,
+  },
+}))
+
+vi.mock('@sim/db/schema', () => ({
+  copilotChats: {
+    id: 'copilotChats.id',
+    userId: 'copilotChats.userId',
+    type: 'copilotChats.type',
+    workspaceId: 'copilotChats.workspaceId',
+    updatedAt: 'copilotChats.updatedAt',
+    lastSeenAt: 'copilotChats.lastSeenAt',
+    deletedAt: 'copilotChats.deletedAt',
+  },
+}))
+
+vi.mock('drizzle-orm', () => ({
+  and: vi.fn((...conditions: unknown[]) => ({ type: 'and', conditions })),
+  eq: vi.fn((field: unknown, value: unknown) => ({ type: 'eq', field, value })),
+  isNotNull: vi.fn((field: unknown) => ({ type: 'isNotNull', field })),
+}))
+
+vi.mock('@/lib/copilot/request/http', () => ({
+  ...copilotHttpMock,
+  createForbiddenResponse: vi.fn((message: string) => ({
+    status: 403,
+    ok: false,
+    json: async () => ({ error: message }),
+  })),
+}))
+
+vi.mock('@/lib/workspaces/permissions/utils', () => ({
+  assertActiveWorkspaceAccess: mockAssertActiveWorkspaceAccess,
+  isWorkspaceAccessDeniedError: (error: unknown) =>
+    error instanceof Error && error.message === 'ACCESS_DENIED',
+}))
+
+vi.mock('@/lib/copilot/chat-status', () => ({
+  chatPubSub: { publishStatusChanged: mockPublishStatusChanged },
+}))
+
+vi.mock('@/lib/posthog/server', () => ({
+  captureServerEvent: vi.fn(),
+}))
+
+import { POST } from '@/app/api/mothership/chats/[chatId]/restore/route'
+
+function makeRequest(chatId: string) {
+  return new NextRequest(`http://localhost:3000/api/mothership/chats/${chatId}/restore`, {
+    method: 'POST',
+  })
+}
+
+function makeContext(chatId: string) {
+  return { params: Promise.resolve({ chatId }) }
+}
+
+describe('POST /api/mothership/chats/[chatId]/restore', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    copilotHttpMockFns.mockAuthenticateCopilotRequestSessionOnly.mockResolvedValue({
+      userId: 'user-1',
+      isAuthenticated: true,
+    })
+    mockSelectLimit.mockResolvedValue([{ workspaceId: 'workspace-1' }])
+    mockSelectWhere.mockReturnValue({ limit: mockSelectLimit })
+    mockSelectFrom.mockReturnValue({ where: mockSelectWhere })
+    mockDbSelect.mockReturnValue({ from: mockSelectFrom })
+    mockDbReturning.mockResolvedValue([{ workspaceId: 'workspace-1' }])
+    mockUpdateWhere.mockReturnValue({ returning: mockDbReturning })
+    mockDbSet.mockReturnValue({ where: mockUpdateWhere })
+    mockDbUpdate.mockReturnValue({ set: mockDbSet })
+    mockAssertActiveWorkspaceAccess.mockResolvedValue(undefined)
+  })
+
+  it('returns 401 when unauthenticated', async () => {
+    copilotHttpMockFns.mockAuthenticateCopilotRequestSessionOnly.mockResolvedValueOnce({
+      userId: null,
+      isAuthenticated: false,
+    })
+
+    const response = await POST(makeRequest('chat-1'), makeContext('chat-1'))
+    expect(response.status).toBe(401)
+    expect(mockDbUpdate).not.toHaveBeenCalled()
+  })
+
+  it('returns 404 when no soft-deleted chat is owned by the caller', async () => {
+    mockSelectLimit.mockResolvedValueOnce([])
+
+    const response = await POST(makeRequest('chat-missing'), makeContext('chat-missing'))
+    expect(response.status).toBe(404)
+    expect(mockAssertActiveWorkspaceAccess).not.toHaveBeenCalled()
+    expect(mockDbUpdate).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 when the caller lost access to the workspace', async () => {
+    mockAssertActiveWorkspaceAccess.mockRejectedValueOnce(new Error('ACCESS_DENIED'))
+
+    const response = await POST(makeRequest('chat-1'), makeContext('chat-1'))
+    expect(response.status).toBe(403)
+    expect(mockDbUpdate).not.toHaveBeenCalled()
+  })
+
+  it('restores the chat, bumping updatedAt and lastSeenAt, and publishes the event', async () => {
+    const response = await POST(makeRequest('chat-1'), makeContext('chat-1'))
+
+    expect(response.status).toBe(200)
+    expect(await response.json()).toEqual({ success: true })
+    expect(mockAssertActiveWorkspaceAccess).toHaveBeenCalledWith('workspace-1', 'user-1')
+    expect(mockDbSet).toHaveBeenCalledWith({
+      deletedAt: null,
+      updatedAt: expect.any(Date),
+      lastSeenAt: expect.any(Date),
+    })
+    expect(mockPublishStatusChanged).toHaveBeenCalledWith({
+      workspaceId: 'workspace-1',
+      chatId: 'chat-1',
+      type: 'created',
+    })
+  })
+
+  it('returns 404 when the chat is restored concurrently before the update lands', async () => {
+    mockDbReturning.mockResolvedValueOnce([])
+
+    const response = await POST(makeRequest('chat-1'), makeContext('chat-1'))
+    expect(response.status).toBe(404)
+    expect(mockPublishStatusChanged).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/sim/app/api/mothership/chats/[chatId]/restore/route.ts b/apps/sim/app/api/mothership/chats/[chatId]/restore/route.ts
new file mode 100644
index 00000000000..b59bcceac05
--- /dev/null
+++ b/apps/sim/app/api/mothership/chats/[chatId]/restore/route.ts
@@ -0,0 +1,110 @@
+import { db } from '@sim/db'
+import { copilotChats } from '@sim/db/schema'
+import { createLogger } from '@sim/logger'
+import { and, eq, isNotNull } from 'drizzle-orm'
+import { type NextRequest, NextResponse } from 'next/server'
+import { restoreMothershipChatContract } from '@/lib/api/contracts/mothership-chats'
+import { parseRequest } from '@/lib/api/server'
+import { chatPubSub } from '@/lib/copilot/chat-status'
+import {
+  authenticateCopilotRequestSessionOnly,
+  createForbiddenResponse,
+  createInternalServerErrorResponse,
+  createUnauthorizedResponse,
+} from '@/lib/copilot/request/http'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { captureServerEvent } from '@/lib/posthog/server'
+import {
+  assertActiveWorkspaceAccess,
+  isWorkspaceAccessDeniedError,
+} from '@/lib/workspaces/permissions/utils'
+
+const logger = createLogger('RestoreMothershipChatAPI')
+
+/**
+ * POST /api/mothership/chats/[chatId]/restore
+ * Restores a soft-deleted mothership chat back into the sidebar. Ownership is
+ * enforced by scoping the update to the authenticated user's rows, and the
+ * caller must still have access to the chat's workspace, matching the delete
+ * path.
+ */
+export const POST = withRouteHandler(
+  async (request: NextRequest, context: { params: Promise<{ chatId: string }> }) => {
+    try {
+      const { userId, isAuthenticated } = await authenticateCopilotRequestSessionOnly()
+      if (!isAuthenticated || !userId) {
+        return createUnauthorizedResponse()
+      }
+
+      const parsed = await parseRequest(restoreMothershipChatContract, request, context)
+      if (!parsed.success) return parsed.response
+      const { chatId } = parsed.data.params
+
+      const [chat] = await db
+        .select({ workspaceId: copilotChats.workspaceId })
+        .from(copilotChats)
+        .where(
+          and(
+            eq(copilotChats.id, chatId),
+            eq(copilotChats.userId, userId),
+            eq(copilotChats.type, 'mothership'),
+            isNotNull(copilotChats.deletedAt)
+          )
+        )
+        .limit(1)
+
+      if (!chat) {
+        return NextResponse.json({ success: false, error: 'Chat not found' }, { status: 404 })
+      }
+      if (chat.workspaceId) {
+        await assertActiveWorkspaceAccess(chat.workspaceId, userId)
+      }
+
+      // Bump `updatedAt` (like workflow/table/KB restores) so the restored chat
+      // surfaces at the top of the sidebar, and mark it seen for the restorer.
+      const now = new Date()
+      const [restoredChat] = await db
+        .update(copilotChats)
+        .set({ deletedAt: null, updatedAt: now, lastSeenAt: now })
+        .where(
+          and(
+            eq(copilotChats.id, chatId),
+            eq(copilotChats.userId, userId),
+            eq(copilotChats.type, 'mothership'),
+            isNotNull(copilotChats.deletedAt)
+          )
+        )
+        .returning({
+          workspaceId: copilotChats.workspaceId,
+        })
+
+      if (!restoredChat) {
+        return NextResponse.json({ success: false, error: 'Chat not found' }, { status: 404 })
+      }
+
+      if (restoredChat.workspaceId) {
+        chatPubSub?.publishStatusChanged({
+          workspaceId: restoredChat.workspaceId,
+          chatId,
+          type: 'created',
+        })
+        captureServerEvent(
+          userId,
+          'task_restored',
+          { workspace_id: restoredChat.workspaceId },
+          {
+            groups: { workspace: restoredChat.workspaceId },
+          }
+        )
+      }
+
+      return NextResponse.json({ success: true })
+    } catch (error) {
+      if (isWorkspaceAccessDeniedError(error)) {
+        return createForbiddenResponse('Workspace access denied')
+      }
+      logger.error('Error restoring mothership chat:', error)
+      return createInternalServerErrorResponse('Failed to restore chat')
+    }
+  }
+)
diff --git a/apps/sim/app/api/mothership/chats/[chatId]/route.test.ts b/apps/sim/app/api/mothership/chats/[chatId]/route.test.ts
index 0879cf10aa6..095c5a11cc5 100644
--- a/apps/sim/app/api/mothership/chats/[chatId]/route.test.ts
+++ b/apps/sim/app/api/mothership/chats/[chatId]/route.test.ts
@@ -6,7 +6,8 @@ import { NextRequest } from 'next/server'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const {
-  mockDbDelete,
+  mockDbUpdate,
+  mockDbSet,
   mockDbReturning,
   mockDbWhere,
   mockDecrementStorageUsageForBillingContext,
@@ -17,7 +18,8 @@ const {
   mockReadFilePreviewSessions,
   mockGetLatestRunForStream,
 } = vi.hoisted(() => ({
-  mockDbDelete: vi.fn(),
+  mockDbUpdate: vi.fn(),
+  mockDbSet: vi.fn(),
   mockDbReturning: vi.fn(),
   mockDbWhere: vi.fn(),
   mockDecrementStorageUsageForBillingContext: vi.fn(),
@@ -31,7 +33,7 @@ const {
 
 vi.mock('@sim/db', () => ({
   db: {
-    delete: mockDbDelete,
+    update: mockDbUpdate,
   },
 }))
 
@@ -43,12 +45,14 @@ vi.mock('@sim/db/schema', () => ({
     updatedAt: 'copilotChats.updatedAt',
     lastSeenAt: 'copilotChats.lastSeenAt',
     workspaceId: 'copilotChats.workspaceId',
+    deletedAt: 'copilotChats.deletedAt',
   },
 }))
 
 vi.mock('drizzle-orm', () => ({
   and: vi.fn((...conditions: unknown[]) => ({ type: 'and', conditions })),
   eq: vi.fn((field: unknown, value: unknown) => ({ type: 'eq', field, value })),
+  isNull: vi.fn((field: unknown) => ({ type: 'isNull', field })),
   sql: Object.assign(
     vi.fn((strings: TemplateStringsArray, ...values: unknown[]) => ({
       type: 'sql',
@@ -319,12 +323,13 @@ describe('DELETE /api/mothership/chats/[chatId]', () => {
       type: 'mothership',
       workspaceId: 'workspace-1',
     })
-    mockDbDelete.mockReturnValue({ where: mockDbWhere })
+    mockDbUpdate.mockReturnValue({ set: mockDbSet })
+    mockDbSet.mockReturnValue({ where: mockDbWhere })
     mockDbWhere.mockReturnValue({ returning: mockDbReturning })
     mockDbReturning.mockResolvedValue([{ workspaceId: 'workspace-1' }])
   })
 
-  it('deletes an unbilled chat without decrementing workspace or payer storage', async () => {
+  it('soft-deletes an unbilled chat without decrementing workspace or payer storage', async () => {
     const response = await DELETE(
       new NextRequest('http://localhost:3000/api/mothership/chats/chat-delete', {
         method: 'DELETE',
@@ -333,7 +338,8 @@ describe('DELETE /api/mothership/chats/[chatId]', () => {
     )
 
     expect(response.status).toBe(200)
-    expect(mockDbDelete).toHaveBeenCalled()
+    expect(mockDbUpdate).toHaveBeenCalled()
+    expect(mockDbSet).toHaveBeenCalledWith({ deletedAt: expect.any(Date) })
     expect(mockDecrementStorageUsageForBillingContext).not.toHaveBeenCalled()
     expect(mockDecrementStorageUsageForBillingContextInTx).not.toHaveBeenCalled()
   })
diff --git a/apps/sim/app/api/mothership/chats/[chatId]/route.ts b/apps/sim/app/api/mothership/chats/[chatId]/route.ts
index 99176cd6b23..9fa07c1e067 100644
--- a/apps/sim/app/api/mothership/chats/[chatId]/route.ts
+++ b/apps/sim/app/api/mothership/chats/[chatId]/route.ts
@@ -2,7 +2,7 @@ import { db } from '@sim/db'
 import { copilotChats } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { toError } from '@sim/utils/errors'
-import { and, eq, sql } from 'drizzle-orm'
+import { and, eq, isNull, sql } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import {
   deleteMothershipChatContract,
@@ -188,7 +188,8 @@ export const PATCH = withRouteHandler(
           and(
             eq(copilotChats.id, chatId),
             eq(copilotChats.userId, userId),
-            eq(copilotChats.type, 'mothership')
+            eq(copilotChats.type, 'mothership'),
+            isNull(copilotChats.deletedAt)
           )
         )
         .returning({
@@ -264,12 +265,14 @@ export const DELETE = withRouteHandler(
       }
 
       const [deletedChat] = await db
-        .delete(copilotChats)
+        .update(copilotChats)
+        .set({ deletedAt: new Date() })
         .where(
           and(
             eq(copilotChats.id, chatId),
             eq(copilotChats.userId, userId),
-            eq(copilotChats.type, 'mothership')
+            eq(copilotChats.type, 'mothership'),
+            isNull(copilotChats.deletedAt)
           )
         )
         .returning({
diff --git a/apps/sim/app/api/mothership/chats/route.test.ts b/apps/sim/app/api/mothership/chats/route.test.ts
index f23d33034ea..890e228a0b5 100644
--- a/apps/sim/app/api/mothership/chats/route.test.ts
+++ b/apps/sim/app/api/mothership/chats/route.test.ts
@@ -31,6 +31,8 @@ vi.mock('@sim/db/schema', () => ({
     updatedAt: 'copilotChats.updatedAt',
     conversationId: 'copilotChats.conversationId',
     lastSeenAt: 'copilotChats.lastSeenAt',
+    pinned: 'copilotChats.pinned',
+    deletedAt: 'copilotChats.deletedAt',
   },
 }))
 
@@ -38,6 +40,8 @@ vi.mock('drizzle-orm', () => ({
   and: vi.fn((...conditions: unknown[]) => ({ type: 'and', conditions })),
   desc: vi.fn((field: unknown) => ({ type: 'desc', field })),
   eq: vi.fn((field: unknown, value: unknown) => ({ type: 'eq', field, value })),
+  isNull: vi.fn((field: unknown) => ({ type: 'isNull', field })),
+  isNotNull: vi.fn((field: unknown) => ({ type: 'isNotNull', field })),
 }))
 
 vi.mock('@/lib/copilot/request/http', () => copilotHttpMock)
diff --git a/apps/sim/app/api/mothership/chats/route.ts b/apps/sim/app/api/mothership/chats/route.ts
index 764b897eac3..8a9a60ef0fa 100644
--- a/apps/sim/app/api/mothership/chats/route.ts
+++ b/apps/sim/app/api/mothership/chats/route.ts
@@ -37,11 +37,11 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
 
     const queryResult = await parseRequest(listMothershipChatsContract, request, {})
     if (!queryResult.success) return queryResult.response
-    const { workspaceId } = queryResult.data.query
+    const { workspaceId, scope } = queryResult.data.query
 
     await assertActiveWorkspaceAccess(workspaceId, userId)
 
-    const data = await listMothershipChats(userId, workspaceId)
+    const data = await listMothershipChats(userId, workspaceId, scope)
 
     return NextResponse.json({ success: true, data })
   } catch (error) {
diff --git a/apps/sim/app/api/tools/onepassword/utils.test.ts b/apps/sim/app/api/tools/onepassword/utils.test.ts
index 4c07ede1323..8d9e9a76672 100644
--- a/apps/sim/app/api/tools/onepassword/utils.test.ts
+++ b/apps/sim/app/api/tools/onepassword/utils.test.ts
@@ -54,18 +54,35 @@ describe('validateConnectServerUrl', () => {
     })
 
     it('blocks a hostname that resolves to a private IP', async () => {
-      mockDnsLookup.mockResolvedValue({ address: '10.1.2.3', family: 4 })
+      mockDnsLookup.mockResolvedValue([{ address: '10.1.2.3', family: 4 }])
       await expect(validateConnectServerUrl('https://connect.internal')).rejects.toThrow(
         'cannot point to a private or reserved IP address'
       )
     })
 
     it('allows a hostname that resolves to a public IP', async () => {
-      mockDnsLookup.mockResolvedValue({ address: '93.184.216.34', family: 4 })
+      mockDnsLookup.mockResolvedValue([{ address: '93.184.216.34', family: 4 }])
       await expect(validateConnectServerUrl('https://connect.example.com')).resolves.toBe(
         '93.184.216.34'
       )
     })
+
+    it('prefers the IPv4 address for a dual-stack host (avoids unreachable IPv6 pin)', async () => {
+      mockDnsLookup.mockResolvedValue([
+        { address: '2606:4700::6810:85e5', family: 6 },
+        { address: '93.184.216.34', family: 4 },
+      ])
+      await expect(validateConnectServerUrl('https://connect.example.com')).resolves.toBe(
+        '93.184.216.34'
+      )
+    })
+
+    it('pins the sole IPv6 address for an IPv6-only host', async () => {
+      mockDnsLookup.mockResolvedValue([{ address: '2606:4700::6810:85e5', family: 6 }])
+      await expect(validateConnectServerUrl('https://connect.example.com')).resolves.toBe(
+        '2606:4700::6810:85e5'
+      )
+    })
   })
 
   describe('self-hosted deployment', () => {
@@ -94,7 +111,7 @@ describe('validateConnectServerUrl', () => {
     })
 
     it('allows a hostname that resolves to a private IP', async () => {
-      mockDnsLookup.mockResolvedValue({ address: '10.1.2.3', family: 4 })
+      mockDnsLookup.mockResolvedValue([{ address: '10.1.2.3', family: 4 }])
       await expect(validateConnectServerUrl('https://connect.internal')).resolves.toBe('10.1.2.3')
     })
   })
diff --git a/apps/sim/app/api/tools/onepassword/utils.ts b/apps/sim/app/api/tools/onepassword/utils.ts
index b78cf0d511c..0ecdd9abe50 100644
--- a/apps/sim/app/api/tools/onepassword/utils.ts
+++ b/apps/sim/app/api/tools/onepassword/utils.ts
@@ -317,7 +317,10 @@ export async function validateConnectServerUrl(serverUrl: string): Promise<strin
 
   let address: string
   try {
-    ;({ address } = await dns.lookup(clean, { verbatim: true }))
+    // Prefer IPv4: pinning strips Happy Eyeballs' fallback, and a pinned IPv6 address hangs
+    // on IPv4-only egress (e.g. AWS NAT gateways).
+    const resolved = await dns.lookup(clean, { all: true, verbatim: true })
+    address = (resolved.find((entry) => entry.family === 4) ?? resolved[0]).address
   } catch (error) {
     connectLogger.warn('DNS lookup failed for 1Password Connect server URL', {
       hostname: clean,
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/chat-content/chat-content.tsx b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/chat-content/chat-content.tsx
index 971732b747c..abedf727bf4 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/chat-content/chat-content.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/chat-content/chat-content.tsx
@@ -17,7 +17,6 @@ import { extractTextContent } from '@/lib/core/utils/react-node-text'
 import { ContextMentionIcon } from '@/app/workspace/[workspaceId]/home/components/context-mention-icon'
 import {
   type ContentSegment,
-  PendingTagIndicator,
   parseSpecialTags,
   SpecialTags,
 } from '@/app/workspace/[workspaceId]/home/components/message-content/components/special-tags'
@@ -396,8 +395,13 @@ interface ChatContentProps {
   onQuestionDismiss?: () => void
   onWorkspaceResourceSelect?: (resource: MothershipResource) => void
   onRevealStateChange?: (isRevealing: boolean) => void
-  /** Reports whether this segment is actively painting text or its own pending-tag indicator. */
+  /** Reports whether this segment is actively painting text. */
   onStreamActivityChange?: (active: boolean) => void
+  /**
+   * Reports whether a special tag is mid-stream — bytes arriving but rendering
+   * nothing (tags are suppressed until complete). A wait from the user's POV.
+   */
+  onPendingTagChange?: (pending: boolean) => void
 }
 
 function ChatContentInner({
@@ -409,6 +413,7 @@ function ChatContentInner({
   onWorkspaceResourceSelect,
   onRevealStateChange,
   onStreamActivityChange,
+  onPendingTagChange,
 }: ChatContentProps) {
   const onWorkspaceResourceSelectRef = useRef(onWorkspaceResourceSelect)
   onWorkspaceResourceSelectRef.current = onWorkspaceResourceSelect
@@ -530,12 +535,17 @@ function ChatContentInner({
     () => parseSpecialTags(streamedContent, isRevealing),
     [streamedContent, isRevealing]
   )
-  const hasPendingIndicator = parsed.hasPendingTag && isRevealing
 
   useEffect(() => {
-    onStreamActivityChange?.(hasRevealBacklog || hasPendingIndicator)
+    onStreamActivityChange?.(hasRevealBacklog)
     return () => onStreamActivityChange?.(false)
-  }, [hasPendingIndicator, hasRevealBacklog, onStreamActivityChange])
+  }, [hasRevealBacklog, onStreamActivityChange])
+
+  const hasPendingTag = parsed.hasPendingTag && isRevealing
+  useEffect(() => {
+    onPendingTagChange?.(hasPendingTag)
+    return () => onPendingTagChange?.(false)
+  }, [hasPendingTag, onPendingTagChange])
 
   type BlockSegment = Exclude<
     ContentSegment,
@@ -624,7 +634,6 @@ function ChatContentInner({
           />
         )
       })}
-      {hasPendingIndicator && <PendingTagIndicator />}
     </div>
   )
 }
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/special-tags/special-tags.tsx b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/special-tags/special-tags.tsx
index a566cd3e9c2..f44aab8407f 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/special-tags/special-tags.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/special-tags/special-tags.tsx
@@ -559,13 +559,18 @@ export function SpecialTags({
   }
 }
 
+interface PendingTagIndicatorProps {
+  /** Activity phrase next to the loader; crossfades on change. */
+  label: string
+}
+
 /**
- * Renders a "Thinking" shimmer while a special tag is still streaming in.
+ * Renders the turn-level activity shimmer.
  */
-export function PendingTagIndicator() {
+export function PendingTagIndicator({ label }: PendingTagIndicatorProps) {
   return (
     <div className='animate-stream-fade-in py-2'>
-      <ThinkingLoader size={20} startVariant='corners' label='Thinking…' labelRatio={0.7} />
+      <ThinkingLoader size={20} startVariant='corners' label={label} labelRatio={0.7} />
     </div>
   )
 }
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/message-content.test.ts b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/message-content.test.ts
index 6f87cb1de0a..942ca3c5afe 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/message-content.test.ts
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/message-content.test.ts
@@ -14,8 +14,8 @@ import { modelToContentBlocks } from '@/app/workspace/[workspaceId]/home/hooks/s
 import type { ContentBlock } from '../../types'
 import {
   assistantMessageHasVisibleExecutingTool,
+  deriveThinkingLabel,
   parseBlocks,
-  shouldShowTrailingThinking,
   shouldSmoothTextSegment,
 } from './message-content'
 
@@ -628,62 +628,6 @@ describe('narration text seams', () => {
   })
 })
 
-describe('shouldShowTrailingThinking', () => {
-  it('shows one turn-level indicator while an open subagent waits between completed steps', () => {
-    expect(
-      shouldShowTrailingThinking({
-        isStreaming: true,
-        isStreamIdle: true,
-        isRenderingStream: false,
-        hasExecutingTool: false,
-        lastSegmentType: 'agent_group',
-      })
-    ).toBe(true)
-  })
-
-  it('stays hidden while a chunk is rendering or before the stream becomes idle', () => {
-    expect(
-      shouldShowTrailingThinking({
-        isStreaming: true,
-        isStreamIdle: true,
-        isRenderingStream: true,
-        hasExecutingTool: false,
-        lastSegmentType: 'text',
-      })
-    ).toBe(false)
-    expect(
-      shouldShowTrailingThinking({
-        isStreaming: true,
-        isStreamIdle: false,
-        isRenderingStream: false,
-        hasExecutingTool: false,
-        lastSegmentType: 'agent_group',
-      })
-    ).toBe(false)
-  })
-
-  it('does not duplicate an executing tool row or survive a stopped turn', () => {
-    expect(
-      shouldShowTrailingThinking({
-        isStreaming: true,
-        isStreamIdle: true,
-        isRenderingStream: false,
-        hasExecutingTool: true,
-        lastSegmentType: 'agent_group',
-      })
-    ).toBe(false)
-    expect(
-      shouldShowTrailingThinking({
-        isStreaming: true,
-        isStreamIdle: true,
-        isRenderingStream: false,
-        hasExecutingTool: false,
-        lastSegmentType: 'stopped',
-      })
-    ).toBe(false)
-  })
-})
-
 describe('parseBlocks legacy — thinking between top-level tools', () => {
   it('keeps consecutive mothership tools in one group across intervening thinking', () => {
     const blocks: ContentBlock[] = [
@@ -793,3 +737,27 @@ describe('assistantMessageHasVisibleExecutingTool', () => {
     expect(assistantMessageHasVisibleExecutingTool(blocks)).toBe(false)
   })
 })
+
+describe('deriveThinkingLabel', () => {
+  it('maps the most recent block to an activity phrase', () => {
+    expect(deriveThinkingLabel([])).toBe('Thinking…')
+    expect(deriveThinkingLabel([{ type: 'thinking', content: 'hm', timestamp: 1 }])).toBe(
+      'Thinking…'
+    )
+    // A stall after streamed text is the agent deciding what's next, not generating.
+    expect(deriveThinkingLabel([mainText('hi')])).toBe('Thinking…')
+    expect(deriveThinkingLabel([{ type: 'subagent_text', content: 'x', timestamp: 1 }])).toBe(
+      'Thinking…'
+    )
+    expect(deriveThinkingLabel([{ type: 'subagent_end', spanId: 'S1', timestamp: 1 }])).toBe(
+      'Returning…'
+    )
+  })
+
+  it('shows Dispatching for the dispatch call, then yields to the opened lane', () => {
+    expect(deriveThinkingLabel([mainToolCall('t1', 'workflow')])).toBe('Dispatching…')
+    expect(deriveThinkingLabel([mainToolCall('t1', 'workspace_file')])).toBe('Dispatching…')
+    expect(deriveThinkingLabel([mainToolCall('t1', 'grep')])).toBe('Thinking…')
+    expect(deriveThinkingLabel([subagentStart('workflow', 'S1', 'main')])).toBeNull()
+  })
+})
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/message-content.tsx b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/message-content.tsx
index 9d8f67067f8..2abcec9fad5 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/message-content.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/message-content.tsx
@@ -1,6 +1,16 @@
 'use client'
 
-import { memo, useCallback, useEffect, useLayoutEffect, useMemo, useRef, useState } from 'react'
+import {
+  memo,
+  type ReactNode,
+  useCallback,
+  useEffect,
+  useLayoutEffect,
+  useMemo,
+  useRef,
+  useState,
+} from 'react'
+import { cn } from '@sim/emcn'
 import { Read as ReadTool, WorkspaceFile } from '@/lib/copilot/generated/tool-catalog-v1'
 import { isToolHiddenInUi } from '@/lib/copilot/tools/client/hidden-tools'
 import { resolveToolDisplay } from '@/lib/copilot/tools/client/store-utils'
@@ -18,6 +28,7 @@ import { AgentGroup, ChatContent, CircleStop, Options, PendingTagIndicator } fro
 import { deriveMessagePhase, isToolDone, type MessagePhase } from './utils'
 
 const FILE_SUBAGENT_ID = 'file'
+/** Quiet period before the shimmer takes the slot back from streamed output. */
 const STREAM_IDLE_DELAY_MS = 1_500
 
 interface TextSegment {
@@ -738,47 +749,69 @@ export function shouldSmoothTextSegment({
   return isStreaming && segmentIndex === segmentCount - 1
 }
 
-export function shouldShowTrailingThinking({
-  isStreaming,
-  isStreamIdle,
-  isRenderingStream,
-  hasExecutingTool,
-  lastSegmentType,
-}: {
-  isStreaming: boolean
-  isStreamIdle: boolean
-  isRenderingStream: boolean
-  hasExecutingTool: boolean
-  lastSegmentType?: 'text' | 'agent_group' | 'options' | 'stopped'
-}): boolean {
-  return (
-    isStreaming &&
-    isStreamIdle &&
-    !isRenderingStream &&
-    !hasExecutingTool &&
-    lastSegmentType !== 'stopped'
-  )
+const DISPATCH_TOOL_NAMES = new Set([...SUBAGENT_KEYS, ...Object.values(SUBAGENT_DISPATCH_TOOLS)])
+
+/**
+ * Activity phrase for the turn-level shimmer, derived from the most recent
+ * stream block. The shimmer only shows in quiet gaps (see showShimmer), so the
+ * phrase describes the wait, not the output: a stall after streamed text is
+ * the agent deciding what's next — Thinking — never "Generating" (while text
+ * actually generates the shimmer is hidden). Dispatching covers only the
+ * dispatch call itself (whose tool row the parser absorbs, so nothing else
+ * shows); once the lane is open its own delegating shimmer owns the state and
+ * the turn-level one stays hidden (`null`).
+ */
+export function deriveThinkingLabel(blocks: ContentBlock[]): string | null {
+  const last = blocks[blocks.length - 1]
+  switch (last?.type) {
+    case 'subagent':
+      return null
+    case 'subagent_end':
+      return 'Returning…'
+    case 'tool_call':
+      return last.toolCall && DISPATCH_TOOL_NAMES.has(last.toolCall.name)
+        ? 'Dispatching…'
+        : 'Thinking…'
+    default:
+      return 'Thinking…'
+  }
 }
 
 interface MessageContentProps {
   blocks: ContentBlock[]
   fallbackContent: string
   isStreaming: boolean
+  /**
+   * True for the last message in the transcript. The last turn keeps a
+   * fixed-height thinking slot at its bottom (see JSX) so the shimmer fades in
+   * place without ever changing height.
+   */
+  isLast?: boolean
   /** Transcript-derived answers for this message's question card (renders the recap). */
   questionAnswers?: string[]
   onOptionSelect?: (id: string) => void
   onQuestionDismiss?: () => void
   onPhaseChange?: (phase: MessagePhase) => void
+  /**
+   * The message's actions row (copy/thumbs). Rendered here, in the thinking
+   * slot's position, so at settle the shimmer and the actions trade places in
+   * one render — a single tiny reflow instead of a collapse the buttons ride
+   * or a late mount the chase visibly scrolls to. The caller gates it on
+   * content/question eligibility only; the settle timing is owned here.
+   */
+  actions?: ReactNode
 }
 
 function MessageContentInner({
   blocks,
   fallbackContent,
   isStreaming = false,
+  isLast = false,
   questionAnswers,
   onOptionSelect,
   onQuestionDismiss,
   onPhaseChange,
+  actions,
 }: MessageContentProps) {
   const { onWorkspaceResourceSelect } = useChatSurface()
   const parsed = useMemo(() => (blocks.length > 0 ? parseBlocks(blocks) : []), [blocks])
@@ -791,6 +824,10 @@ function MessageContentInner({
   const handleTrailingStreamActivityChange = useCallback((active: boolean) => {
     setTrailingStreamActivity(active)
   }, [])
+  const [trailingPendingTag, setTrailingPendingTag] = useState(false)
+  const handleTrailingPendingTagChange = useCallback((pending: boolean) => {
+    setTrailingPendingTag(pending)
+  }, [])
   const [isStreamIdle, setIsStreamIdle] = useState(false)
 
   const segments: MessageSegment[] =
@@ -802,8 +839,8 @@ function MessageContentInner({
   const visibleStreamActivityKey = getVisibleStreamActivityKey(segments)
 
   // Every visible stream update restarts the quiet-period clock. A layout
-  // effect clears an already-visible indicator before paint, so a chunk from
-  // any parallel lane hides the one turn-level loader without a stale flash.
+  // effect clears an already-visible shimmer before paint, so a chunk from any
+  // parallel lane yields the slot to the arriving output without a stale flash.
   useLayoutEffect(() => {
     if (!isStreaming) {
       setIsStreamIdle(false)
@@ -826,91 +863,117 @@ function MessageContentInner({
     onPhaseChangeRef.current?.(phase)
   }, [phase])
 
-  if (segments.length === 0) {
-    if (isStreaming) {
-      return (
-        <div className='space-y-[10px]'>
-          <PendingTagIndicator />
-        </div>
-      )
-    }
-    return null
-  }
+  // The slot is the last message's own element, so it grows on send with the
+  // row (no separate mount → no jump). Gated on phase, not isStreaming: the
+  // trailing text keeps visually revealing on a timer after the network stream
+  // closes, and collapsing under a still-growing reveal reads as the blob
+  // winking out early while everything shifts.
+  const thinkingExpanded = phase !== 'settled' && lastSegment?.type !== 'stopped'
 
-  // Executing tools already render an active row. An open subagent lane does
-  // not suppress the turn-level indicator: once its latest visible chunk has
-  // settled, the loader can bridge the wait until that lane (or a parallel
-  // sibling) emits again.
+  if (segments.length === 0 && !isLast) return null
+
+  // A visible executing tool row already spins — the turn-level shimmer would
+  // double it. (A null label means a just-opened lane's shimmer owns the state.)
+  // A mid-stream special tag renders nothing until complete, so its bytes are a
+  // wait, not output — the shimmer bridges it without the quiet-period delay.
+  const thinkingLabel = deriveThinkingLabel(blocks)
   const hasExecutingTool = assistantMessageHasVisibleExecutingTool(blocks)
-  const showTrailingThinking = shouldShowTrailingThinking({
-    isStreaming: phase === 'streaming',
-    isStreamIdle,
-    isRenderingStream: trailingStreamActivity,
-    hasExecutingTool,
-    lastSegmentType: lastSegment.type,
-  })
+  const showShimmer =
+    thinkingExpanded &&
+    thinkingLabel !== null &&
+    (segments.length === 0 ||
+      trailingPendingTag ||
+      (isStreamIdle && !trailingStreamActivity && !hasExecutingTool))
 
   return (
-    <div className='space-y-[10px]'>
-      {segments.map((segment, i) => {
-        switch (segment.type) {
-          case 'text':
-            return (
-              <ChatContent
-                key={segment.id}
-                content={segment.content}
-                isStreaming={shouldSmoothTextSegment({
-                  isStreaming,
-                  segmentIndex: i,
-                  segmentCount: segments.length,
-                })}
-                questionAnswers={questionAnswers}
-                onOptionSelect={onOptionSelect}
-                onQuestionDismiss={onQuestionDismiss}
-                onWorkspaceResourceSelect={onWorkspaceResourceSelect}
-                onRevealStateChange={
-                  i === segments.length - 1 ? handleTrailingRevealChange : undefined
-                }
-                onStreamActivityChange={
-                  i === segments.length - 1 ? handleTrailingStreamActivityChange : undefined
-                }
-              />
-            )
-          case 'agent_group': {
-            return (
-              <div key={segment.id} className={isStreaming ? 'animate-stream-fade-in' : undefined}>
-                <AgentGroup
+    <div>
+      <div className='space-y-[10px]'>
+        {segments.map((segment, i) => {
+          switch (segment.type) {
+            case 'text':
+              return (
+                <ChatContent
                   key={segment.id}
-                  agentName={segment.agentName}
-                  agentLabel={segment.agentLabel}
-                  items={segment.items}
-                  isDelegating={segment.isDelegating}
-                  isStreaming={isStreaming}
-                  isCurrentSection={i === segments.length - 1}
-                  isLaneOpen={segment.isOpen}
+                  content={segment.content}
+                  isStreaming={shouldSmoothTextSegment({
+                    isStreaming,
+                    segmentIndex: i,
+                    segmentCount: segments.length,
+                  })}
+                  questionAnswers={questionAnswers}
+                  onOptionSelect={onOptionSelect}
+                  onQuestionDismiss={onQuestionDismiss}
+                  onWorkspaceResourceSelect={onWorkspaceResourceSelect}
+                  onRevealStateChange={
+                    i === segments.length - 1 ? handleTrailingRevealChange : undefined
+                  }
+                  onStreamActivityChange={
+                    i === segments.length - 1 ? handleTrailingStreamActivityChange : undefined
+                  }
+                  onPendingTagChange={
+                    i === segments.length - 1 ? handleTrailingPendingTagChange : undefined
+                  }
                 />
-              </div>
-            )
+              )
+            case 'agent_group': {
+              return (
+                <div
+                  key={segment.id}
+                  className={isStreaming ? 'animate-stream-fade-in' : undefined}
+                >
+                  <AgentGroup
+                    key={segment.id}
+                    agentName={segment.agentName}
+                    agentLabel={segment.agentLabel}
+                    items={segment.items}
+                    isDelegating={segment.isDelegating}
+                    isStreaming={isStreaming}
+                    isCurrentSection={i === segments.length - 1}
+                    isLaneOpen={segment.isOpen}
+                  />
+                </div>
+              )
+            }
+            case 'options':
+              return (
+                <div
+                  key={`options-${i}`}
+                  className={isStreaming ? 'animate-stream-fade-in' : undefined}
+                >
+                  <Options items={segment.items} onSelect={onOptionSelect} />
+                </div>
+              )
+            case 'stopped':
+              return (
+                <div key={`stopped-${i}`} className='flex items-center gap-[8px]'>
+                  <CircleStop className='size-[16px] flex-shrink-0 text-[var(--text-icon)]' />
+                  <span className='text-[14px] text-[var(--text-body)]'>Stopped by user</span>
+                </div>
+              )
           }
-          case 'options':
-            return (
-              <div
-                key={`options-${i}`}
-                className={isStreaming ? 'animate-stream-fade-in' : undefined}
-              >
-                <Options items={segment.items} onSelect={onOptionSelect} />
-              </div>
-            )
-          case 'stopped':
-            return (
-              <div key={`stopped-${i}`} className='flex items-center gap-[8px]'>
-                <CircleStop className='size-[16px] flex-shrink-0 text-[var(--text-icon)]' />
-                <span className='text-[14px] text-[var(--text-body)]'>Stopped by user</span>
-              </div>
-            )
-        }
-      })}
-      {showTrailingThinking && <PendingTagIndicator />}
+        })}
+      </div>
+      {thinkingExpanded && isLast ? (
+        // Fixed-height placeholder for the NEXT piece of output: the shimmer
+        // and arriving output trade places via opacity only, so mid-turn swaps
+        // can't move layout. A sibling of the space-y stack (not a child), so
+        // it carries no stray sibling margin — pt-[10px] is its own gap.
+        <div aria-hidden={!showShimmer} className='pt-[10px]'>
+          <div
+            className={cn(
+              'transition-opacity duration-200 ease-out',
+              showShimmer ? 'opacity-100' : 'opacity-0'
+            )}
+          >
+            <PendingTagIndicator label={thinkingLabel ?? 'Thinking…'} />
+          </div>
+        </div>
+      ) : (
+        // The actions row takes the slot's place in the SAME render — a single
+        // ~10px reflow instead of a collapse the buttons would ride upward or a
+        // late mount the chase would visibly scroll to.
+        actions && <div className='mt-2.5'>{actions}</div>
+      )}
     </div>
   )
 }
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/mothership-chat/mothership-chat.tsx b/apps/sim/app/workspace/[workspaceId]/home/components/mothership-chat/mothership-chat.tsx
index e61e9af3c47..db903e8398a 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/mothership-chat/mothership-chat.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/mothership-chat/mothership-chat.tsx
@@ -21,10 +21,7 @@ import {
   type MessagePhase,
 } from '@/app/workspace/[workspaceId]/home/components/message-content'
 import { parseQuestionAnswerMessage } from '@/app/workspace/[workspaceId]/home/components/message-content/components/question'
-import {
-  PendingTagIndicator,
-  parseLastQuestionTag,
-} from '@/app/workspace/[workspaceId]/home/components/message-content/components/special-tags'
+import { parseLastQuestionTag } from '@/app/workspace/[workspaceId]/home/components/message-content/components/special-tags'
 import { QueuedMessages } from '@/app/workspace/[workspaceId]/home/components/queued-messages'
 import {
   UserInput,
@@ -101,7 +98,6 @@ const OVERSCAN = 6
  * scrolled up.
  */
 const PIN_THRESHOLD = 2
-
 /**
  * Initial-scroll sentinel. Distinct from every real `chatId` value — including
  * `undefined` (a not-yet-persisted chat) — so the first scroll-to-bottom fires
@@ -113,7 +109,7 @@ const UNSCROLLED = Symbol('unscrolled')
 const LAYOUT_STYLES = {
   'mothership-view': {
     scrollContainer:
-      'min-h-0 flex-1 overflow-y-auto overflow-x-hidden px-6 pt-4 pb-8 [scrollbar-gutter:stable_both-edges]',
+      'min-h-0 flex-1 overflow-y-auto overflow-x-hidden px-6 pt-4 pb-2 [scrollbar-gutter:stable_both-edges]',
     sizer: 'relative mx-auto w-full max-w-[48rem]',
     rowGap: 'pb-6',
     userRow: 'flex flex-col items-end gap-[6px] pt-3',
@@ -175,6 +171,7 @@ const UserMessageRow = memo(function UserMessageRow({
 interface AssistantMessageRowProps {
   message: ChatMessage
   isStreaming: boolean
+  isLast: boolean
   precedingUserContent?: string
   /** Transcript-derived answers for this message's question card (renders the recap). */
   questionAnswers?: string[]
@@ -186,6 +183,7 @@ interface AssistantMessageRowProps {
 const AssistantMessageRow = memo(function AssistantMessageRow({
   message,
   isStreaming,
+  isLast,
   precedingUserContent,
   questionAnswers,
   rowClassName,
@@ -205,10 +203,6 @@ const AssistantMessageRow = memo(function AssistantMessageRow({
     onAnimatingChangeRef.current?.(phase !== 'settled')
   }, [phase])
 
-  if (!hasAnyBlocks && !trimmedContent && isStreaming) {
-    return <PendingTagIndicator />
-  }
-
   const hasRenderableAssistant = assistantMessageHasRenderableContent(blocks, message.content ?? '')
   if (!hasRenderableAssistant && !trimmedContent && !isStreaming) {
     return null
@@ -225,8 +219,11 @@ const AssistantMessageRow = memo(function AssistantMessageRow({
   const handleQuestionDismiss = () => {
     if (questionTag) setDismissedQuestionTag(questionTag)
   }
-  const showActions = shouldShowAssistantMessageActions({
-    phase,
+  // Settle timing lives in MessageContent (the actions take the thinking
+  // slot's place in the same render), so eligibility here is phase-free:
+  // `phase: 'settled'` asks the helper "would a settled turn show them?".
+  const actionsEligible = shouldShowAssistantMessageActions({
+    phase: 'settled',
     hasContent: Boolean(message.content) || hasAnyBlocks,
     endsWithQuestion,
     questionDismissed,
@@ -245,21 +242,22 @@ const AssistantMessageRow = memo(function AssistantMessageRow({
         blocks={blocks}
         fallbackContent={message.content}
         isStreaming={isStreaming}
+        isLast={isLast}
         questionAnswers={questionAnswers}
         onOptionSelect={onOptionSelect}
         onQuestionDismiss={handleQuestionDismiss}
         onPhaseChange={setPhase}
+        actions={
+          actionsEligible ? (
+            <MessageActions
+              content={message.content}
+              userQuery={precedingUserContent}
+              requestId={message.requestId}
+              messageId={message.id}
+            />
+          ) : undefined
+        }
       />
-      {showActions && (
-        <div className='mt-2.5'>
-          <MessageActions
-            content={message.content}
-            userQuery={precedingUserContent}
-            requestId={message.requestId}
-            messageId={message.id}
-          />
-        </div>
-      )}
     </div>
   )
 })
@@ -302,6 +300,45 @@ export function MothershipChat({
   const [lastRowAnimating, setLastRowAnimating] = useState(false)
   const scrollElementRef = useRef<HTMLDivElement | null>(null)
   const { ref: autoScrollRef } = useAutoScroll(isStreamActive || lastRowAnimating)
+  const sizerRef = useRef<HTMLDivElement | null>(null)
+  const scrollerPaddingRef = useRef<{ top: number; bottom: number } | null>(null)
+
+  /**
+   * Sizer floor while streaming: `scrollHeight` must never dip below the
+   * current viewport bottom. Streaming markdown re-parse emits transient
+   * row-height shrinks; when they pull scrollHeight under
+   * `scrollTop + clientHeight`, the browser clamps `scrollTop` and the pinned
+   * transcript visibly drops, then the chase glides it back. Flooring the
+   * sizer at exactly the scrolled-to extent prevents that clamp while never
+   * ADDING space — the floor cannot exceed what is already on screen. So an
+   * estimate correction (a fresh row measuring smaller than
+   * ROW_HEIGHT_ESTIMATE) releases immediately instead of holding phantom space
+   * the chase would scroll into and bounce back out of.
+   *
+   * Active on the same signal as auto-scroll: the reveal keeps re-parsing
+   * markdown (and shrinking) after the network stream closes, so the floor
+   * must hold through `lastRowAnimating` too.
+   */
+  const floorActive = isStreamActive || lastRowAnimating
+  useLayoutEffect(() => {
+    const sizer = sizerRef.current
+    const el = scrollElementRef.current
+    if (!sizer || !el) return
+    if (!floorActive) {
+      sizer.style.minHeight = ''
+      return
+    }
+    if (!scrollerPaddingRef.current) {
+      const style = getComputedStyle(el)
+      scrollerPaddingRef.current = {
+        top: Number.parseFloat(style.paddingTop),
+        bottom: Number.parseFloat(style.paddingBottom),
+      }
+    }
+    const padding = scrollerPaddingRef.current
+    const floor = Math.max(0, el.scrollTop + el.clientHeight - padding.top - padding.bottom)
+    sizer.style.minHeight = `${floor}px`
+  })
   const setScrollElement = useCallback(
     (el: HTMLDivElement | null) => {
       scrollElementRef.current = el
@@ -516,7 +553,11 @@ export function MothershipChat({
           {isLoading && !hasMessages ? (
             <MothershipChatSkeleton layout={layout} />
           ) : (
-            <div className={styles.sizer} style={{ height: virtualizer.getTotalSize() }}>
+            <div
+              ref={sizerRef}
+              className={styles.sizer}
+              style={{ height: virtualizer.getTotalSize() }}
+            >
               {virtualItems.map((virtualItem) => {
                 const index = virtualItem.index
                 const msg = messages[index]
@@ -544,6 +585,7 @@ export function MothershipChat({
                       <AssistantMessageRow
                         message={msg}
                         isStreaming={isStreamActive && isLast}
+                        isLast={isLast}
                         precedingUserContent={precedingUserContentByIndex[index]}
                         questionAnswers={questionPairing.answersByIndex[index]}
                         rowClassName={cn(styles.assistantRow, styles.rowGap)}
diff --git a/apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/connect-service-account-modal.tsx b/apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/connect-service-account-modal.tsx
index 016455bf012..bb83405f7f6 100644
--- a/apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/connect-service-account-modal.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/connect-service-account-modal.tsx
@@ -178,6 +178,7 @@ export function ConnectServiceAccountModal({
         credentialId={credentialId}
         initialDisplayName={credentialDisplayName}
         initialDescription={credentialDescription}
+        onCreated={onCreated}
       />
     )
   }
diff --git a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/[documentId]/document.tsx b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/[documentId]/document.tsx
index 6a875d4a824..696c3fd82c2 100644
--- a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/[documentId]/document.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/[documentId]/document.tsx
@@ -8,7 +8,6 @@ import { truncate } from '@sim/utils/string'
 import { ChevronDown, ChevronUp, FileText, Pencil, Tag } from 'lucide-react'
 import { useParams, useRouter } from 'next/navigation'
 import { useQueryStates } from 'nuqs'
-import { SearchHighlight } from '@/components/ui/search-highlight'
 import type { ChunkData } from '@/lib/knowledge/types'
 import { formatTokenCount } from '@/lib/tokenization'
 import type {
@@ -38,7 +37,7 @@ import {
   documentParsers,
   documentUrlKeys,
 } from '@/app/workspace/[workspaceId]/knowledge/[id]/[documentId]/search-params'
-import { ActionBar } from '@/app/workspace/[workspaceId]/knowledge/[id]/components'
+import { ActionBar, SearchHighlight } from '@/app/workspace/[workspaceId]/knowledge/[id]/components'
 import { getDocumentIcon } from '@/app/workspace/[workspaceId]/knowledge/components'
 import { useUserPermissionsContext } from '@/app/workspace/[workspaceId]/providers/workspace-permissions-provider'
 import { useContextMenu } from '@/app/workspace/[workspaceId]/w/components/sidebar/hooks'
diff --git a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/base.tsx b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/base.tsx
index 205de1bd764..f5f988ec658 100644
--- a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/base.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/base.tsx
@@ -31,7 +31,6 @@ import { AlertCircle, Pencil, Plus, Tag, X } from 'lucide-react'
 import { useParams, useRouter } from 'next/navigation'
 import { useQueryState, useQueryStates } from 'nuqs'
 import { usePostHog } from 'posthog-js/react'
-import { SearchHighlight } from '@/components/ui/search-highlight'
 import { ALL_TAG_SLOTS, type AllTagSlot, getFieldTypeForSlot } from '@/lib/knowledge/constants'
 import type { DocumentSortField, SortOrder } from '@/lib/knowledge/documents/types'
 import { type FilterFieldType, getOperatorsForFieldType } from '@/lib/knowledge/filters/types'
@@ -59,6 +58,7 @@ import {
   ConnectorsSection,
   DocumentContextMenu,
   RenameDocumentModal,
+  SearchHighlight,
 } from '@/app/workspace/[workspaceId]/knowledge/[id]/components'
 import {
   addConnectorParam,
diff --git a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/index.ts b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/index.ts
index d26e85dc9e3..12e32ebf736 100644
--- a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/index.ts
+++ b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/index.ts
@@ -6,3 +6,4 @@ export { ConnectorsSection } from './connectors-section'
 export { DocumentContextMenu } from './document-context-menu'
 export { EditConnectorModal } from './edit-connector-modal'
 export { RenameDocumentModal } from './rename-document-modal'
+export { SearchHighlight } from './search-highlight'
diff --git a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/search-highlight/index.ts b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/search-highlight/index.ts
new file mode 100644
index 00000000000..1144ed165cd
--- /dev/null
+++ b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/search-highlight/index.ts
@@ -0,0 +1 @@
+export { SearchHighlight } from './search-highlight'
diff --git a/apps/sim/components/ui/search-highlight.tsx b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/search-highlight/search-highlight.tsx
similarity index 85%
rename from apps/sim/components/ui/search-highlight.tsx
rename to apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/search-highlight/search-highlight.tsx
index 050ffc87b85..41062a49b00 100644
--- a/apps/sim/components/ui/search-highlight.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/search-highlight/search-highlight.tsx
@@ -4,6 +4,11 @@ interface SearchHighlightProps {
   className?: string
 }
 
+/**
+ * Renders `text` with substrings matching any whitespace-separated term of
+ * `searchQuery` wrapped in the highlight-match colors. Falls back to plain
+ * text when the query is empty.
+ */
 export function SearchHighlight({ text, searchQuery, className = '' }: SearchHighlightProps) {
   if (!searchQuery.trim()) {
     return <span className={className}>{text}</span>
diff --git a/apps/sim/app/workspace/[workspaceId]/prefetch.ts b/apps/sim/app/workspace/[workspaceId]/prefetch.ts
index e54318c55a5..f8e2d3c3afe 100644
--- a/apps/sim/app/workspace/[workspaceId]/prefetch.ts
+++ b/apps/sim/app/workspace/[workspaceId]/prefetch.ts
@@ -75,7 +75,7 @@ export async function prefetchWorkspaceSidebar(
       staleTime: WORKFLOW_LIST_STALE_TIME,
     }),
     queryClient.prefetchQuery({
-      queryKey: mothershipChatKeys.list(workspaceId),
+      queryKey: mothershipChatKeys.list(workspaceId, 'active'),
       queryFn: async () => {
         const data = await listMothershipChats(userId, workspaceId)
         return data.map(mapChat)
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/components/mcp-server-form-modal/mcp-server-form-modal.tsx b/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/components/mcp-server-form-modal/mcp-server-form-modal.tsx
index fe6d59e0967..f3afefe0820 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/components/mcp-server-form-modal/mcp-server-form-modal.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/components/mcp-server-form-modal/mcp-server-form-modal.tsx
@@ -116,7 +116,7 @@ function getTestButtonLabel(
   if (testResult?.success) return 'Connection success'
   if (testResult?.authRequired) return 'Requires OAuth'
   if (testResult && !testResult.success) return 'No connection: retry'
-  return 'Test Connection'
+  return 'Test connection'
 }
 
 interface FormattedInputProps {
@@ -609,8 +609,8 @@ export function McpServerFormModal({
   const isSubmitDisabled =
     isSubmitting || !isFormValid || isDomainBlocked || (mode === 'edit' && !hasChanges)
 
-  const title = mode === 'add' ? 'Add New MCP Server' : 'Edit MCP Server'
-  const submitLabel = mode === 'add' ? 'Add MCP' : 'Save'
+  const title = mode === 'add' ? 'Add MCP server' : 'Edit MCP server'
+  const submitLabel = mode === 'add' ? 'Add server' : 'Save'
 
   const handleToggleJsonMode = () => {
     if (testResult) clearTestResult()
@@ -622,7 +622,7 @@ export function McpServerFormModal({
   const secondaryAction: ChipModalFooterAction | undefined =
     mode === 'add'
       ? {
-          label: formMode === 'form' ? 'Edit JSON' : 'Edit Form',
+          label: formMode === 'form' ? 'Edit JSON' : 'Edit form',
           onClick: handleToggleJsonMode,
         }
       : formMode === 'form'
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/mcp.tsx b/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/mcp.tsx
index 92f3fc7f60a..5558e23fb35 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/mcp.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/mcp.tsx
@@ -68,10 +68,13 @@ interface ServerListItemProps {
   server: McpServer
   tools: McpTool[]
   isDeleting: boolean
+  isConnecting: boolean
   isLoadingTools?: boolean
   isRefreshing?: boolean
+  discoveryError?: string | null
   onRemove: () => void
   onViewDetails: () => void
+  onAuthorize: () => void
 }
 
 function ServerListItem({
@@ -79,10 +82,13 @@ function ServerListItem({
   server,
   tools,
   isDeleting,
+  isConnecting,
   isLoadingTools = false,
   isRefreshing = false,
+  discoveryError = null,
   onRemove,
   onViewDetails,
+  onAuthorize,
 }: ServerListItemProps) {
   const transportLabel = formatTransportLabel(server.transport || 'http')
   const toolsLabel = getServerToolsLabel(
@@ -91,32 +97,51 @@ function ServerListItem({
     server.lastError,
     server.authType
   )
+  // Only hard-red when there are no last-known tools to show. A populated, connected server
+  // stays on its tool count through a transient probe failure; a persistent failure flips
+  // `connectionStatus` to error/disconnected and reads as failed through that path instead.
+  const showDiscoveryError =
+    Boolean(discoveryError) &&
+    tools.length === 0 &&
+    server.connectionStatus !== 'error' &&
+    server.connectionStatus !== 'disconnected'
   const hasConnectionIssue =
-    server.connectionStatus === 'error' || server.connectionStatus === 'disconnected'
+    server.connectionStatus === 'error' ||
+    server.connectionStatus === 'disconnected' ||
+    showDiscoveryError
 
   return (
     <div className='flex items-center justify-between gap-3'>
       <div className='flex min-w-0 flex-col justify-center gap-[1px]'>
         <div className='flex items-center gap-1.5'>
           <span className='max-w-[200px] truncate text-[var(--text-body)] text-sm'>
-            {server.name || 'Unnamed Server'}
+            {server.name || 'Unnamed server'}
           </span>
           <span className='text-[var(--text-muted)] text-caption'>({transportLabel})</span>
         </div>
         <p
           className={cn(
-            'truncate text-sm',
-            hasConnectionIssue ? 'text-[var(--text-error)]' : 'text-[var(--text-muted)]'
+            'truncate text-caption',
+            hasConnectionIssue && !isConnecting
+              ? 'text-[var(--text-error)]'
+              : 'text-[var(--text-muted)]'
           )}
         >
-          {isRefreshing
-            ? 'Refreshing...'
-            : isLoadingTools && tools.length === 0
-              ? 'Loading...'
-              : toolsLabel}
+          {isConnecting
+            ? 'Waiting for authorization...'
+            : isRefreshing
+              ? 'Refreshing...'
+              : isLoadingTools && tools.length === 0
+                ? 'Loading...'
+                : showDiscoveryError
+                  ? discoveryError
+                  : toolsLabel}
         </p>
       </div>
       <div className='flex flex-shrink-0 items-center gap-1'>
+        {canManage && server.authType === 'oauth' && server.connectionStatus !== 'connected' && (
+          <Chip onClick={onAuthorize}>{isConnecting ? 'Reopen authorization' : 'Authorize'}</Chip>
+        )}
         <RowActionsMenu
           label='Server actions'
           actions={[
@@ -168,11 +193,7 @@ export function MCP() {
     isLoading: serversLoading,
     error: serversError,
   } = useMcpServers(workspaceId)
-  const {
-    data: mcpToolsData = [],
-    error: toolsError,
-    toolsStateByServer,
-  } = useMcpToolsQuery(workspaceId)
+  const { data: mcpToolsData = [], toolsStateByServer } = useMcpToolsQuery(workspaceId)
   const { data: storedTools = [], refetch: refetchStoredTools } = useStoredMcpTools(workspaceId)
   const forceRefreshToolsMutation = useForceRefreshMcpTools()
   const forceRefreshTools = forceRefreshToolsMutation.mutate
@@ -374,7 +395,10 @@ export function MCP() {
     return issues
   }
 
-  const error = toolsError || serversError
+  // Only a failure to load the server LIST replaces the list. A tool-discovery failure must
+  // not blank the page — the servers still render, each row surfacing its own discovery
+  // state via `toolsStateByServer`.
+  const listError = serversError
   const hasServers = servers && servers.length > 0
   const showNoResults = searchTerm.trim() && filteredServers.length === 0 && servers.length > 0
 
@@ -385,15 +409,13 @@ export function MCP() {
     const refreshAction = getRefreshActionState({
       mutationStatus: isCurrentRefresh ? refreshServerMutation.status : 'idle',
       connectionStatus: isCurrentRefresh ? refreshServerMutation.data?.status : undefined,
-      authType: server.authType,
-      error: isCurrentRefresh ? refreshServerMutation.data?.error : undefined,
       workflowsUpdated: isCurrentRefresh ? refreshServerMutation.data?.workflowsUpdated : undefined,
     })
 
     return (
       <SettingsPanel
         back={{ text: 'MCP tools', icon: ArrowLeft, onSelect: handleBackToList }}
-        title={server.name || 'Unnamed Server'}
+        title={server.name || 'Unnamed server'}
         actions={
           canEdit
             ? [
@@ -414,8 +436,8 @@ export function MCP() {
         <SettingsSection label='Server'>
           <div className='flex flex-col gap-4.5'>
             <div className='flex flex-col gap-2'>
-              <span className='text-[var(--text-muted)] text-caption'>Server Name</span>
-              <p className='text-[var(--text-body)] text-sm'>{server.name || 'Unnamed Server'}</p>
+              <span className='text-[var(--text-muted)] text-caption'>Server name</span>
+              <p className='text-[var(--text-body)] text-sm'>{server.name || 'Unnamed server'}</p>
             </div>
 
             <div className='flex flex-col gap-2'>
@@ -450,12 +472,11 @@ export function MCP() {
                 <div>
                   <Chip
                     variant='primary'
-                    disabled={connectingOauthServers.has(server.id)}
                     onClick={async () => {
                       await startOauthForServer(server.id)
                     }}
                   >
-                    {connectingOauthServers.has(server.id) ? 'Connecting…' : 'Connect with OAuth'}
+                    {connectingOauthServers.has(server.id) ? 'Reopen authorization' : 'Authorize'}
                   </Chip>
                 </div>
               </div>
@@ -617,7 +638,7 @@ export function MCP() {
         search={{
           value: searchTerm,
           onChange: setSearchTerm,
-          placeholder: 'Search MCPs...',
+          placeholder: 'Search servers...',
         }}
         actions={
           canEdit
@@ -633,13 +654,15 @@ export function MCP() {
             : []
         }
       >
-        {error ? (
+        {listError ? (
           <div className='flex h-full flex-col items-center justify-center gap-2'>
-            <p className='text-[var(--text-error)] text-xs leading-tight'>
-              {getErrorMessage(error, 'Failed to load MCP servers')}
+            <p className='text-[var(--text-error)] text-small leading-tight'>
+              {getErrorMessage(listError, 'Failed to load MCP servers')}
             </p>
           </div>
-        ) : serversLoading ? null : !hasServers ? (
+        ) : serversLoading ? (
+          <SettingsEmptyState>Loading...</SettingsEmptyState>
+        ) : !hasServers ? (
           <SettingsEmptyState>
             {canEdit ? 'Click "Add server" above to get started' : 'No MCP servers configured'}
           </SettingsEmptyState>
@@ -660,13 +683,18 @@ export function MCP() {
                   server={server}
                   tools={tools}
                   isDeleting={deletingServers.has(server.id)}
+                  isConnecting={connectingOauthServers.has(server.id)}
                   isLoadingTools={isLoadingTools}
                   isRefreshing={
                     refreshServerMutation.isPending &&
                     refreshServerMutation.variables?.serverId === server.id
                   }
+                  discoveryError={
+                    serverToolsState?.error ? getErrorMessage(serverToolsState.error) : null
+                  }
                   onRemove={() => handleRemoveServer(server.id)}
                   onViewDetails={() => handleViewDetails(server.id)}
+                  onAuthorize={() => startOauthForServer(server.id)}
                 />
               )
             })}
@@ -705,8 +733,8 @@ export function MCP() {
           onOpenChange={(open) => {
             if (!open) setServerToDeleteId(null)
           }}
-          srTitle='Delete MCP Server'
-          title='Delete MCP Server'
+          srTitle='Delete MCP server'
+          title='Delete MCP server'
           text={[
             'Are you sure you want to delete ',
             {
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/refresh-action-state.test.ts b/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/refresh-action-state.test.ts
index 4a036e8827b..3186429218a 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/refresh-action-state.test.ts
+++ b/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/refresh-action-state.test.ts
@@ -31,28 +31,11 @@ describe('getRefreshActionState', () => {
     })
   })
 
-  it('shows OAuth authorization required when an OAuth refresh finishes disconnected', () => {
-    expect(
-      getRefreshActionState({
-        mutationStatus: 'success',
-        connectionStatus: 'disconnected',
-        authType: 'oauth',
-        workflowsUpdated: 0,
-      })
-    ).toEqual({
-      text: 'OAuth authorization required',
-      textTone: 'error',
-      disabled: false,
-    })
-  })
-
   it('keeps Failed when a disconnected OAuth refresh has a concrete error', () => {
     expect(
       getRefreshActionState({
         mutationStatus: 'success',
         connectionStatus: 'disconnected',
-        authType: 'oauth',
-        error: 'The MCP server took too long to respond and timed out',
         workflowsUpdated: 0,
       })
     ).toEqual({
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/refresh-action-state.ts b/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/refresh-action-state.ts
index 8b4ae5da87d..28a6869921e 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/refresh-action-state.ts
+++ b/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/refresh-action-state.ts
@@ -1,12 +1,10 @@
 import type { MutationStatus } from '@tanstack/react-query'
-import type { McpServer, RefreshMcpServerResult } from '@/lib/api/contracts/mcp'
+import type { RefreshMcpServerResult } from '@/lib/api/contracts/mcp'
 import type { SettingsAction } from '@/app/workspace/[workspaceId]/settings/components/settings-header/settings-header'
 
 interface RefreshActionStateInput {
   mutationStatus: MutationStatus
   connectionStatus?: RefreshMcpServerResult['status']
-  authType?: McpServer['authType']
-  error?: RefreshMcpServerResult['error']
   workflowsUpdated?: number
 }
 
@@ -15,23 +13,12 @@ type RefreshActionState = Pick<SettingsAction, 'text' | 'textTone' | 'disabled'>
 export function getRefreshActionState({
   mutationStatus,
   connectionStatus,
-  authType,
-  error,
   workflowsUpdated,
 }: RefreshActionStateInput): RefreshActionState {
   if (mutationStatus === 'pending') {
     return { text: 'Refreshing...', textTone: undefined, disabled: true }
   }
 
-  if (
-    mutationStatus === 'success' &&
-    connectionStatus === 'disconnected' &&
-    authType === 'oauth' &&
-    !error?.trim()
-  ) {
-    return { text: 'OAuth authorization required', textTone: 'error', disabled: false }
-  }
-
   if (
     mutationStatus === 'error' ||
     (mutationStatus === 'success' && connectionStatus !== 'connected')
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/server-tools-label.test.ts b/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/server-tools-label.test.ts
index 373ae480af4..43facb9bceb 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/server-tools-label.test.ts
+++ b/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/server-tools-label.test.ts
@@ -19,7 +19,7 @@ describe('getServerToolsLabel', () => {
   })
 
   it('keeps the generic disconnected state for non-OAuth servers', () => {
-    expect(getServerToolsLabel([], 'disconnected', null, 'headers')).toBe('Not Connected')
+    expect(getServerToolsLabel([], 'disconnected', null, 'headers')).toBe('Not connected')
   })
 
   it('shows the persisted error for disconnected connections', () => {
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/server-tools-label.ts b/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/server-tools-label.ts
index 495cea5f9ff..2aae09d5537 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/server-tools-label.ts
+++ b/apps/sim/app/workspace/[workspaceId]/settings/components/mcp/server-tools-label.ts
@@ -16,7 +16,7 @@ export function getServerToolsLabel(
 
   if (connectionStatus === 'disconnected') {
     return (
-      lastError?.trim() || (authType === 'oauth' ? 'OAuth authorization required' : 'Not Connected')
+      lastError?.trim() || (authType === 'oauth' ? 'OAuth authorization required' : 'Not connected')
     )
   }
 
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/mothership/mothership.tsx b/apps/sim/app/workspace/[workspaceId]/settings/components/mothership/mothership.tsx
index 7c86d4721ff..b61f8353a24 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/mothership/mothership.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/settings/components/mothership/mothership.tsx
@@ -1,7 +1,7 @@
 'use client'
 
 import { useCallback, useMemo, useState } from 'react'
-import { Badge, Button, ChipInput, ChipSelect, cn, Label, Skeleton } from '@sim/emcn'
+import { Badge, Button, ChipInput, ChipModalTabs, ChipSelect, Label, Skeleton } from '@sim/emcn'
 import { formatDateTime } from '@sim/utils/formatting'
 import { useQueryStates } from 'nuqs'
 import { AnthropicIcon, OpenAIIcon } from '@/components/icons'
@@ -115,26 +115,11 @@ export function Mothership() {
           />
         </div>
 
-        <div className='flex gap-1 border-[var(--border-secondary)] border-b pb-px'>
-          {TABS.map((tab) => (
-            <button
-              key={tab.id}
-              type='button'
-              onClick={() => setMothershipParams({ tab: tab.id })}
-              className={cn(
-                'relative px-3 py-2 font-medium text-sm transition-colors',
-                activeTab === tab.id
-                  ? 'text-[var(--text-primary)]'
-                  : 'text-[var(--text-tertiary)] hover-hover:hover:text-[var(--text-secondary)]'
-              )}
-            >
-              {tab.label}
-              {activeTab === tab.id && (
-                <span className='absolute right-0 bottom-0 left-0 h-[2px] bg-[var(--text-primary)]' />
-              )}
-            </button>
-          ))}
-        </div>
+        <ChipModalTabs
+          tabs={TABS.map((tab) => ({ value: tab.id, label: tab.label }))}
+          value={activeTab}
+          onChange={(value) => setMothershipParams({ tab: value as MothershipTab })}
+        />
 
         <div className='flex items-center gap-3'>
           <div className='flex items-center gap-2'>
@@ -281,7 +266,7 @@ function OverviewTab({
       )}
       {breakdown?.users && (
         <div className='flex flex-col gap-0.5'>
-          <div className='flex items-center gap-3 border-[var(--border-secondary)] border-b px-3 py-2 text-[var(--text-tertiary)] text-caption'>
+          <div className='flex items-center gap-3 border-[var(--border)] border-b px-3 py-2 text-[var(--text-tertiary)] text-caption'>
             <span className='flex-1'>User ID</span>
             <span className='w-[100px] text-right'>Requests</span>
             <span className='w-[100px] text-right'>Cost</span>
@@ -296,7 +281,7 @@ function OverviewTab({
             }) => (
               <div
                 key={u.user_id}
-                className='flex items-center gap-3 border-[var(--border-secondary)] border-b px-3 py-2 text-small last:border-b-0'
+                className='flex items-center gap-3 border-[var(--border)] border-b px-3 py-2 text-small last:border-b-0'
               >
                 <span className='flex-1 truncate font-mono text-[var(--text-primary)] text-caption'>
                   {u.user_id}
@@ -328,7 +313,7 @@ function OverviewTab({
       {requests?.requests && (
         <div className='max-h-[400px] overflow-auto'>
           <div className='flex flex-col gap-0.5'>
-            <div className='sticky top-0 z-10 flex items-center gap-3 border-[var(--border-secondary)] border-b bg-[var(--surface-1)] px-3 py-2 text-[var(--text-tertiary)] text-caption'>
+            <div className='sticky top-0 z-10 flex items-center gap-3 border-[var(--border)] border-b bg-[var(--surface-1)] px-3 py-2 text-[var(--text-tertiary)] text-caption'>
               <span className='w-[180px]'>Request ID</span>
               <span className='w-[80px]'>Model</span>
               <span className='w-[80px] text-right'>Duration</span>
@@ -352,9 +337,9 @@ function OverviewTab({
                 }) => (
                   <div
                     key={r.request_id}
-                    className='flex items-center gap-3 border-[var(--border-secondary)] border-b px-3 py-1.5 text-small last:border-b-0'
+                    className='flex items-center gap-3 border-[var(--border)] border-b px-3 py-1.5 text-small last:border-b-0'
                   >
-                    <span className='w-[180px] truncate font-mono text-[var(--text-primary)] text-xs'>
+                    <span className='w-[180px] truncate font-mono text-[var(--text-primary)] text-caption'>
                       {r.request_id ?? '—'}
                     </span>
                     <span className='w-[80px] truncate text-[var(--text-secondary)] text-caption'>
@@ -452,7 +437,7 @@ function LicensesTab({ environment }: { environment: MothershipEnv }) {
       </div>
 
       {generatedKey && (
-        <div className='rounded-md border border-[var(--border-secondary)] bg-[var(--surface-hover)] p-3'>
+        <div className='rounded-md border border-[var(--border)] bg-[var(--surface-hover)] p-3'>
           <p className='mb-1 text-[var(--text-secondary)] text-caption'>
             License key (only shown once):
           </p>
@@ -479,7 +464,7 @@ function LicensesTab({ environment }: { environment: MothershipEnv }) {
 
       {data?.licenses && (
         <div className='flex flex-col gap-0.5'>
-          <div className='flex items-center gap-3 border-[var(--border-secondary)] border-b px-3 py-2 text-[var(--text-tertiary)] text-caption'>
+          <div className='flex items-center gap-3 border-[var(--border)] border-b px-3 py-2 text-[var(--text-tertiary)] text-caption'>
             <span className='flex-1'>Name</span>
             <span className='w-[100px] text-right'>Validations</span>
             <span className='w-[140px] text-right'>Expiration</span>
@@ -498,7 +483,7 @@ function LicensesTab({ environment }: { environment: MothershipEnv }) {
             }) => (
               <div
                 key={lic.id}
-                className='flex items-center gap-3 border-[var(--border-secondary)] border-b px-3 py-2 text-small last:border-b-0'
+                className='flex items-center gap-3 border-[var(--border)] border-b px-3 py-2 text-small last:border-b-0'
               >
                 <span className='flex-1 text-[var(--text-primary)]'>{lic.name}</span>
                 <span className='w-[100px] text-right text-[var(--text-secondary)]'>
@@ -529,7 +514,7 @@ function StatCard({
   loading?: boolean
 }) {
   return (
-    <div className='rounded-md border border-[var(--border-secondary)] p-3'>
+    <div className='rounded-md border border-[var(--border)] p-3'>
       <p className='text-[var(--text-tertiary)] text-caption'>{label}</p>
       {loading ? (
         <Skeleton className='mt-1 h-[24px] w-[80px] rounded-sm' />
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/recently-deleted/recently-deleted.tsx b/apps/sim/app/workspace/[workspaceId]/settings/components/recently-deleted/recently-deleted.tsx
index fc335655055..134f008f92e 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/recently-deleted/recently-deleted.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/settings/components/recently-deleted/recently-deleted.tsx
@@ -23,6 +23,7 @@ import { SettingsPanel } from '@/app/workspace/[workspaceId]/settings/components
 import { SettingsResourceRow } from '@/app/workspace/[workspaceId]/settings/components/settings-resource-row'
 import { useFolders, useRestoreFolder } from '@/hooks/queries/folders'
 import { useKnowledgeBasesQuery, useRestoreKnowledgeBase } from '@/hooks/queries/kb/knowledge'
+import { useMothershipChats, useRestoreMothershipChat } from '@/hooks/queries/mothership-chats'
 import { useRestoreTable, useTablesList } from '@/hooks/queries/tables'
 import { useRestoreWorkflow, useWorkflows } from '@/hooks/queries/workflows'
 import {
@@ -43,6 +44,7 @@ type ResourceType =
   | 'file'
   | 'folder'
   | 'workspace_folder'
+  | 'chat'
 
 function getResourceHref(
   workspaceId: string,
@@ -63,6 +65,8 @@ function getResourceHref(
       return `${base}/w`
     case 'workspace_folder':
       return `${base}/files?folderId=${id}`
+    case 'chat':
+      return `${base}/chat/${id}`
   }
 }
 
@@ -81,6 +85,7 @@ const RESOURCE_TYPE_TO_MOTHERSHIP: Record<Exclude<ResourceType, 'all'>, Mothersh
   table: 'table',
   knowledge: 'knowledgebase',
   file: 'file',
+  chat: 'task',
 }
 
 interface DeletedResource {
@@ -103,6 +108,7 @@ const TABS: { id: ResourceType; label: string }[] = [
   { id: 'table', label: 'Tables' },
   { id: 'knowledge', label: 'Knowledge Bases' },
   { id: 'file', label: 'Files' },
+  { id: 'chat', label: 'Chats' },
 ]
 
 const TYPE_LABEL: Record<Exclude<ResourceType, 'all'>, string> = {
@@ -112,6 +118,7 @@ const TYPE_LABEL: Record<Exclude<ResourceType, 'all'>, string> = {
   table: 'Table',
   knowledge: 'Knowledge Base',
   file: 'File',
+  chat: 'Chat',
 }
 
 function ResourceIcon({ resource }: { resource: DeletedResource }) {
@@ -167,6 +174,7 @@ export function RecentlyDeleted() {
   const knowledgeQuery = useKnowledgeBasesQuery(workspaceId, { scope: 'archived' })
   const filesQuery = useWorkspaceFiles(workspaceId, 'archived')
   const workspaceFoldersQuery = useWorkspaceFileFolders(workspaceId, 'archived')
+  const chatsQuery = useMothershipChats(workspaceId, { scope: 'archived' })
 
   const restoreWorkflow = useRestoreWorkflow()
   const restoreFolder = useRestoreFolder()
@@ -174,6 +182,7 @@ export function RecentlyDeleted() {
   const restoreKnowledgeBase = useRestoreKnowledgeBase()
   const restoreWorkspaceFile = useRestoreWorkspaceFile()
   const restoreWorkspaceFileFolder = useRestoreWorkspaceFileFolder()
+  const restoreChat = useRestoreMothershipChat(workspaceId)
 
   const isLoading =
     workflowsQuery.isLoading ||
@@ -181,7 +190,8 @@ export function RecentlyDeleted() {
     tablesQuery.isLoading ||
     knowledgeQuery.isLoading ||
     filesQuery.isLoading ||
-    workspaceFoldersQuery.isLoading
+    workspaceFoldersQuery.isLoading ||
+    chatsQuery.isLoading
 
   const error =
     workflowsQuery.error ||
@@ -189,7 +199,8 @@ export function RecentlyDeleted() {
     tablesQuery.error ||
     knowledgeQuery.error ||
     filesQuery.error ||
-    workspaceFoldersQuery.error
+    workspaceFoldersQuery.error ||
+    chatsQuery.error
 
   const resources = useMemo<DeletedResource[]>(() => {
     const items: DeletedResource[] = []
@@ -254,6 +265,17 @@ export function RecentlyDeleted() {
       })
     }
 
+    for (const chat of chatsQuery.data ?? []) {
+      if (!chat.deletedAt) continue
+      items.push({
+        id: chat.id,
+        name: chat.name,
+        type: 'chat',
+        deletedAt: chat.deletedAt,
+        workspaceId,
+      })
+    }
+
     return items
   }, [
     workflowsQuery.data,
@@ -262,6 +284,7 @@ export function RecentlyDeleted() {
     knowledgeQuery.data,
     filesQuery.data,
     workspaceFoldersQuery.data,
+    chatsQuery.data,
     workspaceId,
   ])
 
@@ -359,6 +382,9 @@ export function RecentlyDeleted() {
             folderId: resource.id,
           })
           break
+        case 'chat':
+          await restoreChat.mutateAsync(resource.id)
+          break
       }
 
       setRestoredItems((prev) => new Map(prev).set(resource.id, { resource, displayIndex }))
@@ -419,6 +445,10 @@ export function RecentlyDeleted() {
           {filtered.map((resource) => {
             const isRestoring = restoringIds.has(resource.id)
             const isRestored = restoredItems.has(resource.id)
+            // Chats are per-user (the archived list and restore are scoped to the
+            // viewer's own rows), so chat restore skips the workspace edit gate —
+            // mirroring that any member can delete their own chats.
+            const canRestore = resource.type === 'chat' || canEdit
 
             return (
               <SettingsResourceRow
@@ -433,7 +463,7 @@ export function RecentlyDeleted() {
                   </>
                 }
                 trailing={
-                  !canEdit ? null : isRestoring ? (
+                  !canRestore ? null : isRestoring ? (
                     <Chip variant='primary' disabled className='shrink-0'>
                       Restoring...
                     </Chip>
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/recently-deleted/search-params.ts b/apps/sim/app/workspace/[workspaceId]/settings/components/recently-deleted/search-params.ts
index 703359ce299..a7e8435eed9 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/recently-deleted/search-params.ts
+++ b/apps/sim/app/workspace/[workspaceId]/settings/components/recently-deleted/search-params.ts
@@ -9,6 +9,7 @@ export const RECENTLY_DELETED_TABS = [
   'table',
   'knowledge',
   'file',
+  'chat',
 ] as const
 
 export type RecentlyDeletedTab = (typeof RECENTLY_DELETED_TABS)[number]
diff --git a/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/components/deploy-modal/components/chat/chat.tsx b/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/components/deploy-modal/components/chat/chat.tsx
index 43b1ea42d11..2d2f1d44b14 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/components/deploy-modal/components/chat/chat.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/components/deploy-modal/components/chat/chat.tsx
@@ -33,6 +33,7 @@ import {
   useUpdateChat,
 } from '@/hooks/queries/chats'
 import type { ChatDetail } from '@/hooks/queries/deployments'
+import { usePermissionConfig } from '@/hooks/use-permission-config'
 import { useIdentifierValidation } from './hooks'
 import {
   getPasswordHelperText,
@@ -371,6 +372,7 @@ export function ChatDeploy({
           <AuthSelector
             key={`${existingChat?.id ?? 'new'}-${formInitCounter}`}
             authType={formData.authType}
+            savedAuthType={existingChat?.authType as AuthType | undefined}
             password={formData.password}
             emails={formData.emails}
             onAuthTypeChange={(type) => updateField('authType', type)}
@@ -583,6 +585,8 @@ function IdentifierInput({
 
 interface AuthSelectorProps {
   authType: AuthType
+  /** The persisted mode of an existing chat, kept selectable even if newly disallowed. */
+  savedAuthType?: AuthType
   password: string
   emails: string[]
   onAuthTypeChange: (type: AuthType) => void
@@ -602,6 +606,7 @@ const AUTH_LABELS: Record<AuthType, string> = {
 
 function AuthSelector({
   authType,
+  savedAuthType,
   password,
   emails,
   onAuthTypeChange,
@@ -671,10 +676,26 @@ function AuthSelector({
     }
   }
 
-  const ssoEnabled = isTruthy(getEnv('NEXT_PUBLIC_SSO_ENABLED'))
-  const authOptions = ssoEnabled
-    ? (['public', 'password', 'email', 'sso'] as const)
-    : (['public', 'password', 'email'] as const)
+  const { config: permissionConfig } = usePermissionConfig()
+  const allowedAuthTypes = permissionConfig.allowedChatDeployAuthTypes
+
+  const ssoAvailable =
+    isTruthy(getEnv('NEXT_PUBLIC_SSO_ENABLED')) ||
+    savedAuthType === 'sso' ||
+    (allowedAuthTypes?.includes('sso') ?? false)
+  const baseAuthOptions: AuthType[] = ssoAvailable
+    ? ['public', 'password', 'email', 'sso']
+    : ['public', 'password', 'email']
+
+  const authOptions = baseAuthOptions.filter(
+    (type) => allowedAuthTypes === null || allowedAuthTypes.includes(type) || type === savedAuthType
+  )
+
+  useEffect(() => {
+    if (authOptions.length > 0 && !authOptions.includes(authType)) {
+      onAuthTypeChange(authOptions[0])
+    }
+  }, [authOptions, authType, onAuthTypeChange])
 
   return (
     <div className='space-y-4'>
diff --git a/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/components/deploy-modal/deploy-modal.tsx b/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/components/deploy-modal/deploy-modal.tsx
index 3af6d13baf0..aa33d96cc92 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/components/deploy-modal/deploy-modal.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/components/deploy-modal/deploy-modal.tsx
@@ -32,7 +32,6 @@ import {
   releaseDeployAction,
   tryAcquireDeployAction,
 } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/hooks/deploy-action-lock'
-import { syncLocalDraftFromServer } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/hooks/sync-local-draft'
 import type { DeployReadiness } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/hooks/use-deploy-readiness'
 import { runPreDeployChecks } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/hooks/use-predeploy-checks'
 import { normalizeName, startsWithUuid } from '@/executor/constants'
@@ -52,6 +51,7 @@ import { useWorkspaceSettings } from '@/hooks/queries/workspace'
 import { usePermissionConfig } from '@/hooks/use-permission-config'
 import { useSettingsNavigation } from '@/hooks/use-settings-navigation'
 import { useWorkflowRegistry } from '@/stores/workflows/registry/store'
+import { syncLocalDraftFromServer } from '@/stores/workflows/sync-local-draft'
 import { mergeSubblockState } from '@/stores/workflows/utils'
 import { useWorkflowStore } from '@/stores/workflows/workflow/store'
 import type { WorkflowState } from '@/stores/workflows/workflow/types'
diff --git a/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/hooks/sync-local-draft.test.ts b/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/hooks/sync-local-draft.test.ts
deleted file mode 100644
index 6abc9a694d0..00000000000
--- a/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/hooks/sync-local-draft.test.ts
+++ /dev/null
@@ -1,246 +0,0 @@
-/**
- * @vitest-environment node
- */
-import { beforeEach, describe, expect, it, vi } from 'vitest'
-
-const {
-  mockRequestJson,
-  mockApplyWorkflowStateToStores,
-  mockGetRegistryState,
-  mockHasPendingOperations,
-  mockGetOperationQueueState,
-  mockGetWorkflowDiffState,
-} = vi.hoisted(() => ({
-  mockRequestJson: vi.fn(),
-  mockApplyWorkflowStateToStores: vi.fn(),
-  mockGetRegistryState: vi.fn(() => ({ activeWorkflowId: 'workflow-a' })),
-  mockHasPendingOperations: vi.fn(() => false),
-  mockGetOperationQueueState: vi.fn(() => ({
-    hasPendingOperations: mockHasPendingOperations,
-    workflowOperationVersions: {},
-  })),
-  mockGetWorkflowDiffState: vi.fn(() => ({
-    hasActiveDiff: false,
-    pendingExternalUpdates: {},
-    reconcilingWorkflows: {},
-    reconciliationErrors: {},
-    remoteUpdateVersions: {},
-  })),
-}))
-
-vi.mock('@/lib/api/client/request', () => ({
-  requestJson: mockRequestJson,
-}))
-
-vi.mock('@/lib/api/contracts', () => ({
-  getWorkflowStateContract: {},
-}))
-
-vi.mock('@/stores/workflow-diff/utils', () => ({
-  applyWorkflowStateToStores: mockApplyWorkflowStateToStores,
-}))
-
-vi.mock('@/stores/workflow-diff/store', () => ({
-  useWorkflowDiffStore: {
-    getState: mockGetWorkflowDiffState,
-  },
-}))
-
-vi.mock('@/stores/operation-queue/store', () => ({
-  useOperationQueueStore: {
-    getState: mockGetOperationQueueState,
-  },
-}))
-
-vi.mock('@/stores/workflows/registry/store', () => ({
-  useWorkflowRegistry: {
-    getState: mockGetRegistryState,
-  },
-}))
-
-import { syncLocalDraftFromServer } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/hooks/sync-local-draft'
-
-describe('syncLocalDraftFromServer', () => {
-  beforeEach(() => {
-    vi.clearAllMocks()
-    mockGetRegistryState.mockReturnValue({ activeWorkflowId: 'workflow-a' })
-    mockHasPendingOperations.mockReturnValue(false)
-    mockGetOperationQueueState.mockImplementation(() => ({
-      hasPendingOperations: mockHasPendingOperations,
-      workflowOperationVersions: {},
-    }))
-    mockGetWorkflowDiffState.mockReturnValue({
-      hasActiveDiff: false,
-      pendingExternalUpdates: {},
-      reconcilingWorkflows: {},
-      reconciliationErrors: {},
-      remoteUpdateVersions: {},
-    })
-  })
-
-  it('hydrates sibling workflow variables into the applied workflow state', async () => {
-    mockRequestJson.mockResolvedValue({
-      data: {
-        state: {
-          blocks: {},
-          edges: [],
-          loops: {},
-          parallels: {},
-          lastSaved: 1,
-        },
-        variables: {
-          'variable-a': {
-            id: 'variable-a',
-            name: 'API_KEY',
-            type: 'plain',
-            value: 'secret',
-          },
-        },
-      },
-    })
-
-    await expect(syncLocalDraftFromServer('workflow-a')).resolves.toBe(true)
-
-    expect(mockApplyWorkflowStateToStores).toHaveBeenCalledWith(
-      'workflow-a',
-      expect.objectContaining({
-        variables: {
-          'variable-a': {
-            id: 'variable-a',
-            name: 'API_KEY',
-            type: 'plain',
-            value: 'secret',
-          },
-        },
-      }),
-      { updateLastSaved: true }
-    )
-  })
-
-  it('does not apply a fetched draft after navigation changes the active workflow', async () => {
-    mockGetRegistryState
-      .mockReturnValueOnce({ activeWorkflowId: 'workflow-a' })
-      .mockReturnValueOnce({ activeWorkflowId: 'workflow-b' })
-    mockRequestJson.mockResolvedValue({
-      data: {
-        state: {
-          blocks: {},
-          edges: [],
-          loops: {},
-          parallels: {},
-          lastSaved: 1,
-        },
-        variables: {},
-      },
-    })
-
-    await expect(syncLocalDraftFromServer('workflow-a')).resolves.toBe(false)
-
-    expect(mockApplyWorkflowStateToStores).not.toHaveBeenCalled()
-  })
-
-  it('does not synthesize an empty variables object when the server omits variables', async () => {
-    mockRequestJson.mockResolvedValue({
-      data: {
-        state: {
-          blocks: {},
-          edges: [],
-          loops: {},
-          parallels: {},
-          lastSaved: 1,
-        },
-      },
-    })
-
-    await expect(syncLocalDraftFromServer('workflow-a')).resolves.toBe(true)
-
-    const appliedState = mockApplyWorkflowStateToStores.mock.calls[0][1]
-    expect(Object.hasOwn(appliedState, 'variables')).toBe(false)
-  })
-
-  it('does not apply a fetched draft over newly queued local operations', async () => {
-    mockHasPendingOperations.mockReturnValueOnce(false).mockReturnValueOnce(true)
-    mockRequestJson.mockResolvedValue({
-      data: {
-        state: {
-          blocks: {},
-          edges: [],
-          loops: {},
-          parallels: {},
-          lastSaved: 1,
-        },
-        variables: {},
-      },
-    })
-
-    await expect(syncLocalDraftFromServer('workflow-a')).resolves.toBe(false)
-
-    expect(mockApplyWorkflowStateToStores).not.toHaveBeenCalled()
-  })
-
-  it('does not apply a fetched draft when a newer remote update arrives during fetch', async () => {
-    mockGetWorkflowDiffState
-      .mockReturnValueOnce({
-        hasActiveDiff: false,
-        pendingExternalUpdates: {},
-        reconcilingWorkflows: {},
-        reconciliationErrors: {},
-        remoteUpdateVersions: {},
-      })
-      .mockReturnValueOnce({
-        hasActiveDiff: false,
-        pendingExternalUpdates: {},
-        reconcilingWorkflows: {},
-        reconciliationErrors: {},
-        remoteUpdateVersions: { 'workflow-a': 1 },
-      })
-    mockRequestJson.mockResolvedValue({
-      data: {
-        state: {
-          blocks: {},
-          edges: [],
-          loops: {},
-          parallels: {},
-          lastSaved: 1,
-        },
-        variables: {},
-      },
-    })
-
-    await expect(syncLocalDraftFromServer('workflow-a')).resolves.toBe(false)
-
-    expect(mockApplyWorkflowStateToStores).not.toHaveBeenCalled()
-  })
-
-  it('does not apply a fetched draft when local operations queue and drain during fetch', async () => {
-    mockGetOperationQueueState
-      .mockReturnValueOnce({
-        hasPendingOperations: mockHasPendingOperations,
-        workflowOperationVersions: {},
-      })
-      .mockReturnValueOnce({
-        hasPendingOperations: mockHasPendingOperations,
-        workflowOperationVersions: {},
-      })
-      .mockReturnValueOnce({
-        hasPendingOperations: mockHasPendingOperations,
-        workflowOperationVersions: { 'workflow-a': 1 },
-      })
-    mockRequestJson.mockResolvedValue({
-      data: {
-        state: {
-          blocks: {},
-          edges: [],
-          loops: {},
-          parallels: {},
-          lastSaved: 1,
-        },
-        variables: {},
-      },
-    })
-
-    await expect(syncLocalDraftFromServer('workflow-a')).resolves.toBe(false)
-
-    expect(mockApplyWorkflowStateToStores).not.toHaveBeenCalled()
-  })
-})
diff --git a/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/hooks/sync-local-draft.ts b/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/hooks/sync-local-draft.ts
deleted file mode 100644
index ad308ee549c..00000000000
--- a/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/hooks/sync-local-draft.ts
+++ /dev/null
@@ -1,59 +0,0 @@
-import { requestJson } from '@/lib/api/client/request'
-import { getWorkflowStateContract } from '@/lib/api/contracts'
-import { useOperationQueueStore } from '@/stores/operation-queue/store'
-import { useWorkflowDiffStore } from '@/stores/workflow-diff/store'
-import { applyWorkflowStateToStores } from '@/stores/workflow-diff/utils'
-import { useWorkflowRegistry } from '@/stores/workflows/registry/store'
-import type { WorkflowState } from '@/stores/workflows/workflow/types'
-
-function canApplyServerSnapshot(
-  workflowId: string,
-  remoteVersionAtStart: number,
-  localOperationVersionAtStart: number
-): boolean {
-  if (useWorkflowRegistry.getState().activeWorkflowId !== workflowId) return false
-  const operationQueueState = useOperationQueueStore.getState()
-  if (operationQueueState.hasPendingOperations(workflowId)) return false
-  if (
-    (operationQueueState.workflowOperationVersions[workflowId] ?? 0) !==
-    localOperationVersionAtStart
-  ) {
-    return false
-  }
-
-  const diffState = useWorkflowDiffStore.getState()
-  return (
-    !diffState.hasActiveDiff &&
-    !diffState.pendingExternalUpdates[workflowId] &&
-    !diffState.reconcilingWorkflows[workflowId] &&
-    !diffState.reconciliationErrors[workflowId] &&
-    (diffState.remoteUpdateVersions[workflowId] ?? 0) === remoteVersionAtStart
-  )
-}
-
-export async function syncLocalDraftFromServer(workflowId: string): Promise<boolean> {
-  if (useWorkflowRegistry.getState().activeWorkflowId !== workflowId) return false
-  if (useOperationQueueStore.getState().hasPendingOperations(workflowId)) return false
-  const localOperationVersionAtStart =
-    useOperationQueueStore.getState().workflowOperationVersions[workflowId] ?? 0
-  const remoteVersionAtStart = useWorkflowDiffStore.getState().remoteUpdateVersions[workflowId] ?? 0
-
-  const responseData = await requestJson(getWorkflowStateContract, {
-    params: { id: workflowId },
-  })
-  const wireState = responseData.data?.state
-  if (!canApplyServerSnapshot(workflowId, remoteVersionAtStart, localOperationVersionAtStart)) {
-    return false
-  }
-  if (!wireState) {
-    throw new Error('No workflow state was returned while syncing the local draft')
-  }
-
-  // double-cast-allowed: workflowStateSchema is a wire supertype; normalized workflow state is persisted in store-compatible shape
-  const workflowState = wireState as unknown as WorkflowState
-  if (Object.hasOwn(responseData.data, 'variables')) {
-    workflowState.variables = responseData.data.variables || {}
-  }
-  applyWorkflowStateToStores(workflowId, workflowState, { updateLastSaved: true })
-  return true
-}
diff --git a/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/hooks/use-deployment.ts b/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/hooks/use-deployment.ts
index d0e0b867bfe..4909fd4e467 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/hooks/use-deployment.ts
+++ b/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/hooks/use-deployment.ts
@@ -5,10 +5,10 @@ import { toError } from '@sim/utils/errors'
 import { runPreDeployChecks } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/hooks/use-predeploy-checks'
 import { useDeployWorkflow } from '@/hooks/queries/deployments'
 import { useWorkflowRegistry } from '@/stores/workflows/registry/store'
+import { syncLocalDraftFromServer } from '@/stores/workflows/sync-local-draft'
 import { mergeSubblockState } from '@/stores/workflows/utils'
 import { useWorkflowStore } from '@/stores/workflows/workflow/store'
 import { releaseDeployAction, tryAcquireDeployAction } from './deploy-action-lock'
-import { syncLocalDraftFromServer } from './sync-local-draft'
 import type { DeployReadiness } from './use-deploy-readiness'
 
 const logger = createLogger('UseDeployment')
diff --git a/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/credential-selector/credential-selector.tsx b/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/credential-selector/credential-selector.tsx
index c30f39fc074..8611bf7ac72 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/credential-selector/credential-selector.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/credential-selector/credential-selector.tsx
@@ -1,7 +1,7 @@
 'use client'
 
 import { useCallback, useMemo, useState } from 'react'
-import { Button, Combobox } from '@sim/emcn'
+import { Button, Combobox, type ComboboxOptionGroup } from '@sim/emcn'
 import { ExternalLink, KeyRound } from 'lucide-react'
 import { useParams } from 'next/navigation'
 import { consumeOAuthReturnContext, writeOAuthReturnContext } from '@/lib/credentials/client-state'
@@ -18,7 +18,6 @@ import {
   ConnectServiceAccountModal,
   type ServiceAccountProviderId,
 } from '@/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal'
-import { ConnectSlackBotModal } from '@/app/workspace/[workspaceId]/integrations/components/connect-slack-bot-modal/connect-slack-bot-modal'
 import { formatDisplayText } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/formatted-text'
 import { getWorkflowSearchLabelHighlight } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/workflow-search-highlight'
 import { useDependsOnGate } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-depends-on-gate'
@@ -53,8 +52,7 @@ export function CredentialSelector({
   const workspaceId = (params?.workspaceId as string) || ''
   const [showConnectModal, setShowConnectModal] = useState(false)
   const [showOAuthModal, setShowOAuthModal] = useState(false)
-  const [showSlackBotModal, setShowSlackBotModal] = useState(false)
-  const [showServiceAccountModal, setShowServiceAccountModal] = useState(false)
+  const [showSetupModal, setShowSetupModal] = useState(false)
   const [editingValue, setEditingValue] = useState('')
   const [isEditing, setIsEditing] = useState(false)
   const activeWorkflowId = useWorkflowRegistry((state) => state.activeWorkflowId)
@@ -104,24 +102,32 @@ export function CredentialSelector({
   const credentialsLoading = isAllCredentials ? allCredentialsLoading : oauthCredentialsLoading
 
   const credentialKind = subBlock.credentialKind
+  const isMergedKinds = credentialKind === 'any'
 
   const credentials = useMemo(() => {
-    // A custom-bot or service-account picker lists only the reusable
-    // service-account credentials, including in trigger mode.
-    if (credentialKind === 'custom-bot' || credentialKind === 'service-account') {
+    // A service-account picker lists only the reusable service-account
+    // credentials, including in trigger mode. A merged ('any') picker lists
+    // OAuth accounts and service accounts together.
+    if (credentialKind === 'service-account') {
       return rawCredentials.filter((cred) => cred.type === 'service_account')
     }
+    if (isMergedKinds) {
+      return rawCredentials
+    }
     return isTriggerMode && !subBlock.allowServiceAccounts
       ? rawCredentials.filter((cred) => cred.type !== 'service_account')
       : rawCredentials
-  }, [rawCredentials, isTriggerMode, credentialKind, subBlock.allowServiceAccounts])
+  }, [rawCredentials, isTriggerMode, credentialKind, isMergedKinds, subBlock.allowServiceAccounts])
 
-  // Resolved service-account provider metadata for the token-paste connect
-  // modal. Gated on `credentialKind` and using the non-throwing lookup so it
-  // never runs (or throws) for the OAuth / custom-bot pickers.
+  // Resolved service-account provider metadata for the setup modal. Gated on
+  // `credentialKind` and using the non-throwing lookup so it never runs (or
+  // throws) for plain OAuth pickers.
   const serviceAccountService = useMemo(
-    () => (credentialKind === 'service-account' ? getServiceConfigByServiceId(serviceId) : null),
-    [credentialKind, serviceId]
+    () =>
+      credentialKind === 'service-account' || isMergedKinds
+        ? getServiceConfigByServiceId(serviceId)
+        : null,
+    [credentialKind, isMergedKinds, serviceId]
   )
 
   const selectedCredential = useMemo(
@@ -198,12 +204,8 @@ export function CredentialSelector({
   )
 
   const handleAddCredential = useCallback(() => {
-    if (credentialKind === 'custom-bot') {
-      setShowSlackBotModal(true)
-      return
-    }
     if (credentialKind === 'service-account') {
-      setShowServiceAccountModal(true)
+      setShowSetupModal(true)
       return
     }
     setShowConnectModal(true)
@@ -239,6 +241,7 @@ export function CredentialSelector({
       const oauthCredentials = allWorkspaceCredentials.filter((c) => c.type === 'oauth')
       return oauthCredentials.map((cred) => ({ label: cred.displayName, value: cred.id }))
     }
+    if (isMergedKinds) return []
 
     const options = credentials.map((cred) => ({
       label: cred.name,
@@ -248,17 +251,14 @@ export function CredentialSelector({
 
     options.push({
       label:
-        credentialKind === 'custom-bot'
-          ? credentials.length > 0
-            ? 'Connect another custom bot'
-            : 'Set up a custom bot'
-          : credentialKind === 'service-account'
-            ? credentials.length > 0
+        credentialKind === 'service-account'
+          ? (subBlock.credentialLabels?.serviceAccountConnect ??
+            (credentials.length > 0
               ? `Add another ${getProviderName(provider)} key`
-              : `Add ${getProviderName(provider)} key`
-            : credentials.length > 0
-              ? `Connect another ${getProviderName(provider)} account`
-              : `Connect ${getProviderName(provider)} account`,
+              : `Add ${getProviderName(provider)} key`))
+          : credentials.length > 0
+            ? `Connect another ${getProviderName(provider)} account`
+            : `Connect ${getProviderName(provider)} account`,
       value: '__connect_account__',
       iconElement: <ExternalLink className='size-3' />,
     })
@@ -266,9 +266,54 @@ export function CredentialSelector({
     return options
   }, [
     isAllCredentials,
+    isMergedKinds,
     allWorkspaceCredentials,
     credentials,
     credentialKind,
+    subBlock.credentialLabels,
+    provider,
+    getProviderIcon,
+    getProviderName,
+  ])
+
+  const comboboxGroups = useMemo<ComboboxOptionGroup[] | undefined>(() => {
+    if (!isMergedKinds) return undefined
+
+    const labels = subBlock.credentialLabels
+    const toOption = (cred: (typeof credentials)[number]) => ({
+      label: cred.name,
+      value: cred.id,
+      iconElement: getProviderIcon((cred.provider ?? provider) as OAuthProvider),
+    })
+
+    return [
+      {
+        section: labels?.oauthGroup ?? `${getProviderName(provider)} accounts`,
+        items: [
+          ...credentials.filter((c) => c.type !== 'service_account').map(toOption),
+          {
+            label: labels?.oauthConnect ?? `Connect ${getProviderName(provider)} account`,
+            value: '__connect_account__',
+            iconElement: <ExternalLink className='size-3' />,
+          },
+        ],
+      },
+      {
+        section: labels?.serviceAccountGroup ?? 'Service accounts',
+        items: [
+          ...credentials.filter((c) => c.type === 'service_account').map(toOption),
+          {
+            label: labels?.serviceAccountConnect ?? `Add ${getProviderName(provider)} key`,
+            value: '__connect_service_account__',
+            iconElement: <ExternalLink className='size-3' />,
+          },
+        ],
+      },
+    ]
+  }, [
+    isMergedKinds,
+    subBlock.credentialLabels,
+    credentials,
     provider,
     getProviderIcon,
     getProviderName,
@@ -320,9 +365,17 @@ export function CredentialSelector({
   const handleComboboxChange = useCallback(
     (value: string) => {
       if (value === '__connect_account__') {
+        if (isMergedKinds) {
+          setShowConnectModal(true)
+          return
+        }
         handleAddCredential()
         return
       }
+      if (value === '__connect_service_account__') {
+        setShowSetupModal(true)
+        return
+      }
 
       const matchedCred = (
         isAllCredentials ? allWorkspaceCredentials.filter((c) => c.type === 'oauth') : credentials
@@ -335,13 +388,21 @@ export function CredentialSelector({
       setIsEditing(true)
       setEditingValue(value)
     },
-    [isAllCredentials, allWorkspaceCredentials, credentials, handleAddCredential, handleSelect]
+    [
+      isAllCredentials,
+      isMergedKinds,
+      allWorkspaceCredentials,
+      credentials,
+      handleAddCredential,
+      handleSelect,
+    ]
   )
 
   return (
     <div>
       <Combobox
         options={comboboxOptions}
+        groups={comboboxGroups}
         value={displayValue}
         selectedValue={selectedId}
         onChange={handleComboboxChange}
@@ -350,8 +411,10 @@ export function CredentialSelector({
           hasDependencies && !depsSatisfied ? 'Fill in required fields above first' : label
         }
         disabled={effectiveDisabled}
-        editable={true}
-        filterOptions={true}
+        editable={!isMergedKinds}
+        filterOptions={!isMergedKinds}
+        searchable={isMergedKinds}
+        searchPlaceholder='Search credentials...'
         isLoading={credentialsLoading}
         overlayContent={overlayContent}
         className={overlayContent ? 'pl-7' : ''}
@@ -371,7 +434,7 @@ export function CredentialSelector({
                 workflowId: activeWorkflowId || '',
                 displayName: selectedCredential?.name ?? getProviderName(provider),
                 providerId: effectiveProviderId,
-                preCount: credentials.length,
+                preCount: credentials.filter((c) => c.type !== 'service_account').length,
                 workspaceId,
                 requestedAt: Date.now(),
               })
@@ -417,22 +480,10 @@ export function CredentialSelector({
         />
       )}
 
-      {showSlackBotModal && (
-        <ConnectSlackBotModal
-          open={showSlackBotModal}
-          onOpenChange={setShowSlackBotModal}
-          workspaceId={workspaceId}
-          onCreated={(newCredentialId) => {
-            setStoreValue(newCredentialId)
-            refetchCredentials()
-          }}
-        />
-      )}
-
-      {showServiceAccountModal && serviceAccountService?.serviceAccountProviderId && (
+      {showSetupModal && serviceAccountService?.serviceAccountProviderId && (
         <ConnectServiceAccountModal
-          open={showServiceAccountModal}
-          onOpenChange={setShowServiceAccountModal}
+          open={showSetupModal}
+          onOpenChange={setShowSetupModal}
           workspaceId={workspaceId}
           serviceAccountProviderId={
             serviceAccountService.serviceAccountProviderId as ServiceAccountProviderId
diff --git a/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/tool-input/tool-input.tsx b/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/tool-input/tool-input.tsx
index a64d37b25c7..a4a937a5e27 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/tool-input/tool-input.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/tool-input/tool-input.tsx
@@ -61,6 +61,7 @@ import {
   useActiveSearchTarget,
 } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/providers/active-search-target-provider'
 import { getAllBlocks, getBlock } from '@/blocks'
+import { isCustomBlockType } from '@/blocks/custom/build-config'
 import { useCustomBlockOverlayVersion } from '@/blocks/custom/client-overlay'
 import { getTileIconColorClass } from '@/blocks/icon-color'
 import type { SubBlockConfig as BlockSubBlockConfig } from '@/blocks/types'
@@ -761,7 +762,9 @@ export const ToolInput = memo(function ToolInput({
     if (hasMultipleOperations(blockType)) {
       return false
     }
-    if (blockType === 'workflow' || blockType === 'knowledge') {
+    // Custom blocks all share toolId `workflow_executor`, so dedup-by-toolId would
+    // block a second (distinct) custom block — allow multiple like workflow/knowledge.
+    if (blockType === 'workflow' || blockType === 'knowledge' || isCustomBlockType(blockType)) {
       return false
     }
     return selectedTools.some((tool) => tool.toolId === toolId)
@@ -799,12 +802,12 @@ export const ToolInput = memo(function ToolInput({
       const operationOptions = hasOperations ? getOperationOptions(toolBlock.type) : []
       const defaultOperation = operationOptions.length > 0 ? operationOptions[0].id : undefined
 
-      const toolId = getToolIdForOperation(toolBlock.type, defaultOperation)
+      const toolId = getToolIdForOperation(toolBlock.type, defaultOperation, toolBlock)
       if (!toolId) return
 
       if (isToolAlreadySelected(toolId, toolBlock.type)) return
 
-      const toolParams = getToolParametersConfig(toolId, toolBlock.type)
+      const toolParams = getToolParametersConfig(toolId, toolBlock.type, undefined, toolBlock)
       if (!toolParams) return
 
       const initialParams: Record<string, string> = {}
@@ -1002,7 +1005,7 @@ export const ToolInput = memo(function ToolInput({
 
       const tool = selectedTools[toolIndex]
 
-      const newToolId = getToolIdForOperation(tool.type, operation)
+      const newToolId = getToolIdForOperation(tool.type, operation, getBlock(tool.type))
 
       if (!newToolId) {
         return
@@ -1589,7 +1592,7 @@ export const ToolInput = memo(function ToolInput({
       groups.push({
         section: 'Built-in Tools',
         items: builtInTools.map((block) => {
-          const toolId = getToolIdForOperation(block.type, undefined)
+          const toolId = getToolIdForOperation(block.type, undefined, block)
           const alreadySelected = toolId ? isToolAlreadySelected(toolId, block.type) : false
           return {
             label: block.name,
@@ -1606,7 +1609,7 @@ export const ToolInput = memo(function ToolInput({
       groups.push({
         section: 'Integrations',
         items: integrations.map((block) => {
-          const toolId = getToolIdForOperation(block.type, undefined)
+          const toolId = getToolIdForOperation(block.type, undefined, block)
           const alreadySelected = toolId ? isToolAlreadySelected(toolId, block.type) : false
           return {
             label: block.name,
@@ -1705,15 +1708,22 @@ export const ToolInput = memo(function ToolInput({
 
           const currentToolId =
             !isCustomTool && !isMcpTool
-              ? getToolIdForOperation(tool.type, tool.operation) || tool.toolId || ''
+              ? getToolIdForOperation(tool.type, tool.operation, toolBlock ?? undefined) ||
+                tool.toolId ||
+                ''
               : tool.toolId || ''
 
           const toolParams =
             !isCustomTool && !isMcpTool && currentToolId
-              ? getToolParametersConfig(currentToolId, tool.type, {
-                  operation: tool.operation,
-                  ...tool.params,
-                })
+              ? getToolParametersConfig(
+                  currentToolId,
+                  tool.type,
+                  {
+                    operation: tool.operation,
+                    ...tool.params,
+                  },
+                  toolBlock ?? undefined
+                )
               : null
 
           const toolScopedOverrides = scopeCanonicalModesForTool(
@@ -1731,7 +1741,8 @@ export const ToolInput = memo(function ToolInput({
                     operation: tool.operation,
                     ...tool.params,
                   },
-                  toolScopedOverrides
+                  toolScopedOverrides,
+                  toolBlock ?? undefined
                 )
               : null
 
diff --git a/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/sub-block.tsx b/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/sub-block.tsx
index e8752f0c4aa..a860fcfcc33 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/sub-block.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/sub-block.tsx
@@ -56,11 +56,13 @@ import { useWebhookManagement } from '@/hooks/use-webhook-management'
 
 const SLACK_OVERRIDES: SelectorOverrides = {
   transformContext: (context, deps) => {
+    // v1 gates on authMethod (raw bot token vs OAuth); v2 has one merged
+    // credential field for actions and customBotCredential for triggers.
     const authMethod = deps.authMethod as string
     const oauthCredential =
       authMethod === 'bot_token'
-        ? String(deps.customBotCredential ?? deps.botToken ?? '')
-        : String(deps.credential ?? deps.customBotCredential ?? deps.triggerCredentials ?? '')
+        ? String(deps.botToken ?? '')
+        : String(deps.credential ?? deps.customBotCredential ?? '')
     return { ...context, oauthCredential }
   },
 }
diff --git a/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/workflow-block/workflow-block.tsx b/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/workflow-block/workflow-block.tsx
index 8d9a4fb85e0..4794bd82128 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/workflow-block/workflow-block.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/workflow-block/workflow-block.tsx
@@ -66,7 +66,7 @@ import { useTablesList } from '@/hooks/queries/tables'
 import { useWorkflowMap } from '@/hooks/queries/workflows'
 import { useReactiveConditions } from '@/hooks/use-reactive-conditions'
 import { useSelectorDisplayName } from '@/hooks/use-selector-display-name'
-import { isModelDeprecated } from '@/providers/models'
+import { getModelSunsetStatus } from '@/providers/models'
 import { useVariablesStore } from '@/stores/variables/store'
 import { useSubBlockStore } from '@/stores/workflows/subblock/store'
 import { useWorkflowStore } from '@/stores/workflows/workflow/store'
@@ -132,12 +132,23 @@ function getBlockSunset(
     }
   }
 
-  if (typeof model === 'string' && isModelDeprecated(model)) {
-    return {
-      status: 'legacy',
-      kind: 'model',
-      tooltip: `${model} is deprecated. Click to upgrade`,
-      prompt: `The "${name}" block uses the deprecated model "${model}". Switch it to the latest equivalent model.`,
+  if (typeof model === 'string') {
+    const modelStatus = getModelSunsetStatus(model)
+    if (modelStatus === 'deprecated') {
+      return {
+        status: 'deprecated',
+        kind: 'model',
+        tooltip: `${model} is no longer available. Click to switch models`,
+        prompt: `The "${name}" block uses "${model}", which the provider has retired — calls to it now fail. Switch it to the latest equivalent model.`,
+      }
+    }
+    if (modelStatus === 'legacy') {
+      return {
+        status: 'legacy',
+        kind: 'model',
+        tooltip: `${model} is a legacy model. Click to upgrade`,
+        prompt: `The "${name}" block uses the legacy model "${model}". Switch it to the latest equivalent model.`,
+      }
     }
   }
 
diff --git a/apps/sim/app/workspace/[workspaceId]/w/components/preview/components/preview-workflow/components/block/block.tsx b/apps/sim/app/workspace/[workspaceId]/w/components/preview/components/preview-workflow/components/block/block.tsx
index c28f99bbc8b..25dfd5d309e 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/components/preview/components/preview-workflow/components/block/block.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/components/preview/components/preview-workflow/components/block/block.tsx
@@ -146,7 +146,7 @@ const SubBlockRow = memo(function SubBlockRow({
   const displayValue = maskedValue || hydratedName || (isSelectorType && value ? '-' : value)
 
   return (
-    <div className='flex items-center gap-2'>
+    <div className='flex h-5 items-center gap-2'>
       <span
         className='min-w-0 truncate text-[var(--text-tertiary)] text-sm capitalize'
         title={title}
diff --git a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/components/command-items/command-items.tsx b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/components/command-items/command-items.tsx
index 315422c6ce0..39b7f75d312 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/components/command-items/command-items.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/components/command-items/command-items.tsx
@@ -6,56 +6,9 @@ import { cn } from '@sim/emcn'
 import { File, Workflow } from '@sim/emcn/icons'
 import { Command } from 'cmdk'
 import type { CommandItemProps } from '@/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/utils'
-import {
-  COMMAND_ITEM_CLASSNAME,
-  fuzzyMatch,
-} from '@/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/utils'
+import { COMMAND_ITEM_CLASSNAME } from '@/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/utils'
 import { getTileIconColorClass } from '@/blocks/icon-color'
 
-interface Segment {
-  text: string
-  hit: boolean
-}
-
-function buildSegments(text: string, positions: readonly number[]): Segment[] {
-  const hits = new Set(positions)
-  const segments: Segment[] = []
-  for (let i = 0; i < text.length; i++) {
-    const hit = hits.has(i)
-    const last = segments[segments.length - 1]
-    if (last && last.hit === hit) last.text += text[i]
-    else segments.push({ text: text[i], hit })
-  }
-  return segments
-}
-
-/**
- * Renders `text` with the characters that match `query` emphasized. Falls back
- * to plain text when there is no query or no positional match against the
- * display text (e.g. the row matched on a hidden id rather than its label).
- */
-export const HighlightedText = memo(
-  function HighlightedText({ text, query }: { text: string; query?: string }) {
-    if (!query) return <>{text}</>
-    const { positions } = fuzzyMatch(text, query)
-    if (positions.length === 0) return <>{text}</>
-    return (
-      <>
-        {buildSegments(text, positions).map((segment, index) =>
-          segment.hit ? (
-            <span key={index} className='font-medium'>
-              {segment.text}
-            </span>
-          ) : (
-            <span key={index}>{segment.text}</span>
-          )
-        )}
-      </>
-    )
-  },
-  (prev, next) => prev.text === next.text && prev.query === next.query
-)
-
 export const MemoizedCommandItem = memo(
   function CommandItem({
     value,
@@ -64,7 +17,6 @@ export const MemoizedCommandItem = memo(
     bgColor,
     showColoredIcon,
     label,
-    query,
   }: CommandItemProps) {
     return (
       <Command.Item value={value} onSelect={onSelect} className={COMMAND_ITEM_CLASSNAME}>
@@ -81,9 +33,7 @@ export const MemoizedCommandItem = memo(
             )}
           />
         </div>
-        <span className='truncate text-[var(--text-body)]'>
-          <HighlightedText text={label} query={query} />
-        </span>
+        <span className='truncate text-[var(--text-body)]'>{label}</span>
       </Command.Item>
     )
   },
@@ -92,8 +42,7 @@ export const MemoizedCommandItem = memo(
     prev.icon === next.icon &&
     prev.bgColor === next.bgColor &&
     prev.showColoredIcon === next.showColoredIcon &&
-    prev.label === next.label &&
-    prev.query === next.query
+    prev.label === next.label
 )
 
 export const MemoizedActionItem = memo(
@@ -103,21 +52,17 @@ export const MemoizedActionItem = memo(
     icon: Icon,
     name,
     shortcut,
-    query,
   }: {
     value: string
     onSelect: () => void
     icon: ComponentType<{ className?: string }>
     name: string
     shortcut?: string
-    query?: string
   }) {
     return (
       <Command.Item value={value} onSelect={onSelect} className={COMMAND_ITEM_CLASSNAME}>
         <Icon className='size-[16px] flex-shrink-0 text-[var(--text-icon)]' />
-        <span className='truncate text-[var(--text-body)]'>
-          <HighlightedText text={name} query={query} />
-        </span>
+        <span className='truncate text-[var(--text-body)]'>{name}</span>
         {shortcut && (
           <span className='ml-auto flex-shrink-0 text-[var(--text-subtle)] text-small'>
             {shortcut}
@@ -130,8 +75,7 @@ export const MemoizedActionItem = memo(
     prev.value === next.value &&
     prev.icon === next.icon &&
     prev.name === next.name &&
-    prev.shortcut === next.shortcut &&
-    prev.query === next.query
+    prev.shortcut === next.shortcut
 )
 
 export const MemoizedWorkflowItem = memo(
@@ -141,14 +85,12 @@ export const MemoizedWorkflowItem = memo(
     name,
     folderPath,
     isCurrent,
-    query,
   }: {
     value: string
     onSelect: () => void
     name: string
     folderPath?: string[]
     isCurrent?: boolean
-    query?: string
   }) {
     return (
       <Command.Item value={value} onSelect={onSelect} className={COMMAND_ITEM_CLASSNAME}>
@@ -156,9 +98,7 @@ export const MemoizedWorkflowItem = memo(
           <Workflow className='size-[14px] text-[var(--text-icon)]' />
         </div>
         <span className='flex min-w-0 max-w-[75%] flex-shrink-0 text-[var(--text-body)]'>
-          <span className='truncate'>
-            <HighlightedText text={name} query={query} />
-          </span>
+          <span className='truncate'>{name}</span>
           {isCurrent && <span className='flex-shrink-0 whitespace-pre'> (current)</span>}
         </span>
         {folderPath && folderPath.length > 0 && (
@@ -181,7 +121,6 @@ export const MemoizedWorkflowItem = memo(
     prev.value === next.value &&
     prev.name === next.name &&
     prev.isCurrent === next.isCurrent &&
-    prev.query === next.query &&
     (prev.folderPath === next.folderPath ||
       (prev.folderPath?.length === next.folderPath?.length &&
         (prev.folderPath ?? []).every((segment, i) => segment === next.folderPath?.[i])))
@@ -193,13 +132,11 @@ export const MemoizedFileItem = memo(
     onSelect,
     name,
     folderPath,
-    query,
   }: {
     value: string
     onSelect: () => void
     name: string
     folderPath?: string[]
-    query?: string
   }) {
     return (
       <Command.Item value={value} onSelect={onSelect} className={COMMAND_ITEM_CLASSNAME}>
@@ -207,9 +144,7 @@ export const MemoizedFileItem = memo(
           <File className='size-[14px] text-[var(--text-icon)]' />
         </div>
         <span className='flex min-w-0 max-w-[75%] flex-shrink-0 font-base text-[var(--text-body)]'>
-          <span className='truncate'>
-            <HighlightedText text={name} query={query} />
-          </span>
+          <span className='truncate'>{name}</span>
         </span>
         {folderPath && folderPath.length > 0 && (
           <span className='ml-auto flex min-w-0 pl-2 font-base text-[var(--text-subtle)] text-small'>
@@ -230,7 +165,6 @@ export const MemoizedFileItem = memo(
   (prev, next) =>
     prev.value === next.value &&
     prev.name === next.name &&
-    prev.query === next.query &&
     (prev.folderPath === next.folderPath ||
       (prev.folderPath?.length === next.folderPath?.length &&
         (prev.folderPath ?? []).every((segment, i) => segment === next.folderPath?.[i])))
@@ -241,22 +175,18 @@ export const MemoizedTaskItem = memo(
     value,
     onSelect,
     name,
-    query,
   }: {
     value: string
     onSelect: () => void
     name: string
-    query?: string
   }) {
     return (
       <Command.Item value={value} onSelect={onSelect} className={COMMAND_ITEM_CLASSNAME}>
-        <span className='truncate text-[var(--text-body)]'>
-          <HighlightedText text={name} query={query} />
-        </span>
+        <span className='truncate text-[var(--text-body)]'>{name}</span>
       </Command.Item>
     )
   },
-  (prev, next) => prev.value === next.value && prev.name === next.name && prev.query === next.query
+  (prev, next) => prev.value === next.value && prev.name === next.name
 )
 
 export const MemoizedWorkspaceItem = memo(
@@ -265,30 +195,23 @@ export const MemoizedWorkspaceItem = memo(
     onSelect,
     name,
     isCurrent,
-    query,
   }: {
     value: string
     onSelect: () => void
     name: string
     isCurrent?: boolean
-    query?: string
   }) {
     return (
       <Command.Item value={value} onSelect={onSelect} className={COMMAND_ITEM_CLASSNAME}>
         <span className='flex min-w-0 text-[var(--text-body)]'>
-          <span className='truncate'>
-            <HighlightedText text={name} query={query} />
-          </span>
+          <span className='truncate'>{name}</span>
           {isCurrent && <span className='flex-shrink-0 whitespace-pre'> (current)</span>}
         </span>
       </Command.Item>
     )
   },
   (prev, next) =>
-    prev.value === next.value &&
-    prev.name === next.name &&
-    prev.isCurrent === next.isCurrent &&
-    prev.query === next.query
+    prev.value === next.value && prev.name === next.name && prev.isCurrent === next.isCurrent
 )
 
 export const MemoizedPageItem = memo(
@@ -298,21 +221,17 @@ export const MemoizedPageItem = memo(
     icon: Icon,
     name,
     shortcut,
-    query,
   }: {
     value: string
     onSelect: () => void
     icon: ComponentType<{ className?: string }>
     name: string
     shortcut?: string
-    query?: string
   }) {
     return (
       <Command.Item value={value} onSelect={onSelect} className={COMMAND_ITEM_CLASSNAME}>
         <Icon className='size-[16px] flex-shrink-0 text-[var(--text-icon)]' />
-        <span className='truncate text-[var(--text-body)]'>
-          <HighlightedText text={name} query={query} />
-        </span>
+        <span className='truncate text-[var(--text-body)]'>{name}</span>
         {shortcut && (
           <span className='ml-auto flex-shrink-0 text-[var(--text-subtle)] text-small'>
             {shortcut}
@@ -325,8 +244,7 @@ export const MemoizedPageItem = memo(
     prev.value === next.value &&
     prev.icon === next.icon &&
     prev.name === next.name &&
-    prev.shortcut === next.shortcut &&
-    prev.query === next.query
+    prev.shortcut === next.shortcut
 )
 
 export const MemoizedIconItem = memo(
@@ -335,26 +253,18 @@ export const MemoizedIconItem = memo(
     onSelect,
     name,
     icon: Icon,
-    query,
   }: {
     value: string
     onSelect: () => void
     name: string
     icon: ComponentType<{ className?: string }>
-    query?: string
   }) {
     return (
       <Command.Item value={value} onSelect={onSelect} className={COMMAND_ITEM_CLASSNAME}>
         <Icon className='size-[16px] flex-shrink-0 text-[var(--text-icon)]' />
-        <span className='truncate text-[var(--text-body)]'>
-          <HighlightedText text={name} query={query} />
-        </span>
+        <span className='truncate text-[var(--text-body)]'>{name}</span>
       </Command.Item>
     )
   },
-  (prev, next) =>
-    prev.value === next.value &&
-    prev.name === next.name &&
-    prev.icon === next.icon &&
-    prev.query === next.query
+  (prev, next) => prev.value === next.value && prev.name === next.name && prev.icon === next.icon
 )
diff --git a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/components/command-items/index.ts b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/components/command-items/index.ts
index 49a29bec4d2..005b06db40f 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/components/command-items/index.ts
+++ b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/components/command-items/index.ts
@@ -1,5 +1,4 @@
 export {
-  HighlightedText,
   MemoizedActionItem,
   MemoizedCommandItem,
   MemoizedFileItem,
diff --git a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/components/search-groups/search-groups.tsx b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/components/search-groups/search-groups.tsx
index 4a6eaed1524..f8e071be9d0 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/components/search-groups/search-groups.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/components/search-groups/search-groups.tsx
@@ -33,11 +33,9 @@ import type {
 export const ActionsGroup = memo(function ActionsGroup({
   items,
   onSelect,
-  query,
 }: {
   items: ActionItem[]
   onSelect: (action: ActionItem) => void
-  query?: string
 }) {
   if (items.length === 0) return null
   return (
@@ -50,7 +48,6 @@ export const ActionsGroup = memo(function ActionsGroup({
           icon={action.icon}
           name={action.name}
           shortcut={action.shortcut}
-          query={query}
         />
       ))}
     </Command.Group>
@@ -60,11 +57,9 @@ export const ActionsGroup = memo(function ActionsGroup({
 export const BlocksGroup = memo(function BlocksGroup({
   items,
   onSelect,
-  query,
 }: {
   items: SearchBlockItem[]
   onSelect: (block: SearchBlockItem) => void
-  query?: string
 }) {
   if (items.length === 0) return null
   return (
@@ -78,7 +73,6 @@ export const BlocksGroup = memo(function BlocksGroup({
           bgColor={block.bgColor}
           showColoredIcon
           label={block.name}
-          query={query}
         />
       ))}
     </Command.Group>
@@ -88,11 +82,9 @@ export const BlocksGroup = memo(function BlocksGroup({
 export const ToolsGroup = memo(function ToolsGroup({
   items,
   onSelect,
-  query,
 }: {
   items: SearchBlockItem[]
   onSelect: (tool: SearchBlockItem) => void
-  query?: string
 }) {
   if (items.length === 0) return null
   return (
@@ -106,7 +98,6 @@ export const ToolsGroup = memo(function ToolsGroup({
           bgColor={tool.bgColor}
           showColoredIcon
           label={tool.name}
-          query={query}
         />
       ))}
     </Command.Group>
@@ -116,11 +107,9 @@ export const ToolsGroup = memo(function ToolsGroup({
 export const TriggersGroup = memo(function TriggersGroup({
   items,
   onSelect,
-  query,
 }: {
   items: SearchBlockItem[]
   onSelect: (trigger: SearchBlockItem) => void
-  query?: string
 }) {
   if (items.length === 0) return null
   return (
@@ -134,7 +123,6 @@ export const TriggersGroup = memo(function TriggersGroup({
           bgColor={trigger.bgColor}
           showColoredIcon
           label={trigger.name}
-          query={query}
         />
       ))}
     </Command.Group>
@@ -144,11 +132,9 @@ export const TriggersGroup = memo(function TriggersGroup({
 export const ToolOpsGroup = memo(function ToolOpsGroup({
   items,
   onSelect,
-  query,
 }: {
   items: SearchToolOperationItem[]
   onSelect: (op: SearchToolOperationItem) => void
-  query?: string
 }) {
   if (items.length === 0) return null
   return (
@@ -162,7 +148,6 @@ export const ToolOpsGroup = memo(function ToolOpsGroup({
           bgColor={op.bgColor}
           showColoredIcon
           label={op.name}
-          query={query}
         />
       ))}
     </Command.Group>
@@ -172,11 +157,9 @@ export const ToolOpsGroup = memo(function ToolOpsGroup({
 export const DocsGroup = memo(function DocsGroup({
   items,
   onSelect,
-  query,
 }: {
   items: SearchDocItem[]
   onSelect: (doc: SearchDocItem) => void
-  query?: string
 }) {
   if (items.length === 0) return null
   return (
@@ -190,7 +173,6 @@ export const DocsGroup = memo(function DocsGroup({
           bgColor='#6B7280'
           showColoredIcon
           label={doc.name}
-          query={query}
         />
       ))}
     </Command.Group>
@@ -200,11 +182,9 @@ export const DocsGroup = memo(function DocsGroup({
 export const WorkflowsGroup = memo(function WorkflowsGroup({
   items,
   onSelect,
-  query,
 }: {
   items: WorkflowItem[]
   onSelect: (workflow: WorkflowItem) => void
-  query?: string
 }) {
   if (items.length === 0) return null
   return (
@@ -217,7 +197,6 @@ export const WorkflowsGroup = memo(function WorkflowsGroup({
           name={workflow.name}
           folderPath={workflow.folderPath}
           isCurrent={workflow.isCurrent}
-          query={query}
         />
       ))}
     </Command.Group>
@@ -227,11 +206,9 @@ export const WorkflowsGroup = memo(function WorkflowsGroup({
 export const ChatsGroup = memo(function ChatsGroup({
   items,
   onSelect,
-  query,
 }: {
   items: TaskItem[]
   onSelect: (task: TaskItem) => void
-  query?: string
 }) {
   if (items.length === 0) return null
   return (
@@ -242,7 +219,6 @@ export const ChatsGroup = memo(function ChatsGroup({
           value={`${task.name} task-${task.id}`}
           onSelect={() => onSelect(task)}
           name={task.name}
-          query={query}
         />
       ))}
     </Command.Group>
@@ -252,11 +228,9 @@ export const ChatsGroup = memo(function ChatsGroup({
 export const WorkspacesGroup = memo(function WorkspacesGroup({
   items,
   onSelect,
-  query,
 }: {
   items: WorkspaceItem[]
   onSelect: (workspace: WorkspaceItem) => void
-  query?: string
 }) {
   if (items.length === 0) return null
   return (
@@ -268,7 +242,6 @@ export const WorkspacesGroup = memo(function WorkspacesGroup({
           onSelect={() => onSelect(workspace)}
           name={workspace.name}
           isCurrent={workspace.isCurrent}
-          query={query}
         />
       ))}
     </Command.Group>
@@ -278,11 +251,9 @@ export const WorkspacesGroup = memo(function WorkspacesGroup({
 export const PagesGroup = memo(function PagesGroup({
   items,
   onSelect,
-  query,
 }: {
   items: PageItem[]
   onSelect: (page: PageItem) => void
-  query?: string
 }) {
   if (items.length === 0) return null
   return (
@@ -295,7 +266,6 @@ export const PagesGroup = memo(function PagesGroup({
           icon={page.icon}
           name={page.name}
           shortcut={page.shortcut}
-          query={query}
         />
       ))}
     </Command.Group>
@@ -311,11 +281,9 @@ export const IntegrationsGroup = createColoredIconGroup('Integrations', 'integra
 export const FilesGroup = memo(function FilesGroup({
   items,
   onSelect,
-  query,
 }: {
   items: FileItem[]
   onSelect: (file: FileItem) => void
-  query?: string
 }) {
   if (items.length === 0) return null
   return (
@@ -327,7 +295,6 @@ export const FilesGroup = memo(function FilesGroup({
           onSelect={() => onSelect(file)}
           name={file.name}
           folderPath={file.folderPath}
-          query={query}
         />
       ))}
     </Command.Group>
@@ -344,11 +311,9 @@ function createColoredIconGroup(heading: string, prefix: string) {
   return memo(function ColoredIconGroup({
     items,
     onSelect,
-    query,
   }: {
     items: IntegrationSearchItem[]
     onSelect: (item: IntegrationSearchItem) => void
-    query?: string
   }) {
     if (items.length === 0) return null
     return (
@@ -362,7 +327,6 @@ function createColoredIconGroup(heading: string, prefix: string) {
             bgColor={item.bgColor}
             showColoredIcon
             label={item.name}
-            query={query}
           />
         ))}
       </Command.Group>
@@ -378,11 +342,9 @@ function createIconGroup(
   return memo(function IconGroup({
     items,
     onSelect,
-    query,
   }: {
     items: TaskItem[]
     onSelect: (item: TaskItem) => void
-    query?: string
   }) {
     if (items.length === 0) return null
     return (
@@ -394,7 +356,6 @@ function createIconGroup(
             onSelect={() => onSelect(item)}
             name={item.name}
             icon={icon}
-            query={query}
           />
         ))}
       </Command.Group>
diff --git a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/search-modal.tsx b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/search-modal.tsx
index ec1dc3e630f..6968fbc91f9 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/search-modal.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/search-modal.tsx
@@ -712,105 +712,53 @@ export function SearchModal({
               </Command.Empty>
 
               {showSection('actions') && (
-                <ActionsGroup
-                  items={filteredActions}
-                  onSelect={handleActionSelect}
-                  query={deferredSearch}
-                />
+                <ActionsGroup items={filteredActions} onSelect={handleActionSelect} />
               )}
               {showSection('connectedAccounts') && (
                 <ConnectedAccountsGroup
                   items={filteredConnectedAccounts}
                   onSelect={handleConnectedAccountSelect}
-                  query={deferredSearch}
                 />
               )}
               {showSection('integrations') && (
                 <IntegrationsGroup
                   items={filteredIntegrations}
                   onSelect={handleIntegrationSelect}
-                  query={deferredSearch}
                 />
               )}
               {showSection('blocks') && (
-                <BlocksGroup
-                  items={filteredBlocks}
-                  onSelect={handleBlockSelectAsBlock}
-                  query={deferredSearch}
-                />
+                <BlocksGroup items={filteredBlocks} onSelect={handleBlockSelectAsBlock} />
               )}
               {showSection('tools') && (
-                <ToolsGroup
-                  items={filteredTools}
-                  onSelect={handleBlockSelectAsTool}
-                  query={deferredSearch}
-                />
+                <ToolsGroup items={filteredTools} onSelect={handleBlockSelectAsTool} />
               )}
               {showSection('triggers') && (
-                <TriggersGroup
-                  items={filteredTriggers}
-                  onSelect={handleBlockSelectAsTrigger}
-                  query={deferredSearch}
-                />
+                <TriggersGroup items={filteredTriggers} onSelect={handleBlockSelectAsTrigger} />
               )}
               {showSection('chats') && (
-                <ChatsGroup
-                  items={filteredChats}
-                  onSelect={handleChatSelect}
-                  query={deferredSearch}
-                />
+                <ChatsGroup items={filteredChats} onSelect={handleChatSelect} />
               )}
               {showSection('workflows') && (
-                <WorkflowsGroup
-                  items={filteredWorkflows}
-                  onSelect={handleWorkflowSelect}
-                  query={deferredSearch}
-                />
+                <WorkflowsGroup items={filteredWorkflows} onSelect={handleWorkflowSelect} />
               )}
               {showSection('tables') && (
-                <TablesGroup
-                  items={filteredTables}
-                  onSelect={handleTableSelect}
-                  query={deferredSearch}
-                />
+                <TablesGroup items={filteredTables} onSelect={handleTableSelect} />
               )}
               {showSection('files') && (
-                <FilesGroup
-                  items={filteredFiles}
-                  onSelect={handleFileSelect}
-                  query={deferredSearch}
-                />
+                <FilesGroup items={filteredFiles} onSelect={handleFileSelect} />
               )}
               {showSection('knowledgeBases') && (
-                <KnowledgeBasesGroup
-                  items={filteredKnowledgeBases}
-                  onSelect={handleKbSelect}
-                  query={deferredSearch}
-                />
+                <KnowledgeBasesGroup items={filteredKnowledgeBases} onSelect={handleKbSelect} />
               )}
               {showSection('toolOperations') && (
-                <ToolOpsGroup
-                  items={filteredToolOps}
-                  onSelect={handleToolOperationSelect}
-                  query={deferredSearch}
-                />
+                <ToolOpsGroup items={filteredToolOps} onSelect={handleToolOperationSelect} />
               )}
               {showSection('workspaces') && (
-                <WorkspacesGroup
-                  items={filteredWorkspaces}
-                  onSelect={handleWorkspaceSelect}
-                  query={deferredSearch}
-                />
-              )}
-              {showSection('docs') && (
-                <DocsGroup items={filteredDocs} onSelect={handleDocSelect} query={deferredSearch} />
+                <WorkspacesGroup items={filteredWorkspaces} onSelect={handleWorkspaceSelect} />
               )}
+              {showSection('docs') && <DocsGroup items={filteredDocs} onSelect={handleDocSelect} />}
               {showSection('pages') && (
-                <PagesGroup
-                  items={filteredPages}
-                  onSelect={handlePageSelect}
-                  query={deferredSearch}
-                />
+                <PagesGroup items={filteredPages} onSelect={handlePageSelect} />
               )}
             </Command.List>
           </Command>
diff --git a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/utils.ts b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/utils.ts
index a9f3fe9dbbe..5b046c31a52 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/utils.ts
+++ b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/utils.ts
@@ -91,10 +91,8 @@ export interface CommandItemProps {
   icon: ComponentType<{ className?: string }>
   bgColor: string
   showColoredIcon?: boolean
-  /** Primary text. Matched characters are highlighted against {@link query}. */
+  /** Primary text of the row. */
   label: string
-  /** Active search query, used to bold matched characters. */
-  query?: string
 }
 
 export const GROUP_HEADING_CLASSNAME =
@@ -181,9 +179,8 @@ function tokenFallback(lowerText: string, lowerQuery: string): FuzzyResult {
  * (`message slack` matches "Slack Send Message") which a strict left-to-right
  * subsequence would miss.
  *
- * Contiguous substring matches report the indices of the substring itself, so
- * highlighting always bolds the run the user actually matched rather than an
- * earlier scattered occurrence of the same characters.
+ * Contiguous substring matches report the indices of the substring itself
+ * rather than an earlier scattered occurrence of the same characters.
  */
 export function fuzzyMatch(text: string, query: string): FuzzyResult {
   if (!query) return { matched: true, score: 1, positions: [] }
diff --git a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workflow-list/components/delete-modal/delete-modal.tsx b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workflow-list/components/delete-modal/delete-modal.tsx
index a2b6d234379..89056077039 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workflow-list/components/delete-modal/delete-modal.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workflow-list/components/delete-modal/delete-modal.tsx
@@ -32,6 +32,9 @@ interface DeleteModalProps {
   itemName?: string | string[]
 }
 
+/** Item types that land in Recently Deleted and can be restored from Settings. */
+const RESTORABLE_TYPES = new Set<string>(['workflow', 'folder', 'mixed', 'task'])
+
 /**
  * Reusable delete confirmation modal for workflow, folder, and workspace items.
  * Displays a warning message and confirmation buttons.
@@ -79,8 +82,6 @@ export function DeleteModal({
     title = 'Delete workspace'
   }
 
-  const restorableTypes = new Set<string>(['workflow', 'folder', 'mixed'])
-
   const buildDescriptionSegments = (): ChipConfirmTextSegment[] => {
     if (itemType === 'workflow') {
       const warning = {
@@ -135,7 +136,7 @@ export function DeleteModal({
 
     if (itemType === 'task') {
       const warning = {
-        text: 'This will permanently remove all conversation history.',
+        text: 'The chat and its conversation history will be archived.',
         error: true,
       }
       if (isMultiple) {
@@ -202,7 +203,7 @@ export function DeleteModal({
       text={[
         ...buildDescriptionSegments(),
         ' ',
-        restorableTypes.has(itemType)
+        RESTORABLE_TYPES.has(itemType)
           ? 'You can restore it from Recently deleted in Settings.'
           : 'This action cannot be undone.',
       ]}
diff --git a/apps/sim/app/workspace/providers/socket-provider.tsx b/apps/sim/app/workspace/providers/socket-provider.tsx
index 9035f519cb9..af6df147547 100644
--- a/apps/sim/app/workspace/providers/socket-provider.tsx
+++ b/apps/sim/app/workspace/providers/socket-provider.tsx
@@ -610,17 +610,35 @@ export function SocketProvider({ children, user }: SocketProviderProps) {
           eventHandlers.current.workflowDeployed?.(data)
         })
 
-        const rehydrateWorkflowStores = async (workflowId: string, workflowState: any) => {
+        /**
+         * DEGRADED-PATH fallback: replaces the workflow + subblock stores with
+         * the raw state pushed by the realtime server. The primary join path is
+         * `syncLocalDraftFromServer`, which fetches MIGRATED state over HTTP —
+         * the realtime server loads state raw, without the app's block
+         * migrations (credential remaps, subblock-id renames, canonicalModes
+         * backfill), because those need the block registry that apps/realtime
+         * cannot import. Applying raw state is acceptable only as a fallback
+         * when the HTTP fetch fails: load-time migrations persist their result
+         * back to the normalized tables (persistMigratedBlocks), so raw state
+         * converges with migrated state after the first migrated load. If that
+         * persistence ever fails repeatedly, raw state diverges from the
+         * migrated deployed snapshot and change detection reports phantom
+         * diffs that survive redeploys (see the exact text-precision
+         * updated_at guard in persistMigratedBlocks).
+         */
+        const applyRawJoinStateFallback = async (workflowId: string, workflowState: any) => {
           const [
             { useOperationQueueStore },
             { useWorkflowRegistry },
             { useWorkflowStore },
             { useSubBlockStore },
+            { useWorkflowDiffStore },
           ] = await Promise.all([
             import('@/stores/operation-queue/store'),
             import('@/stores/workflows/registry/store'),
             import('@/stores/workflows/workflow/store'),
             import('@/stores/workflows/subblock/store'),
+            import('@/stores/workflow-diff/store'),
           ])
 
           const { activeWorkflowId } = useWorkflowRegistry.getState()
@@ -637,6 +655,11 @@ export function SocketProvider({ children, user }: SocketProviderProps) {
             return false
           }
 
+          if (useWorkflowDiffStore.getState().hasActiveDiff) {
+            logger.info('Skipping rehydration - an active diff is in progress')
+            return false
+          }
+
           const subblockValues: Record<string, Record<string, any>> = {}
           Object.entries(workflowState.blocks || {}).forEach(([blockId, block]) => {
             const blockState = block as any
@@ -734,6 +757,17 @@ export function SocketProvider({ children, user }: SocketProviderProps) {
           }
         })
 
+        /**
+         * Join-time state sync. The realtime server can only load RAW workflow
+         * state (no block migrations — see applyRawJoinStateFallback), so the raw
+         * payload is used purely as a trigger and fallback: the stores are
+         * synced from the app's MIGRATED HTTP state via
+         * syncLocalDraftFromServer, which dedupes against an in-flight registry
+         * hydration on the shared query key and refuses to clobber pending
+         * local operations, active diffs, or newer remote updates. Only when
+         * that fetch itself fails does the raw payload get applied, so a
+         * reconnect on a flaky network still recovers to near-current state.
+         */
         socketInstance.on('workflow-state', async (workflowData) => {
           logger.info('Received workflow state from server')
 
@@ -751,10 +785,40 @@ export function SocketProvider({ children, user }: SocketProviderProps) {
           }
 
           if (workflowData?.state) {
+            const { canApplyDraftSnapshot, captureDraftVersions, syncLocalDraftFromServer } =
+              await import('@/stores/workflows/sync-local-draft')
+            const versionsAtJoin = captureDraftVersions(workflowData.id)
+
             try {
-              await rehydrateWorkflowStores(workflowData.id, workflowData.state)
+              const synced = await syncLocalDraftFromServer(workflowData.id)
+              if (!synced) {
+                logger.info('Join-state sync skipped; keeping local state', {
+                  workflowId: workflowData.id,
+                })
+              }
             } catch (error) {
-              logger.error('Error rehydrating workflow state:', error)
+              logger.warn('Join-state sync failed; falling back to raw socket state', { error })
+
+              /**
+               * The raw payload was captured at join time. Anything applied to
+               * the stores while the HTTP sync was failing — local edits,
+               * remote broadcasts, or an external full reload
+               * (workflow-updated / revert) — is newer than the payload, so
+               * applying it would regress those changes. The shared snapshot
+               * guard covers all of those sources.
+               */
+              if (!canApplyDraftSnapshot(workflowData.id, versionsAtJoin)) {
+                logger.info('Skipping raw join-state fallback; stores changed since join', {
+                  workflowId: workflowData.id,
+                })
+                return
+              }
+
+              try {
+                await applyRawJoinStateFallback(workflowData.id, workflowData.state)
+              } catch (rehydrateError) {
+                logger.error('Error rehydrating workflow state:', rehydrateError)
+              }
             }
           }
         })
diff --git a/apps/sim/background/cleanup-soft-deletes.ts b/apps/sim/background/cleanup-soft-deletes.ts
index 4c5a3516825..75e9c42ae20 100644
--- a/apps/sim/background/cleanup-soft-deletes.ts
+++ b/apps/sim/background/cleanup-soft-deletes.ts
@@ -26,7 +26,6 @@ import {
   chunkArray,
   chunkedBatchDelete,
   DEFAULT_DELETE_CHUNK_SIZE,
-  deleteRowsById,
   selectRowsByIdChunks,
 } from '@/lib/cleanup/batch-delete'
 import { prepareChatCleanup } from '@/lib/cleanup/chat-cleanup'
@@ -530,10 +529,11 @@ export async function runCleanupSoftDeletes(payload: CleanupJobPayload): Promise
     `[${label}] Processing ${workspaceIds.length} workspaces, cutoff: ${retentionDate.toISOString()}`
   )
 
-  // Select workflows + files once. These sets drive BOTH external cleanup
-  // (chats + S3) AND the DB deletes below — selecting twice could return
-  // different subsets above the LIMIT cap and orphan or prematurely purge data.
-  const [doomedWorkflows, fileScope] = await Promise.all([
+  // Select workflows + files + soft-deleted chats once. These sets drive BOTH
+  // external cleanup (chats + S3) AND the DB deletes below — selecting twice
+  // could return different subsets above the LIMIT cap and orphan or
+  // prematurely purge data.
+  const [doomedWorkflows, fileScope, expiredSoftDeletedChats] = await Promise.all([
     selectRowsByIdChunks(workspaceIds, (chunkIds, chunkLimit) =>
       db
         .select({ id: workflow.id })
@@ -548,38 +548,91 @@ export async function runCleanupSoftDeletes(payload: CleanupJobPayload): Promise
         .limit(chunkLimit)
     ),
     selectExpiredWorkspaceFiles(workspaceIds, retentionDate),
+    selectRowsByIdChunks(workspaceIds, (chunkIds, chunkLimit) =>
+      db
+        .select({ id: copilotChats.id })
+        .from(copilotChats)
+        .where(
+          and(
+            inArray(copilotChats.workspaceId, chunkIds),
+            isNotNull(copilotChats.deletedAt),
+            lt(copilotChats.deletedAt, retentionDate)
+          )
+        )
+        .limit(chunkLimit)
+    ),
   ])
 
   const doomedWorkflowIds = doomedWorkflows.map((w) => w.id)
+  const softDeletedChatIds = expiredSoftDeletedChats.map((c) => c.id)
   let chatCleanup: { execute: () => Promise<void> } | null = null
 
+  const doomedChatIds = new Set(softDeletedChatIds)
   if (doomedWorkflowIds.length > 0) {
-    const doomedChats = await selectRowsByIdChunks(doomedWorkflowIds, (chunkIds, chunkLimit) =>
+    const workflowChats = await selectRowsByIdChunks(doomedWorkflowIds, (chunkIds, chunkLimit) =>
       db
         .select({ id: copilotChats.id })
         .from(copilotChats)
         .where(inArray(copilotChats.workflowId, chunkIds))
         .limit(chunkLimit)
     )
-
-    const doomedChatIds = doomedChats.map((c) => c.id)
-    if (doomedChatIds.length > 0) {
-      chatCleanup = await prepareChatCleanup(doomedChatIds, label)
+    for (const chat of workflowChats) {
+      doomedChatIds.add(chat.id)
     }
   }
+  if (doomedChatIds.size > 0) {
+    chatCleanup = await prepareChatCleanup([...doomedChatIds], label)
+  }
 
   const fileCleanup = await cleanupWorkspaceFileStorage(fileScope)
 
   let totalDeleted = 0
 
   // Delete the workflow + file rows using the exact IDs we already selected.
-  const workflowResult = await deleteRowsById(
-    workflow,
-    workflow.id,
-    doomedWorkflowIds,
-    `${label}/workflow`
-  )
-  totalDeleted += workflowResult.deleted
+  // Re-check the archive cutoff in the DELETE so a workflow restored between
+  // selection and this point survives — and with it, its chats: their rows are
+  // never cascaded, so chatCleanup.execute()'s row-existence re-check also
+  // spares their backend data and files.
+  for (const batch of chunkArray(doomedWorkflowIds, DEFAULT_DELETE_CHUNK_SIZE)) {
+    try {
+      const deleted = await db
+        .delete(workflow)
+        .where(
+          and(
+            inArray(workflow.id, batch),
+            isNotNull(workflow.archivedAt),
+            lt(workflow.archivedAt, retentionDate)
+          )
+        )
+        .returning({ id: workflow.id })
+      totalDeleted += deleted.length
+    } catch (error) {
+      logger.error(`[${label}/workflow] Archived workflow delete failed`, { error })
+    }
+  }
+
+  // Workflow-scoped chats above are removed by the workflow FK cascade;
+  // soft-deleted mothership chats have no workflow and need their own delete.
+  // Re-check the soft-delete cutoff in the DELETE itself so a chat restored
+  // between selection and this point survives (chatCleanup.execute() below
+  // also re-checks row existence before purging external data).
+  for (const batch of chunkArray(softDeletedChatIds, DEFAULT_DELETE_CHUNK_SIZE)) {
+    try {
+      const deleted = await db
+        .delete(copilotChats)
+        .where(
+          and(
+            inArray(copilotChats.id, batch),
+            isNotNull(copilotChats.deletedAt),
+            lt(copilotChats.deletedAt, retentionDate)
+          )
+        )
+        .returning({ id: copilotChats.id })
+      totalDeleted += deleted.length
+    } catch (error) {
+      logger.error(`[${label}/copilotChats] Soft-deleted chat delete failed`, { error })
+    }
+  }
 
   const legacyFileResult = await deleteExpiredLegacyWorkspaceFileRows(
     fileCleanup.legacyRows,
diff --git a/apps/sim/background/cleanup-tasks.ts b/apps/sim/background/cleanup-tasks.ts
index 341f5132eaa..e987ac41078 100644
--- a/apps/sim/background/cleanup-tasks.ts
+++ b/apps/sim/background/cleanup-tasks.ts
@@ -2,7 +2,6 @@ import { db } from '@sim/db'
 import {
   copilotAsyncToolCalls,
   copilotChats,
-  copilotFeedback,
   copilotRunCheckpoints,
   copilotRuns,
   mothershipInboxTask,
@@ -13,6 +12,8 @@ import { and, inArray, lt } from 'drizzle-orm'
 import type { CleanupJobPayload } from '@/lib/billing/cleanup-dispatcher'
 import {
   batchDeleteByWorkspaceAndTimestamp,
+  chunkArray,
+  DEFAULT_DELETE_CHUNK_SIZE,
   deleteRowsById,
   selectRowsByIdChunks,
   type TableCleanupResult,
@@ -101,14 +102,6 @@ export async function runCleanupTasks(payload: CleanupJobPayload): Promise<void>
     if (r.deleted > 0) logger.info(`[${r.table}] ${r.deleted} deleted`)
   }
 
-  // Delete feedback — no direct workspaceId, reuse chat IDs collected above
-  const feedbackResult = await deleteRowsById(
-    copilotFeedback,
-    copilotFeedback.chatId,
-    doomedChatIds,
-    `${label}/copilotFeedback`
-  )
-
   // Delete copilot runs (has workspaceId directly, cascades checkpoints)
   const runsResult = await batchDeleteByWorkspaceAndTimestamp({
     tableDef: copilotRuns,
@@ -121,12 +114,24 @@ export async function runCleanupTasks(payload: CleanupJobPayload): Promise<void>
 
   // Delete copilot chats using the exact IDs collected above so the chat
   // cleanup (S3 + copilot backend) and the DB delete can never disagree.
-  const chatsResult = await deleteRowsById(
-    copilotChats,
-    copilotChats.id,
-    doomedChatIds,
-    `${label}/copilotChats`
-  )
+  // Re-check the retention cutoff in the DELETE: a chat restored from Recently
+  // Deleted mid-run gets a fresh `updatedAt`, so it survives here (and
+  // chatCleanup.execute() re-checks row existence before purging its data).
+  // Chat-scoped children (copilot_messages, copilot_feedback) go with the row
+  // via FK cascade, so they are removed only for chats actually deleted.
+  const chatsResult = { deleted: 0, failed: 0 }
+  for (const batch of chunkArray(doomedChatIds, DEFAULT_DELETE_CHUNK_SIZE)) {
+    try {
+      const deleted = await db
+        .delete(copilotChats)
+        .where(and(inArray(copilotChats.id, batch), lt(copilotChats.updatedAt, retentionDate)))
+        .returning({ id: copilotChats.id })
+      chatsResult.deleted += deleted.length
+    } catch (error) {
+      chatsResult.failed += batch.length
+      logger.error(`[${label}/copilotChats] Chat retention delete failed`, { error })
+    }
+  }
 
   // Delete mothership inbox tasks (has workspaceId directly)
   const inboxResult = await batchDeleteByWorkspaceAndTimestamp({
@@ -140,7 +145,6 @@ export async function runCleanupTasks(payload: CleanupJobPayload): Promise<void>
 
   const totalDeleted =
     runChildResults.reduce((s, r) => s + r.deleted, 0) +
-    feedbackResult.deleted +
     runsResult.deleted +
     chatsResult.deleted +
     inboxResult.deleted
diff --git a/apps/sim/blocks/blocks/slack.ts b/apps/sim/blocks/blocks/slack.ts
index b0a69183295..1792db96c52 100644
--- a/apps/sim/blocks/blocks/slack.ts
+++ b/apps/sim/blocks/blocks/slack.ts
@@ -2627,48 +2627,51 @@ export const SlackBlockMeta = {
   ],
 } as const satisfies BlockMeta
 
-/**
- * Custom Bot picker used by slack_v2 in place of v1's raw bot-token field — a
- * canonical basic/advanced pair (dropdown + manual credential-ID paste),
- * mirroring the OAuth `credential`/`manualCredential` pair.
- */
-const SLACK_CUSTOM_BOT_SUBBLOCKS: SubBlockConfig[] = [
-  {
-    id: 'customBotCredential',
-    title: 'Slack Bot',
-    type: 'oauth-input',
-    canonicalParamId: 'botCredential',
-    mode: 'basic',
-    serviceId: 'slack',
-    credentialKind: 'custom-bot',
-    requiredScopes: getScopesForService('slack'),
-    placeholder: 'Select a connected bot',
-    dependsOn: ['authMethod'],
-    condition: { field: 'authMethod', value: 'bot_token' },
-    required: true,
-  },
-  {
-    id: 'manualCustomBotCredential',
-    title: 'Bot Credential ID',
-    type: 'short-input',
-    canonicalParamId: 'botCredential',
-    mode: 'advanced',
-    placeholder: 'Enter bot credential ID',
-    dependsOn: ['authMethod'],
-    condition: { field: 'authMethod', value: 'bot_token' },
-    required: true,
-  },
-]
-
 const SLACK_WEBHOOK_TRIGGER_SUBBLOCK_IDS = new Set(
   getTrigger('slack_webhook').subBlocks.map((sb) => sb.id)
 )
 
+/**
+ * Adapts a v1 subblock for slack_v2's merged credential picker: fields gated on
+ * the removed `authMethod` dropdown now depend on the single `credential` field.
+ */
+function adaptSubBlockForV2(sb: SubBlockConfig): SubBlockConfig {
+  const { dependsOn, condition, ...rest } = sb
+  if (sb.id === 'credential') {
+    return {
+      ...rest,
+      credentialKind: 'any',
+      placeholder: 'Select Slack account or bot',
+      credentialLabels: {
+        oauthGroup: 'Sim app',
+        oauthConnect: 'Connect the Sim app',
+        serviceAccountGroup: 'Custom bots',
+        serviceAccountConnect: 'Set up a custom bot',
+      },
+    }
+  }
+  if (sb.id === 'manualCredential') {
+    return { ...rest, placeholder: 'Enter credential ID' }
+  }
+  if (dependsOn && !Array.isArray(dependsOn) && dependsOn.all?.includes('authMethod')) {
+    return { ...sb, dependsOn: ['credential'] }
+  }
+  return sb
+}
+
+const {
+  authMethod: _authMethod,
+  botToken: _botToken,
+  botCredential: _botCredential,
+  ...slackV2Inputs
+} = SlackBlock.inputs
+
 /**
  * slack_v2 — the go-forward Slack action block. Identical operations, tools, and
- * outputs to v1 (shared by reference), but the "Custom Bot" auth method selects
- * a reusable bot credential set up once, instead of pasting a raw token. Also
- * hosts the redesigned slack_oauth trigger (v1 keeps the legacy slack_webhook).
+ * outputs to v1 (shared by reference), but auth is a single credential picker
+ * listing Sim OAuth accounts and reusable custom bots together — the credential's
+ * kind is resolved server-side, so no auth-method choice is needed. Also hosts
+ * the redesigned slack_oauth trigger (v1 keeps the legacy slack_webhook).
  */
 export const SlackV2Block: BlockConfig<SlackResponse> = {
   ...SlackBlock,
@@ -2683,13 +2686,18 @@ export const SlackV2Block: BlockConfig<SlackResponse> = {
     ...SlackBlock.subBlocks.flatMap((sb) => {
       // Drop the legacy paste-secret trigger config (v1 hosts slack_webhook)
       // and v1's raw bot-token auth field — the trigger set includes an
-      // id-colliding 'botToken', so the set check covers both.
+      // id-colliding 'botToken', so the set check covers both. The authMethod
+      // dropdown is gone: the merged credential picker covers both auth kinds.
       if (SLACK_WEBHOOK_TRIGGER_SUBBLOCK_IDS.has(sb.id)) return []
-      if (sb.id === 'authMethod') return [sb, ...SLACK_CUSTOM_BOT_SUBBLOCKS]
-      return [sb]
+      if (sb.id === 'authMethod') return []
+      return [adaptSubBlockForV2(sb)]
     }),
     ...getTrigger('slack_oauth').subBlocks,
   ],
+  inputs: {
+    ...slackV2Inputs,
+    oauthCredential: { type: 'string', description: 'Slack credential (OAuth account or bot)' },
+  },
   triggers: {
     enabled: true,
     available: ['slack_oauth'],
diff --git a/apps/sim/blocks/custom/build-config.ts b/apps/sim/blocks/custom/build-config.ts
index e8f02973d5e..5ff63f41fce 100644
--- a/apps/sim/blocks/custom/build-config.ts
+++ b/apps/sim/blocks/custom/build-config.ts
@@ -76,6 +76,22 @@ export function isReservedOutputName(name: string): boolean {
   return RESERVED_OUTPUT_NAMES.has(name.trim().toLowerCase())
 }
 
+/**
+ * Collect a custom block's per-field param values into the child `inputMapping`
+ * JSON string: every non-reserved, non-empty param keyed by the source field's
+ * stable id. Shared by the hidden `inputMapping` sub-block (canvas serialization)
+ * and the agent-tool transform, so both paths assemble the mapping identically.
+ */
+export function assembleCustomBlockInputMapping(params: Record<string, unknown>): string {
+  const mapping: Record<string, unknown> = {}
+  for (const [key, val] of Object.entries(params)) {
+    if (RESERVED_PARAMS.has(key)) continue
+    if (val === undefined || val === '') continue
+    mapping[key] = val
+  }
+  return JSON.stringify(mapping)
+}
+
 /** Map a Start input field type to the editor sub-block type used to collect it. */
 function subBlockTypeForField(fieldType: string): SubBlockType {
   switch (fieldType) {
@@ -161,15 +177,7 @@ export function buildCustomBlockConfig(
         type: 'code',
         language: 'json',
         hidden: true,
-        value: (params) => {
-          const mapping: Record<string, unknown> = {}
-          for (const [key, val] of Object.entries(params)) {
-            if (RESERVED_PARAMS.has(key)) continue
-            if (val === undefined || val === '') continue
-            mapping[key] = val
-          }
-          return JSON.stringify(mapping)
-        },
+        value: (params) => assembleCustomBlockInputMapping(params),
       },
       ...fieldSubBlocks,
     ],
diff --git a/apps/sim/blocks/types.ts b/apps/sim/blocks/types.ts
index 3ed75ecefde..1abe2b8e379 100644
--- a/apps/sim/blocks/types.ts
+++ b/apps/sim/blocks/types.ts
@@ -367,14 +367,24 @@ export interface SubBlockConfig {
   serviceId?: string
   requiredScopes?: string[]
   /**
-   * Narrows an `oauth-input` selector to a specific credential kind. `'custom-bot'`
-   * lists only reusable custom Slack bot credentials (service-account type) and its
-   * connect row opens the custom-bot setup modal instead of the OAuth flow.
-   * `'service-account'` is the generic equivalent for a no-OAuth provider: it lists
-   * only service-account credentials and its connect row opens the descriptor-driven
-   * token-paste modal (`ConnectServiceAccountModal`).
+   * Narrows an `oauth-input` selector to a specific credential kind.
+   * `'service-account'` lists only service-account credentials; its connect row
+   * opens the provider's setup modal (resolved from the service-account setup
+   * registry — a bespoke wizard when registered, the generic token-paste modal
+   * otherwise). `'any'` lists OAuth accounts and service accounts together in a
+   * grouped dropdown with a connect action for each kind.
    */
-  credentialKind?: 'custom-bot' | 'service-account'
+  credentialKind?: 'service-account' | 'any'
+  /**
+   * Overrides the credential picker's section and connect-row copy. Unset keys
+   * fall back to generic provider-derived labels.
+   */
+  credentialLabels?: {
+    oauthGroup?: string
+    oauthConnect?: string
+    serviceAccountGroup?: string
+    serviceAccountConnect?: string
+  }
   /**
    * Opts a trigger-mode `oauth-input` selector into listing service-account
    * credentials, which are otherwise excluded in trigger mode. Set only when the
diff --git a/apps/sim/blocks/utils.ts b/apps/sim/blocks/utils.ts
index f740a0026bd..f0c7d11f13a 100644
--- a/apps/sim/blocks/utils.ts
+++ b/apps/sim/blocks/utils.ts
@@ -11,6 +11,7 @@ import type { BlockOutput, OutputFieldDefinition, SubBlockConfig } from '@/block
 import {
   getBaseModelProviders,
   getHostedModels,
+  getModelSunsetStatus,
   getProviderIcon,
   getProviderModels,
   orderModelIdsByReleaseDate,
@@ -74,10 +75,12 @@ export function getModelOptions() {
     ])
   )
 
-  return allModels.map((model) => {
-    const icon = getProviderIcon(model)
-    return { label: model, id: model, ...(icon && { icon }) }
-  })
+  return allModels
+    .filter((model) => getModelSunsetStatus(model) !== 'deprecated')
+    .map((model) => {
+      const icon = getProviderIcon(model)
+      return { label: model, id: model, ...(icon && { icon }) }
+    })
 }
 
 /**
diff --git a/apps/sim/components/emails/components/email-footer.tsx b/apps/sim/components/emails/components/email-footer.tsx
index 2cccdce5a10..ef85acd95b3 100644
--- a/apps/sim/components/emails/components/email-footer.tsx
+++ b/apps/sim/components/emails/components/email-footer.tsx
@@ -37,6 +37,16 @@ export function EmailFooter({
     fontFamily: typography.fontFamily,
   }
 
+  /**
+   * Social icons are linked images. `display: block` removes the 2–3px gap
+   * Outlook adds under inline images, and `border: 0` prevents the blue link
+   * border older Outlook versions draw around linked images.
+   */
+  const socialIconStyle = {
+    display: 'block' as const,
+    border: 0,
+  }
+
   return (
     <Section
       style={{
@@ -77,6 +87,7 @@ export function EmailFooter({
                                 width='20'
                                 height='20'
                                 alt='X'
+                                style={socialIconStyle}
                               />
                             </Link>
                           </td>
@@ -87,6 +98,7 @@ export function EmailFooter({
                                 width='20'
                                 height='20'
                                 alt='LinkedIn'
+                                style={socialIconStyle}
                               />
                             </Link>
                           </td>
@@ -97,6 +109,7 @@ export function EmailFooter({
                                 width='20'
                                 height='20'
                                 alt='GitHub'
+                                style={socialIconStyle}
                               />
                             </Link>
                           </td>
@@ -107,6 +120,7 @@ export function EmailFooter({
                                 width='20'
                                 height='20'
                                 alt='Slack'
+                                style={socialIconStyle}
                               />
                             </Link>
                           </td>
diff --git a/apps/sim/components/emails/components/email-layout.tsx b/apps/sim/components/emails/components/email-layout.tsx
index f28e9a81008..264fd177cdb 100644
--- a/apps/sim/components/emails/components/email-layout.tsx
+++ b/apps/sim/components/emails/components/email-layout.tsx
@@ -54,9 +54,8 @@ export function EmailLayout({
           <Section style={baseStyles.header}>
             <Img
               src={brand.logoUrl || `${baseUrl}/brand/color/email/wordmark.png`}
-              height='34'
-              {...(hasCustomLogo ? {} : { width: '70' })}
               alt={brand.name}
+              {...(hasCustomLogo ? { height: '34' } : { height: '41', width: '68' })}
               style={hasCustomLogo ? { display: 'block', width: 'auto' } : { display: 'block' }}
             />
           </Section>
diff --git a/apps/sim/components/ui/index.ts b/apps/sim/components/ui/index.ts
index 40ccab62097..234f6f50a60 100644
--- a/apps/sim/components/ui/index.ts
+++ b/apps/sim/components/ui/index.ts
@@ -1,7 +1,6 @@
 export { Button, buttonVariants } from './button'
 export { GeneratedPasswordInput } from './generated-password-input'
 export { Progress } from './progress'
-export { SearchHighlight } from './search-highlight'
 export {
   Select,
   SelectContent,
diff --git a/apps/sim/content/library/best-ai-agents-for-data-extraction-and-rag-in-2026/index.mdx b/apps/sim/content/library/best-ai-agents-for-data-extraction-and-rag-in-2026/index.mdx
new file mode 100644
index 00000000000..7b636a89723
--- /dev/null
+++ b/apps/sim/content/library/best-ai-agents-for-data-extraction-and-rag-in-2026/index.mdx
@@ -0,0 +1,150 @@
+---
+slug: best-ai-agents-for-data-extraction-and-rag-in-2026
+title: 'Best AI Agents for Data Extraction and RAG in 2026'
+description: Compare the best AI agents for document extraction, SQL queries, spreadsheet analysis, and RAG over internal documents in 2026. See how Sim, n8n, Zapier, Make, and Gumloop handle data workflows.
+date: 2026-07-01
+updated: 2026-07-01
+authors:
+  - andrew
+readingTime: 19
+tags: [AI Agents, Data Extraction, RAG, Sim]
+ogImage: /library/best-ai-agents-for-data-extraction-and-rag-in-2026/cover.jpg
+canonical: https://www.sim.ai/library/best-ai-agents-for-data-extraction-and-rag-in-2026
+draft: false
+faq:
+  - q: "Do AI agents need a separate vector database for RAG?"
+    a: "Not always. Sim includes native Knowledge Bases that handle chunking, embedding, storage, and semantic retrieval, so you skip standing up a separate vector database like Pinecone or Weaviate. You need an external vector store only when a platform lacks native retrieval and forces you to wire one in yourself."
+  - q: "Can I use AI agents to extract tables from PDFs into a database?"
+    a: "Yes. Sim parses documents through its Files handling, including OCR for scanned pages, and lands the results in Tables as structured rows you can push to a database. Platforms without native parsing require a third-party OCR step, and those steps often break on inconsistent table layouts."
+  - q: "What's the difference between an AI agent and a RAG pipeline?"
+    a: "A RAG pipeline retrieves relevant documents and feeds them to a model to ground its answers. An AI agent wraps that retrieval inside a larger workflow, calling tools, querying data, and taking actions across steps. In Sim, the Knowledge Base supplies the retrieval, and the agent decides when to use it."
+  - q: "What file types and sizes can Sim process?"
+    a: "Sim accepts PDF, Word, TXT, Markdown, HTML, Excel, PowerPoint, CSV, JSON, and YAML at up to 100 MB per file, with best performance under 50 MB. Scanned PDFs are supported through Azure or Mistral OCR."
+  - q: "Do these platforms support self-hosted or on-prem data for compliance?"
+    a: "n8n and Sim both offer self-hosting, which keeps sensitive documents inside your own infrastructure for regulatory requirements. Sim self-hosts under Apache 2.0 via Docker or Kubernetes, while n8n uses a fair-code license with commercial-use restrictions. Zapier, Make, and Gumloop run as managed cloud services, so your data passes through their systems. Check each vendor's current deployment options before committing to a compliance-sensitive workflow."
+---
+
+## TL;DR
+
+Sim leads across all four data and RAG use cases because it treats document parsing, structured tables, and semantic retrieval as native primitives rather than add-ons. Each competitor still wins in a specific scenario.
+
+- **PDF and document extraction:** Sim's [Files](https://docs.sim.ai/files) parsing into structured output is the default, with OCR for scanned pages and support for 10 file types up to 100 MB each. Choose Gumloop when you want pre-built scraping and enrichment nodes.
+- **SQL in plain English:** Sim's [Tables](https://docs.sim.ai/tables) ground natural-language queries against schema. Choose n8n when you already run self-hosted database workflows.
+- **Spreadsheet analysis:** Sim's Tables ingest CSV and TSV files with inferred column types, batch-inserting rows 5,000 at a time. Choose Make when you need granular, visible transformation steps.
+- **RAG over internal documents:** Sim's [Knowledge Bases](https://docs.sim.ai/knowledgebase) with connector sync across 50+ sources keep retrieval fresh. Choose Zapier when RAG is a light task beside hundreds of app connections.
+
+## What makes an AI agent good at data extraction and RAG?
+
+Four mechanics separate an agent that actually handles data work from one that stitches together workarounds. The first is native document parsing, meaning the platform reads a PDF or spreadsheet and returns clean structured output without an external OCR service. The second is semantic retrieval backed by a vector store that stays synced to its source, so answers reflect the current document, not a snapshot from three weeks ago. The third is how the platform holds intermediate data. Structured tables let an agent query and transform rows, while flat file passing forces you to reparse the same blob at every step. The fourth is natural-language querying against a database schema, where the agent grounds a plain-English question in the actual columns instead of guessing.
+
+Where a platform sits on these four mechanics depends on what it was built to do. Zapier, Make, and n8n started as integration platforms that move data between apps, so they treat documents and vectors as payloads to route rather than objects to reason over. You reach RAG through a bolt-on vector database node and reach extraction through a third-party parsing service, and you assemble the pipeline yourself.
+
+Agent-native platforms like Sim and Gumloop invert that assumption. Sim ships Knowledge Bases for semantic retrieval with connector sync, Tables for structured extraction pipelines, and Files for document handling, so the retrieval and storage layer lives inside the agent. Sim adds a fifth option the others do not have: [Mothership](https://www.sim.ai/blog/mothership), a natural-language control plane with full context over your workflows, tables, knowledge bases, and files. You describe the pipeline in plain English and Sim builds, tests, and deploys it.
+
+Judge each tool in the sections that follow against these mechanics, not against its marketing.
+
+## What is the best AI agent for extracting data from PDFs and documents in 2026?
+
+Sim extracts data from PDFs and documents with the least assembly because it handles the file, parses it, and returns structured output inside one agent. You upload a document through Files, point an agent at it, and pull specific fields into a Table without wiring an OCR service or a parsing API in between. Sim accepts PDF, Word, TXT, Markdown, HTML, Excel, PowerPoint, CSV, JSON, and YAML at up to 100 MB per file, and extracts text from scanned, image-based pages through Azure or Mistral OCR. The document goes in, structured data comes out, and no glue steps sit between the two.
+
+The four integration platforms take a longer route because none treats document parsing as a first-class capability. n8n gives you a PDF node for basic text extraction, but anything with tables, scanned pages, or mixed layouts pushes you toward a code step or an external OCR service you configure yourself. Zapier and Make both lean on third-party connectors for real extraction, so a receipt or contract flows through a separate parsing app like Docparser or an AI module you pay for per document. Gumloop comes closest among the four with AI-native nodes that read documents, though you still chain the extraction logic node by node rather than describing the fields you want.
+
+Each non-native route fails in a predictable way. The extra parsing service adds a step that can break independently of your agent, so a layout change in the source PDF silently produces empty fields downstream. Per-document pricing on OCR add-ons turns a batch of ten thousand invoices into a line item you have to forecast, and Zapier's task-based billing compounds that cost because every parsing call counts. Brittle parsing is the quieter failure. A model that guesses at a two-column layout will return misaligned data that looks correct until someone audits it.
+
+Choose Gumloop over Sim when your documents are mostly clean and you want its pre-built scraping and enrichment nodes to feed extraction without building retrieval yourself. Choose n8n when you already run self-hosted workflows and prefer writing your own parsing code for full control. For most teams pulling structured fields out of messy real-world documents at volume, Sim removes the parsing service, the per-document meter, and the failure point they introduce.
+
+## Can AI agents query a SQL database in plain English?
+
+Yes, AI agents can turn plain-English questions into SQL, but the quality depends on how well the platform feeds your database schema to the model before it writes a query. Sim handles this through its Tables, which give the agent a structured, typed view of your data instead of a raw connection string. Because the agent knows the column names, types, and relationships up front, it grounds "show me last quarter's churned accounts" against real fields rather than guessing at table structure. That grounding is what separates a query that runs from one that hallucinates a column name.
+
+Mothership extends the same grounding to the build step. It holds context across every table in the workspace, so a request like "create a CRM table, seed it with my existing leads, and schedule a daily sync" produces the table, the rows, and the workflow in one pass. No competitor on this list ships an equivalent.
+
+n8n exposes native database nodes for Postgres, MySQL, and others, and you can pair them with an AI node that drafts SQL. The catch is that you assemble the schema-passing step yourself, often by querying the information schema and piping it into the prompt. n8n gives you full control, but a non-technical user still needs to understand SQL well enough to debug what the model generates.
+
+Zapier and Make both connect to databases, yet neither treats natural-language querying as a first-class feature. In Zapier, you typically trigger on a row or run a pre-written query, and the AI steps summarize results rather than compose SQL against a live schema. Make lets you build the query flow visually with granular control over each database call, but a non-technical user hits a wall the moment the logic needs a hand-written WHERE clause or a JOIN the visual builder does not template.
+
+Gumloop leans on AI-specific nodes and can generate queries as part of a data flow, though it still expects you to wire the database connection and supply schema context for reliable output. It stays closer to plain English than Zapier or Make, but you are still stitching retrieval logic together.
+
+The practical divide is where the plain-English experience ends. Sim keeps it end to end because Tables carry the schema the agent needs. The integration platforms get you a working query, and they push the schema-grounding and SQL debugging back onto whoever built the flow.
+
+## Which AI agent platform best analyzes spreadsheet data automatically?
+
+Sim analyzes spreadsheet data with the least manual wrangling because its Tables feature gives you a structured store that agents read and write directly. Import a CSV or TSV and Sim infers column types from the data and batch-inserts rows 5,000 at a time as typed columns rather than a flat array of strings. From there the agent can filter, aggregate, or summarize without you writing a single formula. The data lands in a shape the agent already understands, so analysis starts on the same step the import finishes.
+
+The four integration-first platforms treat a spreadsheet as a file or an array, and that choice pushes the real work onto you. Zapier reads Google Sheets row by row through its Sheets connector, which fits a trigger-and-append pattern but chokes on anything that needs the whole dataset in view at once. Make and n8n both parse the file into arrays of objects, and any analysis beyond a simple map means you write JavaScript or chain a dozen aggregation modules by hand. Gumloop passes spreadsheet data into AI nodes as text or arrays, so an agent can reason over it, but the structure disappears and large sheets blow past the context window.
+
+The break point in every non-native approach is the same. The moment your question moves from "read this cell" to "group these rows and compare the totals," you leave the platform's built-in capability and start scripting. In Make you add a Set Variable module and an iterator. In n8n you drop into a Code node and write the reduce yourself. Both work, but you are now maintaining transformation logic that has nothing to do with the agent's actual job, and every schema change in the source sheet risks breaking it silently.
+
+Choose Sim when spreadsheet analysis is a recurring part of the workflow rather than a one-off export, because Tables keeps the data queryable across steps instead of forcing a fresh parse each run. Reach for Make or n8n when you want to see and control every transformation, and you accept the scripting that comes with that visibility.
+
+## What is the best AI agent for RAG over internal documents?
+
+Sim wins for RAG over internal documents because its Knowledge Bases handle semantic retrieval and connector sync as built-in primitives, not assembled parts. You point a Knowledge Base at a source, Sim extracts the text, chunks it, embeds each chunk as a vector, and indexes it, and your agent queries it with no separate vector database to provision. [Chunking is configurable](https://docs.sim.ai/knowledgebase/chunking-strategies) from 100 to 4,000 tokens with 0 to 500 tokens of overlap, so you tune precision against context without leaving the platform. Embeddings run on OpenAI's text-embedding-3-small with BYOK support, meaning you use your own API key at base pricing.
+
+[Connector sync](https://docs.sim.ai/knowledgebase/connectors) is the part every other approach makes you build by hand. Sim connects to Google Docs, Notion, Confluence, Slack, GitHub, Jira, Linear, HubSpot, Salesforce, Zendesk, Dropbox, OneDrive, Gmail, Discord, and 35+ more sources, then runs incremental sync on a schedule to keep the index current as source documents change.
+
+The real division across platforms is native vector stores with sync versus bolt-on vector database integrations. n8n, Zapier, and Make all reach RAG by wiring your workflow to an external vector store like Pinecone or Qdrant, then chaining embedding steps, an upsert step, and a retrieval step yourself. That works, and n8n in particular gives you fine control over each stage. You own the entire pipeline, including the parts that break.
+
+Ongoing maintenance separates a working RAG demo from a RAG system you trust six months later. Initial setup is a one-time cost, and any of these tools can survive it. Sync freshness is the recurring cost. When a document changes in your source, a bolt-on pipeline re-embeds it only if you built a trigger to detect the change, so stale answers creep in quietly. Sim's connector sync re-indexes changed content on its own, which removes the most common cause of a RAG agent returning outdated information.
+
+Gumloop sits closer to Sim than the integration platforms do, since its AI-first node library includes retrieval-oriented steps. You still assemble the retrieval infrastructure and manage re-indexing yourself, so you get AI-specific building blocks without the managed sync that keeps a knowledge base fresh.
+
+Choose an external vector store through n8n or Make when your team already runs Pinecone or Qdrant in production and wants the agent to query the same index other services use. In that case, a shared vector store is worth the manual pipeline. For a team standing up RAG over internal documents from scratch, Sim's Knowledge Bases remove the re-indexing and sync work that otherwise turns into a standing maintenance job.
+
+## How do Sim, n8n, Zapier, Make, and Gumloop compare across data and RAG use cases?
+
+The table below maps each platform against the four use cases covered above. Read "native" as built into the platform with no extra tooling, "add-on" as a third-party integration you connect and maintain, "partial" as a built-in capability you still chain together by hand, and "manual" as work you assemble yourself with code or multi-step logic.
+
+| Use case | Sim | n8n | Zapier | Make | Gumloop |
+| --- | --- | --- | --- | --- | --- |
+| PDF/document extraction | Native (Files + parsing + OCR) | Add-on (OCR nodes) | Add-on (parser apps) | Add-on (parser modules) | Partial (AI nodes, manual chaining) |
+| SQL in plain English | Native (Tables + NL) | Manual (query + code) | Add-on (AI module) | Manual (SQL modules) | Add-on (AI query) |
+| Spreadsheet analysis | Native (Tables) | Manual (array handling) | Manual (formatter steps) | Manual (iterator logic) | Add-on (AI nodes) |
+| RAG over internal docs | Native (Knowledge Bases + sync) | Add-on (vector DB) | Limited (agent knowledge sources, no standalone vector store) | Add-on (vector DB) | Manual (assemble pipeline) |
+| Natural-language build layer | Native (Mothership) | None | None | None | None |
+| License | Apache 2.0 (fully open source) | Fair-code (use restrictions) | Proprietary | Proprietary | Proprietary |
+| Self-hosting | Yes (Docker or Kubernetes) | Yes | No | No | No |
+
+Sim carries native support across all four use-case rows because Knowledge Bases, Tables, and Files exist as first-class primitives rather than integrations you wire together, and Mothership adds a build layer none of the others offer. Gumloop comes closest on document and enrichment work through its AI node library, but it chains extraction node by node and leaves you to assemble retrieval infrastructure for RAG. n8n and Make both reach every use case through add-ons or manual construction, which trades setup effort for control. Zapier covers extraction and querying through app integrations, and its agent product accepts knowledge sources, but it has no standalone vector store to query directly, so RAG over a large internal corpus falls outside what it does well.
+
+Use the table to confirm the verdicts, then read the "choose X when" sections that follow to match a platform to your actual workflow shape.
+
+## Choose n8n when
+
+Pick n8n when you want to run the whole thing on your own infrastructure and you already write code inside your workflows. n8n installs on your own servers, so your documents and database connections never leave a network you control. For teams with compliance rules that forbid sending internal files to a hosted platform, that alone settles the decision. Worth noting that Sim self-hosts too, under Apache 2.0 rather than n8n's fair-code license, which carries commercial-use restrictions Apache 2.0 does not.
+
+The second reason is the Code node. n8n lets you drop JavaScript or Python into any step, which means you can assemble a RAG pipeline exactly the way you want it by wiring a vector database, an embedding call, and a retrieval query together by hand. You give up the native Knowledge Base that Sim provides, but you gain full control over chunking, indexing, and which model touches your data.
+
+The third reason is momentum. If your team has already built dozens of n8n workflows and your operations run through them, adding light document extraction or a database query to an existing flow costs less than migrating to an agent-native platform. Stay with n8n when self-hosting, custom code, and prior investment matter more than having retrieval built in. See the [full OpenAI AgentKit vs n8n vs Sim comparison](https://www.sim.ai/library/openai-vs-n8n-vs-sim) for a deeper breakdown.
+
+## Choose Zapier when
+
+Choose Zapier when your team already automates operations through it and your document and data work is a small part of a much larger app landscape. Zapier connects to more than 6,000 apps, so if your daily job is moving records between a CRM, a help desk, a spreadsheet, and a billing tool, keeping one more task inside Zapier beats bolting on a second platform.
+
+The tradeoff is real. Zapier's native document parsing and retrieval primitives are thin, so anything involving vector search or heavy PDF extraction pushes you toward its AI actions or a third-party parsing add-on. For a light task like pulling a few fields off an invoice and dropping them into a sheet, that is fine. For semantic search across thousands of internal documents, you will fight the tool. Per-task pricing compounds the issue at volume, since every parsing call and every retrieval step meters separately.
+
+Stay with Zapier when the breadth of connections carries the workflow and the data extraction is occasional rather than central. If document parsing, database queries, and retrieval become the core of what your agent does, you have outgrown what Zapier handles well.
+
+## Choose Make when
+
+Choose Make when you need to see and control every step of a branching workflow, and built-in RAG matters less than that visibility. Make's canvas exposes each operation as a discrete module across 3,000+ integrations, so you can trace exactly how a record moves through filters, routers, and transformations. For workflows with heavy conditional logic, where a document routes differently based on ten field values, Make gives you a level of granular control that agent-native abstractions hide behind a prompt.
+
+That control fits ops teams processing structured records that follow strict rules rather than open-ended documents. If your extraction job is really a series of if-then transformations against known fields, Make's router and aggregator modules handle it cleanly, and you can debug any single step in isolation. You give up native semantic retrieval, so RAG over unstructured documents means wiring in an external vector store and managing the pipeline yourself. When your data is already structured and your logic is complex, that tradeoff favors Make.
+
+Reach for Make when the workflow shape is the hard part and retrieval is secondary. Reach for Sim when semantic search over documents sits at the center of what your agent does.
+
+## Choose Gumloop when
+
+Choose Gumloop when you want pre-built AI nodes for scraping and enrichment, and you'd rather not assemble retrieval infrastructure yourself. Gumloop ships a node library aimed at AI tasks out of the box, so pulling data off a web page, cleaning it, and enriching it with a model takes a few connected nodes rather than a custom pipeline. For teams whose main job is turning messy web sources into usable records, that packaging removes a lot of the setup Sim expects you to configure.
+
+Gumloop fits marketing, sales, and research teams running enrichment at volume, where the input is a list of URLs or companies and the output is a structured table. Its scraping and extraction nodes are tuned for that pattern, and you spend your time chaining capabilities instead of standing up parsers. The tradeoff shows up when you need durable semantic retrieval over a document corpus that changes, since Gumloop leans on task-level AI nodes rather than a managed vector store with sync. It is also closed source with no self-hosting path, so regulated data has to leave your network. Pick Gumloop when enrichment is the workflow. Pick Sim when a synced knowledge base is.
+
+## Choose Sim when
+
+Choose Sim when document extraction, structured data, and semantic retrieval sit at the center of the agent you're building, not at the edges. If your workflow parses PDFs into rows, queries that data in plain English, and retrieves relevant passages from internal documents, Sim gives you all three as native primitives rather than three separate integrations you wire together and maintain, across 1,000+ integrations and every major model provider.
+
+Sim's Knowledge Bases handle semantic retrieval with connector sync across 50+ sources, so your RAG index stays current without a manual re-indexing job. Tables store extracted data in a structured form your agent can query directly. Files handle document ingestion at up to 100 MB per file with OCR for scanned pages, no bolt-on parsing service required. Mothership lets you describe the whole pipeline in plain English and have Sim build, test, and deploy it. You skip the plumbing that n8n, Zapier, and Make require to reach the same result.
+
+Sim is Apache 2.0 licensed and self-hostable through Docker or Kubernetes, and the cloud platform is [SOC 2 compliant](https://www.sim.ai/blog/enterprise), so regulated teams can keep documents inside their own infrastructure without giving up the native primitives.
+
+Pick Sim when you'd otherwise spend more time assembling a vector database, a parsing service, and a data store than building the actual agent logic. Teams shipping RAG-heavy agents feel this most, since every external dependency adds a failure point and a sync problem to debug. If retrieval and extraction are the product, start at [Sim](https://sim.ai) and add integrations only where its native pieces fall short.
diff --git a/apps/sim/ee/access-control/components/group-detail.tsx b/apps/sim/ee/access-control/components/group-detail.tsx
index 7bf146ec4ac..47a258f5f9a 100644
--- a/apps/sim/ee/access-control/components/group-detail.tsx
+++ b/apps/sim/ee/access-control/components/group-detail.tsx
@@ -79,6 +79,17 @@ const FILE_SHARE_AUTH_TYPE_OPTIONS: { value: ShareAuthType; label: string }[] =
 ]
 const ALL_FILE_SHARE_AUTH_TYPES: ShareAuthType[] = FILE_SHARE_AUTH_TYPE_OPTIONS.map((o) => o.value)
 
+/** Chat-deployment auth modes an admin can allow/disallow. `null` config = all allowed. */
+const CHAT_DEPLOY_AUTH_TYPE_OPTIONS: { value: ShareAuthType; label: string }[] = [
+  { value: 'public', label: 'Public' },
+  { value: 'password', label: 'Password' },
+  { value: 'email', label: 'Email' },
+  { value: 'sso', label: 'SSO' },
+]
+const ALL_CHAT_DEPLOY_AUTH_TYPES: ShareAuthType[] = CHAT_DEPLOY_AUTH_TYPE_OPTIONS.map(
+  (o) => o.value
+)
+
 interface OrganizationMemberOption {
   userId: string
   user: {
@@ -503,7 +514,7 @@ function BlockToolRow({
           className='relative flex size-[16px] flex-shrink-0 items-center justify-center overflow-hidden rounded-sm'
           style={{ background: block.bgColor }}
         >
-          {BlockIcon && <BlockIcon className='!h-[10px] !w-[10px] text-white' />}
+          {BlockIcon && <BlockIcon className='!size-[9px] text-white' />}
         </div>
         <button
           type='button'
@@ -737,13 +748,6 @@ export function GroupDetail({
         configKey: 'hideDeployChatbot' as const,
         hint: 'Hide the chatbot deployment option.',
       },
-      {
-        id: 'hide-deploy-template',
-        label: 'Template',
-        category: 'Deploy Tabs',
-        configKey: 'hideDeployTemplate' as const,
-        hint: 'Hide the template publishing option.',
-      },
       {
         id: 'disable-mcp',
         label: 'MCP Tools',
@@ -1107,6 +1111,10 @@ export function GroupDetail({
   )
 
   const setFileShareAuthTypes = useCallback((values: string[]) => {
+    // At least one mode must stay allowed while public sharing is enabled — an
+    // empty allow-list would silently block every share. To turn public sharing
+    // off entirely, uncheck Public Sharing instead.
+    if (values.length === 0) return
     setEditingConfig((prev) => ({
       ...prev,
       allowedFileShareAuthTypes:
@@ -1114,6 +1122,23 @@ export function GroupDetail({
     }))
   }, [])
 
+  const chatDeployAuthValue = useMemo(
+    () => editingConfig.allowedChatDeployAuthTypes ?? ALL_CHAT_DEPLOY_AUTH_TYPES,
+    [editingConfig.allowedChatDeployAuthTypes]
+  )
+
+  const setChatDeployAuthTypes = useCallback((values: string[]) => {
+    // At least one mode must stay allowed while chat deploy is enabled — an empty
+    // allow-list would silently block every chat deployment. To turn chat deploy
+    // off entirely, use the Hide Chat toggle instead.
+    if (values.length === 0) return
+    setEditingConfig((prev) => ({
+      ...prev,
+      allowedChatDeployAuthTypes:
+        values.length === ALL_CHAT_DEPLOY_AUTH_TYPES.length ? null : (values as ShareAuthType[]),
+    }))
+  }, [])
+
   /** Persists the editing buffer. */
   const handleSaveConfig = useCallback(async () => {
     try {
@@ -1495,10 +1520,10 @@ export function GroupDetail({
                           onCheckedChange={() => toggleIntegration(block.type)}
                         />
                         <div
-                          className='relative flex h-[16px] w-[16px] flex-shrink-0 items-center justify-center overflow-hidden rounded-sm'
+                          className='relative flex size-[16px] flex-shrink-0 items-center justify-center overflow-hidden rounded-sm'
                           style={{ background: block.bgColor }}
                         >
-                          {BlockIcon && <BlockIcon className='!h-[10px] !w-[10px] text-white' />}
+                          {BlockIcon && <BlockIcon className='!size-[9px] text-white' />}
                         </div>
                         <span className='truncate font-medium text-sm'>{block.name}</span>
                       </label>
@@ -1594,6 +1619,29 @@ export function GroupDetail({
                 </div>
               </SettingsSection>
             ))}
+            <SettingsSection label='Chat'>
+              <div
+                className={cn(
+                  'flex flex-col gap-1.5 px-2 pt-1',
+                  editingConfig.hideDeployChatbot && 'opacity-50'
+                )}
+              >
+                <span className='text-[var(--text-secondary)] text-xs'>
+                  Auth modes chat deployments may use
+                </span>
+                <ChipDropdown
+                  multiple
+                  showAllOption={false}
+                  allLabel='None'
+                  value={chatDeployAuthValue}
+                  onChange={setChatDeployAuthTypes}
+                  options={CHAT_DEPLOY_AUTH_TYPE_OPTIONS}
+                  disabled={editingConfig.hideDeployChatbot}
+                  matchTriggerWidth={false}
+                  className='w-[200px]'
+                />
+              </div>
+            </SettingsSection>
             <SettingsSection label='Files'>
               <div className='flex flex-col gap-1.5'>
                 <label
diff --git a/apps/sim/ee/access-control/utils/permission-check.test.ts b/apps/sim/ee/access-control/utils/permission-check.test.ts
index 13352b9fb00..141c166dc3b 100644
--- a/apps/sim/ee/access-control/utils/permission-check.test.ts
+++ b/apps/sim/ee/access-control/utils/permission-check.test.ts
@@ -37,7 +37,7 @@ const {
     hideDeployApi: false,
     hideDeployMcp: false,
     hideDeployChatbot: false,
-    hideDeployTemplate: false,
+    allowedChatDeployAuthTypes: null,
   },
   mockGetAllowedIntegrationsFromEnv: vi.fn<() => string[] | null>(),
   mockIsOrganizationOnEnterprisePlan: vi.fn<() => Promise<boolean>>(),
@@ -134,6 +134,7 @@ vi.mock('@/blocks/registry', () => ({
 
 import {
   assertPermissionsAllowed,
+  ChatDeployAuthNotAllowedError,
   CustomToolsNotAllowedError,
   getUserPermissionConfig,
   IntegrationNotAllowedError,
@@ -144,6 +145,7 @@ import {
   SkillsNotAllowedError,
   ToolNotAllowedError,
   validateBlockType,
+  validateChatDeployAuth,
   validateMcpToolsAllowed,
   validateModelProvider,
   validatePublicFileSharing,
@@ -551,6 +553,38 @@ describe('validatePublicFileSharing', () => {
   })
 })
 
+describe('validateChatDeployAuth', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockWorkspaceGroups.value = []
+    mockDefaultGroup.value = []
+    mockGetAllowedIntegrationsFromEnv.mockReturnValue(null)
+    setEnterpriseOrgWorkspace()
+  })
+
+  it('throws when the auth type is not in the allow-list', async () => {
+    mockWorkspaceGroups.value = [{ config: { allowedChatDeployAuthTypes: ['password', 'sso'] } }]
+    await expect(
+      validateChatDeployAuth('user-123', 'workspace-1', 'public')
+    ).rejects.toBeInstanceOf(ChatDeployAuthNotAllowedError)
+  })
+
+  it('allows an auth type that is in the allow-list', async () => {
+    mockWorkspaceGroups.value = [{ config: { allowedChatDeployAuthTypes: ['password', 'sso'] } }]
+    await validateChatDeployAuth('user-123', 'workspace-1', 'password')
+  })
+
+  it('allows any auth type when the allow-list is null', async () => {
+    mockWorkspaceGroups.value = [{ config: { allowedChatDeployAuthTypes: null } }]
+    await validateChatDeployAuth('user-123', 'workspace-1', 'email')
+  })
+
+  it('no-ops when access control does not apply (non-enterprise)', async () => {
+    mockIsOrganizationOnEnterprisePlan.mockResolvedValue(false)
+    await validateChatDeployAuth('user-123', 'workspace-1', 'public')
+  })
+})
+
 describe('assertPermissionsAllowed', () => {
   beforeEach(() => {
     vi.clearAllMocks()
diff --git a/apps/sim/ee/access-control/utils/permission-check.ts b/apps/sim/ee/access-control/utils/permission-check.ts
index 611ea077b45..d83b16e8f62 100644
--- a/apps/sim/ee/access-control/utils/permission-check.ts
+++ b/apps/sim/ee/access-control/utils/permission-check.ts
@@ -99,6 +99,13 @@ export class PublicFileSharingNotAllowedError extends Error {
   }
 }
 
+export class ChatDeployAuthNotAllowedError extends Error {
+  constructor() {
+    super('This chat authentication mode is not allowed based on your permission group settings')
+    this.name = 'ChatDeployAuthNotAllowedError'
+  }
+}
+
 /**
  * Merges the env allowlist into a permission config.
  * If `config` is null and no env allowlist is set, returns null.
@@ -294,6 +301,35 @@ export async function validatePublicFileSharing(
   }
 }
 
+/**
+ * Throws {@link ChatDeployAuthNotAllowedError} if the user's effective permission
+ * group for the workspace doesn't allow the chat deployment's `authType` (i.e. it
+ * isn't in the group's `allowedChatDeployAuthTypes` allow-list; `null` allows all).
+ * No-op when access control doesn't apply (non-enterprise / disabled), so
+ * non-governed orgs are unaffected.
+ */
+export async function validateChatDeployAuth(
+  userId: string,
+  workspaceId: string,
+  authType: ShareAuthType
+): Promise<void> {
+  const config = await getUserPermissionConfig(userId, workspaceId)
+  if (!config) {
+    return
+  }
+  if (
+    config.allowedChatDeployAuthTypes !== null &&
+    !config.allowedChatDeployAuthTypes.includes(authType)
+  ) {
+    logger.warn('Chat deploy auth type blocked by permission group', {
+      userId,
+      workspaceId,
+      authType,
+    })
+    throw new ChatDeployAuthNotAllowedError()
+  }
+}
+
 /**
  * Org-addressed variant of {@link getUserPermissionConfig}. Use when only the
  * organization is known (e.g. organization-level invitations). Non-default
diff --git a/apps/sim/ee/workspace-forking/lib/background-work/store.test.ts b/apps/sim/ee/workspace-forking/lib/background-work/store.test.ts
index bffc56645c9..04313635abe 100644
--- a/apps/sim/ee/workspace-forking/lib/background-work/store.test.ts
+++ b/apps/sim/ee/workspace-forking/lib/background-work/store.test.ts
@@ -88,9 +88,21 @@ describe('listSurfacedBackgroundWork', () => {
   it('trims the over-fetched row and encodes the next cursor from the last returned row', async () => {
     mockChildrenLookup([])
     const rows = [
-      { id: 'job-1', updatedAt: new Date('2026-07-01T10:00:00.000Z') },
-      { id: 'job-2', updatedAt: new Date('2026-07-01T09:00:00.000Z') },
-      { id: 'job-3', updatedAt: new Date('2026-07-01T08:00:00.000Z') },
+      {
+        id: 'job-1',
+        updatedAt: new Date('2026-07-01T10:00:00.000Z'),
+        updatedAtCursor: '2026-07-01 10:00:00',
+      },
+      {
+        id: 'job-2',
+        updatedAt: new Date('2026-07-01T09:00:00.000Z'),
+        updatedAtCursor: '2026-07-01 09:00:00',
+      },
+      {
+        id: 'job-3',
+        updatedAt: new Date('2026-07-01T08:00:00.000Z'),
+        updatedAtCursor: '2026-07-01 08:00:00',
+      },
     ]
     dbChainMockFns.limit.mockResolvedValueOnce(rows as never)
 
@@ -100,14 +112,40 @@ describe('listSurfacedBackgroundWork', () => {
     expect(result.rows).toEqual(rows.slice(0, 2))
     expect(result.nextCursor).not.toBeNull()
     expect(decodeCursor(result.nextCursor as string)).toEqual({
-      updatedAt: '2026-07-01T09:00:00.000Z',
+      updatedAt: '2026-07-01 09:00:00',
       id: 'job-2',
     })
   })
 
+  it('encodes the cursor from the exact microsecond timestamp text, not the truncated Date', async () => {
+    mockChildrenLookup([])
+    // The Date column value is millisecond-truncated by Drizzle; the cursor must
+    // carry the microsecond text so the keyset boundary is exact.
+    dbChainMockFns.limit.mockResolvedValueOnce([
+      {
+        id: 'job-1',
+        updatedAt: new Date('2026-07-01T10:00:00.123Z'),
+        updatedAtCursor: '2026-07-01 10:00:00.123456',
+      },
+      {
+        id: 'job-2',
+        updatedAt: new Date('2026-07-01T09:00:00.000Z'),
+        updatedAtCursor: '2026-07-01 09:00:00',
+      },
+    ] as never)
+
+    const result = await listSurfacedBackgroundWork(executor, 'ws-1', { limit: 1 })
+
+    expect(decodeCursor(result.nextCursor as string)).toEqual({
+      updatedAt: '2026-07-01 10:00:00.123456',
+      id: 'job-1',
+    })
+  })
+
   it('applies the cursor as a keyset condition with the id tiebreaker', async () => {
     mockChildrenLookup([])
-    const cursor = encodeCursor({ updatedAt: '2026-07-01T09:00:00.000Z', id: 'job-2' })
+    const cursorTimestamp = '2026-07-01 09:00:00.123456'
+    const cursor = encodeCursor({ updatedAt: cursorTimestamp, id: 'job-2' })
 
     await listSurfacedBackgroundWork(executor, 'ws-1', { cursor })
 
@@ -115,21 +153,51 @@ describe('listSurfacedBackgroundWork', () => {
     expect(rowsWhere.type).toBe('and')
     expect(rowsWhere.conditions).toHaveLength(3)
 
-    const cursorDate = new Date('2026-07-01T09:00:00.000Z')
+    // The cursor timestamp is bound as a `::timestamp`-cast SQL fragment so the
+    // comparison happens at full microsecond precision in Postgres.
+    const expectedTimestampFragment = expect.objectContaining({ values: [cursorTimestamp] })
     const keyset = (rowsWhere.conditions as MockCondition[])[2]
-    expect(keyset).toEqual({
-      type: 'or',
-      conditions: [
-        { type: 'lt', left: 'updatedAt', right: cursorDate },
-        {
-          type: 'and',
-          conditions: [
-            { type: 'eq', left: 'updatedAt', right: cursorDate },
-            { type: 'lt', left: 'id', right: 'job-2' },
-          ],
-        },
-      ],
-    })
+    expect(keyset).toEqual(
+      expect.objectContaining({
+        type: 'or',
+        conditions: [
+          expect.objectContaining({
+            type: 'lt',
+            left: 'updatedAt',
+            right: expectedTimestampFragment,
+          }),
+          expect.objectContaining({
+            type: 'and',
+            conditions: [
+              expect.objectContaining({
+                type: 'eq',
+                left: 'updatedAt',
+                right: expectedTimestampFragment,
+              }),
+              expect.objectContaining({ type: 'lt', left: 'id', right: 'job-2' }),
+            ],
+          }),
+        ],
+      })
+    )
+  })
+
+  it('accepts a legacy ISO cursor produced before the text-precision format', async () => {
+    mockChildrenLookup([])
+    const cursor = encodeCursor({ updatedAt: '2026-07-01T09:00:00.000Z', id: 'job-2' })
+
+    await listSurfacedBackgroundWork(executor, 'ws-1', { cursor })
+
+    const rowsWhere = dbChainMockFns.where.mock.calls[1][0] as MockCondition
+    expect(rowsWhere.conditions).toHaveLength(3)
+    const keyset = (rowsWhere.conditions as MockCondition[])[2]
+    expect((keyset.conditions as MockCondition[])[0]).toEqual(
+      expect.objectContaining({
+        type: 'lt',
+        left: 'updatedAt',
+        right: expect.objectContaining({ values: ['2026-07-01T09:00:00.000Z'] }),
+      })
+    )
   })
 
   it('pages through rows with identical updatedAt via the id tiebreaker', async () => {
@@ -137,21 +205,26 @@ describe('listSurfacedBackgroundWork', () => {
     // cursor must carry that id so the second page matches the remaining row
     // through the eq(updatedAt) + lt(id) arm instead of skipping it.
     const sharedAt = new Date('2026-07-01T09:00:00.000Z')
+    const sharedAtCursor = '2026-07-01 09:00:00'
     mockChildrenLookup([])
     dbChainMockFns.limit.mockResolvedValueOnce([
-      { id: 'job-b', updatedAt: sharedAt },
-      { id: 'job-a', updatedAt: sharedAt },
+      { id: 'job-b', updatedAt: sharedAt, updatedAtCursor: sharedAtCursor },
+      { id: 'job-a', updatedAt: sharedAt, updatedAtCursor: sharedAtCursor },
     ] as never)
 
     const firstPage = await listSurfacedBackgroundWork(executor, 'ws-1', { limit: 1 })
-    expect(firstPage.rows).toEqual([{ id: 'job-b', updatedAt: sharedAt }])
+    expect(firstPage.rows).toEqual([
+      { id: 'job-b', updatedAt: sharedAt, updatedAtCursor: sharedAtCursor },
+    ])
     expect(decodeCursor(firstPage.nextCursor as string)).toEqual({
-      updatedAt: sharedAt.toISOString(),
+      updatedAt: sharedAtCursor,
       id: 'job-b',
     })
 
     mockChildrenLookup([])
-    dbChainMockFns.limit.mockResolvedValueOnce([{ id: 'job-a', updatedAt: sharedAt }] as never)
+    dbChainMockFns.limit.mockResolvedValueOnce([
+      { id: 'job-a', updatedAt: sharedAt, updatedAtCursor: sharedAtCursor },
+    ] as never)
 
     const secondPage = await listSurfacedBackgroundWork(executor, 'ws-1', {
       cursor: firstPage.nextCursor as string,
@@ -160,17 +233,47 @@ describe('listSurfacedBackgroundWork', () => {
 
     const rowsWhere = dbChainMockFns.where.mock.calls[3][0] as MockCondition
     const keyset = (rowsWhere.conditions as MockCondition[])[2]
-    expect(keyset.conditions?.[1]).toEqual({
-      type: 'and',
-      conditions: [
-        { type: 'eq', left: 'updatedAt', right: sharedAt },
-        { type: 'lt', left: 'id', right: 'job-b' },
-      ],
-    })
-    expect(secondPage.rows).toEqual([{ id: 'job-a', updatedAt: sharedAt }])
+    expect(keyset.conditions?.[1]).toEqual(
+      expect.objectContaining({
+        type: 'and',
+        conditions: [
+          expect.objectContaining({
+            type: 'eq',
+            left: 'updatedAt',
+            right: expect.objectContaining({ values: [sharedAtCursor] }),
+          }),
+          expect.objectContaining({ type: 'lt', left: 'id', right: 'job-b' }),
+        ],
+      })
+    )
+    expect(secondPage.rows).toEqual([
+      { id: 'job-a', updatedAt: sharedAt, updatedAtCursor: sharedAtCursor },
+    ])
     expect(secondPage.nextCursor).toBeNull()
   })
 
+  it('ignores a cursor whose timestamp Postgres would reject and serves the first page', async () => {
+    // Feb 30 parses in JS (Date normalizes it to Mar 2) but fails a Postgres
+    // ::timestamp cast — it must degrade to the first page, not a 500.
+    mockChildrenLookup([])
+    const cursor = encodeCursor({ updatedAt: '2026-02-30 09:00:00', id: 'job-2' })
+
+    await listSurfacedBackgroundWork(executor, 'ws-1', { cursor })
+
+    const rowsWhere = dbChainMockFns.where.mock.calls[1][0] as MockCondition
+    expect(rowsWhere.conditions).toHaveLength(2)
+  })
+
+  it('ignores a cursor with an out-of-range time and serves the first page', async () => {
+    mockChildrenLookup([])
+    const cursor = encodeCursor({ updatedAt: '2026-07-01 99:00:00', id: 'job-2' })
+
+    await listSurfacedBackgroundWork(executor, 'ws-1', { cursor })
+
+    const rowsWhere = dbChainMockFns.where.mock.calls[1][0] as MockCondition
+    expect(rowsWhere.conditions).toHaveLength(2)
+  })
+
   it('ignores an undecodable cursor and serves the first page', async () => {
     mockChildrenLookup([])
 
diff --git a/apps/sim/ee/workspace-forking/lib/background-work/store.ts b/apps/sim/ee/workspace-forking/lib/background-work/store.ts
index a0f86376b27..facb4431fbd 100644
--- a/apps/sim/ee/workspace-forking/lib/background-work/store.ts
+++ b/apps/sim/ee/workspace-forking/lib/background-work/store.ts
@@ -1,7 +1,19 @@
 import { backgroundWorkStatus, workspace } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { generateId } from '@sim/utils/id'
-import { and, desc, eq, inArray, isNull, lt, lte, or, type SQL, sql } from 'drizzle-orm'
+import {
+  and,
+  desc,
+  eq,
+  getTableColumns,
+  inArray,
+  isNull,
+  lt,
+  lte,
+  or,
+  type SQL,
+  sql,
+} from 'drizzle-orm'
 import type { DbOrTx } from '@/lib/db/types'
 
 const logger = createLogger('ForkBackgroundWork')
@@ -185,7 +197,11 @@ function toMetadataRecord(value: unknown): Record<string, unknown> {
     : {}
 }
 
-/** Keyset position of the last row of a page: `updatedAt` plus the `id` tiebreaker. */
+/**
+ * Keyset position of the last row of a page: `updatedAt` plus the `id` tiebreaker.
+ * `updatedAt` carries the row's Postgres text rendering (full microsecond
+ * precision), not a JS `Date` serialization — see {@link buildCursorCondition}.
+ */
 interface BackgroundWorkCursorData {
   updatedAt: string
   id: string
@@ -204,22 +220,55 @@ function decodeCursor(cursor: string): BackgroundWorkCursorData | null {
   }
 }
 
+/**
+ * Cursor timestamp formats this store has ever encoded: the Postgres text
+ * rendering (`YYYY-MM-DD HH:MM:SS[.ffffff]`) and the legacy `toISOString()`
+ * form (`YYYY-MM-DDTHH:MM:SS.fffZ`).
+ */
+const CURSOR_TIMESTAMP_PATTERN =
+  /^\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])[T ]([01]\d|2[0-3]):[0-5]\d:[0-5]\d(\.\d{1,6})?Z?$/
+
+/**
+ * Validates a cursor timestamp before it is bound into a `::timestamp` cast.
+ * The pattern pins format and field ranges; the calendar check rejects
+ * impossible dates (e.g. Feb 30) that JS `Date` silently normalizes but
+ * Postgres rejects with an error — an invalid cursor must degrade to the
+ * first page, never fail the query.
+ */
+function isValidCursorTimestamp(value: string): boolean {
+  if (!CURSOR_TIMESTAMP_PATTERN.test(value)) return false
+  const [year, month, day] = value.slice(0, 10).split('-').map(Number)
+  const date = new Date(Date.UTC(year, month - 1, day))
+  return date.getUTCMonth() === month - 1 && date.getUTCDate() === day
+}
+
 /**
  * Keyset condition for rows strictly after the cursor position in
  * `updatedAt DESC, id DESC` order: older `updatedAt`, or the same `updatedAt`
  * (which is not unique) with a smaller `id`. Null for an invalid cursor, which
  * degrades to the first page rather than erroring.
+ *
+ * The cursor timestamp is compared via a `::timestamp` cast of the captured
+ * text rather than a JS `Date`: Drizzle dates truncate Postgres microsecond
+ * timestamps to milliseconds, and a truncated boundary value both skips rows
+ * sharing the boundary row's millisecond and never matches the `eq` tiebreaker
+ * arm for microsecond-stamped rows. Legacy cursors that carry an ISO string
+ * (pre-text format) parse through the same cast — the zone suffix is dropped
+ * and the value is read as the same UTC wall time the app stores.
  */
 function buildCursorCondition(cursor: string): SQL<unknown> | null {
   const cursorData = decodeCursor(cursor)
   if (!cursorData?.updatedAt || !cursorData.id) return null
 
-  const cursorDate = new Date(cursorData.updatedAt)
-  if (Number.isNaN(cursorDate.getTime())) return null
+  if (!isValidCursorTimestamp(cursorData.updatedAt)) return null
+  const cursorTimestamp = sql`${cursorData.updatedAt}::timestamp`
 
   return or(
-    lt(backgroundWorkStatus.updatedAt, cursorDate),
-    and(eq(backgroundWorkStatus.updatedAt, cursorDate), lt(backgroundWorkStatus.id, cursorData.id))
+    lt(backgroundWorkStatus.updatedAt, cursorTimestamp),
+    and(
+      eq(backgroundWorkStatus.updatedAt, cursorTimestamp),
+      lt(backgroundWorkStatus.id, cursorData.id)
+    )
   )!
 }
 
@@ -286,18 +335,23 @@ export async function listSurfacedBackgroundWork(
   }
 
   // Over-fetch by one row to learn whether another page exists (audit-log pattern).
+  // `updatedAtCursor` captures the exact microsecond timestamp for the keyset
+  // cursor; the Date-typed `updatedAt` is millisecond-truncated by Drizzle.
   const rows = (await executor
-    .select()
+    .select({
+      ...getTableColumns(backgroundWorkStatus),
+      updatedAtCursor: sql<string>`${backgroundWorkStatus.updatedAt}::text`,
+    })
     .from(backgroundWorkStatus)
     .where(and(...conditions))
     .orderBy(desc(backgroundWorkStatus.updatedAt), desc(backgroundWorkStatus.id))
-    .limit(limit + 1)) as BackgroundWorkRow[]
+    .limit(limit + 1)) as Array<BackgroundWorkRow & { updatedAtCursor: string }>
 
   const hasMore = rows.length > limit
   const page = rows.slice(0, limit)
   const last = page[page.length - 1]
   const nextCursor =
-    hasMore && last ? encodeCursor({ updatedAt: last.updatedAt.toISOString(), id: last.id }) : null
+    hasMore && last ? encodeCursor({ updatedAt: last.updatedAtCursor, id: last.id }) : null
   return { rows: page, nextCursor }
 }
 
diff --git a/apps/sim/ee/workspace-forking/lib/copy/copy-workflows.ts b/apps/sim/ee/workspace-forking/lib/copy/copy-workflows.ts
index 2fede080ea6..62ee9de38c2 100644
--- a/apps/sim/ee/workspace-forking/lib/copy/copy-workflows.ts
+++ b/apps/sim/ee/workspace-forking/lib/copy/copy-workflows.ts
@@ -451,7 +451,12 @@ export async function copyWorkflowStateIntoTarget(
       clearUnmapped: true,
       canonicalModes: activeCanonicalModes,
     })
-    subBlocks = remapConditionIdsInSubBlocks(subBlocks, oldBlockId, newBlockId) as SubBlockRecord
+    subBlocks = remapConditionIdsInSubBlocks(
+      subBlocks,
+      block.type,
+      oldBlockId,
+      newBlockId
+    ) as SubBlockRecord
 
     // Apply the stored dependent values for this block (the modal's mapping). The reference
     // transform already cleared the source's dependent values when their parent was remapped,
diff --git a/apps/sim/executor/handlers/agent/agent-handler.ts b/apps/sim/executor/handlers/agent/agent-handler.ts
index 81018c20bf1..a09d70e3f31 100644
--- a/apps/sim/executor/handlers/agent/agent-handler.ts
+++ b/apps/sim/executor/handlers/agent/agent-handler.ts
@@ -9,6 +9,7 @@ import { normalizeStringRecord, normalizeWorkflowVariables } from '@/lib/core/ut
 import { createMcpToolId } from '@/lib/mcp/utils'
 import { processFilesToUserFiles, type RawFileInput } from '@/lib/uploads/utils/file-utils'
 import { hydrateUserFilesWithBase64 } from '@/lib/uploads/utils/user-file-base64.server'
+import { resolveCustomBlockToolBinding } from '@/lib/workflows/custom-blocks/operations'
 import { getCustomToolById } from '@/lib/workflows/custom-tools/operations'
 import { getAllBlocks } from '@/blocks'
 import type { BlockOutput } from '@/blocks/types'
@@ -581,6 +582,8 @@ export class AgentBlockHandler implements BlockHandler {
       getTool,
       canonicalModes,
       toolIndex,
+      resolveCustomBlockBinding: (blockType: string) =>
+        resolveCustomBlockToolBinding(blockType, ctx.workspaceId),
     })
 
     if (transformedTool) {
diff --git a/apps/sim/executor/handlers/pi/sim-tools.ts b/apps/sim/executor/handlers/pi/sim-tools.ts
index 8956b4a7dcb..f8e56a2ab93 100644
--- a/apps/sim/executor/handlers/pi/sim-tools.ts
+++ b/apps/sim/executor/handlers/pi/sim-tools.ts
@@ -9,12 +9,14 @@
 
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
+import { resolveCustomBlockToolBinding } from '@/lib/workflows/custom-blocks/operations'
 import { getAllBlocks } from '@/blocks/registry'
 import type { ToolInput } from '@/executor/handlers/agent/types'
 import type { PiToolResult, PiToolSpec } from '@/executor/handlers/pi/backend'
 import type { ExecutionContext } from '@/executor/types'
 import { transformBlockTool } from '@/providers/utils'
 import { executeTool } from '@/tools'
+import { mergeToolParameters } from '@/tools/params'
 import type { ToolResponse } from '@/tools/types'
 import { getTool } from '@/tools/utils'
 import { getToolAsync } from '@/tools/utils.server'
@@ -52,6 +54,8 @@ export async function buildSimToolSpecs(
         getAllBlocks,
         getTool,
         getToolAsync,
+        resolveCustomBlockBinding: (blockType: string) =>
+          resolveCustomBlockToolBinding(blockType, ctx.workspaceId),
       })
 
       if (!provider?.id) continue
@@ -71,8 +75,11 @@ export async function buildSimToolSpecs(
             const result = await executeTool(
               toolId,
               {
-                ...preseededParams,
-                ...args,
+                // Same merge the Agent block's tool calls use: user-preseeded values
+                // win over LLM args, and `inputMapping` is deep-merged rather than
+                // replaced — a partial mapping from the model must not drop the
+                // user-filled fields baked onto the block.
+                ...mergeToolParameters(preseededParams, args as Record<string, unknown>),
                 // Trusted execution context, spread last so an LLM-supplied
                 // `_context` arg can't override it. executeTool reads this directly
                 // for OAuth-credential resolution and internal-route identity, the
diff --git a/apps/sim/executor/handlers/workflow/custom-block-tool-runner.test.ts b/apps/sim/executor/handlers/workflow/custom-block-tool-runner.test.ts
new file mode 100644
index 00000000000..edc83663b1c
--- /dev/null
+++ b/apps/sim/executor/handlers/workflow/custom-block-tool-runner.test.ts
@@ -0,0 +1,110 @@
+/**
+ * @vitest-environment node
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockExecute } = vi.hoisted(() => ({ mockExecute: vi.fn() }))
+
+vi.mock('@/executor/handlers/workflow/workflow-handler', () => ({
+  WorkflowBlockHandler: class {
+    execute = mockExecute
+  },
+  aggregateChildCost: (spans: Array<{ cost?: { total?: number } }>) =>
+    spans.reduce((sum, span) => sum + (span?.cost?.total ?? 0), 0),
+}))
+
+import { ChildWorkflowError } from '@/executor/errors/child-workflow-error'
+import {
+  buildCustomBlockExecutionContext,
+  runCustomBlockTool,
+} from '@/executor/handlers/workflow/custom-block-tool-runner'
+
+describe('buildCustomBlockExecutionContext', () => {
+  it('carries consumer identity, inherits the call chain, and is fully scaffolded', () => {
+    const ctx = buildCustomBlockExecutionContext({
+      workspaceId: 'ws-consumer',
+      userId: 'u-consumer',
+      workflowId: 'wf-parent',
+      callChain: ['wf-parent'],
+      billingAttribution: { actorUserId: 'u-consumer', workspaceId: 'ws-consumer' } as any,
+    })
+
+    expect(ctx.workspaceId).toBe('ws-consumer')
+    expect(ctx.userId).toBe('u-consumer')
+    // Inherited (not reset) so the handler's depth guard keeps bounding recursion.
+    expect(ctx.callChain).toEqual(['wf-parent'])
+    // metadata must be a real object — the handler reads it unconditionally.
+    expect(ctx.metadata).toBeTypeOf('object')
+    expect(ctx.metadata.billingAttribution).toEqual({
+      actorUserId: 'u-consumer',
+      workspaceId: 'ws-consumer',
+    })
+    expect(ctx.metadata.executionMode).toBe('sync')
+    // Non-optional scaffolding present.
+    expect(ctx.blockStates).toBeInstanceOf(Map)
+    expect(ctx.executedBlocks).toBeInstanceOf(Set)
+    expect(ctx.completedLoops).toBeInstanceOf(Set)
+    expect(ctx.activeExecutionPath).toBeInstanceOf(Set)
+    expect(ctx.decisions.router).toBeInstanceOf(Map)
+    expect(ctx.decisions.condition).toBeInstanceOf(Map)
+    expect(Array.isArray(ctx.blockLogs)).toBe(true)
+    expect(ctx.executionId).toBeTruthy()
+  })
+
+  it('defaults the call chain to [] when none is provided', () => {
+    expect(buildCustomBlockExecutionContext({}).callChain).toEqual([])
+  })
+})
+
+describe('runCustomBlockTool', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('runs the handler with the synthetic ctx and returns its projected output', async () => {
+    mockExecute.mockResolvedValue({ success: true, result: { answer: 'hi' }, cost: { total: 0.5 } })
+
+    const res = await runCustomBlockTool({
+      blockType: 'custom_block_abc',
+      inputMapping: '{"field-question":"hi"}',
+      _context: { workspaceId: 'ws-consumer', userId: 'u-consumer' },
+    })
+
+    expect(res.success).toBe(true)
+    expect(res.output.cost).toEqual({ total: 0.5 })
+
+    const [ctxArg, blockArg, inputsArg] = mockExecute.mock.calls[0]
+    expect(ctxArg.workspaceId).toBe('ws-consumer')
+    expect(blockArg.metadata.id).toBe('custom_block_abc')
+    expect(inputsArg).toEqual({ inputMapping: '{"field-question":"hi"}' })
+  })
+
+  it('surfaces a handler failure as a clean tool error', async () => {
+    mockExecute.mockRejectedValue(new Error('This block’s workflow is not deployed.'))
+
+    const res = await runCustomBlockTool({ blockType: 'custom_block_abc', _context: {} })
+
+    expect(res.success).toBe(false)
+    expect(res.error).toContain('not deployed')
+  })
+
+  it('rolls up already-incurred child cost when the run fails', async () => {
+    const err: any = new Error('child blew up')
+    err.name = 'ChildWorkflowError'
+    err.childTraceSpans = [{ id: 's1', name: 'child', type: 'agent', cost: { total: 0.25 } }]
+    Object.setPrototypeOf(err, ChildWorkflowError.prototype)
+    mockExecute.mockRejectedValue(err)
+
+    const res = await runCustomBlockTool({ blockType: 'custom_block_abc', _context: {} })
+
+    expect(res.success).toBe(false)
+    // Partial spend must not be recorded as zero-cost.
+    expect((res.output as any).cost.total).toBeGreaterThan(0)
+  })
+
+  it('rejects a missing block type without invoking the handler', async () => {
+    const res = await runCustomBlockTool({ _context: {} })
+    expect(res.success).toBe(false)
+    expect(mockExecute).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/sim/executor/handlers/workflow/custom-block-tool-runner.ts b/apps/sim/executor/handlers/workflow/custom-block-tool-runner.ts
new file mode 100644
index 00000000000..bd9db63949c
--- /dev/null
+++ b/apps/sim/executor/handlers/workflow/custom-block-tool-runner.ts
@@ -0,0 +1,132 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { generateId } from '@sim/utils/id'
+import type { BillingAttributionSnapshot } from '@/lib/billing/core/billing-attribution'
+import { ChildWorkflowError } from '@/executor/errors/child-workflow-error'
+import {
+  aggregateChildCost,
+  WorkflowBlockHandler,
+} from '@/executor/handlers/workflow/workflow-handler'
+import type { ExecutionContext } from '@/executor/types'
+import type { SerializedBlock } from '@/serializer/types'
+import type { ToolResponse } from '@/tools/types'
+
+const logger = createLogger('CustomBlockToolRunner')
+
+/** Server-set execution context propagated to every agent tool call. */
+interface CustomBlockExecutorContext {
+  workspaceId?: string
+  userId?: string
+  workflowId?: string
+  callChain?: string[]
+  isDeployedContext?: boolean
+  billingAttribution?: BillingAttributionSnapshot
+}
+
+interface CustomBlockToolParams {
+  /** The `custom_block_*` type to run — authority is re-resolved from it server-side. */
+  blockType?: string
+  /** Input values keyed by the source field's stable id (assembled + LLM-filled). */
+  inputMapping?: Record<string, unknown> | string
+  _context?: CustomBlockExecutorContext
+}
+
+/**
+ * Build a minimal top-level `ExecutionContext` for running a custom block as an
+ * agent tool. Every value comes from the server-set `_context` (LLM-proof) plus a
+ * fresh executionId. `WorkflowBlockHandler`'s custom-block path re-derives owner
+ * identity, env, and billing from `getCustomBlockAuthority`, so this only needs the
+ * fields that path reads — `workspaceId` (org-scopes the authority lookup),
+ * `metadata` (read unconditionally at `executeCore`), and `callChain` (recursion
+ * depth guard, inherited so it never resets across hops) — plus the non-optional
+ * scaffolding. Keep in sync with `WorkflowBlockHandler.executeCore`'s custom branch.
+ */
+export function buildCustomBlockExecutionContext(
+  context: CustomBlockExecutorContext
+): ExecutionContext {
+  const executionId = generateId()
+  return {
+    workflowId: context.workflowId ?? 'custom-block-tool',
+    workspaceId: context.workspaceId,
+    userId: context.userId,
+    executionId,
+    isDeployedContext: context.isDeployedContext,
+    // Inherit the accumulated chain so the handler appends + validates depth;
+    // resetting to [] would let a self-referential custom block recurse unbounded.
+    callChain: context.callChain ?? [],
+    environmentVariables: {},
+    blockStates: new Map(),
+    executedBlocks: new Set(),
+    blockLogs: [],
+    decisions: { router: new Map(), condition: new Map() },
+    completedLoops: new Set(),
+    activeExecutionPath: new Set(),
+    // `WorkflowBlockHandler` reads only `billingAttribution` + `executionMode` on the
+    // custom-block path; `duration` is the sole required field on the metadata type.
+    metadata: {
+      duration: 0,
+      requestId: generateId(),
+      executionId,
+      workflowId: context.workflowId,
+      workspaceId: context.workspaceId,
+      userId: context.userId,
+      billingAttribution: context.billingAttribution,
+      executionMode: 'sync',
+    },
+  }
+}
+
+/**
+ * Runs a published custom block (deploy-as-block) as an Agent tool, in-process via
+ * `WorkflowBlockHandler` — the same invocation boundary the canvas uses — so
+ * authority (org-scoped owner identity, latest deployment, curated outputs,
+ * required-input enforcement, cost roll-up) is resolved server-side from the block
+ * type. No HTTP hop and no body-field trust: the block type + consumer workspace
+ * come from the server-set `_context`, not the model.
+ *
+ * Lives in a server-only module (dynamic-imported by `executeTool`) so the
+ * client-bundled tool registry never pulls in the executor/db dependency graph.
+ */
+export async function runCustomBlockTool(params: CustomBlockToolParams): Promise<ToolResponse> {
+  if (!params.blockType) {
+    return { success: false, output: {}, error: 'Missing custom block type' }
+  }
+
+  const ctx = buildCustomBlockExecutionContext(params._context ?? {})
+  const block: SerializedBlock = {
+    id: generateId(),
+    position: { x: 0, y: 0 },
+    config: { tool: 'workflow_executor', params: {} },
+    inputs: {},
+    outputs: {},
+    metadata: { id: params.blockType },
+    enabled: true,
+  }
+
+  try {
+    const output = await new WorkflowBlockHandler().execute(ctx, block, {
+      inputMapping: params.inputMapping,
+    })
+    // Custom blocks never stream (no `onStream` on the synthetic ctx), so the
+    // handler always returns the projected BlockOutput object (with `cost.total`).
+    const normalized: Record<string, any> =
+      output && typeof output === 'object' && !Array.isArray(output) ? output : { result: output }
+    return { success: true, output: normalized }
+  } catch (error) {
+    // The handler throws a consumer-safe `ChildWorkflowError` on failure. Its trace
+    // spans are the only carrier of spend the child already incurred before failing,
+    // so roll that up onto the failed result too — otherwise a partially-run child is
+    // recorded as zero-cost.
+    const message = getErrorMessage(error, 'Custom block execution failed')
+    const failedChildSpans = ChildWorkflowError.isChildWorkflowError(error)
+      ? error.childTraceSpans
+      : []
+    const childCost = aggregateChildCost(failedChildSpans)
+    logger.info('Custom block tool execution failed', { blockType: params.blockType, message })
+    return {
+      success: false,
+      output: childCost > 0 ? { cost: { total: childCost } } : {},
+      error: message,
+    }
+  }
+}
diff --git a/apps/sim/executor/handlers/workflow/workflow-handler.ts b/apps/sim/executor/handlers/workflow/workflow-handler.ts
index eb1763f8935..dddd1a19010 100644
--- a/apps/sim/executor/handlers/workflow/workflow-handler.ts
+++ b/apps/sim/executor/handlers/workflow/workflow-handler.ts
@@ -136,7 +136,7 @@ export function remapCustomBlockInputKeys(
  * breakdowns), minus the base execution charge the parent applies once itself.
  * A naive top-level `cost.total` sum undercounts when spend sits on nested children.
  */
-function aggregateChildCost(childTraceSpans: TraceSpan[]): number {
+export function aggregateChildCost(childTraceSpans: TraceSpan[]): number {
   if (childTraceSpans.length === 0) return 0
   const summary = calculateCostSummary(childTraceSpans)
   return Math.max(0, summary.totalCost - summary.baseExecutionCharge)
diff --git a/apps/sim/hooks/mcp/use-mcp-oauth-popup.test.tsx b/apps/sim/hooks/mcp/use-mcp-oauth-popup.test.tsx
new file mode 100644
index 00000000000..d7720a3971c
--- /dev/null
+++ b/apps/sim/hooks/mcp/use-mcp-oauth-popup.test.tsx
@@ -0,0 +1,304 @@
+/**
+ * @vitest-environment jsdom
+ */
+import { act, type ReactNode } from 'react'
+import { sleep } from '@sim/utils/helpers'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockStartOauth } = vi.hoisted(() => ({ mockStartOauth: vi.fn() }))
+
+vi.mock('@sim/emcn', () => ({
+  toast: { success: vi.fn(), error: vi.fn() },
+}))
+
+vi.mock('@/hooks/queries/mcp', () => ({
+  useStartMcpOauth: () => ({ mutateAsync: mockStartOauth }),
+  mcpKeys: {
+    serversList: (workspaceId: string) => ['mcp', 'servers', workspaceId],
+    serverToolsList: (workspaceId: string, serverId: string) => [
+      'mcp',
+      'server-tools',
+      workspaceId,
+      serverId,
+    ],
+    storedToolsList: (workspaceId: string) => ['mcp', 'stored-tools', workspaceId],
+  },
+}))
+
+import { useMcpOauthPopup } from '@/hooks/mcp/use-mcp-oauth-popup'
+
+/**
+ * Minimal dependency-free hook harness (the repo has no `@testing-library/react`).
+ * Mounts the hook in a real React 19 root under jsdom, wrapped in a real
+ * `QueryClientProvider`, so query/mutation lifecycles run exactly as in the app.
+ */
+function renderHookWithClient<T>(useHook: () => T): {
+  result: () => T
+  queryClient: QueryClient
+  unmount: () => void
+} {
+  ;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
+  const queryClient = new QueryClient({
+    defaultOptions: { queries: { retry: false }, mutations: { retry: false } },
+  })
+  const container = document.createElement('div')
+  const root: Root = createRoot(container)
+  let latest: T
+
+  function Probe() {
+    latest = useHook()
+    return null
+  }
+
+  function Wrapper({ children }: { children: ReactNode }) {
+    return <QueryClientProvider client={queryClient}>{children}</QueryClientProvider>
+  }
+
+  act(() => {
+    root.render(
+      <Wrapper>
+        <Probe />
+      </Wrapper>
+    )
+  })
+
+  return { result: () => latest, queryClient, unmount: () => act(() => root.unmount()) }
+}
+
+async function flush() {
+  await act(async () => {
+    for (let i = 0; i < 5; i++) {
+      await Promise.resolve()
+      await sleep(0)
+    }
+  })
+}
+
+describe('useMcpOauthPopup', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    // Popup-first: startOauthForServer opens a blank window synchronously.
+    window.open = vi.fn(
+      () =>
+        ({
+          close: vi.fn(),
+          focus: vi.fn(),
+          location: { replace: vi.fn() },
+          closed: false,
+        }) as unknown as Window
+    )
+    // jsdom has no BroadcastChannel; the hook opens one on mount.
+    class FakeBroadcastChannel {
+      onmessage: ((event: MessageEvent) => void) | null = null
+      constructor(public name: string) {}
+      postMessage(): void {}
+      close(): void {}
+    }
+    ;(globalThis as unknown as { BroadcastChannel: unknown }).BroadcastChannel =
+      FakeBroadcastChannel
+  })
+
+  afterEach(() => {
+    vi.restoreAllMocks()
+  })
+
+  it('ignores a concurrent second start for the same server (no double popup)', async () => {
+    let resolveStart: (value: unknown) => void = () => {}
+    mockStartOauth.mockImplementation(
+      () =>
+        new Promise((res) => {
+          resolveStart = res
+        })
+    )
+
+    const hook = renderHookWithClient(() => useMcpOauthPopup({ workspaceId: 'w1' }))
+    await flush()
+
+    // Two clicks before /oauth/start resolves — the guard must collapse them to one request.
+    await act(async () => {
+      void hook.result().startOauthForServer('s1')
+      void hook.result().startOauthForServer('s1')
+    })
+    expect(mockStartOauth).toHaveBeenCalledTimes(1)
+
+    // Settle the first flow so the guard clears.
+    await act(async () => {
+      resolveStart({
+        status: 'redirect',
+        authorizationUrl: 'https://as.example/a?state=state-1',
+        state: 'state-1',
+      })
+    })
+    await flush()
+
+    hook.unmount()
+  })
+
+  it('allows a fresh start after the previous one settles (reopen after abandon)', async () => {
+    mockStartOauth.mockResolvedValue({
+      status: 'redirect',
+      authorizationUrl: 'https://as.example/a?state=st',
+      state: 'st',
+    })
+
+    const hook = renderHookWithClient(() => useMcpOauthPopup({ workspaceId: 'w1' }))
+    await flush()
+
+    await act(async () => {
+      await hook.result().startOauthForServer('s1')
+    })
+    await flush()
+
+    await act(async () => {
+      await hook.result().startOauthForServer('s1')
+    })
+    await flush()
+
+    // Both distinct clicks reached the mutation — the guard only blocks concurrent re-entry.
+    expect(mockStartOauth).toHaveBeenCalledTimes(2)
+
+    hook.unmount()
+  })
+
+  it('invalidates server queries when start reports already_authorized', async () => {
+    mockStartOauth.mockResolvedValue({ status: 'already_authorized' })
+
+    const hook = renderHookWithClient(() => useMcpOauthPopup({ workspaceId: 'w1' }))
+    await flush()
+    const invalidateSpy = vi.spyOn(hook.queryClient, 'invalidateQueries')
+
+    await act(async () => {
+      await hook.result().startOauthForServer('s1')
+    })
+    await flush()
+
+    // The server is already connected — the UI must still refresh so it reflects that.
+    expect(invalidateSpy).toHaveBeenCalledWith({ queryKey: ['mcp', 'servers', 'w1'] })
+
+    hook.unmount()
+  })
+
+  it('clears the row when a reopen fails (the reopen blanked the prior window)', async () => {
+    mockStartOauth.mockResolvedValueOnce({
+      status: 'redirect',
+      authorizationUrl: 'https://as.example/a?state=st-a',
+      state: 'st-a',
+    })
+    const hook = renderHookWithClient(() => useMcpOauthPopup({ workspaceId: 'w1' }))
+    await flush()
+
+    await act(async () => {
+      await hook.result().startOauthForServer('s1')
+    })
+    await flush()
+    expect(hook.result().connectingServers.has('s1')).toBe(true)
+
+    // Reopen fails after the named-window open already navigated the prior auth window to
+    // about:blank — the prior flow is moot (windowless), so BOTH it and the failed attempt
+    // clear, leaving the row idle with 'Connect with OAuth' immediately available.
+    mockStartOauth.mockRejectedValueOnce(new Error('start failed'))
+    await act(async () => {
+      await hook.result().startOauthForServer('s1')
+    })
+    await flush()
+    expect(hook.result().connectingServers.has('s1')).toBe(false)
+
+    hook.unmount()
+  })
+
+  it('does not issue the start request when the popup is blocked', async () => {
+    ;(window.open as ReturnType<typeof vi.fn>).mockReturnValue(null)
+    const hook = renderHookWithClient(() => useMcpOauthPopup({ workspaceId: 'w1' }))
+    await flush()
+
+    await act(async () => {
+      await hook.result().startOauthForServer('s1')
+    })
+    await flush()
+
+    expect(mockStartOauth).not.toHaveBeenCalled()
+    expect(hook.result().connectingServers.has('s1')).toBe(false)
+    hook.unmount()
+  })
+
+  it('opens the popup before the start request resolves (popup-first)', async () => {
+    const order: string[] = []
+    ;(window.open as ReturnType<typeof vi.fn>).mockImplementation(() => {
+      order.push('open')
+      return { close: vi.fn(), focus: vi.fn(), location: { replace: vi.fn() } } as unknown as Window
+    })
+    mockStartOauth.mockImplementation(async () => {
+      order.push('start')
+      return { status: 'redirect', authorizationUrl: 'https://as.example/a?state=st', state: 'st' }
+    })
+    const hook = renderHookWithClient(() => useMcpOauthPopup({ workspaceId: 'w1' }))
+    await flush()
+
+    await act(async () => {
+      await hook.result().startOauthForServer('s1')
+    })
+
+    expect(order).toEqual(['open', 'start'])
+    hook.unmount()
+  })
+
+  it('clears the label when the popup closes but still honors a late completion', async () => {
+    vi.useFakeTimers()
+    try {
+      const popup = {
+        close: vi.fn(),
+        focus: vi.fn(),
+        location: { replace: vi.fn() },
+        closed: false,
+      }
+      ;(window.open as ReturnType<typeof vi.fn>).mockReturnValue(popup as unknown as Window)
+      let channelHandler: ((e: { data: unknown }) => void) | null = null
+      class CapturingChannel {
+        constructor(public name: string) {}
+        postMessage(): void {}
+        close(): void {}
+      }
+      Object.defineProperty(CapturingChannel.prototype, 'onmessage', {
+        set(h) {
+          channelHandler = h
+        },
+        get() {
+          return channelHandler
+        },
+        configurable: true,
+      })
+      ;(globalThis as unknown as { BroadcastChannel: unknown }).BroadcastChannel = CapturingChannel
+      mockStartOauth.mockResolvedValue({
+        status: 'redirect',
+        authorizationUrl: 'https://as.example/a?state=st',
+        state: 'st',
+      })
+      const hook = renderHookWithClient(() => useMcpOauthPopup({ workspaceId: 'w1' }))
+      await act(async () => {
+        await hook.result().startOauthForServer('s1')
+      })
+      expect(hook.result().connectingServers.has('s1')).toBe(true)
+
+      // User closes the popup — the label share clears within a poll tick...
+      popup.closed = true
+      await act(async () => {
+        vi.advanceTimersByTime(1500)
+      })
+      expect(hook.result().connectingServers.has('s1')).toBe(false)
+
+      // ...but the flow stays registered: a late BroadcastChannel completion is still honored.
+      const invalidateSpy = vi.spyOn(hook.queryClient, 'invalidateQueries')
+      await act(async () => {
+        channelHandler?.({ data: { type: 'mcp-oauth', ok: true, serverId: 's1', state: 'st' } })
+      })
+      expect(invalidateSpy).toHaveBeenCalledWith({ queryKey: ['mcp', 'servers', 'w1'] })
+      // And the count did not go negative / re-clear twice.
+      expect(hook.result().connectingServers.has('s1')).toBe(false)
+      hook.unmount()
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+})
diff --git a/apps/sim/hooks/mcp/use-mcp-oauth-popup.ts b/apps/sim/hooks/mcp/use-mcp-oauth-popup.ts
index a7588ba7bac..d1e76921b48 100644
--- a/apps/sim/hooks/mcp/use-mcp-oauth-popup.ts
+++ b/apps/sim/hooks/mcp/use-mcp-oauth-popup.ts
@@ -1,6 +1,6 @@
 'use client'
 
-import { useCallback, useEffect, useRef, useState } from 'react'
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
 import { toast } from '@sim/emcn'
 import { createLogger } from '@sim/logger'
 import { toError } from '@sim/utils/errors'
@@ -48,136 +48,222 @@ export function useMcpOauthPopup({ workspaceId }: UseMcpOauthPopupProps) {
   const queryClient = useQueryClient()
   const { mutateAsync: startOauth } = useStartMcpOauth()
 
-  const [connectingServers, setConnectingServers] = useState<Set<string>>(() => new Set())
-  // OAuth `state` nonce -> { serverId, safety timeout }. The state keys the BroadcastChannel
-  // correlation: the callback echoes it on every result (even failures that can't resolve a
-  // serverId), so the tab that started this exact flow matches it while other same-origin tabs
-  // ignore it. Cleared only when the flow completes or times out, never by popup.closed polling
-  // — COOP can make popup.closed misreport, and clearing early would drop a genuine completion.
-  const pendingFlowsRef = useRef<Map<string, { serverId: string; timeout: number }>>(new Map())
-  // serverId -> popup.closed poll. Best-effort fast "Connecting…" clear when the user
-  // abandons the popup; never used to correlate a result.
-  const popupPollsRef = useRef<Map<string, number>>(new Map())
-
-  const stopConnecting = useCallback((serverId: string) => {
-    setConnectingServers((prev) => {
-      if (!prev.has(serverId)) return prev
-      const next = new Set(prev)
-      next.delete(serverId)
+  // Per-server count of live authorization attempts; a row shows "Connecting…" / "Reopen
+  // authorization" while its count > 0. Reference counting (not a boolean set) keeps the label
+  // deterministic across concurrent attempts: a reopen retires the superseded flow and starts
+  // its own count within one batched update (no flicker), and every attempt clears exactly
+  // once (never stuck).
+  const [connectingCounts, setConnectingCounts] = useState<Map<string, number>>(() => new Map())
+  // OAuth `state` nonce -> { serverId, safety timeout }. `state` keys the BroadcastChannel
+  // correlation: the callback echoes it on every result (even failures that resolve no serverId),
+  // so the tab that started this exact flow matches it while other same-origin tabs — and
+  // unrelated flows in this tab — ignore the broadcast.
+  const pendingFlowsRef = useRef<
+    Map<string, { serverId: string; timeout: number; poll?: number; labelCleared?: boolean }>
+  >(new Map())
+  // serverIds with an in-flight `/oauth/start` request — guards a fast double-click from opening
+  // two popups. Cleared once the request settles, so a later click (to reopen an abandoned
+  // popup) still starts a fresh flow.
+  const startingRef = useRef<Set<string> | null>(null)
+
+  const incConnecting = useCallback((serverId: string) => {
+    setConnectingCounts((prev) => {
+      const next = new Map(prev)
+      next.set(serverId, (next.get(serverId) ?? 0) + 1)
       return next
     })
   }, [])
 
-  const stopPopupPoll = useCallback((serverId: string) => {
-    const poll = popupPollsRef.current.get(serverId)
-    if (poll !== undefined) {
-      window.clearInterval(poll)
-      popupPollsRef.current.delete(serverId)
-    }
+  const decConnecting = useCallback((serverId: string) => {
+    setConnectingCounts((prev) => {
+      const current = prev.get(serverId)
+      if (current === undefined) return prev
+      const next = new Map(prev)
+      if (current <= 1) next.delete(serverId)
+      else next.set(serverId, current - 1)
+      return next
+    })
   }, [])
 
-  /** End a flow entirely (by its state nonce): stop the spinner, safety timeout, and popup poll. */
+  const invalidateServer = useCallback(
+    (serverId: string) => {
+      queryClient.invalidateQueries({ queryKey: mcpKeys.serversList(workspaceId) })
+      queryClient.invalidateQueries({ queryKey: mcpKeys.serverToolsList(workspaceId, serverId) })
+      queryClient.invalidateQueries({ queryKey: mcpKeys.storedToolsList(workspaceId) })
+    },
+    [queryClient, workspaceId]
+  )
+
+  /** End one flow by its `state` nonce, decrementing its server's connecting count exactly once. */
   const settleFlow = useCallback(
     (state: string) => {
       const flow = pendingFlowsRef.current.get(state)
       if (!flow) return
       window.clearTimeout(flow.timeout)
+      if (flow.poll !== undefined) window.clearInterval(flow.poll)
       pendingFlowsRef.current.delete(state)
-      stopPopupPoll(flow.serverId)
-      stopConnecting(flow.serverId)
+      // The popup-closed poll may have already cleared this flow's label share.
+      if (!flow.labelCleared) decConnecting(flow.serverId)
+    },
+    [decConnecting]
+  )
+
+  /** Retire every prior flow for a server, superseded by a fresh attempt (each decrements once). */
+  const retireFlows = useCallback(
+    (serverId: string) => {
+      const states: string[] = []
+      for (const [state, flow] of pendingFlowsRef.current) {
+        if (flow.serverId === serverId) states.push(state)
+      }
+      for (const state of states) settleFlow(state)
     },
-    [stopConnecting, stopPopupPoll]
+    [settleFlow]
   )
 
   useEffect(() => {
     const pending = pendingFlowsRef.current
-    const polls = popupPollsRef.current
     return () => {
-      for (const { timeout } of pending.values()) window.clearTimeout(timeout)
-      for (const p of polls.values()) window.clearInterval(p)
+      for (const { timeout, poll } of pending.values()) {
+        window.clearTimeout(timeout)
+        if (poll !== undefined) window.clearInterval(poll)
+      }
       pending.clear()
-      polls.clear()
     }
   }, [])
 
   useEffect(() => {
-    // The callback signals over a same-origin BroadcastChannel (see the OAuth callback
-    // route): a provider whose authorize page sets COOP `same-origin` severs
-    // `window.opener`, so a popup `postMessage` can be lost and leave the row stuck on
-    // "Connecting…". A BroadcastChannel is origin-scoped, so it needs no origin check.
+    // The callback signals over a same-origin BroadcastChannel (see the OAuth callback route): a
+    // provider whose authorize page sets COOP `same-origin` severs `window.opener`, so a popup
+    // `postMessage` can be lost and leave the row stuck on "Connecting…". A BroadcastChannel is
+    // origin-scoped, so it needs no origin check.
     const channel = new BroadcastChannel('mcp-oauth')
     channel.onmessage = (event) => {
       const data = event.data as Partial<McpOauthCallbackMessage> | null
       if (data?.type !== 'mcp-oauth') return
-      // A BroadcastChannel reaches every same-origin tab, so react only to a result for a flow
-      // THIS tab started, matched on the OAuth `state` nonce. Every result (success or failure)
-      // carries it, so unrelated tabs — and unrelated flows in this tab — ignore the broadcast.
       if (!data.state) return
       const flow = pendingFlowsRef.current.get(data.state)
       if (!flow) return
       const { serverId } = flow
       settleFlow(data.state)
       if (data.ok) {
-        queryClient.invalidateQueries({ queryKey: mcpKeys.serversList(workspaceId) })
-        queryClient.invalidateQueries({
-          queryKey: mcpKeys.serverToolsList(workspaceId, serverId),
-        })
-        queryClient.invalidateQueries({ queryKey: mcpKeys.storedToolsList(workspaceId) })
+        invalidateServer(serverId)
         toast.success('Server authorized')
       } else {
         toast.error(reasonToMessage(data.reason))
       }
     }
     return () => channel.close()
-  }, [queryClient, workspaceId, settleFlow])
+  }, [settleFlow, invalidateServer])
 
   const startOauthForServer = useCallback(
     async (serverId: string) => {
-      setConnectingServers((prev) => new Set(prev).add(serverId))
+      const starting = (startingRef.current ??= new Set())
+      if (starting.has(serverId)) return
+      starting.add(serverId)
+      // Popup-first: open (or, via the shared window name, reuse+focus) the popup
+      // SYNCHRONOUSLY inside the user's click so the browser's activation gate sees
+      // it. Opening after the /oauth/start await loses the activation and gets
+      // silently popup-blocked — the "pressed Connect and nothing happened" bug.
+      const popup = window.open(
+        'about:blank',
+        `mcp-oauth-${serverId}`,
+        'width=560,height=720,resizable=yes,scrollbars=yes'
+      )
+      if (!popup) {
+        starting.delete(serverId)
+        toast.error('Popup blocked. Please allow popups for this site and retry.')
+        return
+      }
+      popup.focus?.()
+      // Opening the shared named window just navigated ANY prior authorization window to
+      // about:blank, so prior flows for this server are moot regardless of how this attempt
+      // ends — retire them now (a failed start must not leave a windowless flow "connecting"
+      // for the 10-minute safety timeout).
+      retireFlows(serverId)
+      incConnecting(serverId) // this attempt begins
       try {
         const result = await startOauth({ serverId, workspaceId })
         if (result.status === 'already_authorized') {
-          stopConnecting(serverId)
+          try {
+            popup.close()
+          } catch {}
+          invalidateServer(serverId)
+          decConnecting(serverId) // this attempt ends
           return
         }
-        const { popup, state } = result
-        // Drop any prior in-flight flow for this server (e.g. an abandoned attempt now being
-        // retried) so its stale safety timeout can't later clear this new flow's state.
-        for (const [prevState, flow] of pendingFlowsRef.current) {
-          if (flow.serverId === serverId) {
-            window.clearTimeout(flow.timeout)
-            pendingFlowsRef.current.delete(prevState)
-          }
+        const { authorizationUrl, state } = result
+        let navigated = true
+        try {
+          popup.location.replace(authorizationUrl)
+        } catch {
+          // A COOP-severed reused window can refuse scripted navigation; reopen by name.
+          // This runs after the await, so it can itself be popup-blocked — check it.
+          navigated = window.open(authorizationUrl, `mcp-oauth-${serverId}`) !== null
         }
-        // Track this in-flight flow keyed by its `state` nonce for the BroadcastChannel gate,
-        // bounded by a safety timeout in case no result ever arrives (popup abandoned, or a
-        // callback failure the client can't otherwise clear).
-        pendingFlowsRef.current.set(state, {
+        if (!navigated) {
+          try {
+            popup.close()
+          } catch {}
+          decConnecting(serverId)
+          toast.error('Popup blocked. Please allow popups for this site and retry.')
+          return
+        }
+        // Track the in-flight flow by its `state` nonce for the BroadcastChannel gate, bounded by
+        // a safety timeout in case no result ever arrives (popup abandoned, or a callback the
+        // client can't otherwise observe under COOP).
+        const flow: { serverId: string; timeout: number; poll?: number; labelCleared?: boolean } = {
           serverId,
           timeout: window.setTimeout(() => settleFlow(state), OAUTH_FLOW_TIMEOUT_MS),
-        })
-        // Best-effort: clear "Connecting…" quickly when the user closes the popup without
-        // finishing. popup.closed can misreport under COOP, so this only stops the spinner —
-        // it never touches `pendingFlowsRef`, so it can't drop a real result.
-        stopPopupPoll(serverId)
-        popupPollsRef.current.set(
-          serverId,
-          window.setInterval(() => {
-            if (popup.closed) {
-              stopPopupPoll(serverId)
-              stopConnecting(serverId)
-            }
-          }, 500)
-        )
+        }
+        pendingFlowsRef.current.set(state, flow)
+        // Best-effort label clear when the user closes the popup: under COOP `closed` can
+        // misreport true, so this only clears the "Waiting for authorization..." share of
+        // the count — the flow entry stays registered, and a completion that still arrives
+        // over the BroadcastChannel is honored (settleFlow skips the double-decrement).
+        flow.poll = window.setInterval(() => {
+          let closed = false
+          try {
+            closed = popup.closed
+          } catch {
+            closed = true
+          }
+          if (!closed) return
+          if (flow.poll !== undefined) window.clearInterval(flow.poll)
+          flow.poll = undefined
+          if (!flow.labelCleared && pendingFlowsRef.current.get(state) === flow) {
+            flow.labelCleared = true
+            decConnecting(serverId)
+          }
+        }, 1000)
       } catch (e) {
-        stopPopupPoll(serverId)
-        stopConnecting(serverId)
+        try {
+          popup.close()
+        } catch {}
+        decConnecting(serverId) // this attempt ends; any prior flow keeps its own count
         logger.error('Failed to start MCP OAuth', e)
         toast.error(toError(e).message || 'Failed to start authorization')
+      } finally {
+        starting.delete(serverId)
       }
     },
-    [startOauth, workspaceId, settleFlow, stopConnecting, stopPopupPoll]
+    [
+      startOauth,
+      workspaceId,
+      settleFlow,
+      retireFlows,
+      incConnecting,
+      decConnecting,
+      invalidateServer,
+    ]
   )
 
+  const connectingServers = useMemo(() => {
+    const set = new Set<string>()
+    for (const [serverId, count] of connectingCounts) {
+      if (count > 0) set.add(serverId)
+    }
+    return set
+  }, [connectingCounts])
+
   return { connectingServers, startOauthForServer }
 }
diff --git a/apps/sim/hooks/queries/mcp.test.tsx b/apps/sim/hooks/queries/mcp.test.tsx
index 18617f45b67..ad6c120f516 100644
--- a/apps/sim/hooks/queries/mcp.test.tsx
+++ b/apps/sim/hooks/queries/mcp.test.tsx
@@ -3,7 +3,7 @@
  */
 import { act, type ReactNode } from 'react'
 import { sleep } from '@sim/utils/helpers'
-import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { QueryClient, QueryClientProvider, useQueryClient } from '@tanstack/react-query'
 import { createRoot, type Root } from 'react-dom/client'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
@@ -20,7 +20,12 @@ import {
   listMcpServersContract,
   type McpServer,
 } from '@/lib/api/contracts/mcp'
-import { useForceRefreshMcpTools, useMcpServers, useMcpToolsQuery } from '@/hooks/queries/mcp'
+import {
+  mcpKeys,
+  useForceRefreshMcpTools,
+  useMcpServers,
+  useMcpToolsQuery,
+} from '@/hooks/queries/mcp'
 
 const WORKSPACE_ID = 'workspace-1'
 
@@ -181,6 +186,89 @@ describe('useMcpToolsQuery', () => {
     unmount()
   })
 
+  it('keeps last-known-good tools when a later discovery refetch fails', async () => {
+    let discoverCalls = 0
+    mockRequestJson.mockImplementation(async (contract) => {
+      if (contract === listMcpServersContract) {
+        return {
+          success: true,
+          data: { servers: [server('s1', { authType: 'headers', connectionStatus: 'connected' })] },
+        }
+      }
+      if (contract === discoverMcpToolsContract) {
+        discoverCalls++
+        if (discoverCalls === 1) {
+          return { success: true, data: { tools: [{ name: 'tool-a', serverId: 's1' }] } }
+        }
+        throw new Error('transient stall')
+      }
+      throw new Error('Unexpected MCP request')
+    })
+
+    const { getResult, unmount } = renderHookWithClient(() => ({
+      tools: useMcpToolsQuery(WORKSPACE_ID),
+      queryClient: useQueryClient(),
+    }))
+    await flush()
+    expect(getResult().tools.data).toHaveLength(1)
+
+    // Force a refetch that fails; the last successful tools must survive.
+    await act(async () => {
+      await getResult().queryClient.invalidateQueries({
+        queryKey: mcpKeys.serverToolsList(WORKSPACE_ID, 's1'),
+      })
+    })
+    await flush()
+
+    expect(getResult().tools.data).toHaveLength(1)
+    expect(getResult().tools.toolsStateByServer.get('s1')?.error).toBeInstanceOf(Error)
+
+    unmount()
+  })
+
+  it('drops stale tools once a non-OAuth server is persistently failed', async () => {
+    let discoverCalls = 0
+    let listCalls = 0
+    mockRequestJson.mockImplementation(async (contract) => {
+      if (contract === listMcpServersContract) {
+        listCalls++
+        // Healthy on first read, error state after the failed refetch invalidates the list.
+        const connectionStatus = listCalls === 1 ? 'connected' : 'error'
+        return {
+          success: true,
+          data: { servers: [server('s1', { authType: 'headers', connectionStatus })] },
+        }
+      }
+      if (contract === discoverMcpToolsContract) {
+        discoverCalls++
+        if (discoverCalls === 1) {
+          return { success: true, data: { tools: [{ name: 'tool-a', serverId: 's1' }] } }
+        }
+        throw new Error('persistent failure')
+      }
+      throw new Error('Unexpected MCP request')
+    })
+
+    const { getResult, unmount } = renderHookWithClient(() => ({
+      tools: useMcpToolsQuery(WORKSPACE_ID),
+      queryClient: useQueryClient(),
+    }))
+    await flush()
+    expect(getResult().tools.data).toHaveLength(1)
+
+    await act(async () => {
+      await getResult().queryClient.invalidateQueries({
+        queryKey: mcpKeys.serverToolsList(WORKSPACE_ID, 's1'),
+      })
+    })
+    await flush()
+
+    // Stored status is now 'error' → the dead server's stale tools are dropped from the aggregate.
+    expect(getResult().tools.data).toHaveLength(0)
+
+    unmount()
+  })
+
   it('does not force-refresh disconnected OAuth servers', async () => {
     mockServers([
       server('oauth-disconnected', { authType: 'oauth', connectionStatus: 'disconnected' }),
diff --git a/apps/sim/hooks/queries/mcp.ts b/apps/sim/hooks/queries/mcp.ts
index 36e47c2d382..8daab301235 100644
--- a/apps/sim/hooks/queries/mcp.ts
+++ b/apps/sim/hooks/queries/mcp.ts
@@ -182,21 +182,27 @@ export function useMcpToolsQuery(workspaceId: string) {
     let hasData = false
     let anyServerLoading = false
     let firstError: Error | null = null
+    const statusById = new Map(servers?.map((s) => [s.id, s.connectionStatus]))
     const toolsStateByServer = new Map<
       string,
       { isLoading: boolean; isFetching: boolean; error: Error | null }
     >()
     for (let index = 0; index < results.length; index++) {
       const result = results[index]
-      // Drop stale data from servers whose latest refetch errored.
-      if (result.data && !result.isError) {
+      const serverId = serverIds[index]
+      const status = serverId ? statusById.get(serverId) : undefined
+      const persistentlyFailed = status === 'error' || status === 'disconnected'
+      // Keep last-known-good tools through a transient failure (React Query retains `data`, the
+      // stored status is still healthy) so a populated server doesn't blank — but drop them once
+      // the stored status crosses its failure threshold, so the workflow editor stops offering a
+      // dead server's stale tools. Matches how reference MCP clients treat transient vs. closed.
+      if (result.data && (!result.isError || !persistentlyFailed)) {
         tools.push(...result.data)
         hasData = true
       }
       if (result.isLoading) anyServerLoading = true
       if (!firstError && result.error instanceof Error) firstError = result.error
 
-      const serverId = serverIds[index]
       if (serverId) {
         toolsStateByServer.set(serverId, {
           isLoading: result.isLoading,
@@ -213,7 +219,7 @@ export function useMcpToolsQuery(workspaceId: string) {
       error: hasData ? null : firstError,
       toolsStateByServer,
     }
-  }, [results, serversLoading, serverIds])
+  }, [results, serversLoading, serverIds, servers])
 }
 
 export function useForceRefreshMcpTools() {
@@ -310,16 +316,35 @@ export function useCreateMcpServer() {
  * correlate the eventual result back to this exact flow.
  */
 export type StartMcpOauthMutationResult =
-  | { status: 'redirect'; popup: Window; state: string }
+  | { status: 'redirect'; authorizationUrl: string; state: string }
   | { status: 'already_authorized' }
 
 export function useStartMcpOauth() {
   return useMutation<StartMcpOauthMutationResult, Error, { serverId: string; workspaceId: string }>(
     {
       mutationFn: async ({ serverId, workspaceId }) => {
-        const result = await requestJson(startMcpOauthContract, {
-          query: { serverId, workspaceId },
-        })
+        // A stalled /oauth/start must settle so the caller can reset the connecting
+        // state and close its pre-opened popup instead of appearing bricked.
+        // Feature-detect AbortSignal.timeout (Safari <16 lacks it) with a plain
+        // controller fallback.
+        let timeoutSignal: AbortSignal | undefined
+        let timeoutId: ReturnType<typeof setTimeout> | undefined
+        if (typeof AbortSignal.timeout === 'function') {
+          timeoutSignal = AbortSignal.timeout(30_000)
+        } else {
+          const controller = new AbortController()
+          timeoutId = setTimeout(() => controller.abort(new Error('Request timed out')), 30_000)
+          timeoutSignal = controller.signal
+        }
+        let result: Awaited<ReturnType<typeof requestJson<typeof startMcpOauthContract>>>
+        try {
+          result = await requestJson(startMcpOauthContract, {
+            query: { serverId, workspaceId },
+            signal: timeoutSignal,
+          })
+        } finally {
+          if (timeoutId !== undefined) clearTimeout(timeoutId)
+        }
         if (result.status === 'already_authorized') return { status: 'already_authorized' }
 
         const parsedUrl = new URL(result.authorizationUrl)
@@ -332,15 +357,10 @@ export function useStartMcpOauth() {
         if (!state) {
           throw new Error('Authorization URL is missing the OAuth state parameter')
         }
-        const popup = window.open(
-          result.authorizationUrl,
-          `mcp-oauth-${serverId}`,
-          'width=560,height=720,resizable=yes,scrollbars=yes'
-        )
-        if (!popup) {
-          throw new Error('Popup blocked. Please allow popups for this site and retry.')
-        }
-        return { status: 'redirect', popup, state }
+        // The popup itself is opened SYNCHRONOUSLY by the caller inside the user's
+        // click (popup-first) — opening it here, after the network await, loses the
+        // user activation and gets silently popup-blocked.
+        return { status: 'redirect', authorizationUrl: result.authorizationUrl, state }
       },
     }
   )
diff --git a/apps/sim/hooks/queries/mothership-chats.test.ts b/apps/sim/hooks/queries/mothership-chats.test.ts
index 6555d30846d..737296fd25e 100644
--- a/apps/sim/hooks/queries/mothership-chats.test.ts
+++ b/apps/sim/hooks/queries/mothership-chats.test.ts
@@ -59,6 +59,7 @@ describe('tasks query boundary parsing', () => {
             activeStreamId: 'stream-1',
             lastSeenAt: null,
             pinned: false,
+            deletedAt: null,
           },
         ],
       })
@@ -91,6 +92,7 @@ describe('tasks query boundary parsing', () => {
             activeStreamId: null,
             lastSeenAt: null,
             pinned: false,
+            deletedAt: null,
           },
         ],
       })
diff --git a/apps/sim/hooks/queries/mothership-chats.ts b/apps/sim/hooks/queries/mothership-chats.ts
index 606dc0020e3..89a598799a9 100644
--- a/apps/sim/hooks/queries/mothership-chats.ts
+++ b/apps/sim/hooks/queries/mothership-chats.ts
@@ -16,8 +16,10 @@ import {
   getMothershipChatContract,
   listMothershipChatsContract,
   type MothershipChat,
+  type MothershipChatScope,
   removeMothershipChatResourceContract,
   reorderMothershipChatResourcesContract,
+  restoreMothershipChatContract,
   updateMothershipChatContract,
 } from '@/lib/api/contracts/mothership-chats'
 import type { PersistedMessage } from '@/lib/copilot/chat/persisted-message'
@@ -37,6 +39,7 @@ export interface MothershipChatMetadata {
   isActive: boolean
   isUnread: boolean
   isPinned: boolean
+  deletedAt: Date | null
 }
 
 export interface MothershipChatHistory {
@@ -55,8 +58,11 @@ export interface MothershipChatHistory {
 export const mothershipChatKeys = {
   all: ['mothership-chats'] as const,
   lists: () => [...mothershipChatKeys.all, 'list'] as const,
-  list: (workspaceId: string | undefined) =>
+  /** Prefix covering both the active and archived lists of one workspace. */
+  workspaceLists: (workspaceId: string | undefined) =>
     [...mothershipChatKeys.lists(), workspaceId ?? ''] as const,
+  list: (workspaceId: string | undefined, scope: MothershipChatScope = 'active') =>
+    [...mothershipChatKeys.workspaceLists(workspaceId), scope] as const,
   details: () => [...mothershipChatKeys.all, 'detail'] as const,
   detail: (chatId: string | undefined) => [...mothershipChatKeys.details(), chatId ?? ''] as const,
 }
@@ -198,15 +204,17 @@ export function mapChat(chat: MothershipChat): MothershipChatMetadata {
       chat.activeStreamId === null &&
       (chat.lastSeenAt === null || updatedAt > new Date(chat.lastSeenAt)),
     isPinned: chat.pinned,
+    deletedAt: chat.deletedAt ? new Date(chat.deletedAt) : null,
   }
 }
 
 export async function fetchMothershipChats(
   workspaceId: string,
+  scope: MothershipChatScope = 'active',
   signal?: AbortSignal
 ): Promise<MothershipChatMetadata[]> {
   const data = await requestJson(listMothershipChatsContract, {
-    query: { workspaceId },
+    query: { workspaceId, scope },
     signal,
   })
   return data.data.map(mapChat)
@@ -214,12 +222,19 @@ export async function fetchMothershipChats(
 
 /**
  * Fetches mothership chat chats for a workspace.
- * These are workspace-scoped conversations from the Home page.
+ * These are workspace-scoped conversations from the Home page. Pass
+ * `scope: 'archived'` for soft-deleted chats (Recently Deleted).
  */
-export function useMothershipChats(workspaceId?: string) {
+export function useMothershipChats(
+  workspaceId?: string,
+  options?: { scope?: MothershipChatScope }
+) {
+  const scope = options?.scope ?? 'active'
   return useQuery({
-    queryKey: mothershipChatKeys.list(workspaceId),
-    queryFn: workspaceId ? ({ signal }) => fetchMothershipChats(workspaceId, signal) : skipToken,
+    queryKey: mothershipChatKeys.list(workspaceId, scope),
+    queryFn: workspaceId
+      ? ({ signal }) => fetchMothershipChats(workspaceId, scope, signal)
+      : skipToken,
     placeholderData: keepPreviousData,
     staleTime: MOTHERSHIP_CHAT_LIST_STALE_TIME,
   })
@@ -274,20 +289,42 @@ async function deleteChat(chatId: string): Promise<void> {
 }
 
 /**
- * Deletes a mothership chat chat and invalidates the chat list.
+ * Soft-deletes a mothership chat and invalidates both the active and archived
+ * chat lists — the chat moves from the sidebar into Recently Deleted.
  */
 export function useDeleteMothershipChat(workspaceId?: string) {
   const queryClient = useQueryClient()
   return useMutation({
     mutationFn: deleteChat,
     onSettled: (_data, _error, chatId) => {
-      queryClient.invalidateQueries({ queryKey: mothershipChatKeys.list(workspaceId) })
+      queryClient.invalidateQueries({ queryKey: mothershipChatKeys.workspaceLists(workspaceId) })
       queryClient.removeQueries({ queryKey: mothershipChatKeys.detail(chatId) })
       useMothershipQueueStore.getState().clearChat(chatId)
     },
   })
 }
 
+async function restoreChat(chatId: string): Promise<void> {
+  await requestJson(restoreMothershipChatContract, {
+    params: { chatId },
+  })
+}
+
+/**
+ * Restores a soft-deleted mothership chat and invalidates both the active and
+ * archived chat lists — the chat moves from Recently Deleted back into the
+ * sidebar.
+ */
+export function useRestoreMothershipChat(workspaceId?: string) {
+  const queryClient = useQueryClient()
+  return useMutation({
+    mutationFn: restoreChat,
+    onSettled: () => {
+      queryClient.invalidateQueries({ queryKey: mothershipChatKeys.workspaceLists(workspaceId) })
+    },
+  })
+}
+
 /**
  * Deletes multiple mothership chat chats and invalidates the chat list.
  */
@@ -298,7 +335,7 @@ export function useDeleteMothershipChats(workspaceId?: string) {
       await Promise.all(chatIds.map(deleteChat))
     },
     onSettled: (_data, _error, chatIds) => {
-      queryClient.invalidateQueries({ queryKey: mothershipChatKeys.list(workspaceId) })
+      queryClient.invalidateQueries({ queryKey: mothershipChatKeys.workspaceLists(workspaceId) })
       const queueStore = useMothershipQueueStore.getState()
       for (const chatId of chatIds) {
         queryClient.removeQueries({ queryKey: mothershipChatKeys.detail(chatId) })
@@ -656,6 +693,7 @@ export function useCreateMothershipChat(workspaceId?: string) {
         isActive: false,
         isUnread: false,
         isPinned: false,
+        deletedAt: null,
       }
       const pinnedCount = existing.findIndex((chat) => !chat.isPinned)
       const insertAt = pinnedCount === -1 ? existing.length : pinnedCount
@@ -703,6 +741,7 @@ export function useForkMothershipChat(workspaceId?: string) {
           isActive: false,
           isUnread: false,
           isPinned: false,
+          deletedAt: null,
         }
         const pinnedCount = existing.findIndex((chat) => !chat.isPinned)
         const insertAt = pinnedCount === -1 ? existing.length : pinnedCount
diff --git a/apps/sim/hooks/use-auto-scroll.ts b/apps/sim/hooks/use-auto-scroll.ts
index 7e824746baf..d5edf8977ba 100644
--- a/apps/sim/hooks/use-auto-scroll.ts
+++ b/apps/sim/hooks/use-auto-scroll.ts
@@ -1,9 +1,5 @@
 import { useCallback, useEffect, useRef } from 'react'
-import {
-  CHASE_REST_GAP,
-  createSmoothBottomChase,
-  SMOOTH_CHASE_RATE,
-} from '@/lib/core/utils/smooth-bottom-chase'
+import { createSmoothBottomChase } from '@/lib/core/utils/smooth-bottom-chase'
 
 /** Tolerance for keeping stickiness during programmatic auto-scroll. */
 const STICK_THRESHOLD = 30
@@ -34,9 +30,10 @@ const ANIMATION_FOLLOW_WINDOW = 500
 /**
  * How long to keep chasing the bottom after streaming stops. End-of-turn content
  * mounts just after `isStreaming` flips false — the suggested-follow-up options,
- * the actions row (gated on `!isStreaming`), and the virtualizer's re-measure of
- * the grown row — so a single final scroll fires before it lays out and leaves it
- * clipped behind the input. Following for a short window pulls it into view.
+ * the actions row (swapped into the thinking slot's place), and the
+ * virtualizer's re-measure of the grown row — so a single final scroll fires
+ * before it lays out and leaves it clipped behind the input. Following for a
+ * short window pulls it into view.
  */
 const POST_STREAM_SETTLE_WINDOW = 300
 
@@ -199,41 +196,16 @@ export function useAutoScroll(
       chase.kick()
     }
 
-    /**
-     * Chase the bottom every frame for `durationMs` with the same eased step.
-     * Catches height growth that arrives over several frames with no observed
-     * DOM mutation — a CSS height animation, or end-of-turn content and the
-     * virtualizer's re-measure settling after streaming stops.
-     *
-     * Self-interrupting: our eased writes leave `scrollTop` exactly where we
-     * last put it, whereas a user scroll moves it up from there — so the moment
-     * `scrollTop` drops below our last write, we stop and never fight a real
-     * scroll, even with the gesture listeners already torn down.
-     */
-    const followToBottom = (durationMs: number) => {
-      if (!stickyRef.current) return
-      const until = performance.now() + durationMs
-      let lastTop = -1
-      const follow = () => {
-        if (performance.now() > until || !stickyRef.current) return
-        if (lastTop >= 0 && el.scrollTop < lastTop - 1) return
-        const gap = el.scrollHeight - el.clientHeight - el.scrollTop
-        if (gap > CHASE_REST_GAP) {
-          el.scrollTop = el.scrollTop + Math.max(1, gap * SMOOTH_CHASE_RATE)
-        }
-        lastTop = el.scrollTop
-        requestAnimationFrame(follow)
-      }
-      requestAnimationFrame(follow)
-    }
-
     /**
      * CSS-driven height animations (e.g. Radix Collapsible expanding mid-stream)
      * grow scrollHeight without triggering MutationObserver, so auto-scroll stops
-     * following. Follow for a short window so the container stays pinned while the
-     * animation runs.
+     * following. Keep the one chase loop alive for a short window so the
+     * container stays pinned while the animation runs. `animationstart` fires
+     * for every child animation in the transcript (segment fade-ins, loader
+     * keyframes, label crossfades) — kickUntil coalesces them into a single
+     * extended deadline on the single loop; anything more snaps the glide.
      */
-    const onAnimationStart = () => followToBottom(ANIMATION_FOLLOW_WINDOW)
+    const onAnimationStart = () => chase.kickUntil(ANIMATION_FOLLOW_WINDOW)
 
     el.addEventListener('wheel', onWheel, { passive: true })
     el.addEventListener('touchstart', onTouchStart, { passive: true })
@@ -262,7 +234,10 @@ export function useAutoScroll(
       chase.cancel()
       pointerDownRef.current = false
       lastUserGestureAtRef.current = Number.NEGATIVE_INFINITY
-      followToBottom(POST_STREAM_SETTLE_WINDOW)
+      // End-of-turn content mounts just after teardown; follow it briefly. The
+      // chase's own upward-move interrupt still protects a real user scroll
+      // even with the gesture listeners gone.
+      chase.kickUntil(POST_STREAM_SETTLE_WINDOW)
     }
   }, [isStreaming, scrollToBottom])
 
diff --git a/apps/sim/hooks/use-collaborative-workflow.ts b/apps/sim/hooks/use-collaborative-workflow.ts
index 2f63a73f30a..e0c752bb446 100644
--- a/apps/sim/hooks/use-collaborative-workflow.ts
+++ b/apps/sim/hooks/use-collaborative-workflow.ts
@@ -527,6 +527,19 @@ export function useCollaborativeWorkflow() {
             }
           }
         }
+
+        /**
+         * Per-frame `update-position` broadcasts are not applied by this
+         * handler (positions land via BATCH_UPDATE_POSITIONS commits), so they
+         * must not count as applied remote state changes — a collaborator's
+         * drag would otherwise exhaust sync refetch attempts for nothing.
+         */
+        const isUnappliedPositionFrame =
+          target === OPERATION_TARGETS.BLOCK && operation === BLOCK_OPERATIONS.UPDATE_POSITION
+        const appliedWorkflowId = metadata?.workflowId || activeWorkflowId
+        if (!isUnappliedPositionFrame && appliedWorkflowId) {
+          useOperationQueueStore.getState().markRemoteApplied(appliedWorkflowId)
+        }
       } catch (error) {
         logger.error('Error applying remote operation:', error)
       } finally {
@@ -559,6 +572,11 @@ export function useCollaborativeWorkflow() {
         if (activeWorkflowId && blockType === 'function' && subblockId === 'code') {
           useCodeUndoRedoStore.getState().clear(activeWorkflowId, blockId, subblockId)
         }
+
+        const appliedWorkflowId = workflowId || activeWorkflowId
+        if (appliedWorkflowId) {
+          useOperationQueueStore.getState().markRemoteApplied(appliedWorkflowId)
+        }
       } catch (error) {
         logger.error('Error applying remote subblock update:', error)
       } finally {
@@ -585,6 +603,7 @@ export function useCollaborativeWorkflow() {
       isApplyingRemoteChange.current = true
 
       try {
+        const isKnownField = field === 'name' || field === 'value' || field === 'type'
         if (field === 'name') {
           useVariablesStore.getState().updateVariable(variableId, { name: value })
         } else if (field === 'value') {
@@ -592,6 +611,11 @@ export function useCollaborativeWorkflow() {
         } else if (field === 'type') {
           useVariablesStore.getState().updateVariable(variableId, { type: value })
         }
+
+        const appliedWorkflowId = workflowId || activeWorkflowId
+        if (isKnownField && appliedWorkflowId) {
+          useOperationQueueStore.getState().markRemoteApplied(appliedWorkflowId)
+        }
       } catch (error) {
         logger.error('Error applying remote variable update:', error)
       } finally {
diff --git a/apps/sim/hooks/use-mothership-chat-events.test.ts b/apps/sim/hooks/use-mothership-chat-events.test.ts
index de511c0bfa8..8a40af7a61b 100644
--- a/apps/sim/hooks/use-mothership-chat-events.test.ts
+++ b/apps/sim/hooks/use-mothership-chat-events.test.ts
@@ -32,7 +32,7 @@ describe('handleMothershipChatStatusEvent', () => {
 
     expect(queryClient.invalidateQueries).toHaveBeenCalledTimes(2)
     expect(queryClient.invalidateQueries).toHaveBeenCalledWith({
-      queryKey: mothershipChatKeys.list('ws-1'),
+      queryKey: mothershipChatKeys.workspaceLists('ws-1'),
     })
     expect(queryClient.invalidateQueries).toHaveBeenCalledWith({
       queryKey: mothershipChatKeys.detail('chat-1'),
@@ -61,7 +61,7 @@ describe('handleMothershipChatStatusEvent', () => {
 
     expect(queryClient.invalidateQueries).toHaveBeenCalledTimes(1)
     expect(queryClient.invalidateQueries).toHaveBeenCalledWith({
-      queryKey: mothershipChatKeys.list('ws-1'),
+      queryKey: mothershipChatKeys.workspaceLists('ws-1'),
     })
     expect(queryClient.removeQueries).not.toHaveBeenCalled()
   })
@@ -88,7 +88,7 @@ describe('handleMothershipChatStatusEvent', () => {
 
     expect(queryClient.invalidateQueries).toHaveBeenCalledTimes(1)
     expect(queryClient.invalidateQueries).toHaveBeenCalledWith({
-      queryKey: mothershipChatKeys.list('ws-1'),
+      queryKey: mothershipChatKeys.workspaceLists('ws-1'),
     })
     expect(queryClient.removeQueries).not.toHaveBeenCalled()
   })
@@ -115,7 +115,7 @@ describe('handleMothershipChatStatusEvent', () => {
 
     expect(queryClient.invalidateQueries).toHaveBeenCalledTimes(1)
     expect(queryClient.invalidateQueries).toHaveBeenCalledWith({
-      queryKey: mothershipChatKeys.list('ws-1'),
+      queryKey: mothershipChatKeys.workspaceLists('ws-1'),
     })
     expect(queryClient.removeQueries).not.toHaveBeenCalled()
   })
@@ -142,7 +142,7 @@ describe('handleMothershipChatStatusEvent', () => {
 
     expect(queryClient.invalidateQueries).toHaveBeenCalledTimes(2)
     expect(queryClient.invalidateQueries).toHaveBeenCalledWith({
-      queryKey: mothershipChatKeys.list('ws-1'),
+      queryKey: mothershipChatKeys.workspaceLists('ws-1'),
     })
     expect(queryClient.invalidateQueries).toHaveBeenCalledWith({
       queryKey: mothershipChatKeys.detail('chat-1'),
@@ -172,7 +172,7 @@ describe('handleMothershipChatStatusEvent', () => {
 
     expect(queryClient.invalidateQueries).toHaveBeenCalledTimes(2)
     expect(queryClient.invalidateQueries).toHaveBeenCalledWith({
-      queryKey: mothershipChatKeys.list('ws-1'),
+      queryKey: mothershipChatKeys.workspaceLists('ws-1'),
     })
     expect(queryClient.invalidateQueries).toHaveBeenCalledWith({
       queryKey: mothershipChatKeys.detail('chat-1'),
@@ -202,7 +202,7 @@ describe('handleMothershipChatStatusEvent', () => {
 
     expect(queryClient.invalidateQueries).toHaveBeenCalledTimes(2)
     expect(queryClient.invalidateQueries).toHaveBeenCalledWith({
-      queryKey: mothershipChatKeys.list('ws-1'),
+      queryKey: mothershipChatKeys.workspaceLists('ws-1'),
     })
     expect(queryClient.invalidateQueries).toHaveBeenCalledWith({
       queryKey: mothershipChatKeys.detail('chat-1'),
@@ -223,7 +223,7 @@ describe('handleMothershipChatStatusEvent', () => {
 
     expect(queryClient.invalidateQueries).toHaveBeenCalledTimes(2)
     expect(queryClient.invalidateQueries).toHaveBeenCalledWith({
-      queryKey: mothershipChatKeys.list('ws-1'),
+      queryKey: mothershipChatKeys.workspaceLists('ws-1'),
     })
     expect(queryClient.invalidateQueries).toHaveBeenCalledWith({
       queryKey: mothershipChatKeys.detail('chat-1'),
@@ -244,7 +244,7 @@ describe('handleMothershipChatStatusEvent', () => {
 
     expect(queryClient.invalidateQueries).toHaveBeenCalledTimes(1)
     expect(queryClient.invalidateQueries).toHaveBeenCalledWith({
-      queryKey: mothershipChatKeys.list('ws-1'),
+      queryKey: mothershipChatKeys.workspaceLists('ws-1'),
     })
     expect(queryClient.removeQueries).toHaveBeenCalledTimes(1)
     expect(queryClient.removeQueries).toHaveBeenCalledWith({
@@ -265,7 +265,7 @@ describe('handleMothershipChatStatusEvent', () => {
 
     expect(queryClient.invalidateQueries).toHaveBeenCalledTimes(2)
     expect(queryClient.invalidateQueries).toHaveBeenCalledWith({
-      queryKey: mothershipChatKeys.list('ws-1'),
+      queryKey: mothershipChatKeys.workspaceLists('ws-1'),
     })
     expect(queryClient.invalidateQueries).toHaveBeenCalledWith({
       queryKey: mothershipChatKeys.detail('chat-1'),
@@ -294,7 +294,7 @@ describe('handleMothershipChatStatusEvent', () => {
 
     expect(queryClient.invalidateQueries).toHaveBeenCalledTimes(1)
     expect(queryClient.invalidateQueries).toHaveBeenCalledWith({
-      queryKey: mothershipChatKeys.list('ws-1'),
+      queryKey: mothershipChatKeys.workspaceLists('ws-1'),
     })
     expect(queryClient.removeQueries).not.toHaveBeenCalled()
   })
@@ -321,7 +321,7 @@ describe('handleMothershipChatStatusEvent', () => {
 
     expect(queryClient.invalidateQueries).toHaveBeenCalledTimes(1)
     expect(queryClient.invalidateQueries).toHaveBeenCalledWith({
-      queryKey: mothershipChatKeys.list('ws-1'),
+      queryKey: mothershipChatKeys.workspaceLists('ws-1'),
     })
     expect(queryClient.removeQueries).not.toHaveBeenCalled()
   })
@@ -348,7 +348,7 @@ describe('handleMothershipChatStatusEvent', () => {
 
     expect(queryClient.invalidateQueries).toHaveBeenCalledTimes(1)
     expect(queryClient.invalidateQueries).toHaveBeenCalledWith({
-      queryKey: mothershipChatKeys.list('ws-1'),
+      queryKey: mothershipChatKeys.workspaceLists('ws-1'),
     })
     expect(queryClient.removeQueries).not.toHaveBeenCalled()
   })
@@ -375,7 +375,7 @@ describe('handleMothershipChatStatusEvent', () => {
 
     expect(queryClient.invalidateQueries).toHaveBeenCalledTimes(2)
     expect(queryClient.invalidateQueries).toHaveBeenCalledWith({
-      queryKey: mothershipChatKeys.list('ws-1'),
+      queryKey: mothershipChatKeys.workspaceLists('ws-1'),
     })
     expect(queryClient.invalidateQueries).toHaveBeenCalledWith({
       queryKey: mothershipChatKeys.detail('chat-1'),
@@ -396,7 +396,7 @@ describe('handleMothershipChatStatusEvent', () => {
 
     expect(queryClient.invalidateQueries).toHaveBeenCalledTimes(1)
     expect(queryClient.invalidateQueries).toHaveBeenCalledWith({
-      queryKey: mothershipChatKeys.list('ws-1'),
+      queryKey: mothershipChatKeys.workspaceLists('ws-1'),
     })
     expect(queryClient.removeQueries).not.toHaveBeenCalled()
   })
diff --git a/apps/sim/hooks/use-mothership-chat-events.ts b/apps/sim/hooks/use-mothership-chat-events.ts
index ad8f0d9d3fd..fe49bcb8283 100644
--- a/apps/sim/hooks/use-mothership-chat-events.ts
+++ b/apps/sim/hooks/use-mothership-chat-events.ts
@@ -101,7 +101,9 @@ export function handleMothershipChatStatusEvent(
     return
   }
 
-  queryClient.invalidateQueries({ queryKey: mothershipChatKeys.list(workspaceId) })
+  // workspaceLists covers both the active and archived (Recently Deleted)
+  // lists: delete/restore events move chats between the two scopes.
+  queryClient.invalidateQueries({ queryKey: mothershipChatKeys.workspaceLists(workspaceId) })
   if (!payload.chatId) return
   if (payload.type === 'deleted') {
     queryClient.removeQueries({ queryKey: mothershipChatKeys.detail(payload.chatId) })
diff --git a/apps/sim/lib/admin/dashboard-organizations.test.ts b/apps/sim/lib/admin/dashboard-organizations.test.ts
index c61b05b3da2..6f9d2362ee9 100644
--- a/apps/sim/lib/admin/dashboard-organizations.test.ts
+++ b/apps/sim/lib/admin/dashboard-organizations.test.ts
@@ -67,7 +67,37 @@ vi.mock('@/lib/core/idempotency/transaction', () => ({
 }))
 vi.mock('@/lib/core/outbox/service', () => ({ enqueueOutboxEvent: vi.fn() }))
 
-import { listDashboardOrganizations } from '@/lib/admin/dashboard'
+import { listDashboardOrganizations, toDashboardConfigurationUpdate } from '@/lib/admin/dashboard'
+
+describe('toDashboardConfigurationUpdate', () => {
+  it('converts the pending Stripe metadata intent without replacing applied values', () => {
+    expect(
+      toDashboardConfigurationUpdate({
+        latestRevision: 2,
+        desiredMetadata: {},
+        hasUnappliedIntent: true,
+        effectiveSeatCapacity: 20,
+        configurationUpdate: {
+          id: 'config-2',
+          status: 'pending',
+          requestedMetadata: {
+            usageLimitCredits: 10_000_000,
+            seats: 20,
+            concurrencyLimit: 50,
+          },
+          error: null,
+        },
+      })
+    ).toEqual({
+      id: 'config-2',
+      status: 'pending',
+      requestedUsageLimitDollars: 50_000,
+      requestedSeats: 20,
+      requestedConcurrencyLimit: 50,
+      error: null,
+    })
+  })
+})
 
 describe('listDashboardOrganizations', () => {
   beforeEach(() => {
diff --git a/apps/sim/lib/admin/dashboard.ts b/apps/sim/lib/admin/dashboard.ts
index d29bf4379fb..d39f6b8405b 100644
--- a/apps/sim/lib/admin/dashboard.ts
+++ b/apps/sim/lib/admin/dashboard.ts
@@ -154,10 +154,9 @@ interface DashboardOrganizationSummaryInput {
 }
 
 export function toDashboardProvisioning(view: EnterpriseProvisioningView) {
-  const { includedMonthlyCredits, usageLimitCredits, ...rest } = view
+  const { usageLimitCredits, ...rest } = view
   return {
     ...rest,
-    includedMonthlyDollars: creditsToDollars(includedMonthlyCredits),
     usageLimitDollars: creditsToDollars(usageLimitCredits),
   }
 }
@@ -172,11 +171,7 @@ function buildDashboardOrganizationSummary({
 }: DashboardOrganizationSummaryInput) {
   const metadata = metadataRecord(latestSubscription?.metadata)
   const teamEconomics = getTeamOrganizationEconomics(latestSubscription?.plan, memberCount)
-  const includedMonthlyDollars =
-    teamEconomics?.includedMonthlyDollars ??
-    creditsToDollars(
-      Math.max(0, Math.round(metadataNumber(metadata, 'includedMonthlyCredits') ?? 0))
-    )
+  const planAllowanceDollars = teamEconomics?.planAllowanceDollars ?? null
   const invoiceAmountCents = metadataNumber(metadata, 'invoiceAmountCents')
   const monthlyPrice = metadataNumber(metadata, 'monthlyPrice')
   const effectiveUsageLimitDollars = Number(org.orgUsageLimit ?? 0)
@@ -212,7 +207,7 @@ function buildDashboardOrganizationSummary({
     externalCollaboratorCount,
     seats,
     concurrencyLimit,
-    includedMonthlyDollars,
+    planAllowanceDollars,
     usageLimitDollars,
     effectiveUsageLimitDollars,
     prepaidBalanceDollars: Number(org.creditBalance ?? 0),
@@ -227,6 +222,27 @@ function buildDashboardOrganizationSummary({
   }
 }
 
+export function toDashboardConfigurationUpdate(
+  intent: Awaited<ReturnType<typeof resolveEnterpriseMetadataIntent>> | null
+) {
+  const update = intent?.configurationUpdate
+  if (!update) return null
+  const metadata = update.requestedMetadata
+  const usageLimitCredits = metadataNumber(metadata, 'usageLimitCredits')
+  const seats = metadataNumber(metadata, 'seats')
+  const concurrencyLimit = metadataNumber(metadata, 'concurrencyLimit')
+
+  return {
+    id: update.id,
+    status: update.status,
+    requestedUsageLimitDollars:
+      usageLimitCredits === null ? null : creditsToDollars(usageLimitCredits),
+    requestedSeats: seats === null ? null : Math.round(seats),
+    requestedConcurrencyLimit: concurrencyLimit === null ? null : Math.round(concurrencyLimit),
+    error: update.error,
+  }
+}
+
 export async function listDashboardUsers({ search, limit, offset }: PaginationInput) {
   const trimmed = search.trim()
   // Mirror Better Auth's active-ban semantics: permanent bans and temporary
@@ -444,60 +460,65 @@ export async function listDashboardOrganizations({ search, limit, offset }: Pagi
 export async function getDashboardOrganization(organizationId: string) {
   const summary = await getDashboardOrganizationSummary(organizationId)
   if (!summary) return null
-  const [memberRows, externalRows, workspaceRows, limitRows] = await Promise.all([
-    db
-      .select({
-        id: member.id,
-        userId: user.id,
-        name: user.name,
-        email: user.email,
-        role: member.role,
-      })
-      .from(member)
-      .innerJoin(user, eq(user.id, member.userId))
-      .where(eq(member.organizationId, organizationId))
-      .orderBy(user.name),
-    db
-      .select({
-        userId: user.id,
-        name: user.name,
-        email: user.email,
-        workspaceCount: countDistinct(workspace.id),
-      })
-      .from(permissions)
-      .innerJoin(user, eq(user.id, permissions.userId))
-      .innerJoin(
-        workspace,
-        and(
-          eq(permissions.entityType, 'workspace'),
-          eq(permissions.entityId, workspace.id),
-          eq(workspace.organizationId, organizationId)
+  const { subscription: subscriptionRow, ...base } = summary
+  const [memberRows, externalRows, workspaceRows, limitRows, configurationIntent] =
+    await Promise.all([
+      db
+        .select({
+          id: member.id,
+          userId: user.id,
+          name: user.name,
+          email: user.email,
+          role: member.role,
+        })
+        .from(member)
+        .innerJoin(user, eq(user.id, member.userId))
+        .where(eq(member.organizationId, organizationId))
+        .orderBy(user.name),
+      db
+        .select({
+          userId: user.id,
+          name: user.name,
+          email: user.email,
+          workspaceCount: countDistinct(workspace.id),
+        })
+        .from(permissions)
+        .innerJoin(user, eq(user.id, permissions.userId))
+        .innerJoin(
+          workspace,
+          and(
+            eq(permissions.entityType, 'workspace'),
+            eq(permissions.entityId, workspace.id),
+            eq(workspace.organizationId, organizationId)
+          )
         )
-      )
-      .leftJoin(
-        member,
-        and(eq(member.userId, permissions.userId), eq(member.organizationId, organizationId))
-      )
-      .where(and(isNull(member.id), isNull(workspace.archivedAt)))
-      .groupBy(user.id, user.name, user.email)
-      .orderBy(user.name),
-    db
-      .select({ id: workspace.id, name: workspace.name })
-      .from(workspace)
-      .where(eq(workspace.organizationId, organizationId))
-      .orderBy(workspace.name),
-    db
-      .select({
-        userId: organizationMemberUsageLimit.userId,
-        limit: organizationMemberUsageLimit.usageLimit,
-      })
-      .from(organizationMemberUsageLimit)
-      .where(eq(organizationMemberUsageLimit.organizationId, organizationId)),
-  ])
+        .leftJoin(
+          member,
+          and(eq(member.userId, permissions.userId), eq(member.organizationId, organizationId))
+        )
+        .where(and(isNull(member.id), isNull(workspace.archivedAt)))
+        .groupBy(user.id, user.name, user.email)
+        .orderBy(user.name),
+      db
+        .select({ id: workspace.id, name: workspace.name })
+        .from(workspace)
+        .where(eq(workspace.organizationId, organizationId))
+        .orderBy(workspace.name),
+      db
+        .select({
+          userId: organizationMemberUsageLimit.userId,
+          limit: organizationMemberUsageLimit.usageLimit,
+        })
+        .from(organizationMemberUsageLimit)
+        .where(eq(organizationMemberUsageLimit.organizationId, organizationId)),
+      subscriptionRow?.plan === 'enterprise'
+        ? resolveEnterpriseMetadataIntent(db, subscriptionRow.id, subscriptionRow.metadata)
+        : Promise.resolve(null),
+    ])
   const limits = new Map(limitRows.map((row) => [row.userId, Number(row.limit)]))
-  const { subscription: subscriptionRow, ...base } = summary
   return {
     ...base,
+    configurationUpdate: toDashboardConfigurationUpdate(configurationIntent),
     members: memberRows.map((row) => ({
       ...row,
       usageLimitDollars: limits.get(row.userId) ?? null,
@@ -570,7 +591,6 @@ export async function updateDashboardEnterpriseSeats(
 export async function updateDashboardOrganizationLimits(
   organizationId: string,
   values: {
-    includedMonthlyDollars?: number
     usageLimitDollars?: number
     concurrencyLimit?: number | null
   },
@@ -597,9 +617,6 @@ export async function updateDashboardOrganizationLimits(
       .for('update')
       .limit(1)
     const metadata = metadataRecord(subscriptionRow?.metadata)
-    if (values.includedMonthlyDollars !== undefined && subscriptionRow?.plan !== 'enterprise') {
-      throw new Error('Included allowance is editable only for Enterprise organizations')
-    }
     if (values.concurrencyLimit !== undefined && subscriptionRow?.plan !== 'enterprise') {
       throw new Error('Concurrency is editable only for Enterprise organizations')
     }
@@ -612,10 +629,6 @@ export async function updateDashboardOrganizationLimits(
         subscriptionId: subscriptionRow.id,
         appliedMetadata: subscriptionRow.metadata,
         buildDesiredMetadata: (current) => {
-          const included =
-            values.includedMonthlyDollars === undefined
-              ? Math.round(metadataNumber(current, 'includedMonthlyCredits') ?? 0)
-              : dollarsToCredits(values.includedMonthlyDollars)
           const configuredUsageLimit =
             values.usageLimitDollars === undefined
               ? Math.round(
@@ -625,7 +638,6 @@ export async function updateDashboardOrganizationLimits(
               : dollarsToCredits(values.usageLimitDollars)
           return {
             ...current,
-            includedMonthlyCredits: included,
             usageLimitCredits: configuredUsageLimit,
             ...(values.concurrencyLimit !== undefined
               ? { concurrencyLimit: values.concurrencyLimit }
@@ -644,18 +656,14 @@ export async function updateDashboardOrganizationLimits(
       subscriptionRow?.plan,
       memberCountRow?.value ?? 0
     )
-    const included =
-      values.includedMonthlyDollars ??
-      (teamEconomics
-        ? teamEconomics.includedMonthlyDollars
-        : creditsToDollars(Math.round(metadataNumber(metadata, 'includedMonthlyCredits') ?? 0)))
+    const planAllowance = teamEconomics?.planAllowanceDollars ?? 0
     const prepaid = Number(org.creditBalance)
     const configuredUsageLimit =
       values.usageLimitDollars ??
       (metadataNumber(metadata, 'usageLimitCredits') === null
         ? Number(org.orgUsageLimit ?? 0)
         : creditsToDollars(metadataNumber(metadata, 'usageLimitCredits') ?? 0))
-    const effective = Math.max(configuredUsageLimit, included + prepaid)
+    const effective = Math.max(configuredUsageLimit, planAllowance + prepaid)
     await tx
       .update(organization)
       .set({ orgUsageLimit: effective.toString(), updatedAt: new Date() })
@@ -666,9 +674,6 @@ export async function updateDashboardOrganizationLimits(
         .set({
           metadata: {
             ...metadata,
-            ...(subscriptionRow.plan === 'enterprise'
-              ? { includedMonthlyCredits: dollarsToCredits(included) }
-              : {}),
             usageLimitCredits: dollarsToCredits(configuredUsageLimit),
           },
         })
@@ -731,16 +736,7 @@ export async function grantDashboardOrganizationBalance(
           subscriptionRow?.plan,
           memberCountRow?.value ?? 0
         )
-        const includedDollars = teamEconomics
-          ? teamEconomics.includedMonthlyDollars
-          : creditsToDollars(
-              Math.round(
-                metadataNumber(
-                  metadataRecord(subscriptionRow?.metadata),
-                  'includedMonthlyCredits'
-                ) ?? 0
-              )
-            )
+        const planAllowanceDollars = teamEconomics?.planAllowanceDollars ?? 0
         const subscriptionMetadata = metadataRecord(subscriptionRow?.metadata)
         const configuredUsageLimitCredits = metadataNumber(
           subscriptionMetadata,
@@ -753,7 +749,7 @@ export async function grantDashboardOrganizationBalance(
         const grantDollarDelta = toDecimal(amountDollars).toString()
         const usageLimitFallback = getOrganizationUsageLimitFallbackDollars({
           creditBalanceDollarsBeforeGrant: org.creditBalance,
-          includedDollars,
+          planAllowanceDollars,
           configuredUsageLimitDollars,
         })
         const [updated] = await tx
diff --git a/apps/sim/lib/admin/organization-economics.test.ts b/apps/sim/lib/admin/organization-economics.test.ts
index 2a6f49dc783..22c9413215e 100644
--- a/apps/sim/lib/admin/organization-economics.test.ts
+++ b/apps/sim/lib/admin/organization-economics.test.ts
@@ -8,7 +8,7 @@ describe('getTeamOrganizationEconomics', () => {
   it('derives the pooled Pro allowance and invoice from internal seats', () => {
     expect(getTeamOrganizationEconomics('team_6000', 3)).toEqual({
       seats: 3,
-      includedMonthlyDollars: 90,
+      planAllowanceDollars: 90,
       monthlyInvoiceAmountUsd: 75,
     })
   })
@@ -16,7 +16,7 @@ describe('getTeamOrganizationEconomics', () => {
   it('derives the pooled Max allowance and invoice from internal seats', () => {
     expect(getTeamOrganizationEconomics('team_25000', 2)).toEqual({
       seats: 2,
-      includedMonthlyDollars: 250,
+      planAllowanceDollars: 250,
       monthlyInvoiceAmountUsd: 200,
     })
   })
@@ -31,7 +31,7 @@ describe('getOrganizationUsageLimitFallbackDollars', () => {
     expect(
       getOrganizationUsageLimitFallbackDollars({
         creditBalanceDollarsBeforeGrant: '0.001',
-        includedDollars: 0,
+        planAllowanceDollars: 0,
         configuredUsageLimitDollars: 0,
       })
     ).toBe('0.001')
@@ -41,7 +41,7 @@ describe('getOrganizationUsageLimitFallbackDollars', () => {
     expect(
       getOrganizationUsageLimitFallbackDollars({
         creditBalanceDollarsBeforeGrant: '1.259567',
-        includedDollars: 5,
+        planAllowanceDollars: 5,
         configuredUsageLimitDollars: 100,
       })
     ).toBe('101.259567')
diff --git a/apps/sim/lib/admin/organization-economics.ts b/apps/sim/lib/admin/organization-economics.ts
index 063338f3967..6380686b317 100644
--- a/apps/sim/lib/admin/organization-economics.ts
+++ b/apps/sim/lib/admin/organization-economics.ts
@@ -4,7 +4,7 @@ import { Decimal, toDecimal } from '@/lib/billing/utils/decimal'
 
 export interface TeamOrganizationEconomics {
   seats: number
-  includedMonthlyDollars: number
+  planAllowanceDollars: number
   monthlyInvoiceAmountUsd: number
 }
 
@@ -17,7 +17,7 @@ export function getTeamOrganizationEconomics(
   const seats = Math.max(0, Math.trunc(internalMemberCount))
   return {
     seats,
-    includedMonthlyDollars: (getPlanTierCredits(plan) * seats) / CREDIT_MULTIPLIER,
+    planAllowanceDollars: (getPlanTierCredits(plan) * seats) / CREDIT_MULTIPLIER,
     monthlyInvoiceAmountUsd: getPlanTierDollars(plan) * seats,
   }
 }
@@ -29,15 +29,15 @@ export function getTeamOrganizationEconomics(
  */
 export function getOrganizationUsageLimitFallbackDollars(params: {
   creditBalanceDollarsBeforeGrant: string | number
-  includedDollars: number
+  planAllowanceDollars: number
   configuredUsageLimitDollars: number | null
 }): string {
   const configuredUsageLimitDollars =
     params.configuredUsageLimitDollars === null
       ? toDecimal(0)
       : toDecimal(params.configuredUsageLimitDollars)
-  const includedUsageLimitDollars = toDecimal(params.includedDollars)
-  return Decimal.max(configuredUsageLimitDollars, includedUsageLimitDollars)
+  const planAllowanceDollars = toDecimal(params.planAllowanceDollars)
+  return Decimal.max(configuredUsageLimitDollars, planAllowanceDollars)
     .plus(toDecimal(params.creditBalanceDollarsBeforeGrant))
     .toString()
 }
diff --git a/apps/sim/lib/api/contracts/mothership-chats.ts b/apps/sim/lib/api/contracts/mothership-chats.ts
index 239c420431f..bb50923b562 100644
--- a/apps/sim/lib/api/contracts/mothership-chats.ts
+++ b/apps/sim/lib/api/contracts/mothership-chats.ts
@@ -6,8 +6,12 @@ const dateStringSchema = z.string().refine((value) => !Number.isNaN(Date.parse(v
   message: 'Expected a valid date string',
 })
 
+export const mothershipChatScopeSchema = z.enum(['active', 'archived'])
+export type MothershipChatScope = z.output<typeof mothershipChatScopeSchema>
+
 export const listMothershipChatsQuerySchema = z.object({
   workspaceId: z.string().min(1),
+  scope: mothershipChatScopeSchema.default('active'),
 })
 
 export const mothershipChatParamsSchema = z.object({
@@ -251,6 +255,7 @@ export const mothershipChatSchema = z.object({
   activeStreamId: z.string().nullable(),
   lastSeenAt: dateStringSchema.nullable(),
   pinned: z.boolean(),
+  deletedAt: dateStringSchema.nullable(),
 })
 
 export const listMothershipChatsContract = defineRouteContract({
@@ -291,6 +296,18 @@ export const deleteMothershipChatContract = defineRouteContract({
   },
 })
 
+export const restoreMothershipChatContract = defineRouteContract({
+  method: 'POST',
+  path: '/api/mothership/chats/[chatId]/restore',
+  params: mothershipChatParamsSchema,
+  response: {
+    mode: 'json',
+    schema: z.object({
+      success: z.literal(true),
+    }),
+  },
+})
+
 export const forkMothershipChatBodySchema = z.object({
   upToMessageId: z.string().min(1, 'upToMessageId is required'),
 })
diff --git a/apps/sim/lib/api/contracts/permission-groups.ts b/apps/sim/lib/api/contracts/permission-groups.ts
index 051ea60d93d..273c47f874d 100644
--- a/apps/sim/lib/api/contracts/permission-groups.ts
+++ b/apps/sim/lib/api/contracts/permission-groups.ts
@@ -28,7 +28,7 @@ export const permissionGroupFullConfigSchema = z.object({
   hideDeployApi: z.boolean(),
   hideDeployMcp: z.boolean(),
   hideDeployChatbot: z.boolean(),
-  hideDeployTemplate: z.boolean(),
+  allowedChatDeployAuthTypes: z.array(shareAuthTypeSchema).nullable(),
 })
 
 export const addPermissionGroupMemberBodySchema = z.object({
diff --git a/apps/sim/lib/api/contracts/v1/admin/dashboard.test.ts b/apps/sim/lib/api/contracts/v1/admin/dashboard.test.ts
index 97da77abb28..85a733053ad 100644
--- a/apps/sim/lib/api/contracts/v1/admin/dashboard.test.ts
+++ b/apps/sim/lib/api/contracts/v1/admin/dashboard.test.ts
@@ -58,7 +58,7 @@ describe('admin dashboard credit grant contract', () => {
         externalCollaboratorCount: 0,
         seats: 0,
         concurrencyLimit: null,
-        includedMonthlyDollars: 0,
+        planAllowanceDollars: null,
         usageLimitDollars: 0.001,
         effectiveUsageLimitDollars: 0.001,
         prepaidBalanceDollars: 0.001,
@@ -83,6 +83,12 @@ describe('admin dashboard credit grant contract', () => {
     expect(adminDashboardLimitsBodySchema.safeParse({ concurrencyLimit: 1.5 }).success).toBe(false)
   })
 
+  it('does not expose included allowance as an editable organization control', () => {
+    expect(adminDashboardLimitsBodySchema.safeParse({ includedMonthlyDollars: 100 }).success).toBe(
+      false
+    )
+  })
+
   it('accepts null to restore the deployment-wide Enterprise concurrency default', () => {
     expect(adminDashboardLimitsBodySchema.safeParse({ concurrencyLimit: null }).success).toBe(true)
     expect(
diff --git a/apps/sim/lib/api/contracts/v1/admin/dashboard.ts b/apps/sim/lib/api/contracts/v1/admin/dashboard.ts
index 59a0ee8079a..a7315ed4b94 100644
--- a/apps/sim/lib/api/contracts/v1/admin/dashboard.ts
+++ b/apps/sim/lib/api/contracts/v1/admin/dashboard.ts
@@ -38,7 +38,6 @@ export const adminDashboardProvisioningSchema = z.object({
   organizationId: z.string(),
   status: z.enum(['pending', 'processing', 'dead_letter', 'awaiting_webhook', 'applied']),
   monthlyInvoiceAmountUsd: z.number(),
-  includedMonthlyDollars: creditAlignedDollarAmountSchema,
   usageLimitDollars: creditAlignedDollarAmountSchema,
   seats: z.number().int().positive(),
   concurrencyLimit: z.number().int().positive().max(MAX_BILLING_CONCURRENCY_LIMIT),
@@ -61,7 +60,7 @@ export const adminDashboardOrganizationSummarySchema = z.object({
   externalCollaboratorCount: z.number().int().min(0),
   seats: z.number().int().min(0),
   concurrencyLimit: z.number().int().positive().max(MAX_BILLING_CONCURRENCY_LIMIT).nullable(),
-  includedMonthlyDollars: dollarAmountSchema,
+  planAllowanceDollars: dollarAmountSchema.nullable(),
   usageLimitDollars: dollarAmountSchema,
   effectiveUsageLimitDollars: dollarAmountSchema,
   prepaidBalanceDollars: dollarAmountSchema,
@@ -71,6 +70,21 @@ export const adminDashboardOrganizationSummarySchema = z.object({
 
 export const adminDashboardOrganizationDetailSchema =
   adminDashboardOrganizationSummarySchema.extend({
+    configurationUpdate: z
+      .object({
+        id: z.string(),
+        status: z.enum(['pending', 'processing', 'failed']),
+        requestedUsageLimitDollars: dollarAmountSchema.nullable(),
+        requestedSeats: z.number().int().positive().nullable(),
+        requestedConcurrencyLimit: z
+          .number()
+          .int()
+          .positive()
+          .max(MAX_BILLING_CONCURRENCY_LIMIT)
+          .nullable(),
+        error: z.string().nullable(),
+      })
+      .nullable(),
     members: z.array(
       z.object({
         id: z.string(),
@@ -124,7 +138,6 @@ export const adminDashboardSeatsBodySchema = z.object({
 
 export const adminDashboardLimitsBodySchema = z
   .object({
-    includedMonthlyDollars: creditAlignedDollarAmountSchema.optional(),
     usageLimitDollars: creditAlignedDollarAmountSchema.optional(),
     concurrencyLimit: z
       .number()
@@ -135,10 +148,7 @@ export const adminDashboardLimitsBodySchema = z
       .optional(),
   })
   .refine(
-    (value) =>
-      value.includedMonthlyDollars !== undefined ||
-      value.usageLimitDollars !== undefined ||
-      value.concurrencyLimit !== undefined,
+    (value) => value.usageLimitDollars !== undefined || value.concurrencyLimit !== undefined,
     { error: 'At least one limit must be provided' }
   )
 
diff --git a/apps/sim/lib/auth/auth.ts b/apps/sim/lib/auth/auth.ts
index ea2d1f0b227..a18c757f6c2 100644
--- a/apps/sim/lib/auth/auth.ts
+++ b/apps/sim/lib/auth/auth.ts
@@ -768,6 +768,13 @@ export const auth = betterAuth({
   },
   emailAndPassword: {
     enabled: true,
+    /**
+     * Same flag that hides the email/password signup form (DISABLE_EMAIL_SIGNUP).
+     * Blocks /sign-up/email at the better-auth layer so ripping out the frontend
+     * form cannot be bypassed by calling the endpoint directly. Existing users
+     * can still sign in.
+     */
+    disableSignUp: isEmailSignupDisabled,
     requireEmailVerification: isEmailVerificationEnabled,
     /**
      * When someone signs up with an already-registered email, better-auth returns a
@@ -891,11 +898,6 @@ export const auth = betterAuth({
           })
       }
 
-      if (isEmailSignupDisabled && ctx.path.startsWith('/sign-up/email'))
-        throw new APIError('FORBIDDEN', {
-          message: 'Email sign-up is disabled. Please use Google, Microsoft, or GitHub.',
-        })
-
       const isSignIn = ctx.path.startsWith('/sign-in')
       const isSignUp = ctx.path.startsWith('/sign-up')
 
@@ -1039,6 +1041,16 @@ export const auth = betterAuth({
           throw error
         }
       },
+      /**
+       * Without this, /sign-in/email-otp auto-registers any unknown email —
+       * bypassing the signup gate entirely (no captcha, no /sign-up path).
+       * Gated by the same DISABLE_EMAIL_SIGNUP flag as the signup form (and by
+       * DISABLE_REGISTRATION, whose /sign-up path check has the same blind
+       * spot); when set, better-auth also silently skips sending OTPs to
+       * unknown emails (enumeration-safe) while existing users keep OTP
+       * sign-in.
+       */
+      disableSignUp: isEmailSignupDisabled || isRegistrationDisabled,
       sendVerificationOnSignUp: false,
       otpLength: 6, // Explicitly set the OTP length
       expiresIn: 15 * 60, // 15 minutes in seconds
diff --git a/apps/sim/lib/billing/enterprise-credit-limits.test.ts b/apps/sim/lib/billing/enterprise-credit-limits.test.ts
index 6cc0036d624..0fd263b3e18 100644
--- a/apps/sim/lib/billing/enterprise-credit-limits.test.ts
+++ b/apps/sim/lib/billing/enterprise-credit-limits.test.ts
@@ -10,14 +10,12 @@ describe('deriveEnterpriseCreditLimits', () => {
       deriveEnterpriseCreditLimits({
         metadata: {
           invoiceAmountCents: '99900',
-          includedMonthlyCredits: '10000',
           usageLimitCredits: '20000',
         },
         monthlyPriceUsd: 999,
         prepaidBalanceDollars: 10,
       })
     ).toEqual({
-      includedMonthlyCredits: 10000,
       configuredUsageLimitCredits: 20000,
       prepaidCredits: 2000,
       effectiveUsageLimitCredits: 22000,
@@ -25,20 +23,19 @@ describe('deriveEnterpriseCreditLimits', () => {
     })
   })
 
-  it('uses the included allowance as the base when it exceeds configuration', () => {
+  it('uses the configured usage limit without an invoice-derived floor', () => {
     expect(
       deriveEnterpriseCreditLimits({
         metadata: {
-          includedMonthlyCredits: '10000',
           usageLimitCredits: '8000',
         },
         monthlyPriceUsd: 999,
         prepaidBalanceDollars: 10,
       }).effectiveUsageLimitCredits
-    ).toBe(12000)
+    ).toBe(10000)
   })
 
-  it('uses the legacy monthly-price allowance only when credit metadata is absent', () => {
+  it('defaults the usage limit to the monthly price when metadata is absent', () => {
     expect(
       deriveEnterpriseCreditLimits({
         metadata: {},
@@ -46,7 +43,6 @@ describe('deriveEnterpriseCreditLimits', () => {
         prepaidBalanceDollars: 0,
       })
     ).toEqual({
-      includedMonthlyCredits: 10000,
       configuredUsageLimitCredits: 10000,
       prepaidCredits: 0,
       effectiveUsageLimitCredits: 10000,
@@ -58,7 +54,6 @@ describe('deriveEnterpriseCreditLimits', () => {
     expect(
       deriveEnterpriseCreditLimits({
         metadata: {
-          includedMonthlyCredits: '20000',
           usageLimitCredits: '20000',
         },
         monthlyPriceUsd: 100,
diff --git a/apps/sim/lib/billing/enterprise-credit-limits.ts b/apps/sim/lib/billing/enterprise-credit-limits.ts
index fe2ec7cc89e..ef7ab5e615a 100644
--- a/apps/sim/lib/billing/enterprise-credit-limits.ts
+++ b/apps/sim/lib/billing/enterprise-credit-limits.ts
@@ -12,26 +12,19 @@ export function deriveEnterpriseCreditLimits({
   monthlyPriceUsd,
   prepaidBalanceDollars,
 }: DeriveEnterpriseCreditLimitsInput) {
-  const parsedIncludedCredits = Number(metadata.includedMonthlyCredits)
-  const includedMonthlyCredits = Number.isFinite(parsedIncludedCredits)
-    ? Math.max(0, Math.round(parsedIncludedCredits))
-    : dollarsToCredits(monthlyPriceUsd)
   const parsedUsageLimitCredits = Number(metadata.usageLimitCredits)
   const configuredUsageLimitCredits = Number.isFinite(parsedUsageLimitCredits)
     ? Math.max(0, Math.round(parsedUsageLimitCredits))
-    : includedMonthlyCredits
+    : dollarsToCredits(monthlyPriceUsd)
   const prepaidBalance = toDecimal(prepaidBalanceDollars)
   const prepaidCredits = dollarsToCredits(prepaidBalance.toNumber())
-  const effectiveUsageLimitDollars = toDecimal(
-    Math.max(configuredUsageLimitCredits, includedMonthlyCredits)
-  )
+  const effectiveUsageLimitDollars = toDecimal(configuredUsageLimitCredits)
     .div(CREDIT_MULTIPLIER)
     .plus(prepaidBalance)
     .toString()
   const effectiveUsageLimitCredits = dollarsToCredits(Number(effectiveUsageLimitDollars))
 
   return {
-    includedMonthlyCredits,
     configuredUsageLimitCredits,
     prepaidCredits,
     effectiveUsageLimitCredits,
diff --git a/apps/sim/lib/billing/enterprise-outbox.test.ts b/apps/sim/lib/billing/enterprise-outbox.test.ts
index 22c68e46b16..5f63af9fde1 100644
--- a/apps/sim/lib/billing/enterprise-outbox.test.ts
+++ b/apps/sim/lib/billing/enterprise-outbox.test.ts
@@ -35,13 +35,12 @@ import {
 const payload = {
   version: 1 as const,
   request: {
-    requestKey: 'enterprise-v2:owner-1:org-1:10000:20000:20000:5:1250',
+    requestKey: 'enterprise-v3:owner-1:org-1:10000:20000:5:1250',
     ownerUserId: 'owner-1',
     organizationId: 'org-1',
     requestedByEmail: 'admin@sim.ai',
     requestedByUserId: 'admin-1',
     invoiceAmountCents: 10000,
-    includedMonthlyCredits: 20000,
     usageLimitCredits: 20000,
     seats: 5,
     concurrencyLimit: 1250,
@@ -81,7 +80,6 @@ function stripeSubscription(
     items: { data: Array.from({ length: options.itemCount ?? 1 }, () => item) },
     metadata: {
       invoiceAmountCents: '10000',
-      includedMonthlyCredits: '20000',
       usageLimitCredits: '20000',
       seats: '5',
       concurrencyLimit: '1250',
@@ -152,7 +150,7 @@ describe('Enterprise issuance Stripe-term correlation', () => {
       ...payload,
       request: {
         ...payload.request,
-        requestKey: 'enterprise-v2:owner-1:org-1:10000:20000:20000:5:1250:draft-collection',
+        requestKey: 'enterprise-v3:owner-1:org-1:10000:20000:5:1250:draft-collection',
         pausePaymentCollection: true,
       },
     }
@@ -180,7 +178,7 @@ describe('Enterprise issuance Stripe-term correlation', () => {
     ['wrong interval count', { intervalCount: 2 }],
     ['automatic collection', { collectionMethod: 'charge_automatically' }],
     ['wrong due terms', { daysUntilDue: 14 }],
-    ['wrong credits', { metadata: { includedMonthlyCredits: '999' } }],
+    ['wrong usage limit', { metadata: { usageLimitCredits: '999' } }],
     ['wrong seats', { metadata: { seats: '6' } }],
     ['wrong concurrency', { metadata: { concurrencyLimit: '999' } }],
   ] as const)('rejects %s', (_name, options) => {
@@ -220,6 +218,12 @@ describe('Enterprise metadata intent admission state', () => {
 
     expect(state.hasUnappliedIntent).toBe(true)
     expect(state.effectiveSeatCapacity).toBe(7)
+    expect(state.configurationUpdate).toEqual({
+      id: 'config-2',
+      status: 'pending',
+      requestedMetadata: { seats: 7 },
+      error: null,
+    })
   })
 
   it('falls back to applied seats for a dead-lettered intent', async () => {
@@ -241,6 +245,33 @@ describe('Enterprise metadata intent admission state', () => {
 
     expect(state.hasUnappliedIntent).toBe(false)
     expect(state.effectiveSeatCapacity).toBe(10)
+    expect(state.configurationUpdate).toEqual({
+      id: 'config-2',
+      status: 'failed',
+      requestedMetadata: { seats: 7 },
+      error: null,
+    })
+  })
+
+  it('hides the update after the verified webhook applies its operation id', async () => {
+    const state = await resolveEnterpriseMetadataIntent(
+      executorReturning([
+        {
+          id: 'config-2',
+          status: 'pending',
+          payload: {
+            subscriptionId: 'sub-local',
+            revision: 2,
+            metadata: { seats: 7 },
+          },
+        },
+      ]),
+      'sub-local',
+      { seats: '7', simConfigRevision: '2', simConfigOperationId: 'config-2' }
+    )
+
+    expect(state.hasUnappliedIntent).toBe(false)
+    expect(state.configurationUpdate).toBeNull()
   })
 
   it('fails closed when the newest desired metadata payload is malformed', async () => {
diff --git a/apps/sim/lib/billing/enterprise-outbox.ts b/apps/sim/lib/billing/enterprise-outbox.ts
index 39362028335..93747d6033f 100644
--- a/apps/sim/lib/billing/enterprise-outbox.ts
+++ b/apps/sim/lib/billing/enterprise-outbox.ts
@@ -17,7 +17,6 @@ export const enterpriseProvisionRequestSchema = z.object({
   requestedByEmail: z.string().min(1),
   requestedByUserId: z.string().nullable(),
   invoiceAmountCents: z.number().int().positive(),
-  includedMonthlyCredits: nonnegativeInteger,
   usageLimitCredits: nonnegativeInteger,
   seats: z.number().int().positive(),
   concurrencyLimit: z.number().int().positive().max(MAX_BILLING_CONCURRENCY_LIMIT).optional(),
@@ -126,7 +125,6 @@ export function enterpriseOperationMatchesStripeSubscription(
     price.recurring?.interval === 'month' &&
     (price.recurring.interval_count ?? 1) === 1 &&
     stripeMetadataInteger(metadata, 'invoiceAmountCents') === request.invoiceAmountCents &&
-    stripeMetadataInteger(metadata, 'includedMonthlyCredits') === request.includedMonthlyCredits &&
     stripeMetadataInteger(metadata, 'usageLimitCredits') === request.usageLimitCredits &&
     stripeMetadataInteger(metadata, 'seats') === request.seats &&
     (request.concurrencyLimit === undefined ||
@@ -209,6 +207,12 @@ export interface EnterpriseMetadataIntentState {
   desiredMetadata: Record<string, unknown>
   hasUnappliedIntent: boolean
   effectiveSeatCapacity: number | null
+  configurationUpdate: {
+    id: string
+    status: 'pending' | 'processing' | 'failed'
+    requestedMetadata: Record<string, unknown>
+    error: string | null
+  } | null
 }
 
 /**
@@ -230,6 +234,7 @@ export async function resolveEnterpriseMetadataIntent(
       id: outboxEvent.id,
       status: outboxEvent.status,
       payload: outboxEvent.payload,
+      lastError: outboxEvent.lastError,
     })
     .from(outboxEvent)
     .where(
@@ -251,6 +256,7 @@ export async function resolveEnterpriseMetadataIntent(
       desiredMetadata: appliedMetadata,
       hasUnappliedIntent: false,
       effectiveSeatCapacity: appliedSeats,
+      configurationUpdate: null,
     }
   }
 
@@ -260,7 +266,8 @@ export async function resolveEnterpriseMetadataIntent(
   }
 
   const appliedOperationId = appliedMetadata.simConfigOperationId
-  const hasUnappliedIntent = latest.status !== 'dead_letter' && appliedOperationId !== latest.id
+  const operationApplied = appliedOperationId === latest.id
+  const hasUnappliedIntent = latest.status !== 'dead_letter' && !operationApplied
   const desiredMetadata = hasUnappliedIntent ? parsed.data.metadata : appliedMetadata
   const desiredSeats = positiveInteger(parsed.data.metadata.seats)
   const effectiveSeatCapacity = hasUnappliedIntent
@@ -276,5 +283,18 @@ export async function resolveEnterpriseMetadataIntent(
     desiredMetadata,
     hasUnappliedIntent,
     effectiveSeatCapacity,
+    configurationUpdate: operationApplied
+      ? null
+      : {
+          id: latest.id,
+          status:
+            latest.status === 'dead_letter'
+              ? 'failed'
+              : latest.status === 'processing'
+                ? 'processing'
+                : 'pending',
+          requestedMetadata: parsed.data.metadata,
+          error: latest.status === 'dead_letter' ? (latest.lastError ?? null) : null,
+        },
   }
 }
diff --git a/apps/sim/lib/billing/enterprise-provisioning.test.ts b/apps/sim/lib/billing/enterprise-provisioning.test.ts
index 45667323064..d01e15d1964 100644
--- a/apps/sim/lib/billing/enterprise-provisioning.test.ts
+++ b/apps/sim/lib/billing/enterprise-provisioning.test.ts
@@ -132,13 +132,12 @@ function operationPayload(overrides: Record<string, unknown> = {}) {
   return {
     version: 1 as const,
     request: {
-      requestKey: 'enterprise-v2:owner-1:org-1:12500:20000:24000:12:1250',
+      requestKey: 'enterprise-v3:owner-1:org-1:12500:24000:12:1250',
       ownerUserId: 'owner-1',
       organizationId: 'org-1',
       requestedByEmail: 'admin@sim.ai',
       requestedByUserId: 'admin-1',
       invoiceAmountCents: 12500,
-      includedMonthlyCredits: 20000,
       usageLimitCredits: 24000,
       seats: 12,
       concurrencyLimit: 1250,
@@ -160,7 +159,7 @@ function context() {
 }
 
 describe('Enterprise issuance serialization decisions', () => {
-  it('derives included usage from invoice amount in the request key', () => {
+  it('includes the configured or invoice-defaulted usage limit in the request key', () => {
     const input = {
       ownerUserId: 'owner-1',
       monthlyInvoiceAmountUsd: 125,
@@ -171,17 +170,17 @@ describe('Enterprise issuance serialization decisions', () => {
     }
 
     expect(buildEnterpriseProvisioningRequestKey(input, 'org-1')).toBe(
-      'enterprise-v2:owner-1:org-1:12500:25000:24000:12'
+      'enterprise-v3:owner-1:org-1:12500:24000:12'
     )
     expect(
       buildEnterpriseProvisioningRequestKey({ ...input, concurrencyLimit: 1250 }, 'org-1')
-    ).toBe('enterprise-v2:owner-1:org-1:12500:25000:24000:12:1250')
+    ).toBe('enterprise-v3:owner-1:org-1:12500:24000:12:1250')
     expect(
       buildEnterpriseProvisioningRequestKey({ ...input, pausePaymentCollection: true }, 'org-1')
-    ).toBe('enterprise-v2:owner-1:org-1:12500:25000:24000:12:draft-collection')
+    ).toBe('enterprise-v3:owner-1:org-1:12500:24000:12:draft-collection')
     expect(
       buildEnterpriseProvisioningRequestKey({ ...input, usageLimitCredits: undefined }, 'org-1')
-    ).toBe('enterprise-v2:owner-1:org-1:12500:25000:25000:12')
+    ).toBe('enterprise-v3:owner-1:org-1:12500:25000:12')
   })
 
   it('deduplicates an identical unresolved request to the existing outbox operation', () => {
@@ -197,7 +196,7 @@ describe('Enterprise issuance serialization decisions', () => {
   it('rejects a different request while the existing operation is unresolved', () => {
     expect(() =>
       decideEnterpriseProvisioningIssue(
-        'enterprise-v2:different-request',
+        'enterprise-v3:different-request',
         [{ id: 'operation-1', payload: operationPayload() }],
         []
       )
@@ -324,7 +323,6 @@ describe('Enterprise issuance outbox handler', () => {
         metadata: expect.objectContaining({
           enterpriseOperationId: 'operation-1',
           referenceId: 'org-1',
-          includedMonthlyCredits: '20000',
           usageLimitCredits: '24000',
           seats: '12',
           concurrencyLimit: '1250',
@@ -379,7 +377,7 @@ describe('Enterprise issuance outbox handler', () => {
     const pausedPayload = operationPayload({
       request: {
         ...operationPayload().request,
-        requestKey: 'enterprise-v2:owner-1:org-1:12500:20000:24000:12:1250:draft-collection',
+        requestKey: 'enterprise-v3:owner-1:org-1:12500:24000:12:1250:draft-collection',
         pausePaymentCollection: true,
       },
     })
@@ -407,7 +405,7 @@ describe('Enterprise issuance outbox handler', () => {
     const pausedPayload = operationPayload({
       request: {
         ...operationPayload().request,
-        requestKey: 'enterprise-v2:owner-1:org-1:12500:20000:24000:12:1250:draft-collection',
+        requestKey: 'enterprise-v3:owner-1:org-1:12500:24000:12:1250:draft-collection',
         pausePaymentCollection: true,
       },
     })
@@ -496,7 +494,6 @@ describe('Enterprise metadata outbox handler', () => {
         plan: 'enterprise',
         referenceId: 'org-1',
         seats: 15,
-        includedMonthlyCredits: 30000,
         usageLimitCredits: 35000,
         concurrencyLimit: 1250,
       },
@@ -524,7 +521,6 @@ describe('Enterprise metadata outbox handler', () => {
       {
         metadata: expect.objectContaining({
           seats: '15',
-          includedMonthlyCredits: '30000',
           concurrencyLimit: '1250',
           simConfigRevision: '4',
           simConfigOperationId: 'metadata-event-1',
diff --git a/apps/sim/lib/billing/enterprise-provisioning.ts b/apps/sim/lib/billing/enterprise-provisioning.ts
index b126748e8a8..368f7135305 100644
--- a/apps/sim/lib/billing/enterprise-provisioning.ts
+++ b/apps/sim/lib/billing/enterprise-provisioning.ts
@@ -249,7 +249,6 @@ export interface EnterpriseProvisioningView {
   organizationId: string
   status: EnterpriseOperationStatus
   monthlyInvoiceAmountUsd: number
-  includedMonthlyCredits: number
   usageLimitCredits: number
   seats: number
   concurrencyLimit: number
@@ -276,19 +275,19 @@ function slugifyOrganizationName(name: string, organizationId: string): string {
   return `${base || 'organization'}-${organizationId.slice(-8)}`
 }
 
-/** Builds a commercial-terms key while preserving legacy keys when new terms are omitted. */
+/** Builds a deterministic key from every Enterprise commercial term. */
 export function buildEnterpriseProvisioningRequestKey(
   input: IssueEnterpriseProvisioningInput,
   organizationId: string
 ): string {
-  const includedMonthlyCredits = dollarsToCredits(input.monthlyInvoiceAmountUsd)
+  const usageLimitCredits =
+    input.usageLimitCredits ?? dollarsToCredits(input.monthlyInvoiceAmountUsd)
   const requestTerms: Array<string | number> = [
-    'enterprise-v2',
+    'enterprise-v3',
     input.ownerUserId,
     organizationId,
     Math.round(input.monthlyInvoiceAmountUsd * 100),
-    includedMonthlyCredits,
-    input.usageLimitCredits ?? includedMonthlyCredits,
+    usageLimitCredits,
     input.seats,
   ]
   if (input.concurrencyLimit !== undefined) requestTerms.push(input.concurrencyLimit)
@@ -308,7 +307,6 @@ function toEnterpriseProvisioningView(
     organizationId: request.organizationId,
     status: deriveEnterpriseOperationStatus(row.status, payload),
     monthlyInvoiceAmountUsd: request.invoiceAmountCents / 100,
-    includedMonthlyCredits: request.includedMonthlyCredits,
     usageLimitCredits: request.usageLimitCredits,
     seats: request.seats,
     concurrencyLimit: getBillingConcurrencyLimit('enterprise', request.concurrencyLimit),
@@ -423,7 +421,7 @@ export async function issueEnterpriseProvisioning(
       'Monthly invoice amount must be at least $0.01 and use whole cents'
     )
   }
-  const includedMonthlyCredits = dollarsToCredits(input.monthlyInvoiceAmountUsd)
+  const defaultUsageLimitCredits = dollarsToCredits(input.monthlyInvoiceAmountUsd)
   if (
     input.concurrencyLimit !== undefined &&
     parseBillingConcurrencyLimit(input.concurrencyLimit) !== input.concurrencyLimit
@@ -550,8 +548,7 @@ export async function issueEnterpriseProvisioning(
       requestedByEmail: input.requestedByEmail,
       requestedByUserId: input.requestedByUserId,
       invoiceAmountCents,
-      includedMonthlyCredits,
-      usageLimitCredits: input.usageLimitCredits ?? includedMonthlyCredits,
+      usageLimitCredits: input.usageLimitCredits ?? defaultUsageLimitCredits,
       seats: input.seats,
       ...(input.concurrencyLimit !== undefined ? { concurrencyLimit: input.concurrencyLimit } : {}),
       pausePaymentCollection: input.pausePaymentCollection ?? false,
@@ -580,7 +577,6 @@ export async function issueEnterpriseProvisioning(
       metadata: {
         organizationId: view.organizationId,
         invoiceAmountCents: Math.round(view.monthlyInvoiceAmountUsd * 100),
-        includedMonthlyCredits: view.includedMonthlyCredits,
         usageLimitCredits: view.usageLimitCredits,
         seats: view.seats,
         concurrencyLimit: view.concurrencyLimit,
@@ -826,7 +822,6 @@ export const provisionEnterpriseInStripe: OutboxHandler<unknown> = async (rawPay
     enterpriseOperationId: context.eventId,
     invoiceAmountCents: request.invoiceAmountCents.toString(),
     monthlyPrice: (request.invoiceAmountCents / 100).toFixed(2),
-    includedMonthlyCredits: request.includedMonthlyCredits.toString(),
     usageLimitCredits: request.usageLimitCredits.toString(),
     seats: request.seats.toString(),
     ...(request.concurrencyLimit !== undefined
diff --git a/apps/sim/lib/billing/organizations/lock-order.test.ts b/apps/sim/lib/billing/organizations/lock-order.test.ts
index f430ed9b040..f06493cdcab 100644
--- a/apps/sim/lib/billing/organizations/lock-order.test.ts
+++ b/apps/sim/lib/billing/organizations/lock-order.test.ts
@@ -310,13 +310,12 @@ describe('organization ownership transfer reservation', () => {
                   payload: {
                     version: 1,
                     request: {
-                      requestKey: 'enterprise-v2:owner-1:org-1:10000:20000:20000:5',
+                      requestKey: 'enterprise-v3:owner-1:org-1:10000:20000:5',
                       ownerUserId: 'owner-1',
                       organizationId: 'org-1',
                       requestedByEmail: 'admin@sim.ai',
                       requestedByUserId: 'admin-1',
                       invoiceAmountCents: 10000,
-                      includedMonthlyCredits: 20000,
                       usageLimitCredits: 20000,
                       seats: 5,
                     },
diff --git a/apps/sim/lib/billing/webhooks/enterprise.ts b/apps/sim/lib/billing/webhooks/enterprise.ts
index 3ee71a7b516..1c3689b944e 100644
--- a/apps/sim/lib/billing/webhooks/enterprise.ts
+++ b/apps/sim/lib/billing/webhooks/enterprise.ts
@@ -331,7 +331,6 @@ async function reconcileManualEnterpriseSubscription(
     operationNewlyApplied,
     hasCorrelatedOperation,
     subscriptionNewlyInserted,
-    includedMonthlyCredits,
     configuredUsageLimitCredits,
     prepaidCredits,
     effectiveUsageLimitCredits,
@@ -344,7 +343,6 @@ async function reconcileManualEnterpriseSubscription(
     plan: subscriptionRow.plan,
     status: subscriptionRow.status,
     monthlyPrice,
-    includedMonthlyCredits,
     effectiveUsageLimitCredits,
     prepaidCredits,
     seats,
@@ -391,7 +389,6 @@ async function reconcileManualEnterpriseSubscription(
         stripeSubscriptionId: stripeSubscription.id,
         seats,
         monthlyPrice,
-        includedMonthlyCredits,
         configuredUsageLimitCredits,
         effectiveUsageLimitCredits,
         prepaidCredits,
diff --git a/apps/sim/lib/cleanup/chat-cleanup.ts b/apps/sim/lib/cleanup/chat-cleanup.ts
index c5dafdf9c27..55f6a96832c 100644
--- a/apps/sim/lib/cleanup/chat-cleanup.ts
+++ b/apps/sim/lib/cleanup/chat-cleanup.ts
@@ -1,5 +1,5 @@
 import { db } from '@sim/db'
-import { copilotMessages, workspaceFiles } from '@sim/db/schema'
+import { copilotChats, copilotMessages, workspaceFiles } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { and, inArray, isNull } from 'drizzle-orm'
 import { chunkArray } from '@/lib/cleanup/batch-delete'
@@ -26,6 +26,7 @@ type ChatScopedContext = (typeof CHAT_SCOPED_CONTEXTS)[number]
 interface FileRef {
   key: string
   context: ChatScopedContext
+  chatId: string
 }
 
 /**
@@ -42,7 +43,11 @@ export async function collectChatFiles(chatIds: string[]): Promise<FileRef[]> {
   for (const chunk of chunkArray(chatIds, CHAT_FILE_COLLECT_CHUNK_SIZE)) {
     const [linkedFiles, messageRows] = await Promise.all([
       db
-        .select({ key: workspaceFiles.key, context: workspaceFiles.context })
+        .select({
+          key: workspaceFiles.key,
+          context: workspaceFiles.context,
+          chatId: workspaceFiles.chatId,
+        })
         .from(workspaceFiles)
         .where(
           and(
@@ -54,15 +59,15 @@ export async function collectChatFiles(chatIds: string[]): Promise<FileRef[]> {
       // Scan every message row for the chat (no deleted_at filter): this is a
       // deletion path collecting blob keys, so attachments on any row count.
       db
-        .select({ content: copilotMessages.content })
+        .select({ content: copilotMessages.content, chatId: copilotMessages.chatId })
         .from(copilotMessages)
         .where(inArray(copilotMessages.chatId, chunk)),
     ])
 
     for (const f of linkedFiles) {
-      if (!seen.has(f.key)) {
+      if (f.chatId && !seen.has(f.key)) {
         seen.add(f.key)
-        files.push({ key: f.key, context: f.context as ChatScopedContext })
+        files.push({ key: f.key, context: f.context as ChatScopedContext, chatId: f.chatId })
       }
     }
 
@@ -80,7 +85,7 @@ export async function collectChatFiles(chatIds: string[]): Promise<FileRef[]> {
           const key = (attachment as Record<string, unknown>).key as string
           if (!seen.has(key)) {
             seen.add(key)
-            files.push({ key, context: 'copilot' })
+            files.push({ key, context: 'copilot', chatId: row.chatId })
           }
         }
       }
@@ -195,17 +200,36 @@ export async function prepareChatCleanup(
 
   return {
     execute: async () => {
+      // A chat can be restored (or its delete can fail) between selection and
+      // the caller's row delete. Purge backend data and files only for chats
+      // whose rows are actually gone, so a surviving row never loses its data.
+      const survivors = new Set<string>()
+      for (const chunk of chunkArray(chatIds, CHAT_FILE_COLLECT_CHUNK_SIZE)) {
+        const rows = await db
+          .select({ id: copilotChats.id })
+          .from(copilotChats)
+          .where(inArray(copilotChats.id, chunk))
+        for (const row of rows) survivors.add(row.id)
+      }
+      if (survivors.size > 0) {
+        logger.info(
+          `[${label}] Skipping external cleanup for ${survivors.size} chats whose rows still exist`
+        )
+      }
+      const confirmedChatIds = chatIds.filter((id) => !survivors.has(id))
+      const confirmedFiles = files.filter((file) => !survivors.has(file.chatId))
+
       // Call copilot backend
-      if (chatIds.length > 0) {
-        const copilotResult = await cleanupCopilotBackend(chatIds, label)
+      if (confirmedChatIds.length > 0) {
+        const copilotResult = await cleanupCopilotBackend(confirmedChatIds, label)
         logger.info(
           `[${label}] Copilot backend: ${copilotResult.deleted} deleted, ${copilotResult.failed} failed`
         )
       }
 
       // Delete storage files with correct context per file
-      if (files.length > 0) {
-        const fileStats = await deleteStorageFiles(files, label)
+      if (confirmedFiles.length > 0) {
+        const fileStats = await deleteStorageFiles(confirmedFiles, label)
         logger.info(
           `[${label}] Storage cleanup: ${fileStats.filesDeleted} deleted, ${fileStats.filesFailed} failed`
         )
diff --git a/apps/sim/lib/copilot/chat/lifecycle.ts b/apps/sim/lib/copilot/chat/lifecycle.ts
index 7530f3c5ed7..f6584f731d5 100644
--- a/apps/sim/lib/copilot/chat/lifecycle.ts
+++ b/apps/sim/lib/copilot/chat/lifecycle.ts
@@ -88,6 +88,18 @@ export async function loadCopilotChatMessages(chatId: string): Promise<Persisted
   return rows.map((row) => stripToolResultOutput(row.content as PersistedMessage))
 }
 
+/**
+ * Ownership + liveness predicate shared by the accessible-chat loaders:
+ * the chat must belong to the user and not be soft-deleted.
+ */
+function ownedLiveChatWhere(chatId: string, userId: string) {
+  return and(
+    eq(copilotChats.id, chatId),
+    eq(copilotChats.userId, userId),
+    isNull(copilotChats.deletedAt)
+  )
+}
+
 type CopilotChatAuthRow = Pick<
   typeof copilotChats.$inferSelect,
   'id' | 'userId' | 'workflowId' | 'workspaceId' | 'type'
@@ -165,7 +177,7 @@ export async function getAccessibleCopilotChatAuth(
   const [chat] = await db
     .select(copilotChatAuthColumns)
     .from(copilotChats)
-    .where(and(eq(copilotChats.id, chatId), eq(copilotChats.userId, userId)))
+    .where(ownedLiveChatWhere(chatId, userId))
     .limit(1)
 
   return authorizeCopilotChatRow(chat, chatId, userId)
@@ -183,7 +195,7 @@ export async function getAccessibleCopilotChat(
   const [chat] = await db
     .select(copilotChatLegacyDetailColumns)
     .from(copilotChats)
-    .where(and(eq(copilotChats.id, chatId), eq(copilotChats.userId, userId)))
+    .where(ownedLiveChatWhere(chatId, userId))
     .limit(1)
 
   const authorized = await authorizeCopilotChatRow(chat, chatId, userId)
@@ -208,7 +220,7 @@ export async function getAccessibleCopilotChatWithMessages(
   const [chat] = await db
     .select(copilotChatDetailColumns)
     .from(copilotChats)
-    .where(and(eq(copilotChats.id, chatId), eq(copilotChats.userId, userId)))
+    .where(ownedLiveChatWhere(chatId, userId))
     .limit(1)
 
   const authorized = await authorizeCopilotChatRow(chat, chatId, userId)
diff --git a/apps/sim/lib/copilot/chat/list-mothership-chats.ts b/apps/sim/lib/copilot/chat/list-mothership-chats.ts
index 73839785a75..951ac24aaee 100644
--- a/apps/sim/lib/copilot/chat/list-mothership-chats.ts
+++ b/apps/sim/lib/copilot/chat/list-mothership-chats.ts
@@ -1,7 +1,7 @@
 import { db } from '@sim/db'
 import { copilotChats } from '@sim/db/schema'
-import { and, desc, eq } from 'drizzle-orm'
-import type { MothershipChat } from '@/lib/api/contracts/mothership-chats'
+import { and, desc, eq, isNotNull, isNull } from 'drizzle-orm'
+import type { MothershipChat, MothershipChatScope } from '@/lib/api/contracts/mothership-chats'
 import { reconcileChatStreamMarkers } from '@/lib/copilot/chat/stream-liveness'
 
 /**
@@ -10,10 +10,15 @@ import { reconcileChatStreamMarkers } from '@/lib/copilot/chat/stream-liveness'
  * sidebar prefetch. Performs no auth or workspace-access checks — callers
  * enforce access before invoking. Reconciles stale live-stream markers and
  * normalizes timestamps to ISO strings to honor the wire contract.
+ *
+ * `scope` selects between live chats (`active`, the default) and soft-deleted
+ * chats (`archived`, surfaced in Recently Deleted). Archived chats skip
+ * stream-marker reconciliation — a deleted chat has no live stream to repair.
  */
 export async function listMothershipChats(
   userId: string,
-  workspaceId: string
+  workspaceId: string,
+  scope: MothershipChatScope = 'active'
 ): Promise<MothershipChat[]> {
   const chats = await db
     .select({
@@ -23,28 +28,34 @@ export async function listMothershipChats(
       activeStreamId: copilotChats.conversationId,
       lastSeenAt: copilotChats.lastSeenAt,
       pinned: copilotChats.pinned,
+      deletedAt: copilotChats.deletedAt,
     })
     .from(copilotChats)
     .where(
       and(
         eq(copilotChats.userId, userId),
         eq(copilotChats.workspaceId, workspaceId),
-        eq(copilotChats.type, 'mothership')
+        eq(copilotChats.type, 'mothership'),
+        scope === 'archived' ? isNotNull(copilotChats.deletedAt) : isNull(copilotChats.deletedAt)
       )
     )
     .orderBy(desc(copilotChats.pinned), desc(copilotChats.updatedAt))
 
-  const streamMarkers = await reconcileChatStreamMarkers(
-    chats.map((c) => ({ chatId: c.id, streamId: c.activeStreamId })),
-    { repairVerifiedStaleMarkers: true }
-  )
+  const streamMarkers =
+    scope === 'archived'
+      ? null
+      : await reconcileChatStreamMarkers(
+          chats.map((c) => ({ chatId: c.id, streamId: c.activeStreamId })),
+          { repairVerifiedStaleMarkers: true }
+        )
 
   return chats.map((c) => ({
     id: c.id,
     title: c.title,
     updatedAt: c.updatedAt.toISOString(),
-    activeStreamId: streamMarkers.get(c.id)?.streamId ?? null,
+    activeStreamId: streamMarkers?.get(c.id)?.streamId ?? null,
     lastSeenAt: c.lastSeenAt ? c.lastSeenAt.toISOString() : null,
     pinned: c.pinned,
+    deletedAt: c.deletedAt ? c.deletedAt.toISOString() : null,
   }))
 }
diff --git a/apps/sim/lib/copilot/tools/handlers/deployment/deploy.ts b/apps/sim/lib/copilot/tools/handlers/deployment/deploy.ts
index 02d4a83c70b..20282e78f4d 100644
--- a/apps/sim/lib/copilot/tools/handlers/deployment/deploy.ts
+++ b/apps/sim/lib/copilot/tools/handlers/deployment/deploy.ts
@@ -22,6 +22,10 @@ import {
   performFullUndeploy,
 } from '@/lib/workflows/orchestration'
 import { checkChatAccess, checkWorkflowAccessForChatCreation } from '@/app/api/chat/utils'
+import {
+  ChatDeployAuthNotAllowedError,
+  validateChatDeployAuth,
+} from '@/ee/access-control/utils/permission-check'
 import { ensureWorkflowAccess } from '../access'
 import type { DeployApiParams, DeployChatParams, DeployMcpParams } from '../param-types'
 
@@ -400,6 +404,20 @@ export async function executeDeployChat(
       params.customizations?.iconUrl ||
       existingCustomizations.imageUrl
 
+    // Enforce the permission group's chat auth-mode allow-list, but only when the
+    // mode actually changes (or on a first deploy) so an existing grandfathered
+    // mode can be re-saved.
+    if (workflowRecord.workspaceId && resolvedAuthType !== existingDeployment?.authType) {
+      try {
+        await validateChatDeployAuth(context.userId, workflowRecord.workspaceId, resolvedAuthType)
+      } catch (error) {
+        if (error instanceof ChatDeployAuthNotAllowedError) {
+          return { success: false, error: error.message }
+        }
+        throw error
+      }
+    }
+
     const result = await performChatDeploy({
       workflowId,
       userId: context.userId,
diff --git a/apps/sim/lib/copilot/tools/server/blocks/get-blocks-metadata-tool.ts b/apps/sim/lib/copilot/tools/server/blocks/get-blocks-metadata-tool.ts
index 7828f89ec98..6dbb214de80 100644
--- a/apps/sim/lib/copilot/tools/server/blocks/get-blocks-metadata-tool.ts
+++ b/apps/sim/lib/copilot/tools/server/blocks/get-blocks-metadata-tool.ts
@@ -782,6 +782,9 @@ function getStaticModelOptions(): { id: string; label?: string }[] {
     }
     if (provider?.models) {
       for (const model of provider.models) {
+        // Exclude retired models — the agent must not receive a model whose API
+        // calls fail (mirrors the user picker + VFS menu).
+        if (model.sunset?.status === 'deprecated') continue
         models.push({ id: model.id, label: model.id })
       }
     }
diff --git a/apps/sim/lib/copilot/tools/server/workflow/edit-workflow/builders.test.ts b/apps/sim/lib/copilot/tools/server/workflow/edit-workflow/builders.test.ts
index 77fa6ae5323..e49d0279423 100644
--- a/apps/sim/lib/copilot/tools/server/workflow/edit-workflow/builders.test.ts
+++ b/apps/sim/lib/copilot/tools/server/workflow/edit-workflow/builders.test.ts
@@ -3,6 +3,7 @@
  */
 import { describe, expect, it, vi } from 'vitest'
 import {
+  applyTriggerConfigToBlockSubblocks,
   createBlockFromParams,
   normalizeSubblockValue,
 } from '@/lib/copilot/tools/server/workflow/edit-workflow/builders'
@@ -33,14 +34,27 @@ const knowledgeBlockConfig = {
   ],
 }
 
+const slackBlockConfig = {
+  type: 'slack',
+  name: 'Slack',
+  outputs: {},
+  subBlocks: [{ id: 'channel', type: 'channel-selector' }],
+}
+
 const blocksByType: Record<string, unknown> = {
   agent: agentBlockConfig,
   condition: conditionBlockConfig,
   knowledge: knowledgeBlockConfig,
+  slack: slackBlockConfig,
 }
 
 vi.mock('@/blocks/registry', () => ({
-  getAllBlocks: () => [agentBlockConfig, conditionBlockConfig, knowledgeBlockConfig],
+  getAllBlocks: () => [
+    agentBlockConfig,
+    conditionBlockConfig,
+    knowledgeBlockConfig,
+    slackBlockConfig,
+  ],
   getBlock: (type: string) => blocksByType[type],
 }))
 
@@ -168,3 +182,40 @@ describe('normalizeSubblockValue', () => {
     expect(JSON.parse(result as string)[0].id).not.toBe('filter-1')
   })
 })
+
+describe('applyTriggerConfigToBlockSubblocks', () => {
+  it('uses the registry type for declared keys and short-input only for undeclared keys', () => {
+    const block = { id: 'b1', type: 'slack', subBlocks: {} as Record<string, unknown> }
+
+    applyTriggerConfigToBlockSubblocks(block, { channel: 'C123', customField: 'x' })
+
+    expect(block.subBlocks.channel).toEqual({
+      id: 'channel',
+      type: 'channel-selector',
+      value: 'C123',
+    })
+    expect(block.subBlocks.customField).toEqual({
+      id: 'customField',
+      type: 'short-input',
+      value: 'x',
+    })
+  })
+
+  it('keeps the existing entry metadata when the key already exists', () => {
+    const block = {
+      id: 'b1',
+      type: 'slack',
+      subBlocks: {
+        channel: { id: 'channel', type: 'channel-selector', value: 'C-old' },
+      } as Record<string, { id: string; type: string; value: unknown }>,
+    }
+
+    applyTriggerConfigToBlockSubblocks(block, { channel: 'C-new' })
+
+    expect(block.subBlocks.channel).toEqual({
+      id: 'channel',
+      type: 'channel-selector',
+      value: 'C-new',
+    })
+  })
+})
diff --git a/apps/sim/lib/copilot/tools/server/workflow/edit-workflow/builders.ts b/apps/sim/lib/copilot/tools/server/workflow/edit-workflow/builders.ts
index 286dc576b1d..f669a7719d5 100644
--- a/apps/sim/lib/copilot/tools/server/workflow/edit-workflow/builders.ts
+++ b/apps/sim/lib/copilot/tools/server/workflow/edit-workflow/builders.ts
@@ -9,7 +9,7 @@ import {
   isCanonicalPair,
 } from '@/lib/workflows/subblocks/visibility'
 import { hasTriggerCapability } from '@/lib/workflows/triggers/trigger-utils'
-import { getAllBlocks } from '@/blocks/registry'
+import { getAllBlocks, getBlock } from '@/blocks/registry'
 import type { BlockConfig } from '@/blocks/types'
 import { TRIGGER_RUNTIME_SUBBLOCK_IDS } from '@/triggers/constants'
 import type { EditWorkflowOperation, SkippedItem, ValidationError } from './types'
@@ -624,9 +624,14 @@ export function applyTriggerConfigToBlockSubblocks(block: any, triggerConfig: Re
         value: configValue,
       }
     } else {
+      // The registry type is authoritative for declared keys; `short-input` is
+      // only the keep-alive default for dynamic trigger-config keys the block
+      // config does not declare (an `unknown` type would be dropped on the next
+      // sanitize pass, losing the value).
+      const subBlockDef = getBlock(block.type)?.subBlocks.find((sb) => sb.id === configKey)
       block.subBlocks[configKey] = {
         id: configKey,
-        type: 'short-input',
+        type: subBlockDef?.type || 'short-input',
         value: configValue,
       }
     }
diff --git a/apps/sim/lib/copilot/vfs/serializers.ts b/apps/sim/lib/copilot/vfs/serializers.ts
index 6e3ff25277c..2750383005e 100644
--- a/apps/sim/lib/copilot/vfs/serializers.ts
+++ b/apps/sim/lib/copilot/vfs/serializers.ts
@@ -453,6 +453,9 @@ function getStaticModelOptionsForVFS(): StaticModelOption[] {
   for (const [providerId, def] of Object.entries(PROVIDER_DEFINITIONS)) {
     if (dynamicProviders.has(providerId)) continue
     for (const model of def.models) {
+      // Retired models are hidden from the agent's menu (mirrors the user picker)
+      // so it never suggests a model whose API calls fail; legacy stays available.
+      if (model.sunset?.status === 'deprecated') continue
       const option: StaticModelOption = {
         id: model.id,
         provider: providerId,
@@ -460,7 +463,7 @@ function getStaticModelOptionsForVFS(): StaticModelOption[] {
       }
       if (model.recommended) option.recommended = true
       if (model.speedOptimized) option.speedOptimized = true
-      if (model.deprecated) option.deprecated = true
+      if (model.sunset) option.deprecated = true
       models.push(option)
     }
   }
diff --git a/apps/sim/lib/copilot/vfs/workspace-vfs.ts b/apps/sim/lib/copilot/vfs/workspace-vfs.ts
index fb8e7550199..1a6096870c4 100644
--- a/apps/sim/lib/copilot/vfs/workspace-vfs.ts
+++ b/apps/sim/lib/copilot/vfs/workspace-vfs.ts
@@ -2230,7 +2230,8 @@ export class WorkspaceVFS {
           and(
             eq(copilotChats.workspaceId, workspaceId),
             eq(copilotChats.userId, userId),
-            eq(copilotChats.type, 'mothership')
+            eq(copilotChats.type, 'mothership'),
+            isNull(copilotChats.deletedAt)
           )
         )
         .orderBy(desc(copilotChats.updatedAt))
diff --git a/apps/sim/lib/core/security/csp.ts b/apps/sim/lib/core/security/csp.ts
index 25e848a0d5f..2e55e81da08 100644
--- a/apps/sim/lib/core/security/csp.ts
+++ b/apps/sim/lib/core/security/csp.ts
@@ -66,6 +66,9 @@ const STATIC_SCRIPT_SRC = [
         'https://*.hs-analytics.net',
         'https://*.hscollectedforms.net',
         'https://*.hs-banner.com',
+        // X (Twitter) conversion pixel (landing pages) — the base code injects
+        // uwt.js as a <script> tag from static.ads-twitter.com
+        'https://static.ads-twitter.com',
       ]
     : []),
 ] as const
@@ -106,6 +109,10 @@ const STATIC_CONNECT_SRC = [
         // The visitor beacon itself is an image pixel (img-src, already
         // permitted below), not a connect-src request.
         'https://*.hscollectedforms.net',
+        // X (Twitter) conversion pixel — uwt.js sends conversion beacons here
+        // via fetch/sendBeacon. The t.co image-pixel fallback is already
+        // covered by the `https:` wildcard in img-src.
+        'https://analytics.twitter.com',
       ]
     : []),
 ] as const
diff --git a/apps/sim/lib/core/security/input-validation.server.ts b/apps/sim/lib/core/security/input-validation.server.ts
index cfef31a08d2..09e758fa008 100644
--- a/apps/sim/lib/core/security/input-validation.server.ts
+++ b/apps/sim/lib/core/security/input-validation.server.ts
@@ -105,7 +105,11 @@ export async function validateUrlWithDNS(
   }
 
   try {
-    const { address } = await dns.lookup(cleanHostname, { verbatim: true })
+    // Prefer IPv4: pinning strips Happy Eyeballs' fallback, and a pinned IPv6 address hangs
+    // on IPv4-only egress (e.g. AWS NAT gateways) — still-pinned consumers (providers, SSO,
+    // A2A) depend on this ordering.
+    const resolved = await dns.lookup(cleanHostname, { all: true, verbatim: true })
+    const { address } = resolved.find((entry) => entry.family === 4) ?? resolved[0]
 
     const resolvedIsLoopback =
       ipaddr.isValid(address) &&
@@ -188,7 +192,10 @@ export async function validateDatabaseHost(
   }
 
   try {
-    const { address } = await dns.lookup(cleanHost, { verbatim: true })
+    // Prefer IPv4: pinning strips Happy Eyeballs' fallback, and a pinned IPv6 address hangs
+    // on IPv4-only egress (e.g. AWS NAT gateways).
+    const resolved = await dns.lookup(cleanHost, { all: true, verbatim: true })
+    const { address } = resolved.find((entry) => entry.family === 4) ?? resolved[0]
 
     if (isPrivateOrReservedIP(address) && !isPrivateDatabaseHostsAllowed) {
       logger.warn('Database host resolves to blocked IP address', {
@@ -416,6 +423,176 @@ export function createPinnedLookup(resolvedIP: string): LookupFunction {
   }
 }
 
+/**
+ * DNS lookup that resolves normally and validates EVERY resolved address against
+ * the SSRF policy at socket-connect time (the LibreChat `getSSRFConnect` pattern).
+ * Private/reserved/loopback records are filtered out; if nothing publicly routable
+ * remains the connect fails. Because the check runs on each dial — including
+ * redirects and reconnects — there is no validated-then-trusted window for a DNS
+ * rebind to slip through, and unlike single-IP pinning the connector keeps the
+ * full public address set, so the OS/undici can fall back across addresses.
+ * IPv4 is ordered first (`verbatim: false`) — our egress is IPv4-only.
+ */
+export function createSsrfGuardedLookup(): LookupFunction {
+  return (hostname, options, callback) => {
+    dns
+      .lookup(hostname, { all: true, verbatim: false })
+      .then((addresses) => {
+        const usable = addresses.filter((entry) => !isPrivateOrReservedIP(entry.address))
+        if (usable.length === 0) {
+          callback(
+            new Error(`Blocked by SSRF policy: ${hostname} has no publicly routable address`),
+            '',
+            4
+          )
+          return
+        }
+        if (options.all) callback(null, usable)
+        else callback(null, usable[0].address, usable[0].family)
+      })
+      .catch((error) => callback(toError(error), '', 4))
+  }
+}
+
+const MAX_GUARDED_REDIRECTS = 5
+
+/**
+ * Rejects a redirect hop whose target is a private/reserved IP LITERAL. Node's
+ * `net.connect` bypasses the custom `lookup` for numeric hosts (`isIP(host)`
+ * short-circuits), so the connect-time guard never sees IP-literal dials —
+ * a 3xx to `http://169.254.169.254/` would otherwise connect directly. Hostname
+ * targets are covered by {@link createSsrfGuardedLookup} at connect time.
+ */
+function assertGuardedRedirectTarget(url: URL): void {
+  if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+    throw new Error(`Blocked by SSRF policy: redirect to unsupported protocol ${url.protocol}`)
+  }
+  const host =
+    url.hostname.startsWith('[') && url.hostname.endsWith(']')
+      ? url.hostname.slice(1, -1)
+      : url.hostname
+  if (ipaddr.isValid(host) && isPrivateOrReservedIP(host)) {
+    throw new Error('Blocked by SSRF policy: redirect to a private or reserved address')
+  }
+}
+
+/**
+ * Manual, revalidating redirect follower used by the guarded fetch. Auto-follow
+ * is unsafe here on two counts the connect-time lookup cannot cover: IP-literal
+ * redirect targets bypass the lookup entirely (validated per hop instead), and
+ * undici retains CUSTOM request headers across cross-origin redirects (it strips
+ * only Authorization/Cookie) — so caller headers are dropped on any cross-origin
+ * hop. Exported for tests.
+ */
+export async function followRedirectsGuarded(
+  rawFetch: (url: string, init: UndiciRequestInit) => Promise<Response>,
+  input: string,
+  init: UndiciRequestInit
+): Promise<Response> {
+  let currentUrl = new URL(input)
+  // The initial URL gets the same IP-literal check as redirect hops, so the exported
+  // guard is self-contained even when a caller skips its own up-front validation.
+  assertGuardedRedirectTarget(currentUrl)
+  let method = (init.method ?? 'GET').toUpperCase()
+  let body = init.body
+  let headers = init.headers
+  for (let hop = 0; ; hop++) {
+    const response = await rawFetch(currentUrl.href, {
+      ...init,
+      method,
+      body,
+      headers,
+      redirect: 'manual',
+    })
+    const status = response.status
+    const location = response.headers.get('location')
+    if (![301, 302, 303, 307, 308].includes(status) || !location) return response
+    // Cancel the redirect body up front so the throw paths below (hop cap, blocked
+    // target) can't leave a socket checked out on the long-lived Agent.
+    await response.body?.cancel().catch(() => {})
+    if (hop >= MAX_GUARDED_REDIRECTS) {
+      throw new Error(`Blocked by SSRF policy: more than ${MAX_GUARDED_REDIRECTS} redirects`)
+    }
+    const nextUrl = new URL(location, currentUrl)
+    assertGuardedRedirectTarget(nextUrl)
+    // Per the fetch spec: 303 (and 301/302 on POST) switch to a bodyless GET, dropping
+    // the entity headers that described the removed body (a retained Content-Length /
+    // Content-Type on a bodyless GET is malformed and undici rejects it).
+    if (status === 303 || ((status === 301 || status === 302) && method === 'POST')) {
+      method = 'GET'
+      body = undefined
+      if (headers !== undefined) {
+        const sanitized = new Headers(headers as HeadersInit)
+        sanitized.delete('content-length')
+        sanitized.delete('content-type')
+        sanitized.delete('content-encoding')
+        sanitized.delete('transfer-encoding')
+        // double-cast-allowed: Headers is a valid undici HeadersInit at runtime but the DOM/undici types differ
+        headers = sanitized as unknown as UndiciRequestInit['headers']
+      }
+    }
+    if (nextUrl.origin !== currentUrl.origin) {
+      headers = undefined
+      // 307/308 preserve method+body; forwarding a body cross-origin can hand OAuth
+      // client secrets / tokens to an open-redirect target now that redirects really
+      // dial the new origin. No legitimate MCP/OAuth flow does this — refuse it.
+      if (body !== undefined && body !== null) {
+        throw new Error(
+          'Blocked by SSRF policy: cross-origin redirect would forward a request body'
+        )
+      }
+    }
+    currentUrl = nextUrl
+  }
+}
+
+/**
+ * SSRF-guarded `fetch` + its `Agent` for outbound requests to user-controlled
+ * hosts: DNS resolves normally, and every socket connect validates the chosen
+ * addresses via {@link createSsrfGuardedLookup}; redirects are followed manually
+ * with per-hop validation (see {@link followRedirectsGuarded}) so IP-literal
+ * targets can't bypass the lookup and custom headers never cross origins. See
+ * {@link createPinnedFetchWithDispatcher} for the `maxResponseSize` semantics.
+ */
+export function createSsrfGuardedFetchWithDispatcher(options?: { maxResponseSize?: number }): {
+  fetch: typeof fetch
+  dispatcher: Agent
+} {
+  const dispatcher = new Agent({
+    allowH2: false,
+    connect: { lookup: createSsrfGuardedLookup() },
+    ...(options?.maxResponseSize !== undefined ? { maxResponseSize: options.maxResponseSize } : {}),
+  })
+
+  const rawFetch = async (url: string, init: UndiciRequestInit): Promise<Response> => {
+    const response = await undiciFetch(url, { ...init, dispatcher })
+    // double-cast-allowed: undici Response and DOM Response are structurally compatible at runtime
+    return response as unknown as Response
+  }
+
+  const guarded = async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
+    const target = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url
+    // A Request input carries its own method/headers/body/signal; lift them into the
+    // init (explicit init fields win, per fetch semantics) so the manual redirect
+    // follower doesn't silently downgrade a guarded POST Request to a bare GET.
+    let effectiveInit: RequestInit = init ?? {}
+    if (typeof Request !== 'undefined' && input instanceof Request) {
+      const bodyAllowed = input.method !== 'GET' && input.method !== 'HEAD'
+      effectiveInit = {
+        method: input.method,
+        headers: input.headers,
+        body: bodyAllowed ? await input.clone().arrayBuffer() : undefined,
+        signal: input.signal,
+        ...init,
+      }
+    }
+    // double-cast-allowed: DOM RequestInit and undici RequestInit are structurally compatible at runtime but the TS types differ
+    return followRedirectsGuarded(rawFetch, target, effectiveInit as unknown as UndiciRequestInit)
+  }
+
+  return { fetch: guarded, dispatcher }
+}
+
 /**
  * Builds a standard `fetch`-compatible function that pins every outbound
  * connection to `resolvedIP`, preventing DNS-rebinding (TOCTOU) between URL
diff --git a/apps/sim/lib/core/security/ssrf-guarded-lookup.test.ts b/apps/sim/lib/core/security/ssrf-guarded-lookup.test.ts
new file mode 100644
index 00000000000..b504017c435
--- /dev/null
+++ b/apps/sim/lib/core/security/ssrf-guarded-lookup.test.ts
@@ -0,0 +1,232 @@
+/**
+ * @vitest-environment node
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockDnsLookup } = vi.hoisted(() => ({ mockDnsLookup: vi.fn() }))
+
+vi.mock('dns/promises', () => ({ default: { lookup: mockDnsLookup } }))
+
+import { createSsrfGuardedLookup } from '@/lib/core/security/input-validation.server'
+
+type LookupResult = { address: string; family: number }
+
+function runLookup(
+  hostname: string,
+  options: { all?: boolean } = {}
+): Promise<{ err: Error | null; address?: string | LookupResult[]; family?: number }> {
+  return new Promise((resolve) => {
+    const lookup = createSsrfGuardedLookup()
+    type LookupCb = (err: Error | null, address?: string | LookupResult[], family?: number) => void
+    // double-cast-allowed: net.LookupFunction's overloaded callback shapes collapse to this in practice
+    ;(lookup as unknown as (h: string, o: object, cb: LookupCb) => void)(
+      hostname,
+      options,
+      (err: Error | null, address?: string | LookupResult[], family?: number) =>
+        resolve({ err, address, family })
+    )
+  })
+}
+
+describe('createSsrfGuardedLookup', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('passes through a public address', async () => {
+    mockDnsLookup.mockResolvedValue([{ address: '93.184.216.34', family: 4 }])
+    const r = await runLookup('example.com')
+    expect(r.err).toBeNull()
+    expect(r.address).toBe('93.184.216.34')
+    expect(r.family).toBe(4)
+  })
+
+  it.each([
+    ['loopback', '127.0.0.1'],
+    ['RFC1918 10.x', '10.0.0.5'],
+    ['RFC1918 192.168.x', '192.168.1.1'],
+    ['link-local metadata', '169.254.169.254'],
+    ['IPv6 loopback', '::1'],
+    ['IPv4-mapped private', '::ffff:10.0.0.1'],
+  ])('fails the connect when the host resolves only to %s', async (_label, ip) => {
+    mockDnsLookup.mockResolvedValue([{ address: ip, family: ip.includes(':') ? 6 : 4 }])
+    const r = await runLookup('rebind.attacker.example')
+    expect(r.err?.message).toMatch(/Blocked by SSRF policy/)
+  })
+
+  it('filters private records out of a mixed answer and connects only to public ones', async () => {
+    // A rebinding server can interleave private records with public ones; only the
+    // public set may ever reach the socket.
+    mockDnsLookup.mockResolvedValue([
+      { address: '10.1.2.3', family: 4 },
+      { address: '93.184.216.34', family: 4 },
+      { address: '169.254.169.254', family: 4 },
+    ])
+    const r = await runLookup('mixed.example', { all: true })
+    expect(r.err).toBeNull()
+    expect(r.address).toEqual([{ address: '93.184.216.34', family: 4 }])
+  })
+
+  it('re-validates on every call (no validated-then-trusted window)', async () => {
+    // First resolution is public; the rebind flips to private — the second connect fails.
+    mockDnsLookup.mockResolvedValueOnce([{ address: '93.184.216.34', family: 4 }])
+    mockDnsLookup.mockResolvedValueOnce([{ address: '169.254.169.254', family: 4 }])
+
+    const first = await runLookup('rebind.example')
+    const second = await runLookup('rebind.example')
+
+    expect(first.err).toBeNull()
+    expect(second.err?.message).toMatch(/Blocked by SSRF policy/)
+  })
+
+  it('propagates DNS resolution failures', async () => {
+    mockDnsLookup.mockRejectedValue(new Error('ENOTFOUND'))
+    const r = await runLookup('nope.invalid')
+    expect(r.err?.message).toBe('ENOTFOUND')
+  })
+
+  it('returns the full public set for options.all (fallback across addresses)', async () => {
+    mockDnsLookup.mockResolvedValue([
+      { address: '104.21.22.105', family: 4 },
+      { address: '172.67.204.95', family: 4 },
+    ])
+    const r = await runLookup('multi.example', { all: true })
+    expect(r.err).toBeNull()
+    expect(r.address).toHaveLength(2)
+  })
+})
+
+import { followRedirectsGuarded } from '@/lib/core/security/input-validation.server'
+
+function redirectTo(location: string, status = 302): Response {
+  return new Response(null, { status, headers: { location } })
+}
+
+describe('followRedirectsGuarded', () => {
+  it('returns a non-redirect response as-is', async () => {
+    const raw = vi.fn(async () => new Response('ok', { status: 200 }))
+    const res = await followRedirectsGuarded(raw, 'https://a.example/x', {})
+    expect(res.status).toBe(200)
+    expect(raw).toHaveBeenCalledTimes(1)
+  })
+
+  it('follows a same-origin redirect and keeps the caller headers', async () => {
+    const raw = vi
+      .fn()
+      .mockResolvedValueOnce(redirectTo('https://a.example/y'))
+      .mockResolvedValueOnce(new Response('ok', { status: 200 }))
+    const res = await followRedirectsGuarded(raw, 'https://a.example/x', {
+      headers: { 'x-api-key': 'secret' },
+    })
+    expect(res.status).toBe(200)
+    expect(raw.mock.calls[1][0]).toBe('https://a.example/y')
+    expect(raw.mock.calls[1][1].headers).toEqual({ 'x-api-key': 'secret' })
+  })
+
+  it('drops custom headers on a cross-origin redirect', async () => {
+    const raw = vi
+      .fn()
+      .mockResolvedValueOnce(redirectTo('https://b.example/harvest'))
+      .mockResolvedValueOnce(new Response('ok', { status: 200 }))
+    await followRedirectsGuarded(raw, 'https://a.example/x', {
+      headers: { 'x-api-key': 'secret' },
+    })
+    expect(raw.mock.calls[1][1].headers).toBeUndefined()
+  })
+
+  it('blocks a redirect to a private IP literal (metadata endpoint)', async () => {
+    const raw = vi.fn(async () => redirectTo('http://169.254.169.254/latest/meta-data/'))
+    await expect(followRedirectsGuarded(raw, 'https://a.example/x', {})).rejects.toThrow(
+      /Blocked by SSRF policy/
+    )
+    expect(raw).toHaveBeenCalledTimes(1)
+  })
+
+  it('blocks a redirect to a bracketed private IPv6 literal', async () => {
+    const raw = vi.fn(async () => redirectTo('http://[::1]/admin'))
+    await expect(followRedirectsGuarded(raw, 'https://a.example/x', {})).rejects.toThrow(
+      /Blocked by SSRF policy/
+    )
+  })
+
+  it('blocks non-http(s) redirect protocols', async () => {
+    const raw = vi.fn(async () => redirectTo('file:///etc/passwd'))
+    await expect(followRedirectsGuarded(raw, 'https://a.example/x', {})).rejects.toThrow(
+      /unsupported protocol/
+    )
+  })
+
+  it('caps the number of hops', async () => {
+    const raw = vi.fn(async () => redirectTo('https://a.example/loop'))
+    await expect(followRedirectsGuarded(raw, 'https://a.example/x', {})).rejects.toThrow(
+      /more than \d+ redirects/
+    )
+  })
+
+  it('switches POST to a bodyless GET on 303', async () => {
+    const raw = vi
+      .fn()
+      .mockResolvedValueOnce(redirectTo('https://a.example/next', 303))
+      .mockResolvedValueOnce(new Response('ok', { status: 200 }))
+    await followRedirectsGuarded(raw, 'https://a.example/x', { method: 'POST', body: 'data' })
+    expect(raw.mock.calls[1][1].method).toBe('GET')
+    expect(raw.mock.calls[1][1].body).toBeUndefined()
+  })
+
+  it('preserves method and body on 307', async () => {
+    const raw = vi
+      .fn()
+      .mockResolvedValueOnce(redirectTo('https://a.example/next', 307))
+      .mockResolvedValueOnce(new Response('ok', { status: 200 }))
+    await followRedirectsGuarded(raw, 'https://a.example/x', { method: 'POST', body: 'data' })
+    expect(raw.mock.calls[1][1].method).toBe('POST')
+    expect(raw.mock.calls[1][1].body).toBe('data')
+  })
+})
+
+describe('followRedirectsGuarded — hardening', () => {
+  it('blocks a private IP-literal as the INITIAL url (guard is self-contained)', async () => {
+    const raw = vi.fn(async () => new Response('ok'))
+    await expect(
+      followRedirectsGuarded(raw, 'http://169.254.169.254/latest/meta-data/', {})
+    ).rejects.toThrow(/Blocked by SSRF policy/)
+    expect(raw).not.toHaveBeenCalled()
+  })
+
+  it('drops entity headers when a 303 switches POST to a bodyless GET', async () => {
+    const raw = vi
+      .fn()
+      .mockResolvedValueOnce(redirectTo('https://a.example/next', 303))
+      .mockResolvedValueOnce(new Response('ok', { status: 200 }))
+    await followRedirectsGuarded(raw, 'https://a.example/x', {
+      method: 'POST',
+      body: '{"a":1}',
+      headers: { 'content-type': 'application/json', 'content-length': '7', 'x-keep': 'yes' },
+    })
+    const hopHeaders = new Headers(raw.mock.calls[1][1].headers)
+    expect(hopHeaders.get('content-type')).toBeNull()
+    expect(hopHeaders.get('content-length')).toBeNull()
+    expect(hopHeaders.get('x-keep')).toBe('yes')
+  })
+})
+
+describe('followRedirectsGuarded — cross-origin body protection', () => {
+  it('refuses a cross-origin 307 that would forward a request body', async () => {
+    const raw = vi.fn(async () => redirectTo('https://b.example/steal', 307))
+    await expect(
+      followRedirectsGuarded(raw, 'https://a.example/token', {
+        method: 'POST',
+        body: 'client_secret=shh',
+      })
+    ).rejects.toThrow(/cross-origin redirect would forward a request body/)
+  })
+
+  it('allows a bodyless cross-origin redirect', async () => {
+    const raw = vi
+      .fn()
+      .mockResolvedValueOnce(redirectTo('https://b.example/next', 302))
+      .mockResolvedValueOnce(new Response('ok', { status: 200 }))
+    const res = await followRedirectsGuarded(raw, 'https://a.example/x', {})
+    expect(res.status).toBe(200)
+  })
+})
diff --git a/apps/sim/lib/core/utils/smooth-bottom-chase.ts b/apps/sim/lib/core/utils/smooth-bottom-chase.ts
index 1f6dea0af16..90c3b9d8e84 100644
--- a/apps/sim/lib/core/utils/smooth-bottom-chase.ts
+++ b/apps/sim/lib/core/utils/smooth-bottom-chase.ts
@@ -2,12 +2,12 @@
  * Fraction of the remaining gap to close per frame while chasing the bottom —
  * an exponential glide (originating in the subagent viewport's stick-to-bottom,
  * see BoundedViewport in agent-group.tsx) instead of snapping `scrollTop` to
- * `scrollHeight` on every content append. Closes ~90% of any gap within ~18
- * frames (~300ms) — deliberately lazier than the subagent viewport's 0.18 so a
- * large content burst reads as a calm upward drift of the transcript rather
+ * `scrollHeight` on every content append. Closes ~90% of any gap within ~13
+ * frames (~220ms) — slightly lazier than the subagent viewport's 0.18 so a
+ * large content burst reads as a brisk upward drift of the transcript rather
  * than a lurch.
  */
-export const SMOOTH_CHASE_RATE = 0.12
+export const SMOOTH_CHASE_RATE = 0.16
 
 /** Gap (px) below which the chase parks until new growth reopens it. */
 export const CHASE_REST_GAP = 0.5
@@ -26,6 +26,14 @@ export interface SmoothBottomChaseHandle {
   isActive: () => boolean
   /** Start the loop if parked. Call after content growth. */
   kick: () => void
+  /**
+   * Keep the loop alive for `durationMs` even while the gap is at rest,
+   * re-checking every frame. Covers growth that arrives over several frames
+   * with no observable trigger — a CSS height animation, or a virtualizer
+   * re-measure settling after streaming stops. Repeat calls extend the
+   * deadline; there is never more than one loop.
+   */
+  kickUntil: (durationMs: number) => void
   cancel: () => void
 }
 
@@ -47,11 +55,15 @@ export function createSmoothBottomChase(
 ): SmoothBottomChaseHandle {
   let raf: number | null = null
   let lastTop: number | null = null
+  let deadline = 0
 
   const park = () => {
     if (raf !== null) cancelAnimationFrame(raf)
     raf = null
     lastTop = null
+    // A stale deadline must not leak into a later plain kick() — kick alone
+    // parks at rest, only a live kickUntil window idles through it.
+    deadline = 0
   }
 
   const step = () => {
@@ -71,7 +83,14 @@ export function createSmoothBottomChase(
     }
     const gap = target.getBottomTop() - top
     if (gap <= CHASE_REST_GAP) {
-      park()
+      // Within a kickUntil deadline the loop idles at rest instead of parking,
+      // so growth in the deadline window is chased without a fresh trigger.
+      if (performance.now() >= deadline) {
+        park()
+        return
+      }
+      lastTop = top
+      raf = requestAnimationFrame(step)
       return
     }
     target.setTop(top + Math.max(1, gap * SMOOTH_CHASE_RATE))
@@ -82,10 +101,25 @@ export function createSmoothBottomChase(
     raf = requestAnimationFrame(step)
   }
 
+  /**
+   * Seed the upward-move interrupt baseline at (re)start so a user scroll-up
+   * between the kick and the first frame parks the loop immediately — without
+   * it the first step has no baseline and writes one downward frame against
+   * the user (relevant on the teardown kickUntil, where the gesture listeners
+   * are already gone).
+   */
+  const start = () => {
+    if (raf !== null) return
+    lastTop = target.getTop()
+    raf = requestAnimationFrame(step)
+  }
+
   return {
     isActive: () => raf !== null,
-    kick: () => {
-      if (raf === null) raf = requestAnimationFrame(step)
+    kick: start,
+    kickUntil: (durationMs: number) => {
+      deadline = Math.max(deadline, performance.now() + durationMs)
+      start()
     },
     cancel: park,
   }
diff --git a/apps/sim/lib/data-drains/sources/copilot-chats.ts b/apps/sim/lib/data-drains/sources/copilot-chats.ts
index 538e867301f..11b008ee7dc 100644
--- a/apps/sim/lib/data-drains/sources/copilot-chats.ts
+++ b/apps/sim/lib/data-drains/sources/copilot-chats.ts
@@ -36,6 +36,7 @@ const chatColumns = {
   resources: copilotChats.resources,
   lastSeenAt: copilotChats.lastSeenAt,
   pinned: copilotChats.pinned,
+  deletedAt: copilotChats.deletedAt,
   createdAt: copilotChats.createdAt,
   updatedAt: copilotChats.updatedAt,
 } as const
@@ -121,6 +122,7 @@ export const copilotChatsSource: DrainSource<CopilotChatRow> = {
       config: row.config,
       resources: row.resources,
       lastSeenAt: row.lastSeenAt ? row.lastSeenAt.toISOString() : null,
+      deletedAt: row.deletedAt ? row.deletedAt.toISOString() : null,
       createdAt: row.createdAt.toISOString(),
       updatedAt: row.updatedAt.toISOString(),
     }
diff --git a/apps/sim/lib/guardrails/mask-client.test.ts b/apps/sim/lib/guardrails/mask-client.test.ts
index 3fcb1894353..f8ee031545c 100644
--- a/apps/sim/lib/guardrails/mask-client.test.ts
+++ b/apps/sim/lib/guardrails/mask-client.test.ts
@@ -3,13 +3,15 @@
  */
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockToken, mockBaseUrl } = vi.hoisted(() => ({
+const { mockToken, mockBaseUrl, mockSleep } = vi.hoisted(() => ({
   mockToken: vi.fn(),
   mockBaseUrl: vi.fn(),
+  mockSleep: vi.fn(),
 }))
 
 vi.mock('@/lib/auth/internal', () => ({ generateInternalToken: mockToken }))
 vi.mock('@/lib/core/utils/urls', () => ({ getInternalApiBaseUrl: mockBaseUrl }))
+vi.mock('@sim/utils/helpers', () => ({ sleep: mockSleep }))
 
 import { maskPIIBatchViaHttp } from '@/lib/guardrails/mask-client'
 
@@ -20,6 +22,7 @@ describe('maskPIIBatchViaHttp', () => {
     vi.clearAllMocks()
     mockToken.mockResolvedValue('tok')
     mockBaseUrl.mockReturnValue('http://app.internal:3000')
+    mockSleep.mockResolvedValue(undefined)
     fetchMock = vi.fn(async (_url: string, init: { body: string }) => {
       const { texts } = JSON.parse(init.body) as { texts: string[] }
       return new Response(JSON.stringify({ masked: texts.map((t) => `M(${t})`) }), {
@@ -52,10 +55,80 @@ describe('maskPIIBatchViaHttp', () => {
     expect(fetchMock).toHaveBeenCalledTimes(3) // 2000-per-request cap
   })
 
-  it('throws on a non-2xx response so the caller can scrub', async () => {
-    fetchMock.mockResolvedValueOnce(new Response('boom', { status: 500 }))
+  it('throws immediately on a deterministic 4xx without retrying', async () => {
+    fetchMock.mockResolvedValueOnce(new Response('bad request', { status: 400 }))
 
     await expect(maskPIIBatchViaHttp(['a'], [])).rejects.toThrow(/mask-batch request failed/)
+    expect(fetchMock).toHaveBeenCalledTimes(1)
+    expect(mockSleep).not.toHaveBeenCalled()
+  })
+
+  it('retries a transient 5xx with backoff and then succeeds', async () => {
+    fetchMock.mockResolvedValueOnce(new Response('deploying', { status: 503 }))
+
+    const out = await maskPIIBatchViaHttp(['a'], [])
+
+    expect(out).toEqual(['M(a)'])
+    expect(fetchMock).toHaveBeenCalledTimes(2)
+    expect(mockSleep).toHaveBeenCalledTimes(1)
+  })
+
+  it('retries a rejected fetch (network error) and then succeeds', async () => {
+    fetchMock.mockRejectedValueOnce(new TypeError('fetch failed'))
+
+    const out = await maskPIIBatchViaHttp(['a'], [])
+
+    expect(out).toEqual(['M(a)'])
+    expect(fetchMock).toHaveBeenCalledTimes(2)
+  })
+
+  it('retries a runtime-level request timeout and then succeeds', async () => {
+    const timeout = new Error('The operation timed out.')
+    timeout.name = 'TimeoutError'
+    fetchMock.mockRejectedValueOnce(timeout)
+
+    const out = await maskPIIBatchViaHttp(['a'], [])
+
+    expect(out).toEqual(['M(a)'])
+    expect(fetchMock).toHaveBeenCalledTimes(2)
+  })
+
+  it('gives up after the retry budget is exhausted on a persistent 5xx', async () => {
+    fetchMock.mockImplementation(async () => new Response('down', { status: 503 }))
+
+    await expect(maskPIIBatchViaHttp(['a'], [])).rejects.toThrow(/mask-batch request failed/)
+    expect(fetchMock).toHaveBeenCalledTimes(8)
+    expect(mockSleep).toHaveBeenCalledTimes(7)
+  })
+
+  it('mints a fresh internal token per attempt', async () => {
+    fetchMock.mockResolvedValueOnce(new Response('deploying', { status: 503 }))
+
+    await maskPIIBatchViaHttp(['a'], [])
+
+    expect(mockToken).toHaveBeenCalledTimes(2)
+  })
+
+  it('does not retry a null 200 body (deterministic, not a transient TypeError)', async () => {
+    fetchMock.mockResolvedValueOnce(
+      new Response('null', { status: 200, headers: { 'content-type': 'application/json' } })
+    )
+
+    await expect(maskPIIBatchViaHttp(['a'], [])).rejects.toThrow(/unexpected result/)
+    expect(fetchMock).toHaveBeenCalledTimes(1)
+    expect(mockSleep).not.toHaveBeenCalled()
+  })
+
+  it('does not retry a shape mismatch (deterministic server bug)', async () => {
+    fetchMock.mockResolvedValueOnce(
+      new Response(JSON.stringify({ nope: true }), {
+        status: 200,
+        headers: { 'content-type': 'application/json' },
+      })
+    )
+
+    await expect(maskPIIBatchViaHttp(['a'], [])).rejects.toThrow(/unexpected result/)
+    expect(fetchMock).toHaveBeenCalledTimes(1)
   })
 
   it('returns [] without any request for empty input', async () => {
diff --git a/apps/sim/lib/guardrails/mask-client.ts b/apps/sim/lib/guardrails/mask-client.ts
index 7f5776b8524..7972e0e55cc 100644
--- a/apps/sim/lib/guardrails/mask-client.ts
+++ b/apps/sim/lib/guardrails/mask-client.ts
@@ -1,3 +1,5 @@
+import { sleep } from '@sim/utils/helpers'
+import { backoffWithJitter, parseRetryAfter } from '@sim/utils/retry'
 import type { GuardrailsMaskBatchResult } from '@/lib/api/contracts'
 import { generateInternalToken } from '@/lib/auth/internal'
 import { env } from '@/lib/core/config/env'
@@ -18,6 +20,60 @@ import type { CustomPiiPattern } from '@/lib/guardrails/pii-entities'
  */
 const CHUNK_CONCURRENCY = env.PII_MASK_CHUNK_CONCURRENCY ?? 64
 
+/**
+ * Per-chunk retry budget for transient failures (network errors, 408/429/5xx).
+ * A large payload fans out into many chunk requests, so a single blip — an ALB
+ * 502 during a deploy, a Presidio pod restart — must not fail the whole
+ * redaction (and, on the execution-altering stages, abort the run). With the
+ * default 500ms→30s jittered backoff this rides out ~2 minutes of outage per
+ * chunk before giving up. Deterministic failures (4xx, shape mismatches) throw
+ * immediately.
+ */
+const MAX_CHUNK_ATTEMPTS = 8
+
+const RETRYABLE_STATUSES = new Set([408, 429, 500, 502, 503, 504])
+
+class MaskChunkHttpError extends Error {
+  constructor(
+    message: string,
+    readonly status: number,
+    readonly retryAfterMs: number | null
+  ) {
+    super(message)
+    this.name = 'MaskChunkHttpError'
+  }
+}
+
+function isRetryableChunkError(error: unknown): boolean {
+  if (error instanceof MaskChunkHttpError) {
+    return RETRYABLE_STATUSES.has(error.status)
+  }
+  // A rejected fetch (connection refused/reset, DNS, socket drop) is transient —
+  // Node wraps these in TypeError('fetch failed'). Runtime-level request
+  // timeouts (undici's default 300s headers/body timeout, Bun's TimeoutError)
+  // and mid-flight socket closes surface with their own names/codes per runtime;
+  // all are congestion or connection churn, not a deterministic failure: a chunk
+  // queued behind a saturated Presidio fleet must retry, not fail the payload.
+  if (error instanceof TypeError) {
+    return true
+  }
+  const { name, code } = (error ?? {}) as { name?: unknown; code?: unknown }
+  if (name === 'TimeoutError' || name === 'HeadersTimeoutError' || name === 'BodyTimeoutError') {
+    return true
+  }
+  return (
+    typeof code === 'string' &&
+    [
+      'ECONNRESET',
+      'ECONNREFUSED',
+      'EPIPE',
+      'ETIMEDOUT',
+      'ConnectionClosed',
+      'ConnectionRefused',
+    ].includes(code)
+  )
+}
+
 /**
  * Mask PII across many strings via the internal app-container endpoint.
  *
@@ -29,8 +85,10 @@ const CHUNK_CONCURRENCY = env.PII_MASK_CHUNK_CONCURRENCY ?? 64
  * concurrency, so a large payload fans out rather than serializing; order is
  * preserved, so the returned array matches `texts` length.
  *
- * Rejects on any non-2xx, timeout, or shape mismatch so the caller can apply
- * its own fail-safe (scrubbing rather than leaking).
+ * Transient chunk failures (network errors, 408/429/5xx) retry with jittered
+ * backoff (see {@link MAX_CHUNK_ATTEMPTS}); only a deterministic failure or an
+ * exhausted retry budget rejects, so the caller can apply its own fail-safe
+ * (scrubbing rather than leaking).
  */
 export async function maskPIIBatchViaHttp(
   texts: string[],
@@ -64,8 +122,29 @@ async function postChunk(
   language: string | undefined,
   customPatterns: CustomPiiPattern[] | undefined
 ): Promise<string[]> {
-  // Mint per request: a single token (5min TTL) can expire mid-batch when a
-  // large execution fans out into many sequential chunk requests.
+  for (let attempt = 1; ; attempt++) {
+    try {
+      return await postChunkOnce(url, texts, entityTypes, language, customPatterns)
+    } catch (error) {
+      if (attempt >= MAX_CHUNK_ATTEMPTS || !isRetryableChunkError(error)) {
+        throw error
+      }
+      const retryAfterMs = error instanceof MaskChunkHttpError ? error.retryAfterMs : null
+      await sleep(backoffWithJitter(attempt, retryAfterMs))
+    }
+  }
+}
+
+async function postChunkOnce(
+  url: string,
+  texts: string[],
+  entityTypes: string[],
+  language: string | undefined,
+  customPatterns: CustomPiiPattern[] | undefined
+): Promise<string[]> {
+  // Mint per attempt: a single token (5min TTL) can expire mid-batch when a
+  // large execution fans out into many sequential chunk requests or a chunk
+  // spends its retry budget waiting out an outage.
   const token = await generateInternalToken()
 
   // boundary-raw-fetch: internal server-to-server call to the app container (internal JWT auth, configurable base URL)
@@ -80,11 +159,15 @@ async function postChunk(
 
   if (!response.ok) {
     const detail = await response.text().catch(() => '')
-    throw new Error(`PII mask-batch request failed (${response.status}): ${detail.slice(0, 200)}`)
+    throw new MaskChunkHttpError(
+      `PII mask-batch request failed (${response.status}): ${detail.slice(0, 200)}`,
+      response.status,
+      parseRetryAfter(response.headers.get('retry-after'))
+    )
   }
 
-  const data = (await response.json()) as GuardrailsMaskBatchResult
-  if (!Array.isArray(data.masked)) {
+  const data = (await response.json()) as GuardrailsMaskBatchResult | null
+  if (!data || !Array.isArray(data.masked)) {
     throw new Error('PII mask-batch returned an unexpected result')
   }
   return data.masked
diff --git a/apps/sim/lib/logs/execution/pii-large-values.test.ts b/apps/sim/lib/logs/execution/pii-large-values.test.ts
index 15292ef1419..3176b1131e3 100644
--- a/apps/sim/lib/logs/execution/pii-large-values.test.ts
+++ b/apps/sim/lib/logs/execution/pii-large-values.test.ts
@@ -1,33 +1,41 @@
 /**
  * @vitest-environment node
  */
+import { sleep } from '@sim/utils/helpers'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockMaterializeRef, mockCompact, mockMaterializeManifest, mockMaskBatch } = vi.hoisted(
-  () => ({
-    mockMaterializeRef: vi.fn(),
-    mockCompact: vi.fn(),
-    mockMaterializeManifest: vi.fn(),
-    mockMaskBatch: vi.fn(),
-  })
-)
+const { mockMaterializeRef, mockStoreLargeValue, mockCompact, mockMaskBatch } = vi.hoisted(() => ({
+  mockMaterializeRef: vi.fn(),
+  mockStoreLargeValue: vi.fn(),
+  mockCompact: vi.fn(),
+  mockMaskBatch: vi.fn(),
+}))
 
 vi.mock('@/lib/execution/payloads/store', () => ({
   materializeLargeValueRef: mockMaterializeRef,
+  storeLargeValue: mockStoreLargeValue,
 }))
 vi.mock('@/lib/execution/payloads/serializer', () => ({
   compactExecutionPayload: mockCompact,
 }))
-vi.mock('@/lib/execution/payloads/large-array-manifest', () => ({
-  materializeLargeArrayManifest: mockMaterializeManifest,
-}))
-vi.mock('@/lib/execution/payloads/large-array-manifest-metadata', () => ({
-  isLargeArrayManifest: () => false,
-}))
+vi.mock('@/lib/execution/payloads/materialization.server', () => {
+  const MAX_INLINE_MATERIALIZATION_BYTES = 16 * 1024 * 1024
+  return {
+    MAX_INLINE_MATERIALIZATION_BYTES,
+    MAX_DURABLE_LARGE_VALUE_BYTES: 64 * 1024 * 1024,
+    assertInlineMaterializationSize: (size: number, maxBytes?: number) => {
+      if (size > (maxBytes ?? MAX_INLINE_MATERIALIZATION_BYTES)) {
+        throw new Error('Execution memory limit exceeded. Reduce payload size and try again.')
+      }
+    },
+  }
+})
 vi.mock('@/lib/guardrails/mask-client', () => ({
   maskPIIBatchViaHttp: mockMaskBatch,
 }))
 
+import type { LargeArrayManifest } from '@/lib/execution/payloads/large-array-manifest'
+import { isLargeArrayManifest } from '@/lib/execution/payloads/large-array-manifest-metadata'
 import {
   redactLargeValueRefs,
   redactLargeValueRefsInValue,
@@ -44,16 +52,58 @@ const REF = {
 
 const STORE = { workspaceId: 'ws-1', workflowId: 'wf-1', executionId: 'ex-1', userId: 'u-1' }
 
-describe('redactLargeValueRefs', () => {
-  beforeEach(() => {
-    vi.clearAllMocks()
-    mockMaskBatch.mockImplementation(async (texts: string[]) => texts.map((t) => `MASKED(${t})`))
-    // compact echoes its input so we can assert the masked content is what's re-stored.
-    mockCompact.mockImplementation(async (value: unknown) => value)
+/** Chunk arrays keyed by ref id, served by mockMaterializeRef and captured by mockStoreLargeValue. */
+const chunkData = new Map<string, unknown>()
+let storedRefCounter = 0
+
+function makeChunkRef(id: string, size: number, kind = 'array') {
+  return { __simLargeValueRef: true, version: 1, id, kind, size } as const
+}
+
+function makeManifest(
+  chunks: Array<{ id: string; size: number; items: unknown[] }>
+): LargeArrayManifest {
+  for (const chunk of chunks) {
+    chunkData.set(chunk.id, chunk.items)
+  }
+  return {
+    __simLargeArrayManifest: true,
+    version: 2,
+    kind: 'array',
+    totalCount: chunks.reduce((sum, c) => sum + c.items.length, 0),
+    chunkCount: chunks.length,
+    byteSize: chunks.reduce((sum, c) => sum + c.size, 0),
+    chunks: chunks.map((c) => ({
+      ref: makeChunkRef(c.id, c.size),
+      count: c.items.length,
+      byteSize: c.size,
+    })),
+    preview: [{ note: 'raw unmasked preview' }],
+  }
+}
+
+function installDefaultMocks() {
+  mockMaskBatch.mockImplementation(async (texts: string[]) => texts.map((t) => `MASKED(${t})`))
+  // compact echoes its input so we can assert the masked content is what's re-stored.
+  mockCompact.mockImplementation(async (value: unknown) => value)
+  mockMaterializeRef.mockImplementation(async (ref: { id: string }) => chunkData.get(ref.id))
+  mockStoreLargeValue.mockImplementation(async (value: unknown, _json: string, size: number) => {
+    const id = `lv_${String(storedRefCounter++).padStart(12, '0')}`
+    chunkData.set(id, value)
+    return { __simLargeValueRef: true, version: 1, id, kind: 'array', size }
   })
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  chunkData.clear()
+  storedRefCounter = 0
+  installDefaultMocks()
+})
 
+describe('redactLargeValueRefs', () => {
   it('hydrates, masks, and re-stores a large-value ref (content preserved, PII masked)', async () => {
-    mockMaterializeRef.mockResolvedValue({ note: 'contact bob', id: 42 })
+    chunkData.set(REF.id, { note: 'contact bob', id: 42 })
 
     const result = await redactLargeValueRefs(
       { finalOutput: REF },
@@ -62,7 +112,11 @@ describe('redactLargeValueRefs', () => {
 
     expect(mockMaterializeRef).toHaveBeenCalledWith(
       REF,
-      expect.objectContaining({ executionId: 'ex-1', trackReference: false })
+      expect.objectContaining({
+        executionId: 'ex-1',
+        trackReference: false,
+        maxBytes: 64 * 1024 * 1024,
+      })
     )
     expect(result.finalOutput).toEqual({ note: 'MASKED(contact bob)', id: 42 })
     expect(mockCompact).toHaveBeenCalledTimes(1)
@@ -79,7 +133,7 @@ describe('redactLargeValueRefs', () => {
   })
 
   it('falls back to the marker when re-store throws (never leaks)', async () => {
-    mockMaterializeRef.mockResolvedValue({ note: 'secret@x.com' })
+    chunkData.set(REF.id, { note: 'secret@x.com' })
     mockCompact.mockRejectedValueOnce(new Error('s3 down'))
     const result = await redactLargeValueRefs(
       { finalOutput: REF },
@@ -91,9 +145,8 @@ describe('redactLargeValueRefs', () => {
   it('hydrates+masks refs across multiple payload keys (parallel, cross-key)', async () => {
     const refA = { ...REF, id: 'lv_aaaaaaaaaaaa' }
     const refB = { ...REF, id: 'lv_bbbbbbbbbbbb' }
-    mockMaterializeRef.mockImplementation(async (ref: { id: string }) =>
-      ref.id === 'lv_aaaaaaaaaaaa' ? { note: 'call bob' } : { note: 'email amy' }
-    )
+    chunkData.set(refA.id, { note: 'call bob' })
+    chunkData.set(refB.id, { note: 'email amy' })
 
     const result = await redactLargeValueRefs(
       { finalOutput: refA, traceSpans: [{ output: refB }] },
@@ -110,9 +163,7 @@ describe('redactLargeValueRefs', () => {
     const refA = { ...REF, id: 'lv_aaaaaaaaaaaa' }
     const refB = { ...REF, id: 'lv_bbbbbbbbbbbb' }
     // refA materializes fine; refB can't — in throw mode the whole redaction must abort.
-    mockMaterializeRef.mockImplementation(async (ref: { id: string }) =>
-      ref.id === 'lv_aaaaaaaaaaaa' ? { note: 'ok' } : undefined
-    )
+    chunkData.set(refA.id, { note: 'ok' })
 
     await expect(
       redactLargeValueRefs(
@@ -132,17 +183,246 @@ describe('redactLargeValueRefs', () => {
     expect(result).toEqual(payload)
     expect(mockMaterializeRef).not.toHaveBeenCalled()
   })
+
+  it('masks a single ref past the inline ceiling with the raised durable budget', async () => {
+    const bigRef = { ...REF, id: 'lv_bigbigbigbig', size: 30 * 1024 * 1024 }
+    chunkData.set(bigRef.id, { note: 'ssn 123-45-6789' })
+
+    const result = await redactLargeValueRefs(
+      { finalOutput: bigRef },
+      { entityTypes: [], language: 'en', store: STORE, onFailure: 'throw' }
+    )
+
+    expect(mockMaterializeRef).toHaveBeenCalledWith(
+      bigRef,
+      expect.objectContaining({ maxBytes: 64 * 1024 * 1024 })
+    )
+    expect(result.finalOutput).toEqual({ note: 'MASKED(ssn 123-45-6789)' })
+  })
+
+  it('processes oversized single refs serially, after the pooled refs', async () => {
+    const smallRef = { ...REF, id: 'lv_smallsmall12' }
+    const bigRef = { ...REF, id: 'lv_bigbigbigbig', size: 30 * 1024 * 1024 }
+    chunkData.set(smallRef.id, { note: 'small' })
+    chunkData.set(bigRef.id, { note: 'big' })
+
+    await redactLargeValueRefs(
+      { finalOutput: { a: bigRef, b: smallRef } },
+      { entityTypes: [], language: 'en', store: STORE }
+    )
+
+    const order = mockMaterializeRef.mock.calls.map(([ref]) => (ref as { id: string }).id)
+    expect(order).toEqual(['lv_smallsmall12', 'lv_bigbigbigbig'])
+  })
+
+  it('completes an oversized ref whose content nests another oversized ref (no gate deadlock)', async () => {
+    const outer = { ...REF, id: 'lv_outerbig1234', size: 30 * 1024 * 1024 }
+    const inner = { ...REF, id: 'lv_innerbig1234', size: 20 * 1024 * 1024 }
+    chunkData.set(outer.id, { note: 'outer bob', deep: inner })
+    chunkData.set(inner.id, { note: 'inner amy' })
+
+    const result = await redactLargeValueRefs(
+      { finalOutput: outer },
+      { entityTypes: [], language: 'en', store: STORE, onFailure: 'throw' }
+    )
+
+    expect(result.finalOutput).toEqual({
+      note: 'MASKED(outer bob)',
+      deep: { note: 'MASKED(inner amy)' },
+    })
+  })
+
+  it('serializes nested oversized refs discovered under different pooled parents', async () => {
+    const parentA = { ...REF, id: 'lv_parentaaaaaa' }
+    const parentB = { ...REF, id: 'lv_parentbbbbbb' }
+    const nestedA = { ...REF, id: 'lv_nestedaaaaaa', size: 30 * 1024 * 1024 }
+    const nestedB = { ...REF, id: 'lv_nestedbbbbbb', size: 30 * 1024 * 1024 }
+    chunkData.set(parentA.id, { deep: nestedA })
+    chunkData.set(parentB.id, { deep: nestedB })
+    let inFlight = 0
+    let maxInFlight = 0
+    mockMaterializeRef.mockImplementation(async (ref: { id: string; size: number }) => {
+      if (ref.size > 16 * 1024 * 1024) {
+        inFlight++
+        maxInFlight = Math.max(maxInFlight, inFlight)
+        await sleep(1)
+        inFlight--
+      }
+      return chunkData.get(ref.id)
+    })
+    chunkData.set(nestedA.id, { note: 'a' })
+    chunkData.set(nestedB.id, { note: 'b' })
+
+    const result = await redactLargeValueRefs(
+      { finalOutput: { a: parentA, b: parentB } },
+      { entityTypes: [], language: 'en', store: STORE }
+    )
+
+    expect((result.finalOutput as any).a).toEqual({ deep: { note: 'MASKED(a)' } })
+    expect((result.finalOutput as any).b).toEqual({ deep: { note: 'MASKED(b)' } })
+    expect(maxInFlight).toBe(1)
+  })
+
+  it('processes a manifest containing an oversized chunk serially, after the pooled refs', async () => {
+    const smallRef = { ...REF, id: 'lv_smallsmall12' }
+    chunkData.set(smallRef.id, { note: 'small' })
+    const bigChunkManifest = makeManifest([
+      { id: 'lv_hugechunk000', size: 20 * 1024 * 1024, items: [{ note: 'one giant item' }] },
+    ])
+
+    await redactLargeValueRefs(
+      { finalOutput: { a: bigChunkManifest, b: smallRef } },
+      { entityTypes: [], language: 'en', store: STORE }
+    )
+
+    const order = mockMaterializeRef.mock.calls.map(([ref]) => (ref as { id: string }).id)
+    expect(order).toEqual(['lv_smallsmall12', 'lv_hugechunk000'])
+  })
 })
 
-describe('redactLargeValueRefsInValue (arbitrary blockStates)', () => {
-  beforeEach(() => {
-    vi.clearAllMocks()
-    mockMaskBatch.mockImplementation(async (texts: string[]) => texts.map((t) => `MASKED(${t})`))
-    mockCompact.mockImplementation(async (value: unknown) => value)
+describe('redactManifest — chunk-wise', () => {
+  it('masks a >16MB manifest chunk-by-chunk without tripping the inline ceiling', async () => {
+    const manifest = makeManifest([
+      { id: 'lv_chunk0chunk0', size: 9_000_000, items: [{ note: 'alpha' }, { note: 'beta' }] },
+      { id: 'lv_chunk1chunk1', size: 9_000_000, items: [{ note: 'gamma' }, { note: 'delta' }] },
+      { id: 'lv_chunk2chunk2', size: 9_000_000, items: [{ note: 'omega' }] },
+    ])
+
+    const result = await redactLargeValueRefs(
+      { finalOutput: manifest },
+      { entityTypes: ['PERSON'], language: 'en', store: STORE, onFailure: 'throw' }
+    )
+
+    const masked = result.finalOutput as LargeArrayManifest
+    expect(isLargeArrayManifest(masked)).toBe(true)
+    expect(masked.totalCount).toBe(5)
+
+    const maskedItems = masked.chunks.flatMap((chunk) => chunkData.get(chunk.ref.id) as unknown[])
+    expect(maskedItems).toEqual([
+      { note: 'MASKED(alpha)' },
+      { note: 'MASKED(beta)' },
+      { note: 'MASKED(gamma)' },
+      { note: 'MASKED(delta)' },
+      { note: 'MASKED(omega)' },
+    ])
+    // Manifests re-store through the manifest writer, never the whole-value serializer.
+    expect(mockCompact).not.toHaveBeenCalled()
+    // One hydration per source chunk, read-only and with the raised per-chunk budget.
+    const chunkReads = mockMaterializeRef.mock.calls.filter(([ref]) =>
+      String((ref as { id: string }).id).startsWith('lv_chunk')
+    )
+    expect(chunkReads).toHaveLength(3)
+    for (const [, context] of chunkReads) {
+      expect(context).toMatchObject({ trackReference: false, maxBytes: 64 * 1024 * 1024 })
+    }
+  })
+
+  it('derives the rebuilt preview from masked items, never the raw source preview', async () => {
+    const manifest = makeManifest([
+      { id: 'lv_chunk0chunk0', size: 9_000_000, items: [{ note: 'bob smith' }] },
+      { id: 'lv_chunk1chunk1', size: 9_000_000, items: [{ note: 'amy jones' }] },
+    ])
+
+    const result = await redactLargeValueRefs(
+      { finalOutput: manifest },
+      { entityTypes: ['PERSON'], language: 'en', store: STORE }
+    )
+
+    const masked = result.finalOutput as LargeArrayManifest
+    expect(masked.preview).toEqual([{ note: 'MASKED(bob smith)' }])
+  })
+
+  it('returns an empty manifest unchanged in shape for a zero-item manifest', async () => {
+    const empty: LargeArrayManifest = {
+      __simLargeArrayManifest: true,
+      version: 2,
+      kind: 'array',
+      totalCount: 0,
+      chunkCount: 0,
+      byteSize: 0,
+      chunks: [],
+      preview: [],
+    }
+
+    const result = await redactLargeValueRefs(
+      { finalOutput: empty },
+      { entityTypes: [], language: 'en', store: STORE }
+    )
+
+    const masked = result.finalOutput as LargeArrayManifest
+    expect(isLargeArrayManifest(masked)).toBe(true)
+    expect(masked.totalCount).toBe(0)
+    expect(mockStoreLargeValue).not.toHaveBeenCalled()
+  })
+
+  it('recursively masks a nested large-value ref inside a chunk item', async () => {
+    const nestedRef = { ...REF, id: 'lv_nestednested' }
+    chunkData.set(nestedRef.id, { note: 'nested bob' })
+    const manifest = makeManifest([
+      { id: 'lv_chunk0chunk0', size: 9_000_000, items: [{ note: 'top', deep: nestedRef }] },
+    ])
+
+    const result = await redactLargeValueRefs(
+      { finalOutput: manifest },
+      { entityTypes: [], language: 'en', store: STORE }
+    )
+
+    const masked = result.finalOutput as LargeArrayManifest
+    const [item] = chunkData.get(masked.chunks[0].ref.id) as Array<Record<string, unknown>>
+    expect(item.note).toBe('MASKED(top)')
+    expect(item.deep).toEqual({ note: 'MASKED(nested bob)' })
+  })
+
+  describe('partial chunk failure', () => {
+    it('scrubs the whole manifest to the marker in scrub mode', async () => {
+      const manifest = makeManifest([
+        { id: 'lv_chunk0chunk0', size: 9_000_000, items: [{ note: 'ok' }] },
+        { id: 'lv_chunk1chunk1', size: 9_000_000, items: [{ note: 'lost' }] },
+      ])
+      chunkData.delete('lv_chunk1chunk1')
+
+      const result = await redactLargeValueRefs(
+        { finalOutput: manifest },
+        { entityTypes: [], language: 'en', store: STORE }
+      )
+
+      expect(result.finalOutput).toBe('[REDACTION_FAILED]')
+    })
+
+    it('throws PiiRedactionError in throw mode', async () => {
+      const manifest = makeManifest([
+        { id: 'lv_chunk0chunk0', size: 9_000_000, items: [{ note: 'ok' }] },
+        { id: 'lv_chunk1chunk1', size: 9_000_000, items: [{ note: 'lost' }] },
+      ])
+      chunkData.delete('lv_chunk1chunk1')
+
+      await expect(
+        redactLargeValueRefs(
+          { finalOutput: manifest },
+          { entityTypes: [], language: 'en', store: STORE, onFailure: 'throw' }
+        )
+      ).rejects.toBeInstanceOf(PiiRedactionError)
+    })
+  })
+
+  it('fails fast when a chunk materializes with the wrong item count', async () => {
+    const manifest = makeManifest([
+      { id: 'lv_chunk0chunk0', size: 9_000_000, items: [{ note: 'a' }, { note: 'b' }] },
+    ])
+    chunkData.set('lv_chunk0chunk0', [{ note: 'a' }])
+
+    const result = await redactLargeValueRefs(
+      { finalOutput: manifest },
+      { entityTypes: [], language: 'en', store: STORE }
+    )
+
+    expect(result.finalOutput).toBe('[REDACTION_FAILED]')
   })
+})
 
+describe('redactLargeValueRefsInValue (arbitrary blockStates)', () => {
   it('hydrates + re-stores a ref nested in a non-RedactablePayload shape', async () => {
-    mockMaterializeRef.mockResolvedValue({ note: 'contact bob' })
+    chunkData.set(REF.id, { note: 'contact bob' })
     const blockStates = { 'block-1': { output: REF }, 'block-2': { output: { plain: 'hi' } } }
 
     const result = await redactLargeValueRefsInValue(blockStates, {
@@ -167,7 +447,7 @@ describe('redactLargeValueRefsInValue (arbitrary blockStates)', () => {
   })
 
   it('rethrows a re-store failure as PiiRedactionError under throw mode', async () => {
-    mockMaterializeRef.mockResolvedValue({ note: 'secret@x.com' })
+    chunkData.set(REF.id, { note: 'secret@x.com' })
     mockCompact.mockRejectedValueOnce(new Error('s3 down'))
 
     await expect(
diff --git a/apps/sim/lib/logs/execution/pii-large-values.ts b/apps/sim/lib/logs/execution/pii-large-values.ts
index 1797964a065..dd323eb6b46 100644
--- a/apps/sim/lib/logs/execution/pii-large-values.ts
+++ b/apps/sim/lib/logs/execution/pii-large-values.ts
@@ -3,9 +3,17 @@ import { getErrorMessage } from '@sim/utils/errors'
 import { env } from '@/lib/core/config/env'
 import { mapWithConcurrency } from '@/lib/core/utils/concurrency'
 import type { LargeArrayManifest } from '@/lib/execution/payloads/large-array-manifest'
-import { materializeLargeArrayManifest } from '@/lib/execution/payloads/large-array-manifest'
+import {
+  appendLargeArrayManifest,
+  createLargeArrayManifest,
+  readLargeArrayManifestSlice,
+} from '@/lib/execution/payloads/large-array-manifest'
 import { isLargeArrayManifest } from '@/lib/execution/payloads/large-array-manifest-metadata'
 import { isLargeValueRef, type LargeValueRef } from '@/lib/execution/payloads/large-value-ref'
+import {
+  MAX_DURABLE_LARGE_VALUE_BYTES,
+  MAX_INLINE_MATERIALIZATION_BYTES,
+} from '@/lib/execution/payloads/materialization.server'
 import { compactExecutionPayload } from '@/lib/execution/payloads/serializer'
 import type { LargeValueStoreContext } from '@/lib/execution/payloads/store'
 import { materializeLargeValueRef } from '@/lib/execution/payloads/store'
@@ -35,6 +43,41 @@ export interface RedactLargeValueRefsOptions {
    * than feeding a marker (or leaking raw bytes) downstream.
    */
   onFailure?: PiiRedactionFailureMode
+  /**
+   * @internal Shared across every nested invocation spawned from one entry-point
+   * call, so oversized hydrations serialize globally — not just within their own
+   * {@link resolveReplacements} pass. Created by the entry points; callers never
+   * set it.
+   */
+  oversizedGate?: OversizedHydrationGate
+  /**
+   * @internal True while running under the gate. Nested oversized work inside a
+   * gated ref runs directly instead of re-acquiring — the holder would otherwise
+   * wait on itself (deadlock). Safe because the holder is globally serialized.
+   */
+  withinOversizedGate?: boolean
+}
+
+/** Promise-chain mutex for oversized hydrations (see {@link requiresSerialHydration}). */
+interface OversizedHydrationGate {
+  chain: Promise<void>
+}
+
+/** Queue `fn` behind every previously gated task; failures don't poison the chain. */
+async function runSerially<T>(gate: OversizedHydrationGate, fn: () => Promise<T>): Promise<T> {
+  const run = gate.chain.then(fn)
+  gate.chain = run.then(
+    () => undefined,
+    () => undefined
+  )
+  return run
+}
+
+/** Ensure one shared gate exists for the whole entry-point call tree. */
+function withOversizedGate(options: RedactLargeValueRefsOptions): RedactLargeValueRefsOptions {
+  return options.oversizedGate
+    ? options
+    : { ...options, oversizedGate: { chain: Promise.resolve() } }
 }
 
 /**
@@ -57,6 +100,7 @@ export async function redactLargeValueRefs(
   payload: RedactablePayload,
   options: RedactLargeValueRefsOptions
 ): Promise<RedactablePayload> {
+  const gatedOptions = withOversizedGate(options)
   // Collect refs across the WHOLE payload first (shared `seen`), so every ref is
   // hydrated+masked+re-stored in one bounded-concurrency pass instead of one
   // sequential pass per key. A ref shared across keys is walked/masked once.
@@ -67,7 +111,7 @@ export async function redactLargeValueRefs(
   }
   if (refs.length === 0) return payload
 
-  const replacements = await resolveReplacements(refs, options)
+  const replacements = await resolveReplacements(refs, gatedOptions)
   const result: RedactablePayload = { ...payload }
   for (const key of Object.keys(payload) as (keyof RedactablePayload)[]) {
     if (payload[key] !== undefined) result[key] = substituteRefs(payload[key], replacements)
@@ -85,7 +129,7 @@ export async function redactLargeValueRefsInValue<T>(
   value: T,
   options: RedactLargeValueRefsOptions
 ): Promise<T> {
-  return (await redactValueRefs(value, options)) as T
+  return (await redactValueRefs(value, withOversizedGate(options))) as T
 }
 
 /** Sync-collect every ref/manifest in `value`, then async-replace each, then sync-substitute. */
@@ -108,10 +152,30 @@ async function redactValueRefs(
  */
 const REF_CONCURRENCY = env.PII_REF_CONCURRENCY ?? 4
 
+/**
+ * A single ref past the default inline ceiling hydrates its whole blob at once
+ * (~2-3× its serialized size in transient heap) — and a manifest whose packer
+ * emitted an oversized chunk (a single item larger than the chunk target)
+ * hydrates that chunk the same way. Those run serially instead of in the
+ * {@link REF_CONCURRENCY} pool — one 64MB hydration is fine, four at once is an
+ * OOM on the small trigger.dev machines. Normally-chunked manifests page ~8MB
+ * at a time and stay pooled regardless of total size.
+ */
+function requiresSerialHydration(ref: object): boolean {
+  if (isLargeValueRef(ref)) {
+    return ref.size > MAX_INLINE_MATERIALIZATION_BYTES
+  }
+  if (isLargeArrayManifest(ref)) {
+    return ref.chunks.some((chunk) => chunk.byteSize > MAX_INLINE_MATERIALIZATION_BYTES)
+  }
+  return false
+}
+
 /**
  * Dedupe the collected refs by identity, then replace each in parallel (bounded by
- * {@link REF_CONCURRENCY}). `Map.set` is synchronous, so concurrent workers writing
- * the shared map do not race.
+ * {@link REF_CONCURRENCY}); refs needing an oversized hydration run serially after
+ * the pool drains (see {@link requiresSerialHydration}). `Map.set` is synchronous,
+ * so concurrent workers writing the shared map do not race.
  *
  * `mapWithConcurrency`'s `fn` must not reject (a rejection fails the pool
  * non-deterministically), so the mapper is total: it catches per-ref errors and
@@ -124,15 +188,28 @@ async function resolveReplacements(
   options: RedactLargeValueRefsOptions
 ): Promise<Map<object, unknown>> {
   const unique = [...new Set(refs)]
+  const pooled = unique.filter((ref) => !requiresSerialHydration(ref))
+  const oversized = unique.filter(requiresSerialHydration)
   const replacements = new Map<object, unknown>()
   let firstError: unknown
-  await mapWithConcurrency(unique, REF_CONCURRENCY, async (ref) => {
+  const resolveOne = async (ref: object, opts: RedactLargeValueRefsOptions): Promise<void> => {
     try {
-      replacements.set(ref, await replaceRef(ref, options))
+      replacements.set(ref, await replaceRef(ref, opts))
     } catch (error) {
       if (firstError === undefined) firstError = error
     }
-  })
+  }
+  await mapWithConcurrency(pooled, REF_CONCURRENCY, (ref) => resolveOne(ref, options))
+  const gate = options.oversizedGate
+  for (const ref of oversized) {
+    if (!gate || options.withinOversizedGate) {
+      // Already serialized by a gated ancestor (or no gate: direct internal
+      // call) — re-acquiring would deadlock on the ancestor's own hold.
+      await resolveOne(ref, options)
+    } else {
+      await runSerially(gate, () => resolveOne(ref, { ...options, withinOversizedGate: true }))
+    }
+  }
   if (firstError !== undefined) throw firstError
   return replacements
 }
@@ -176,21 +253,32 @@ async function replaceRef(ref: object, options: RedactLargeValueRefsOptions): Pr
 }
 
 /**
- * Mask a materialized large value and re-offload it: handle any nested refs
- * first, then mask inline strings, then re-store. `redactObjectStrings` skips
- * refs, so the nested re-stored refs are left intact while their siblings mask.
+ * Mask a materialized value: mask inline strings first (`redactObjectStrings`
+ * treats refs as opaque), then replace any nested refs with their own masked
+ * results. Strings-first matters — a nested ref whose masked value shrinks
+ * below the offload threshold comes back inline, and running the string pass
+ * after substitution would mask that already-masked content a second time
+ * (non-idempotent for custom patterns).
  */
-async function maskAndReStore(
+async function maskMaterializedValue(
   value: unknown,
   options: RedactLargeValueRefsOptions
 ): Promise<unknown> {
-  const nested = await redactValueRefs(value, options)
-  const masked = await redactObjectStrings(nested, {
+  const masked = await redactObjectStrings(value, {
     entityTypes: options.entityTypes,
     language: options.language,
     customPatterns: options.customPatterns,
     onFailure: options.onFailure ?? 'scrub',
   })
+  return redactValueRefs(masked, options)
+}
+
+/** Mask a materialized large value and re-offload it as a fresh durable ref. */
+async function maskAndReStore(
+  value: unknown,
+  options: RedactLargeValueRefsOptions
+): Promise<unknown> {
+  const masked = await maskMaterializedValue(value, options)
   return compactExecutionPayload(masked, { ...options.store, requireDurable: true })
 }
 
@@ -217,6 +305,11 @@ async function redactRef(
     const materialized = await materializeLargeValueRef(ref, {
       ...options.store,
       trackReference: false,
+      // Redaction must hydrate refs past the default inline ceiling to mask
+      // them; refs above that ceiling are scheduled serially (see
+      // isOversizedSingleRef) so the raised budget never multiplies across the
+      // concurrency pool.
+      maxBytes: MAX_DURABLE_LARGE_VALUE_BYTES,
     })
     if (materialized === undefined) {
       return onRefFailure(
@@ -231,13 +324,47 @@ async function redactRef(
   }
 }
 
+/**
+ * Mask a large-array manifest chunk-by-chunk: page one stored chunk at a time,
+ * mask nested refs + strings in that slice, and append the masked items to a
+ * fresh manifest. Peak memory stays ~one chunk regardless of the manifest's
+ * total `byteSize`, so a large offloaded array never trips the inline
+ * materialization ceiling. The rebuilt manifest re-chunks by byte target,
+ * recomputes `count`/`byteSize` bookkeeping from the masked items, and derives
+ * `preview` from masked content — the source manifest's preview holds raw items
+ * and must never be carried forward.
+ */
 async function redactManifest(
   manifest: LargeArrayManifest,
   options: RedactLargeValueRefsOptions
 ): Promise<unknown> {
   try {
-    const materialized = await materializeLargeArrayManifest(manifest, { ...options.store })
-    return await maskAndReStore(materialized, options)
+    const readContext = {
+      ...options.store,
+      trackReference: false,
+      // Chunks target ~8MB, but a single item larger than the target still
+      // occupies its own chunk — allow those up to the durable cap since they
+      // hydrate one at a time.
+      maxBytes: MAX_DURABLE_LARGE_VALUE_BYTES,
+    }
+    let masked: LargeArrayManifest | undefined
+    let cursor = 0
+    for (const chunk of manifest.chunks) {
+      const slice = await readLargeArrayManifestSlice(manifest, cursor, chunk.count, readContext)
+      cursor += chunk.count
+      const items = (await maskMaterializedValue(slice, options)) as unknown[]
+      masked =
+        masked === undefined
+          ? await createLargeArrayManifest(items, { ...options.store })
+          : await appendLargeArrayManifest(masked, items, { ...options.store })
+    }
+    if (masked === undefined) {
+      return createLargeArrayManifest([], { ...options.store })
+    }
+    if (masked.totalCount !== manifest.totalCount) {
+      throw new Error('Masked manifest item count does not match the source manifest.')
+    }
+    return masked
   } catch (error) {
     return onRefFailure(error, options, 'Failed to redact large array manifest')
   }
diff --git a/apps/sim/lib/logs/execution/pii-redaction.ts b/apps/sim/lib/logs/execution/pii-redaction.ts
index d29c4cb864b..cfca0c8ea0e 100644
--- a/apps/sim/lib/logs/execution/pii-redaction.ts
+++ b/apps/sim/lib/logs/execution/pii-redaction.ts
@@ -145,7 +145,9 @@ function transformUnit(
  *
  * There is no total-size ceiling — the batching layer chunks the request and
  * fans out with bounded concurrency, so payloads of any size are masked properly
- * rather than scrubbed. The per-chunk request timeout is the real backstop.
+ * rather than scrubbed. Transient chunk failures retry with backoff inside the
+ * mask client; a failure surfacing here means the retry budget is exhausted or
+ * the failure is deterministic.
  */
 async function maskCollected(
   collected: string[],
diff --git a/apps/sim/lib/mcp/client.test.ts b/apps/sim/lib/mcp/client.test.ts
index dda637bbe88..8a87eac5a5f 100644
--- a/apps/sim/lib/mcp/client.test.ts
+++ b/apps/sim/lib/mcp/client.test.ts
@@ -21,7 +21,7 @@ vi.mock('@sim/logger', () => ({
 }))
 
 vi.mock('@/lib/mcp/pinned-fetch', () => ({
-  createPinnedMcpFetch: vi.fn(() => ({ fetch: vi.fn(), close: mockPinnedClose })),
+  createGuardedMcpFetch: vi.fn(() => ({ fetch: vi.fn(), close: mockPinnedClose })),
 }))
 
 /**
@@ -177,7 +177,7 @@ describe('McpClient notification handler', () => {
       undefined,
       expect.objectContaining({
         timeout: 30_000,
-        maxTotalTimeout: 60_000,
+        maxTotalTimeout: expect.any(Number),
         resetTimeoutOnProgress: true,
         onprogress: expect.any(Function),
       })
@@ -196,10 +196,84 @@ describe('McpClient notification handler', () => {
 
     expect(mockSdkListTools).toHaveBeenCalledWith(
       undefined,
-      expect.objectContaining({ timeout: 60_000, maxTotalTimeout: 60_000 })
+      expect.objectContaining({ timeout: 60_000, maxTotalTimeout: expect.any(Number) })
     )
   })
 
+  it('follows nextCursor pagination and aggregates all pages', async () => {
+    mockSdkListTools
+      .mockResolvedValueOnce({ tools: [{ name: 'a' }, { name: 'b' }], nextCursor: 'c1' })
+      .mockResolvedValueOnce({ tools: [{ name: 'c' }], nextCursor: 'c2' })
+      .mockResolvedValueOnce({ tools: [{ name: 'd' }] })
+    const client = new McpClient({
+      config: createConfig(),
+      securityPolicy: { requireConsent: false, auditLevel: 'basic' },
+    })
+
+    await client.connect()
+    const tools = await client.listTools()
+
+    expect(tools.map((t) => t.name)).toEqual(['a', 'b', 'c', 'd'])
+    expect(mockSdkListTools).toHaveBeenNthCalledWith(2, { cursor: 'c1' }, expect.anything())
+    expect(mockSdkListTools).toHaveBeenNthCalledWith(3, { cursor: 'c2' }, expect.anything())
+  })
+
+  it('stops paginating when the server repeats a cursor (loop guard)', async () => {
+    mockSdkListTools.mockResolvedValue({ tools: [{ name: 'x' }], nextCursor: 'same' })
+    const client = new McpClient({
+      config: createConfig(),
+      securityPolicy: { requireConsent: false, auditLevel: 'basic' },
+    })
+
+    await client.connect()
+    const tools = await client.listTools()
+
+    // Page 1 sets cursor 'same'; page 2 returns 'same' again → guard stops. Not 50 pages.
+    expect(mockSdkListTools).toHaveBeenCalledTimes(2)
+    expect(tools).toHaveLength(2)
+  })
+
+  it('returns partial tools when a later page fails', async () => {
+    mockSdkListTools
+      .mockResolvedValueOnce({ tools: [{ name: 'a' }], nextCursor: 'c1' })
+      .mockRejectedValueOnce(new Error('page 2 blew up'))
+    const client = new McpClient({
+      config: createConfig(),
+      securityPolicy: { requireConsent: false, auditLevel: 'basic' },
+    })
+
+    await client.connect()
+    const tools = await client.listTools()
+
+    expect(tools.map((t) => t.name)).toEqual(['a'])
+  })
+
+  it('keeps an empty partial (does not throw) when page one succeeds but a later page fails', async () => {
+    // Page one is valid but empty with a cursor; page two fails. Page one succeeded, so
+    // discovery must not fail the server — it returns [] rather than throwing.
+    mockSdkListTools
+      .mockResolvedValueOnce({ tools: [], nextCursor: 'c1' })
+      .mockRejectedValueOnce(new Error('page 2 blew up'))
+    const client = new McpClient({
+      config: createConfig(),
+      securityPolicy: { requireConsent: false, auditLevel: 'basic' },
+    })
+
+    await client.connect()
+    await expect(client.listTools()).resolves.toEqual([])
+  })
+
+  it('throws when the very first page fails', async () => {
+    mockSdkListTools.mockRejectedValueOnce(new Error('page 1 blew up'))
+    const client = new McpClient({
+      config: createConfig(),
+      securityPolicy: { requireConsent: false, auditLevel: 'basic' },
+    })
+
+    await client.connect()
+    await expect(client.listTools()).rejects.toThrow()
+  })
+
   it('logs connection diagnostics without header values', async () => {
     const client = new McpClient({
       config: {
@@ -276,7 +350,7 @@ describe('McpClient notification handler', () => {
     const client = new McpClient({
       config: createConfig(),
       securityPolicy: { requireConsent: false, auditLevel: 'basic' },
-      resolvedIP: '203.0.113.10',
+      resolvedIP: '93.184.216.34',
     })
 
     // A failed connect discards the client without a disconnect(), so the Agent
@@ -290,7 +364,7 @@ describe('McpClient notification handler', () => {
     const client = new McpClient({
       config: createConfig(),
       securityPolicy: { requireConsent: false, auditLevel: 'basic' },
-      resolvedIP: '203.0.113.10',
+      resolvedIP: '93.184.216.34',
     })
 
     await client.connect()
@@ -304,7 +378,7 @@ describe('McpClient notification handler', () => {
     const client = new McpClient({
       config: createConfig(),
       securityPolicy: { requireConsent: false, auditLevel: 'basic' },
-      resolvedIP: '203.0.113.10',
+      resolvedIP: '93.184.216.34',
     })
 
     await expect(client.connect()).rejects.toThrow()
diff --git a/apps/sim/lib/mcp/client.ts b/apps/sim/lib/mcp/client.ts
index 80931413320..3e22087c8cf 100644
--- a/apps/sim/lib/mcp/client.ts
+++ b/apps/sim/lib/mcp/client.ts
@@ -5,15 +5,15 @@ import {
   LATEST_PROTOCOL_VERSION,
   type ListToolsResult,
   SUPPORTED_PROTOCOL_VERSIONS,
-  type Tool,
   ToolListChangedNotificationSchema,
 } from '@modelcontextprotocol/sdk/types.js'
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { getMaxExecutionTimeout } from '@/lib/core/execution-limits'
+import { isPrivateOrReservedIP } from '@/lib/core/security/input-validation.server'
 import { getMcpSafeErrorDiagnostics } from '@/lib/mcp/error-diagnostics'
 import { McpOauthRedirectRequired } from '@/lib/mcp/oauth'
-import { createPinnedMcpFetch } from '@/lib/mcp/pinned-fetch'
+import { createGuardedMcpFetch, createPinnedPrivateMcpFetch } from '@/lib/mcp/pinned-fetch'
 import {
   type McpClientOptions,
   McpConnectionError,
@@ -73,7 +73,7 @@ export class McpClient {
   private onToolsChanged?: McpToolsChangedCallback
   private authProvider?: McpClientOptions['authProvider']
   private isConnected = false
-  private closePinnedTransport?: () => Promise<void>
+  private closeGuardedTransport?: () => Promise<void>
 
   constructor(options: McpClientOptions) {
     this.config = options.config
@@ -96,12 +96,21 @@ export class McpClient {
       throw new McpError('OAuth MCP server requires an authProvider')
     }
     const useOauth = this.config.authType === 'oauth'
-    const pinned = resolvedIP ? createPinnedMcpFetch(resolvedIP) : undefined
-    this.closePinnedTransport = pinned?.close
+    // `resolvedIP` non-null signals the SSRF policy is active for this server (it is null in
+    // allowlist mode / localhost-on-self-hosted); the guard validates addresses per-connect.
+    // A private/loopback resolvedIP only reaches here on self-hosted (where the policy
+    // permits it) — the guarded lookup would filter it, so that case keeps the legacy pin
+    // to the validated address (old behavior + its anti-rebinding property).
+    const guarded = resolvedIP
+      ? isPrivateOrReservedIP(resolvedIP)
+        ? createPinnedPrivateMcpFetch(resolvedIP)
+        : createGuardedMcpFetch()
+      : undefined
+    this.closeGuardedTransport = guarded?.close
     this.transport = new StreamableHTTPClientTransport(new URL(this.config.url), {
       authProvider: useOauth ? this.authProvider : undefined,
       requestInit: { headers: this.config.headers },
-      ...(pinned ? { fetch: pinned.fetch } : {}),
+      ...(guarded ? { fetch: guarded.fetch } : {}),
     })
 
     this.client = new Client(
@@ -228,16 +237,16 @@ export class McpClient {
   }
 
   /**
-   * Tears down the pinned transport's HTTP/2 Agent, releasing its sockets. Must run
+   * Tears down the guarded transport's Agent, releasing its sockets. Must run
    * on every terminal path — successful disconnect, and failed or cancelled connect —
    * since a failed `connect()` discards this client without a `disconnect()` call.
    * Idempotent: the handle is cleared before use so repeat calls (a failed connect
    * followed by the caller's `disconnect()`) never destroy the same Agent twice.
    */
   private async closeTransportAgent(): Promise<void> {
-    const close = this.closePinnedTransport
+    const close = this.closeGuardedTransport
     if (!close) return
-    this.closePinnedTransport = undefined
+    this.closeGuardedTransport = undefined
     try {
       await close()
     } catch (error) {
@@ -265,33 +274,98 @@ export class McpClient {
     const maxTotalTimeoutMs = MCP_CLIENT_CONSTANTS.LIST_TOOLS_MAX_TOTAL_TIMEOUT_MS
     const startedAt = Date.now()
 
+    // The SDK's `listTools()` returns a single page; a server that paginates via
+    // `nextCursor` would otherwise be silently truncated to page one. Follow the
+    // cursor, bounded by four independent budgets — pages, tool count, byte size,
+    // and aggregate wall-clock — plus a repeated-cursor guard, since a page cap
+    // alone can't stop a server that returns a fresh cursor with no new tools.
+    const deadline = startedAt + maxTotalTimeoutMs
+    const maxPages = MCP_CLIENT_CONSTANTS.LIST_TOOLS_MAX_PAGES
+    const tools: McpTool[] = []
+    const seenCursors = new Set<string>()
+    let cursor: string | undefined
+    let bytes = 0
+    let pagesFetched = 0
+    let truncated: string | undefined
+    let reachedEnd = false
+
     try {
-      const result: ListToolsResult = await this.client.listTools(undefined, {
-        // resetTimeoutOnProgress only takes effect when onprogress is supplied.
-        timeout: idleTimeoutMs,
-        maxTotalTimeout: maxTotalTimeoutMs,
-        resetTimeoutOnProgress: true,
-        onprogress: (progress) => {
-          logger.debug(`Tool discovery progress from ${this.config.name}`, {
+      for (let page = 0; page < maxPages; page++) {
+        const remainingMs = deadline - Date.now()
+        if (remainingMs <= 0) {
+          truncated = 'aggregate timeout'
+          break
+        }
+        const result: ListToolsResult = await this.client.listTools(
+          cursor ? { cursor } : undefined,
+          {
+            // resetTimeoutOnProgress only takes effect when onprogress is supplied.
+            timeout: Math.min(idleTimeoutMs, remainingMs),
+            maxTotalTimeout: remainingMs,
+            resetTimeoutOnProgress: true,
+            onprogress: (progress) => {
+              logger.debug(`Tool discovery progress from ${this.config.name}`, {
+                serverId: this.config.id,
+                progress: progress.progress,
+                total: progress.total,
+              })
+            },
+          }
+        )
+        pagesFetched++
+
+        if (!result.tools || !Array.isArray(result.tools)) {
+          logger.warn(`Invalid tools response from server ${this.config.name}:`, result)
+          reachedEnd = true
+          break
+        }
+
+        for (const tool of result.tools) {
+          if (tools.length >= MCP_CLIENT_CONSTANTS.LIST_TOOLS_MAX_TOOLS) {
+            truncated = 'tool count'
+            break
+          }
+          bytes += Buffer.byteLength(JSON.stringify(tool), 'utf8')
+          if (bytes > MCP_CLIENT_CONSTANTS.LIST_TOOLS_MAX_BYTES) {
+            truncated = 'byte size'
+            break
+          }
+          tools.push({
+            name: tool.name,
+            description: tool.description,
+            inputSchema: tool.inputSchema as McpTool['inputSchema'],
             serverId: this.config.id,
-            progress: progress.progress,
-            total: progress.total,
+            serverName: this.config.name,
           })
-        },
-      })
+        }
+        if (truncated) break
+
+        const next = result.nextCursor
+        if (!next) {
+          reachedEnd = true
+          break // missing/empty cursor = end of results (spec)
+        }
+        if (seenCursors.has(next)) {
+          truncated = 'repeated cursor'
+          break
+        }
+        seenCursors.add(next)
+        cursor = next
+      }
 
-      if (!result.tools || !Array.isArray(result.tools)) {
-        logger.warn(`Invalid tools response from server ${this.config.name}:`, result)
-        return []
+      // The loop can exhaust `maxPages` with a cursor still pending — that's a page-cap
+      // truncation, distinct from a natural end (`reachedEnd`) or an explicit budget hit.
+      if (!truncated && !reachedEnd) truncated = 'page cap'
+      if (truncated) {
+        logger.warn(`Tool discovery truncated for server ${this.config.name}`, {
+          serverId: this.config.id,
+          reason: truncated,
+          toolsCollected: tools.length,
+          pagesFetched,
+        })
       }
 
-      return result.tools.map((tool: Tool) => ({
-        name: tool.name,
-        description: tool.description,
-        inputSchema: tool.inputSchema as McpTool['inputSchema'],
-        serverId: this.config.id,
-        serverName: this.config.name,
-      }))
+      return tools
     } catch (error) {
       logger.error(`Failed to list tools from server ${this.config.name}`, {
         serverId: this.config.id,
@@ -299,9 +373,14 @@ export class McpClient {
         durationMs: Date.now() - startedAt,
         idleTimeoutMs,
         maxTotalTimeoutMs,
+        pagesFetched,
+        toolsCollected: tools.length,
         sessionIdPresent: Boolean(this.transport.sessionId),
         error: getMcpSafeErrorDiagnostics(error),
       })
+      // At least one page succeeded → keep its (possibly empty) partial result rather than
+      // failing discovery and marking the server unhealthy; only a page-one failure throws.
+      if (pagesFetched > 0) return tools
       throw error
     }
   }
diff --git a/apps/sim/lib/mcp/connection-pool.test.ts b/apps/sim/lib/mcp/connection-pool.test.ts
index 4df677f13e0..9359eceb92e 100644
--- a/apps/sim/lib/mcp/connection-pool.test.ts
+++ b/apps/sim/lib/mcp/connection-pool.test.ts
@@ -83,6 +83,50 @@ describe('McpConnectionPool', () => {
     expect(client.disconnect).not.toHaveBeenCalled()
   })
 
+  it('keeps the connection after a single timeout release', async () => {
+    const client = makeFakeClient()
+    const create = vi.fn(async () => client)
+
+    const lease = await pool.acquire(params('s1:w1:u1', create))
+    await lease.release(false, true)
+    await borrow(pool, params('s1:w1:u1', create))
+
+    expect(create).toHaveBeenCalledTimes(1)
+    expect(client.disconnect).not.toHaveBeenCalled()
+  })
+
+  it('retires the connection after consecutive timeouts (circuit breaker)', async () => {
+    const client = makeFakeClient()
+    const replacement = makeFakeClient()
+    const create = vi.fn<() => Promise<McpClient>>()
+    create.mockResolvedValueOnce(client)
+    create.mockResolvedValue(replacement)
+
+    const l1 = await pool.acquire(params('s1:w1:u1', create))
+    await l1.release(false, true)
+    const l2 = await pool.acquire(params('s1:w1:u1', create))
+    await l2.release(false, true)
+
+    expect(client.disconnect).toHaveBeenCalledTimes(1)
+    const l3 = await pool.acquire(params('s1:w1:u1', create))
+    expect(l3.client).toBe(replacement)
+    await l3.release()
+  })
+
+  it('resets the timeout count on a healthy release', async () => {
+    const client = makeFakeClient()
+    const create = vi.fn(async () => client)
+
+    const l1 = await pool.acquire(params('s1:w1:u1', create))
+    await l1.release(false, true)
+    await borrow(pool, params('s1:w1:u1', create)) // healthy — resets the count
+    const l3 = await pool.acquire(params('s1:w1:u1', create))
+    await l3.release(false, true) // first of a new streak, not the second strike
+
+    expect(client.disconnect).not.toHaveBeenCalled()
+    expect(create).toHaveBeenCalledTimes(1)
+  })
+
   it('dedups concurrent creates into a single connect (single-flight)', async () => {
     let resolveCreate: ((client: McpClient) => void) | undefined
     const created = new Promise<McpClient>((resolve) => {
diff --git a/apps/sim/lib/mcp/connection-pool.ts b/apps/sim/lib/mcp/connection-pool.ts
index 47e162668ca..8eda72cbd3e 100644
--- a/apps/sim/lib/mcp/connection-pool.ts
+++ b/apps/sim/lib/mcp/connection-pool.ts
@@ -32,6 +32,14 @@ const logger = createLogger('McpConnectionPool')
 const MAX_POOL_SIZE = 100
 /** Max lifetime; on expiry the pinned SSRF `resolvedIP` re-resolves. */
 const MAX_CONNECTION_AGE_MS = 10 * 60 * 1000
+/**
+ * Circuit breaker: retire a connection after this many CONSECUTIVE request
+ * timeouts. One timeout is a slow request and keeps the session (retiring on
+ * every timeout causes connect/stall/reconnect churn); repeated timeouts with
+ * no success in between indicate a half-open transport the liveness ping
+ * hasn't caught yet. A healthy release resets the count.
+ */
+const MAX_CONSECUTIVE_TIMEOUTS = 2
 const LIVENESS_TTL_MS = 60 * 1000
 const LIVENESS_PING_TIMEOUT_MS = 5 * 1000
 const IDLE_TIMEOUT_MS = 5 * 60 * 1000
@@ -46,10 +54,14 @@ export interface AcquireParams {
   create: () => Promise<McpClient>
 }
 
-/** A borrowed connection. `release(poison)` must be called exactly once; pass `poison: true` to retire on failure. */
+/**
+ * A borrowed connection. `release(poison, sawTimeout)` must be called exactly once:
+ * `poison: true` retires immediately (dead-connection error); `sawTimeout: true`
+ * counts toward the consecutive-timeout circuit breaker without retiring on its own.
+ */
 export interface ConnectionLease {
   client: McpClient
-  release: (poison?: boolean) => Promise<void>
+  release: (poison?: boolean, sawTimeout?: boolean) => Promise<void>
 }
 
 interface PoolEntry {
@@ -60,6 +72,7 @@ interface PoolEntry {
   lastActivityAt: number
   lastLivenessCheckAt: number
   borrowers: number
+  consecutiveTimeouts: number
   retired: boolean
   closing: boolean
 }
@@ -95,7 +108,10 @@ export class McpConnectionPool {
     while (entry.closing) entry = await this.resolveEntry(params)
     entry.borrowers++
     entry.lastActivityAt = Date.now()
-    return { client: entry.client, release: (poison) => this.release(entry, poison ?? false) }
+    return {
+      client: entry.client,
+      release: (poison, sawTimeout) => this.release(entry, poison ?? false, sawTimeout ?? false),
+    }
   }
 
   private async resolveEntry(params: AcquireParams): Promise<PoolEntry> {
@@ -162,6 +178,7 @@ export class McpConnectionPool {
         lastActivityAt: now,
         lastLivenessCheckAt: now,
         borrowers: 0,
+        consecutiveTimeouts: 0,
         retired: false,
         closing: false,
       }
@@ -194,9 +211,17 @@ export class McpConnectionPool {
     return record.promise
   }
 
-  private async release(entry: PoolEntry, poison: boolean): Promise<void> {
+  private async release(entry: PoolEntry, poison: boolean, sawTimeout: boolean): Promise<void> {
     entry.borrowers = Math.max(0, entry.borrowers - 1)
     entry.lastActivityAt = Date.now()
+    if (sawTimeout) {
+      entry.consecutiveTimeouts++
+      if (entry.consecutiveTimeouts >= MAX_CONSECUTIVE_TIMEOUTS) {
+        this.retire(entry, `${entry.consecutiveTimeouts} consecutive request timeouts`)
+      }
+    } else if (!poison) {
+      entry.consecutiveTimeouts = 0
+    }
     if (poison) this.retire(entry, 'poisoned by failed operation')
     await this.closeIfIdle(entry)
   }
diff --git a/apps/sim/lib/mcp/domain-check.test.ts b/apps/sim/lib/mcp/domain-check.test.ts
index 28f7bab6008..ab0616c6ac2 100644
--- a/apps/sim/lib/mcp/domain-check.test.ts
+++ b/apps/sim/lib/mcp/domain-check.test.ts
@@ -364,12 +364,31 @@ describe('validateMcpServerSsrf', () => {
   })
 
   it('returns resolved IP for URLs that resolve to public IPs', async () => {
-    mockDnsLookup.mockResolvedValue({ address: '93.184.216.34' })
+    mockDnsLookup.mockResolvedValue([{ address: '93.184.216.34', family: 4 }])
     await expect(validateMcpServerSsrf('https://example.com/mcp')).resolves.toBe('93.184.216.34')
   })
 
+  it('prefers IPv4 over IPv6 for a dual-stack host (verbatim returns IPv6 first)', async () => {
+    // Cloudflare-fronted hosts resolve IPv6-first; pinning that IPv6 hangs on an IPv4-only
+    // egress. The guard must pin the reachable IPv4 instead.
+    mockDnsLookup.mockResolvedValue([
+      { address: '2606:4700:3037::ac43:cc5f', family: 6 },
+      { address: '104.21.22.105', family: 4 },
+    ])
+    await expect(validateMcpServerSsrf('https://app.withgauge.com/mcp')).resolves.toBe(
+      '104.21.22.105'
+    )
+  })
+
+  it('pins the sole IPv6 address for an IPv6-only host', async () => {
+    mockDnsLookup.mockResolvedValue([{ address: '2606:4700:3037::ac43:cc5f', family: 6 }])
+    await expect(validateMcpServerSsrf('https://ipv6-only.example/mcp')).resolves.toBe(
+      '2606:4700:3037::ac43:cc5f'
+    )
+  })
+
   it('returns resolved IP for HTTP URLs on non-localhost hosts', async () => {
-    mockDnsLookup.mockResolvedValue({ address: '93.184.216.34' })
+    mockDnsLookup.mockResolvedValue([{ address: '93.184.216.34', family: 4 }])
     await expect(validateMcpServerSsrf('http://example.com:3000/mcp')).resolves.toBe(
       '93.184.216.34'
     )
@@ -405,12 +424,12 @@ describe('validateMcpServerSsrf', () => {
   })
 
   it('throws McpSsrfError for URLs resolving to private IPs', async () => {
-    mockDnsLookup.mockResolvedValue({ address: '10.0.0.5' })
+    mockDnsLookup.mockResolvedValue([{ address: '10.0.0.5', family: 4 }])
     await expect(validateMcpServerSsrf('https://internal.corp/mcp')).rejects.toThrow(McpSsrfError)
   })
 
   it('throws McpSsrfError for URLs resolving to link-local IPs', async () => {
-    mockDnsLookup.mockResolvedValue({ address: '169.254.169.254' })
+    mockDnsLookup.mockResolvedValue([{ address: '169.254.169.254', family: 4 }])
     await expect(validateMcpServerSsrf('https://metadata.internal/latest')).rejects.toThrow(
       McpSsrfError
     )
@@ -424,7 +443,7 @@ describe('validateMcpServerSsrf', () => {
   })
 
   it('returns resolved IP for URLs resolving to loopback on self-hosted (localhost alias)', async () => {
-    mockDnsLookup.mockResolvedValue({ address: '127.0.0.1' })
+    mockDnsLookup.mockResolvedValue([{ address: '127.0.0.1', family: 4 }])
     await expect(validateMcpServerSsrf('http://my-local-alias:3000/mcp')).resolves.toBe('127.0.0.1')
   })
 
@@ -450,14 +469,14 @@ describe('validateMcpServerSsrf', () => {
     })
 
     it('rejects URLs resolving to loopback on hosted', async () => {
-      mockDnsLookup.mockResolvedValue({ address: '127.0.0.1' })
+      mockDnsLookup.mockResolvedValue([{ address: '127.0.0.1', family: 4 }])
       await expect(validateMcpServerSsrf('http://my-local-alias:3000/mcp')).rejects.toThrow(
         McpSsrfError
       )
     })
 
     it('returns resolved IP for public IP resolutions on hosted', async () => {
-      mockDnsLookup.mockResolvedValue({ address: '93.184.216.34' })
+      mockDnsLookup.mockResolvedValue([{ address: '93.184.216.34', family: 4 }])
       await expect(validateMcpServerSsrf('https://example.com/mcp')).resolves.toBe('93.184.216.34')
     })
 
@@ -483,7 +502,7 @@ describe('validateMcpServerSsrf', () => {
     })
 
     it('still blocks DNS resolutions to private IPs on hosted (regression)', async () => {
-      mockDnsLookup.mockResolvedValue({ address: '10.0.0.5' })
+      mockDnsLookup.mockResolvedValue([{ address: '10.0.0.5', family: 4 }])
       await expect(validateMcpServerSsrf('https://internal.corp/mcp')).rejects.toThrow(McpSsrfError)
     })
 
@@ -508,7 +527,7 @@ describe('validateMcpServerSsrf', () => {
     })
 
     it('returns resolved loopback IP for DNS aliases (caller pins)', async () => {
-      mockDnsLookup.mockResolvedValue({ address: '127.0.0.1' })
+      mockDnsLookup.mockResolvedValue([{ address: '127.0.0.1', family: 4 }])
       await expect(validateMcpServerSsrf('http://my-local-alias/mcp')).resolves.toBe('127.0.0.1')
     })
   })
diff --git a/apps/sim/lib/mcp/domain-check.ts b/apps/sim/lib/mcp/domain-check.ts
index d48588ead6b..e04b6f04cc3 100644
--- a/apps/sim/lib/mcp/domain-check.ts
+++ b/apps/sim/lib/mcp/domain-check.ts
@@ -185,8 +185,10 @@ export async function validateMcpServerSsrf(url: string | undefined): Promise<st
 
   let address: string
   try {
-    const lookup = await dns.lookup(cleanHostname, { verbatim: true })
-    address = lookup.address
+    // Prefer IPv4: pinning strips Happy Eyeballs' fallback, and a pinned IPv6 address
+    // (which `verbatim` returns first for dual-stack hosts) hangs on IPv4-only egress.
+    const resolved = await dns.lookup(cleanHostname, { all: true, verbatim: true })
+    address = (resolved.find((entry) => entry.family === 4) ?? resolved[0]).address
   } catch (error) {
     logger.warn('DNS lookup failed for MCP server URL', {
       hostname,
diff --git a/apps/sim/lib/mcp/oauth/revoke.test.ts b/apps/sim/lib/mcp/oauth/revoke.test.ts
index beb3a9dd0ab..1e69c99f8d8 100644
--- a/apps/sim/lib/mcp/oauth/revoke.test.ts
+++ b/apps/sim/lib/mcp/oauth/revoke.test.ts
@@ -31,7 +31,9 @@ const {
 }))
 
 vi.mock('@/lib/core/security/input-validation.server', () => ({
-  createPinnedFetchWithDispatcher: vi.fn(() => ({
+  isPrivateOrReservedIP: (ip: string) =>
+    ip.startsWith('127.') || ip.startsWith('10.') || ip === '::1',
+  createSsrfGuardedFetchWithDispatcher: vi.fn(() => ({
     fetch: mockUndiciFetch,
     dispatcher: { destroy: vi.fn(() => Promise.resolve()) },
   })),
diff --git a/apps/sim/lib/mcp/oauth/storage.ts b/apps/sim/lib/mcp/oauth/storage.ts
index 3db4ffda083..63a567faaf8 100644
--- a/apps/sim/lib/mcp/oauth/storage.ts
+++ b/apps/sim/lib/mcp/oauth/storage.ts
@@ -170,18 +170,22 @@ export async function saveClientInformation(
   info: OAuthClientInformationMixed
 ): Promise<void> {
   const encrypted = await encryptClientInformation(info)
+  logger.info('Persisting MCP OAuth client information', { rowId })
   await db
     .update(mcpServerOauth)
     .set({ clientInformation: encrypted, updatedAt: new Date() })
     .where(eq(mcpServerOauth.id, rowId))
+  logger.info('Persisted MCP OAuth client information', { rowId })
 }
 
 export async function saveTokens(rowId: string, tokens: OAuthTokens): Promise<void> {
   const encrypted = await encryptTokens(tokens)
+  logger.info('Persisting MCP OAuth tokens', { rowId })
   await db
     .update(mcpServerOauth)
     .set({ tokens: encrypted, lastRefreshedAt: new Date(), updatedAt: new Date() })
     .where(eq(mcpServerOauth.id, rowId))
+  logger.info('Persisted MCP OAuth tokens', { rowId })
 }
 
 export async function saveCodeVerifier(rowId: string, verifier: string): Promise<void> {
diff --git a/apps/sim/lib/mcp/pinned-fetch.test.ts b/apps/sim/lib/mcp/pinned-fetch.test.ts
index fc873cfffdd..608499f17b1 100644
--- a/apps/sim/lib/mcp/pinned-fetch.test.ts
+++ b/apps/sim/lib/mcp/pinned-fetch.test.ts
@@ -5,11 +5,13 @@ import { sleep } from '@sim/utils/helpers'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const {
+  mockCreateGuardedFetchWithDispatcher,
   mockCreatePinnedFetchWithDispatcher,
   mockValidateMcpServerSsrf,
   sentinelFetch,
   mockDestroy,
 } = vi.hoisted(() => ({
+  mockCreateGuardedFetchWithDispatcher: vi.fn(),
   mockCreatePinnedFetchWithDispatcher: vi.fn(),
   mockValidateMcpServerSsrf: vi.fn(),
   sentinelFetch: vi.fn(),
@@ -17,36 +19,36 @@ const {
 }))
 
 vi.mock('@/lib/core/security/input-validation.server', () => ({
+  createSsrfGuardedFetchWithDispatcher: mockCreateGuardedFetchWithDispatcher,
   createPinnedFetchWithDispatcher: mockCreatePinnedFetchWithDispatcher,
+  isPrivateOrReservedIP: (ip: string) =>
+    ip.startsWith('127.') || ip.startsWith('10.') || ip === '::1',
 }))
 vi.mock('@/lib/mcp/domain-check', () => ({
   validateMcpServerSsrf: mockValidateMcpServerSsrf,
 }))
 
-import { createPinnedMcpFetch, createSsrfGuardedMcpFetch } from '@/lib/mcp/pinned-fetch'
+import { createGuardedMcpFetch, createSsrfGuardedMcpFetch } from '@/lib/mcp/pinned-fetch'
 
-/** The per-request pinned Agent is always built with a DoS-backstop response cap. */
+/** The per-request guarded Agent is always built with a DoS-backstop response cap. */
 const withResponseCap = expect.objectContaining({ maxResponseSize: expect.any(Number) })
 
-describe('createPinnedMcpFetch', () => {
+describe('createGuardedMcpFetch', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockDestroy.mockResolvedValue(undefined)
-    mockCreatePinnedFetchWithDispatcher.mockReturnValue({
+    mockCreateGuardedFetchWithDispatcher.mockReturnValue({
       fetch: sentinelFetch,
       dispatcher: { destroy: mockDestroy },
     })
   })
 
-  it('builds the transport on HTTP/1.1 — never opts into allowH2 (undici h2 stalls)', () => {
-    const { close } = createPinnedMcpFetch('203.0.113.10')
+  it('builds the transport on the guarded connector with no response cap (streaming)', () => {
+    const { close } = createGuardedMcpFetch()
 
-    // Called with the IP only: no `allowH2`, so the Agent stays on undici's h1.1 default.
-    expect(mockCreatePinnedFetchWithDispatcher).toHaveBeenCalledWith('203.0.113.10')
-    const options = mockCreatePinnedFetchWithDispatcher.mock.calls[0][1] as
-      | { allowH2?: boolean }
-      | undefined
-    expect(options?.allowH2).toBeUndefined()
+    // No options: no `allowH2` opt-in (h1.1 default) and no maxResponseSize —
+    // the long-lived transport must stream unbounded SSE.
+    expect(mockCreateGuardedFetchWithDispatcher).toHaveBeenCalledWith()
 
     // close() tears down the pooled sockets (incl. the long-lived SSE) on disconnect.
     void close()
@@ -58,24 +60,21 @@ describe('createSsrfGuardedMcpFetch', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockDestroy.mockResolvedValue(undefined)
-    mockCreatePinnedFetchWithDispatcher.mockReturnValue({
+    mockCreateGuardedFetchWithDispatcher.mockReturnValue({
       fetch: sentinelFetch,
       dispatcher: { destroy: mockDestroy },
     })
     sentinelFetch.mockImplementation(async () => new Response('ok'))
   })
 
-  it('validates each request URL and pins to the resolved IP', async () => {
+  it('validates each request URL and issues it over the guarded connector', async () => {
     mockValidateMcpServerSsrf.mockResolvedValue('203.0.113.10')
     const fetchLike = createSsrfGuardedMcpFetch()
     await fetchLike('https://attacker.example/revoke', { method: 'POST' })
 
     expect(mockValidateMcpServerSsrf).toHaveBeenCalledWith('https://attacker.example/revoke')
-    // The pinned Agent is always built with the DoS-backstop response-size cap.
-    expect(mockCreatePinnedFetchWithDispatcher).toHaveBeenCalledWith(
-      '203.0.113.10',
-      withResponseCap
-    )
+    // The guarded Agent is always built with the DoS-backstop response-size cap.
+    expect(mockCreateGuardedFetchWithDispatcher).toHaveBeenCalledWith(withResponseCap)
     expect(sentinelFetch).toHaveBeenCalledWith(
       'https://attacker.example/revoke',
       expect.objectContaining({ method: 'POST', signal: expect.any(AbortSignal) })
@@ -258,7 +257,7 @@ describe('createSsrfGuardedMcpFetch', () => {
 
     await expect(fetchLike('https://slow-dns.example/token')).rejects.toThrow(/timed out after 5ms/)
     // Never got past validation, so no request was issued and no Agent was created.
-    expect(mockCreatePinnedFetchWithDispatcher).not.toHaveBeenCalled()
+    expect(mockCreateGuardedFetchWithDispatcher).not.toHaveBeenCalled()
     expect(sentinelFetch).not.toHaveBeenCalled()
     expect(mockDestroy).not.toHaveBeenCalled()
   })
@@ -274,7 +273,7 @@ describe('createSsrfGuardedMcpFetch', () => {
     await expect(
       fetchLike('https://slow.example/token', { signal: controller.signal })
     ).rejects.toThrow('pre-aborted')
-    expect(mockCreatePinnedFetchWithDispatcher).not.toHaveBeenCalled()
+    expect(mockCreateGuardedFetchWithDispatcher).not.toHaveBeenCalled()
     // Let the swallowed validation rejection settle so a leak would surface here.
     await sleep(0)
   })
@@ -288,7 +287,7 @@ describe('createSsrfGuardedMcpFetch', () => {
     controller.abort(new Error('caller cancelled'))
 
     await expect(pending).rejects.toThrow('caller cancelled')
-    expect(mockCreatePinnedFetchWithDispatcher).not.toHaveBeenCalled()
+    expect(mockCreateGuardedFetchWithDispatcher).not.toHaveBeenCalled()
   })
 
   it('propagates a caller-initiated abort unchanged (composed with the deadline)', async () => {
@@ -320,7 +319,7 @@ describe('createSsrfGuardedMcpFetch', () => {
     await expect(
       fetchLike('http://169.254.169.254/latest/meta-data/', { method: 'POST' })
     ).rejects.toThrow('blocked')
-    expect(mockCreatePinnedFetchWithDispatcher).not.toHaveBeenCalled()
+    expect(mockCreateGuardedFetchWithDispatcher).not.toHaveBeenCalled()
     expect(sentinelFetch).not.toHaveBeenCalled()
   })
 
@@ -330,10 +329,7 @@ describe('createSsrfGuardedMcpFetch', () => {
     await fetchLike(new URL('https://attacker.example/discover'))
 
     expect(mockValidateMcpServerSsrf).toHaveBeenCalledWith('https://attacker.example/discover')
-    expect(mockCreatePinnedFetchWithDispatcher).toHaveBeenCalledWith(
-      '203.0.113.10',
-      withResponseCap
-    )
+    expect(mockCreateGuardedFetchWithDispatcher).toHaveBeenCalledWith(withResponseCap)
   })
 
   it('falls back to global fetch when validation returns no IP', async () => {
@@ -345,7 +341,7 @@ describe('createSsrfGuardedMcpFetch', () => {
       const fetchLike = createSsrfGuardedMcpFetch()
       await fetchLike('https://allowed.internal/mcp')
 
-      expect(mockCreatePinnedFetchWithDispatcher).not.toHaveBeenCalled()
+      expect(mockCreateGuardedFetchWithDispatcher).not.toHaveBeenCalled()
       expect(globalFetch).toHaveBeenCalledTimes(1)
       // No pinned Agent was created, so there is nothing to tear down.
       expect(mockDestroy).not.toHaveBeenCalled()
@@ -354,3 +350,24 @@ describe('createSsrfGuardedMcpFetch', () => {
     }
   })
 })
+
+describe('self-hosted private-resolution carve-out', () => {
+  it('keeps the legacy pin for a loopback-resolving host (guarded lookup would filter it)', async () => {
+    // Self-hosted DNS alias -> 127.0.0.1: policy allows it. The guarded lookup would
+    // strand the connect and an unguarded fallback would reopen rebinding — so this case
+    // pins to the validated address, preserving the old behavior and its security property.
+    mockValidateMcpServerSsrf.mockResolvedValue('127.0.0.1')
+    mockCreatePinnedFetchWithDispatcher.mockReturnValue({
+      fetch: sentinelFetch,
+      dispatcher: { destroy: mockDestroy },
+    })
+    sentinelFetch.mockImplementation(async () => new Response('ok'))
+    const fetchLike = createSsrfGuardedMcpFetch()
+    await fetchLike('https://my-local-alias/mcp')
+    expect(mockCreatePinnedFetchWithDispatcher).toHaveBeenCalledWith(
+      '127.0.0.1',
+      expect.objectContaining({ maxResponseSize: expect.any(Number) })
+    )
+    expect(mockCreateGuardedFetchWithDispatcher).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/sim/lib/mcp/pinned-fetch.ts b/apps/sim/lib/mcp/pinned-fetch.ts
index 5cbc4f55758..3a83b783cc1 100644
--- a/apps/sim/lib/mcp/pinned-fetch.ts
+++ b/apps/sim/lib/mcp/pinned-fetch.ts
@@ -1,30 +1,97 @@
 import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js'
+import { createLogger } from '@sim/logger'
 import type { Agent } from 'undici'
-import { createPinnedFetchWithDispatcher } from '@/lib/core/security/input-validation.server'
+import {
+  createPinnedFetchWithDispatcher,
+  createSsrfGuardedFetchWithDispatcher,
+  isPrivateOrReservedIP,
+} from '@/lib/core/security/input-validation.server'
 import { validateMcpServerSsrf } from '@/lib/mcp/domain-check'
 import { McpError } from '@/lib/mcp/types'
 
-/** Pinned fetch for the live MCP transport, plus a handle to release its sockets. */
-export interface PinnedMcpFetch {
+const logger = createLogger('McpOauthFetch')
+const transportLogger = createLogger('McpTransportFetch')
+
+/** SSRF-guarded fetch for the live MCP transport, plus a handle to release its sockets. */
+export interface GuardedMcpFetch {
   fetch: typeof fetch
   /** Tears down the Agent's pooled sockets; call when the MCP client disconnects. */
   close: () => Promise<void>
 }
 
 /**
- * Pinned fetch for the long-lived MCP transport (one Agent reused per connection).
+ * SSRF-guarded fetch for the long-lived MCP transport (one Agent reused per connection).
+ *
+ * DNS resolves normally and EVERY socket connect validates the resolved addresses
+ * against the private/reserved blocklist (validate-at-connect, the LibreChat
+ * pattern), and redirects are followed manually with per-hop validation — an
+ * IP-literal redirect target (which bypasses any connect-time lookup) is checked
+ * explicitly, and custom headers are dropped on cross-origin hops. This replaces
+ * the previous single-IP pin, which no reference MCP client uses and which welded
+ * every request to one address with no fallback.
  *
  * Runs HTTP/1.1: we do not opt into undici's experimental `allowH2`, whose h2 path stalls
  * with headers-but-no-body on reused POST sessions (nodejs/undici #2311, #3433, #4143) —
  * the streamable-HTTP `initialize` hang behind a CDN. Both official MCP SDKs use h1.1, and
  * the transport has no concurrency to gain from h2. `close` tears down pooled sockets
- * (incl. the SSE connection) on disconnect; IP-pinning is protocol-independent.
+ * (incl. the SSE connection) on disconnect.
+ */
+/**
+ * Legacy single-IP pin, kept ONLY for self-hosted private/loopback resolutions
+ * (a DNS alias the policy explicitly permits): the guarded lookup would filter
+ * the address and strand the connect, while an unguarded fallback would reopen
+ * rebinding/redirect escape. Pinning to the validated address preserves the old
+ * behavior and its security property for exactly this carve-out.
  */
-export function createPinnedMcpFetch(resolvedIP: string): PinnedMcpFetch {
+export function createPinnedPrivateMcpFetch(resolvedIP: string): GuardedMcpFetch {
   const { fetch: pinnedFetch, dispatcher } = createPinnedFetchWithDispatcher(resolvedIP)
   return { fetch: pinnedFetch, close: () => dispatcher.destroy() }
 }
 
+export function createGuardedMcpFetch(): GuardedMcpFetch {
+  const { fetch: guardedFetch, dispatcher } = createSsrfGuardedFetchWithDispatcher()
+  // Per-request phase logging: a stalled transport request (e.g. a first `initialize` that hangs
+  // to the client timeout) shows whether it stalls BEFORE response headers ("request" with no
+  // "response headers" = connect/request stall) or AFTER ("response headers" then the SDK's
+  // stream read stalls). Isolates the client-side first-connect stall.
+  const instrumentedFetch: typeof fetch = async (input, init) => {
+    const method = init?.method ?? (input instanceof Request ? input.method : 'GET')
+    const target =
+      typeof input === 'string'
+        ? input
+        : input instanceof URL
+          ? input.href
+          : input instanceof Request
+            ? input.url
+            : String(input)
+    const host = URL.canParse(target) ? new URL(target).host : target
+    const startedAt = Date.now()
+    transportLogger.info('MCP transport request', { host, method })
+    try {
+      const response = await guardedFetch(input, init)
+      transportLogger.info('MCP transport response headers', {
+        host,
+        method,
+        status: response.status,
+        ttfbMs: Date.now() - startedAt,
+      })
+      return response
+    } catch (error) {
+      const e = error as { name?: string; code?: string; cause?: { name?: string; code?: string } }
+      transportLogger.warn('MCP transport request failed', {
+        host,
+        method,
+        ms: Date.now() - startedAt,
+        errorName: e?.name,
+        errorCode: e?.code ?? e?.cause?.code,
+        causeName: e?.cause?.name,
+      })
+      throw error
+    }
+  }
+  return { fetch: instrumentedFetch, close: () => dispatcher.destroy() }
+}
+
 /**
  * Per-request deadline for guarded OAuth / RFC 7009 legs. The MCP SDK sets no timeout on
  * these (only its JSON-RPC layer gets one) and undici's default is 5 minutes, so an
@@ -137,11 +204,13 @@ function releaseStreamOnSettle(
  * Builds a `FetchLike` for one-shot MCP OAuth calls (discovery, dynamic client
  * registration, token exchange/refresh, RFC 7009 revocation). Each hop's URL comes from
  * attacker-controllable authorization-server metadata, so every request is re-validated
- * against the SSRF policy and pinned to the resolved IP.
+ * against the SSRF policy up front (fail fast, friendly errors) AND at socket-connect
+ * time via the guarded lookup, with redirects followed manually under per-hop
+ * validation (IP-literal targets included) and cross-origin header stripping.
  *
  * The SDK provides none of the safety itself (no timeout on OAuth legs, lazy body reads),
  * so the guard owns it: the `timeoutMs` deadline covers validation + request + the buffered
- * body read; the per-request pinned Agent is `destroy()`ed on every path; and the returned
+ * body read; the per-request guarded Agent is `destroy()`ed on every path; and the returned
  * `Response` is a detached in-memory copy. Only our own deadline is relabeled to `McpError`.
  *
  * @param timeoutMs Per-request deadline in ms (defaults to 30s; override for tests).
@@ -151,22 +220,35 @@ function releaseStreamOnSettle(
 export function createSsrfGuardedMcpFetch(timeoutMs: number = OAUTH_FETCH_TIMEOUT_MS): FetchLike {
   return (async (url, init) => {
     const target = typeof url === 'string' ? url : url.href
+    const host = URL.canParse(target) ? new URL(target).host : target
+    const startedAt = Date.now()
     const timeoutSignal = AbortSignal.timeout(timeoutMs)
     // Bound every phase — validation, request, body read — by the deadline + caller signal.
     const signal = init?.signal ? AbortSignal.any([init.signal, timeoutSignal]) : timeoutSignal
     // Per-request Agent must be torn down (finally): a one-shot leg never reuses its socket.
     let dispatcher: Agent | undefined
     try {
+      logger.info('OAuth guarded fetch: validating', { host })
       const resolvedIP = await withDeadline(validateMcpServerSsrf(target), signal)
+      logger.info('OAuth guarded fetch: requesting', { host, guarded: Boolean(resolvedIP) })
       let response: Response
-      if (resolvedIP) {
+      if (resolvedIP && isPrivateOrReservedIP(resolvedIP)) {
+        // Self-hosted private/loopback resolution (policy-permitted): the guarded lookup
+        // would filter the address, and an unguarded fallback would reopen rebinding —
+        // keep the legacy pin to the validated address for exactly this case.
         const pinned = createPinnedFetchWithDispatcher(resolvedIP, {
           maxResponseSize: MAX_OAUTH_RESPONSE_BYTES,
         })
         dispatcher = pinned.dispatcher
         response = await withDeadline(pinned.fetch(url, { ...init, signal }), signal)
+      } else if (resolvedIP) {
+        const guarded = createSsrfGuardedFetchWithDispatcher({
+          maxResponseSize: MAX_OAUTH_RESPONSE_BYTES,
+        })
+        dispatcher = guarded.dispatcher
+        response = await withDeadline(guarded.fetch(url, { ...init, signal }), signal)
       } else {
-        // No pin (self-hosted allowlist) — global fetch over the shared dispatcher.
+        // No guard (self-hosted allowlist / localhost carve-out) — global fetch as before.
         response = await withDeadline(globalThis.fetch(url, { ...init, signal }), signal)
       }
       // The probe's `initialize` can stream (text/event-stream); hand it back live so the
@@ -175,11 +257,23 @@ export function createSsrfGuardedMcpFetch(timeoutMs: number = OAUTH_FETCH_TIMEOU
       if (contentType.includes('text/event-stream')) {
         const streamed = releaseStreamOnSettle(response, dispatcher, signal)
         dispatcher = undefined // teardown ownership moved to releaseStreamOnSettle
+        logger.info('OAuth guarded fetch: streaming response', {
+          host,
+          status: response.status,
+          ms: Date.now() - startedAt,
+        })
         return streamed
       }
-      return await bufferUnderDeadline(response, signal)
+      logger.info('OAuth guarded fetch: reading body', { host, status: response.status })
+      const buffered = await bufferUnderDeadline(response, signal)
+      logger.info('OAuth guarded fetch: done', {
+        host,
+        status: response.status,
+        ms: Date.now() - startedAt,
+      })
+      return buffered
     } catch (error) {
-      const host = URL.canParse(target) ? new URL(target).host : target
+      logger.warn('OAuth guarded fetch: failed', { host, ms: Date.now() - startedAt })
       // Relabel only our own deadline — by reason identity, not signal state (which may
       // abort independently just after the deadline).
       if (timeoutSignal.aborted && error === timeoutSignal.reason) {
diff --git a/apps/sim/lib/mcp/service-pool.test.ts b/apps/sim/lib/mcp/service-pool.test.ts
index bb614710d05..be7fb6de847 100644
--- a/apps/sim/lib/mcp/service-pool.test.ts
+++ b/apps/sim/lib/mcp/service-pool.test.ts
@@ -134,7 +134,7 @@ describe('McpService connection reuse wiring', () => {
       expect.objectContaining({ key: `server-1:${WORKSPACE_ID}:${USER_ID}`, serverId: 'server-1' })
     )
     expect(mockCallTool).toHaveBeenCalledTimes(1)
-    expect(mockRelease).toHaveBeenCalledWith(false)
+    expect(mockRelease).toHaveBeenCalledWith(false, false)
     expect(poolClient.disconnect).not.toHaveBeenCalled()
     // A pool hit must not re-resolve env vars (acquire never invoked `create`).
     expect(mockResolveEnvVars).not.toHaveBeenCalled()
@@ -158,7 +158,7 @@ describe('McpService connection reuse wiring', () => {
       mcpService.executeTool(USER_ID, 'server-1', { name: 'do', arguments: {} }, WORKSPACE_ID)
     ).rejects.toThrow()
 
-    expect(mockRelease).toHaveBeenCalledWith(true)
+    expect(mockRelease).toHaveBeenCalledWith(true, false)
   })
 
   it('keeps the pooled connection warm on a benign (non-connection) tool error', async () => {
@@ -168,7 +168,37 @@ describe('McpService connection reuse wiring', () => {
       mcpService.executeTool(USER_ID, 'server-1', { name: 'do', arguments: {} }, WORKSPACE_ID)
     ).rejects.toThrow()
 
-    expect(mockRelease).toHaveBeenCalledWith(false)
+    expect(mockRelease).toHaveBeenCalledWith(false, false)
+  })
+
+  it('keeps the pooled connection warm on a request timeout (does not retire the session)', async () => {
+    // A streamable-HTTP request timeout aborts only that request's stream; the session stays
+    // healthy for the next request, so a timeout must NOT poison the lease (matches every
+    // production MCP client and avoids a connect/stall/reconnect churn loop). It DOES report
+    // sawTimeout so the pool's consecutive-timeout circuit breaker can retire a half-open
+    // transport after repeated strikes.
+    mockCallTool.mockRejectedValue(new Error('Request timed out'))
+
+    await expect(
+      mcpService.executeTool(USER_ID, 'server-1', { name: 'do', arguments: {} }, WORKSPACE_ID)
+    ).rejects.toThrow()
+
+    expect(mockRelease).toHaveBeenCalledWith(false, true)
+  })
+
+  it('classifies an AbortSignal.timeout-shaped TimeoutError as a timeout for the breaker', async () => {
+    // DOMException name 'TimeoutError' with a message that lacks "timed out".
+    mockCallTool.mockRejectedValue(
+      Object.assign(new Error('The operation was aborted due to timeout'), {
+        name: 'TimeoutError',
+      })
+    )
+
+    await expect(
+      mcpService.executeTool(USER_ID, 'server-1', { name: 'do', arguments: {} }, WORKSPACE_ID)
+    ).rejects.toThrow()
+
+    expect(mockRelease).toHaveBeenCalledWith(false, true)
   })
 
   it('poisons the lease on an auth failure so a rotated credential is re-resolved', async () => {
@@ -178,7 +208,7 @@ describe('McpService connection reuse wiring', () => {
       mcpService.executeTool(USER_ID, 'server-1', { name: 'do', arguments: {} }, WORKSPACE_ID)
     ).rejects.toThrow()
 
-    expect(mockRelease).toHaveBeenCalledWith(true)
+    expect(mockRelease).toHaveBeenCalledWith(true, false)
   })
 
   it('retries and recovers when a rotated credential causes a one-off auth failure', async () => {
@@ -196,7 +226,7 @@ describe('McpService connection reuse wiring', () => {
     expect(result).toEqual({ content: [] })
     expect(mockCallTool).toHaveBeenCalledTimes(2)
     // First attempt poisoned the stale lease; the retry re-acquired a fresh one.
-    expect(mockRelease).toHaveBeenCalledWith(true)
+    expect(mockRelease).toHaveBeenCalledWith(true, false)
     expect(mockAcquire).toHaveBeenCalledTimes(2)
   })
 })
diff --git a/apps/sim/lib/mcp/service.ts b/apps/sim/lib/mcp/service.ts
index e95d3269437..d4ef715b8e2 100644
--- a/apps/sim/lib/mcp/service.ts
+++ b/apps/sim/lib/mcp/service.ts
@@ -93,15 +93,28 @@ function isTimeoutError(error: unknown): boolean {
   if (error instanceof McpError && error.code === ErrorCode.RequestTimeout) {
     return true
   }
+  // AbortSignal.timeout / undici surface a DOMException named TimeoutError whose
+  // message ("The operation was aborted due to timeout") lacks "timed out".
+  const e = error as { name?: string; cause?: { name?: string } } | null
+  if (e?.name === 'TimeoutError' || e?.cause?.name === 'TimeoutError') {
+    return true
+  }
   return getErrorMessage(error, '').toLowerCase().includes('timed out')
 }
 
 /**
  * A pooled connection is dead and must be retired so the caller's retry rebuilds
  * fresh: a stale session (400/404), an auth failure (401 — a rotated/revoked
- * credential; the rebuild re-resolves it), a closed transport, a timeout (no
- * response — possibly wedged), or a reset socket. Benign tool/consent errors and
- * healthy upstream responses (429/5xx) keep the connection warm.
+ * credential; the rebuild re-resolves it), a closed transport, or a reset socket.
+ *
+ * A request timeout is deliberately NOT dead: streamable-HTTP aborts only that
+ * request's own POST stream, leaving the session healthy for the next request, so
+ * every production MCP client (SDK, OpenCode, LibreChat) rejects the request and
+ * keeps the connection rather than tearing it down. Retiring on a timeout instead
+ * forced a full reconnect on the next discovery — and a fresh connect can stall on
+ * our end far longer than a warm request — turning one slow response into a
+ * connect/stall/reconnect churn loop. Benign tool/consent errors and healthy
+ * upstream responses (429/5xx) also keep the connection warm.
  */
 function isDeadConnectionError(error: unknown): boolean {
   if (error instanceof UnauthorizedError) {
@@ -113,9 +126,6 @@ function isDeadConnectionError(error: unknown): boolean {
   if (error instanceof McpError && error.code === ErrorCode.ConnectionClosed) {
     return true
   }
-  if (isTimeoutError(error)) {
-    return true
-  }
   const message = getErrorMessage(error, '').toLowerCase()
   return (
     message.includes('econnreset') ||
@@ -421,13 +431,17 @@ class McpService {
         create,
       })
       let poison = false
+      let sawTimeout = false
       try {
         return await fn(lease.client)
       } catch (error) {
         poison = isDeadConnectionError(error)
+        // A lone timeout keeps the session; the pool's circuit breaker retires it
+        // after consecutive timeouts with no healthy request in between.
+        sawTimeout = isTimeoutError(error)
         throw error
       } finally {
-        await lease.release(poison)
+        await lease.release(poison, sawTimeout)
       }
     }
 
diff --git a/apps/sim/lib/mcp/utils.ts b/apps/sim/lib/mcp/utils.ts
index 2f04d3039c3..8e64ee476c0 100644
--- a/apps/sim/lib/mcp/utils.ts
+++ b/apps/sim/lib/mcp/utils.ts
@@ -55,6 +55,12 @@ export const MCP_CLIENT_CONSTANTS = {
   LIST_TOOLS_TIMEOUT_MS: 30_000,
   /** Hard ceiling for tools/list regardless of progress (SDK maxTotalTimeout safeguard). */
   LIST_TOOLS_MAX_TOTAL_TIMEOUT_MS: 60_000,
+  /** Max `tools/list` pages followed via `nextCursor` before truncating (see fetch loop). */
+  LIST_TOOLS_MAX_PAGES: 50,
+  /** Max tools aggregated across all pages before truncating. */
+  LIST_TOOLS_MAX_TOOLS: 1000,
+  /** Max total tool-payload bytes aggregated across all pages before truncating. */
+  LIST_TOOLS_MAX_BYTES: 5 * 1024 * 1024,
   FAILURE_CACHE_TTL_MS: 120_000,
 } as const
 
diff --git a/apps/sim/lib/permission-groups/types.ts b/apps/sim/lib/permission-groups/types.ts
index 67674171af0..3b1a9049bfe 100644
--- a/apps/sim/lib/permission-groups/types.ts
+++ b/apps/sim/lib/permission-groups/types.ts
@@ -1,7 +1,10 @@
 import { z } from 'zod'
 import type { ShareAuthType } from '@/lib/api/contracts/public-shares'
 
-/** Auth modes a public file share can use; admins may restrict the allowed subset. */
+/**
+ * Auth modes a public file share or a chat deployment can use; admins may
+ * restrict the allowed subset. The two surfaces share the same four modes.
+ */
 export const FILE_SHARE_AUTH_TYPES = ['public', 'password', 'email', 'sso'] as const
 
 export const PERMISSION_GROUP_CONSTRAINTS = {
@@ -41,7 +44,7 @@ export const permissionGroupConfigSchema = z.object({
   hideDeployApi: z.boolean().optional(),
   hideDeployMcp: z.boolean().optional(),
   hideDeployChatbot: z.boolean().optional(),
-  hideDeployTemplate: z.boolean().optional(),
+  allowedChatDeployAuthTypes: z.array(z.enum(FILE_SHARE_AUTH_TYPES)).nullable().optional(),
 })
 
 export interface PermissionGroupConfig {
@@ -79,7 +82,8 @@ export interface PermissionGroupConfig {
   hideDeployApi: boolean
   hideDeployMcp: boolean
   hideDeployChatbot: boolean
-  hideDeployTemplate: boolean
+  /** Allowed chat-deployment auth modes; `null` means all are allowed. */
+  allowedChatDeployAuthTypes: ShareAuthType[] | null
 }
 
 export const DEFAULT_PERMISSION_GROUP_CONFIG: PermissionGroupConfig = {
@@ -106,7 +110,7 @@ export const DEFAULT_PERMISSION_GROUP_CONFIG: PermissionGroupConfig = {
   hideDeployApi: false,
   hideDeployMcp: false,
   hideDeployChatbot: false,
-  hideDeployTemplate: false,
+  allowedChatDeployAuthTypes: null,
 }
 
 export function parsePermissionGroupConfig(config: unknown): PermissionGroupConfig {
@@ -150,6 +154,10 @@ export function parsePermissionGroupConfig(config: unknown): PermissionGroupConf
     hideDeployApi: typeof c.hideDeployApi === 'boolean' ? c.hideDeployApi : false,
     hideDeployMcp: typeof c.hideDeployMcp === 'boolean' ? c.hideDeployMcp : false,
     hideDeployChatbot: typeof c.hideDeployChatbot === 'boolean' ? c.hideDeployChatbot : false,
-    hideDeployTemplate: typeof c.hideDeployTemplate === 'boolean' ? c.hideDeployTemplate : false,
+    allowedChatDeployAuthTypes: Array.isArray(c.allowedChatDeployAuthTypes)
+      ? c.allowedChatDeployAuthTypes.filter((t): t is ShareAuthType =>
+          (FILE_SHARE_AUTH_TYPES as readonly string[]).includes(t as string)
+        )
+      : null,
   }
 }
diff --git a/apps/sim/lib/posthog/events.ts b/apps/sim/lib/posthog/events.ts
index c6d0a8f09ea..abef034dcd7 100644
--- a/apps/sim/lib/posthog/events.ts
+++ b/apps/sim/lib/posthog/events.ts
@@ -500,6 +500,10 @@ export interface PostHogEventMap {
     workspace_id: string
   }
 
+  task_restored: {
+    workspace_id: string
+  }
+
   task_forked: {
     workspace_id: string
     source_chat_id: string
diff --git a/apps/sim/lib/webhooks/deploy.test.ts b/apps/sim/lib/webhooks/deploy.test.ts
index c5a96499b86..8409705850d 100644
--- a/apps/sim/lib/webhooks/deploy.test.ts
+++ b/apps/sim/lib/webhooks/deploy.test.ts
@@ -62,6 +62,23 @@ const tableTrigger = trigger([
   { id: 'manualTableId', mode: 'trigger-advanced', canonicalParamId: 'tableId', required: true },
 ])
 
+const slackTrigger = trigger([
+  { id: 'eventType', mode: 'trigger', required: true },
+  {
+    id: 'customBotCredential',
+    mode: 'trigger',
+    canonicalParamId: 'botCredential',
+    serviceId: 'slack',
+    required: true,
+  },
+  {
+    id: 'manualBotCredential',
+    mode: 'trigger-advanced',
+    canonicalParamId: 'botCredential',
+    required: true,
+  },
+])
+
 function makeBlock(
   type: string,
   subBlockValues: Record<string, unknown>,
@@ -155,6 +172,28 @@ describe('buildProviderConfig canonical collapse', () => {
     const { providerConfig } = buildProviderConfig(block, 'table_new_row', tableTrigger)
     expect(providerConfig.tableId).toBe('ACTIVE')
   })
+
+  it('collapses the slack bot credential pair under botCredential for the routing branch', () => {
+    const block = makeBlock('slack_v2', {
+      eventType: 'message',
+      customBotCredential: 'cred_bot_1',
+    })
+    const result = buildProviderConfig(block, 'slack_oauth', slackTrigger)
+
+    expect(result.providerConfig.botCredential).toBe('cred_bot_1')
+    expect(result.providerConfig.eventType).toBe('message')
+    // The slack trigger has no generic triggerCredentials field — the routing
+    // branch resolves botCredential itself.
+    expect(result.credentialReference).toBeUndefined()
+    expect(result.credentialServiceId).toBeUndefined()
+  })
+
+  it('reports a missing required slack bot credential as a missing field', () => {
+    const block = makeBlock('slack_v2', { eventType: 'message' })
+    const result = buildProviderConfig(block, 'slack_oauth', slackTrigger)
+
+    expect(result.missingFields.length).toBeGreaterThan(0)
+  })
 })
 
 describe('resolveTriggerCredentialId', () => {
diff --git a/apps/sim/lib/webhooks/deploy.ts b/apps/sim/lib/webhooks/deploy.ts
index d667f0391d5..1678159e2f7 100644
--- a/apps/sim/lib/webhooks/deploy.ts
+++ b/apps/sim/lib/webhooks/deploy.ts
@@ -1,5 +1,5 @@
 import { db } from '@sim/db'
-import { account, credential, webhook, workflowDeploymentVersion } from '@sim/db/schema'
+import { credential, webhook, workflowDeploymentVersion } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { generateShortId } from '@sim/utils/id'
@@ -15,7 +15,6 @@ import {
   projectDesiredWebhookProviderConfig,
 } from '@/lib/webhooks/provider-subscriptions'
 import { getProviderHandler } from '@/lib/webhooks/providers'
-import { fetchSlackTeamId } from '@/lib/webhooks/providers/slack'
 import {
   prepareStableWebhookRegistrations,
   type StableDesiredWebhookRegistration,
@@ -27,17 +26,12 @@ import {
   isCanonicalPair,
   resolveActiveCanonicalValue,
 } from '@/lib/workflows/subblocks/visibility'
-import {
-  getSlackBotCredential,
-  refreshAccessTokenIfNeeded,
-  resolveOAuthAccountId,
-} from '@/app/api/auth/oauth/utils'
+import { getSlackBotCredential } from '@/app/api/auth/oauth/utils'
 import { getBlock } from '@/blocks'
 import type { SubBlockConfig } from '@/blocks/types'
 import type { BlockState } from '@/stores/workflows/workflow/types'
 import { getTrigger, isTriggerValid } from '@/triggers'
 import { SYSTEM_SUBBLOCK_IDS } from '@/triggers/constants'
-import { SIM_SUBSCRIBED_EVENTS } from '@/triggers/slack/shared'
 
 const logger = createLogger('DeployWebhookSync')
 
@@ -431,106 +425,43 @@ async function resolveWebhookConfigForBlock(input: {
   let effectivePath: string | null = triggerPath
   let routingKey: string | null = null
   if (triggerId === 'slack_oauth') {
-    const appType = typeof providerConfig.appType === 'string' ? providerConfig.appType : 'custom'
-    if (appType === 'sim') {
-      const eventType =
-        typeof providerConfig.eventType === 'string' ? providerConfig.eventType : null
-      if (eventType && !SIM_SUBSCRIBED_EVENTS.includes(eventType)) {
-        return {
-          success: false,
-          error: {
-            message:
-              'This event is not available on the Sim Slack app. Use a custom app or choose a supported event.',
-            status: 400,
-          },
-        }
-      }
-      if (!credentialId) {
-        return {
-          success: false,
-          error: { message: 'Select a Slack account for the trigger.', status: 400 },
-        }
-      }
-
-      let tokenOwnerUserId = input.userId
-      const resolvedAccount = await resolveOAuthAccountId(credentialId)
-      if (resolvedAccount?.accountId) {
-        const [owner] = await db
-          .select({ userId: account.userId })
-          .from(account)
-          .where(eq(account.id, resolvedAccount.accountId))
-          .limit(1)
-        if (owner?.userId) tokenOwnerUserId = owner.userId
-      }
-      const botToken = await refreshAccessTokenIfNeeded(
-        credentialId,
-        tokenOwnerUserId,
-        input.requestId
-      )
-      if (!botToken) {
-        return {
-          success: false,
-          error: {
-            message: 'Could not access the connected Slack account. Reconnect it and try again.',
-            status: 400,
-          },
-        }
-      }
-      try {
-        const { teamId, userId: botUserId } = await fetchSlackTeamId(botToken)
-        routingKey = teamId
-        if (botUserId) providerConfig.bot_user_id = botUserId
-      } catch (error: unknown) {
-        logger.error(
-          `[${input.requestId}] Slack team_id resolution failed for ${input.block.id}`,
-          error
-        )
-        return {
-          success: false,
-          error: {
-            message: 'Could not verify the connected Slack workspace. Reconnect it and try again.',
-            status: 400,
-          },
-        }
-      }
-      effectiveProvider = 'slack_app'
-      effectivePath = null
-    } else {
-      const botCredentialId =
-        typeof providerConfig.botCredential === 'string' ? providerConfig.botCredential : undefined
-      if (!botCredentialId) {
-        return {
-          success: false,
-          error: { message: 'Select a Slack bot credential for the trigger.', status: 400 },
-        }
+    // Custom-bot only: events route by the bot credential to one shared ingest
+    // URL verified with the bot's own signing secret. The native Sim-app path
+    // (team_id routing via the official app) is intentionally not supported yet.
+    const botCredentialId =
+      typeof providerConfig.botCredential === 'string' ? providerConfig.botCredential : undefined
+    if (!botCredentialId) {
+      return {
+        success: false,
+        error: { message: 'Select a Slack bot credential for the trigger.', status: 400 },
       }
-      const botCredential = await getSlackBotCredential(botCredentialId)
-      if (!botCredential) {
-        return {
-          success: false,
-          error: {
-            message: 'The selected Slack bot credential is missing or invalid. Reconnect it.',
-            status: 400,
-          },
-        }
+    }
+    const botCredential = await getSlackBotCredential(botCredentialId)
+    if (!botCredential) {
+      return {
+        success: false,
+        error: {
+          message: 'The selected Slack bot credential is missing or invalid. Reconnect it.',
+          status: 400,
+        },
       }
-      const workflowWorkspace =
-        typeof input.workflow.workspaceId === 'string' ? input.workflow.workspaceId : undefined
-      if (!workflowWorkspace || botCredential.workspaceId !== workflowWorkspace) {
-        return {
-          success: false,
-          error: {
-            message: 'The selected Slack bot credential is not available in this workspace.',
-            status: 400,
-          },
-        }
+    }
+    const workflowWorkspace =
+      typeof input.workflow.workspaceId === 'string' ? input.workflow.workspaceId : undefined
+    if (!workflowWorkspace || botCredential.workspaceId !== workflowWorkspace) {
+      return {
+        success: false,
+        error: {
+          message: 'The selected Slack bot credential is not available in this workspace.',
+          status: 400,
+        },
       }
-      effectiveProvider = 'slack'
-      effectivePath = null
-      routingKey = botCredentialId
-      providerConfig.credentialId = botCredentialId
-      if (botCredential.botUserId) providerConfig.bot_user_id = botCredential.botUserId
     }
+    effectiveProvider = 'slack'
+    effectivePath = null
+    routingKey = botCredentialId
+    providerConfig.credentialId = botCredentialId
+    if (botCredential.botUserId) providerConfig.bot_user_id = botCredential.botUserId
   }
 
   return {
diff --git a/apps/sim/lib/webhooks/registration-store.test.ts b/apps/sim/lib/webhooks/registration-store.test.ts
index 204580b899b..bcb54a43e79 100644
--- a/apps/sim/lib/webhooks/registration-store.test.ts
+++ b/apps/sim/lib/webhooks/registration-store.test.ts
@@ -25,11 +25,18 @@ vi.mock('@sim/db', () => ({
 vi.mock('drizzle-orm', () => ({
   and: (...conditions: Condition[]) => ({ kind: 'and', conditions }),
   eq: (column: unknown, value: unknown) => ({ kind: 'eq', column, value }),
+  exists: (subquery: unknown) => ({ kind: 'exists', subquery }),
   gt: (column: unknown, value: unknown) => ({ kind: 'gt', column, value }),
   inArray: (column: unknown, value: unknown) => ({ kind: 'inArray', column, value }),
   isNull: (column: unknown) => ({ kind: 'isNull', column }),
   lt: (column: unknown, value: unknown) => ({ kind: 'lt', column, value }),
   lte: (column: unknown, value: unknown) => ({ kind: 'lte', column, value }),
+  notExists: (subquery: unknown) => ({ kind: 'notExists', subquery }),
+  sql: (strings: TemplateStringsArray, ...values: unknown[]) => ({
+    kind: 'sql',
+    strings: [...strings],
+    values,
+  }),
 }))
 
 vi.mock('@/lib/webhooks/provider-subscriptions', () => ({
@@ -42,6 +49,7 @@ vi.mock('@/lib/webhooks/path-claims', () => ({
 
 vi.mock('@/lib/workflows/persistence/deployment-operations', () => ({
   isDeploymentOperationCurrent: mockIsDeploymentOperationCurrent,
+  setDeploymentTxTimeouts: vi.fn(),
 }))
 
 import type { DbOrTx } from '@sim/workflow-persistence/types'
@@ -182,22 +190,22 @@ describe('activateWebhookRegistrations', () => {
 
     await activateWebhookRegistrations(tx, FENCE)
 
-    expect(updates).toHaveLength(3)
-    expect(updates[0].payload).toEqual(
-      expect.objectContaining({ registrationStatus: 'retired', isActive: false })
+    expect(updates).toHaveLength(2)
+    /**
+     * Retire + repoint fold into one generation-conditional statement over
+     * the active rows: every mutated column is a CASE keyed on the fence
+     * generation, and the WHERE covers both phases via lte.
+     */
+    expect(updates[0].payload.registrationStatus).toEqual(expect.objectContaining({ kind: 'sql' }))
+    expect(updates[0].payload.deploymentVersionId).toEqual(
+      expect.objectContaining({ kind: 'sql', values: expect.arrayContaining(['version-3']) })
     )
-    expect(updates[0].payload.archivedAt).toBeInstanceOf(Date)
-    expect(JSON.stringify(updates[0].condition)).toContain('"lt"')
+    expect(updates[0].payload.isActive).toEqual(expect.objectContaining({ kind: 'sql' }))
+    expect(updates[0].payload.archivedAt).toEqual(expect.objectContaining({ kind: 'sql' }))
+    expect(updates[0].payload.updatedAt).toBeInstanceOf(Date)
+    expect(JSON.stringify(updates[0].condition)).toContain('"lte"')
 
     expect(updates[1].payload).toEqual(
-      expect.objectContaining({
-        deploymentVersionId: 'version-3',
-        isActive: true,
-        archivedAt: null,
-      })
-    )
-
-    expect(updates[2].payload).toEqual(
       expect.objectContaining({
         registrationStatus: 'active',
         deploymentVersionId: 'version-3',
diff --git a/apps/sim/lib/webhooks/registration-store.ts b/apps/sim/lib/webhooks/registration-store.ts
index 2754a89de94..eeeb1e350f6 100644
--- a/apps/sim/lib/webhooks/registration-store.ts
+++ b/apps/sim/lib/webhooks/registration-store.ts
@@ -1,9 +1,14 @@
 import { db } from '@sim/db'
-import { webhook, workflow, workflowDeploymentVersion } from '@sim/db/schema'
+import {
+  webhook,
+  workflow,
+  workflowDeploymentOperation,
+  workflowDeploymentVersion,
+} from '@sim/db/schema'
 import { generateShortId } from '@sim/utils/id'
 import { isPlainRecord } from '@sim/utils/object'
 import type { DbOrTx } from '@sim/workflow-persistence/types'
-import { and, eq, gt, inArray, isNull, lt, lte } from 'drizzle-orm'
+import { and, eq, exists, gt, inArray, isNull, lt, lte, notExists, sql } from 'drizzle-orm'
 import { claimWebhookPath } from '@/lib/webhooks/path-claims'
 import { projectDesiredWebhookProviderConfig } from '@/lib/webhooks/provider-subscriptions'
 import {
@@ -12,7 +17,10 @@ import {
 } from '@/lib/webhooks/registration-identity'
 import { planWebhookRegistrationReconciliation } from '@/lib/webhooks/registration-reconciliation'
 import type { DeploymentOperationStatus } from '@/lib/workflows/deployment-lifecycle'
-import { isDeploymentOperationCurrent } from '@/lib/workflows/persistence/deployment-operations'
+import {
+  isDeploymentOperationCurrent,
+  setDeploymentTxTimeouts,
+} from '@/lib/workflows/persistence/deployment-operations'
 
 export type WebhookRegistrationRow = typeof webhook.$inferSelect
 export type WebhookRegistrationStatus = 'active' | 'candidate' | 'retired' | 'orphaned'
@@ -216,6 +224,7 @@ export async function prepareWebhookRegistrationIntents(input: {
   desired: readonly DesiredWebhookRegistrationIntent[]
 }): Promise<PreparedWebhookRegistrationWork> {
   return db.transaction(async (tx) => {
+    await setDeploymentTxTimeouts(tx)
     await assertCurrentOperation(tx, input.fence, ['preparing'])
     await adoptLegacyActiveRows(tx, input.fence)
 
@@ -398,35 +407,82 @@ export async function prepareWebhookRegistrationIntents(input: {
   })
 }
 
-/** Checkpoints provider-managed candidate state under the operation and generation fences. */
+/**
+ * Predicate asserting the fence's operation is still the workflow's current
+ * preparing attempt, evaluated inside the same statement that carries it.
+ * Mirrors `isDeploymentOperationCurrent` (exact operation identity + no newer
+ * generation) without a separate round trip or the workflow-row lock.
+ */
+function currentPreparingOperationPredicate(fence: WebhookRegistrationOperationFence) {
+  return and(
+    exists(
+      db
+        .select({ id: workflowDeploymentOperation.id })
+        .from(workflowDeploymentOperation)
+        .where(
+          and(
+            eq(workflowDeploymentOperation.id, fence.operationId),
+            eq(workflowDeploymentOperation.workflowId, fence.workflowId),
+            eq(workflowDeploymentOperation.generation, fence.generation),
+            eq(workflowDeploymentOperation.deploymentVersionId, fence.deploymentVersionId),
+            eq(workflowDeploymentOperation.status, 'preparing')
+          )
+        )
+    ),
+    notExists(
+      db
+        .select({ id: workflowDeploymentOperation.id })
+        .from(workflowDeploymentOperation)
+        .where(
+          and(
+            eq(workflowDeploymentOperation.workflowId, fence.workflowId),
+            gt(workflowDeploymentOperation.generation, fence.generation)
+          )
+        )
+    )
+  )
+}
+
+/**
+ * Checkpoints provider-managed candidate state under the operation and
+ * generation fences.
+ *
+ * Runs as ONE fenced UPDATE — no transaction and no workflow-row lock. This
+ * is the hottest write on the deployment path (it follows every external
+ * provider call), so it must not hold locks across client round trips. The
+ * row fence (`candidate` + exact generation) is the authoritative guard: any
+ * newer preparation either adopts the row (bumping its generation) or orphans
+ * it (flipping its status) before touching provider state, so a stale
+ * checkpoint can never match. The operation-currency predicate rejects writes
+ * from superseded attempts up front.
+ */
 export async function checkpointWebhookCandidate(input: {
   fence: WebhookRegistrationOperationFence
   webhookId: string
   providerConfig: Record<string, unknown>
   prepared?: boolean
 }): Promise<WebhookRegistrationRow> {
-  return db.transaction(async (tx) => {
-    await assertCurrentOperation(tx, input.fence, ['preparing'])
-    const now = new Date()
-    const [updated] = await tx
-      .update(webhook)
-      .set({
-        providerConfig: input.providerConfig,
-        ...(input.prepared === false ? {} : { preparedAt: now }),
-        updatedAt: now,
-      })
-      .where(
-        and(
-          eq(webhook.id, input.webhookId),
-          eq(webhook.workflowId, input.fence.workflowId),
-          eq(webhook.registrationStatus, 'candidate'),
-          eq(webhook.registrationGeneration, input.fence.generation)
-        )
+  assertOperationGeneration(input.fence.generation)
+  const now = new Date()
+  const [updated] = await db
+    .update(webhook)
+    .set({
+      providerConfig: input.providerConfig,
+      ...(input.prepared === false ? {} : { preparedAt: now }),
+      updatedAt: now,
+    })
+    .where(
+      and(
+        eq(webhook.id, input.webhookId),
+        eq(webhook.workflowId, input.fence.workflowId),
+        eq(webhook.registrationStatus, 'candidate'),
+        eq(webhook.registrationGeneration, input.fence.generation),
+        currentPreparingOperationPredicate(input.fence)
       )
-      .returning()
-    if (!updated) throw new StaleWebhookRegistrationOperationError()
-    return updated
-  })
+    )
+    .returning()
+  if (!updated) throw new StaleWebhookRegistrationOperationError()
+  return updated
 }
 
 /**
@@ -469,36 +525,32 @@ export async function activateWebhookRegistrations(
     .limit(1)
   if (newerRows.length > 0) throw new StaleWebhookRegistrationOperationError()
 
+  /**
+   * Retire (generation < fence) and repoint (generation = fence) touch
+   * disjoint subsets of the active rows, so they fold into one statement.
+   * Promotion of candidates stays a SEPARATE statement below: promoting a
+   * candidate inserts a live entry into the non-deferrable partial unique
+   * index `webhook_active_registration_unique` for the same (workflowId,
+   * blockId) the retired row is vacating, and a single statement offers no
+   * ordering guarantee between those two row versions — retire must be fully
+   * applied first.
+   */
   const now = new Date()
+  const isCurrentGeneration = sql`${webhook.registrationGeneration} = ${fence.generation}`
   await tx
     .update(webhook)
     .set({
-      registrationStatus: 'retired',
-      isActive: false,
-      archivedAt: now,
+      registrationStatus: sql`CASE WHEN ${isCurrentGeneration} THEN ${webhook.registrationStatus} ELSE 'retired' END`,
+      deploymentVersionId: sql`CASE WHEN ${isCurrentGeneration} THEN ${fence.deploymentVersionId}::text ELSE ${webhook.deploymentVersionId} END`,
+      isActive: sql<boolean>`${isCurrentGeneration}`,
+      archivedAt: sql`CASE WHEN ${isCurrentGeneration} THEN NULL ELSE ${now.toISOString()}::timestamp END`,
       updatedAt: now,
     })
     .where(
       and(
         eq(webhook.workflowId, fence.workflowId),
         eq(webhook.registrationStatus, 'active'),
-        lt(webhook.registrationGeneration, fence.generation)
-      )
-    )
-
-  await tx
-    .update(webhook)
-    .set({
-      deploymentVersionId: fence.deploymentVersionId,
-      isActive: true,
-      archivedAt: null,
-      updatedAt: now,
-    })
-    .where(
-      and(
-        eq(webhook.workflowId, fence.workflowId),
-        eq(webhook.registrationStatus, 'active'),
-        eq(webhook.registrationGeneration, fence.generation)
+        lte(webhook.registrationGeneration, fence.generation)
       )
     )
 
@@ -525,6 +577,7 @@ export async function listRetiredWebhookRegistrationsForCleanup(
   input: WebhookRegistrationOperationFence & { limit?: number }
 ): Promise<WebhookRegistrationRow[]> {
   return db.transaction(async (tx) => {
+    await setDeploymentTxTimeouts(tx)
     await assertCurrentOperation(tx, input, ['active'])
     return tx
       .select()
@@ -542,7 +595,10 @@ export async function listRetiredWebhookRegistrationsForCleanup(
 }
 
 /**
- * Reloads an exact cleanup snapshot. A row advanced or reused by a newer generation is rejected.
+ * Reloads an exact cleanup snapshot. A row advanced or reused by a newer
+ * generation is rejected. A plain fenced SELECT suffices: cleanup actions run
+ * after this returns (so a row lock could not protect them anyway), and the
+ * delete that follows is independently fenced on the same predicates.
  */
 export async function getWebhookCleanupSnapshotIfCurrent(input: {
   workflowId: string
@@ -550,21 +606,19 @@ export async function getWebhookCleanupSnapshotIfCurrent(input: {
   expectedGeneration: number
   statuses: readonly WebhookRegistrationStatus[]
 }): Promise<WebhookRegistrationRow | null> {
-  return db.transaction(async (tx) => {
-    const [row] = await tx
-      .select()
-      .from(webhook)
-      .where(
-        and(
-          eq(webhook.workflowId, input.workflowId),
-          eq(webhook.id, input.webhookId),
-          eq(webhook.registrationGeneration, input.expectedGeneration),
-          inArray(webhook.registrationStatus, input.statuses)
-        )
+  const [row] = await db
+    .select()
+    .from(webhook)
+    .where(
+      and(
+        eq(webhook.workflowId, input.workflowId),
+        eq(webhook.id, input.webhookId),
+        eq(webhook.registrationGeneration, input.expectedGeneration),
+        inArray(webhook.registrationStatus, input.statuses)
       )
-      .for('update')
-    return row ?? null
-  })
+    )
+    .limit(1)
+  return row ?? null
 }
 
 /** Deletes an externally cleaned row while preserving sticky path ownership. */
@@ -574,18 +628,16 @@ export async function deleteWebhookRegistrationAfterCleanup(input: {
   expectedGeneration: number
   statuses: readonly WebhookRegistrationStatus[]
 }): Promise<boolean> {
-  return db.transaction(async (tx) => {
-    const [deleted] = await tx
-      .delete(webhook)
-      .where(
-        and(
-          eq(webhook.workflowId, input.workflowId),
-          eq(webhook.id, input.webhookId),
-          eq(webhook.registrationGeneration, input.expectedGeneration),
-          inArray(webhook.registrationStatus, input.statuses)
-        )
+  const [deleted] = await db
+    .delete(webhook)
+    .where(
+      and(
+        eq(webhook.workflowId, input.workflowId),
+        eq(webhook.id, input.webhookId),
+        eq(webhook.registrationGeneration, input.expectedGeneration),
+        inArray(webhook.registrationStatus, input.statuses)
       )
-      .returning({ id: webhook.id })
-    return Boolean(deleted)
-  })
+    )
+    .returning({ id: webhook.id })
+  return Boolean(deleted)
 }
diff --git a/apps/sim/lib/workflows/comparison/compare.test.ts b/apps/sim/lib/workflows/comparison/compare.test.ts
index 8b39f481be5..e727b9d1513 100644
--- a/apps/sim/lib/workflows/comparison/compare.test.ts
+++ b/apps/sim/lib/workflows/comparison/compare.test.ts
@@ -777,6 +777,209 @@ describe('hasWorkflowChanged', () => {
     })
   })
 
+  describe('Table SubBlock Special Handling', () => {
+    it.concurrent('should ignore non-deterministic table row ids', () => {
+      const state1 = createWorkflowState({
+        blocks: {
+          block1: createBlock('block1', {
+            subBlocks: {
+              headers: {
+                id: 'headers',
+                type: 'table',
+                value: [{ id: 'row-a', cells: { Key: 'Authorization', Value: 'Bearer x' } }],
+              },
+            },
+          }),
+        },
+      })
+      const state2 = createWorkflowState({
+        blocks: {
+          block1: createBlock('block1', {
+            subBlocks: {
+              headers: {
+                id: 'headers',
+                type: 'table',
+                value: [{ id: 'row-b', cells: { Key: 'Authorization', Value: 'Bearer x' } }],
+              },
+            },
+          }),
+        },
+      })
+      expect(hasWorkflowChanged(state1, state2)).toBe(false)
+    })
+
+    it.concurrent('should treat a null table and a single blank starter row as equal', () => {
+      const state1 = createWorkflowState({
+        blocks: {
+          block1: createBlock('block1', {
+            subBlocks: {
+              headers: { id: 'headers', type: 'table', value: null },
+            },
+          }),
+        },
+      })
+      const state2 = createWorkflowState({
+        blocks: {
+          block1: createBlock('block1', {
+            subBlocks: {
+              headers: {
+                id: 'headers',
+                type: 'table',
+                value: [{ id: 'row-a', cells: { Key: '', Value: '' } }],
+              },
+            },
+          }),
+        },
+      })
+      expect(hasWorkflowChanged(state1, state2)).toBe(false)
+    })
+
+    it.concurrent('should ignore a trailing blank row after a populated row', () => {
+      const state1 = createWorkflowState({
+        blocks: {
+          block1: createBlock('block1', {
+            subBlocks: {
+              headers: {
+                id: 'headers',
+                type: 'table',
+                value: [{ id: 'row-a', cells: { Key: 'Accept', Value: 'application/json' } }],
+              },
+            },
+          }),
+        },
+      })
+      const state2 = createWorkflowState({
+        blocks: {
+          block1: createBlock('block1', {
+            subBlocks: {
+              headers: {
+                id: 'headers',
+                type: 'table',
+                value: [
+                  { id: 'row-b', cells: { Key: 'Accept', Value: 'application/json' } },
+                  { id: 'row-c', cells: { Key: '', Value: '' } },
+                ],
+              },
+            },
+          }),
+        },
+      })
+      expect(hasWorkflowChanged(state1, state2)).toBe(false)
+    })
+
+    it.concurrent('should detect real table cell changes', () => {
+      const state1 = createWorkflowState({
+        blocks: {
+          block1: createBlock('block1', {
+            subBlocks: {
+              headers: {
+                id: 'headers',
+                type: 'table',
+                value: [{ id: 'row-a', cells: { Key: 'Accept', Value: 'application/json' } }],
+              },
+            },
+          }),
+        },
+      })
+      const state2 = createWorkflowState({
+        blocks: {
+          block1: createBlock('block1', {
+            subBlocks: {
+              headers: {
+                id: 'headers',
+                type: 'table',
+                value: [{ id: 'row-a', cells: { Key: 'Accept', Value: 'text/plain' } }],
+              },
+            },
+          }),
+        },
+      })
+      expect(hasWorkflowChanged(state1, state2)).toBe(true)
+    })
+
+    it.concurrent('should preserve flat rows without a cells object', () => {
+      const state1 = createWorkflowState({
+        blocks: {
+          block1: createBlock('block1', {
+            subBlocks: {
+              headers: { id: 'headers', type: 'table', value: null },
+            },
+          }),
+        },
+      })
+      const state2 = createWorkflowState({
+        blocks: {
+          block1: createBlock('block1', {
+            subBlocks: {
+              headers: {
+                id: 'headers',
+                type: 'table',
+                value: [{ name: 'FOO', value: 'bar' }],
+              },
+            },
+          }),
+        },
+      })
+      expect(hasWorkflowChanged(state1, state2)).toBe(true)
+    })
+
+    it.concurrent('should detect edits to flat rows without a cells object', () => {
+      const state1 = createWorkflowState({
+        blocks: {
+          block1: createBlock('block1', {
+            subBlocks: {
+              headers: {
+                id: 'headers',
+                type: 'table',
+                value: [{ name: 'FOO', value: 'bar' }],
+              },
+            },
+          }),
+        },
+      })
+      const state2 = createWorkflowState({
+        blocks: {
+          block1: createBlock('block1', {
+            subBlocks: {
+              headers: {
+                id: 'headers',
+                type: 'table',
+                value: [{ name: 'FOO', value: 'baz' }],
+              },
+            },
+          }),
+        },
+      })
+      expect(hasWorkflowChanged(state1, state2)).toBe(true)
+    })
+
+    it.concurrent('should detect rows with a partially blank cell', () => {
+      const state1 = createWorkflowState({
+        blocks: {
+          block1: createBlock('block1', {
+            subBlocks: {
+              headers: { id: 'headers', type: 'table', value: null },
+            },
+          }),
+        },
+      })
+      const state2 = createWorkflowState({
+        blocks: {
+          block1: createBlock('block1', {
+            subBlocks: {
+              headers: {
+                id: 'headers',
+                type: 'table',
+                value: [{ id: 'row-a', cells: { Key: 'Accept', Value: '' } }],
+              },
+            },
+          }),
+        },
+      })
+      expect(hasWorkflowChanged(state1, state2)).toBe(true)
+    })
+  })
+
   describe('Loop Changes', () => {
     it.concurrent('should detect added loops', () => {
       const state1 = createWorkflowState({ loops: {} })
diff --git a/apps/sim/lib/workflows/comparison/compare.ts b/apps/sim/lib/workflows/comparison/compare.ts
index be5e6ab7820..0b402b913f7 100644
--- a/apps/sim/lib/workflows/comparison/compare.ts
+++ b/apps/sim/lib/workflows/comparison/compare.ts
@@ -244,8 +244,9 @@ export function generateWorkflowDiffSummary(
         continue
       }
 
-      const currentValue = normalizeSubBlockValue(subId, currentSub.value)
-      const previousValue = normalizeSubBlockValue(subId, previousSub.value)
+      const subType = currentSub.type ?? previousSub.type
+      const currentValue = normalizeSubBlockValue(subId, currentSub.value, subType)
+      const previousValue = normalizeSubBlockValue(subId, previousSub.value, subType)
 
       if (typeof currentValue === 'string' && typeof previousValue === 'string') {
         if (currentValue !== previousValue) {
diff --git a/apps/sim/lib/workflows/comparison/normalize.ts b/apps/sim/lib/workflows/comparison/normalize.ts
index 8e4f97af77f..1078d568d15 100644
--- a/apps/sim/lib/workflows/comparison/normalize.ts
+++ b/apps/sim/lib/workflows/comparison/normalize.ts
@@ -231,6 +231,50 @@ export function normalizeVariables(variables: unknown): Record<string, Variable>
   return variables as Record<string, Variable>
 }
 
+/** Table row shape produced by the table subblock component */
+type TableRowLike = Record<string, unknown> & { id?: unknown; cells?: Record<string, unknown> }
+
+function isBlankTableCellValue(value: unknown): boolean {
+  return value === '' || value === null || value === undefined
+}
+
+/**
+ * Sanitizes table subblock rows for comparison. Only rows in the editor's
+ * canonical `{ id, cells }` shape are normalized:
+ * - The row `id` is dropped — it is a client-generated React key
+ *   (`generateId()`), never read at execution (`transformTable` / response
+ *   `parseHeaders` consume cells only), and non-deterministic: the table
+ *   component materializes an empty starter row with a fresh id on mount.
+ * - Rows whose cells are all empty are dropped — execution ignores rows
+ *   without a truthy Key, and the editor persists one blank starter row for
+ *   an empty table, so a blank row is presentation, not configuration.
+ *
+ * Rows in any other shape (e.g. copilot-written flat rows like
+ * `{ name, value }`) pass through verbatim — their keys carry data, so
+ * nothing about them may be assumed blank or UI-only.
+ *
+ * @param rows - Array of table row values
+ * @returns Sanitized rows array
+ */
+export function sanitizeTableRows(rows: unknown[]): unknown[] {
+  const sanitized: unknown[] = []
+  for (const row of rows) {
+    if (!row || typeof row !== 'object' || Array.isArray(row)) {
+      sanitized.push(row)
+      continue
+    }
+    const { cells } = row as TableRowLike
+    if (!cells || typeof cells !== 'object' || Array.isArray(cells)) {
+      sanitized.push(row)
+      continue
+    }
+    if (Object.values(cells).every(isBlankTableCellValue)) continue
+    const { id: _id, ...rest } = row as TableRowLike
+    sanitized.push(rest)
+  }
+  return sanitized
+}
+
 /** Input format item with optional UI-only fields */
 type InputFormatItem = Record<string, unknown> & { collapsed?: boolean }
 
@@ -465,13 +509,19 @@ export function normalizeTriggerConfigValues(
 
 /**
  * Normalizes a subBlock value with sanitization for specific subBlock types.
- * Sanitizes: tools (removes isExpanded), inputFormat (removes collapsed)
+ * Sanitizes: tools (removes isExpanded), inputFormat (removes collapsed),
+ * table values (removes non-deterministic row ids and all-blank starter rows).
  *
  * @param subBlockId - The subBlock ID
  * @param value - The subBlock value
+ * @param subBlockType - Optional subBlock type for type-based sanitization
  * @returns Normalized value
  */
-export function normalizeSubBlockValue(subBlockId: string, value: unknown): unknown {
+export function normalizeSubBlockValue(
+  subBlockId: string,
+  value: unknown,
+  subBlockType?: unknown
+): unknown {
   let normalizedValue = value ?? null
 
   if (subBlockId === 'tools' && Array.isArray(normalizedValue)) {
@@ -480,6 +530,10 @@ export function normalizeSubBlockValue(subBlockId: string, value: unknown): unkn
   if (subBlockId === 'inputFormat' && Array.isArray(normalizedValue)) {
     normalizedValue = sanitizeInputFormat(normalizedValue)
   }
+  if (subBlockType === 'table' && Array.isArray(normalizedValue)) {
+    const sanitizedRows = sanitizeTableRows(normalizedValue)
+    normalizedValue = sanitizedRows.length > 0 ? sanitizedRows : null
+  }
 
   return normalizedValue
 }
@@ -530,7 +584,7 @@ export function normalizeWorkflowState(state: WorkflowState): NormalizedWorkflow
 
     for (const subBlockId of subBlockIds) {
       const subBlock = blockSubBlocks[subBlockId] as SubBlockWithDiffMarker
-      const value = normalizeSubBlockValue(subBlockId, subBlock.value)
+      const value = normalizeSubBlockValue(subBlockId, subBlock.value, subBlock.type)
       const subBlockRest = extractSubBlockRest(subBlock as Record<string, unknown>)
 
       normalizedSubBlocks[subBlockId] = {
diff --git a/apps/sim/lib/workflows/custom-blocks/operations.ts b/apps/sim/lib/workflows/custom-blocks/operations.ts
index ad3ff18bd1a..975b479dcba 100644
--- a/apps/sim/lib/workflows/custom-blocks/operations.ts
+++ b/apps/sim/lib/workflows/custom-blocks/operations.ts
@@ -355,6 +355,38 @@ export async function getCustomBlockAuthority(
   }
 }
 
+/** A custom block's agent-tool binding: bound workflow + its input schema surface. */
+export interface CustomBlockToolBinding {
+  workflowId: string
+  /** LATEST-deployment Start input fields — the exact inputs the child will accept. */
+  inputFields: WorkflowInputField[]
+  /** Field ids (form keys) the publisher marked required. */
+  requiredInputIds: string[]
+}
+
+/**
+ * Resolve a custom block's agent-tool binding so an Agent can offer it as a tool:
+ * the authoritative bound workflow (org-scoped to the consumer's workspace,
+ * owner-derived — the same trust model execution uses via `getCustomBlockAuthority`)
+ * plus its LATEST-deployment Start input fields and the publisher's required-input
+ * ids. Returns `null` when the type doesn't resolve for the consumer's org
+ * (foreign-org, disabled, or missing) so the caller simply omits the tool. Fields
+ * are keyed by their stable id, matching `assembleCustomBlockInputMapping`.
+ */
+export async function resolveCustomBlockToolBinding(
+  type: string,
+  consumerWorkspaceId: string | undefined
+): Promise<CustomBlockToolBinding | null> {
+  const authority = await getCustomBlockAuthority(type, consumerWorkspaceId)
+  if (!authority) return null
+  const inputFields = await deriveInputFields(authority.workflowId)
+  return {
+    workflowId: authority.workflowId,
+    inputFields,
+    requiredInputIds: authority.requiredInputIds,
+  }
+}
+
 export class CustomBlockValidationError extends Error {
   constructor(message: string) {
     super(message)
diff --git a/apps/sim/lib/workflows/deployment-outbox.test.ts b/apps/sim/lib/workflows/deployment-outbox.test.ts
index 29bbc7a6a3d..72881739136 100644
--- a/apps/sim/lib/workflows/deployment-outbox.test.ts
+++ b/apps/sim/lib/workflows/deployment-outbox.test.ts
@@ -150,6 +150,7 @@ vi.mock('@/lib/workflows/persistence/deployment-operations', () => ({
   markDeploymentComponentReadiness: mockMarkDeploymentComponentReadiness,
   markDeploymentOperationFailed: mockMarkDeploymentOperationFailed,
   recordDeploymentOperationRetry: mockRecordDeploymentOperationRetry,
+  setDeploymentTxTimeouts: vi.fn(),
 }))
 
 vi.mock('@/lib/workflows/schedules', () => ({
diff --git a/apps/sim/lib/workflows/deployment-outbox.ts b/apps/sim/lib/workflows/deployment-outbox.ts
index 59dbf525f88..ed58b1d040a 100644
--- a/apps/sim/lib/workflows/deployment-outbox.ts
+++ b/apps/sim/lib/workflows/deployment-outbox.ts
@@ -48,6 +48,7 @@ import {
   markDeploymentComponentReadiness,
   markDeploymentOperationFailed,
   recordDeploymentOperationRetry,
+  setDeploymentTxTimeouts,
   type WorkflowDeploymentOperation,
 } from '@/lib/workflows/persistence/deployment-operations'
 import { createSchedulesForDeploy, deleteSchedulesForWorkflow } from '@/lib/workflows/schedules'
@@ -1022,6 +1023,7 @@ async function deleteSchedulesForDeploymentIfInactive(params: {
   operationFence?: DeploymentCleanupOperationFence
 }): Promise<boolean> {
   return db.transaction(async (tx) => {
+    await setDeploymentTxTimeouts(tx)
     await tx
       .select({ id: workflowTable.id })
       .from(workflowTable)
@@ -1202,6 +1204,7 @@ async function createSchedulesIfStillActive(params: {
   blocks: Record<string, BlockState>
 }) {
   return db.transaction(async (tx) => {
+    await setDeploymentTxTimeouts(tx)
     const [workflowRecord] = await tx
       .select({ id: workflowTable.id })
       .from(workflowTable)
@@ -1250,6 +1253,7 @@ async function pruneWorkflowGroupOutputsIfStillActive(params: {
   requestId: string
 }): Promise<void> {
   await db.transaction(async (tx) => {
+    await setDeploymentTxTimeouts(tx)
     const [workflowRecord] = await tx
       .select({ id: workflowTable.id })
       .from(workflowTable)
diff --git a/apps/sim/lib/workflows/persistence/deployment-operations.test.ts b/apps/sim/lib/workflows/persistence/deployment-operations.test.ts
index 5692b0e8a4b..757e54eb2e8 100644
--- a/apps/sim/lib/workflows/persistence/deployment-operations.test.ts
+++ b/apps/sim/lib/workflows/persistence/deployment-operations.test.ts
@@ -433,19 +433,19 @@ describe('deployment operation persistence', () => {
 
     expect(result.success).toBe(true)
     expect(dbChainMockFns.update.mock.calls.map(([table]) => table)).toEqual([
-      schemaMock.workflowDeploymentVersion,
       schemaMock.workflowDeploymentVersion,
       schemaMock.workflow,
       schemaMock.workflowDeploymentOperation,
     ])
-    expect(dbChainMockFns.set).toHaveBeenNthCalledWith(1, { isActive: false })
-    expect(dbChainMockFns.set).toHaveBeenNthCalledWith(2, { isActive: true })
+    expect(dbChainMockFns.set).toHaveBeenNthCalledWith(1, {
+      isActive: expect.objectContaining({ values: expect.arrayContaining(['version-2']) }),
+    })
     expect(dbChainMockFns.set).toHaveBeenNthCalledWith(
-      3,
+      2,
       expect.objectContaining({ isDeployed: true, deployedAt: expect.any(Date) })
     )
     expect(dbChainMockFns.set).toHaveBeenNthCalledWith(
-      4,
+      3,
       expect.objectContaining({
         status: 'active',
         completedAt: expect.any(Date),
diff --git a/apps/sim/lib/workflows/persistence/deployment-operations.ts b/apps/sim/lib/workflows/persistence/deployment-operations.ts
index f2964dfd5e0..9146f35b601 100644
--- a/apps/sim/lib/workflows/persistence/deployment-operations.ts
+++ b/apps/sim/lib/workflows/persistence/deployment-operations.ts
@@ -3,7 +3,7 @@ import { generateId } from '@sim/utils/id'
 import type { DbOrTx } from '@sim/workflow-persistence/types'
 import type { WorkflowState } from '@sim/workflow-types/workflow'
 import type { InferSelectModel } from 'drizzle-orm'
-import { and, desc, eq, inArray, sql } from 'drizzle-orm'
+import { and, desc, eq, inArray, or, sql } from 'drizzle-orm'
 import {
   canTransitionDeploymentOperation,
   createDeploymentReadiness,
@@ -114,6 +114,28 @@ type ResolveOperationTarget = (context: PrepareOperationContext) =>
 
 const IN_FLIGHT_STATUSES: DeploymentOperationStatus[] = ['preparing', 'activating']
 
+const DEPLOYMENT_TX_STATEMENT_TIMEOUT_MS = 30_000
+const DEPLOYMENT_TX_LOCK_TIMEOUT_MS = 5_000
+const DEPLOYMENT_TX_IDLE_TIMEOUT_MS = 30_000
+
+/**
+ * Applies transaction-scoped Postgres safety timeouts in one round trip.
+ *
+ * Deployment transactions hold the workflow-row lock plus webhook and
+ * operation row locks across several statements; the idle timeout is the
+ * backstop that stops a wedged client from pinning those locks indefinitely,
+ * and `lock_timeout` keeps a waiter from inheriting the full statement clock.
+ * `set_config(..., true)` is `SET LOCAL`-scoped, so it clears at
+ * COMMIT/ROLLBACK and is safe under PgBouncer transaction pooling.
+ */
+export async function setDeploymentTxTimeouts(tx: DbOrTx): Promise<void> {
+  await tx.execute(
+    sql`SELECT set_config('statement_timeout', ${`${DEPLOYMENT_TX_STATEMENT_TIMEOUT_MS}ms`}, true),
+        set_config('lock_timeout', ${`${DEPLOYMENT_TX_LOCK_TIMEOUT_MS}ms`}, true),
+        set_config('idle_in_transaction_session_timeout', ${`${DEPLOYMENT_TX_IDLE_TIMEOUT_MS}ms`}, true)`
+  )
+}
+
 /**
  * Creates an inactive immutable snapshot and a preparing deployment attempt.
  */
@@ -326,6 +348,7 @@ export async function beginDeploymentOperationActivation(
   params: DeploymentOperationGeneration
 ): Promise<DeploymentOperationMutationResult> {
   return db.transaction(async (tx) => {
+    await setDeploymentTxTimeouts(tx)
     const operation = await lockCurrentOperation(tx, params)
     if (!operation.success) return operation
 
@@ -438,6 +461,7 @@ export async function activateDeploymentOperation(
   params: ActivateDeploymentOperationParams
 ): Promise<DeploymentOperationMutationResult> {
   return db.transaction(async (tx) => {
+    await setDeploymentTxTimeouts(tx)
     const operationResult = await lockCurrentOperation(tx, params)
     if (!operationResult.success) return operationResult
 
@@ -539,18 +563,25 @@ export async function activateDeploymentOperation(
       }
     }
 
+    /**
+     * Single-statement cutover: only rows whose isActive value actually
+     * changes are touched (the previously active row and the target), instead
+     * of rewriting every version row of the workflow on each deploy. There is
+     * no unique index on (workflowId, isActive), so the one-statement flip has
+     * no constraint-ordering hazard.
+     */
     await tx
       .update(workflowDeploymentVersion)
-      .set({ isActive: false })
-      .where(eq(workflowDeploymentVersion.workflowId, operation.workflowId))
-
-    await tx
-      .update(workflowDeploymentVersion)
-      .set({ isActive: true })
+      .set({
+        isActive: sql<boolean>`${workflowDeploymentVersion.id} = ${operation.deploymentVersionId}`,
+      })
       .where(
         and(
           eq(workflowDeploymentVersion.workflowId, operation.workflowId),
-          eq(workflowDeploymentVersion.id, operation.deploymentVersionId)
+          or(
+            eq(workflowDeploymentVersion.isActive, true),
+            eq(workflowDeploymentVersion.id, operation.deploymentVersionId)
+          )
         )
       )
 
@@ -818,7 +849,11 @@ async function prepareOperation(
     return { success: true, operation, reused: false }
   }
 
-  return params.tx ? executePrepare(params.tx) : db.transaction(executePrepare)
+  if (params.tx) return executePrepare(params.tx)
+  return db.transaction(async (tx) => {
+    await setDeploymentTxTimeouts(tx)
+    return executePrepare(tx)
+  })
 }
 
 async function lockCurrentOperation(
diff --git a/apps/sim/lib/workflows/persistence/duplicate.ts b/apps/sim/lib/workflows/persistence/duplicate.ts
index ab075a8be5f..9895a90fb7f 100644
--- a/apps/sim/lib/workflows/persistence/duplicate.ts
+++ b/apps/sim/lib/workflows/persistence/duplicate.ts
@@ -326,6 +326,7 @@ export async function duplicateWorkflow(
         if (updatedSubBlocks && typeof updatedSubBlocks === 'object') {
           updatedSubBlocks = remapConditionIdsInSubBlocks(
             updatedSubBlocks as Record<string, any>,
+            block.type,
             block.id,
             newBlockId
           )
diff --git a/apps/sim/lib/workflows/persistence/remap-internal-ids.test.ts b/apps/sim/lib/workflows/persistence/remap-internal-ids.test.ts
index 7cdc22f39b2..b0069c858bd 100644
--- a/apps/sim/lib/workflows/persistence/remap-internal-ids.test.ts
+++ b/apps/sim/lib/workflows/persistence/remap-internal-ids.test.ts
@@ -2,8 +2,10 @@
  * @vitest-environment node
  */
 import { describe, expect, it } from 'vitest'
+import { remapConditionEdgeHandle } from '@/lib/workflows/condition-ids'
 import {
   coerceObjectArray,
+  remapConditionIdsInSubBlocks,
   remapWorkflowReferencesInSubBlocks,
   type SubBlockRecord,
 } from '@/lib/workflows/persistence/remap-internal-ids'
@@ -378,6 +380,77 @@ describe('remapWorkflowReferencesInSubBlocks', () => {
   })
 })
 
+describe('remapConditionIdsInSubBlocks', () => {
+  const OLD_ID = 'old-block'
+  const NEW_ID = 'new-block'
+  const conditionsValue = JSON.stringify([
+    { id: `${OLD_ID}-if`, title: 'if', value: '<a.b> > 1' },
+    { id: `${OLD_ID}-else`, title: 'else', value: '' },
+  ])
+
+  it('remaps condition row ids on a condition block', () => {
+    const subBlocks: SubBlockRecord = {
+      conditions: { id: 'conditions', type: 'condition-input', value: conditionsValue },
+    }
+    const result = remapConditionIdsInSubBlocks(subBlocks, 'condition', OLD_ID, NEW_ID)
+    const rows = JSON.parse(result.conditions.value as string)
+    expect(rows.map((row: { id: string }) => row.id)).toEqual([`${NEW_ID}-if`, `${NEW_ID}-else`])
+  })
+
+  /**
+   * Regression: a fallback writer stamped the conditions subblock `short-input`.
+   * The remap must key on block type + subblock key, not the drifted stored type,
+   * so the row ids and the edge handle move together (previously the ids stayed
+   * stale while the handle remapped, orphaning every edge out of the block).
+   */
+  it('remaps condition row ids even when the stored subblock type drifted', () => {
+    const subBlocks: SubBlockRecord = {
+      conditions: { id: 'conditions', type: 'short-input', value: conditionsValue },
+    }
+    const result = remapConditionIdsInSubBlocks(subBlocks, 'condition', OLD_ID, NEW_ID)
+    const rows = JSON.parse(result.conditions.value as string)
+    const handle = remapConditionEdgeHandle(`condition-${OLD_ID}-else`, OLD_ID, NEW_ID)
+    expect(handle).toBe(`condition-${NEW_ID}-else`)
+    expect(rows.map((row: { id: string }) => row.id)).toContain(`${NEW_ID}-else`)
+  })
+
+  it('remaps route ids on a router_v2 block', () => {
+    const subBlocks: SubBlockRecord = {
+      routes: {
+        id: 'routes',
+        type: 'router-input',
+        value: JSON.stringify([{ id: `${OLD_ID}-route1`, title: 'Route 1', value: 'desc' }]),
+      },
+    }
+    const result = remapConditionIdsInSubBlocks(subBlocks, 'router_v2', OLD_ID, NEW_ID)
+    const rows = JSON.parse(result.routes.value as string)
+    expect(rows[0].id).toBe(`${NEW_ID}-route1`)
+  })
+
+  it('leaves rows with a foreign block-id prefix untouched (matches the edge-handle remap)', () => {
+    const subBlocks: SubBlockRecord = {
+      conditions: {
+        id: 'conditions',
+        type: 'condition-input',
+        value: JSON.stringify([{ id: 'foreign-block-if', title: 'if', value: '' }]),
+      },
+    }
+    const result = remapConditionIdsInSubBlocks(subBlocks, 'condition', OLD_ID, NEW_ID)
+    expect(result.conditions).toBe(subBlocks.conditions)
+    expect(remapConditionEdgeHandle('condition-foreign-block-if', OLD_ID, NEW_ID)).toBe(
+      'condition-foreign-block-if'
+    )
+  })
+
+  it('does not touch subblocks on non-dynamic-handle block types', () => {
+    const subBlocks: SubBlockRecord = {
+      conditions: { id: 'conditions', type: 'condition-input', value: conditionsValue },
+    }
+    const result = remapConditionIdsInSubBlocks(subBlocks, 'function', OLD_ID, NEW_ID)
+    expect(result.conditions).toBe(subBlocks.conditions)
+  })
+})
+
 describe('coerceObjectArray', () => {
   it('returns arrays directly', () => {
     expect(coerceObjectArray([{ a: 1 }])).toEqual({ array: [{ a: 1 }], wasString: false })
diff --git a/apps/sim/lib/workflows/persistence/remap-internal-ids.ts b/apps/sim/lib/workflows/persistence/remap-internal-ids.ts
index f9a9634cd99..09217823190 100644
--- a/apps/sim/lib/workflows/persistence/remap-internal-ids.ts
+++ b/apps/sim/lib/workflows/persistence/remap-internal-ids.ts
@@ -1,5 +1,6 @@
 import { createLogger } from '@sim/logger'
 import { remapConditionBlockIds } from '@/lib/workflows/condition-ids'
+import { isDynamicHandleSubblock } from '@/lib/workflows/dynamic-handle-topology'
 import {
   type CanonicalModeOverrides,
   resolveCanonicalMode,
@@ -321,9 +322,16 @@ function remapWorkflowInputTools(
 /**
  * Remap condition/router block IDs within subBlocks when a block is copied with
  * a new ID. Returns a new object without mutating the input.
+ *
+ * Gated on the BLOCK type + canonical subblock key (`conditions`/`routes`), not
+ * the stored subblock `type`: edge handles are remapped by string prefix with no
+ * type gate, so keying this side on mutable stored metadata lets a drifted type
+ * (e.g. a `conditions` entry stamped `short-input` by a fallback writer) skip the
+ * id remap while the handles still move — orphaning every edge out of the block.
  */
 export function remapConditionIdsInSubBlocks(
   subBlocks: SubBlockRecord,
+  blockType: string | undefined,
   oldBlockId: string,
   newBlockId: string
 ): SubBlockRecord {
@@ -332,7 +340,7 @@ export function remapConditionIdsInSubBlocks(
     if (
       subBlock &&
       typeof subBlock === 'object' &&
-      (subBlock.type === 'condition-input' || subBlock.type === 'router-input') &&
+      isDynamicHandleSubblock(blockType, key) &&
       typeof subBlock.value === 'string'
     ) {
       try {
diff --git a/apps/sim/lib/workflows/persistence/utils.ts b/apps/sim/lib/workflows/persistence/utils.ts
index 1de604a8d80..0fff85f8fd7 100644
--- a/apps/sim/lib/workflows/persistence/utils.ts
+++ b/apps/sim/lib/workflows/persistence/utils.ts
@@ -23,6 +23,7 @@ import { LRUCache } from 'lru-cache'
 import type { Edge } from 'reactflow'
 import { releaseWebhookPathClaims } from '@/lib/webhooks/path-claims'
 import { remapConditionBlockIds, remapConditionEdgeHandle } from '@/lib/workflows/condition-ids'
+import { isDynamicHandleSubblock } from '@/lib/workflows/dynamic-handle-topology'
 import {
   backfillCanonicalModes,
   migrateSubblockIds,
@@ -356,6 +357,8 @@ export const CREDENTIAL_SUBBLOCK_IDS = new Set([
   'credential',
   'manualCredential',
   'triggerCredentials',
+  'customBotCredential',
+  'manualBotCredential',
 ])
 
 async function migrateCredentialIds(
@@ -715,7 +718,7 @@ export function regenerateWorkflowStateIds(state: RegenerateStateInput): Regener
         }
 
         if (
-          (updatedSubBlock.type === 'condition-input' || updatedSubBlock.type === 'router-input') &&
+          isDynamicHandleSubblock(block.type, subId) &&
           typeof updatedSubBlock.value === 'string'
         ) {
           try {
diff --git a/apps/sim/lib/workflows/sanitization/subblocks.test.ts b/apps/sim/lib/workflows/sanitization/subblocks.test.ts
index a9a714a400a..5dd15da3801 100644
--- a/apps/sim/lib/workflows/sanitization/subblocks.test.ts
+++ b/apps/sim/lib/workflows/sanitization/subblocks.test.ts
@@ -133,5 +133,59 @@ describe('sanitizeMalformedSubBlocks', () => {
       expect(changed).toBe(true)
       expect(subBlocks.code).toEqual({ id: 'code', type: 'code', value: 'return 1' })
     })
+
+    it('repairs a stored type that contradicts the configured type', () => {
+      const { subBlocks, changed } = sanitizeMalformedSubBlocks({
+        id: 'block-1',
+        type: 'function',
+        subBlocks: {
+          code: { id: 'code', type: 'short-input', value: 'return 1' },
+        },
+      })
+
+      expect(changed).toBe(true)
+      expect(subBlocks.code).toEqual({ id: 'code', type: 'code', value: 'return 1' })
+    })
+
+    /**
+     * Regression: a fallback writer stamped a condition block's `conditions`
+     * subblock `short-input`. Copy-time id remapping used to gate on that stored
+     * type, skipping the conditions array while edge handles still remapped —
+     * orphaning every edge out of the block on fork/duplicate/import.
+     */
+    it('repairs a condition block conditions subblock stamped short-input by a fallback writer', () => {
+      const conditionsValue = JSON.stringify([
+        { id: 'block-1-if', title: 'if', value: '<a.b>' },
+        { id: 'block-1-else', title: 'else', value: '' },
+      ])
+      const { subBlocks, changed } = sanitizeMalformedSubBlocks({
+        id: 'block-1',
+        type: 'condition',
+        subBlocks: {
+          conditions: { id: 'conditions', type: 'short-input', value: conditionsValue },
+        },
+      })
+
+      expect(changed).toBe(true)
+      expect(subBlocks.conditions).toEqual({
+        id: 'conditions',
+        type: 'condition-input',
+        value: conditionsValue,
+      })
+    })
+
+    it('preserves a valid stored type for keys the config does not declare (runtime values)', () => {
+      const input = {
+        webhookId: { id: 'webhookId', type: 'short-input', value: 'wh-1' },
+      }
+      const { subBlocks, changed } = sanitizeMalformedSubBlocks({
+        id: 'block-1',
+        type: 'function',
+        subBlocks: input,
+      })
+
+      expect(changed).toBe(false)
+      expect(subBlocks).toBe(input)
+    })
   })
 })
diff --git a/apps/sim/lib/workflows/sanitization/subblocks.ts b/apps/sim/lib/workflows/sanitization/subblocks.ts
index 1f0d222ce2a..07a2f11cb9b 100644
--- a/apps/sim/lib/workflows/sanitization/subblocks.ts
+++ b/apps/sim/lib/workflows/sanitization/subblocks.ts
@@ -21,6 +21,17 @@ interface SanitizableBlock {
  * Repairs legacy subBlock metadata when the map key identifies a real field,
  * and drops entries that cannot be associated with a stable subBlock.
  *
+ * For keys the block registry declares, the CONFIGURED type is authoritative
+ * and overwrites a contradicting stored type. Stored types drift in two ways:
+ * fallback writers stamp a plausible-but-wrong default (`short-input`) when
+ * they synthesize a missing structure entry, and block configs evolve their
+ * declared types over time while persisted rows keep the old one. A wrong
+ * stored type silently disables type-gated logic downstream — most damaging
+ * for `condition-input`/`router-input`, where copy-time id remapping skips
+ * the conditions array while edge handles still remap, orphaning the edges.
+ * Draft loads persist this repair via `persistMigratedBlocks`, so stored
+ * state converges back to the registry.
+ *
  * Custom blocks are schema-agnostic here: their server-side config never
  * declares the per-field input sub-blocks (the execution overlay passes bare
  * wiring rows, and this may run with no overlay at all), so "not in config"
@@ -95,10 +106,11 @@ export function sanitizeMalformedSubBlocks(
       continue
     }
 
-    const type =
+    const storedType =
       typeof subBlock.type === 'string' && subBlock.type.length > 0 && subBlock.type !== 'unknown'
         ? subBlock.type
-        : typeFromConfig || DEFAULT_SUBBLOCK_TYPE
+        : null
+    const type = typeFromConfig ?? storedType ?? DEFAULT_SUBBLOCK_TYPE
     const hasValue = Object.hasOwn(subBlock, 'value')
     const value =
       options.convertEmptyStringToNull && subBlock.value === ''
@@ -111,7 +123,12 @@ export function sanitizeMalformedSubBlocks(
     const normalizedValue = hasValue && value !== subBlock.value
 
     if (repairedMetadata) {
-      logger.warn('Repairing malformed subBlock metadata', { blockId: block.id, subBlockId })
+      logger.warn('Repairing malformed subBlock metadata', {
+        blockId: block.id,
+        subBlockId,
+        storedType: subBlock.type,
+        repairedType: type,
+      })
       changed = true
     } else if (normalizedValue) {
       logger.warn('Normalizing malformed subBlock value', { blockId: block.id, subBlockId })
diff --git a/apps/sim/providers/bedrock/utils.ts b/apps/sim/providers/bedrock/utils.ts
index a385ffd053b..82919624d09 100644
--- a/apps/sim/providers/bedrock/utils.ts
+++ b/apps/sim/providers/bedrock/utils.ts
@@ -89,7 +89,6 @@ export function generateToolUseId(toolName: string): string {
  */
 const GEO_PROFILE_UNSUPPORTED_MODEL_IDS = new Set([
   'mistral.mistral-large-3-675b-instruct',
-  'mistral.mistral-large-2411-v1:0',
   'mistral.mistral-large-2407-v1:0',
   'mistral.magistral-small-2509',
   'mistral.ministral-3-14b-instruct',
diff --git a/apps/sim/providers/custom-block-tool.test.ts b/apps/sim/providers/custom-block-tool.test.ts
new file mode 100644
index 00000000000..b6c97963e5f
--- /dev/null
+++ b/apps/sim/providers/custom-block-tool.test.ts
@@ -0,0 +1,120 @@
+/**
+ * @vitest-environment node
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { transformBlockTool } from '@/providers/utils'
+import { normalizeToolId } from '@/tools/normalize'
+
+const mockResolve = vi.fn()
+
+const options = {
+  getAllBlocks: () => [
+    {
+      type: 'custom_block_test',
+      name: 'The Elder',
+      description: 'Ask the elder',
+      tools: { access: ['workflow_executor'] },
+      subBlocks: [],
+    },
+  ],
+  getTool: (id: string) =>
+    id === 'deployed_block_executor'
+      ? { id: 'deployed_block_executor', description: 'exec' }
+      : undefined,
+  resolveCustomBlockBinding: mockResolve,
+}
+
+describe('transformBlockTool — custom blocks', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('builds an id-keyed deployed_block_executor tool and omits file[] fields', async () => {
+    mockResolve.mockResolvedValue({
+      workflowId: 'wf-src',
+      inputFields: [
+        { id: 'q', name: 'Question', type: 'string', required: true },
+        { id: 'f', name: 'Files', type: 'file[]' },
+      ],
+      requiredInputIds: ['q'],
+    })
+
+    const tool = await transformBlockTool(
+      { type: 'custom_block_test', params: { q: 'hi' } },
+      options
+    )
+
+    expect(tool).not.toBeNull()
+    // Unique per block, name/description from the block (never the source workflow).
+    expect(tool!.id).toBe('deployed_block_executor_custom_block_test')
+    expect(tool!.name).toBe('The Elder')
+    // Baked params: block type + assembled (id-keyed) input mapping.
+    expect(tool!.params.blockType).toBe('custom_block_test')
+    expect(tool!.params.inputMapping).toBe('{"q":"hi"}')
+    // LLM schema: inputMapping object keyed by field id, file[] omitted, required honored.
+    const inputMapping = tool!.parameters.properties.inputMapping
+    expect(Object.keys(inputMapping.properties)).toEqual(['q'])
+    expect(inputMapping.required).toEqual(['q'])
+    expect(tool!.parameters.required).toEqual(['inputMapping'])
+
+    expect(mockResolve).toHaveBeenCalledWith('custom_block_test')
+  })
+
+  it('keeps the tool id out of the user-defined custom-tool namespace', async () => {
+    mockResolve.mockResolvedValue({
+      workflowId: 'wf-src',
+      inputFields: [{ id: 'q', name: 'Question', type: 'string' }],
+      requiredInputIds: [],
+    })
+
+    const tool = await transformBlockTool({ type: 'custom_block_test', params: {} }, options)
+
+    // `custom_` is the custom-tool prefix (`isCustomTool`). Colliding with it makes
+    // executeTool resolve via the DB custom-tool lookup, skip internal-field
+    // stripping, and let `disableCustomTools` block deploy-as-block tools.
+    expect(tool!.id.startsWith('custom_')).toBe(false)
+    expect(normalizeToolId(tool!.id)).toBe('deployed_block_executor')
+  })
+
+  it('does not offer the tool when a required file input has no preset value', async () => {
+    mockResolve.mockResolvedValue({
+      workflowId: 'wf-src',
+      inputFields: [{ id: 'f', name: 'Files', type: 'file[]' }],
+      requiredInputIds: ['f'],
+    })
+
+    const tool = await transformBlockTool({ type: 'custom_block_test', params: {} }, options)
+    expect(tool).toBeNull()
+  })
+
+  it('still offers the tool when a required file input is pre-filled on the block', async () => {
+    mockResolve.mockResolvedValue({
+      workflowId: 'wf-src',
+      inputFields: [{ id: 'f', name: 'Files', type: 'file[]' }],
+      requiredInputIds: ['f'],
+    })
+
+    const tool = await transformBlockTool(
+      { type: 'custom_block_test', params: { f: [{ id: 'file-1' }] } },
+      options
+    )
+    expect(tool).not.toBeNull()
+    // The preset value rides the baked mapping; the schema still omits the file field.
+    expect(tool!.params.inputMapping).toContain('file-1')
+    expect(Object.keys(tool!.parameters.properties.inputMapping.properties)).toEqual([])
+  })
+
+  it('returns null (tool not offered) when the binding cannot be resolved', async () => {
+    mockResolve.mockResolvedValue(null)
+    const tool = await transformBlockTool({ type: 'custom_block_test', params: {} }, options)
+    expect(tool).toBeNull()
+  })
+
+  it('returns null when no resolver is injected (non-server callers)', async () => {
+    const tool = await transformBlockTool(
+      { type: 'custom_block_test', params: {} },
+      { ...options, resolveCustomBlockBinding: undefined }
+    )
+    expect(tool).toBeNull()
+  })
+})
diff --git a/apps/sim/providers/models.test.ts b/apps/sim/providers/models.test.ts
index 1df24dad98b..56eddcbeb6b 100644
--- a/apps/sim/providers/models.test.ts
+++ b/apps/sim/providers/models.test.ts
@@ -24,7 +24,7 @@ const DYNAMIC_PROVIDERS = new Set([
 function firstDeprecatedModelId(): string | undefined {
   for (const [providerId, provider] of Object.entries(PROVIDER_DEFINITIONS)) {
     if (DYNAMIC_PROVIDERS.has(providerId)) continue
-    const dep = provider.models.find((m) => m.deprecated)
+    const dep = provider.models.find((m) => m.sunset)
     if (dep) return dep.id
   }
   return undefined
diff --git a/apps/sim/providers/models.ts b/apps/sim/providers/models.ts
index d307316520d..23ab2236e38 100644
--- a/apps/sim/providers/models.ts
+++ b/apps/sim/providers/models.ts
@@ -69,7 +69,15 @@ interface ModelDefinition {
   releaseDate?: string
   recommended?: boolean
   speedOptimized?: boolean
-  deprecated?: boolean
+  /**
+   * Post-availability lifecycle, mirroring `BlockConfig.sunset`. `legacy` —
+   * superseded but still callable (amber); `deprecated` — the provider retired
+   * it and API calls now fail (red). `deprecated` models are hidden from pickers
+   * but stay {@link isKnownModelId} so existing pinned workflows still validate.
+   */
+  sunset?: {
+    status: 'legacy' | 'deprecated'
+  }
 }
 
 export interface ProviderDefinition {
@@ -284,7 +292,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 1047576,
         releaseDate: '2025-04-14',
-        deprecated: true,
+        sunset: { status: 'legacy' },
       },
       // GPT-5.6 family
       {
@@ -615,7 +623,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 128000,
         releaseDate: '2025-08-07',
-        deprecated: true,
+        sunset: { status: 'legacy' },
       },
       // o-series reasoning models
       {
@@ -634,7 +642,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 200000,
         releaseDate: '2025-04-16',
-        deprecated: true,
+        sunset: { status: 'legacy' },
       },
       {
         id: 'o3-pro',
@@ -665,7 +673,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 200000,
         releaseDate: '2025-04-16',
-        deprecated: true,
+        sunset: { status: 'legacy' },
       },
       {
         id: 'o3-mini',
@@ -683,7 +691,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 200000,
         releaseDate: '2025-01-31',
-        deprecated: true,
+        sunset: { status: 'legacy' },
       },
       {
         id: 'o1',
@@ -701,7 +709,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 200000,
         releaseDate: '2024-12-17',
-        deprecated: true,
+        sunset: { status: 'legacy' },
       },
       // Legacy
       {
@@ -718,7 +726,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 128000,
         releaseDate: '2024-05-13',
-        deprecated: true,
+        sunset: { status: 'legacy' },
       },
     ],
   },
@@ -891,7 +899,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 200000,
         releaseDate: '2025-08-05',
-        deprecated: true,
+        sunset: { status: 'legacy' },
       },
       {
         id: 'claude-opus-4-0',
@@ -911,7 +919,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 200000,
         releaseDate: '2025-05-22',
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
       {
         id: 'claude-sonnet-4-5',
@@ -951,7 +959,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 200000,
         releaseDate: '2025-05-22',
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
       {
         id: 'claude-haiku-4-5',
@@ -988,7 +996,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 200000,
         releaseDate: '2024-03-13',
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
     ],
   },
@@ -1018,7 +1026,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 128000,
         releaseDate: '2024-11-20',
-        deprecated: true,
+        sunset: { status: 'legacy' },
       },
       {
         id: 'azure/gpt-5.4',
@@ -1398,7 +1406,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 200000,
         releaseDate: '2025-08-05',
-        deprecated: true,
+        sunset: { status: 'legacy' },
       },
       {
         id: 'azure-anthropic/claude-haiku-4-5',
@@ -1435,6 +1443,46 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
     icon: GeminiIcon,
     color: '#4285F4',
     models: [
+      {
+        id: 'gemini-3.6-flash',
+        pricing: {
+          input: 1.5,
+          cachedInput: 0.15,
+          output: 7.5,
+          updatedAt: '2026-07-21',
+        },
+        capabilities: {
+          temperature: { min: 0, max: 2 },
+          thinking: {
+            levels: ['minimal', 'low', 'medium', 'high'],
+            default: 'medium',
+          },
+          maxOutputTokens: 65536,
+        },
+        contextWindow: 1048576,
+        releaseDate: '2026-07-21',
+        recommended: true,
+      },
+      {
+        id: 'gemini-3.5-flash-lite',
+        pricing: {
+          input: 0.3,
+          cachedInput: 0.03,
+          output: 2.5,
+          updatedAt: '2026-07-21',
+        },
+        capabilities: {
+          temperature: { min: 0, max: 2 },
+          thinking: {
+            levels: ['minimal', 'low', 'medium', 'high'],
+            default: 'minimal',
+          },
+          maxOutputTokens: 65536,
+        },
+        contextWindow: 1048576,
+        releaseDate: '2026-07-21',
+        speedOptimized: true,
+      },
       {
         id: 'gemini-3.5-flash',
         pricing: {
@@ -1453,7 +1501,6 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 1048576,
         releaseDate: '2026-05-19',
-        recommended: true,
       },
       {
         id: 'gemini-3.1-pro-preview',
@@ -1585,7 +1632,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 1048576,
         releaseDate: '2025-02-05',
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
       {
         id: 'gemini-2.0-flash-lite',
@@ -1600,7 +1647,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 1048576,
         releaseDate: '2025-02-25',
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
       {
         id: 'deep-research-pro-preview-12-2025',
@@ -1708,7 +1755,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 1000000,
         releaseDate: '2025-11-18',
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
       {
         id: 'vertex/gemini-3-flash-preview',
@@ -1800,7 +1847,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 1048576,
         releaseDate: '2025-02-05',
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
       {
         id: 'vertex/gemini-2.0-flash-lite',
@@ -1814,7 +1861,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 1048576,
         releaseDate: '2025-02-25',
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
       {
         id: 'vertex/deep-research-pro-preview-12-2025',
@@ -1899,7 +1946,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 128000,
         releaseDate: '2024-12-26',
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
       {
         id: 'deepseek-r1',
@@ -1912,7 +1959,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         capabilities: {},
         contextWindow: 128000,
         releaseDate: '2025-01-20',
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
       {
         id: 'deepseek-reasoner',
@@ -1982,7 +2029,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 1000000,
         releaseDate: '2025-07-09',
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
       {
         id: 'grok-4-0709',
@@ -1997,7 +2044,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 1000000,
         releaseDate: '2025-07-09',
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
       {
         id: 'grok-4-1-fast-reasoning',
@@ -2012,7 +2059,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 1000000,
         releaseDate: '2025-11-19',
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
       {
         id: 'grok-4-1-fast-non-reasoning',
@@ -2027,7 +2074,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 1000000,
         releaseDate: '2025-11-19',
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
       {
         id: 'grok-4-fast-reasoning',
@@ -2042,7 +2089,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 1000000,
         releaseDate: '2025-09-19',
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
       {
         id: 'grok-4-fast-non-reasoning',
@@ -2057,7 +2104,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 1000000,
         releaseDate: '2025-09-19',
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
       {
         id: 'grok-code-fast-1',
@@ -2072,7 +2119,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 256000,
         releaseDate: '2025-08-28',
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
       {
         id: 'grok-4.20-0309-reasoning',
@@ -2129,7 +2176,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 1000000,
         releaseDate: '2025-02-17',
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
       {
         id: 'grok-3-fast-latest',
@@ -2144,7 +2191,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 1000000,
         releaseDate: '2025-02-17',
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
     ],
   },
@@ -2184,7 +2231,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         capabilities: {},
         contextWindow: 32768,
         releaseDate: '2024-08-27',
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
       {
         id: 'cerebras/qwen-3-235b-a22b-instruct-2507',
@@ -2196,7 +2243,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         capabilities: {},
         contextWindow: 131072,
         releaseDate: '2025-07-29',
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
       {
         id: 'cerebras/zai-glm-4.7',
@@ -2297,7 +2344,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 131072,
         releaseDate: '2025-04-29',
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
       {
         id: 'groq/qwen/qwen3.6-27b',
@@ -2351,7 +2398,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 131072,
         releaseDate: '2025-04-05',
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
       {
         id: 'groq/moonshotai/kimi-k2-instruct-0905',
@@ -2363,7 +2410,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         capabilities: {},
         contextWindow: 262144,
         releaseDate: '2025-09-05',
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
     ],
   },
@@ -2940,7 +2987,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 128000,
         releaseDate: '2024-11-18',
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
       {
         id: 'magistral-medium-latest',
@@ -2980,7 +3027,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 128000,
         releaseDate: '2025-09-18',
-        deprecated: true,
+        sunset: { status: 'legacy' },
       },
       {
         id: 'magistral-small-2509',
@@ -2994,7 +3041,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 128000,
         releaseDate: '2025-09-18',
-        deprecated: true,
+        sunset: { status: 'legacy' },
       },
       {
         id: 'mistral-medium-latest',
@@ -3073,7 +3120,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 128000,
         releaseDate: '2025-06-20',
-        deprecated: true,
+        sunset: { status: 'legacy' },
       },
       {
         id: 'open-mistral-nemo',
@@ -3139,7 +3186,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 256000,
         releaseDate: '2025-12-09',
-        deprecated: true,
+        sunset: { status: 'legacy' },
       },
       {
         id: 'devstral-small-2507',
@@ -3153,7 +3200,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 128000,
         releaseDate: '2025-07-10',
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
       {
         id: 'devstral-medium-2507',
@@ -3167,7 +3214,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 128000,
         releaseDate: '2025-07-10',
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
       {
         id: 'ministral-14b-latest',
@@ -3347,21 +3394,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 200000,
         releaseDate: '2025-08-05',
-        deprecated: true,
-      },
-      {
-        id: 'bedrock/amazon.nova-2-pro-v1:0',
-        pricing: {
-          input: 1.375,
-          output: 11.0,
-          updatedAt: '2026-06-11',
-        },
-        capabilities: {
-          temperature: { min: 0, max: 1 },
-        },
-        contextWindow: 1000000,
-        releaseDate: '2025-12-02',
-        deprecated: true,
+        sunset: { status: 'legacy' },
       },
       {
         id: 'bedrock/amazon.nova-2-lite-v1:0',
@@ -3391,7 +3424,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 1000000,
         releaseDate: '2025-04-30',
-        deprecated: true,
+        sunset: { status: 'legacy' },
       },
       {
         id: 'bedrock/amazon.nova-pro-v1:0',
@@ -3493,7 +3526,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 128000,
         releaseDate: '2024-09-25',
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
       {
         id: 'bedrock/meta.llama3-2-11b-instruct-v1:0',
@@ -3507,7 +3540,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 128000,
         releaseDate: '2024-09-25',
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
       {
         id: 'bedrock/meta.llama3-2-3b-instruct-v1:0',
@@ -3521,7 +3554,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 128000,
         releaseDate: '2024-09-25',
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
       {
         id: 'bedrock/meta.llama3-2-1b-instruct-v1:0',
@@ -3535,7 +3568,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         },
         contextWindow: 128000,
         releaseDate: '2024-09-25',
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
       {
         id: 'bedrock/meta.llama3-1-405b-instruct-v1:0',
@@ -3548,7 +3581,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
           temperature: { min: 0, max: 1 },
         },
         contextWindow: 128000,
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
       {
         id: 'bedrock/meta.llama3-1-70b-instruct-v1:0',
@@ -3592,19 +3625,6 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
         contextWindow: 256000,
         releaseDate: '2025-12-02',
       },
-      {
-        id: 'bedrock/mistral.mistral-large-2411-v1:0',
-        pricing: {
-          input: 2.0,
-          output: 6.0,
-          updatedAt: '2026-04-01',
-        },
-        capabilities: {
-          temperature: { min: 0, max: 1 },
-        },
-        contextWindow: 128000,
-        deprecated: true,
-      },
       {
         id: 'bedrock/mistral.mistral-large-2407-v1:0',
         pricing: {
@@ -3616,7 +3636,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
           temperature: { min: 0, max: 1 },
         },
         contextWindow: 128000,
-        deprecated: true,
+        sunset: { status: 'legacy' },
       },
       {
         id: 'bedrock/mistral.pixtral-large-2502-v1:0',
@@ -3710,7 +3730,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
           temperature: { min: 0, max: 1 },
         },
         contextWindow: 32000,
-        deprecated: true,
+        sunset: { status: 'deprecated' },
       },
       {
         id: 'bedrock/cohere.command-r-plus-v1:0',
@@ -3723,7 +3743,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
           temperature: { min: 0, max: 1 },
         },
         contextWindow: 128000,
-        deprecated: true,
+        sunset: { status: 'legacy' },
       },
       {
         id: 'bedrock/cohere.command-r-v1:0',
@@ -3736,7 +3756,7 @@ export const PROVIDER_DEFINITIONS: Record<string, ProviderDefinition> = {
           temperature: { min: 0, max: 1 },
         },
         contextWindow: 128000,
-        deprecated: true,
+        sunset: { status: 'legacy' },
       },
     ],
   },
@@ -3850,20 +3870,29 @@ export function isKnownModelId(modelId: string): boolean {
   return false
 }
 
-const DEPRECATED_STATIC_MODEL_IDS = new Set<string>()
+const MODEL_SUNSET_STATUS = new Map<string, 'legacy' | 'deprecated'>()
 for (const [providerId, provider] of Object.entries(PROVIDER_DEFINITIONS)) {
   if ((DYNAMIC_MODEL_PROVIDERS as readonly string[]).includes(providerId)) continue
   for (const model of provider.models) {
-    if (model.deprecated) DEPRECATED_STATIC_MODEL_IDS.add(model.id.toLowerCase())
+    if (model.sunset) MODEL_SUNSET_STATUS.set(model.id.toLowerCase(), model.sunset.status)
   }
 }
 
 /**
- * Whether a stored model id is a deprecated static-catalog model. Dynamic-provider
- * and unknown ids are never deprecated (they carry no static catalog entry).
+ * The sunset tier of a static-catalog model — `legacy` (superseded, callable) or
+ * `deprecated` (retired, API fails) — or `undefined` when not sunset. Mirrors
+ * reading `BlockConfig.sunset.status`. Dynamic-provider and unknown ids return
+ * `undefined` (no static catalog entry).
  */
+export function getModelSunsetStatus(
+  modelId: string | undefined | null
+): 'legacy' | 'deprecated' | undefined {
+  return modelId ? MODEL_SUNSET_STATUS.get(modelId.toLowerCase()) : undefined
+}
+
+/** Whether a stored model id is sunset (either tier). */
 export function isModelDeprecated(modelId: string | undefined | null): boolean {
-  return !!modelId && DEPRECATED_STATIC_MODEL_IDS.has(modelId.toLowerCase())
+  return getModelSunsetStatus(modelId) !== undefined
 }
 
 function getRecommendedModels(): string[] {
diff --git a/apps/sim/providers/utils.ts b/apps/sim/providers/utils.ts
index 641423746e0..ba0ab5629e8 100644
--- a/apps/sim/providers/utils.ts
+++ b/apps/sim/providers/utils.ts
@@ -13,6 +13,8 @@ import {
   normalizeStringRecord,
   normalizeWorkflowVariables,
 } from '@/lib/core/utils/records'
+import type { CustomBlockToolBinding } from '@/lib/workflows/custom-blocks/operations'
+import { isFileFieldType, type WorkflowInputField } from '@/lib/workflows/input-format'
 import {
   buildCanonicalIndex,
   type CanonicalGroup,
@@ -21,6 +23,7 @@ import {
   resolveActiveCanonicalValue,
   scopeCanonicalModesForTool,
 } from '@/lib/workflows/subblocks/visibility'
+import { assembleCustomBlockInputMapping, isCustomBlockType } from '@/blocks/custom/build-config'
 import { isCustomTool } from '@/executor/constants'
 import {
   getComputerUseModels,
@@ -518,6 +521,60 @@ function resolveCanonicalResourceParams(
   return resolved
 }
 
+/** JSON-schema type for a workflow input field (LLM tool schema). */
+function inputFieldSchemaType(fieldType: string): string {
+  switch (fieldType) {
+    case 'number':
+      return 'number'
+    case 'boolean':
+      return 'boolean'
+    case 'object':
+      return 'object'
+    case 'array':
+      return 'array'
+    default:
+      return 'string'
+  }
+}
+
+/**
+ * Build the LLM tool schema for a custom block used as an agent tool: a single
+ * `inputMapping` object whose properties are the block's deployed input fields,
+ * keyed by the field's stable id (so it lines up with `assembleCustomBlockInputMapping`
+ * and the child's id→name remap) and marked required per the publisher's overrides.
+ * `file[]` fields are omitted — the model can't synthesize uploaded-file descriptors.
+ */
+function buildCustomBlockInputMappingSchema(
+  blockName: string,
+  inputFields: WorkflowInputField[],
+  requiredInputIds: string[]
+): ProviderToolConfig['parameters'] {
+  const requiredSet = new Set(requiredInputIds)
+  const properties: Record<string, any> = {}
+  const requiredFields: string[] = []
+  for (const field of inputFields) {
+    if (isFileFieldType(field.type)) continue
+    const key = field.id ?? field.name
+    properties[key] = {
+      type: inputFieldSchemaType(field.type),
+      description: field.description ? `${field.name} — ${field.description}` : field.name,
+    }
+    if (requiredSet.has(key)) requiredFields.push(key)
+  }
+  return {
+    type: 'object',
+    properties: {
+      inputMapping: {
+        type: 'object',
+        description: `Input values for ${blockName}`,
+        properties,
+        required: requiredFields,
+      },
+    },
+    required: requiredFields.length > 0 ? ['inputMapping'] : [],
+  }
+}
+
 /**
  * Transforms a block tool into a provider tool config with operation selection
  *
@@ -533,6 +590,14 @@ export async function transformBlockTool(
     getTool: (toolId: string) => any
     getToolAsync?: (toolId: string) => Promise<any>
     canonicalModes?: Record<string, 'basic' | 'advanced'>
+    /**
+     * Server-only resolver for a custom (deploy-as-block) tool's binding (bound
+     * workflow + input schema), org-scoped to the consumer. Injected as a dependency
+     * — like `getAllBlocks`/`getTool` — so this client-reachable module never imports
+     * the DB-backed `operations` module. Omit for non-server callers that can't
+     * resolve authority; a custom block is then simply not offered as a tool.
+     */
+    resolveCustomBlockBinding?: (blockType: string) => Promise<CustomBlockToolBinding | null>
     /**
      * Position of this tool within its parent agent block's `tool-input` array. Canonical-mode
      * overrides are stored scoped by this index (`${toolIndex}:${canonicalId}`) rather than by
@@ -552,6 +617,59 @@ export async function transformBlockTool(
     return null
   }
 
+  // Custom (deploy-as-block) blocks resolve to the generic `workflow_executor`, but
+  // as an agent tool they must run through the authority boundary (owner identity,
+  // latest deployment, curated outputs) — not the plain workflow executor. Route
+  // them to the dedicated in-process `deployed_block_executor` tool, carrying the
+  // block TYPE (never a source workflow id) so authority is re-resolved server-side.
+  // Dynamic imports keep the DB/executor dependency graph out of client bundles.
+  if (isCustomBlockType(block.type)) {
+    const binding = await options.resolveCustomBlockBinding?.(block.type)
+    if (!binding) {
+      logger.warn(`Custom block tool binding not resolved for type: ${block.type}`)
+      return null
+    }
+    const customToolConfig = getTool('deployed_block_executor')
+    if (!customToolConfig) {
+      logger.warn('deployed_block_executor tool not registered')
+      return null
+    }
+    const inputMapping = assembleCustomBlockInputMapping(block.params || {})
+    // A `file[]` field is omitted from the model schema (the model can't synthesize
+    // upload descriptors). If such a field is REQUIRED and the user hasn't
+    // pre-filled it on the block, no invocation could ever satisfy the child's
+    // required-input check — so don't offer an unusable tool at all.
+    const prefilled = JSON.parse(inputMapping) as Record<string, unknown>
+    const requiredIds = new Set(binding.requiredInputIds)
+    const unfillableFileField = binding.inputFields.find((field) => {
+      const key = field.id ?? field.name
+      return isFileFieldType(field.type) && requiredIds.has(key) && !(key in prefilled)
+    })
+    if (unfillableFileField) {
+      logger.warn(
+        `Custom block ${block.type} not offered as a tool: required file input "${unfillableFileField.name}" has no preset value and cannot be supplied by the model`
+      )
+      return null
+    }
+    return {
+      // Unique per block so two custom-block tools never collide on the wire.
+      id: `deployed_block_executor_${block.type}`,
+      // Name/description come from the block itself — never the source workflow's
+      // metadata, which the consumer has no access to.
+      name: blockDef.name,
+      description: blockDef.description || customToolConfig.description,
+      params: {
+        blockType: block.type,
+        inputMapping,
+      },
+      parameters: buildCustomBlockInputMappingSchema(
+        blockDef.name,
+        binding.inputFields,
+        binding.requiredInputIds
+      ),
+    }
+  }
+
   let toolId: string | null = null
 
   if ((blockDef.tools?.access?.length || 0) > 1) {
diff --git a/apps/sim/public/brand/color/email/wordmark.png b/apps/sim/public/brand/color/email/wordmark.png
index 977814b5655..2c3a6c314f2 100644
Binary files a/apps/sim/public/brand/color/email/wordmark.png and b/apps/sim/public/brand/color/email/wordmark.png differ
diff --git a/apps/sim/public/library/best-ai-agents-for-data-extraction-and-rag-in-2026/cover.jpg b/apps/sim/public/library/best-ai-agents-for-data-extraction-and-rag-in-2026/cover.jpg
new file mode 100644
index 00000000000..a90a2c607f1
Binary files /dev/null and b/apps/sim/public/library/best-ai-agents-for-data-extraction-and-rag-in-2026/cover.jpg differ
diff --git a/apps/sim/public/static/github-icon.png b/apps/sim/public/static/github-icon.png
index 1f6d5ae3e40..2fa312fa96b 100644
Binary files a/apps/sim/public/static/github-icon.png and b/apps/sim/public/static/github-icon.png differ
diff --git a/apps/sim/public/static/linkedin-icon.png b/apps/sim/public/static/linkedin-icon.png
index fd97e14b0c4..2385697d021 100644
Binary files a/apps/sim/public/static/linkedin-icon.png and b/apps/sim/public/static/linkedin-icon.png differ
diff --git a/apps/sim/public/static/slack-icon.png b/apps/sim/public/static/slack-icon.png
index c560d6563bd..c7635a5f373 100644
Binary files a/apps/sim/public/static/slack-icon.png and b/apps/sim/public/static/slack-icon.png differ
diff --git a/apps/sim/public/static/x-icon.png b/apps/sim/public/static/x-icon.png
index 58d635b3fb8..968d1bbb7fe 100644
Binary files a/apps/sim/public/static/x-icon.png and b/apps/sim/public/static/x-icon.png differ
diff --git a/apps/sim/stores/AGENTS.md b/apps/sim/stores/AGENTS.md
index bef10dbc6fc..8883b425d8e 100644
--- a/apps/sim/stores/AGENTS.md
+++ b/apps/sim/stores/AGENTS.md
@@ -3,3 +3,27 @@
 Applies to Zustand stores under `apps/sim/**/stores/**` and `apps/sim/**/store.ts`.
 
 Store authoring rules — `devtools` middleware, `persist` + `partialize` only for reload-surviving state, immutable updates, `set((state) => ...)` for previous-state-dependent updates, `reset()` action, splitting complex stores into `store.ts` + `types.ts`, and `_hasHydrated` tracking — live in `.claude/rules/sim-stores.md`.
+
+## Workflow value state invariants
+
+Workflow state is split across two stores on purpose: `useWorkflowStore` holds block
+structure (plus a hydration-time copy of each subblock value) and `useSubBlockStore`
+holds live values, so per-keystroke edits don't re-render the canvas. Rules that keep
+this split correct:
+
+- The structure's `subBlocks[*].value` is stale after any edit. Never read it directly
+  for a current value — merge via `mergeSubblockState`/`mergeSubblockStateWithValues`
+  (single implementation in `@sim/workflow-persistence/subblocks`) or read the
+  subblock store. Exception: condition/router dynamic-handle subblocks dual-write the
+  structure (`syncDynamicHandleSubblockValue`) and may be read from either source.
+- Merge semantics are tri-state: a key present in the subblock store wins — including
+  `null`, which means "explicitly cleared". Absent/`undefined` falls back to the
+  structure. Do not add merge or precedence logic anywhere else; if a new reader needs
+  different semantics, extend the shared merge.
+- Every subblock-store write must go through `collaborativeSetSubblockValue` (or a
+  batch equivalent) so the identical value is persisted via the realtime server. A
+  store write that skips persistence makes the client's merged state diverge from the
+  DB draft, which deploy snapshots — producing phantom "Update" states on the deploy
+  button that clear on refresh. Hydration-derived local-only writes are allowed only
+  when change detection compensates (see `populateTriggerFieldsFromConfig` +
+  `normalizeTriggerConfigValues`).
diff --git a/apps/sim/stores/operation-queue/store.ts b/apps/sim/stores/operation-queue/store.ts
index 200abdf2b3f..b3feae6b49b 100644
--- a/apps/sim/stores/operation-queue/store.ts
+++ b/apps/sim/stores/operation-queue/store.ts
@@ -118,9 +118,19 @@ function dropOperationForMissingTarget(operation: QueuedOperation): boolean {
 export const useOperationQueueStore = create<OperationQueueState>((set, get) => ({
   operations: [],
   workflowOperationVersions: {},
+  remoteApplyVersions: {},
   isProcessing: false,
   hasOperationError: false,
 
+  markRemoteApplied: (workflowId) => {
+    set((state) => ({
+      remoteApplyVersions: {
+        ...state.remoteApplyVersions,
+        [workflowId]: (state.remoteApplyVersions[workflowId] ?? 0) + 1,
+      },
+    }))
+  },
+
   addToQueue: (operation) => {
     set((state) => ({
       workflowOperationVersions: {
diff --git a/apps/sim/stores/operation-queue/types.ts b/apps/sim/stores/operation-queue/types.ts
index fb56a2a694b..796fc527ae7 100644
--- a/apps/sim/stores/operation-queue/types.ts
+++ b/apps/sim/stores/operation-queue/types.ts
@@ -44,10 +44,20 @@ export interface QueuedOperation {
 export interface OperationQueueState {
   operations: QueuedOperation[]
   workflowOperationVersions: Record<string, number>
+  /**
+   * Per-workflow counter bumped every time a REMOTE collaborator's operation
+   * (block op, subblock update, variable update) is applied to the local
+   * stores. Lets full-state syncs (`syncLocalDraftFromServer`) detect that a
+   * remote edit landed while their fetch was in flight — the fetched snapshot
+   * may predate that edit's persist — and refetch instead of clobbering it.
+   */
+  remoteApplyVersions: Record<string, number>
   isProcessing: boolean
   hasOperationError: boolean
 
   addToQueue: (operation: Omit<QueuedOperation, 'timestamp' | 'retryCount' | 'status'>) => void
+  /** Records that a remote collaborator's operation was applied to local stores. */
+  markRemoteApplied: (workflowId: string) => void
   confirmOperation: (operationId: string) => void
   failOperation: (operationId: string, retryable?: boolean) => void
   handleOperationTimeout: (operationId: string) => void
diff --git a/apps/sim/stores/workflows/subblock/store.ts b/apps/sim/stores/workflows/subblock/store.ts
index 7cb745b9fdd..c723f274bca 100644
--- a/apps/sim/stores/workflows/subblock/store.ts
+++ b/apps/sim/stores/workflows/subblock/store.ts
@@ -24,15 +24,36 @@ export const EMPTY_SUBBLOCK_VALUES: Record<string, Record<string, SubBlockValue>
 export const EMPTY_BLOCK_SUBBLOCK_VALUES: Record<string, SubBlockValue> = {}
 
 /**
- * SubBlockState stores values for all subblocks in workflows
+ * SubBlockState stores values for all subblocks in workflows.
  *
- * Important implementation notes:
- * 1. Values are stored per workflow, per block, per subblock
- * 2. When workflows are synced to the database, the mergeSubblockState function
- *    in utils.ts combines the block structure with these values
- * 3. If a subblock value exists here but not in the block structure
- *    (e.g., inputFormat in starter block), the merge function will include it
- *    in the synchronized state to ensure persistence
+ * Architecture: values deliberately live here, split from the workflow store's
+ * block structure, so per-keystroke edits do not re-render the canvas graph.
+ * The structure keeps a copy of each value from hydration time only — it goes
+ * stale as soon as a value is edited (except condition/router dynamic-handle
+ * subblocks, which dual-write the structure because edge handles derive from
+ * it). Whenever full state is needed (change detection, export, manual runs,
+ * diffs), mergeSubblockState/mergeSubblockStateWithValues joins this store
+ * onto the structure.
+ *
+ * Value semantics at that join (single source of truth for the contract):
+ * - Key present with any value, including null: this store wins. Null means
+ *   the user explicitly cleared the field — it must NOT fall back to the
+ *   structure's stale copy, or cleared fields resurrect in comparisons and
+ *   serialization while the DB (correctly) holds null.
+ * - Key absent or undefined: no value recorded; the structure's value stands.
+ * - initializeFromWorkflow seeds every structure key (nulls included) at
+ *   hydration, so post-hydration "present with null" is always meaningful.
+ *
+ * Persistence: user-authored edits flow through collaborativeSetSubblockValue,
+ * which updates this store and queues the identical value to the realtime
+ * server — the client's merged state and the DB draft stay equivalent, which
+ * is what keeps deploy-time change detection honest (deploy snapshots the DB
+ * draft). Direct setValue callers do not persist, and each is safe for a
+ * different reason: remote-broadcast application (already persisted
+ * server-side), undo/redo (persists via its own queued inverse operations),
+ * webhook management (writes trigger-runtime ids the comparison excludes), and
+ * populateTriggerFieldsFromConfig (values derived from the persisted
+ * triggerConfig aggregate, compensated via normalizeTriggerConfigValues).
  */
 
 export const useSubBlockStore = create<SubBlockStore>()(
@@ -60,16 +81,25 @@ export const useSubBlockStore = create<SubBlockStore>()(
               }
             }
 
-            if (!row.id) {
-              row.id = generateId()
+            const needsId = !row.id
+            const needsCells = !row.cells || typeof row.cells !== 'object'
+            if (!needsId && !needsCells) {
+              return row
             }
-
-            if (!row.cells || typeof row.cells !== 'object') {
+            if (needsCells) {
               logger.warn('Fixing malformed table row cells', { blockId, subBlockId, row })
-              row.cells = { Key: '', Value: '' }
             }
 
-            return row
+            /**
+             * Repair on a copy: the incoming rows are shared with the caller
+             * (component state, socket payloads), and mutating them in place
+             * corrupts state owned elsewhere. Valid rows keep their identity.
+             */
+            return {
+              ...row,
+              ...(needsId ? { id: generateId() } : {}),
+              ...(needsCells ? { cells: { Key: '', Value: '' } } : {}),
+            }
           })
         }
       }
diff --git a/apps/sim/stores/workflows/subblock/types.ts b/apps/sim/stores/workflows/subblock/types.ts
index f9137d52ad8..f62410bd4af 100644
--- a/apps/sim/stores/workflows/subblock/types.ts
+++ b/apps/sim/stores/workflows/subblock/types.ts
@@ -13,6 +13,15 @@ interface SubBlockStoreState {
 
 export interface SubBlockStore extends SubBlockStoreState {
   setValue: (blockId: string, subBlockId: string, value: SubBlockValue) => void
+  /**
+   * Point read for display purposes. Collapses "no value recorded" and
+   * "explicitly cleared" into `null` (`?? null` on the raw map) — fine for
+   * rendering, where both states look empty. Consumers that need the
+   * tri-state distinction (present-null means cleared, absent means unknown;
+   * see the merge semantics in `@sim/workflow-persistence/subblocks`) must
+   * read `workflowValues` directly and use key presence, as
+   * `mergeSubblockStateWithValues` does.
+   */
   getValue: (blockId: string, subBlockId: string) => SubBlockValue | undefined
   clear: () => void
   initializeFromWorkflow: (workflowId: string, blocks: Record<string, BlockState>) => void
diff --git a/apps/sim/stores/workflows/sync-local-draft.test.ts b/apps/sim/stores/workflows/sync-local-draft.test.ts
new file mode 100644
index 00000000000..fdf0b8831c2
--- /dev/null
+++ b/apps/sim/stores/workflows/sync-local-draft.test.ts
@@ -0,0 +1,390 @@
+/**
+ * @vitest-environment node
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const {
+  mockFetchQuery,
+  mockApplyWorkflowStateToStores,
+  mockGetRegistryState,
+  mockHasPendingOperations,
+  mockGetOperationQueueState,
+  mockGetWorkflowDiffState,
+} = vi.hoisted(() => ({
+  mockFetchQuery: vi.fn(),
+  mockApplyWorkflowStateToStores: vi.fn(),
+  mockGetRegistryState: vi.fn(() => ({ activeWorkflowId: 'workflow-a' })),
+  mockHasPendingOperations: vi.fn(() => false),
+  mockGetOperationQueueState: vi.fn(() => ({
+    hasPendingOperations: mockHasPendingOperations,
+    workflowOperationVersions: {},
+    remoteApplyVersions: {},
+  })),
+  mockGetWorkflowDiffState: vi.fn(() => ({
+    hasActiveDiff: false,
+    pendingExternalUpdates: {},
+    reconcilingWorkflows: {},
+    reconciliationErrors: {},
+    remoteUpdateVersions: {},
+  })),
+}))
+
+vi.mock('@/app/_shell/providers/get-query-client', () => ({
+  getQueryClient: () => ({ fetchQuery: mockFetchQuery }),
+}))
+
+vi.mock('@/hooks/queries/utils/fetch-workflow-envelope', () => ({
+  fetchWorkflowEnvelope: vi.fn(),
+}))
+
+vi.mock('@/hooks/queries/utils/workflow-keys', () => ({
+  workflowKeys: {
+    state: (id: string) => ['workflow', 'state', id],
+  },
+}))
+
+vi.mock('@/stores/workflow-diff/utils', () => ({
+  applyWorkflowStateToStores: mockApplyWorkflowStateToStores,
+}))
+
+vi.mock('@/stores/workflow-diff/store', () => ({
+  useWorkflowDiffStore: {
+    getState: mockGetWorkflowDiffState,
+  },
+}))
+
+vi.mock('@/stores/operation-queue/store', () => ({
+  useOperationQueueStore: {
+    getState: mockGetOperationQueueState,
+  },
+}))
+
+vi.mock('@/stores/workflows/registry/store', () => ({
+  useWorkflowRegistry: {
+    getState: mockGetRegistryState,
+  },
+}))
+
+import {
+  canApplyDraftSnapshot,
+  captureDraftVersions,
+  syncLocalDraftFromServer,
+} from '@/stores/workflows/sync-local-draft'
+
+function buildEnvelopeState() {
+  return {
+    blocks: {},
+    edges: [],
+    loops: {},
+    parallels: {},
+    lastSaved: 1,
+  }
+}
+
+describe('syncLocalDraftFromServer', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockGetRegistryState.mockReturnValue({ activeWorkflowId: 'workflow-a' })
+    mockHasPendingOperations.mockReturnValue(false)
+    mockGetOperationQueueState.mockImplementation(() => ({
+      hasPendingOperations: mockHasPendingOperations,
+      workflowOperationVersions: {},
+      remoteApplyVersions: {},
+    }))
+    mockGetWorkflowDiffState.mockReturnValue({
+      hasActiveDiff: false,
+      pendingExternalUpdates: {},
+      reconcilingWorkflows: {},
+      reconciliationErrors: {},
+      remoteUpdateVersions: {},
+    })
+  })
+
+  it('fetches through the shared workflow-state query key with a fresh fetch', async () => {
+    mockFetchQuery.mockResolvedValue({ state: buildEnvelopeState(), variables: {} })
+
+    await expect(syncLocalDraftFromServer('workflow-a')).resolves.toBe(true)
+
+    expect(mockFetchQuery).toHaveBeenCalledWith(
+      expect.objectContaining({
+        queryKey: ['workflow', 'state', 'workflow-a'],
+        staleTime: 0,
+      })
+    )
+  })
+
+  it('hydrates sibling workflow variables into the applied workflow state', async () => {
+    mockFetchQuery.mockResolvedValue({
+      state: buildEnvelopeState(),
+      variables: {
+        'variable-a': {
+          id: 'variable-a',
+          name: 'API_KEY',
+          type: 'plain',
+          value: 'secret',
+        },
+      },
+    })
+
+    await expect(syncLocalDraftFromServer('workflow-a')).resolves.toBe(true)
+
+    expect(mockApplyWorkflowStateToStores).toHaveBeenCalledWith(
+      'workflow-a',
+      expect.objectContaining({
+        variables: {
+          'variable-a': {
+            id: 'variable-a',
+            name: 'API_KEY',
+            type: 'plain',
+            value: 'secret',
+          },
+        },
+      }),
+      { updateLastSaved: true }
+    )
+  })
+
+  it('does not mutate the shared query-cache envelope when stamping variables', async () => {
+    const envelope = {
+      state: buildEnvelopeState(),
+      variables: { 'variable-a': { id: 'variable-a', name: 'X', type: 'plain', value: '1' } },
+    }
+    mockFetchQuery.mockResolvedValue(envelope)
+
+    await expect(syncLocalDraftFromServer('workflow-a')).resolves.toBe(true)
+
+    expect(Object.hasOwn(envelope.state, 'variables')).toBe(false)
+    const appliedState = mockApplyWorkflowStateToStores.mock.calls[0][1]
+    expect(appliedState).not.toBe(envelope.state)
+  })
+
+  it('does not apply a fetched draft after navigation changes the active workflow', async () => {
+    mockGetRegistryState
+      .mockReturnValueOnce({ activeWorkflowId: 'workflow-a' })
+      .mockReturnValueOnce({ activeWorkflowId: 'workflow-b' })
+    mockFetchQuery.mockResolvedValue({ state: buildEnvelopeState(), variables: {} })
+
+    await expect(syncLocalDraftFromServer('workflow-a')).resolves.toBe(false)
+
+    expect(mockApplyWorkflowStateToStores).not.toHaveBeenCalled()
+  })
+
+  it('does not synthesize an empty variables object when the server omits variables', async () => {
+    mockFetchQuery.mockResolvedValue({ state: buildEnvelopeState() })
+
+    await expect(syncLocalDraftFromServer('workflow-a')).resolves.toBe(true)
+
+    const appliedState = mockApplyWorkflowStateToStores.mock.calls[0][1]
+    expect(Object.hasOwn(appliedState, 'variables')).toBe(false)
+  })
+
+  it('does not apply a fetched draft over newly queued local operations', async () => {
+    mockHasPendingOperations.mockReturnValueOnce(false).mockReturnValueOnce(true)
+    mockFetchQuery.mockResolvedValue({ state: buildEnvelopeState(), variables: {} })
+
+    await expect(syncLocalDraftFromServer('workflow-a')).resolves.toBe(false)
+
+    expect(mockApplyWorkflowStateToStores).not.toHaveBeenCalled()
+  })
+
+  it('does not apply a fetched draft when an active diff is showing', async () => {
+    mockGetWorkflowDiffState.mockReturnValue({
+      hasActiveDiff: true,
+      pendingExternalUpdates: {},
+      reconcilingWorkflows: {},
+      reconciliationErrors: {},
+      remoteUpdateVersions: {},
+    })
+    mockFetchQuery.mockResolvedValue({ state: buildEnvelopeState(), variables: {} })
+
+    await expect(syncLocalDraftFromServer('workflow-a')).resolves.toBe(false)
+
+    expect(mockApplyWorkflowStateToStores).not.toHaveBeenCalled()
+  })
+
+  it('does not apply a fetched draft when a newer remote update arrives during fetch', async () => {
+    mockGetWorkflowDiffState
+      .mockReturnValueOnce({
+        hasActiveDiff: false,
+        pendingExternalUpdates: {},
+        reconcilingWorkflows: {},
+        reconciliationErrors: {},
+        remoteUpdateVersions: {},
+      })
+      .mockReturnValueOnce({
+        hasActiveDiff: false,
+        pendingExternalUpdates: {},
+        reconcilingWorkflows: {},
+        reconciliationErrors: {},
+        remoteUpdateVersions: { 'workflow-a': 1 },
+      })
+    mockFetchQuery.mockResolvedValue({ state: buildEnvelopeState(), variables: {} })
+
+    await expect(syncLocalDraftFromServer('workflow-a')).resolves.toBe(false)
+
+    expect(mockApplyWorkflowStateToStores).not.toHaveBeenCalled()
+  })
+
+  it('does not apply a fetched draft when local operations queue and drain during fetch', async () => {
+    mockGetOperationQueueState
+      .mockReturnValueOnce({
+        hasPendingOperations: mockHasPendingOperations,
+        workflowOperationVersions: {},
+        remoteApplyVersions: {},
+      })
+      .mockReturnValueOnce({
+        hasPendingOperations: mockHasPendingOperations,
+        workflowOperationVersions: {},
+        remoteApplyVersions: {},
+      })
+      .mockReturnValueOnce({
+        hasPendingOperations: mockHasPendingOperations,
+        workflowOperationVersions: {},
+        remoteApplyVersions: {},
+      })
+      .mockReturnValueOnce({
+        hasPendingOperations: mockHasPendingOperations,
+        workflowOperationVersions: { 'workflow-a': 1 },
+        remoteApplyVersions: {},
+      })
+    mockFetchQuery.mockResolvedValue({ state: buildEnvelopeState(), variables: {} })
+
+    await expect(syncLocalDraftFromServer('workflow-a')).resolves.toBe(false)
+
+    expect(mockApplyWorkflowStateToStores).not.toHaveBeenCalled()
+  })
+
+  it('refetches when a remote op is applied during the fetch, then applies the fresh snapshot', async () => {
+    const queueState = {
+      hasPendingOperations: mockHasPendingOperations,
+      workflowOperationVersions: {} as Record<string, number>,
+      remoteApplyVersions: {} as Record<string, number>,
+    }
+    mockGetOperationQueueState.mockImplementation(() => queueState)
+
+    const staleEnvelope = { state: buildEnvelopeState(), variables: {} }
+    const freshEnvelope = { state: { ...buildEnvelopeState(), lastSaved: 2 }, variables: {} }
+    mockFetchQuery
+      .mockImplementationOnce(async () => {
+        queueState.remoteApplyVersions = { 'workflow-a': 1 }
+        return staleEnvelope
+      })
+      .mockResolvedValueOnce(freshEnvelope)
+
+    await expect(syncLocalDraftFromServer('workflow-a')).resolves.toBe(true)
+
+    expect(mockFetchQuery).toHaveBeenCalledTimes(2)
+    expect(mockApplyWorkflowStateToStores).toHaveBeenCalledWith(
+      'workflow-a',
+      expect.objectContaining({ lastSaved: 2 }),
+      { updateLastSaved: true }
+    )
+  })
+
+  it('applies the latest snapshot after exhausting retries during a busy remote session', async () => {
+    const queueState = {
+      hasPendingOperations: mockHasPendingOperations,
+      workflowOperationVersions: {} as Record<string, number>,
+      remoteApplyVersions: {} as Record<string, number>,
+    }
+    mockGetOperationQueueState.mockImplementation(() => queueState)
+
+    let remoteVersion = 0
+    mockFetchQuery.mockImplementation(async () => {
+      remoteVersion += 1
+      queueState.remoteApplyVersions = { 'workflow-a': remoteVersion }
+      return { state: { ...buildEnvelopeState(), lastSaved: remoteVersion }, variables: {} }
+    })
+
+    await expect(syncLocalDraftFromServer('workflow-a')).resolves.toBe(true)
+
+    expect(mockFetchQuery).toHaveBeenCalledTimes(3)
+    expect(mockApplyWorkflowStateToStores).toHaveBeenCalledWith(
+      'workflow-a',
+      expect.objectContaining({ lastSaved: 3 }),
+      { updateLastSaved: true }
+    )
+  })
+
+  it('propagates fetch failures to the caller', async () => {
+    mockFetchQuery.mockRejectedValue(new Error('network down'))
+
+    await expect(syncLocalDraftFromServer('workflow-a')).rejects.toThrow('network down')
+
+    expect(mockApplyWorkflowStateToStores).not.toHaveBeenCalled()
+  })
+})
+
+describe('canApplyDraftSnapshot', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockGetRegistryState.mockReturnValue({ activeWorkflowId: 'workflow-a' })
+    mockHasPendingOperations.mockReturnValue(false)
+    mockGetOperationQueueState.mockImplementation(() => ({
+      hasPendingOperations: mockHasPendingOperations,
+      workflowOperationVersions: {},
+      remoteApplyVersions: {},
+    }))
+    mockGetWorkflowDiffState.mockReturnValue({
+      hasActiveDiff: false,
+      pendingExternalUpdates: {},
+      reconcilingWorkflows: {},
+      reconciliationErrors: {},
+      remoteUpdateVersions: {},
+    })
+  })
+
+  it('allows applying when nothing moved since capture', () => {
+    const versions = captureDraftVersions('workflow-a')
+
+    expect(canApplyDraftSnapshot('workflow-a', versions)).toBe(true)
+  })
+
+  it('refuses when an external full reload (workflow-updated) landed since capture', () => {
+    const versions = captureDraftVersions('workflow-a')
+    mockGetWorkflowDiffState.mockReturnValue({
+      hasActiveDiff: false,
+      pendingExternalUpdates: {},
+      reconcilingWorkflows: {},
+      reconciliationErrors: {},
+      remoteUpdateVersions: { 'workflow-a': 1 },
+    })
+
+    expect(canApplyDraftSnapshot('workflow-a', versions)).toBe(false)
+  })
+
+  it('refuses while an external reload is still reconciling', () => {
+    const versions = captureDraftVersions('workflow-a')
+    mockGetWorkflowDiffState.mockReturnValue({
+      hasActiveDiff: false,
+      pendingExternalUpdates: {},
+      reconcilingWorkflows: { 'workflow-a': true },
+      reconciliationErrors: {},
+      remoteUpdateVersions: {},
+    })
+
+    expect(canApplyDraftSnapshot('workflow-a', versions)).toBe(false)
+  })
+
+  it('refuses when a remote collaborator op was applied since capture', () => {
+    const versions = captureDraftVersions('workflow-a')
+    mockGetOperationQueueState.mockImplementation(() => ({
+      hasPendingOperations: mockHasPendingOperations,
+      workflowOperationVersions: {},
+      remoteApplyVersions: { 'workflow-a': 1 },
+    }))
+
+    expect(canApplyDraftSnapshot('workflow-a', versions)).toBe(false)
+  })
+
+  it('refuses when a local edit was enqueued since capture', () => {
+    const versions = captureDraftVersions('workflow-a')
+    mockGetOperationQueueState.mockImplementation(() => ({
+      hasPendingOperations: mockHasPendingOperations,
+      workflowOperationVersions: { 'workflow-a': 1 },
+      remoteApplyVersions: {},
+    }))
+
+    expect(canApplyDraftSnapshot('workflow-a', versions)).toBe(false)
+  })
+})
diff --git a/apps/sim/stores/workflows/sync-local-draft.ts b/apps/sim/stores/workflows/sync-local-draft.ts
new file mode 100644
index 00000000000..c62e6fb68a6
--- /dev/null
+++ b/apps/sim/stores/workflows/sync-local-draft.ts
@@ -0,0 +1,159 @@
+import { createLogger } from '@sim/logger'
+import { sleep } from '@sim/utils/helpers'
+import { getQueryClient } from '@/app/_shell/providers/get-query-client'
+import { fetchWorkflowEnvelope } from '@/hooks/queries/utils/fetch-workflow-envelope'
+import { workflowKeys } from '@/hooks/queries/utils/workflow-keys'
+import { useOperationQueueStore } from '@/stores/operation-queue/store'
+import { useWorkflowDiffStore } from '@/stores/workflow-diff/store'
+import { applyWorkflowStateToStores } from '@/stores/workflow-diff/utils'
+import { useWorkflowRegistry } from '@/stores/workflows/registry/store'
+import type { WorkflowState } from '@/stores/workflows/workflow/types'
+
+const logger = createLogger('SyncLocalDraft')
+
+/**
+ * A remote collaborator's edit applied mid-fetch means the fetched snapshot may
+ * predate that edit's persist (the realtime server debounces writes), so the
+ * sync refetches. Bounded: a persistently busy session keeps converging through
+ * op broadcasts anyway, so after the last attempt the latest snapshot is
+ * applied rather than leaving a reconnecting client on stale state.
+ */
+const MAX_SYNC_FETCH_ATTEMPTS = 3
+const SYNC_RETRY_DELAY_MS = 50
+
+/**
+ * Version vector describing everything that can move workflow state under a
+ * full-state snapshot while it is being fetched or held:
+ * - `localOperation`: local edits enqueued (operation queue)
+ * - `remoteApply`: remote collaborator ops applied to the stores
+ * - `remoteUpdate`: external full reloads (workflow-updated / revert)
+ */
+export interface DraftSyncVersions {
+  localOperation: number
+  remoteApply: number
+  remoteUpdate: number
+}
+
+/** Captures the current {@link DraftSyncVersions} for a workflow. */
+export function captureDraftVersions(workflowId: string): DraftSyncVersions {
+  const queueState = useOperationQueueStore.getState()
+  return {
+    localOperation: queueState.workflowOperationVersions[workflowId] ?? 0,
+    remoteApply: queueState.remoteApplyVersions[workflowId] ?? 0,
+    remoteUpdate: useWorkflowDiffStore.getState().remoteUpdateVersions[workflowId] ?? 0,
+  }
+}
+
+/**
+ * Hard guards shared by every snapshot application: the workflow is still
+ * active, nothing local is pending or was enqueued since capture, no diff or
+ * reconciliation is in progress, and no external full reload
+ * (workflow-updated / revert) landed since capture. Remote collaborator ops
+ * (`remoteApply`) are deliberately NOT part of this core — the sync loop
+ * treats them as a refetch signal rather than a refusal.
+ */
+function canApplyServerSnapshot(
+  workflowId: string,
+  expected: Pick<DraftSyncVersions, 'localOperation' | 'remoteUpdate'>
+): boolean {
+  if (useWorkflowRegistry.getState().activeWorkflowId !== workflowId) return false
+  const operationQueueState = useOperationQueueStore.getState()
+  if (operationQueueState.hasPendingOperations(workflowId)) return false
+  if (
+    (operationQueueState.workflowOperationVersions[workflowId] ?? 0) !== expected.localOperation
+  ) {
+    return false
+  }
+
+  const diffState = useWorkflowDiffStore.getState()
+  return (
+    !diffState.hasActiveDiff &&
+    !diffState.pendingExternalUpdates[workflowId] &&
+    !diffState.reconcilingWorkflows[workflowId] &&
+    !diffState.reconciliationErrors[workflowId] &&
+    (diffState.remoteUpdateVersions[workflowId] ?? 0) === expected.remoteUpdate
+  )
+}
+
+/**
+ * Whether a full-state snapshot captured alongside `versions` may still be
+ * applied. Unlike the sync loop — which refetches when remote collaborator
+ * ops land mid-fetch — this treats a `remoteApply` movement as a hard
+ * refusal, because callers holding a fixed snapshot (e.g. the raw join-state
+ * fallback) cannot refetch a fresher one.
+ */
+export function canApplyDraftSnapshot(workflowId: string, versions: DraftSyncVersions): boolean {
+  return (
+    canApplyServerSnapshot(workflowId, versions) &&
+    (useOperationQueueStore.getState().remoteApplyVersions[workflowId] ?? 0) ===
+      versions.remoteApply
+  )
+}
+
+/**
+ * Reconciles the local Zustand stores with the server's current draft by
+ * fetching migrated state over HTTP and applying it — used after deploys and
+ * on socket join, where the realtime server can only supply raw (unmigrated)
+ * state.
+ *
+ * Fetches through the shared `workflowKeys.state(id)` React Query entry
+ * (always-fresh, in-flight deduped), so a sync racing the registry hydration
+ * coalesces into a single request and the cache stays warm.
+ *
+ * Refuses to apply (returns false) when the session is busy — pending or
+ * newly-queued local operations, an active copilot diff, in-progress
+ * reconciliation, a newer remote update during the fetch, or navigation away —
+ * so it never clobbers in-flight work. A remote collaborator's op applied
+ * during the fetch triggers a bounded refetch instead (the snapshot may
+ * predate that op's persist). Throws when the fetch itself fails.
+ */
+export async function syncLocalDraftFromServer(workflowId: string): Promise<boolean> {
+  if (useWorkflowRegistry.getState().activeWorkflowId !== workflowId) return false
+  if (useOperationQueueStore.getState().hasPendingOperations(workflowId)) return false
+  const versionsAtStart = captureDraftVersions(workflowId)
+
+  let envelope: Awaited<ReturnType<typeof fetchWorkflowEnvelope>> | undefined
+  for (let attempt = 1; ; attempt++) {
+    const remoteApplyVersionAtStart =
+      useOperationQueueStore.getState().remoteApplyVersions[workflowId] ?? 0
+
+    envelope = await getQueryClient().fetchQuery({
+      queryKey: workflowKeys.state(workflowId),
+      queryFn: ({ signal }) => fetchWorkflowEnvelope(workflowId, signal),
+      staleTime: 0,
+    })
+
+    if (!canApplyServerSnapshot(workflowId, versionsAtStart)) {
+      return false
+    }
+
+    const remoteOpAppliedDuringFetch =
+      (useOperationQueueStore.getState().remoteApplyVersions[workflowId] ?? 0) !==
+      remoteApplyVersionAtStart
+    if (!remoteOpAppliedDuringFetch) break
+
+    if (attempt >= MAX_SYNC_FETCH_ATTEMPTS) {
+      logger.info('Applying latest draft snapshot despite concurrent remote ops', {
+        workflowId,
+        attempts: attempt,
+      })
+      break
+    }
+    await sleep(SYNC_RETRY_DELAY_MS)
+  }
+
+  const wireState = envelope?.state
+  if (!envelope || !wireState) {
+    throw new Error('No workflow state was returned while syncing the local draft')
+  }
+
+  // Copy before annotating: the envelope is the shared React Query cache entry
+  // and must not be mutated.
+  const draftState = Object.hasOwn(envelope, 'variables')
+    ? { ...wireState, variables: envelope.variables || {} }
+    : { ...wireState }
+  // double-cast-allowed: workflowStateSchema is a wire supertype; normalized workflow state is persisted in store-compatible shape
+  const workflowState = draftState as unknown as WorkflowState
+  applyWorkflowStateToStores(workflowId, workflowState, { updateLastSaved: true })
+  return true
+}
diff --git a/apps/sim/stores/workflows/utils.test.ts b/apps/sim/stores/workflows/utils.test.ts
index 00127c138ed..68966905752 100644
--- a/apps/sim/stores/workflows/utils.test.ts
+++ b/apps/sim/stores/workflows/utils.test.ts
@@ -5,6 +5,7 @@ import {
   createLoopBlock,
   createStarterBlock,
 } from '@sim/testing'
+import type { Edge } from 'reactflow'
 import { describe, expect, it } from 'vitest'
 import { normalizeName } from '@/executor/constants'
 import { getUniqueBlockName, regenerateBlockIds } from './utils'
@@ -438,6 +439,67 @@ describe('regenerateBlockIds', () => {
     expect(duplicatedBlock.data?.parentId).toBe(loopId)
   })
 
+  /**
+   * Regression: a fallback writer stamped a condition block's `conditions`
+   * subblock `short-input`. The id remap must key on block type + subblock key
+   * (not the drifted stored type) so the condition row ids and the outgoing
+   * edge's sourceHandle move together — previously the handle remapped while
+   * the row ids stayed stale, orphaning the edge.
+   */
+  it('keeps condition row ids and edge handles consistent when the stored subblock type drifted', () => {
+    const conditionId = 'condition-1'
+    const targetId = 'target-1'
+
+    const blocksToCopy = {
+      [conditionId]: createBlock({
+        id: conditionId,
+        type: 'condition',
+        name: 'botFilter',
+        subBlocks: {
+          conditions: {
+            id: 'conditions',
+            type: 'short-input',
+            value: JSON.stringify([
+              { id: `${conditionId}-if`, title: 'if', value: '<a.b>' },
+              { id: `${conditionId}-else`, title: 'else', value: '' },
+            ]),
+          },
+        },
+      }),
+      [targetId]: createAgentBlock({ id: targetId, name: 'Agent 1' }),
+    }
+
+    const edges = [
+      {
+        id: 'edge-1',
+        source: conditionId,
+        sourceHandle: `condition-${conditionId}-else`,
+        target: targetId,
+        targetHandle: 'target',
+      },
+    ] as Edge[]
+
+    const result = regenerateBlockIds(
+      blocksToCopy,
+      edges,
+      {},
+      {},
+      {},
+      positionOffset,
+      {},
+      getUniqueBlockName
+    )
+
+    const newCondition = Object.values(result.blocks).find((b) => b.type === 'condition')!
+    const newEdge = result.edges[0]
+    const rowIds = JSON.parse(newCondition.subBlocks.conditions.value as string).map(
+      (row: { id: string }) => row.id
+    )
+
+    expect(rowIds).toEqual([`${newCondition.id}-if`, `${newCondition.id}-else`])
+    expect(newEdge.sourceHandle).toBe(`condition-${newCondition.id}-else`)
+  })
+
   it('should unlock pasted block when source is locked', () => {
     const blockId = 'block-1'
 
diff --git a/apps/sim/stores/workflows/utils.ts b/apps/sim/stores/workflows/utils.ts
index a57f04b95af..feaf871af1b 100644
--- a/apps/sim/stores/workflows/utils.ts
+++ b/apps/sim/stores/workflows/utils.ts
@@ -5,11 +5,13 @@ import type { Edge } from 'reactflow'
 import { DEFAULT_DUPLICATE_OFFSET } from '@/lib/workflows/autolayout/constants'
 import { getEffectiveBlockOutputs } from '@/lib/workflows/blocks/block-outputs'
 import { remapConditionBlockIds, remapConditionEdgeHandle } from '@/lib/workflows/condition-ids'
+import { isDynamicHandleSubblock } from '@/lib/workflows/dynamic-handle-topology'
 import { createDefaultInputFormatField } from '@/lib/workflows/input-format'
 import { buildDefaultCanonicalModes } from '@/lib/workflows/subblocks/visibility'
 import { hasTriggerCapability } from '@/lib/workflows/triggers/trigger-utils'
 import { getBlock } from '@/blocks'
 import { normalizeName } from '@/executor/constants'
+import { useWorkflowRegistry } from '@/stores/workflows/registry/store'
 import { useSubBlockStore } from '@/stores/workflows/subblock/store'
 import { validateEdges } from '@/stores/workflows/workflow/edge-validation'
 import type {
@@ -189,9 +191,13 @@ export function prepareBlockState(options: PrepareBlockStateOptions): BlockState
 }
 
 /**
- * Merges workflow block states with subblock values while maintaining block structure
+ * Merges workflow block states with the sub-block store's values while maintaining
+ * block structure. Resolves the active workflow when no workflowId is given.
+ * Value semantics (explicit-null clears, orphaned runtime values such as
+ * webhookId/triggerPath, undefined fallbacks) are defined by
+ * {@link mergeSubblockStateWithValues}.
  * @param blocks - Block configurations from workflow store
- * @param workflowId - ID of the workflow to merge values for
+ * @param workflowId - ID of the workflow to merge values for (defaults to the active workflow)
  * @param blockId - Optional specific block ID to merge (merges all if not provided)
  * @returns Merged block states with updated values
  */
@@ -200,78 +206,12 @@ export function mergeSubblockState(
   workflowId?: string,
   blockId?: string
 ): Record<string, BlockState> {
-  const subBlockStore = useSubBlockStore.getState()
+  const resolvedWorkflowId = workflowId ?? useWorkflowRegistry.getState().activeWorkflowId
+  const workflowSubblockValues = resolvedWorkflowId
+    ? useSubBlockStore.getState().workflowValues[resolvedWorkflowId] || {}
+    : {}
 
-  const workflowSubblockValues = workflowId ? subBlockStore.workflowValues[workflowId] || {} : {}
-
-  if (workflowId) {
-    return mergeSubblockStateWithValues(blocks, workflowSubblockValues, blockId)
-  }
-
-  const blocksToProcess = blockId ? { [blockId]: blocks[blockId] } : blocks
-
-  return Object.entries(blocksToProcess).reduce(
-    (acc, [id, block]) => {
-      if (!block) {
-        return acc
-      }
-
-      const blockSubBlocks = block.subBlocks || {}
-
-      const blockValues = workflowSubblockValues[id] || {}
-
-      const mergedSubBlocks = Object.entries(blockSubBlocks).reduce(
-        (subAcc, [subBlockId, subBlock]) => {
-          if (!subBlock) {
-            return subAcc
-          }
-
-          let storedValue = null
-
-          if (workflowId) {
-            if (blockValues[subBlockId] !== undefined) {
-              storedValue = blockValues[subBlockId]
-            }
-          } else {
-            storedValue = subBlockStore.getValue(id, subBlockId)
-          }
-
-          subAcc[subBlockId] = {
-            ...subBlock,
-            value: (storedValue !== undefined && storedValue !== null
-              ? storedValue
-              : subBlock.value) as SubBlockState['value'],
-          }
-
-          return subAcc
-        },
-        {} as Record<string, SubBlockState>
-      )
-
-      // Add any values that exist in the store but aren't in the block structure
-      // This handles cases where block config has been updated but values still exist
-      // IMPORTANT: This includes runtime subblock IDs like webhookId, triggerPath, etc.
-      Object.entries(blockValues).forEach(([subBlockId, value]) => {
-        if (!mergedSubBlocks[subBlockId] && value !== null && value !== undefined) {
-          // Create a minimal subblock structure
-          mergedSubBlocks[subBlockId] = {
-            id: subBlockId,
-            type: 'short-input', // Default type that's safe to use
-            value: value as SubBlockState['value'],
-          }
-        }
-      })
-
-      // Return the full block state with updated subBlocks (including orphaned values)
-      acc[id] = {
-        ...block,
-        subBlocks: mergedSubBlocks,
-      }
-
-      return acc
-    },
-    {} as Record<string, BlockState>
-  )
+  return mergeSubblockStateWithValues(blocks, workflowSubblockValues, blockId)
 }
 
 function updateValueReferences(value: unknown, nameMap: Map<string, string>): unknown {
@@ -337,7 +277,7 @@ export function regenerateWorkflowIds(
     const oldNormalizedName = normalizeName(block.name)
     nameMap.set(oldNormalizedName, oldNormalizedName)
     const newBlock = { ...block, id: newId, subBlocks: structuredClone(block.subBlocks) }
-    remapConditionIds(newBlock.subBlocks, {}, oldId, newId)
+    remapConditionIds(newBlock.subBlocks, {}, block.type, oldId, newId)
     newBlocks[newId] = newBlock
   })
 
@@ -410,15 +350,26 @@ export function regenerateWorkflowIds(
 /**
  * Remaps condition/router block IDs within subBlock values when a block is duplicated.
  * Mutates both `subBlocks` and `subBlockValues` in place (callers must pass cloned data).
+ *
+ * Gated on the BLOCK type + canonical subblock key (`conditions`/`routes`), not the
+ * stored subblock `type`: edge handles remap by string prefix with no type gate, so a
+ * drifted stored type would skip the id remap here while the handles still move,
+ * orphaning every edge out of the block.
+ *
+ * The `subBlockValues[id] ?? subBlock.value` fallback is safe here despite the
+ * structure copy being generally stale: condition/router subblocks are
+ * dynamic-handle types, which dual-write the structure on every edit
+ * (syncDynamicHandleSubblockValue), so both sources are current for them.
  */
 export function remapConditionIds(
   subBlocks: Record<string, SubBlockState>,
   subBlockValues: Record<string, unknown>,
+  blockType: string | undefined,
   oldBlockId: string,
   newBlockId: string
 ): void {
   for (const [subBlockId, subBlock] of Object.entries(subBlocks)) {
-    if (subBlock.type !== 'condition-input' && subBlock.type !== 'router-input') continue
+    if (!isDynamicHandleSubblock(blockType, subBlockId)) continue
 
     const value = subBlockValues[subBlockId] ?? subBlock.value
     if (typeof value !== 'string') continue
@@ -522,7 +473,7 @@ export function regenerateBlockIds(
     }
 
     // Remap condition/router IDs in the duplicated block
-    remapConditionIds(newBlock.subBlocks, newSubBlockValues[newId] || {}, oldId, newId)
+    remapConditionIds(newBlock.subBlocks, newSubBlockValues[newId] || {}, block.type, oldId, newId)
   })
 
   // Second pass: update parentId references for nested blocks
diff --git a/apps/sim/stores/workflows/workflow/store.ts b/apps/sim/stores/workflows/workflow/store.ts
index 02d9a58761e..11008b1658f 100644
--- a/apps/sim/stores/workflows/workflow/store.ts
+++ b/apps/sim/stores/workflows/workflow/store.ts
@@ -595,6 +595,7 @@ export const useWorkflowStore = create<WorkflowStore>()(
         remapConditionIds(
           newSubBlocks as Record<string, SubBlockState>,
           clonedSubBlockValues,
+          block.type,
           id,
           newId
         )
diff --git a/apps/sim/tools/github/create_pr_review.test.ts b/apps/sim/tools/github/create_pr_review.test.ts
index f96b18fc70f..4a77b679d81 100644
--- a/apps/sim/tools/github/create_pr_review.test.ts
+++ b/apps/sim/tools/github/create_pr_review.test.ts
@@ -130,4 +130,22 @@ describe('createPRReviewV2Tool response', () => {
       createPRReviewV2Tool.transformResponse!(Response.json(reviewPayload({ html_url: '' })))
     ).rejects.toThrow('GitHub review response.html_url must be a non-empty string')
   })
+
+  it('surfaces the GitHub error message on a non-ok response', async () => {
+    const result = await createPRReviewV2Tool.transformResponse!(
+      Response.json({ message: 'Validation Failed' }, { status: 422 })
+    )
+
+    expect(result.success).toBe(false)
+    expect(result.error).toBe('Validation Failed')
+  })
+
+  it('falls back to a status-based error when the error body has no message', async () => {
+    const result = await createPRReviewV2Tool.transformResponse!(
+      new Response('not json', { status: 500 })
+    )
+
+    expect(result.success).toBe(false)
+    expect(result.error).toBe('Failed to submit PR review (HTTP 500)')
+  })
 })
diff --git a/apps/sim/tools/github/create_pr_review.ts b/apps/sim/tools/github/create_pr_review.ts
index ea99eea649c..b0ace3d7636 100644
--- a/apps/sim/tools/github/create_pr_review.ts
+++ b/apps/sim/tools/github/create_pr_review.ts
@@ -258,10 +258,9 @@ export const createPRReviewV2Tool: ToolConfig<CreatePRReviewParams, CreatePRRevi
     if (!response.ok) {
       return {
         success: false,
-        error: await responseErrorMessage(
-          response,
-          `Failed to submit PR review (HTTP ${response.status})`
-        ),
+        error:
+          (await readGitHubErrorMessage(response)) ??
+          `Failed to submit PR review (HTTP ${response.status})`,
         output: {
           id: 0,
           user: null,
diff --git a/apps/sim/tools/index.ts b/apps/sim/tools/index.ts
index 165e8ed4d26..3ca1fbe1e15 100644
--- a/apps/sim/tools/index.ts
+++ b/apps/sim/tools/index.ts
@@ -1237,6 +1237,31 @@ export async function executeTool(
       }
     }
 
+    // Custom blocks (deploy-as-block) run in-process through WorkflowBlockHandler.
+    // The runner is dynamic-imported from a server-only module so the client-bundled
+    // tool registry never pulls in the executor/db dependency graph (a static or
+    // dynamic executor import in the tool descriptor itself would break the client
+    // build — and with it `getTool('workflow_executor')`).
+    if (normalizedToolId === 'deployed_block_executor') {
+      logger.info(`[${requestId}] Running custom block tool ${toolId}`)
+      const { runCustomBlockTool } = await import(
+        '@/executor/handlers/workflow/custom-block-tool-runner'
+      )
+      const result = await runCustomBlockTool(contextParams)
+      const endTime = new Date()
+      return {
+        ...result,
+        // Strip internal `__`-prefixed fields the same way every other tool path does,
+        // so child-workflow internals never reach the agent's tool result.
+        output: postProcessToolOutput(normalizedToolId, result.output ?? {}),
+        timing: {
+          startTime: startTimeISO,
+          endTime: endTime.toISOString(),
+          duration: endTime.getTime() - startTime.getTime(),
+        },
+      }
+    }
+
     // Check for direct execution (no HTTP request needed)
     if (tool.directExecution) {
       logger.info(`[${requestId}] Using directExecution for ${toolId}`)
diff --git a/apps/sim/tools/normalize.ts b/apps/sim/tools/normalize.ts
index 9082e79a5c0..177c11aa140 100644
--- a/apps/sim/tools/normalize.ts
+++ b/apps/sim/tools/normalize.ts
@@ -7,6 +7,17 @@
  * Pure string utility — no server dependencies, safe to import in client components.
  */
 export function normalizeToolId(toolId: string): string {
+  // Custom (deploy-as-block) tools: 'deployed_block_executor_custom_block_<id>' ->
+  // 'deployed_block_executor'. Note the id deliberately does NOT start with
+  // `custom_` — that prefix is the user-defined custom-tool namespace
+  // (`isCustomTool`), and colliding with it misroutes resolution and permissions.
+  if (
+    toolId.startsWith('deployed_block_executor_') &&
+    toolId.length > 'deployed_block_executor_'.length
+  ) {
+    return 'deployed_block_executor'
+  }
+
   if (toolId.startsWith('workflow_executor_') && toolId.length > 'workflow_executor_'.length) {
     return 'workflow_executor'
   }
diff --git a/apps/sim/tools/params.test.ts b/apps/sim/tools/params.test.ts
index 5afa84eaf54..734969cd8eb 100644
--- a/apps/sim/tools/params.test.ts
+++ b/apps/sim/tools/params.test.ts
@@ -5,6 +5,7 @@ import {
   createUserToolSchema,
   filterSchemaForLLM,
   formatParameterLabel,
+  getSubBlocksForToolInput,
   getToolParametersConfig,
   isPasswordParameter,
   mergeToolParameters,
@@ -59,6 +60,15 @@ vi.mock('@/tools/utils', () => ({
     if (toolId === 'test_tool') {
       return mockToolConfig
     }
+    if (toolId === 'workflow_executor') {
+      return {
+        id: 'workflow_executor',
+        name: 'Workflow Executor',
+        description: '',
+        version: '1.0.0',
+        params: {},
+      }
+    }
     return null
   }),
 }))
@@ -815,3 +825,49 @@ describe('Tool Parameters Utils', () => {
     })
   })
 })
+
+describe('custom block agent-tool rendering', () => {
+  // Mirrors buildCustomBlockConfig: hidden workflowId/inputMapping wiring + per-field
+  // sub-blocks keyed by the source field's stable id.
+  const customBlockConfig = {
+    subBlocks: [
+      { id: 'workflowId', type: 'short-input', hidden: true },
+      { id: 'inputMapping', type: 'code', language: 'json', hidden: true },
+      { id: 'field-question', title: 'Question', type: 'short-input', required: true },
+      { id: 'field-files', title: 'Attachments', type: 'file-upload', multiple: true },
+    ],
+  } as any
+
+  describe('getToolParametersConfig', () => {
+    it('surfaces the field sub-blocks, never workflowId/inputMapping', () => {
+      const result = getToolParametersConfig(
+        'workflow_executor',
+        'custom_block_abc',
+        undefined,
+        customBlockConfig
+      )
+      expect(result).not.toBeNull()
+      const ids = result!.userInputParameters.map((p) => p.id)
+      expect(ids).toEqual(['field-question', 'field-files'])
+      expect(ids).not.toContain('workflowId')
+      expect(ids).not.toContain('inputMapping')
+      expect(result!.userInputParameters.every((p) => p.visibility === 'user-or-llm')).toBe(true)
+      expect(result!.requiredParameters.map((p) => p.id)).toEqual(['field-question'])
+    })
+  })
+
+  describe('getSubBlocksForToolInput', () => {
+    it('returns field sub-blocks as user-or-llm and drops reserved/hidden wiring', () => {
+      const result = getSubBlocksForToolInput(
+        'workflow_executor',
+        'custom_block_abc',
+        undefined,
+        undefined,
+        customBlockConfig
+      )
+      expect(result).not.toBeNull()
+      expect(result!.subBlocks.map((sb) => sb.id)).toEqual(['field-question', 'field-files'])
+      expect(result!.subBlocks.every((sb) => sb.paramVisibility === 'user-or-llm')).toBe(true)
+    })
+  })
+})
diff --git a/apps/sim/tools/params.ts b/apps/sim/tools/params.ts
index ba596692f20..1ffc78914a4 100644
--- a/apps/sim/tools/params.ts
+++ b/apps/sim/tools/params.ts
@@ -11,6 +11,7 @@ import {
   resolveCanonicalMode,
   type SubBlockCondition,
 } from '@/lib/workflows/subblocks/visibility'
+import { isCustomBlockType, RESERVED_PARAMS } from '@/blocks/custom/build-config'
 import type {
   BlockConfig as AppBlockConfig,
   SubBlockConfig as BlockSubBlockConfig,
@@ -199,9 +200,18 @@ function getBlockConfigurations(): Record<string, ToolInputBlockConfig> {
 
 /**
  * Gets the correct tool ID for a block operation.
+ *
+ * Pass `blockOverride` (a fresh, overlay-aware config) for custom (deploy-as-block)
+ * blocks — the module `getBlockConfigurations()` cache can miss async-hydrated
+ * custom blocks, which would return `undefined` here and make "add tool" silently
+ * no-op.
  */
-export function getToolIdForOperation(blockType: string, operation?: string): string | undefined {
-  const block = getBlockConfigurations()[blockType]
+export function getToolIdForOperation(
+  blockType: string,
+  operation?: string,
+  blockOverride?: Pick<ToolInputBlockConfig, 'tools'>
+): string | undefined {
+  const block = blockOverride ?? getBlockConfigurations()[blockType]
   if (!block?.tools?.access) return undefined
 
   if (block.tools.access.length === 1) {
@@ -265,6 +275,20 @@ function resolveSubBlockForParam(
   return undefined
 }
 
+/** Map a custom-block field sub-block type to a tool-parameter type. */
+function customFieldParamType(subBlockType: string): string {
+  switch (subBlockType) {
+    case 'switch':
+      return 'boolean'
+    case 'file-upload':
+      return 'file[]'
+    case 'code':
+      return 'json'
+    default:
+      return 'string'
+  }
+}
+
 /**
  * Gets all parameters for a tool, categorized by their usage
  * Also includes UI component information from block configurations
@@ -272,7 +296,8 @@ function resolveSubBlockForParam(
 export function getToolParametersConfig(
   toolId: string,
   blockType?: string,
-  currentValues?: Record<string, unknown>
+  currentValues?: Record<string, unknown>,
+  blockConfigOverride?: Pick<ToolInputBlockConfig, 'subBlocks'>
 ): ToolWithParameters | null {
   try {
     const toolConfig = getTool(toolId)
@@ -287,6 +312,41 @@ export function getToolParametersConfig(
       return null
     }
 
+    // Custom (deploy-as-block) blocks resolve to `workflow_executor`, but their
+    // editable inputs are their own per-field sub-blocks — not the generic
+    // workflowId/inputMapping. Surface those so the tool panel renders the block's
+    // real fields (and never the workflow-executor fields as "uncovered" params).
+    // MUST run before the `workflow_executor` branch below. Read subBlocks from the
+    // fresh, overlay-aware `blockConfigOverride` — the module `getBlockConfigurations`
+    // cache can miss async-hydrated custom blocks.
+    if (blockType && isCustomBlockType(blockType)) {
+      const blockConfig = blockConfigOverride ?? getBlockConfigurations()[blockType]
+      const fieldSubBlocks = (
+        (blockConfig?.subBlocks as BlockSubBlockConfig[] | undefined) ?? []
+      ).filter((sb) => !sb.hidden && !RESERVED_PARAMS.has(sb.id))
+      const parameters: ToolParameterConfig[] = fieldSubBlocks.map((sb) => ({
+        id: sb.id,
+        type: customFieldParamType(sb.type),
+        required: sb.required === true,
+        visibility: 'user-or-llm',
+        description: sb.description,
+        uiComponent: {
+          type: sb.type,
+          title: sb.title,
+          placeholder: sb.placeholder,
+          language: sb.language,
+          multiple: sb.multiple,
+        },
+      }))
+      return {
+        toolConfig,
+        allParameters: parameters,
+        userInputParameters: parameters,
+        requiredParameters: parameters.filter((param) => param.required),
+        optionalParameters: parameters.filter((param) => !param.required),
+      }
+    }
+
     // Special handling for workflow_executor tool
     if (toolId === 'workflow_executor') {
       const parameters: ToolParameterConfig[] = [
@@ -1033,6 +1093,21 @@ export function getSubBlocksForToolInput(
       return null
     }
 
+    // Custom (deploy-as-block) blocks: render their own editable field sub-blocks
+    // as `user-or-llm` (the hidden workflowId/inputMapping wiring is filtered by
+    // RESERVED_PARAMS — `isSubBlockHidden` does NOT honor `hidden: true`, so the
+    // explicit reserved filter is what keeps them out).
+    if (blockType && isCustomBlockType(blockType)) {
+      const fieldSubBlocks = (blockConfig.subBlocks as BlockSubBlockConfig[])
+        .filter((sb) => !sb.hidden && !RESERVED_PARAMS.has(sb.id))
+        .map((sb) => ({ ...sb, paramVisibility: 'user-or-llm' as ParameterVisibility }))
+      return {
+        toolConfig,
+        subBlocks: fieldSubBlocks,
+        oauthConfig: toolConfig.oauth,
+      }
+    }
+
     const allSubBlocks = blockConfig.subBlocks as BlockSubBlockConfig[]
     const canonicalIndex = buildCanonicalIndex(allSubBlocks)
 
diff --git a/apps/sim/tools/registry.minimal.ts b/apps/sim/tools/registry.minimal.ts
index 31e1e52c36c..bacfae7e566 100644
--- a/apps/sim/tools/registry.minimal.ts
+++ b/apps/sim/tools/registry.minimal.ts
@@ -72,6 +72,7 @@ import {
   slackUpdateViewTool,
 } from '@/tools/slack'
 import type { ToolConfig } from '@/tools/types'
+import { customBlockExecutorTool, workflowExecutorTool } from '@/tools/workflow'
 
 /**
  * Dev-only minimal tool registry. Swapped in for `@/tools/registry` via a
@@ -87,6 +88,10 @@ export const tools: Record<string, ToolConfig> = {
   http_request: httpRequestTool,
   function_execute: functionExecuteTool,
   guardrails_validate: guardrailsValidateTool,
+  // Needed so workflow-as-tool and custom (deploy-as-block) tools resolve their
+  // config in minimal-registry dev mode (both route through `workflow_executor`).
+  workflow_executor: workflowExecutorTool,
+  deployed_block_executor: customBlockExecutorTool,
   gmail_send_v2: gmailSendV2Tool,
   gmail_read_v2: gmailReadV2Tool,
   gmail_search_v2: gmailSearchV2Tool,
diff --git a/apps/sim/tools/registry.ts b/apps/sim/tools/registry.ts
index 72faeb561eb..296a2bae42d 100644
--- a/apps/sim/tools/registry.ts
+++ b/apps/sim/tools/registry.ts
@@ -4595,7 +4595,7 @@ import {
   workdayTerminateWorkerTool,
   workdayUpdateWorkerTool,
 } from '@/tools/workday'
-import { workflowExecutorTool } from '@/tools/workflow'
+import { customBlockExecutorTool, workflowExecutorTool } from '@/tools/workflow'
 import {
   xCreateBookmarkTool,
   xCreateTweetTool,
@@ -8187,6 +8187,7 @@ export const tools: Record<string, ToolConfig> = {
   google_forms_delete_watch: googleFormsDeleteWatchTool,
   google_forms_renew_watch: googleFormsRenewWatchTool,
   workflow_executor: workflowExecutorTool,
+  deployed_block_executor: customBlockExecutorTool,
   wealthbox_read_contact: wealthboxReadContactTool,
   wealthbox_write_contact: wealthboxWriteContactTool,
   wealthbox_read_task: wealthboxReadTaskTool,
diff --git a/apps/sim/tools/slack/set_status.ts b/apps/sim/tools/slack/set_status.ts
index e2d88a18f63..a1e30d4fcac 100644
--- a/apps/sim/tools/slack/set_status.ts
+++ b/apps/sim/tools/slack/set_status.ts
@@ -71,9 +71,10 @@ export const slackSetStatusTool: ToolConfig<SlackSetStatusParams, SlackSetStatus
     },
     status: {
       type: 'string',
-      required: true,
+      required: false,
       visibility: 'user-or-llm',
-      description: "Status text to display, e.g. 'Working on it…'. Pass an empty string to clear.",
+      description:
+        "Status text to display, e.g. 'Working on it…'. Omit or pass an empty string to clear the status.",
     },
     loadingMessages: {
       type: 'json',
diff --git a/apps/sim/tools/slack/types.ts b/apps/sim/tools/slack/types.ts
index 3489109202d..6e8739a355e 100644
--- a/apps/sim/tools/slack/types.ts
+++ b/apps/sim/tools/slack/types.ts
@@ -794,7 +794,7 @@ export interface SlackGetThreadParams extends SlackBaseParams {
 export interface SlackSetStatusParams extends SlackBaseParams {
   channel: string
   threadTs: string
-  status: string
+  status?: string
   loadingMessages?: string[]
 }
 
diff --git a/apps/sim/tools/workflow/custom-block-executor.ts b/apps/sim/tools/workflow/custom-block-executor.ts
new file mode 100644
index 00000000000..37e19f27fc9
--- /dev/null
+++ b/apps/sim/tools/workflow/custom-block-executor.ts
@@ -0,0 +1,46 @@
+import type { ToolConfig } from '@/tools/types'
+
+interface CustomBlockExecutorParams {
+  /** The `custom_block_*` type to run — authority is re-resolved from it server-side. */
+  blockType: string
+  /** Input values keyed by the source field's stable id (assembled + LLM-filled). */
+  inputMapping?: Record<string, unknown> | string
+}
+
+/**
+ * Tool descriptor for running a published custom block (deploy-as-block) as an
+ * Agent tool. Execution is handled server-side in `executeTool` (`tools/index.ts`)
+ * via the `custom-block-tool-runner`, NOT here — so this module (imported by the
+ * client-bundled tool registry) stays free of the executor/db dependency graph.
+ * `request` is declared to satisfy the type but is never invoked (the executeTool
+ * custom-block branch returns first).
+ */
+export const customBlockExecutorTool: ToolConfig<CustomBlockExecutorParams> = {
+  // NOT `custom_block_executor`: `custom_` is the user-defined custom-tool namespace
+  // (`isCustomTool`), so that id would make `executeTool` resolve this through the
+  // DB custom-tool lookup, skip `postProcessToolOutput`'s internal-field stripping,
+  // and let `disableCustomTools` workspaces block deploy-as-block tools.
+  id: 'deployed_block_executor',
+  name: 'Custom Block Executor',
+  description: 'Execute a published custom block (a workflow packaged as a reusable block).',
+  version: '1.0.0',
+  params: {
+    blockType: {
+      type: 'string',
+      required: true,
+      visibility: 'user-only',
+      description: 'The custom block type to execute',
+    },
+    inputMapping: {
+      type: 'object',
+      required: false,
+      visibility: 'user-or-llm',
+      description: "Input values for the block's fields, keyed by field id",
+    },
+  },
+  request: {
+    url: () => '',
+    method: 'POST',
+    headers: () => ({}),
+  },
+}
diff --git a/apps/sim/tools/workflow/index.ts b/apps/sim/tools/workflow/index.ts
index 6330fc9c456..9d51194ca5f 100644
--- a/apps/sim/tools/workflow/index.ts
+++ b/apps/sim/tools/workflow/index.ts
@@ -1 +1,2 @@
+export { customBlockExecutorTool } from '@/tools/workflow/custom-block-executor'
 export { workflowExecutorTool } from '@/tools/workflow/executor'
diff --git a/apps/sim/triggers/slack/oauth.ts b/apps/sim/triggers/slack/oauth.ts
index 1591889831b..368b4128dc5 100644
--- a/apps/sim/triggers/slack/oauth.ts
+++ b/apps/sim/triggers/slack/oauth.ts
@@ -1,9 +1,7 @@
 import { SlackIcon } from '@/components/icons'
 import { getScopesForService } from '@/lib/oauth/utils'
-import { useSubBlockStore } from '@/stores/workflows/subblock/store'
 import {
   SLACK_ALL_EVENT_OPTIONS,
-  SLACK_SIM_EVENT_OPTIONS,
   SLACK_SOURCE_OPTIONS,
   SLACK_THREAD_OPTIONS,
   SLACK_TRIGGER_OUTPUTS,
@@ -25,14 +23,11 @@ const BOT_FILTER_EVENTS = ['message', 'app_mention']
 const OWN_MESSAGE_EVENTS = ['message', 'app_mention', 'reaction_added', 'reaction_removed']
 
 /**
- * Unified Slack trigger. App Type selects how events arrive:
- * - `sim` (default): the official Sim Slack app the user OAuth-connects — events
- *   route to this workflow by Slack `team_id` (stored as the webhook `routingKey`,
- *   derived at deploy time). No signing secret, bot token, or app setup.
- * - `custom`: a bring-your-own Slack app, selected as a reusable bot credential
- *   (set up once). Events route by that credential (`webhook.routingKey =
- *   credentialId`) to one shared ingest URL, so many triggers on the same bot
- *   share a single Request URL, verified with the bot's own signing secret.
+ * Slack trigger backed by a reusable custom-bot credential (set up once, reused
+ * across triggers and actions). Events route by that credential
+ * (`webhook.routingKey = credentialId`) to one shared ingest URL, so many
+ * triggers on the same bot share a single Request URL, verified with the bot's
+ * own signing secret.
  */
 export const slackOAuthTrigger: TriggerConfig = {
   id: 'slack_oauth',
@@ -47,50 +42,12 @@ export const slackOAuthTrigger: TriggerConfig = {
       id: 'eventType',
       title: 'Event',
       type: 'dropdown',
-      options: [...SLACK_SIM_EVENT_OPTIONS],
+      options: [...SLACK_ALL_EVENT_OPTIONS],
       placeholder: 'Select an event',
       description:
         'The single Slack event this trigger fires on. Add another trigger block for another event.',
       required: true,
       mode: 'trigger',
-      dependsOn: ['appType'],
-      fetchOptions: async (blockId: string) => {
-        const appType = useSubBlockStore.getState().getValue(blockId, 'appType')
-        return appType === 'custom' ? [...SLACK_ALL_EVENT_OPTIONS] : [...SLACK_SIM_EVENT_OPTIONS]
-      },
-    },
-    {
-      id: 'appType',
-      title: 'App Type',
-      type: 'dropdown',
-      // Ship 1 exposes custom bots only; the native "Sim" app mode returns in a
-      // later ship (un-hide + default back to 'sim'). Hidden — not removed — so
-      // the seeded 'custom' value keeps every `appType==='custom'` condition, the
-      // event-catalog fetch, and the deploy routing branch resolving correctly.
-      hidden: true,
-      options: [
-        { label: 'Sim', id: 'sim' },
-        { label: 'Custom', id: 'custom' },
-      ],
-      value: () => 'custom',
-      // `value()` only seeds editor-created blocks; `defaultValue` is what
-      // buildProviderConfig persists when the stored value is absent
-      // (imported / programmatically-created workflows).
-      defaultValue: 'custom',
-      description: 'Use the official Sim Slack app, or your own custom Slack app.',
-      mode: 'trigger',
-    },
-    {
-      id: 'triggerCredentials',
-      title: 'Slack Account',
-      type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      serviceId: 'slack',
-      requiredScopes: getScopesForService('slack'),
-      placeholder: 'Select Slack account',
-      required: { field: 'appType', value: 'sim' },
-      mode: 'trigger',
-      condition: { field: 'appType', value: 'sim' },
     },
     {
       id: 'customBotCredential',
@@ -98,14 +55,14 @@ export const slackOAuthTrigger: TriggerConfig = {
       type: 'oauth-input',
       canonicalParamId: 'botCredential',
       serviceId: 'slack',
-      credentialKind: 'custom-bot',
+      credentialKind: 'service-account',
+      credentialLabels: { serviceAccountConnect: 'Set up a custom bot' },
       requiredScopes: getScopesForService('slack'),
       placeholder: 'Select a connected bot',
       description:
         'Choose a custom Slack bot you set up once and reuse across triggers and actions.',
-      required: { field: 'appType', value: 'custom' },
+      required: true,
       mode: 'trigger',
-      condition: { field: 'appType', value: 'custom' },
     },
     {
       id: 'manualBotCredential',
@@ -114,9 +71,8 @@ export const slackOAuthTrigger: TriggerConfig = {
       canonicalParamId: 'botCredential',
       placeholder: 'Enter bot credential ID',
       description: 'Set the custom bot credential ID directly.',
-      required: { field: 'appType', value: 'custom' },
+      required: true,
       mode: 'trigger-advanced',
-      condition: { field: 'appType', value: 'custom' },
     },
     {
       id: 'source',
@@ -142,7 +98,7 @@ export const slackOAuthTrigger: TriggerConfig = {
       placeholder: 'Any channel the bot is in',
       description:
         'Restrict to specific channels. Leave empty to trigger on any channel the bot has been added to.',
-      dependsOn: { any: ['triggerCredentials', 'customBotCredential'] },
+      dependsOn: ['customBotCredential'],
       required: false,
       mode: 'trigger',
       condition: { field: 'eventType', value: CHANNEL_FILTER_EVENTS },
diff --git a/apps/sim/triggers/slack/shared.ts b/apps/sim/triggers/slack/shared.ts
index 0efca9c72ac..4372f7ba68b 100644
--- a/apps/sim/triggers/slack/shared.ts
+++ b/apps/sim/triggers/slack/shared.ts
@@ -271,17 +271,7 @@ export const slackEventById = new Map<string, SlackEventCatalogEntry>(
   SLACK_EVENT_CATALOG.map((entry) => [entry.id, entry])
 )
 
-/** Event ids the official shared Sim app subscribes to (Sim-mode gating SOT). */
-export const SIM_SUBSCRIBED_EVENTS: readonly string[] = SLACK_EVENT_CATALOG.filter(
-  (entry) => entry.simSubscribed
-).map((entry) => entry.id)
-
-/** Dropdown options for Sim mode — only officially-subscribed events. */
-export const SLACK_SIM_EVENT_OPTIONS = SLACK_EVENT_CATALOG.filter(
-  (entry) => entry.simSubscribed
-).map((entry) => ({ label: entry.label, id: entry.id }))
-
-/** Dropdown options for Custom mode — every event (manifest generated on demand). */
+/** Dropdown options for the event picker — every event (manifest generated on demand). */
 export const SLACK_ALL_EVENT_OPTIONS = SLACK_EVENT_CATALOG.map((entry) => ({
   label: entry.label,
   id: entry.id,
diff --git a/bun.lock b/bun.lock
index 18b739ea299..39e51d99b97 100644
--- a/bun.lock
+++ b/bun.lock
@@ -543,6 +543,7 @@
         "@sim/tsconfig": "workspace:*",
         "@types/node": "24.2.1",
         "typescript": "^7.0.2",
+        "vitest": "^4.1.0",
       },
     },
     "packages/workflow-renderer": {
diff --git a/packages/db/migrations/0264_fat_ikaris.sql b/packages/db/migrations/0264_fat_ikaris.sql
new file mode 100644
index 00000000000..1eb642755ad
--- /dev/null
+++ b/packages/db/migrations/0264_fat_ikaris.sql
@@ -0,0 +1,10 @@
+-- Replay-safety: this file ends in a CONCURRENTLY index build below an embedded COMMIT, so a
+-- failure there replays the whole file — every statement here is idempotent.
+ALTER TABLE "copilot_chats" ADD COLUMN IF NOT EXISTS "deleted_at" timestamp;--> statement-breakpoint
+-- Partial index backing the Recently Deleted listing of soft-deleted chats (queried by
+-- user + workspace equality). Built CONCURRENTLY per runner convention (plain CREATE
+-- INDEX write-blocks the relation).
+COMMIT;--> statement-breakpoint
+SET lock_timeout = 0;--> statement-breakpoint
+CREATE INDEX CONCURRENTLY IF NOT EXISTS "copilot_chats_user_workspace_deleted_partial_idx" ON "copilot_chats" USING btree ("user_id","workspace_id") WHERE "copilot_chats"."deleted_at" IS NOT NULL;--> statement-breakpoint
+SET lock_timeout = '5s';
diff --git a/packages/db/migrations/meta/0264_snapshot.json b/packages/db/migrations/meta/0264_snapshot.json
new file mode 100644
index 00000000000..72ee5a4d8c1
--- /dev/null
+++ b/packages/db/migrations/meta/0264_snapshot.json
@@ -0,0 +1,17393 @@
+{
+  "id": "12a47eb4-408b-41d5-92e3-c26a03d1d754",
+  "prevId": "cca39e95-9fb8-4e3d-9e0d-591aa668edb5",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.academy_certificate": {
+      "name": "academy_certificate",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "course_id": {
+          "name": "course_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "academy_cert_status",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "issued_at": {
+          "name": "issued_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "certificate_number": {
+          "name": "certificate_number",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "academy_certificate_user_id_idx": {
+          "name": "academy_certificate_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "academy_certificate_course_id_idx": {
+          "name": "academy_certificate_course_id_idx",
+          "columns": [
+            {
+              "expression": "course_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "academy_certificate_user_course_unique": {
+          "name": "academy_certificate_user_course_unique",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "course_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "academy_certificate_number_idx": {
+          "name": "academy_certificate_number_idx",
+          "columns": [
+            {
+              "expression": "certificate_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "academy_certificate_status_idx": {
+          "name": "academy_certificate_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "academy_certificate_user_id_user_id_fk": {
+          "name": "academy_certificate_user_id_user_id_fk",
+          "tableFrom": "academy_certificate",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "academy_certificate_certificate_number_unique": {
+          "name": "academy_certificate_certificate_number_unique",
+          "nullsNotDistinct": false,
+          "columns": ["certificate_number"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.account": {
+      "name": "account",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "account_id": {
+          "name": "account_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "access_token": {
+          "name": "access_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token": {
+          "name": "refresh_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "id_token": {
+          "name": "id_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "access_token_expires_at": {
+          "name": "access_token_expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token_expires_at": {
+          "name": "refresh_token_expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "password": {
+          "name": "password",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "account_user_id_idx": {
+          "name": "account_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "idx_account_on_account_id_provider_id": {
+          "name": "idx_account_on_account_id_provider_id",
+          "columns": [
+            {
+              "expression": "account_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "account_user_id_user_id_fk": {
+          "name": "account_user_id_user_id_fk",
+          "tableFrom": "account",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.api_key": {
+      "name": "api_key",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key_hash": {
+          "name": "key_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'personal'"
+        },
+        "last_used": {
+          "name": "last_used",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "api_key_workspace_type_idx": {
+          "name": "api_key_workspace_type_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "api_key_user_type_idx": {
+          "name": "api_key_user_type_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "api_key_key_hash_idx": {
+          "name": "api_key_key_hash_idx",
+          "columns": [
+            {
+              "expression": "key_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "api_key_user_id_user_id_fk": {
+          "name": "api_key_user_id_user_id_fk",
+          "tableFrom": "api_key",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "api_key_workspace_id_workspace_id_fk": {
+          "name": "api_key_workspace_id_workspace_id_fk",
+          "tableFrom": "api_key",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "api_key_created_by_user_id_fk": {
+          "name": "api_key_created_by_user_id_fk",
+          "tableFrom": "api_key",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "api_key_key_unique": {
+          "name": "api_key_key_unique",
+          "nullsNotDistinct": false,
+          "columns": ["key"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "workspace_type_check": {
+          "name": "workspace_type_check",
+          "value": "(type = 'workspace' AND workspace_id IS NOT NULL) OR (type = 'personal' AND workspace_id IS NULL)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.async_jobs": {
+      "name": "async_jobs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_at": {
+          "name": "run_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "attempts": {
+          "name": "attempts",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "max_attempts": {
+          "name": "max_attempts",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 3
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "output": {
+          "name": "output",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "async_jobs_status_started_at_idx": {
+          "name": "async_jobs_status_started_at_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "async_jobs_status_completed_at_idx": {
+          "name": "async_jobs_status_completed_at_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "completed_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "async_jobs_schedule_pending_run_at_idx": {
+          "name": "async_jobs_schedule_pending_run_at_idx",
+          "columns": [
+            {
+              "expression": "run_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"async_jobs\".\"type\" = 'schedule-execution' AND \"async_jobs\".\"status\" = 'pending'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "async_jobs_schedule_processing_started_at_idx": {
+          "name": "async_jobs_schedule_processing_started_at_idx",
+          "columns": [
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"async_jobs\".\"type\" = 'schedule-execution' AND \"async_jobs\".\"status\" = 'processing'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.audit_log": {
+      "name": "audit_log",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "action": {
+          "name": "action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_type": {
+          "name": "resource_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_id": {
+          "name": "resource_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_name": {
+          "name": "actor_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_email": {
+          "name": "actor_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resource_name": {
+          "name": "resource_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'{}'"
+        },
+        "ip_address": {
+          "name": "ip_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_agent": {
+          "name": "user_agent",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "audit_log_workspace_created_idx": {
+          "name": "audit_log_workspace_created_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "audit_log_workspace_created_at_id_idx": {
+          "name": "audit_log_workspace_created_at_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "date_trunc('milliseconds', \"created_at\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "audit_log_actor_created_idx": {
+          "name": "audit_log_actor_created_idx",
+          "columns": [
+            {
+              "expression": "actor_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "audit_log_resource_idx": {
+          "name": "audit_log_resource_idx",
+          "columns": [
+            {
+              "expression": "resource_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "audit_log_action_idx": {
+          "name": "audit_log_action_idx",
+          "columns": [
+            {
+              "expression": "action",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "audit_log_workspace_id_workspace_id_fk": {
+          "name": "audit_log_workspace_id_workspace_id_fk",
+          "tableFrom": "audit_log",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "audit_log_actor_id_user_id_fk": {
+          "name": "audit_log_actor_id_user_id_fk",
+          "tableFrom": "audit_log",
+          "tableTo": "user",
+          "columnsFrom": ["actor_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.background_work_status": {
+      "name": "background_work_status",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "kind": {
+          "name": "kind",
+          "type": "background_work_kind",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "background_work_status_value",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "background_work_status_workspace_status_idx": {
+          "name": "background_work_status_workspace_status_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "background_work_status_workflow_status_idx": {
+          "name": "background_work_status_workflow_status_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "background_work_status_meta_child_ws_idx": {
+          "name": "background_work_status_meta_child_ws_idx",
+          "columns": [
+            {
+              "expression": "(\"metadata\" ->> 'childWorkspaceId')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "background_work_status_meta_other_ws_idx": {
+          "name": "background_work_status_meta_other_ws_idx",
+          "columns": [
+            {
+              "expression": "(\"metadata\" ->> 'otherWorkspaceId')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "background_work_status_workspace_id_workspace_id_fk": {
+          "name": "background_work_status_workspace_id_workspace_id_fk",
+          "tableFrom": "background_work_status",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "background_work_status_workflow_id_workflow_id_fk": {
+          "name": "background_work_status_workflow_id_workflow_id_fk",
+          "tableFrom": "background_work_status",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.chat": {
+      "name": "chat",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "identifier": {
+          "name": "identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "is_active": {
+          "name": "is_active",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "customizations": {
+          "name": "customizations",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'{}'"
+        },
+        "auth_type": {
+          "name": "auth_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'public'"
+        },
+        "password": {
+          "name": "password",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "allowed_emails": {
+          "name": "allowed_emails",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'[]'"
+        },
+        "output_configs": {
+          "name": "output_configs",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'[]'"
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "identifier_idx": {
+          "name": "identifier_idx",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"chat\".\"archived_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "chat_archived_at_partial_idx": {
+          "name": "chat_archived_at_partial_idx",
+          "columns": [
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"chat\".\"archived_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "idx_chat_on_workflow_id_archived_at": {
+          "name": "idx_chat_on_workflow_id_archived_at",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "chat_workflow_id_workflow_id_fk": {
+          "name": "chat_workflow_id_workflow_id_fk",
+          "tableFrom": "chat",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "chat_user_id_user_id_fk": {
+          "name": "chat_user_id_user_id_fk",
+          "tableFrom": "chat",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.copilot_async_tool_calls": {
+      "name": "copilot_async_tool_calls",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "checkpoint_id": {
+          "name": "checkpoint_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tool_call_id": {
+          "name": "tool_call_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "tool_name": {
+          "name": "tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "args": {
+          "name": "args",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "status": {
+          "name": "status",
+          "type": "copilot_async_tool_status",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "result": {
+          "name": "result",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claimed_at": {
+          "name": "claimed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claimed_by": {
+          "name": "claimed_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "copilot_async_tool_calls_run_id_idx": {
+          "name": "copilot_async_tool_calls_run_id_idx",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_async_tool_calls_checkpoint_id_idx": {
+          "name": "copilot_async_tool_calls_checkpoint_id_idx",
+          "columns": [
+            {
+              "expression": "checkpoint_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_async_tool_calls_tool_call_id_idx": {
+          "name": "copilot_async_tool_calls_tool_call_id_idx",
+          "columns": [
+            {
+              "expression": "tool_call_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_async_tool_calls_status_idx": {
+          "name": "copilot_async_tool_calls_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_async_tool_calls_run_status_idx": {
+          "name": "copilot_async_tool_calls_run_status_idx",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_async_tool_calls_tool_call_id_unique": {
+          "name": "copilot_async_tool_calls_tool_call_id_unique",
+          "columns": [
+            {
+              "expression": "tool_call_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "copilot_async_tool_calls_run_id_copilot_runs_id_fk": {
+          "name": "copilot_async_tool_calls_run_id_copilot_runs_id_fk",
+          "tableFrom": "copilot_async_tool_calls",
+          "tableTo": "copilot_runs",
+          "columnsFrom": ["run_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "copilot_async_tool_calls_checkpoint_id_copilot_run_checkpoints_id_fk": {
+          "name": "copilot_async_tool_calls_checkpoint_id_copilot_run_checkpoints_id_fk",
+          "tableFrom": "copilot_async_tool_calls",
+          "tableTo": "copilot_run_checkpoints",
+          "columnsFrom": ["checkpoint_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.copilot_chats": {
+      "name": "copilot_chats",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "type": {
+          "name": "type",
+          "type": "chat_type",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'copilot'"
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "model": {
+          "name": "model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'claude-3-7-sonnet-latest'"
+        },
+        "conversation_id": {
+          "name": "conversation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "preview_yaml": {
+          "name": "preview_yaml",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "plan_artifact": {
+          "name": "plan_artifact",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resources": {
+          "name": "resources",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'"
+        },
+        "last_seen_at": {
+          "name": "last_seen_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "pinned": {
+          "name": "pinned",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "copilot_chats_user_id_idx": {
+          "name": "copilot_chats_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_chats_workflow_id_idx": {
+          "name": "copilot_chats_workflow_id_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_chats_user_workflow_idx": {
+          "name": "copilot_chats_user_workflow_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_chats_user_workspace_idx": {
+          "name": "copilot_chats_user_workspace_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_chats_created_at_idx": {
+          "name": "copilot_chats_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_chats_updated_at_idx": {
+          "name": "copilot_chats_updated_at_idx",
+          "columns": [
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_chats_workspace_created_at_id_idx": {
+          "name": "copilot_chats_workspace_created_at_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "date_trunc('milliseconds', \"created_at\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_chats_user_workspace_deleted_partial_idx": {
+          "name": "copilot_chats_user_workspace_deleted_partial_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"copilot_chats\".\"deleted_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "copilot_chats_user_id_user_id_fk": {
+          "name": "copilot_chats_user_id_user_id_fk",
+          "tableFrom": "copilot_chats",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "copilot_chats_workflow_id_workflow_id_fk": {
+          "name": "copilot_chats_workflow_id_workflow_id_fk",
+          "tableFrom": "copilot_chats",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "copilot_chats_workspace_id_workspace_id_fk": {
+          "name": "copilot_chats_workspace_id_workspace_id_fk",
+          "tableFrom": "copilot_chats",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.copilot_feedback": {
+      "name": "copilot_feedback",
+      "schema": "",
+      "columns": {
+        "feedback_id": {
+          "name": "feedback_id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "chat_id": {
+          "name": "chat_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_query": {
+          "name": "user_query",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_response": {
+          "name": "agent_response",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "is_positive": {
+          "name": "is_positive",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "feedback": {
+          "name": "feedback",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workflow_yaml": {
+          "name": "workflow_yaml",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "copilot_feedback_user_id_idx": {
+          "name": "copilot_feedback_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_feedback_chat_id_idx": {
+          "name": "copilot_feedback_chat_id_idx",
+          "columns": [
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_feedback_user_chat_idx": {
+          "name": "copilot_feedback_user_chat_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_feedback_is_positive_idx": {
+          "name": "copilot_feedback_is_positive_idx",
+          "columns": [
+            {
+              "expression": "is_positive",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_feedback_created_at_idx": {
+          "name": "copilot_feedback_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "copilot_feedback_user_id_user_id_fk": {
+          "name": "copilot_feedback_user_id_user_id_fk",
+          "tableFrom": "copilot_feedback",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "copilot_feedback_chat_id_copilot_chats_id_fk": {
+          "name": "copilot_feedback_chat_id_copilot_chats_id_fk",
+          "tableFrom": "copilot_feedback",
+          "tableTo": "copilot_chats",
+          "columnsFrom": ["chat_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.copilot_messages": {
+      "name": "copilot_messages",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "chat_id": {
+          "name": "chat_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "message_id": {
+          "name": "message_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content": {
+          "name": "content",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stream_id": {
+          "name": "stream_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "parent_message_id": {
+          "name": "parent_message_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "model": {
+          "name": "model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tokens_in": {
+          "name": "tokens_in",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tokens_out": {
+          "name": "tokens_out",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "seq": {
+          "name": "seq",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "copilot_messages_chat_message_unique": {
+          "name": "copilot_messages_chat_message_unique",
+          "columns": [
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "message_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_messages_chat_created_at_idx": {
+          "name": "copilot_messages_chat_created_at_idx",
+          "columns": [
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"copilot_messages\".\"deleted_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_messages_chat_seq_idx": {
+          "name": "copilot_messages_chat_seq_idx",
+          "columns": [
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "seq",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"copilot_messages\".\"deleted_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_messages_chat_stream_idx": {
+          "name": "copilot_messages_chat_stream_idx",
+          "columns": [
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "stream_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"copilot_messages\".\"stream_id\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_messages_user_created_at_idx": {
+          "name": "copilot_messages_user_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "message_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"copilot_messages\".\"role\" = 'user' AND \"copilot_messages\".\"deleted_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "copilot_messages_chat_id_copilot_chats_id_fk": {
+          "name": "copilot_messages_chat_id_copilot_chats_id_fk",
+          "tableFrom": "copilot_messages",
+          "tableTo": "copilot_chats",
+          "columnsFrom": ["chat_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.copilot_run_checkpoints": {
+      "name": "copilot_run_checkpoints",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "pending_tool_call_id": {
+          "name": "pending_tool_call_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "conversation_snapshot": {
+          "name": "conversation_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "agent_state": {
+          "name": "agent_state",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "provider_request": {
+          "name": "provider_request",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "copilot_run_checkpoints_run_id_idx": {
+          "name": "copilot_run_checkpoints_run_id_idx",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_run_checkpoints_pending_tool_call_id_idx": {
+          "name": "copilot_run_checkpoints_pending_tool_call_id_idx",
+          "columns": [
+            {
+              "expression": "pending_tool_call_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_run_checkpoints_run_pending_tool_unique": {
+          "name": "copilot_run_checkpoints_run_pending_tool_unique",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "pending_tool_call_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "copilot_run_checkpoints_run_id_copilot_runs_id_fk": {
+          "name": "copilot_run_checkpoints_run_id_copilot_runs_id_fk",
+          "tableFrom": "copilot_run_checkpoints",
+          "tableTo": "copilot_runs",
+          "columnsFrom": ["run_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.copilot_runs": {
+      "name": "copilot_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "execution_id": {
+          "name": "execution_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_run_id": {
+          "name": "parent_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "chat_id": {
+          "name": "chat_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stream_id": {
+          "name": "stream_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent": {
+          "name": "agent",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "model": {
+          "name": "model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "copilot_run_status",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "request_context": {
+          "name": "request_context",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "copilot_runs_execution_id_idx": {
+          "name": "copilot_runs_execution_id_idx",
+          "columns": [
+            {
+              "expression": "execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_runs_parent_run_id_idx": {
+          "name": "copilot_runs_parent_run_id_idx",
+          "columns": [
+            {
+              "expression": "parent_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_runs_chat_id_idx": {
+          "name": "copilot_runs_chat_id_idx",
+          "columns": [
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_runs_user_id_idx": {
+          "name": "copilot_runs_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_runs_workflow_id_idx": {
+          "name": "copilot_runs_workflow_id_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_runs_workspace_id_idx": {
+          "name": "copilot_runs_workspace_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_runs_status_idx": {
+          "name": "copilot_runs_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_runs_chat_execution_idx": {
+          "name": "copilot_runs_chat_execution_idx",
+          "columns": [
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_runs_execution_started_at_idx": {
+          "name": "copilot_runs_execution_started_at_idx",
+          "columns": [
+            {
+              "expression": "execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_runs_workspace_completed_at_id_idx": {
+          "name": "copilot_runs_workspace_completed_at_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "date_trunc('milliseconds', \"completed_at\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_runs_stream_id_unique": {
+          "name": "copilot_runs_stream_id_unique",
+          "columns": [
+            {
+              "expression": "stream_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "copilot_runs_chat_id_copilot_chats_id_fk": {
+          "name": "copilot_runs_chat_id_copilot_chats_id_fk",
+          "tableFrom": "copilot_runs",
+          "tableTo": "copilot_chats",
+          "columnsFrom": ["chat_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "copilot_runs_user_id_user_id_fk": {
+          "name": "copilot_runs_user_id_user_id_fk",
+          "tableFrom": "copilot_runs",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "copilot_runs_workflow_id_workflow_id_fk": {
+          "name": "copilot_runs_workflow_id_workflow_id_fk",
+          "tableFrom": "copilot_runs",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "copilot_runs_workspace_id_workspace_id_fk": {
+          "name": "copilot_runs_workspace_id_workspace_id_fk",
+          "tableFrom": "copilot_runs",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.copilot_workflow_read_hashes": {
+      "name": "copilot_workflow_read_hashes",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "chat_id": {
+          "name": "chat_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "hash": {
+          "name": "hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "copilot_workflow_read_hashes_chat_id_idx": {
+          "name": "copilot_workflow_read_hashes_chat_id_idx",
+          "columns": [
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_workflow_read_hashes_workflow_id_idx": {
+          "name": "copilot_workflow_read_hashes_workflow_id_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "copilot_workflow_read_hashes_chat_workflow_unique": {
+          "name": "copilot_workflow_read_hashes_chat_workflow_unique",
+          "columns": [
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "copilot_workflow_read_hashes_chat_id_copilot_chats_id_fk": {
+          "name": "copilot_workflow_read_hashes_chat_id_copilot_chats_id_fk",
+          "tableFrom": "copilot_workflow_read_hashes",
+          "tableTo": "copilot_chats",
+          "columnsFrom": ["chat_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "copilot_workflow_read_hashes_workflow_id_workflow_id_fk": {
+          "name": "copilot_workflow_read_hashes_workflow_id_workflow_id_fk",
+          "tableFrom": "copilot_workflow_read_hashes",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.credential": {
+      "name": "credential",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "credential_type",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_name": {
+          "name": "display_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "account_id": {
+          "name": "account_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "env_key": {
+          "name": "env_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "env_owner_user_id": {
+          "name": "env_owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "encrypted_service_account_key": {
+          "name": "encrypted_service_account_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "credential_workspace_id_idx": {
+          "name": "credential_workspace_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_type_idx": {
+          "name": "credential_type_idx",
+          "columns": [
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_provider_id_idx": {
+          "name": "credential_provider_id_idx",
+          "columns": [
+            {
+              "expression": "provider_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_account_id_idx": {
+          "name": "credential_account_id_idx",
+          "columns": [
+            {
+              "expression": "account_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_env_owner_user_id_idx": {
+          "name": "credential_env_owner_user_id_idx",
+          "columns": [
+            {
+              "expression": "env_owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_workspace_account_unique": {
+          "name": "credential_workspace_account_unique",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "account_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "account_id IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_workspace_env_unique": {
+          "name": "credential_workspace_env_unique",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "env_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "type = 'env_workspace'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_workspace_personal_env_unique": {
+          "name": "credential_workspace_personal_env_unique",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "env_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "env_owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "type = 'env_personal'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "credential_workspace_id_workspace_id_fk": {
+          "name": "credential_workspace_id_workspace_id_fk",
+          "tableFrom": "credential",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "credential_account_id_account_id_fk": {
+          "name": "credential_account_id_account_id_fk",
+          "tableFrom": "credential",
+          "tableTo": "account",
+          "columnsFrom": ["account_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "credential_env_owner_user_id_user_id_fk": {
+          "name": "credential_env_owner_user_id_user_id_fk",
+          "tableFrom": "credential",
+          "tableTo": "user",
+          "columnsFrom": ["env_owner_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "credential_created_by_user_id_fk": {
+          "name": "credential_created_by_user_id_fk",
+          "tableFrom": "credential",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "credential_oauth_source_check": {
+          "name": "credential_oauth_source_check",
+          "value": "(type <> 'oauth') OR (account_id IS NOT NULL AND provider_id IS NOT NULL)"
+        },
+        "credential_workspace_env_source_check": {
+          "name": "credential_workspace_env_source_check",
+          "value": "(type <> 'env_workspace') OR (env_key IS NOT NULL AND env_owner_user_id IS NULL)"
+        },
+        "credential_personal_env_source_check": {
+          "name": "credential_personal_env_source_check",
+          "value": "(type <> 'env_personal') OR (env_key IS NOT NULL AND env_owner_user_id IS NOT NULL)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.credential_member": {
+      "name": "credential_member",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "credential_id": {
+          "name": "credential_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "credential_member_role",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'member'"
+        },
+        "status": {
+          "name": "status",
+          "type": "credential_member_status",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "joined_at": {
+          "name": "joined_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "invited_by": {
+          "name": "invited_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "credential_member_user_id_idx": {
+          "name": "credential_member_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_member_role_idx": {
+          "name": "credential_member_role_idx",
+          "columns": [
+            {
+              "expression": "role",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_member_status_idx": {
+          "name": "credential_member_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "credential_member_unique": {
+          "name": "credential_member_unique",
+          "columns": [
+            {
+              "expression": "credential_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "credential_member_credential_id_credential_id_fk": {
+          "name": "credential_member_credential_id_credential_id_fk",
+          "tableFrom": "credential_member",
+          "tableTo": "credential",
+          "columnsFrom": ["credential_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "credential_member_user_id_user_id_fk": {
+          "name": "credential_member_user_id_user_id_fk",
+          "tableFrom": "credential_member",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "credential_member_invited_by_user_id_fk": {
+          "name": "credential_member_invited_by_user_id_fk",
+          "tableFrom": "credential_member",
+          "tableTo": "user",
+          "columnsFrom": ["invited_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.custom_block": {
+      "name": "custom_block",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "icon_url": {
+          "name": "icon_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "inputs": {
+          "name": "inputs",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outputs": {
+          "name": "outputs",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "custom_block_organization_id_idx": {
+          "name": "custom_block_organization_id_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "custom_block_workflow_id_idx": {
+          "name": "custom_block_workflow_id_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "custom_block_organization_type_unique": {
+          "name": "custom_block_organization_type_unique",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "custom_block_organization_id_organization_id_fk": {
+          "name": "custom_block_organization_id_organization_id_fk",
+          "tableFrom": "custom_block",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "custom_block_workflow_id_workflow_id_fk": {
+          "name": "custom_block_workflow_id_workflow_id_fk",
+          "tableFrom": "custom_block",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "custom_block_created_by_user_id_fk": {
+          "name": "custom_block_created_by_user_id_fk",
+          "tableFrom": "custom_block",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.custom_tools": {
+      "name": "custom_tools",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema": {
+          "name": "schema",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "code": {
+          "name": "code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "custom_tools_workspace_id_idx": {
+          "name": "custom_tools_workspace_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "custom_tools_workspace_title_unique": {
+          "name": "custom_tools_workspace_title_unique",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "title",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "custom_tools_workspace_id_workspace_id_fk": {
+          "name": "custom_tools_workspace_id_workspace_id_fk",
+          "tableFrom": "custom_tools",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "custom_tools_user_id_user_id_fk": {
+          "name": "custom_tools_user_id_user_id_fk",
+          "tableFrom": "custom_tools",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.data_drain_runs": {
+      "name": "data_drain_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "drain_id": {
+          "name": "drain_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "data_drain_run_status",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "trigger": {
+          "name": "trigger",
+          "type": "data_drain_run_trigger",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rows_exported": {
+          "name": "rows_exported",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "bytes_written": {
+          "name": "bytes_written",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "cursor_before": {
+          "name": "cursor_before",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cursor_after": {
+          "name": "cursor_after",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "locators": {
+          "name": "locators",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        }
+      },
+      "indexes": {
+        "data_drain_runs_drain_started_idx": {
+          "name": "data_drain_runs_drain_started_idx",
+          "columns": [
+            {
+              "expression": "drain_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "data_drain_runs_drain_id_data_drains_id_fk": {
+          "name": "data_drain_runs_drain_id_data_drains_id_fk",
+          "tableFrom": "data_drain_runs",
+          "tableTo": "data_drains",
+          "columnsFrom": ["drain_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.data_drains": {
+      "name": "data_drains",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source": {
+          "name": "source",
+          "type": "data_drain_source",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "destination_type": {
+          "name": "destination_type",
+          "type": "data_drain_destination",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "destination_config": {
+          "name": "destination_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "destination_credentials": {
+          "name": "destination_credentials",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schedule_cadence": {
+          "name": "schedule_cadence",
+          "type": "data_drain_cadence",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "cursor": {
+          "name": "cursor",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_run_at": {
+          "name": "last_run_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_success_at": {
+          "name": "last_success_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "data_drains_org_idx": {
+          "name": "data_drains_org_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "data_drains_due_idx": {
+          "name": "data_drains_due_idx",
+          "columns": [
+            {
+              "expression": "enabled",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_run_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "data_drains_org_name_unique": {
+          "name": "data_drains_org_name_unique",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "data_drains_organization_id_organization_id_fk": {
+          "name": "data_drains_organization_id_organization_id_fk",
+          "tableFrom": "data_drains",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "data_drains_created_by_user_id_fk": {
+          "name": "data_drains_created_by_user_id_fk",
+          "tableFrom": "data_drains",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.docs_embeddings": {
+      "name": "docs_embeddings",
+      "schema": "",
+      "columns": {
+        "chunk_id": {
+          "name": "chunk_id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "chunk_text": {
+          "name": "chunk_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_document": {
+          "name": "source_document",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_link": {
+          "name": "source_link",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "header_text": {
+          "name": "header_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "header_level": {
+          "name": "header_level",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_count": {
+          "name": "token_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "embedding": {
+          "name": "embedding",
+          "type": "vector(1536)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "embedding_model": {
+          "name": "embedding_model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'text-embedding-3-small'"
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "chunk_text_tsv": {
+          "name": "chunk_text_tsv",
+          "type": "tsvector",
+          "primaryKey": false,
+          "notNull": false,
+          "generated": {
+            "as": "to_tsvector('english', \"docs_embeddings\".\"chunk_text\")",
+            "type": "stored"
+          }
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "docs_emb_source_document_idx": {
+          "name": "docs_emb_source_document_idx",
+          "columns": [
+            {
+              "expression": "source_document",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "docs_emb_header_level_idx": {
+          "name": "docs_emb_header_level_idx",
+          "columns": [
+            {
+              "expression": "header_level",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "docs_emb_source_header_idx": {
+          "name": "docs_emb_source_header_idx",
+          "columns": [
+            {
+              "expression": "source_document",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "header_level",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "docs_emb_model_idx": {
+          "name": "docs_emb_model_idx",
+          "columns": [
+            {
+              "expression": "embedding_model",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "docs_emb_created_at_idx": {
+          "name": "docs_emb_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "docs_embedding_vector_hnsw_idx": {
+          "name": "docs_embedding_vector_hnsw_idx",
+          "columns": [
+            {
+              "expression": "embedding",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "vector_cosine_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "hnsw",
+          "with": {
+            "m": 16,
+            "ef_construction": 64
+          }
+        },
+        "docs_emb_metadata_gin_idx": {
+          "name": "docs_emb_metadata_gin_idx",
+          "columns": [
+            {
+              "expression": "metadata",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "docs_emb_chunk_text_fts_idx": {
+          "name": "docs_emb_chunk_text_fts_idx",
+          "columns": [
+            {
+              "expression": "chunk_text_tsv",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "docs_embedding_not_null_check": {
+          "name": "docs_embedding_not_null_check",
+          "value": "\"embedding\" IS NOT NULL"
+        },
+        "docs_header_level_check": {
+          "name": "docs_header_level_check",
+          "value": "\"header_level\" >= 1 AND \"header_level\" <= 6"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.document": {
+      "name": "document",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "knowledge_base_id": {
+          "name": "knowledge_base_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "filename": {
+          "name": "filename",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "file_url": {
+          "name": "file_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "storage_key": {
+          "name": "storage_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "file_size": {
+          "name": "file_size",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "mime_type": {
+          "name": "mime_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "chunk_count": {
+          "name": "chunk_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "token_count": {
+          "name": "token_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "character_count": {
+          "name": "character_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "processing_status": {
+          "name": "processing_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "processing_started_at": {
+          "name": "processing_started_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "processing_completed_at": {
+          "name": "processing_completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "processing_error": {
+          "name": "processing_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_excluded": {
+          "name": "user_excluded",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "tag1": {
+          "name": "tag1",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tag2": {
+          "name": "tag2",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tag3": {
+          "name": "tag3",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tag4": {
+          "name": "tag4",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tag5": {
+          "name": "tag5",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tag6": {
+          "name": "tag6",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tag7": {
+          "name": "tag7",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "number1": {
+          "name": "number1",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "number2": {
+          "name": "number2",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "number3": {
+          "name": "number3",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "number4": {
+          "name": "number4",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "number5": {
+          "name": "number5",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "date1": {
+          "name": "date1",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "date2": {
+          "name": "date2",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "boolean1": {
+          "name": "boolean1",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "boolean2": {
+          "name": "boolean2",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "boolean3": {
+          "name": "boolean3",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connector_id": {
+          "name": "connector_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "external_id": {
+          "name": "external_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "content_hash": {
+          "name": "content_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_url": {
+          "name": "source_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "uploaded_by": {
+          "name": "uploaded_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "uploaded_at": {
+          "name": "uploaded_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "doc_kb_id_idx": {
+          "name": "doc_kb_id_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_filename_idx": {
+          "name": "doc_filename_idx",
+          "columns": [
+            {
+              "expression": "filename",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_processing_status_idx": {
+          "name": "doc_processing_status_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "processing_status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_connector_external_id_idx": {
+          "name": "doc_connector_external_id_idx",
+          "columns": [
+            {
+              "expression": "connector_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "external_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"document\".\"deleted_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_connector_id_idx": {
+          "name": "doc_connector_id_idx",
+          "columns": [
+            {
+              "expression": "connector_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_storage_key_idx": {
+          "name": "doc_storage_key_idx",
+          "columns": [
+            {
+              "expression": "storage_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"document\".\"storage_key\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_archived_at_partial_idx": {
+          "name": "doc_archived_at_partial_idx",
+          "columns": [
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"document\".\"archived_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_deleted_at_partial_idx": {
+          "name": "doc_deleted_at_partial_idx",
+          "columns": [
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"document\".\"deleted_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_tag1_idx": {
+          "name": "doc_tag1_idx",
+          "columns": [
+            {
+              "expression": "tag1",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_tag2_idx": {
+          "name": "doc_tag2_idx",
+          "columns": [
+            {
+              "expression": "tag2",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_tag3_idx": {
+          "name": "doc_tag3_idx",
+          "columns": [
+            {
+              "expression": "tag3",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_tag4_idx": {
+          "name": "doc_tag4_idx",
+          "columns": [
+            {
+              "expression": "tag4",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_tag5_idx": {
+          "name": "doc_tag5_idx",
+          "columns": [
+            {
+              "expression": "tag5",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_tag6_idx": {
+          "name": "doc_tag6_idx",
+          "columns": [
+            {
+              "expression": "tag6",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_tag7_idx": {
+          "name": "doc_tag7_idx",
+          "columns": [
+            {
+              "expression": "tag7",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_number1_idx": {
+          "name": "doc_number1_idx",
+          "columns": [
+            {
+              "expression": "number1",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_number2_idx": {
+          "name": "doc_number2_idx",
+          "columns": [
+            {
+              "expression": "number2",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_number3_idx": {
+          "name": "doc_number3_idx",
+          "columns": [
+            {
+              "expression": "number3",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_number4_idx": {
+          "name": "doc_number4_idx",
+          "columns": [
+            {
+              "expression": "number4",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_number5_idx": {
+          "name": "doc_number5_idx",
+          "columns": [
+            {
+              "expression": "number5",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_date1_idx": {
+          "name": "doc_date1_idx",
+          "columns": [
+            {
+              "expression": "date1",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_date2_idx": {
+          "name": "doc_date2_idx",
+          "columns": [
+            {
+              "expression": "date2",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_boolean1_idx": {
+          "name": "doc_boolean1_idx",
+          "columns": [
+            {
+              "expression": "boolean1",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_boolean2_idx": {
+          "name": "doc_boolean2_idx",
+          "columns": [
+            {
+              "expression": "boolean2",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "doc_boolean3_idx": {
+          "name": "doc_boolean3_idx",
+          "columns": [
+            {
+              "expression": "boolean3",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_knowledge_base_id_knowledge_base_id_fk": {
+          "name": "document_knowledge_base_id_knowledge_base_id_fk",
+          "tableFrom": "document",
+          "tableTo": "knowledge_base",
+          "columnsFrom": ["knowledge_base_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_connector_id_knowledge_connector_id_fk": {
+          "name": "document_connector_id_knowledge_connector_id_fk",
+          "tableFrom": "document",
+          "tableTo": "knowledge_connector",
+          "columnsFrom": ["connector_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_uploaded_by_user_id_fk": {
+          "name": "document_uploaded_by_user_id_fk",
+          "tableFrom": "document",
+          "tableTo": "user",
+          "columnsFrom": ["uploaded_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.embedding": {
+      "name": "embedding",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "knowledge_base_id": {
+          "name": "knowledge_base_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "chunk_index": {
+          "name": "chunk_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "chunk_hash": {
+          "name": "chunk_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content": {
+          "name": "content",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content_length": {
+          "name": "content_length",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_count": {
+          "name": "token_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "embedding": {
+          "name": "embedding",
+          "type": "vector(1536)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "embedding_model": {
+          "name": "embedding_model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'text-embedding-3-small'"
+        },
+        "start_offset": {
+          "name": "start_offset",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "end_offset": {
+          "name": "end_offset",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "tag1": {
+          "name": "tag1",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tag2": {
+          "name": "tag2",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tag3": {
+          "name": "tag3",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tag4": {
+          "name": "tag4",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tag5": {
+          "name": "tag5",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tag6": {
+          "name": "tag6",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tag7": {
+          "name": "tag7",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "number1": {
+          "name": "number1",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "number2": {
+          "name": "number2",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "number3": {
+          "name": "number3",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "number4": {
+          "name": "number4",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "number5": {
+          "name": "number5",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "date1": {
+          "name": "date1",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "date2": {
+          "name": "date2",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "boolean1": {
+          "name": "boolean1",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "boolean2": {
+          "name": "boolean2",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "boolean3": {
+          "name": "boolean3",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "content_tsv": {
+          "name": "content_tsv",
+          "type": "tsvector",
+          "primaryKey": false,
+          "notNull": false,
+          "generated": {
+            "as": "to_tsvector('english', \"embedding\".\"content\")",
+            "type": "stored"
+          }
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "emb_kb_id_idx": {
+          "name": "emb_kb_id_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_doc_id_idx": {
+          "name": "emb_doc_id_idx",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_doc_chunk_idx": {
+          "name": "emb_doc_chunk_idx",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "chunk_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_kb_model_idx": {
+          "name": "emb_kb_model_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "embedding_model",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_kb_enabled_idx": {
+          "name": "emb_kb_enabled_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "enabled",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_doc_enabled_idx": {
+          "name": "emb_doc_enabled_idx",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "enabled",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "embedding_vector_hnsw_idx": {
+          "name": "embedding_vector_hnsw_idx",
+          "columns": [
+            {
+              "expression": "embedding",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "vector_cosine_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "hnsw",
+          "with": {
+            "m": 16,
+            "ef_construction": 64
+          }
+        },
+        "emb_tag1_idx": {
+          "name": "emb_tag1_idx",
+          "columns": [
+            {
+              "expression": "tag1",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_tag2_idx": {
+          "name": "emb_tag2_idx",
+          "columns": [
+            {
+              "expression": "tag2",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_tag3_idx": {
+          "name": "emb_tag3_idx",
+          "columns": [
+            {
+              "expression": "tag3",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_tag4_idx": {
+          "name": "emb_tag4_idx",
+          "columns": [
+            {
+              "expression": "tag4",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_tag5_idx": {
+          "name": "emb_tag5_idx",
+          "columns": [
+            {
+              "expression": "tag5",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_tag6_idx": {
+          "name": "emb_tag6_idx",
+          "columns": [
+            {
+              "expression": "tag6",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_tag7_idx": {
+          "name": "emb_tag7_idx",
+          "columns": [
+            {
+              "expression": "tag7",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_number1_idx": {
+          "name": "emb_number1_idx",
+          "columns": [
+            {
+              "expression": "number1",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_number2_idx": {
+          "name": "emb_number2_idx",
+          "columns": [
+            {
+              "expression": "number2",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_number3_idx": {
+          "name": "emb_number3_idx",
+          "columns": [
+            {
+              "expression": "number3",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_number4_idx": {
+          "name": "emb_number4_idx",
+          "columns": [
+            {
+              "expression": "number4",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_number5_idx": {
+          "name": "emb_number5_idx",
+          "columns": [
+            {
+              "expression": "number5",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_date1_idx": {
+          "name": "emb_date1_idx",
+          "columns": [
+            {
+              "expression": "date1",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_date2_idx": {
+          "name": "emb_date2_idx",
+          "columns": [
+            {
+              "expression": "date2",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_boolean1_idx": {
+          "name": "emb_boolean1_idx",
+          "columns": [
+            {
+              "expression": "boolean1",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_boolean2_idx": {
+          "name": "emb_boolean2_idx",
+          "columns": [
+            {
+              "expression": "boolean2",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_boolean3_idx": {
+          "name": "emb_boolean3_idx",
+          "columns": [
+            {
+              "expression": "boolean3",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "emb_content_fts_idx": {
+          "name": "emb_content_fts_idx",
+          "columns": [
+            {
+              "expression": "content_tsv",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "embedding_knowledge_base_id_knowledge_base_id_fk": {
+          "name": "embedding_knowledge_base_id_knowledge_base_id_fk",
+          "tableFrom": "embedding",
+          "tableTo": "knowledge_base",
+          "columnsFrom": ["knowledge_base_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "embedding_document_id_document_id_fk": {
+          "name": "embedding_document_id_document_id_fk",
+          "tableFrom": "embedding",
+          "tableTo": "document",
+          "columnsFrom": ["document_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "embedding_not_null_check": {
+          "name": "embedding_not_null_check",
+          "value": "\"embedding\" IS NOT NULL"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.environment": {
+      "name": "environment",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "variables": {
+          "name": "variables",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "environment_user_id_user_id_fk": {
+          "name": "environment_user_id_user_id_fk",
+          "tableFrom": "environment",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "environment_user_id_unique": {
+          "name": "environment_user_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["user_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.execution_large_value_dependencies": {
+      "name": "execution_large_value_dependencies",
+      "schema": "",
+      "columns": {
+        "parent_key": {
+          "name": "parent_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "child_key": {
+          "name": "child_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "execution_large_value_dependencies_workspace_parent_key_idx": {
+          "name": "execution_large_value_dependencies_workspace_parent_key_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_large_value_dependencies_workspace_child_key_idx": {
+          "name": "execution_large_value_dependencies_workspace_child_key_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "child_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "execution_large_value_dependencies_workspace_id_workspace_id_fk": {
+          "name": "execution_large_value_dependencies_workspace_id_workspace_id_fk",
+          "tableFrom": "execution_large_value_dependencies",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "execution_large_value_dependencies_parent_key_child_key_pk": {
+          "name": "execution_large_value_dependencies_parent_key_child_key_pk",
+          "columns": ["parent_key", "child_key"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.execution_large_value_references": {
+      "name": "execution_large_value_references",
+      "schema": "",
+      "columns": {
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_id": {
+          "name": "execution_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source": {
+          "name": "source",
+          "type": "execution_large_value_reference_source",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "execution_large_value_references_workspace_execution_source_idx": {
+          "name": "execution_large_value_references_workspace_execution_source_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "execution_large_value_references_workspace_id_workspace_id_fk": {
+          "name": "execution_large_value_references_workspace_id_workspace_id_fk",
+          "tableFrom": "execution_large_value_references",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "execution_large_value_references_workflow_id_workflow_id_fk": {
+          "name": "execution_large_value_references_workflow_id_workflow_id_fk",
+          "tableFrom": "execution_large_value_references",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "execution_large_value_references_key_execution_id_source_pk": {
+          "name": "execution_large_value_references_key_execution_id_source_pk",
+          "columns": ["key", "execution_id", "source"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.execution_large_values": {
+      "name": "execution_large_values",
+      "schema": "",
+      "columns": {
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_execution_id": {
+          "name": "owner_execution_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "size": {
+          "name": "size",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "execution_large_values_owner_execution_id_idx": {
+          "name": "execution_large_values_owner_execution_id_idx",
+          "columns": [
+            {
+              "expression": "owner_execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_large_values_cleanup_idx": {
+          "name": "execution_large_values_cleanup_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"execution_large_values\".\"deleted_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_large_values_tombstone_cleanup_idx": {
+          "name": "execution_large_values_tombstone_cleanup_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"execution_large_values\".\"deleted_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "execution_large_values_workspace_id_workspace_id_fk": {
+          "name": "execution_large_values_workspace_id_workspace_id_fk",
+          "tableFrom": "execution_large_values",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "execution_large_values_workflow_id_workflow_id_fk": {
+          "name": "execution_large_values_workflow_id_workflow_id_fk",
+          "tableFrom": "execution_large_values",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.idempotency_key": {
+      "name": "idempotency_key",
+      "schema": "",
+      "columns": {
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "result": {
+          "name": "result",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "idempotency_key_created_at_idx": {
+          "name": "idempotency_key_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.invitation": {
+      "name": "invitation",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "invitation_kind",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'organization'"
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "inviter_id": {
+          "name": "inviter_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "membership_intent": {
+          "name": "membership_intent",
+          "type": "invitation_membership_intent",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'internal'"
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "invitation_status",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "token": {
+          "name": "token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "invitation_email_idx": {
+          "name": "invitation_email_idx",
+          "columns": [
+            {
+              "expression": "email",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "invitation_organization_id_idx": {
+          "name": "invitation_organization_id_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "invitation_status_idx": {
+          "name": "invitation_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "invitation_pending_email_org_unique": {
+          "name": "invitation_pending_email_org_unique",
+          "columns": [
+            {
+              "expression": "email",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"invitation\".\"status\" = 'pending' AND \"invitation\".\"organization_id\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "invitation_inviter_id_user_id_fk": {
+          "name": "invitation_inviter_id_user_id_fk",
+          "tableFrom": "invitation",
+          "tableTo": "user",
+          "columnsFrom": ["inviter_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "invitation_organization_id_organization_id_fk": {
+          "name": "invitation_organization_id_organization_id_fk",
+          "tableFrom": "invitation",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "invitation_token_unique": {
+          "name": "invitation_token_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.invitation_workspace_grant": {
+      "name": "invitation_workspace_grant",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "invitation_id": {
+          "name": "invitation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "permission": {
+          "name": "permission",
+          "type": "permission_type",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "invitation_workspace_grant_unique": {
+          "name": "invitation_workspace_grant_unique",
+          "columns": [
+            {
+              "expression": "invitation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "invitation_workspace_grant_workspace_id_idx": {
+          "name": "invitation_workspace_grant_workspace_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "invitation_workspace_grant_invitation_id_invitation_id_fk": {
+          "name": "invitation_workspace_grant_invitation_id_invitation_id_fk",
+          "tableFrom": "invitation_workspace_grant",
+          "tableTo": "invitation",
+          "columnsFrom": ["invitation_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "invitation_workspace_grant_workspace_id_workspace_id_fk": {
+          "name": "invitation_workspace_grant_workspace_id_workspace_id_fk",
+          "tableFrom": "invitation_workspace_grant",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.job_execution_logs": {
+      "name": "job_execution_logs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "schedule_id": {
+          "name": "schedule_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_id": {
+          "name": "execution_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "level": {
+          "name": "level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'running'"
+        },
+        "trigger": {
+          "name": "trigger",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ended_at": {
+          "name": "ended_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "total_duration_ms": {
+          "name": "total_duration_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_data": {
+          "name": "execution_data",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "cost": {
+          "name": "cost",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "job_execution_logs_schedule_id_idx": {
+          "name": "job_execution_logs_schedule_id_idx",
+          "columns": [
+            {
+              "expression": "schedule_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "job_execution_logs_workspace_started_at_idx": {
+          "name": "job_execution_logs_workspace_started_at_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "job_execution_logs_workspace_ended_at_id_idx": {
+          "name": "job_execution_logs_workspace_ended_at_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "date_trunc('milliseconds', \"ended_at\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "job_execution_logs_execution_id_unique": {
+          "name": "job_execution_logs_execution_id_unique",
+          "columns": [
+            {
+              "expression": "execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "job_execution_logs_trigger_idx": {
+          "name": "job_execution_logs_trigger_idx",
+          "columns": [
+            {
+              "expression": "trigger",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "job_execution_logs_schedule_id_workflow_schedule_id_fk": {
+          "name": "job_execution_logs_schedule_id_workflow_schedule_id_fk",
+          "tableFrom": "job_execution_logs",
+          "tableTo": "workflow_schedule",
+          "columnsFrom": ["schedule_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "job_execution_logs_workspace_id_workspace_id_fk": {
+          "name": "job_execution_logs_workspace_id_workspace_id_fk",
+          "tableFrom": "job_execution_logs",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.knowledge_base": {
+      "name": "knowledge_base",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "token_count": {
+          "name": "token_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "embedding_model": {
+          "name": "embedding_model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'text-embedding-3-small'"
+        },
+        "embedding_dimension": {
+          "name": "embedding_dimension",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1536
+        },
+        "chunking_config": {
+          "name": "chunking_config",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{\"maxSize\": 1024, \"minSize\": 1, \"overlap\": 200}'"
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "kb_user_id_idx": {
+          "name": "kb_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kb_workspace_id_idx": {
+          "name": "kb_workspace_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kb_user_workspace_idx": {
+          "name": "kb_user_workspace_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kb_deleted_at_idx": {
+          "name": "kb_deleted_at_idx",
+          "columns": [
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kb_workspace_deleted_partial_idx": {
+          "name": "kb_workspace_deleted_partial_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"knowledge_base\".\"deleted_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kb_workspace_name_active_unique": {
+          "name": "kb_workspace_name_active_unique",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"knowledge_base\".\"deleted_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "knowledge_base_user_id_user_id_fk": {
+          "name": "knowledge_base_user_id_user_id_fk",
+          "tableFrom": "knowledge_base",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "knowledge_base_workspace_id_workspace_id_fk": {
+          "name": "knowledge_base_workspace_id_workspace_id_fk",
+          "tableFrom": "knowledge_base",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.knowledge_base_tag_definitions": {
+      "name": "knowledge_base_tag_definitions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "knowledge_base_id": {
+          "name": "knowledge_base_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "tag_slot": {
+          "name": "tag_slot",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_name": {
+          "name": "display_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "field_type": {
+          "name": "field_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'text'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "kb_tag_definitions_kb_slot_idx": {
+          "name": "kb_tag_definitions_kb_slot_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "tag_slot",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kb_tag_definitions_kb_display_name_idx": {
+          "name": "kb_tag_definitions_kb_display_name_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "display_name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kb_tag_definitions_kb_id_idx": {
+          "name": "kb_tag_definitions_kb_id_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "knowledge_base_tag_definitions_knowledge_base_id_knowledge_base_id_fk": {
+          "name": "knowledge_base_tag_definitions_knowledge_base_id_knowledge_base_id_fk",
+          "tableFrom": "knowledge_base_tag_definitions",
+          "tableTo": "knowledge_base",
+          "columnsFrom": ["knowledge_base_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.knowledge_connector": {
+      "name": "knowledge_connector",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "knowledge_base_id": {
+          "name": "knowledge_base_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connector_type": {
+          "name": "connector_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "credential_id": {
+          "name": "credential_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "encrypted_api_key": {
+          "name": "encrypted_api_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_config": {
+          "name": "source_config",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sync_mode": {
+          "name": "sync_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'full'"
+        },
+        "sync_interval_minutes": {
+          "name": "sync_interval_minutes",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1440
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "last_sync_at": {
+          "name": "last_sync_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_sync_error": {
+          "name": "last_sync_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_sync_doc_count": {
+          "name": "last_sync_doc_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_sync_at": {
+          "name": "next_sync_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "consecutive_failures": {
+          "name": "consecutive_failures",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "kc_knowledge_base_id_idx": {
+          "name": "kc_knowledge_base_id_idx",
+          "columns": [
+            {
+              "expression": "knowledge_base_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kc_status_next_sync_idx": {
+          "name": "kc_status_next_sync_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "next_sync_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kc_archived_at_partial_idx": {
+          "name": "kc_archived_at_partial_idx",
+          "columns": [
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"knowledge_connector\".\"archived_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kc_deleted_at_partial_idx": {
+          "name": "kc_deleted_at_partial_idx",
+          "columns": [
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"knowledge_connector\".\"deleted_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "knowledge_connector_knowledge_base_id_knowledge_base_id_fk": {
+          "name": "knowledge_connector_knowledge_base_id_knowledge_base_id_fk",
+          "tableFrom": "knowledge_connector",
+          "tableTo": "knowledge_base",
+          "columnsFrom": ["knowledge_base_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.knowledge_connector_sync_log": {
+      "name": "knowledge_connector_sync_log",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "connector_id": {
+          "name": "connector_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "docs_added": {
+          "name": "docs_added",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "docs_updated": {
+          "name": "docs_updated",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "docs_deleted": {
+          "name": "docs_deleted",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "docs_unchanged": {
+          "name": "docs_unchanged",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "docs_failed": {
+          "name": "docs_failed",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "kcsl_connector_id_idx": {
+          "name": "kcsl_connector_id_idx",
+          "columns": [
+            {
+              "expression": "connector_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "knowledge_connector_sync_log_connector_id_knowledge_connector_id_fk": {
+          "name": "knowledge_connector_sync_log_connector_id_knowledge_connector_id_fk",
+          "tableFrom": "knowledge_connector_sync_log",
+          "tableTo": "knowledge_connector",
+          "columnsFrom": ["connector_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.mcp_server_oauth": {
+      "name": "mcp_server_oauth",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "mcp_server_id": {
+          "name": "mcp_server_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "client_information": {
+          "name": "client_information",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tokens": {
+          "name": "tokens",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "code_verifier": {
+          "name": "code_verifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "state_created_at": {
+          "name": "state_created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_refreshed_at": {
+          "name": "last_refreshed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "mcp_server_oauth_server_unique": {
+          "name": "mcp_server_oauth_server_unique",
+          "columns": [
+            {
+              "expression": "mcp_server_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "mcp_server_oauth_state_idx": {
+          "name": "mcp_server_oauth_state_idx",
+          "columns": [
+            {
+              "expression": "state",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "mcp_server_oauth_mcp_server_id_mcp_servers_id_fk": {
+          "name": "mcp_server_oauth_mcp_server_id_mcp_servers_id_fk",
+          "tableFrom": "mcp_server_oauth",
+          "tableTo": "mcp_servers",
+          "columnsFrom": ["mcp_server_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "mcp_server_oauth_user_id_user_id_fk": {
+          "name": "mcp_server_oauth_user_id_user_id_fk",
+          "tableFrom": "mcp_server_oauth",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "mcp_server_oauth_workspace_id_workspace_id_fk": {
+          "name": "mcp_server_oauth_workspace_id_workspace_id_fk",
+          "tableFrom": "mcp_server_oauth",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.mcp_servers": {
+      "name": "mcp_servers",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "transport": {
+          "name": "transport",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "url": {
+          "name": "url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "auth_type": {
+          "name": "auth_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'headers'"
+        },
+        "oauth_client_id": {
+          "name": "oauth_client_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "oauth_client_secret": {
+          "name": "oauth_client_secret",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "headers": {
+          "name": "headers",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'{}'"
+        },
+        "timeout": {
+          "name": "timeout",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "default": 30000
+        },
+        "retries": {
+          "name": "retries",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "default": 3
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "last_connected": {
+          "name": "last_connected",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_status": {
+          "name": "connection_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'disconnected'"
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status_config": {
+          "name": "status_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'{}'"
+        },
+        "tool_count": {
+          "name": "tool_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "default": 0
+        },
+        "last_tools_refresh": {
+          "name": "last_tools_refresh",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "total_requests": {
+          "name": "total_requests",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "default": 0
+        },
+        "last_used": {
+          "name": "last_used",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "mcp_servers_workspace_enabled_idx": {
+          "name": "mcp_servers_workspace_enabled_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "enabled",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "mcp_servers_workspace_deleted_partial_idx": {
+          "name": "mcp_servers_workspace_deleted_partial_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"mcp_servers\".\"deleted_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "mcp_servers_workspace_id_workspace_id_fk": {
+          "name": "mcp_servers_workspace_id_workspace_id_fk",
+          "tableFrom": "mcp_servers",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "mcp_servers_created_by_user_id_fk": {
+          "name": "mcp_servers_created_by_user_id_fk",
+          "tableFrom": "mcp_servers",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.member": {
+      "name": "member",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "member_user_id_unique": {
+          "name": "member_user_id_unique",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "member_organization_id_idx": {
+          "name": "member_organization_id_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "member_user_id_user_id_fk": {
+          "name": "member_user_id_user_id_fk",
+          "tableFrom": "member",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "member_organization_id_organization_id_fk": {
+          "name": "member_organization_id_organization_id_fk",
+          "tableFrom": "member",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.memory": {
+      "name": "memory",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "data": {
+          "name": "data",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "memory_key_idx": {
+          "name": "memory_key_idx",
+          "columns": [
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "memory_workspace_idx": {
+          "name": "memory_workspace_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "memory_workspace_key_idx": {
+          "name": "memory_workspace_key_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "memory_workspace_deleted_partial_idx": {
+          "name": "memory_workspace_deleted_partial_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"memory\".\"deleted_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "memory_workspace_id_workspace_id_fk": {
+          "name": "memory_workspace_id_workspace_id_fk",
+          "tableFrom": "memory",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.mothership_inbox_allowed_sender": {
+      "name": "mothership_inbox_allowed_sender",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "added_by": {
+          "name": "added_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "inbox_sender_ws_email_idx": {
+          "name": "inbox_sender_ws_email_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "email",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "mothership_inbox_allowed_sender_workspace_id_workspace_id_fk": {
+          "name": "mothership_inbox_allowed_sender_workspace_id_workspace_id_fk",
+          "tableFrom": "mothership_inbox_allowed_sender",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "mothership_inbox_allowed_sender_added_by_user_id_fk": {
+          "name": "mothership_inbox_allowed_sender_added_by_user_id_fk",
+          "tableFrom": "mothership_inbox_allowed_sender",
+          "tableTo": "user",
+          "columnsFrom": ["added_by"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.mothership_inbox_task": {
+      "name": "mothership_inbox_task",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "from_email": {
+          "name": "from_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "from_name": {
+          "name": "from_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "body_preview": {
+          "name": "body_preview",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "body_text": {
+          "name": "body_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "body_html": {
+          "name": "body_html",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "email_message_id": {
+          "name": "email_message_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "in_reply_to": {
+          "name": "in_reply_to",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "response_message_id": {
+          "name": "response_message_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agentmail_message_id": {
+          "name": "agentmail_message_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'received'"
+        },
+        "chat_id": {
+          "name": "chat_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trigger_job_id": {
+          "name": "trigger_job_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_summary": {
+          "name": "result_summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rejection_reason": {
+          "name": "rejection_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "has_attachments": {
+          "name": "has_attachments",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "cc_recipients": {
+          "name": "cc_recipients",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "processing_started_at": {
+          "name": "processing_started_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "inbox_task_ws_created_at_idx": {
+          "name": "inbox_task_ws_created_at_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "inbox_task_ws_status_idx": {
+          "name": "inbox_task_ws_status_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "inbox_task_response_msg_id_idx": {
+          "name": "inbox_task_response_msg_id_idx",
+          "columns": [
+            {
+              "expression": "response_message_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "inbox_task_email_msg_id_idx": {
+          "name": "inbox_task_email_msg_id_idx",
+          "columns": [
+            {
+              "expression": "email_message_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "mothership_inbox_task_workspace_id_workspace_id_fk": {
+          "name": "mothership_inbox_task_workspace_id_workspace_id_fk",
+          "tableFrom": "mothership_inbox_task",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "mothership_inbox_task_chat_id_copilot_chats_id_fk": {
+          "name": "mothership_inbox_task_chat_id_copilot_chats_id_fk",
+          "tableFrom": "mothership_inbox_task",
+          "tableTo": "copilot_chats",
+          "columnsFrom": ["chat_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.mothership_inbox_webhook": {
+      "name": "mothership_inbox_webhook",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "webhook_id": {
+          "name": "webhook_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "secret": {
+          "name": "secret",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "mothership_inbox_webhook_workspace_id_workspace_id_fk": {
+          "name": "mothership_inbox_webhook_workspace_id_workspace_id_fk",
+          "tableFrom": "mothership_inbox_webhook",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "mothership_inbox_webhook_workspace_id_unique": {
+          "name": "mothership_inbox_webhook_workspace_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["workspace_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.mothership_settings": {
+      "name": "mothership_settings",
+      "schema": "",
+      "columns": {
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "mcp_tool_refs": {
+          "name": "mcp_tool_refs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "custom_tool_refs": {
+          "name": "custom_tool_refs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "skill_refs": {
+          "name": "skill_refs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "mothership_settings_workspace_id_idx": {
+          "name": "mothership_settings_workspace_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "mothership_settings_workspace_id_workspace_id_fk": {
+          "name": "mothership_settings_workspace_id_workspace_id_fk",
+          "tableFrom": "mothership_settings",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.organization": {
+      "name": "organization",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "slug": {
+          "name": "slug",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "logo": {
+          "name": "logo",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "whitelabel_settings": {
+          "name": "whitelabel_settings",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "data_retention_settings": {
+          "name": "data_retention_settings",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "org_usage_limit": {
+          "name": "org_usage_limit",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "storage_used_bytes": {
+          "name": "storage_used_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "limit_notifications": {
+          "name": "limit_notifications",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "departed_member_usage": {
+          "name": "departed_member_usage",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'0'"
+        },
+        "credit_balance": {
+          "name": "credit_balance",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'0'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.organization_member_usage_limit": {
+      "name": "organization_member_usage_limit",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "usage_limit": {
+          "name": "usage_limit",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "set_by": {
+          "name": "set_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "org_member_usage_limit_org_user_unique": {
+          "name": "org_member_usage_limit_org_user_unique",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "org_member_usage_limit_organization_id_idx": {
+          "name": "org_member_usage_limit_organization_id_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "organization_member_usage_limit_organization_id_organization_id_fk": {
+          "name": "organization_member_usage_limit_organization_id_organization_id_fk",
+          "tableFrom": "organization_member_usage_limit",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "organization_member_usage_limit_user_id_user_id_fk": {
+          "name": "organization_member_usage_limit_user_id_user_id_fk",
+          "tableFrom": "organization_member_usage_limit",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "organization_member_usage_limit_set_by_user_id_fk": {
+          "name": "organization_member_usage_limit_set_by_user_id_fk",
+          "tableFrom": "organization_member_usage_limit",
+          "tableTo": "user",
+          "columnsFrom": ["set_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.outbox_event": {
+      "name": "outbox_event",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "event_type": {
+          "name": "event_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "payload": {
+          "name": "payload",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "attempts": {
+          "name": "attempts",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "max_attempts": {
+          "name": "max_attempts",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 10
+        },
+        "available_at": {
+          "name": "available_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "locked_at": {
+          "name": "locked_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "processed_at": {
+          "name": "processed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "outbox_event_status_available_idx": {
+          "name": "outbox_event_status_available_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "available_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "outbox_event_locked_at_idx": {
+          "name": "outbox_event_locked_at_idx",
+          "columns": [
+            {
+              "expression": "locked_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "outbox_event_type_created_idx": {
+          "name": "outbox_event_type_created_idx",
+          "columns": [
+            {
+              "expression": "event_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.paused_executions": {
+      "name": "paused_executions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_id": {
+          "name": "execution_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_snapshot": {
+          "name": "execution_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "pause_points": {
+          "name": "pause_points",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "total_pause_count": {
+          "name": "total_pause_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resumed_count": {
+          "name": "resumed_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "automatic_resume_retry_count": {
+          "name": "automatic_resume_retry_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paused'"
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "paused_at": {
+          "name": "paused_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_resume_at": {
+          "name": "next_resume_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "paused_executions_workflow_id_idx": {
+          "name": "paused_executions_workflow_id_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "paused_executions_status_idx": {
+          "name": "paused_executions_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "paused_executions_execution_id_unique": {
+          "name": "paused_executions_execution_id_unique",
+          "columns": [
+            {
+              "expression": "execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "paused_executions_next_resume_at_idx": {
+          "name": "paused_executions_next_resume_at_idx",
+          "columns": [
+            {
+              "expression": "next_resume_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "status = 'paused' AND next_resume_at IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "paused_executions_workflow_id_workflow_id_fk": {
+          "name": "paused_executions_workflow_id_workflow_id_fk",
+          "tableFrom": "paused_executions",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.pending_credential_draft": {
+      "name": "pending_credential_draft",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_name": {
+          "name": "display_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_id": {
+          "name": "credential_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pending_draft_user_provider_ws": {
+          "name": "pending_draft_user_provider_ws",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pending_credential_draft_user_id_user_id_fk": {
+          "name": "pending_credential_draft_user_id_user_id_fk",
+          "tableFrom": "pending_credential_draft",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pending_credential_draft_workspace_id_workspace_id_fk": {
+          "name": "pending_credential_draft_workspace_id_workspace_id_fk",
+          "tableFrom": "pending_credential_draft",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pending_credential_draft_credential_id_credential_id_fk": {
+          "name": "pending_credential_draft_credential_id_credential_id_fk",
+          "tableFrom": "pending_credential_draft",
+          "tableTo": "credential",
+          "columnsFrom": ["credential_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.permission_group": {
+      "name": "permission_group",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "is_default": {
+          "name": "is_default",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        }
+      },
+      "indexes": {
+        "permission_group_created_by_idx": {
+          "name": "permission_group_created_by_idx",
+          "columns": [
+            {
+              "expression": "created_by",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "permission_group_organization_name_unique": {
+          "name": "permission_group_organization_name_unique",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "permission_group_organization_default_unique": {
+          "name": "permission_group_organization_default_unique",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "is_default = true",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "permission_group_organization_id_organization_id_fk": {
+          "name": "permission_group_organization_id_organization_id_fk",
+          "tableFrom": "permission_group",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "permission_group_created_by_user_id_fk": {
+          "name": "permission_group_created_by_user_id_fk",
+          "tableFrom": "permission_group",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.permission_group_member": {
+      "name": "permission_group_member",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "permission_group_id": {
+          "name": "permission_group_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "assigned_by": {
+          "name": "assigned_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assigned_at": {
+          "name": "assigned_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "permission_group_member_group_id_idx": {
+          "name": "permission_group_member_group_id_idx",
+          "columns": [
+            {
+              "expression": "permission_group_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "permission_group_member_group_user_unique": {
+          "name": "permission_group_member_group_user_unique",
+          "columns": [
+            {
+              "expression": "permission_group_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "permission_group_member_organization_user_idx": {
+          "name": "permission_group_member_organization_user_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "permission_group_member_permission_group_id_permission_group_id_fk": {
+          "name": "permission_group_member_permission_group_id_permission_group_id_fk",
+          "tableFrom": "permission_group_member",
+          "tableTo": "permission_group",
+          "columnsFrom": ["permission_group_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "permission_group_member_organization_id_organization_id_fk": {
+          "name": "permission_group_member_organization_id_organization_id_fk",
+          "tableFrom": "permission_group_member",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "permission_group_member_user_id_user_id_fk": {
+          "name": "permission_group_member_user_id_user_id_fk",
+          "tableFrom": "permission_group_member",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "permission_group_member_assigned_by_user_id_fk": {
+          "name": "permission_group_member_assigned_by_user_id_fk",
+          "tableFrom": "permission_group_member",
+          "tableTo": "user",
+          "columnsFrom": ["assigned_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.permission_group_workspace": {
+      "name": "permission_group_workspace",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "permission_group_id": {
+          "name": "permission_group_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "permission_group_workspace_workspace_id_idx": {
+          "name": "permission_group_workspace_workspace_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "permission_group_workspace_group_workspace_unique": {
+          "name": "permission_group_workspace_group_workspace_unique",
+          "columns": [
+            {
+              "expression": "permission_group_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "permission_group_workspace_permission_group_id_permission_group_id_fk": {
+          "name": "permission_group_workspace_permission_group_id_permission_group_id_fk",
+          "tableFrom": "permission_group_workspace",
+          "tableTo": "permission_group",
+          "columnsFrom": ["permission_group_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "permission_group_workspace_workspace_id_workspace_id_fk": {
+          "name": "permission_group_workspace_workspace_id_workspace_id_fk",
+          "tableFrom": "permission_group_workspace",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "permission_group_workspace_organization_id_organization_id_fk": {
+          "name": "permission_group_workspace_organization_id_organization_id_fk",
+          "tableFrom": "permission_group_workspace",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.permissions": {
+      "name": "permissions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entity_type": {
+          "name": "entity_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entity_id": {
+          "name": "entity_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "permission_type": {
+          "name": "permission_type",
+          "type": "permission_type",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "permissions_user_id_idx": {
+          "name": "permissions_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "permissions_entity_idx": {
+          "name": "permissions_entity_idx",
+          "columns": [
+            {
+              "expression": "entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "entity_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "permissions_user_entity_type_idx": {
+          "name": "permissions_user_entity_type_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "permissions_user_entity_permission_idx": {
+          "name": "permissions_user_entity_permission_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "permission_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "permissions_user_entity_idx": {
+          "name": "permissions_user_entity_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "entity_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "permissions_unique_constraint": {
+          "name": "permissions_unique_constraint",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "entity_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "permissions_user_id_user_id_fk": {
+          "name": "permissions_user_id_user_id_fk",
+          "tableFrom": "permissions",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.public_share": {
+      "name": "public_share",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "resource_type": {
+          "name": "resource_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_id": {
+          "name": "resource_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "token": {
+          "name": "token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "is_active": {
+          "name": "is_active",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "auth_type": {
+          "name": "auth_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'public'"
+        },
+        "password": {
+          "name": "password",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "allowed_emails": {
+          "name": "allowed_emails",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'[]'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "public_share_token_unique": {
+          "name": "public_share_token_unique",
+          "columns": [
+            {
+              "expression": "token",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "public_share_resource_unique": {
+          "name": "public_share_resource_unique",
+          "columns": [
+            {
+              "expression": "resource_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "public_share_resource_id_idx": {
+          "name": "public_share_resource_id_idx",
+          "columns": [
+            {
+              "expression": "resource_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "public_share_workspace_id_idx": {
+          "name": "public_share_workspace_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "public_share_workspace_id_workspace_id_fk": {
+          "name": "public_share_workspace_id_workspace_id_fk",
+          "tableFrom": "public_share",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "public_share_created_by_user_id_fk": {
+          "name": "public_share_created_by_user_id_fk",
+          "tableFrom": "public_share",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.rate_limit_bucket": {
+      "name": "rate_limit_bucket",
+      "schema": "",
+      "columns": {
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "tokens": {
+          "name": "tokens",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_refill_at": {
+          "name": "last_refill_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.resume_queue": {
+      "name": "resume_queue",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "paused_execution_id": {
+          "name": "paused_execution_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_execution_id": {
+          "name": "parent_execution_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "new_execution_id": {
+          "name": "new_execution_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "context_id": {
+          "name": "context_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resume_input": {
+          "name": "resume_input",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "queued_at": {
+          "name": "queued_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "claimed_at": {
+          "name": "claimed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "resume_queue_parent_status_idx": {
+          "name": "resume_queue_parent_status_idx",
+          "columns": [
+            {
+              "expression": "parent_execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "queued_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "resume_queue_new_execution_idx": {
+          "name": "resume_queue_new_execution_idx",
+          "columns": [
+            {
+              "expression": "new_execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "resume_queue_paused_execution_id_paused_executions_id_fk": {
+          "name": "resume_queue_paused_execution_id_paused_executions_id_fk",
+          "tableFrom": "resume_queue",
+          "tableTo": "paused_executions",
+          "columnsFrom": ["paused_execution_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.session": {
+      "name": "session",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token": {
+          "name": "token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ip_address": {
+          "name": "ip_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_agent": {
+          "name": "user_agent",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "active_organization_id": {
+          "name": "active_organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "impersonated_by": {
+          "name": "impersonated_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "session_user_id_idx": {
+          "name": "session_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "session_token_idx": {
+          "name": "session_token_idx",
+          "columns": [
+            {
+              "expression": "token",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "session_user_id_user_id_fk": {
+          "name": "session_user_id_user_id_fk",
+          "tableFrom": "session",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "session_active_organization_id_organization_id_fk": {
+          "name": "session_active_organization_id_organization_id_fk",
+          "tableFrom": "session",
+          "tableTo": "organization",
+          "columnsFrom": ["active_organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "session_token_unique": {
+          "name": "session_token_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.settings": {
+      "name": "settings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "theme": {
+          "name": "theme",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "auto_connect": {
+          "name": "auto_connect",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "telemetry_enabled": {
+          "name": "telemetry_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "email_preferences": {
+          "name": "email_preferences",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "billing_usage_notifications_enabled": {
+          "name": "billing_usage_notifications_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "show_training_controls": {
+          "name": "show_training_controls",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "super_user_mode_enabled": {
+          "name": "super_user_mode_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "mothership_environment": {
+          "name": "mothership_environment",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'default'"
+        },
+        "error_notifications_enabled": {
+          "name": "error_notifications_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "snap_to_grid_size": {
+          "name": "snap_to_grid_size",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "show_action_bar": {
+          "name": "show_action_bar",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "timezone": {
+          "name": "timezone",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "copilot_enabled_models": {
+          "name": "copilot_enabled_models",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "copilot_auto_allowed_tools": {
+          "name": "copilot_auto_allowed_tools",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'"
+        },
+        "last_active_workspace_id": {
+          "name": "last_active_workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "settings_user_id_user_id_fk": {
+          "name": "settings_user_id_user_id_fk",
+          "tableFrom": "settings",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "settings_user_id_unique": {
+          "name": "settings_user_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["user_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.sim_trigger_state": {
+      "name": "sim_trigger_state",
+      "schema": "",
+      "columns": {
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "block_id": {
+          "name": "block_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_key": {
+          "name": "scope_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "last_fired_at": {
+          "name": "last_fired_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "sim_trigger_state_workflow_id_workflow_id_fk": {
+          "name": "sim_trigger_state_workflow_id_workflow_id_fk",
+          "tableFrom": "sim_trigger_state",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "sim_trigger_state_workflow_id_block_id_scope_key_pk": {
+          "name": "sim_trigger_state_workflow_id_block_id_scope_key_pk",
+          "columns": ["workflow_id", "block_id", "scope_key"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.skill": {
+      "name": "skill",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content": {
+          "name": "content",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "skill_workspace_name_unique": {
+          "name": "skill_workspace_name_unique",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "skill_workspace_id_workspace_id_fk": {
+          "name": "skill_workspace_id_workspace_id_fk",
+          "tableFrom": "skill",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "skill_user_id_user_id_fk": {
+          "name": "skill_user_id_user_id_fk",
+          "tableFrom": "skill",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.sso_provider": {
+      "name": "sso_provider",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "issuer": {
+          "name": "issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "domain": {
+          "name": "domain",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "oidc_config": {
+          "name": "oidc_config",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "saml_config": {
+          "name": "saml_config",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "sso_provider_provider_id_idx": {
+          "name": "sso_provider_provider_id_idx",
+          "columns": [
+            {
+              "expression": "provider_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "sso_provider_domain_idx": {
+          "name": "sso_provider_domain_idx",
+          "columns": [
+            {
+              "expression": "domain",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "sso_provider_user_id_idx": {
+          "name": "sso_provider_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "sso_provider_organization_id_idx": {
+          "name": "sso_provider_organization_id_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "sso_provider_user_id_user_id_fk": {
+          "name": "sso_provider_user_id_user_id_fk",
+          "tableFrom": "sso_provider",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "sso_provider_organization_id_organization_id_fk": {
+          "name": "sso_provider_organization_id_organization_id_fk",
+          "tableFrom": "sso_provider",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.subscription": {
+      "name": "subscription",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "plan": {
+          "name": "plan",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reference_id": {
+          "name": "reference_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stripe_customer_id": {
+          "name": "stripe_customer_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stripe_subscription_id": {
+          "name": "stripe_subscription_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "period_start": {
+          "name": "period_start",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "period_end": {
+          "name": "period_end",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cancel_at_period_end": {
+          "name": "cancel_at_period_end",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cancel_at": {
+          "name": "cancel_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "canceled_at": {
+          "name": "canceled_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "ended_at": {
+          "name": "ended_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "seats": {
+          "name": "seats",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trial_start": {
+          "name": "trial_start",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trial_end": {
+          "name": "trial_end",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "billing_interval": {
+          "name": "billing_interval",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stripe_schedule_id": {
+          "name": "stripe_schedule_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "subscription_reference_status_idx": {
+          "name": "subscription_reference_status_idx",
+          "columns": [
+            {
+              "expression": "reference_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "check_enterprise_metadata": {
+          "name": "check_enterprise_metadata",
+          "value": "plan != 'enterprise' OR metadata IS NOT NULL"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.table_jobs": {
+      "name": "table_jobs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "table_id": {
+          "name": "table_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'running'"
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rows_processed": {
+          "name": "rows_processed",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "table_jobs_one_active_per_table": {
+          "name": "table_jobs_one_active_per_table",
+          "columns": [
+            {
+              "expression": "table_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"table_jobs\".\"status\" = 'running' AND \"table_jobs\".\"type\" <> 'export'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "table_jobs_watchdog_idx": {
+          "name": "table_jobs_watchdog_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "table_jobs_table_started_idx": {
+          "name": "table_jobs_table_started_idx",
+          "columns": [
+            {
+              "expression": "table_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "table_jobs_table_id_user_table_definitions_id_fk": {
+          "name": "table_jobs_table_id_user_table_definitions_id_fk",
+          "tableFrom": "table_jobs",
+          "tableTo": "user_table_definitions",
+          "columnsFrom": ["table_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "table_jobs_workspace_id_workspace_id_fk": {
+          "name": "table_jobs_workspace_id_workspace_id_fk",
+          "tableFrom": "table_jobs",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.table_row_executions": {
+      "name": "table_row_executions",
+      "schema": "",
+      "columns": {
+        "table_id": {
+          "name": "table_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "row_id": {
+          "name": "row_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "group_id": {
+          "name": "group_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_id": {
+          "name": "execution_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "job_id": {
+          "name": "job_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "running_block_ids": {
+          "name": "running_block_ids",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::text[]"
+        },
+        "block_errors": {
+          "name": "block_errors",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "cancelled_at": {
+          "name": "cancelled_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "enrichment_details": {
+          "name": "enrichment_details",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "table_row_executions_table_status_idx": {
+          "name": "table_row_executions_table_status_idx",
+          "columns": [
+            {
+              "expression": "table_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"table_row_executions\".\"status\" IN ('queued', 'running', 'pending')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "table_row_executions_execution_id_idx": {
+          "name": "table_row_executions_execution_id_idx",
+          "columns": [
+            {
+              "expression": "execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"table_row_executions\".\"execution_id\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "table_row_executions_table_group_idx": {
+          "name": "table_row_executions_table_group_idx",
+          "columns": [
+            {
+              "expression": "table_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "group_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "table_row_executions_table_id_user_table_definitions_id_fk": {
+          "name": "table_row_executions_table_id_user_table_definitions_id_fk",
+          "tableFrom": "table_row_executions",
+          "tableTo": "user_table_definitions",
+          "columnsFrom": ["table_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "table_row_executions_row_id_user_table_rows_id_fk": {
+          "name": "table_row_executions_row_id_user_table_rows_id_fk",
+          "tableFrom": "table_row_executions",
+          "tableTo": "user_table_rows",
+          "columnsFrom": ["row_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "table_row_executions_row_id_group_id_pk": {
+          "name": "table_row_executions_row_id_group_id_pk",
+          "columns": ["row_id", "group_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.table_run_dispatches": {
+      "name": "table_run_dispatches",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "table_id": {
+          "name": "table_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "request_id": {
+          "name": "request_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "mode": {
+          "name": "mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope": {
+          "name": "scope",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "cursor": {
+          "name": "cursor",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "limit": {
+          "name": "limit",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "processed_count": {
+          "name": "processed_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "is_manual_run": {
+          "name": "is_manual_run",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "triggered_by_user_id": {
+          "name": "triggered_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_at": {
+          "name": "requested_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cancelled_at": {
+          "name": "cancelled_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "table_run_dispatches_active_idx": {
+          "name": "table_run_dispatches_active_idx",
+          "columns": [
+            {
+              "expression": "table_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "table_run_dispatches_watchdog_idx": {
+          "name": "table_run_dispatches_watchdog_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "requested_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "table_run_dispatches_table_id_user_table_definitions_id_fk": {
+          "name": "table_run_dispatches_table_id_user_table_definitions_id_fk",
+          "tableFrom": "table_run_dispatches",
+          "tableTo": "user_table_definitions",
+          "columnsFrom": ["table_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "table_run_dispatches_workspace_id_workspace_id_fk": {
+          "name": "table_run_dispatches_workspace_id_workspace_id_fk",
+          "tableFrom": "table_run_dispatches",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "table_run_dispatches_triggered_by_user_id_user_id_fk": {
+          "name": "table_run_dispatches_triggered_by_user_id_user_id_fk",
+          "tableFrom": "table_run_dispatches",
+          "tableTo": "user",
+          "columnsFrom": ["triggered_by_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.usage_log": {
+      "name": "usage_log",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "category": {
+          "name": "category",
+          "type": "usage_log_category",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source": {
+          "name": "source",
+          "type": "usage_log_source",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cost": {
+          "name": "cost",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "event_key": {
+          "name": "event_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "billing_entity_type": {
+          "name": "billing_entity_type",
+          "type": "billing_entity_type",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "billing_entity_id": {
+          "name": "billing_entity_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "billing_period_start": {
+          "name": "billing_period_start",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "billing_period_end": {
+          "name": "billing_period_end",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_id": {
+          "name": "execution_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "usage_log_user_created_at_idx": {
+          "name": "usage_log_user_created_at_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "usage_log_source_idx": {
+          "name": "usage_log_source_idx",
+          "columns": [
+            {
+              "expression": "source",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "usage_log_workspace_id_idx": {
+          "name": "usage_log_workspace_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "usage_log_workflow_id_idx": {
+          "name": "usage_log_workflow_id_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "usage_log_event_key_unique": {
+          "name": "usage_log_event_key_unique",
+          "columns": [
+            {
+              "expression": "event_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"usage_log\".\"event_key\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "usage_log_billing_entity_period_idx": {
+          "name": "usage_log_billing_entity_period_idx",
+          "columns": [
+            {
+              "expression": "billing_entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "billing_entity_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "billing_period_start",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "billing_period_end",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"usage_log\".\"billing_entity_type\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "usage_log_workspace_created_at_idx": {
+          "name": "usage_log_workspace_created_at_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "usage_log_execution_id_idx": {
+          "name": "usage_log_execution_id_idx",
+          "columns": [
+            {
+              "expression": "execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "usage_log_user_id_user_id_fk": {
+          "name": "usage_log_user_id_user_id_fk",
+          "tableFrom": "usage_log",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "usage_log_workspace_id_workspace_id_fk": {
+          "name": "usage_log_workspace_id_workspace_id_fk",
+          "tableFrom": "usage_log",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "usage_log_workflow_id_workflow_id_fk": {
+          "name": "usage_log_workflow_id_workflow_id_fk",
+          "tableFrom": "usage_log",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "usage_log_billing_scope_all_or_none": {
+          "name": "usage_log_billing_scope_all_or_none",
+          "value": "(\n        (\"usage_log\".\"billing_entity_type\" IS NULL AND \"usage_log\".\"billing_entity_id\" IS NULL AND \"usage_log\".\"billing_period_start\" IS NULL AND \"usage_log\".\"billing_period_end\" IS NULL)\n        OR\n        (\"usage_log\".\"billing_entity_type\" IS NOT NULL AND \"usage_log\".\"billing_entity_id\" IS NOT NULL AND \"usage_log\".\"billing_period_start\" IS NOT NULL AND \"usage_log\".\"billing_period_end\" IS NOT NULL AND \"usage_log\".\"billing_period_start\" < \"usage_log\".\"billing_period_end\")\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.user": {
+      "name": "user",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "normalized_email": {
+          "name": "normalized_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "email_verified": {
+          "name": "email_verified",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "image": {
+          "name": "image",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stripe_customer_id": {
+          "name": "stripe_customer_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'user'"
+        },
+        "banned": {
+          "name": "banned",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": false,
+          "default": false
+        },
+        "ban_reason": {
+          "name": "ban_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "ban_expires": {
+          "name": "ban_expires",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "user_email_unique": {
+          "name": "user_email_unique",
+          "nullsNotDistinct": false,
+          "columns": ["email"]
+        },
+        "user_normalized_email_unique": {
+          "name": "user_normalized_email_unique",
+          "nullsNotDistinct": false,
+          "columns": ["normalized_email"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user_stats": {
+      "name": "user_stats",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "total_manual_executions": {
+          "name": "total_manual_executions",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_api_calls": {
+          "name": "total_api_calls",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_webhook_triggers": {
+          "name": "total_webhook_triggers",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_scheduled_executions": {
+          "name": "total_scheduled_executions",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_chat_executions": {
+          "name": "total_chat_executions",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_mcp_executions": {
+          "name": "total_mcp_executions",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_tokens_used": {
+          "name": "total_tokens_used",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_cost": {
+          "name": "total_cost",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'0'"
+        },
+        "current_usage_limit": {
+          "name": "current_usage_limit",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'5'"
+        },
+        "usage_limit_updated_at": {
+          "name": "usage_limit_updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "now()"
+        },
+        "current_period_cost": {
+          "name": "current_period_cost",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'0'"
+        },
+        "last_period_cost": {
+          "name": "last_period_cost",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'0'"
+        },
+        "billed_overage_this_period": {
+          "name": "billed_overage_this_period",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'0'"
+        },
+        "pro_period_cost_snapshot": {
+          "name": "pro_period_cost_snapshot",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'0'"
+        },
+        "pro_period_cost_snapshot_at": {
+          "name": "pro_period_cost_snapshot_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credit_balance": {
+          "name": "credit_balance",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'0'"
+        },
+        "total_copilot_cost": {
+          "name": "total_copilot_cost",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'0'"
+        },
+        "current_period_copilot_cost": {
+          "name": "current_period_copilot_cost",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'0'"
+        },
+        "last_period_copilot_cost": {
+          "name": "last_period_copilot_cost",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'0'"
+        },
+        "total_copilot_tokens": {
+          "name": "total_copilot_tokens",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_copilot_calls": {
+          "name": "total_copilot_calls",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_mcp_copilot_calls": {
+          "name": "total_mcp_copilot_calls",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_mcp_copilot_cost": {
+          "name": "total_mcp_copilot_cost",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'0'"
+        },
+        "current_period_mcp_copilot_cost": {
+          "name": "current_period_mcp_copilot_cost",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'0'"
+        },
+        "storage_used_bytes": {
+          "name": "storage_used_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_active": {
+          "name": "last_active",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "billing_blocked": {
+          "name": "billing_blocked",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "billing_blocked_reason": {
+          "name": "billing_blocked_reason",
+          "type": "billing_blocked_reason",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "limit_notifications": {
+          "name": "limit_notifications",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "user_stats_user_id_user_id_fk": {
+          "name": "user_stats_user_id_user_id_fk",
+          "tableFrom": "user_stats",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "user_stats_user_id_unique": {
+          "name": "user_stats_user_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["user_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user_table_definitions": {
+      "name": "user_table_definitions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "schema": {
+          "name": "schema",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "max_rows": {
+          "name": "max_rows",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 10000
+        },
+        "row_count": {
+          "name": "row_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "rows_version": {
+          "name": "rows_version",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_table_def_workspace_id_idx": {
+          "name": "user_table_def_workspace_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_table_def_workspace_name_unique": {
+          "name": "user_table_def_workspace_name_unique",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"user_table_definitions\".\"archived_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_table_def_archived_at_idx": {
+          "name": "user_table_def_archived_at_idx",
+          "columns": [
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_table_def_workspace_archived_partial_idx": {
+          "name": "user_table_def_workspace_archived_partial_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"user_table_definitions\".\"archived_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_table_definitions_workspace_id_workspace_id_fk": {
+          "name": "user_table_definitions_workspace_id_workspace_id_fk",
+          "tableFrom": "user_table_definitions",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "user_table_definitions_created_by_user_id_fk": {
+          "name": "user_table_definitions_created_by_user_id_fk",
+          "tableFrom": "user_table_definitions",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user_table_rows": {
+      "name": "user_table_rows",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "table_id": {
+          "name": "table_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "data": {
+          "name": "data",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "position": {
+          "name": "position",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "order_key": {
+          "name": "order_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "user_table_rows_tenant_data_gin_idx": {
+          "name": "user_table_rows_tenant_data_gin_idx",
+          "columns": [
+            {
+              "expression": "table_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "\"data\" jsonb_path_ops",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "user_table_rows_workspace_table_idx": {
+          "name": "user_table_rows_workspace_table_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "table_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_table_rows_table_position_idx": {
+          "name": "user_table_rows_table_position_idx",
+          "columns": [
+            {
+              "expression": "table_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "position",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_table_rows_table_order_key_idx": {
+          "name": "user_table_rows_table_order_key_idx",
+          "columns": [
+            {
+              "expression": "table_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "order_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_table_rows_table_id_id_idx": {
+          "name": "user_table_rows_table_id_id_idx",
+          "columns": [
+            {
+              "expression": "table_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_table_rows_table_id_user_table_definitions_id_fk": {
+          "name": "user_table_rows_table_id_user_table_definitions_id_fk",
+          "tableFrom": "user_table_rows",
+          "tableTo": "user_table_definitions",
+          "columnsFrom": ["table_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "user_table_rows_workspace_id_workspace_id_fk": {
+          "name": "user_table_rows_workspace_id_workspace_id_fk",
+          "tableFrom": "user_table_rows",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "user_table_rows_created_by_user_id_fk": {
+          "name": "user_table_rows_created_by_user_id_fk",
+          "tableFrom": "user_table_rows",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.verification": {
+      "name": "verification",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "identifier": {
+          "name": "identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value": {
+          "name": "value",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "verification_identifier_idx": {
+          "name": "verification_identifier_idx",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "verification_expires_at_idx": {
+          "name": "verification_expires_at_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.waitlist": {
+      "name": "waitlist",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "waitlist_email_unique": {
+          "name": "waitlist_email_unique",
+          "nullsNotDistinct": false,
+          "columns": ["email"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.webhook": {
+      "name": "webhook",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deployment_version_id": {
+          "name": "deployment_version_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "registration_status": {
+          "name": "registration_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "registration_generation": {
+          "name": "registration_generation",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "config_fingerprint": {
+          "name": "config_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "prepared_at": {
+          "name": "prepared_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "block_id": {
+          "name": "block_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "path": {
+          "name": "path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "routing_key": {
+          "name": "routing_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_config": {
+          "name": "provider_config",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "is_active": {
+          "name": "is_active",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "failed_count": {
+          "name": "failed_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "default": 0
+        },
+        "last_failed_at": {
+          "name": "last_failed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "path_deployment_unique": {
+          "name": "path_deployment_unique",
+          "columns": [
+            {
+              "expression": "path",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deployment_version_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"webhook\".\"archived_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "webhook_workflow_deployment_idx": {
+          "name": "webhook_workflow_deployment_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deployment_version_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "webhook_routing_key_active_idx": {
+          "name": "webhook_routing_key_active_idx",
+          "columns": [
+            {
+              "expression": "routing_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"webhook\".\"archived_at\" IS NULL AND \"webhook\".\"routing_key\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "webhook_archived_at_partial_idx": {
+          "name": "webhook_archived_at_partial_idx",
+          "columns": [
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"webhook\".\"archived_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "idx_webhook_on_provider_is_active_workflow_id_deploym_bdeed5468": {
+          "name": "idx_webhook_on_provider_is_active_workflow_id_deploym_bdeed5468",
+          "columns": [
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "is_active",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deployment_version_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "webhook_tiktok_credential_id_idx": {
+          "name": "webhook_tiktok_credential_id_idx",
+          "columns": [
+            {
+              "expression": "((\"provider_config\")::jsonb ->> 'credentialId')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"webhook\".\"provider\" = 'tiktok' AND \"webhook\".\"is_active\" = true AND \"webhook\".\"archived_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "idx_webhook_on_workflow_id_block_id_updated_at_desc": {
+          "name": "idx_webhook_on_workflow_id_block_id_updated_at_desc",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "block_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "webhook_active_registration_unique": {
+          "name": "webhook_active_registration_unique",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "block_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"webhook\".\"registration_status\" = 'active' AND \"webhook\".\"block_id\" IS NOT NULL AND \"webhook\".\"archived_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "webhook_candidate_registration_unique": {
+          "name": "webhook_candidate_registration_unique",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "block_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"webhook\".\"registration_status\" = 'candidate' AND \"webhook\".\"block_id\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "webhook_registration_status_generation_idx": {
+          "name": "webhook_registration_status_generation_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "registration_status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "registration_generation",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "webhook_workflow_id_workflow_id_fk": {
+          "name": "webhook_workflow_id_workflow_id_fk",
+          "tableFrom": "webhook",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "webhook_deployment_version_id_workflow_deployment_version_id_fk": {
+          "name": "webhook_deployment_version_id_workflow_deployment_version_id_fk",
+          "tableFrom": "webhook",
+          "tableTo": "workflow_deployment_version",
+          "columnsFrom": ["deployment_version_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "webhook_registration_status_check": {
+          "name": "webhook_registration_status_check",
+          "value": "\"webhook\".\"registration_status\" IS NULL OR \"webhook\".\"registration_status\" IN ('active', 'candidate', 'retired', 'orphaned')"
+        },
+        "webhook_registration_generation_check": {
+          "name": "webhook_registration_generation_check",
+          "value": "\"webhook\".\"registration_generation\" IS NULL OR \"webhook\".\"registration_generation\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.webhook_path_claim": {
+      "name": "webhook_path_claim",
+      "schema": "",
+      "columns": {
+        "path": {
+          "name": "path",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation": {
+          "name": "generation",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "webhook_path_claim_workflow_idx": {
+          "name": "webhook_path_claim_workflow_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "webhook_path_claim_workflow_id_workflow_id_fk": {
+          "name": "webhook_path_claim_workflow_id_workflow_id_fk",
+          "tableFrom": "webhook_path_claim",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "webhook_path_claim_generation_check": {
+          "name": "webhook_path_claim_generation_check",
+          "value": "\"webhook_path_claim\".\"generation\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.workflow": {
+      "name": "workflow",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "folder_id": {
+          "name": "folder_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sort_order": {
+          "name": "sort_order",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_synced": {
+          "name": "last_synced",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "is_deployed": {
+          "name": "is_deployed",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "deployed_at": {
+          "name": "deployed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "is_public_api": {
+          "name": "is_public_api",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "locked": {
+          "name": "locked",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "fork_sync_excluded": {
+          "name": "fork_sync_excluded",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "run_count": {
+          "name": "run_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_run_at": {
+          "name": "last_run_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "variables": {
+          "name": "variables",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'{}'"
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "workflow_user_id_idx": {
+          "name": "workflow_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_workspace_id_idx": {
+          "name": "workflow_workspace_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_user_workspace_idx": {
+          "name": "workflow_user_workspace_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_workspace_folder_name_active_unique": {
+          "name": "workflow_workspace_folder_name_active_unique",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "coalesce(\"folder_id\", '')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"workflow\".\"archived_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_folder_sort_idx": {
+          "name": "workflow_folder_sort_idx",
+          "columns": [
+            {
+              "expression": "folder_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "sort_order",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_archived_at_idx": {
+          "name": "workflow_archived_at_idx",
+          "columns": [
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_workspace_archived_partial_idx": {
+          "name": "workflow_workspace_archived_partial_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"workflow\".\"archived_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workflow_user_id_user_id_fk": {
+          "name": "workflow_user_id_user_id_fk",
+          "tableFrom": "workflow",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workflow_workspace_id_workspace_id_fk": {
+          "name": "workflow_workspace_id_workspace_id_fk",
+          "tableFrom": "workflow",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workflow_folder_id_workflow_folder_id_fk": {
+          "name": "workflow_folder_id_workflow_folder_id_fk",
+          "tableFrom": "workflow",
+          "tableTo": "workflow_folder",
+          "columnsFrom": ["folder_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workflow_blocks": {
+      "name": "workflow_blocks",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "position_x": {
+          "name": "position_x",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "position_y": {
+          "name": "position_y",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "horizontal_handles": {
+          "name": "horizontal_handles",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "is_wide": {
+          "name": "is_wide",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "advanced_mode": {
+          "name": "advanced_mode",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "trigger_mode": {
+          "name": "trigger_mode",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "locked": {
+          "name": "locked",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "height": {
+          "name": "height",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'0'"
+        },
+        "sub_blocks": {
+          "name": "sub_blocks",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "outputs": {
+          "name": "outputs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "data": {
+          "name": "data",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'{}'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workflow_blocks_workflow_id_idx": {
+          "name": "workflow_blocks_workflow_id_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_blocks_type_idx": {
+          "name": "workflow_blocks_type_idx",
+          "columns": [
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workflow_blocks_workflow_id_workflow_id_fk": {
+          "name": "workflow_blocks_workflow_id_workflow_id_fk",
+          "tableFrom": "workflow_blocks",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workflow_checkpoints": {
+      "name": "workflow_checkpoints",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "chat_id": {
+          "name": "chat_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "message_id": {
+          "name": "message_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workflow_state": {
+          "name": "workflow_state",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workflow_checkpoints_user_id_idx": {
+          "name": "workflow_checkpoints_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_checkpoints_workflow_id_idx": {
+          "name": "workflow_checkpoints_workflow_id_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_checkpoints_chat_id_idx": {
+          "name": "workflow_checkpoints_chat_id_idx",
+          "columns": [
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_checkpoints_message_id_idx": {
+          "name": "workflow_checkpoints_message_id_idx",
+          "columns": [
+            {
+              "expression": "message_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_checkpoints_user_workflow_idx": {
+          "name": "workflow_checkpoints_user_workflow_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_checkpoints_workflow_chat_idx": {
+          "name": "workflow_checkpoints_workflow_chat_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_checkpoints_created_at_idx": {
+          "name": "workflow_checkpoints_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_checkpoints_chat_created_at_idx": {
+          "name": "workflow_checkpoints_chat_created_at_idx",
+          "columns": [
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workflow_checkpoints_user_id_user_id_fk": {
+          "name": "workflow_checkpoints_user_id_user_id_fk",
+          "tableFrom": "workflow_checkpoints",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workflow_checkpoints_workflow_id_workflow_id_fk": {
+          "name": "workflow_checkpoints_workflow_id_workflow_id_fk",
+          "tableFrom": "workflow_checkpoints",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workflow_checkpoints_chat_id_copilot_chats_id_fk": {
+          "name": "workflow_checkpoints_chat_id_copilot_chats_id_fk",
+          "tableFrom": "workflow_checkpoints",
+          "tableTo": "copilot_chats",
+          "columnsFrom": ["chat_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workflow_deployment_operation": {
+      "name": "workflow_deployment_operation",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deployment_version_id": {
+          "name": "deployment_version_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "previous_active_version_id": {
+          "name": "previous_active_version_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "action": {
+          "name": "action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "protocol_version": {
+          "name": "protocol_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation": {
+          "name": "generation",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'preparing'"
+        },
+        "component_readiness": {
+          "name": "component_readiness",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "request_hash": {
+          "name": "request_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workflow_deployment_operation_workflow_generation_unique": {
+          "name": "workflow_deployment_operation_workflow_generation_unique",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "generation",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_deployment_operation_workflow_idempotency_unique": {
+          "name": "workflow_deployment_operation_workflow_idempotency_unique",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"workflow_deployment_operation\".\"idempotency_key\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_deployment_operation_workflow_in_flight_unique": {
+          "name": "workflow_deployment_operation_workflow_in_flight_unique",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"workflow_deployment_operation\".\"status\" IN ('preparing', 'activating')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_deployment_operation_workflow_status_idx": {
+          "name": "workflow_deployment_operation_workflow_status_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_deployment_operation_deployment_version_idx": {
+          "name": "workflow_deployment_operation_deployment_version_idx",
+          "columns": [
+            {
+              "expression": "deployment_version_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_deployment_operation_workflow_version_generation_idx": {
+          "name": "workflow_deployment_operation_workflow_version_generation_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deployment_version_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "generation",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workflow_deployment_operation_workflow_id_workflow_id_fk": {
+          "name": "workflow_deployment_operation_workflow_id_workflow_id_fk",
+          "tableFrom": "workflow_deployment_operation",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workflow_deployment_operation_deployment_version_id_workflow_deployment_version_id_fk": {
+          "name": "workflow_deployment_operation_deployment_version_id_workflow_deployment_version_id_fk",
+          "tableFrom": "workflow_deployment_operation",
+          "tableTo": "workflow_deployment_version",
+          "columnsFrom": ["deployment_version_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workflow_deployment_operation_previous_active_version_id_workflow_deployment_version_id_fk": {
+          "name": "workflow_deployment_operation_previous_active_version_id_workflow_deployment_version_id_fk",
+          "tableFrom": "workflow_deployment_operation",
+          "tableTo": "workflow_deployment_version",
+          "columnsFrom": ["previous_active_version_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "workflow_deployment_operation_action_check": {
+          "name": "workflow_deployment_operation_action_check",
+          "value": "\"workflow_deployment_operation\".\"action\" IN ('deploy', 'activate')"
+        },
+        "workflow_deployment_operation_status_check": {
+          "name": "workflow_deployment_operation_status_check",
+          "value": "\"workflow_deployment_operation\".\"status\" IN ('preparing', 'activating', 'active', 'failed', 'superseded')"
+        },
+        "workflow_deployment_operation_generation_check": {
+          "name": "workflow_deployment_operation_generation_check",
+          "value": "\"workflow_deployment_operation\".\"generation\" > 0"
+        },
+        "workflow_deployment_operation_protocol_version_check": {
+          "name": "workflow_deployment_operation_protocol_version_check",
+          "value": "\"workflow_deployment_operation\".\"protocol_version\" > 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.workflow_deployment_version": {
+      "name": "workflow_deployment_version",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "state": {
+          "name": "state",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "is_active": {
+          "name": "is_active",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "workflow_deployment_version_workflow_version_unique": {
+          "name": "workflow_deployment_version_workflow_version_unique",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "version",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_deployment_version_workflow_active_idx": {
+          "name": "workflow_deployment_version_workflow_active_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "is_active",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_deployment_version_created_at_idx": {
+          "name": "workflow_deployment_version_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workflow_deployment_version_workflow_id_workflow_id_fk": {
+          "name": "workflow_deployment_version_workflow_id_workflow_id_fk",
+          "tableFrom": "workflow_deployment_version",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workflow_edges": {
+      "name": "workflow_edges",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_block_id": {
+          "name": "source_block_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_block_id": {
+          "name": "target_block_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_handle": {
+          "name": "source_handle",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_handle": {
+          "name": "target_handle",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workflow_edges_workflow_id_idx": {
+          "name": "workflow_edges_workflow_id_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_edges_workflow_source_idx": {
+          "name": "workflow_edges_workflow_source_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_block_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_edges_workflow_target_idx": {
+          "name": "workflow_edges_workflow_target_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_block_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workflow_edges_workflow_id_workflow_id_fk": {
+          "name": "workflow_edges_workflow_id_workflow_id_fk",
+          "tableFrom": "workflow_edges",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workflow_edges_source_block_id_workflow_blocks_id_fk": {
+          "name": "workflow_edges_source_block_id_workflow_blocks_id_fk",
+          "tableFrom": "workflow_edges",
+          "tableTo": "workflow_blocks",
+          "columnsFrom": ["source_block_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workflow_edges_target_block_id_workflow_blocks_id_fk": {
+          "name": "workflow_edges_target_block_id_workflow_blocks_id_fk",
+          "tableFrom": "workflow_edges",
+          "tableTo": "workflow_blocks",
+          "columnsFrom": ["target_block_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workflow_execution_logs": {
+      "name": "workflow_execution_logs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_id": {
+          "name": "execution_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "state_snapshot_id": {
+          "name": "state_snapshot_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deployment_version_id": {
+          "name": "deployment_version_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "level": {
+          "name": "level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'running'"
+        },
+        "trigger": {
+          "name": "trigger",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ended_at": {
+          "name": "ended_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "total_duration_ms": {
+          "name": "total_duration_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_data": {
+          "name": "execution_data",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "cost": {
+          "name": "cost",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cost_total": {
+          "name": "cost_total",
+          "type": "numeric",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "models_used": {
+          "name": "models_used",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "files": {
+          "name": "files",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workflow_execution_logs_workflow_id_idx": {
+          "name": "workflow_execution_logs_workflow_id_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_execution_logs_state_snapshot_id_idx": {
+          "name": "workflow_execution_logs_state_snapshot_id_idx",
+          "columns": [
+            {
+              "expression": "state_snapshot_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_execution_logs_deployment_version_id_idx": {
+          "name": "workflow_execution_logs_deployment_version_id_idx",
+          "columns": [
+            {
+              "expression": "deployment_version_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_execution_logs_trigger_idx": {
+          "name": "workflow_execution_logs_trigger_idx",
+          "columns": [
+            {
+              "expression": "trigger",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_execution_logs_level_idx": {
+          "name": "workflow_execution_logs_level_idx",
+          "columns": [
+            {
+              "expression": "level",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_execution_logs_started_at_idx": {
+          "name": "workflow_execution_logs_started_at_idx",
+          "columns": [
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_execution_logs_execution_id_unique": {
+          "name": "workflow_execution_logs_execution_id_unique",
+          "columns": [
+            {
+              "expression": "execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_execution_logs_workflow_started_at_idx": {
+          "name": "workflow_execution_logs_workflow_started_at_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_execution_logs_workspace_started_at_idx": {
+          "name": "workflow_execution_logs_workspace_started_at_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_execution_logs_workspace_started_at_id_desc_idx": {
+          "name": "workflow_execution_logs_workspace_started_at_id_desc_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "\"started_at\" DESC NULLS LAST",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "\"id\" DESC",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_execution_logs_workspace_cost_total_idx": {
+          "name": "workflow_execution_logs_workspace_cost_total_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "cost_total",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_execution_logs_models_used_idx": {
+          "name": "workflow_execution_logs_models_used_idx",
+          "columns": [
+            {
+              "expression": "models_used",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "workflow_execution_logs_workspace_ended_at_id_idx": {
+          "name": "workflow_execution_logs_workspace_ended_at_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "date_trunc('milliseconds', \"ended_at\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_execution_logs_running_started_at_idx": {
+          "name": "workflow_execution_logs_running_started_at_idx",
+          "columns": [
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "status = 'running'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_execution_logs_completed_ended_at_idx": {
+          "name": "workflow_execution_logs_completed_ended_at_idx",
+          "columns": [
+            {
+              "expression": "ended_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"workflow_execution_logs\".\"status\" = 'completed' AND \"workflow_execution_logs\".\"level\" = 'info' AND \"workflow_execution_logs\".\"ended_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workflow_execution_logs_workflow_id_workflow_id_fk": {
+          "name": "workflow_execution_logs_workflow_id_workflow_id_fk",
+          "tableFrom": "workflow_execution_logs",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workflow_execution_logs_workspace_id_workspace_id_fk": {
+          "name": "workflow_execution_logs_workspace_id_workspace_id_fk",
+          "tableFrom": "workflow_execution_logs",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workflow_execution_logs_state_snapshot_id_workflow_execution_snapshots_id_fk": {
+          "name": "workflow_execution_logs_state_snapshot_id_workflow_execution_snapshots_id_fk",
+          "tableFrom": "workflow_execution_logs",
+          "tableTo": "workflow_execution_snapshots",
+          "columnsFrom": ["state_snapshot_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "workflow_execution_logs_deployment_version_id_workflow_deployment_version_id_fk": {
+          "name": "workflow_execution_logs_deployment_version_id_workflow_deployment_version_id_fk",
+          "tableFrom": "workflow_execution_logs",
+          "tableTo": "workflow_deployment_version",
+          "columnsFrom": ["deployment_version_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workflow_execution_snapshots": {
+      "name": "workflow_execution_snapshots",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "state_hash": {
+          "name": "state_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "state_data": {
+          "name": "state_data",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workflow_snapshots_workflow_id_idx": {
+          "name": "workflow_snapshots_workflow_id_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_snapshots_hash_idx": {
+          "name": "workflow_snapshots_hash_idx",
+          "columns": [
+            {
+              "expression": "state_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_snapshots_workflow_hash_idx": {
+          "name": "workflow_snapshots_workflow_hash_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "state_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_snapshots_created_at_idx": {
+          "name": "workflow_snapshots_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workflow_execution_snapshots_workflow_id_workflow_id_fk": {
+          "name": "workflow_execution_snapshots_workflow_id_workflow_id_fk",
+          "tableFrom": "workflow_execution_snapshots",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workflow_folder": {
+      "name": "workflow_folder",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_id": {
+          "name": "parent_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'#6B7280'"
+        },
+        "is_expanded": {
+          "name": "is_expanded",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "locked": {
+          "name": "locked",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "sort_order": {
+          "name": "sort_order",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "workflow_folder_user_idx": {
+          "name": "workflow_folder_user_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_folder_workspace_parent_idx": {
+          "name": "workflow_folder_workspace_parent_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_folder_parent_sort_idx": {
+          "name": "workflow_folder_parent_sort_idx",
+          "columns": [
+            {
+              "expression": "parent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "sort_order",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_folder_archived_at_idx": {
+          "name": "workflow_folder_archived_at_idx",
+          "columns": [
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_folder_workspace_archived_partial_idx": {
+          "name": "workflow_folder_workspace_archived_partial_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"workflow_folder\".\"archived_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workflow_folder_user_id_user_id_fk": {
+          "name": "workflow_folder_user_id_user_id_fk",
+          "tableFrom": "workflow_folder",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workflow_folder_workspace_id_workspace_id_fk": {
+          "name": "workflow_folder_workspace_id_workspace_id_fk",
+          "tableFrom": "workflow_folder",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workflow_mcp_server": {
+      "name": "workflow_mcp_server",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "is_public": {
+          "name": "is_public",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workflow_mcp_server_workspace_id_idx": {
+          "name": "workflow_mcp_server_workspace_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_mcp_server_created_by_idx": {
+          "name": "workflow_mcp_server_created_by_idx",
+          "columns": [
+            {
+              "expression": "created_by",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_mcp_server_deleted_at_idx": {
+          "name": "workflow_mcp_server_deleted_at_idx",
+          "columns": [
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_mcp_server_workspace_deleted_partial_idx": {
+          "name": "workflow_mcp_server_workspace_deleted_partial_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"workflow_mcp_server\".\"deleted_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workflow_mcp_server_workspace_id_workspace_id_fk": {
+          "name": "workflow_mcp_server_workspace_id_workspace_id_fk",
+          "tableFrom": "workflow_mcp_server",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workflow_mcp_server_created_by_user_id_fk": {
+          "name": "workflow_mcp_server_created_by_user_id_fk",
+          "tableFrom": "workflow_mcp_server",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workflow_mcp_tool": {
+      "name": "workflow_mcp_tool",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "server_id": {
+          "name": "server_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "tool_name": {
+          "name": "tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "tool_description": {
+          "name": "tool_description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "parameter_schema": {
+          "name": "parameter_schema",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "parameter_description_overrides": {
+          "name": "parameter_description_overrides",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::json"
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workflow_mcp_tool_server_id_idx": {
+          "name": "workflow_mcp_tool_server_id_idx",
+          "columns": [
+            {
+              "expression": "server_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_mcp_tool_workflow_id_idx": {
+          "name": "workflow_mcp_tool_workflow_id_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_mcp_tool_server_workflow_unique": {
+          "name": "workflow_mcp_tool_server_workflow_unique",
+          "columns": [
+            {
+              "expression": "server_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"workflow_mcp_tool\".\"archived_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_mcp_tool_archived_at_partial_idx": {
+          "name": "workflow_mcp_tool_archived_at_partial_idx",
+          "columns": [
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"workflow_mcp_tool\".\"archived_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workflow_mcp_tool_server_id_workflow_mcp_server_id_fk": {
+          "name": "workflow_mcp_tool_server_id_workflow_mcp_server_id_fk",
+          "tableFrom": "workflow_mcp_tool",
+          "tableTo": "workflow_mcp_server",
+          "columnsFrom": ["server_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workflow_mcp_tool_workflow_id_workflow_id_fk": {
+          "name": "workflow_mcp_tool_workflow_id_workflow_id_fk",
+          "tableFrom": "workflow_mcp_tool",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workflow_schedule": {
+      "name": "workflow_schedule",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deployment_version_id": {
+          "name": "deployment_version_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deployment_operation_id": {
+          "name": "deployment_operation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "block_id": {
+          "name": "block_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cron_expression": {
+          "name": "cron_expression",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_run_at": {
+          "name": "next_run_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_ran_at": {
+          "name": "last_ran_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_queued_at": {
+          "name": "last_queued_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trigger_type": {
+          "name": "trigger_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "timezone": {
+          "name": "timezone",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'UTC'"
+        },
+        "failed_count": {
+          "name": "failed_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "infra_retry_count": {
+          "name": "infra_retry_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "last_failed_at": {
+          "name": "last_failed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_type": {
+          "name": "source_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'workflow'"
+        },
+        "job_title": {
+          "name": "job_title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "prompt": {
+          "name": "prompt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lifecycle": {
+          "name": "lifecycle",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'persistent'"
+        },
+        "success_condition": {
+          "name": "success_condition",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "max_runs": {
+          "name": "max_runs",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_count": {
+          "name": "run_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "source_chat_id": {
+          "name": "source_chat_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_task_name": {
+          "name": "source_task_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_user_id": {
+          "name": "source_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_workspace_id": {
+          "name": "source_workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "job_history": {
+          "name": "job_history",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "contexts": {
+          "name": "contexts",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "excluded_dates": {
+          "name": "excluded_dates",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "ends_at": {
+          "name": "ends_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workflow_schedule_workflow_block_deployment_unique": {
+          "name": "workflow_schedule_workflow_block_deployment_unique",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "block_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deployment_version_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"workflow_schedule\".\"archived_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_schedule_workflow_deployment_idx": {
+          "name": "workflow_schedule_workflow_deployment_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deployment_version_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_schedule_archived_at_partial_idx": {
+          "name": "workflow_schedule_archived_at_partial_idx",
+          "columns": [
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"workflow_schedule\".\"archived_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "idx_workflow_schedule_on_source_workspace_id_source_t_c07f3bba6": {
+          "name": "idx_workflow_schedule_on_source_workspace_id_source_t_c07f3bba6",
+          "columns": [
+            {
+              "expression": "source_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_schedule_due_workflow_idx": {
+          "name": "workflow_schedule_due_workflow_idx",
+          "columns": [
+            {
+              "expression": "next_run_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_queued_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deployment_version_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"workflow_schedule\".\"archived_at\" IS NULL AND \"workflow_schedule\".\"status\" NOT IN ('disabled', 'completed') AND (\"workflow_schedule\".\"source_type\" = 'workflow' OR \"workflow_schedule\".\"source_type\" IS NULL)",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_schedule_due_job_idx": {
+          "name": "workflow_schedule_due_job_idx",
+          "columns": [
+            {
+              "expression": "next_run_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_queued_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"workflow_schedule\".\"archived_at\" IS NULL AND \"workflow_schedule\".\"status\" NOT IN ('disabled', 'completed') AND \"workflow_schedule\".\"source_type\" = 'job'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workflow_schedule_workflow_id_workflow_id_fk": {
+          "name": "workflow_schedule_workflow_id_workflow_id_fk",
+          "tableFrom": "workflow_schedule",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workflow_schedule_deployment_version_id_workflow_deployment_version_id_fk": {
+          "name": "workflow_schedule_deployment_version_id_workflow_deployment_version_id_fk",
+          "tableFrom": "workflow_schedule",
+          "tableTo": "workflow_deployment_version",
+          "columnsFrom": ["deployment_version_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workflow_schedule_deployment_operation_id_workflow_deployment_operation_id_fk": {
+          "name": "workflow_schedule_deployment_operation_id_workflow_deployment_operation_id_fk",
+          "tableFrom": "workflow_schedule",
+          "tableTo": "workflow_deployment_operation",
+          "columnsFrom": ["deployment_operation_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workflow_schedule_source_user_id_user_id_fk": {
+          "name": "workflow_schedule_source_user_id_user_id_fk",
+          "tableFrom": "workflow_schedule",
+          "tableTo": "user",
+          "columnsFrom": ["source_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workflow_schedule_source_workspace_id_workspace_id_fk": {
+          "name": "workflow_schedule_source_workspace_id_workspace_id_fk",
+          "tableFrom": "workflow_schedule",
+          "tableTo": "workspace",
+          "columnsFrom": ["source_workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workflow_subflows": {
+      "name": "workflow_subflows",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workflow_id": {
+          "name": "workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workflow_subflows_workflow_id_idx": {
+          "name": "workflow_subflows_workflow_id_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workflow_subflows_workflow_type_idx": {
+          "name": "workflow_subflows_workflow_type_idx",
+          "columns": [
+            {
+              "expression": "workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workflow_subflows_workflow_id_workflow_id_fk": {
+          "name": "workflow_subflows_workflow_id_workflow_id_fk",
+          "tableFrom": "workflow_subflows",
+          "tableTo": "workflow",
+          "columnsFrom": ["workflow_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace": {
+      "name": "workspace",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'#33C482'"
+        },
+        "logo_url": {
+          "name": "logo_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_id": {
+          "name": "owner_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workspace_mode": {
+          "name": "workspace_mode",
+          "type": "workspace_mode",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'grandfathered_shared'"
+        },
+        "billed_account_user_id": {
+          "name": "billed_account_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "storage_used_bytes": {
+          "name": "storage_used_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "allow_personal_api_keys": {
+          "name": "allow_personal_api_keys",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "inbox_enabled": {
+          "name": "inbox_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "inbox_address": {
+          "name": "inbox_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "inbox_provider_id": {
+          "name": "inbox_provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "organization_assigned_at": {
+          "name": "organization_assigned_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "forked_from_workspace_id": {
+          "name": "forked_from_workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_owner_id_idx": {
+          "name": "workspace_owner_id_idx",
+          "columns": [
+            {
+              "expression": "owner_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_organization_id_idx": {
+          "name": "workspace_organization_id_idx",
+          "columns": [
+            {
+              "expression": "organization_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_mode_idx": {
+          "name": "workspace_mode_idx",
+          "columns": [
+            {
+              "expression": "workspace_mode",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_forked_from_workspace_id_idx": {
+          "name": "workspace_forked_from_workspace_id_idx",
+          "columns": [
+            {
+              "expression": "forked_from_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_owner_id_user_id_fk": {
+          "name": "workspace_owner_id_user_id_fk",
+          "tableFrom": "workspace",
+          "tableTo": "user",
+          "columnsFrom": ["owner_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workspace_organization_id_organization_id_fk": {
+          "name": "workspace_organization_id_organization_id_fk",
+          "tableFrom": "workspace",
+          "tableTo": "organization",
+          "columnsFrom": ["organization_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_billed_account_user_id_user_id_fk": {
+          "name": "workspace_billed_account_user_id_user_id_fk",
+          "tableFrom": "workspace",
+          "tableTo": "user",
+          "columnsFrom": ["billed_account_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "workspace_forked_from_workspace_id_workspace_id_fk": {
+          "name": "workspace_forked_from_workspace_id_workspace_id_fk",
+          "tableFrom": "workspace",
+          "tableTo": "workspace",
+          "columnsFrom": ["forked_from_workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "workspace_storage_used_bytes_non_negative": {
+          "name": "workspace_storage_used_bytes_non_negative",
+          "value": "\"workspace\".\"storage_used_bytes\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.workspace_byok_keys": {
+      "name": "workspace_byok_keys",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "encrypted_api_key": {
+          "name": "encrypted_api_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_byok_workspace_provider_idx": {
+          "name": "workspace_byok_workspace_provider_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_byok_keys_workspace_id_workspace_id_fk": {
+          "name": "workspace_byok_keys_workspace_id_workspace_id_fk",
+          "tableFrom": "workspace_byok_keys",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workspace_byok_keys_created_by_user_id_fk": {
+          "name": "workspace_byok_keys_created_by_user_id_fk",
+          "tableFrom": "workspace_byok_keys",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_environment": {
+      "name": "workspace_environment",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "variables": {
+          "name": "variables",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_environment_workspace_unique": {
+          "name": "workspace_environment_workspace_unique",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_environment_workspace_id_workspace_id_fk": {
+          "name": "workspace_environment_workspace_id_workspace_id_fk",
+          "tableFrom": "workspace_environment",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_file": {
+      "name": "workspace_file",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "size": {
+          "name": "size",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uploaded_by": {
+          "name": "uploaded_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "uploaded_at": {
+          "name": "uploaded_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_file_workspace_id_idx": {
+          "name": "workspace_file_workspace_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_file_key_idx": {
+          "name": "workspace_file_key_idx",
+          "columns": [
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_file_deleted_at_idx": {
+          "name": "workspace_file_deleted_at_idx",
+          "columns": [
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_file_workspace_deleted_partial_idx": {
+          "name": "workspace_file_workspace_deleted_partial_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"workspace_file\".\"deleted_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_file_workspace_id_workspace_id_fk": {
+          "name": "workspace_file_workspace_id_workspace_id_fk",
+          "tableFrom": "workspace_file",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workspace_file_uploaded_by_user_id_fk": {
+          "name": "workspace_file_uploaded_by_user_id_fk",
+          "tableFrom": "workspace_file",
+          "tableTo": "user",
+          "columnsFrom": ["uploaded_by"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "workspace_file_key_unique": {
+          "name": "workspace_file_key_unique",
+          "nullsNotDistinct": false,
+          "columns": ["key"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_file_folders": {
+      "name": "workspace_file_folders",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_id": {
+          "name": "parent_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sort_order": {
+          "name": "sort_order",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_file_folders_workspace_parent_idx": {
+          "name": "workspace_file_folders_workspace_parent_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_file_folders_parent_sort_idx": {
+          "name": "workspace_file_folders_parent_sort_idx",
+          "columns": [
+            {
+              "expression": "parent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "sort_order",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_file_folders_deleted_at_idx": {
+          "name": "workspace_file_folders_deleted_at_idx",
+          "columns": [
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_file_folders_workspace_deleted_partial_idx": {
+          "name": "workspace_file_folders_workspace_deleted_partial_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"workspace_file_folders\".\"deleted_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_file_folders_workspace_parent_name_active_unique": {
+          "name": "workspace_file_folders_workspace_parent_name_active_unique",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "coalesce(\"parent_id\", '')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"workspace_file_folders\".\"deleted_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_file_folders_user_id_user_id_fk": {
+          "name": "workspace_file_folders_user_id_user_id_fk",
+          "tableFrom": "workspace_file_folders",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workspace_file_folders_workspace_id_workspace_id_fk": {
+          "name": "workspace_file_folders_workspace_id_workspace_id_fk",
+          "tableFrom": "workspace_file_folders",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workspace_file_folders_parent_id_workspace_file_folders_id_fk": {
+          "name": "workspace_file_folders_parent_id_workspace_file_folders_id_fk",
+          "tableFrom": "workspace_file_folders",
+          "tableTo": "workspace_file_folders",
+          "columnsFrom": ["parent_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_files": {
+      "name": "workspace_files",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "folder_id": {
+          "name": "folder_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "context": {
+          "name": "context",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "chat_id": {
+          "name": "chat_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "message_id": {
+          "name": "message_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "original_name": {
+          "name": "original_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_name": {
+          "name": "display_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "content_type": {
+          "name": "content_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "size": {
+          "name": "size",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "uploaded_at": {
+          "name": "uploaded_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_files_key_active_unique": {
+          "name": "workspace_files_key_active_unique",
+          "columns": [
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"workspace_files\".\"deleted_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_files_workspace_folder_name_active_unique": {
+          "name": "workspace_files_workspace_folder_name_active_unique",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "coalesce(\"folder_id\", '')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "original_name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"workspace_files\".\"deleted_at\" IS NULL AND \"workspace_files\".\"context\" = 'workspace' AND \"workspace_files\".\"workspace_id\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_files_chat_display_name_unique": {
+          "name": "workspace_files_chat_display_name_unique",
+          "columns": [
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "display_name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"workspace_files\".\"context\" = 'mothership' AND \"workspace_files\".\"chat_id\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_files_key_idx": {
+          "name": "workspace_files_key_idx",
+          "columns": [
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_files_user_id_idx": {
+          "name": "workspace_files_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_files_workspace_id_idx": {
+          "name": "workspace_files_workspace_id_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_files_folder_id_idx": {
+          "name": "workspace_files_folder_id_idx",
+          "columns": [
+            {
+              "expression": "folder_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_files_context_idx": {
+          "name": "workspace_files_context_idx",
+          "columns": [
+            {
+              "expression": "context",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_files_chat_id_idx": {
+          "name": "workspace_files_chat_id_idx",
+          "columns": [
+            {
+              "expression": "chat_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_files_deleted_at_idx": {
+          "name": "workspace_files_deleted_at_idx",
+          "columns": [
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_files_workspace_deleted_partial_idx": {
+          "name": "workspace_files_workspace_deleted_partial_idx",
+          "columns": [
+            {
+              "expression": "workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"workspace_files\".\"deleted_at\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_files_user_id_user_id_fk": {
+          "name": "workspace_files_user_id_user_id_fk",
+          "tableFrom": "workspace_files",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workspace_files_workspace_id_workspace_id_fk": {
+          "name": "workspace_files_workspace_id_workspace_id_fk",
+          "tableFrom": "workspace_files",
+          "tableTo": "workspace",
+          "columnsFrom": ["workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workspace_files_folder_id_workspace_file_folders_id_fk": {
+          "name": "workspace_files_folder_id_workspace_file_folders_id_fk",
+          "tableFrom": "workspace_files",
+          "tableTo": "workspace_file_folders",
+          "columnsFrom": ["folder_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_files_chat_id_copilot_chats_id_fk": {
+          "name": "workspace_files_chat_id_copilot_chats_id_fk",
+          "tableFrom": "workspace_files",
+          "tableTo": "copilot_chats",
+          "columnsFrom": ["chat_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_fork_block_map": {
+      "name": "workspace_fork_block_map",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "child_workspace_id": {
+          "name": "child_workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_workflow_id": {
+          "name": "parent_workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_block_id": {
+          "name": "parent_block_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "child_workflow_id": {
+          "name": "child_workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "child_block_id": {
+          "name": "child_block_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_fork_block_map_child_ws_parent_unique": {
+          "name": "workspace_fork_block_map_child_ws_parent_unique",
+          "columns": [
+            {
+              "expression": "child_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_block_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_fork_block_map_child_ws_child_unique": {
+          "name": "workspace_fork_block_map_child_ws_child_unique",
+          "columns": [
+            {
+              "expression": "child_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "child_block_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_fork_block_map_child_ws_parent_wf_idx": {
+          "name": "workspace_fork_block_map_child_ws_parent_wf_idx",
+          "columns": [
+            {
+              "expression": "child_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_fork_block_map_child_ws_child_wf_idx": {
+          "name": "workspace_fork_block_map_child_ws_child_wf_idx",
+          "columns": [
+            {
+              "expression": "child_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "child_workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_fork_block_map_child_workspace_id_workspace_id_fk": {
+          "name": "workspace_fork_block_map_child_workspace_id_workspace_id_fk",
+          "tableFrom": "workspace_fork_block_map",
+          "tableTo": "workspace",
+          "columnsFrom": ["child_workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_fork_dependent_value": {
+      "name": "workspace_fork_dependent_value",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "child_workspace_id": {
+          "name": "child_workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_workflow_id": {
+          "name": "target_workflow_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_block_id": {
+          "name": "target_block_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sub_block_key": {
+          "name": "sub_block_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value": {
+          "name": "value",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_fork_dependent_value_child_ws_wf_idx": {
+          "name": "workspace_fork_dependent_value_child_ws_wf_idx",
+          "columns": [
+            {
+              "expression": "child_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_fork_dependent_value_field_unique": {
+          "name": "workspace_fork_dependent_value_field_unique",
+          "columns": [
+            {
+              "expression": "child_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_workflow_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_block_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "sub_block_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_fork_dependent_value_child_workspace_id_workspace_id_fk": {
+          "name": "workspace_fork_dependent_value_child_workspace_id_workspace_id_fk",
+          "tableFrom": "workspace_fork_dependent_value",
+          "tableTo": "workspace",
+          "columnsFrom": ["child_workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_fork_promote_run": {
+      "name": "workspace_fork_promote_run",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "child_workspace_id": {
+          "name": "child_workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_workspace_id": {
+          "name": "source_workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_workspace_id": {
+          "name": "target_workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "direction": {
+          "name": "direction",
+          "type": "workspace_fork_promote_direction",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "snapshot": {
+          "name": "snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_fork_promote_run_child_ws_target_unique": {
+          "name": "workspace_fork_promote_run_child_ws_target_unique",
+          "columns": [
+            {
+              "expression": "child_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_fork_promote_run_target_ws_idx": {
+          "name": "workspace_fork_promote_run_target_ws_idx",
+          "columns": [
+            {
+              "expression": "target_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_fork_promote_run_child_workspace_id_workspace_id_fk": {
+          "name": "workspace_fork_promote_run_child_workspace_id_workspace_id_fk",
+          "tableFrom": "workspace_fork_promote_run",
+          "tableTo": "workspace",
+          "columnsFrom": ["child_workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workspace_fork_promote_run_created_by_user_id_fk": {
+          "name": "workspace_fork_promote_run_created_by_user_id_fk",
+          "tableFrom": "workspace_fork_promote_run",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_fork_resource_map": {
+      "name": "workspace_fork_resource_map",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "child_workspace_id": {
+          "name": "child_workspace_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_type": {
+          "name": "resource_type",
+          "type": "workspace_fork_resource_type",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_resource_id": {
+          "name": "parent_resource_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "child_resource_id": {
+          "name": "child_resource_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_fork_resource_map_child_ws_idx": {
+          "name": "workspace_fork_resource_map_child_ws_idx",
+          "columns": [
+            {
+              "expression": "child_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_fork_resource_map_child_ws_type_idx": {
+          "name": "workspace_fork_resource_map_child_ws_type_idx",
+          "columns": [
+            {
+              "expression": "child_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_fork_resource_map_child_type_parent_unique": {
+          "name": "workspace_fork_resource_map_child_type_parent_unique",
+          "columns": [
+            {
+              "expression": "child_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_resource_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_fork_resource_map_child_workspace_id_workspace_id_fk": {
+          "name": "workspace_fork_resource_map_child_workspace_id_workspace_id_fk",
+          "tableFrom": "workspace_fork_resource_map",
+          "tableTo": "workspace",
+          "columnsFrom": ["child_workspace_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workspace_fork_resource_map_created_by_user_id_fk": {
+          "name": "workspace_fork_resource_map_created_by_user_id_fk",
+          "tableFrom": "workspace_fork_resource_map",
+          "tableTo": "user",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {
+    "public.academy_cert_status": {
+      "name": "academy_cert_status",
+      "schema": "public",
+      "values": ["active", "revoked", "expired"]
+    },
+    "public.background_work_kind": {
+      "name": "background_work_kind",
+      "schema": "public",
+      "values": ["deployment_side_effects", "fork_content_copy", "fork_sync", "fork_rollback"]
+    },
+    "public.background_work_status_value": {
+      "name": "background_work_status_value",
+      "schema": "public",
+      "values": ["pending", "processing", "completed", "completed_with_warnings", "failed"]
+    },
+    "public.billing_blocked_reason": {
+      "name": "billing_blocked_reason",
+      "schema": "public",
+      "values": ["payment_failed", "dispute"]
+    },
+    "public.billing_entity_type": {
+      "name": "billing_entity_type",
+      "schema": "public",
+      "values": ["user", "organization"]
+    },
+    "public.chat_type": {
+      "name": "chat_type",
+      "schema": "public",
+      "values": ["mothership", "copilot"]
+    },
+    "public.copilot_async_tool_status": {
+      "name": "copilot_async_tool_status",
+      "schema": "public",
+      "values": ["pending", "running", "completed", "failed", "cancelled", "delivered"]
+    },
+    "public.copilot_run_status": {
+      "name": "copilot_run_status",
+      "schema": "public",
+      "values": ["active", "paused_waiting_for_tool", "resuming", "complete", "error", "cancelled"]
+    },
+    "public.credential_member_role": {
+      "name": "credential_member_role",
+      "schema": "public",
+      "values": ["admin", "member"]
+    },
+    "public.credential_member_status": {
+      "name": "credential_member_status",
+      "schema": "public",
+      "values": ["active", "pending", "revoked"]
+    },
+    "public.credential_type": {
+      "name": "credential_type",
+      "schema": "public",
+      "values": ["oauth", "env_workspace", "env_personal", "service_account"]
+    },
+    "public.data_drain_cadence": {
+      "name": "data_drain_cadence",
+      "schema": "public",
+      "values": ["hourly", "daily"]
+    },
+    "public.data_drain_destination": {
+      "name": "data_drain_destination",
+      "schema": "public",
+      "values": ["s3", "gcs", "azure_blob", "datadog", "bigquery", "snowflake", "webhook"]
+    },
+    "public.data_drain_run_status": {
+      "name": "data_drain_run_status",
+      "schema": "public",
+      "values": ["running", "success", "failed"]
+    },
+    "public.data_drain_run_trigger": {
+      "name": "data_drain_run_trigger",
+      "schema": "public",
+      "values": ["cron", "manual"]
+    },
+    "public.data_drain_source": {
+      "name": "data_drain_source",
+      "schema": "public",
+      "values": ["workflow_logs", "job_logs", "audit_logs", "copilot_chats", "copilot_runs"]
+    },
+    "public.execution_large_value_reference_source": {
+      "name": "execution_large_value_reference_source",
+      "schema": "public",
+      "values": ["execution_log", "paused_snapshot"]
+    },
+    "public.invitation_kind": {
+      "name": "invitation_kind",
+      "schema": "public",
+      "values": ["organization", "workspace"]
+    },
+    "public.invitation_membership_intent": {
+      "name": "invitation_membership_intent",
+      "schema": "public",
+      "values": ["internal", "external"]
+    },
+    "public.invitation_status": {
+      "name": "invitation_status",
+      "schema": "public",
+      "values": ["pending", "accepted", "rejected", "cancelled", "expired"]
+    },
+    "public.permission_type": {
+      "name": "permission_type",
+      "schema": "public",
+      "values": ["admin", "write", "read"]
+    },
+    "public.usage_log_category": {
+      "name": "usage_log_category",
+      "schema": "public",
+      "values": ["model", "fixed", "tool"]
+    },
+    "public.usage_log_source": {
+      "name": "usage_log_source",
+      "schema": "public",
+      "values": [
+        "workflow",
+        "wand",
+        "copilot",
+        "workspace-chat",
+        "mcp_copilot",
+        "mothership_block",
+        "knowledge-base",
+        "voice-input",
+        "enrichment"
+      ]
+    },
+    "public.workspace_fork_promote_direction": {
+      "name": "workspace_fork_promote_direction",
+      "schema": "public",
+      "values": ["push", "pull"]
+    },
+    "public.workspace_fork_resource_type": {
+      "name": "workspace_fork_resource_type",
+      "schema": "public",
+      "values": [
+        "workflow",
+        "oauth_credential",
+        "service_account_credential",
+        "env_var",
+        "table",
+        "knowledge_base",
+        "knowledge_document",
+        "file",
+        "mcp_server",
+        "workflow_mcp_server",
+        "custom_tool",
+        "skill"
+      ]
+    },
+    "public.workspace_mode": {
+      "name": "workspace_mode",
+      "schema": "public",
+      "values": ["personal", "organization", "grandfathered_shared"]
+    }
+  },
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}
diff --git a/packages/db/migrations/meta/_journal.json b/packages/db/migrations/meta/_journal.json
index 8a9a55e7524..5b970c86327 100644
--- a/packages/db/migrations/meta/_journal.json
+++ b/packages/db/migrations/meta/_journal.json
@@ -1842,6 +1842,13 @@
       "when": 1784252317428,
       "tag": "0263_workflow_fork_sync_excluded",
       "breakpoints": true
+    },
+    {
+      "idx": 264,
+      "version": "7",
+      "when": 1784680777879,
+      "tag": "0264_fat_ikaris",
+      "breakpoints": true
     }
   ]
 }
diff --git a/packages/db/schema.ts b/packages/db/schema.ts
index 24157f8fa31..3ee3b557ef5 100644
--- a/packages/db/schema.ts
+++ b/packages/db/schema.ts
@@ -2390,6 +2390,7 @@ export const copilotChats = pgTable(
     resources: jsonb('resources').notNull().default('[]'),
     lastSeenAt: timestamp('last_seen_at'),
     pinned: boolean('pinned').notNull().default(false),
+    deletedAt: timestamp('deleted_at'),
     createdAt: timestamp('created_at').notNull().defaultNow(),
     updatedAt: timestamp('updated_at').notNull().defaultNow(),
   },
@@ -2413,6 +2414,11 @@ export const copilotChats = pgTable(
       sql`date_trunc('milliseconds', ${table.createdAt})`,
       table.id
     ),
+
+    // Soft-deleted chats surfaced in Recently Deleted (listed per user + workspace)
+    userWorkspaceDeletedPartialIdx: index('copilot_chats_user_workspace_deleted_partial_idx')
+      .on(table.userId, table.workspaceId)
+      .where(sql`${table.deletedAt} IS NOT NULL`),
   })
 )
 
diff --git a/packages/emcn/src/components/chip-modal/chip-modal.tsx b/packages/emcn/src/components/chip-modal/chip-modal.tsx
index e70d99f15e7..b722de672a2 100644
--- a/packages/emcn/src/components/chip-modal/chip-modal.tsx
+++ b/packages/emcn/src/components/chip-modal/chip-modal.tsx
@@ -237,6 +237,10 @@ export interface ChipModalTabsProps {
  * Reusing `ChipSwitch` keeps every tabbed modal visually identical to the
  * segmented toggles elsewhere in the app (e.g. the billing-period switch).
  *
+ * Pinned to `w-fit` so the pill always hugs its tabs: dropped directly into a
+ * flex column the `inline-flex` trough is otherwise blockified and stretched
+ * full-width by `align-items: stretch`. A caller-supplied width class still wins.
+ *
  * @example
  * ```tsx
  * <ChipModalBody>
@@ -262,7 +266,7 @@ function ChipModalTabs({
       onChange={onChange}
       aria-label={ariaLabel}
       options={tabs.map((tab) => ({ value: tab.value, label: tab.label, icon: tab.icon }))}
-      className={className}
+      className={cn('w-fit', className)}
     />
   )
 }
diff --git a/packages/testing/src/mocks/database.mock.ts b/packages/testing/src/mocks/database.mock.ts
index 9a879e4cad8..3c832d79652 100644
--- a/packages/testing/src/mocks/database.mock.ts
+++ b/packages/testing/src/mocks/database.mock.ts
@@ -349,5 +349,7 @@ export const databaseMock = {
  */
 export const drizzleOrmMock = {
   sql: createMockSql(),
+  /** Mirrors drizzle's getTableColumns for schema-mock tables (column-name maps). */
+  getTableColumns: vi.fn((table: Record<string, unknown>) => ({ ...table })),
   ...createMockSqlOperators(),
 }
diff --git a/packages/workflow-persistence/package.json b/packages/workflow-persistence/package.json
index 3b3275b60c1..bca4c2ff05d 100644
--- a/packages/workflow-persistence/package.json
+++ b/packages/workflow-persistence/package.json
@@ -40,7 +40,9 @@
     "lint": "biome check --write --unsafe .",
     "lint:check": "biome check .",
     "format": "biome format --write .",
-    "format:check": "biome format ."
+    "format:check": "biome format .",
+    "test": "vitest run",
+    "test:watch": "vitest"
   },
   "dependencies": {
     "@sim/db": "workspace:*",
@@ -53,6 +55,7 @@
   "devDependencies": {
     "@sim/tsconfig": "workspace:*",
     "@types/node": "24.2.1",
-    "typescript": "^7.0.2"
+    "typescript": "^7.0.2",
+    "vitest": "^4.1.0"
   }
 }
diff --git a/packages/workflow-persistence/src/load.ts b/packages/workflow-persistence/src/load.ts
index 288e9217e8a..6d16e41427a 100644
--- a/packages/workflow-persistence/src/load.ts
+++ b/packages/workflow-persistence/src/load.ts
@@ -2,7 +2,7 @@ import { db, workflow, workflowBlocks, workflowEdges, workflowSubflows } from '@
 import { createLogger } from '@sim/logger'
 import type { BlockState, Loop, Parallel } from '@sim/workflow-types/workflow'
 import { SUBFLOW_TYPES } from '@sim/workflow-types/workflow'
-import { and, eq, isNull } from 'drizzle-orm'
+import { and, eq, getTableColumns, isNull, sql } from 'drizzle-orm'
 import type { Edge } from 'reactflow'
 import { clampParallelBatchSize } from './subflow-helpers'
 import type { DbOrTx, NormalizedWorkflowData } from './types'
@@ -11,7 +11,14 @@ const logger = createLogger('WorkflowPersistenceLoad')
 
 export interface RawNormalizedWorkflow extends NormalizedWorkflowData {
   workspaceId: string
-  blockUpdatedAtById: Record<string, Date | null>
+  /**
+   * Each block row's `updated_at` rendered by Postgres as text, preserving the
+   * full microsecond precision. Kept as a string on purpose: Drizzle's `date`
+   * mode surfaces timestamps as JS `Date`s, which truncate to milliseconds, so
+   * a Date-based value can never be used for an exact compare-and-set against
+   * rows stamped by SQL `now()`/`defaultNow()`.
+   */
+  blockUpdatedAtById: Record<string, string | null>
 }
 
 /**
@@ -35,7 +42,13 @@ export async function loadWorkflowFromNormalizedTablesRaw(
   try {
     const tx = externalTx ?? db
     const [blocks, edges, subflows, [workflowRow]] = await Promise.all([
-      tx.select().from(workflowBlocks).where(eq(workflowBlocks.workflowId, workflowId)),
+      tx
+        .select({
+          ...getTableColumns(workflowBlocks),
+          updatedAtText: sql<string | null>`${workflowBlocks.updatedAt}::text`,
+        })
+        .from(workflowBlocks)
+        .where(eq(workflowBlocks.workflowId, workflowId)),
       tx.select().from(workflowEdges).where(eq(workflowEdges.workflowId, workflowId)),
       tx.select().from(workflowSubflows).where(eq(workflowSubflows.workflowId, workflowId)),
       tx
@@ -54,7 +67,7 @@ export async function loadWorkflowFromNormalizedTablesRaw(
     }
 
     const blocksMap: Record<string, BlockState> = {}
-    const blockUpdatedAtById: Record<string, Date | null> = {}
+    const blockUpdatedAtById: Record<string, string | null> = {}
     blocks.forEach((block) => {
       const blockData = (block.data ?? {}) as BlockState['data']
 
@@ -78,7 +91,7 @@ export async function loadWorkflowFromNormalizedTablesRaw(
       }
 
       blocksMap[block.id] = assembled
-      blockUpdatedAtById[block.id] = block.updatedAt ?? null
+      blockUpdatedAtById[block.id] = block.updatedAtText ?? null
     })
 
     const edgesArray: Edge[] = edges.map((edge) => ({
@@ -180,11 +193,31 @@ export async function loadWorkflowFromNormalizedTablesRaw(
   }
 }
 
+/**
+ * Optimistic-concurrency guard: matches a row's `updated_at` exactly against
+ * the microsecond-precision text value captured at read time.
+ *
+ * The comparison deliberately round-trips through text rather than a JS
+ * `Date`. Postgres stores `timestamp` columns with microsecond precision, but
+ * Drizzle's `date` mode truncates to milliseconds on read, so a Date-based
+ * equality guard can never match rows stamped by SQL `now()`/`defaultNow()` —
+ * the UPDATE silently no-ops forever and load-time migrations never persist.
+ * Casting the captured text back to `timestamp` restores an exact
+ * compare-and-set: a concurrent write stamps a new `updated_at` and the guard
+ * fails closed (skipped, logged, retried on the next load). Residual, inherent
+ * limit: a concurrent app write whose JS `new Date()` collides with the stored
+ * value at exact precision is indistinguishable; a version column would be
+ * required to close that fully.
+ */
+function updatedAtMatches(expectedText: string) {
+  return eq(workflowBlocks.updatedAt, sql`${expectedText}::timestamp`)
+}
+
 export async function persistMigratedBlocks(
   workflowId: string,
   originalBlocks: Record<string, BlockState>,
   migratedBlocks: Record<string, BlockState>,
-  blockUpdatedAtById: Record<string, Date | null> = {}
+  blockUpdatedAtById: Record<string, string | null> = {}
 ): Promise<void> {
   try {
     for (const [blockId, block] of Object.entries(migratedBlocks)) {
@@ -197,11 +230,11 @@ export async function persistMigratedBlocks(
               eq(workflowBlocks.workflowId, workflowId),
               expectedUpdatedAt === null
                 ? isNull(workflowBlocks.updatedAt)
-                : eq(workflowBlocks.updatedAt, expectedUpdatedAt)
+                : updatedAtMatches(expectedUpdatedAt)
             )
           : and(eq(workflowBlocks.id, blockId), eq(workflowBlocks.workflowId, workflowId))
 
-        await db
+        const persisted = await db
           .update(workflowBlocks)
           .set({
             subBlocks: block.subBlocks,
@@ -209,6 +242,15 @@ export async function persistMigratedBlocks(
             updatedAt: new Date(),
           })
           .where(whereClause)
+          .returning({ id: workflowBlocks.id })
+
+        if (persisted.length === 0) {
+          logger.warn('Skipped persisting block migration (row changed since read or missing)', {
+            workflowId,
+            blockId,
+            expectedUpdatedAt,
+          })
+        }
       }
     }
   } catch (err) {
diff --git a/packages/workflow-persistence/src/subblocks.test.ts b/packages/workflow-persistence/src/subblocks.test.ts
new file mode 100644
index 00000000000..4abda21d97d
--- /dev/null
+++ b/packages/workflow-persistence/src/subblocks.test.ts
@@ -0,0 +1,121 @@
+import type { BlockState } from '@sim/workflow-types/workflow'
+import { describe, expect, it } from 'vitest'
+import { DEFAULT_SUBBLOCK_TYPE, mergeSubblockStateWithValues } from './subblocks'
+
+function buildBlock(subBlocks: BlockState['subBlocks']): BlockState {
+  return {
+    id: 'block-1',
+    type: 'api',
+    name: 'API',
+    position: { x: 0, y: 0 },
+    subBlocks,
+    outputs: {},
+    enabled: true,
+  } as BlockState
+}
+
+function buildBlocks(subBlocks: BlockState['subBlocks']): Record<string, BlockState> {
+  return { 'block-1': buildBlock(subBlocks) }
+}
+
+describe('mergeSubblockStateWithValues', () => {
+  it('overrides structure values with non-null store values', () => {
+    const blocks = buildBlocks({
+      channel: { id: 'channel', type: 'short-input', value: 'old-channel' },
+    })
+
+    const merged = mergeSubblockStateWithValues(blocks, {
+      'block-1': { channel: 'new-channel' },
+    })
+
+    expect(merged['block-1'].subBlocks.channel.value).toBe('new-channel')
+  })
+
+  it('overrides structure values with explicit null (cleared field)', () => {
+    const blocks = buildBlocks({
+      channel: { id: 'channel', type: 'short-input', value: 'old-channel' },
+    })
+
+    const merged = mergeSubblockStateWithValues(blocks, {
+      'block-1': { channel: null },
+    })
+
+    expect(merged['block-1'].subBlocks.channel.value).toBeNull()
+  })
+
+  it('keeps structure values when the key is absent from the values map', () => {
+    const blocks = buildBlocks({
+      channel: { id: 'channel', type: 'short-input', value: 'old-channel' },
+    })
+
+    const merged = mergeSubblockStateWithValues(blocks, { 'block-1': {} })
+
+    expect(merged['block-1'].subBlocks.channel.value).toBe('old-channel')
+  })
+
+  it('treats undefined values as absent', () => {
+    const blocks = buildBlocks({
+      channel: { id: 'channel', type: 'short-input', value: 'old-channel' },
+    })
+
+    const merged = mergeSubblockStateWithValues(blocks, {
+      'block-1': { channel: undefined },
+    })
+
+    expect(merged['block-1'].subBlocks.channel.value).toBe('old-channel')
+  })
+
+  it('does not create entries for null values missing from the structure', () => {
+    const blocks = buildBlocks({
+      channel: { id: 'channel', type: 'short-input', value: 'old-channel' },
+    })
+
+    const merged = mergeSubblockStateWithValues(blocks, {
+      'block-1': { webhookId: null },
+    })
+
+    expect(merged['block-1'].subBlocks.webhookId).toBeUndefined()
+  })
+
+  it('creates minimal entries for non-null values missing from the structure', () => {
+    const blocks = buildBlocks({
+      channel: { id: 'channel', type: 'short-input', value: 'old-channel' },
+    })
+
+    const merged = mergeSubblockStateWithValues(blocks, {
+      'block-1': { webhookId: 'wh-123' },
+    })
+
+    expect(merged['block-1'].subBlocks.webhookId).toEqual({
+      id: 'webhookId',
+      type: DEFAULT_SUBBLOCK_TYPE,
+      value: 'wh-123',
+    })
+  })
+
+  it('merges only the requested block when blockId is provided', () => {
+    const blocks: Record<string, BlockState> = {
+      'block-1': buildBlock({
+        channel: { id: 'channel', type: 'short-input', value: 'old-channel' },
+      }),
+      'block-2': buildBlock({
+        channel: { id: 'channel', type: 'short-input', value: 'other' },
+      }),
+    }
+
+    const merged = mergeSubblockStateWithValues(
+      blocks,
+      { 'block-1': { channel: null }, 'block-2': { channel: null } },
+      'block-1'
+    )
+
+    expect(Object.keys(merged)).toEqual(['block-1'])
+    expect(merged['block-1'].subBlocks.channel.value).toBeNull()
+  })
+
+  it('skips unknown block ids without throwing', () => {
+    const merged = mergeSubblockStateWithValues(buildBlocks({}), {}, 'missing-block')
+
+    expect(merged).toEqual({})
+  })
+})
diff --git a/packages/workflow-persistence/src/subblocks.ts b/packages/workflow-persistence/src/subblocks.ts
index 28501bf8f02..0109b4ceeee 100644
--- a/packages/workflow-persistence/src/subblocks.ts
+++ b/packages/workflow-persistence/src/subblocks.ts
@@ -39,7 +39,19 @@ export function mergeSubBlockValues(
 
 /**
  * Merges workflow block states with explicit subblock values while maintaining block structure.
- * Values that are null or undefined do not override existing subblock values.
+ *
+ * A value that is present in the map overrides the structure's value — including `null`,
+ * which represents an explicitly cleared field. The block structure's own copy of a value
+ * can be stale (it is only rewritten on hydration, while edits land in the values map), so
+ * skipping nulls here would resurrect the pre-clear value and make the merged state diverge
+ * from what is actually persisted.
+ *
+ * Two softening rules keep sparse maps safe:
+ * - `undefined` is treated as "no value recorded" and never overrides the structure.
+ * - `null` never creates an entry for a subblock missing from the structure; only non-null
+ *   structure-less values (e.g. runtime ids like `webhookId`/`triggerPath`) are added, with
+ *   a minimal default shape, so they survive serialization.
+ *
  * @param blocks - Block configurations from workflow state
  * @param subBlockValues - Subblock values keyed by blockId -> subBlockId -> value
  * @param blockId - Optional specific block ID to merge (merges all if not provided)
@@ -59,12 +71,14 @@ export function mergeSubblockStateWithValues(
       }
 
       const blockSubBlocks = block.subBlocks || {}
-      const blockValues = subBlockValues[id] || {}
-      const filteredValues = Object.fromEntries(
-        Object.entries(filterUndefined(blockValues)).filter(([, value]) => value !== null)
+      const definedValues = filterUndefined(subBlockValues[id] || {})
+      const mergeableValues = Object.fromEntries(
+        Object.entries(definedValues).filter(
+          ([subBlockId, value]) => value !== null || Object.hasOwn(blockSubBlocks, subBlockId)
+        )
       )
 
-      const mergedSubBlocks = mergeSubBlockValues(blockSubBlocks, filteredValues) as Record<
+      const mergedSubBlocks = mergeSubBlockValues(blockSubBlocks, mergeableValues) as Record<
         string,
         SubBlockState
       >
diff --git a/packages/workflow-persistence/vitest.config.ts b/packages/workflow-persistence/vitest.config.ts
new file mode 100644
index 00000000000..471771e48fe
--- /dev/null
+++ b/packages/workflow-persistence/vitest.config.ts
@@ -0,0 +1,9 @@
+import { defineConfig } from 'vitest/config'
+
+export default defineConfig({
+  test: {
+    globals: false,
+    environment: 'node',
+    include: ['src/**/*.test.ts'],
+  },
+})
diff --git a/packages/workflow-renderer/src/dimensions.ts b/packages/workflow-renderer/src/dimensions.ts
index 89a15c31b15..736e95b7727 100644
--- a/packages/workflow-renderer/src/dimensions.ts
+++ b/packages/workflow-renderer/src/dimensions.ts
@@ -31,17 +31,21 @@ export const CONTAINER_DIMENSIONS = {
 } as const
 
 /**
- * Handle position constants - must match CSS in workflow-block.tsx and subflow-node.tsx
+ * Handle position constants - must match CSS in workflow-block-view.tsx,
+ * sub-block-row-view.tsx, and subflow-node.tsx
  */
 export const HANDLE_POSITIONS = {
   /** Default Y offset from block top for source/target handles */
   DEFAULT_Y_OFFSET: 20,
   /** Error handle offset from block bottom */
   ERROR_BOTTOM_OFFSET: 17,
-  /** Condition handle starting Y offset */
-  CONDITION_START_Y: 60,
-  /** Height per condition row */
-  CONDITION_ROW_HEIGHT: 29,
+  /**
+   * Y of the first condition-row handle: 40px header + 1px divider +
+   * 8px content padding + half of the 20px row
+   */
+  CONDITION_START_Y: 59,
+  /** Row pitch: 20px row height (h-5) + 8px flex gap (gap-2) */
+  CONDITION_ROW_HEIGHT: 28,
   /** Subflow start handle Y offset (header 50px + pill offset 16px + pill center 14px) */
   SUBFLOW_START_Y_OFFSET: 80,
 } as const
diff --git a/packages/workflow-renderer/src/workflow-block/sub-block-row-view.tsx b/packages/workflow-renderer/src/workflow-block/sub-block-row-view.tsx
index 7be0b0bb7b6..87c4ac824b4 100644
--- a/packages/workflow-renderer/src/workflow-block/sub-block-row-view.tsx
+++ b/packages/workflow-renderer/src/workflow-block/sub-block-row-view.tsx
@@ -19,10 +19,15 @@ export interface SubBlockRowViewProps {
 /**
  * Pure renderer for a collapsed block's subblock summary row: a capitalized
  * title and its resolved display value.
+ *
+ * The fixed `h-5` row height is part of the handle-position contract —
+ * `HANDLE_POSITIONS.CONDITION_ROW_HEIGHT` in dimensions.ts assumes a 20px row
+ * plus the container's 8px gap, so condition/router source handles align with
+ * their rows.
  */
 export function SubBlockRowView({ title, displayValue, isMonospace }: SubBlockRowViewProps) {
   return (
-    <div className='flex items-center gap-2'>
+    <div className='flex h-5 items-center gap-2'>
       <OverflowSpan
         value={title}
         className='min-w-0 truncate text-[var(--text-tertiary)] text-sm capitalize'
diff --git a/scripts/check-api-validation-contracts.ts b/scripts/check-api-validation-contracts.ts
index dad531101fb..14a54b13f51 100644
--- a/scripts/check-api-validation-contracts.ts
+++ b/scripts/check-api-validation-contracts.ts
@@ -9,8 +9,8 @@ const QUERY_HOOKS_DIR = path.join(ROOT, 'apps/sim/hooks/queries')
 const SELECTOR_HOOKS_DIR = path.join(ROOT, 'apps/sim/hooks/selectors')
 
 const BASELINE = {
-  totalRoutes: 965,
-  zodRoutes: 965,
+  totalRoutes: 966,
+  zodRoutes: 966,
   nonZodRoutes: 0,
 } as const